212 lines
6.3 KiB
Go
212 lines
6.3 KiB
Go
package server
|
|
|
|
import (
|
|
"crypto/aes"
|
|
"crypto/cipher"
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
"sync"
|
|
|
|
"github.com/x-grk/longpolling-remote-access/internal/proto"
|
|
)
|
|
|
|
// Saved SSH hosts: each user keeps their own list of hosts with the way in -
|
|
// password or key - so the SSH dialog connects with one choice. The secret is
|
|
// sealed with AES-256-GCM under the server's key, which lives apart from the
|
|
// database (LPRA_SECRET_KEY, or a file beside the database made on first
|
|
// use), and bound to its owner: a row read out of the database, or moved to
|
|
// another user, opens to nobody.
|
|
|
|
type savedHost struct {
|
|
ID int64 `json:"id"`
|
|
Label string `json:"label"`
|
|
Host string `json:"host"`
|
|
Port int `json:"port"`
|
|
User string `json:"user"`
|
|
Auth string `json:"auth"` // password, key or agent
|
|
}
|
|
|
|
type sshSecret struct {
|
|
Password string `json:"password,omitempty"`
|
|
Key string `json:"key,omitempty"`
|
|
Passphrase string `json:"passphrase,omitempty"`
|
|
}
|
|
|
|
var (
|
|
secretKeyOnce sync.Once
|
|
secretKey []byte
|
|
secretKeyErr error
|
|
)
|
|
|
|
// sealKey is the server's key for saved secrets.
|
|
func (s *Server) sealKey() ([]byte, error) {
|
|
secretKeyOnce.Do(func() {
|
|
if v := strings.TrimSpace(os.Getenv("LPRA_SECRET_KEY")); v != "" {
|
|
k, err := hex.DecodeString(v)
|
|
if err != nil || len(k) != 32 {
|
|
k, err = base64.StdEncoding.DecodeString(v)
|
|
}
|
|
if err != nil || len(k) != 32 {
|
|
secretKeyErr = errors.New("LPRA_SECRET_KEY: нужны 32 байта (hex или base64)")
|
|
return
|
|
}
|
|
secretKey = k
|
|
return
|
|
}
|
|
path := s.db.path + ".key"
|
|
if b, err := os.ReadFile(path); err == nil {
|
|
k, err := hex.DecodeString(strings.TrimSpace(string(b)))
|
|
if err != nil || len(k) != 32 {
|
|
secretKeyErr = errors.New(path + ": испорчен ключ")
|
|
return
|
|
}
|
|
secretKey = k
|
|
return
|
|
}
|
|
k := make([]byte, 32)
|
|
_, _ = rand.Read(k)
|
|
if err := os.WriteFile(path, []byte(hex.EncodeToString(k)+"\n"), 0o600); err != nil {
|
|
secretKeyErr = err
|
|
return
|
|
}
|
|
secretKey = k
|
|
})
|
|
return secretKey, secretKeyErr
|
|
}
|
|
|
|
func (s *Server) seal(owner int64, plain []byte) (string, error) {
|
|
k, err := s.sealKey()
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
blk, _ := aes.NewCipher(k)
|
|
g, _ := cipher.NewGCM(blk)
|
|
nonce := make([]byte, g.NonceSize())
|
|
_, _ = rand.Read(nonce)
|
|
out := g.Seal(nonce, nonce, plain, []byte("ssh:"+strconv.FormatInt(owner, 10)))
|
|
return base64.StdEncoding.EncodeToString(out), nil
|
|
}
|
|
|
|
func (s *Server) open(owner int64, sealed string) ([]byte, error) {
|
|
k, err := s.sealKey()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
b, err := base64.StdEncoding.DecodeString(sealed)
|
|
blk, _ := aes.NewCipher(k)
|
|
g, _ := cipher.NewGCM(blk)
|
|
if err != nil || len(b) < g.NonceSize() {
|
|
return nil, errors.New("испорчена запись")
|
|
}
|
|
return g.Open(nil, b[:g.NonceSize()], b[g.NonceSize():], []byte("ssh:"+strconv.FormatInt(owner, 10)))
|
|
}
|
|
|
|
func (s *Server) saveSSHHost(owner int64, h savedHost, sec sshSecret) (int64, error) {
|
|
plain, _ := json.Marshal(sec)
|
|
sealed, err := s.seal(owner, plain)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return s.db.sql.insert(`INSERT INTO ssh_hosts (admin_id, label, host, port, login, auth, secret) VALUES (?, ?, ?, ?, ?, ?, ?)`,
|
|
owner, h.Label, h.Host, h.Port, h.User, h.Auth, sealed)
|
|
}
|
|
|
|
func (s *Server) listSSHHosts(owner int64) []savedHost {
|
|
rows, err := s.db.sql.Query(`SELECT id, label, host, port, login, auth FROM ssh_hosts WHERE admin_id = ? ORDER BY label, host`, owner)
|
|
list := []savedHost{}
|
|
if err != nil {
|
|
return list
|
|
}
|
|
defer rows.Close()
|
|
for rows.Next() {
|
|
var h savedHost
|
|
if rows.Scan(&h.ID, &h.Label, &h.Host, &h.Port, &h.User, &h.Auth) == nil {
|
|
list = append(list, h)
|
|
}
|
|
}
|
|
return list
|
|
}
|
|
|
|
// fillSaved puts the saved host t.Saved of owner - address and way in - into
|
|
// t, which then goes on as if typed in.
|
|
func (s *Server) fillSaved(owner int64, t *proto.SSHTarget) error {
|
|
if t == nil || t.Saved == 0 {
|
|
return nil
|
|
}
|
|
var h savedHost
|
|
var sealed string
|
|
err := s.db.sql.QueryRow(`SELECT host, port, login, auth, secret FROM ssh_hosts WHERE id = ? AND admin_id = ?`, t.Saved, owner).
|
|
Scan(&h.Host, &h.Port, &h.User, &h.Auth, &sealed)
|
|
if err != nil {
|
|
return errors.New("сохранённый хост не найден")
|
|
}
|
|
plain, err := s.open(owner, sealed)
|
|
if err != nil {
|
|
return errors.New("сохранённый хост не расшифровался")
|
|
}
|
|
var sec sshSecret
|
|
_ = json.Unmarshal(plain, &sec)
|
|
*t = proto.SSHTarget{Host: h.Host, Port: h.Port, User: h.User, Password: sec.Password, Key: sec.Key, Passphrase: sec.Passphrase}
|
|
return nil
|
|
}
|
|
|
|
// GET /api/panel/ssh/hosts - the user's saved hosts, without secrets.
|
|
func (s *Server) handleSSHHosts(w http.ResponseWriter, r *http.Request) {
|
|
writeJSON(w, s.listSSHHosts(s.currentAdmin(r).ID))
|
|
}
|
|
|
|
// POST /api/panel/ssh/hosts - save a host: {label, host, port, user, auth,
|
|
// password | key, passphrase}.
|
|
func (s *Server) handleSSHHostAdd(w http.ResponseWriter, r *http.Request) {
|
|
var in struct {
|
|
savedHost
|
|
sshSecret
|
|
}
|
|
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&in); err != nil {
|
|
writeJSON(w, map[string]any{"ok": false, "error": "плохой запрос"})
|
|
return
|
|
}
|
|
h := in.savedHost
|
|
h.Host, h.User, h.Label = strings.TrimSpace(h.Host), strings.TrimSpace(h.User), strings.TrimSpace(h.Label)
|
|
if h.Port == 0 {
|
|
h.Port = 22
|
|
}
|
|
if h.Host == "" || h.User == "" || h.Port < 1 || h.Port > 65535 || strings.ContainsAny(h.Host+h.User, " \t\r\n/") {
|
|
writeJSON(w, map[string]any{"ok": false, "error": "нужны хост, порт и пользователь"})
|
|
return
|
|
}
|
|
if h.Label == "" {
|
|
h.Label = h.User + "@" + h.Host
|
|
}
|
|
sec := in.sshSecret
|
|
switch h.Auth {
|
|
case "key":
|
|
sec.Password = ""
|
|
case "agent":
|
|
sec = sshSecret{}
|
|
default:
|
|
h.Auth = "password"
|
|
sec.Key, sec.Passphrase = "", ""
|
|
}
|
|
id, err := s.saveSSHHost(s.currentAdmin(r).ID, h, sec)
|
|
if err != nil {
|
|
writeJSON(w, map[string]any{"ok": false, "error": err.Error()})
|
|
return
|
|
}
|
|
writeJSON(w, map[string]any{"ok": true, "id": id})
|
|
}
|
|
|
|
// POST /api/panel/ssh/hosts/{hid}/delete
|
|
func (s *Server) handleSSHHostDelete(w http.ResponseWriter, r *http.Request) {
|
|
id, _ := strconv.ParseInt(r.PathValue("hid"), 10, 64)
|
|
_, _ = s.db.sql.Exec(`DELETE FROM ssh_hosts WHERE id = ? AND admin_id = ?`, id, s.currentAdmin(r).ID)
|
|
writeJSON(w, map[string]any{"ok": true})
|
|
}
|