Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssh: tcpip_tunnel_in callback function #9571

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ssh: tcpip_tunnel_in callback function #9571

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/ssh/src/ssh.hrl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -889,9 +889,11 @@ connection out of a [server](`daemon/2`). Disabled per default.
-doc """
Enables (`true`) or disables (`false`) the possibility to tunnel a TCP/IP
connection in to a [server](`daemon/2`). Disabled per default.

Set `Callback` function to allow/deny/log tunnel connections.
""".
-doc(#{group => <<"Daemon Options">>}).
-type tcpip_tunnel_in_daemon_option() :: {tcpip_tunnel_in, boolean()} .
-type tcpip_tunnel_in_daemon_option() :: {tcpip_tunnel_in, boolean() | Callback::fun((HostName::string(), inet:port_number()) -> boolean() | denied)} .

-doc """
Make the server (daemon) tell the client that the server accepts extension
Expand Down
16 changes: 13 additions & 3 deletions lib/ssh/src/ssh_connection.erl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -946,17 +946,27 @@ handle_msg(#ssh_msg_channel_open{channel_type = "direct-tcpip",
connection_supervisor = ConnectionSup
} = C,
server, _SSH) ->
HostName = binary_to_list(HostToConnect),
Allowed = case ?GET_OPT(tcpip_tunnel_in, Options) of
T when is_boolean(T) -> T;
AllowedFun when is_function(AllowedFun, 2) -> AllowedFun(HostName, PortToConnect)
end,
{ReplyMsg, NextChId} =
case ?GET_OPT(tcpip_tunnel_in, Options) of
%% May add more to the option, like allowed ip/port pairs to connect to
case Allowed of
denied ->
{channel_open_failure_msg(RemoteId,
?SSH_OPEN_ADMINISTRATIVELY_PROHIBITED,
"Not allowed", "en"),
ChId};

false ->
{channel_open_failure_msg(RemoteId,
?SSH_OPEN_CONNECT_FAILED,
"Forwarding disabled", "en"),
ChId};

true ->
case gen_tcp:connect(binary_to_list(HostToConnect), PortToConnect,
case gen_tcp:connect(HostName, PortToConnect,
[{active,false}, binary]) of
{ok,Sock} ->
{ok,Pid} = ssh_connection_sup:start_channel(server, ConnectionSup, self(),
Expand Down
2 changes: 1 addition & 1 deletion lib/ssh/src/ssh_options.erl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,7 +454,7 @@ default(server) ->

tcpip_tunnel_in =>
#{default => false,
chk => fun(V) -> erlang:is_boolean(V) end,
chk => fun(V) -> check_function2(V) orelse erlang:is_boolean(V) end,
class => user_option
},

Expand Down
57 changes: 57 additions & 0 deletions lib/ssh/test/ssh_to_openssh_SUITE.erl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@
exec_direct_with_io_in_sshc/1,
exec_with_io_in_sshc/1,
tunnel_in_erlclient_erlserver/1,
tunnel_in_erlclient_erlserver_allowed/1,
tunnel_in_erlclient_erlserver_denied/1,
tunnel_in_erlclient_openssh_server/1,
tunnel_in_non_erlclient_erlserver/1,
tunnel_out_erlclient_erlserver/1,
Expand Down Expand Up @@ -74,6 +76,8 @@ all() ->

groups() ->
[{erlang_client, [], [tunnel_in_erlclient_erlserver,
tunnel_in_erlclient_erlserver_allowed,
tunnel_in_erlclient_erlserver_denied,
tunnel_out_erlclient_erlserver,
{group, tunnel_distro_server},
erlang_shell_client_openssh_server,
Expand Down Expand Up @@ -414,6 +418,59 @@ tunnel_in_erlclient_erlserver(Config) ->

test_tunneling(ToSock, ListenHost, ListenPort).

%%--------------------------------------------------------------------
tunnel_in_erlclient_erlserver_allowed(Config) ->
SystemDir = proplists:get_value(data_dir, Config),
UserDir = proplists:get_value(priv_dir, Config),
{ToSock, ToHost, ToPort} = tunneling_listner(),
Self = self(),
AllowedFun = fun(HostToConnect, PortToConnect) ->
Self ! {allowed, {HostToConnect, PortToConnect}},
true
end,
{_Pid, Host, Port} = ssh_test_lib:daemon([{tcpip_tunnel_in, AllowedFun},
{system_dir, SystemDir},
{user_dir, UserDir},
{user_passwords, [{"foo", "bar"}]},
{failfun, fun ssh_test_lib:failfun/2}]),
C = ssh_test_lib:connect(Host, Port, [{silently_accept_hosts, true},
{user_dir, UserDir},
{user,"foo"},{password,"bar"},
{user_interaction, false}]),

ListenHost = inet:ntoa({127,0,0,1}),
{ok,ListenPort} = ssh:tcpip_tunnel_to_server(C, ListenHost,0, ToHost, ToPort, 2000),
test_tunneling(ToSock, ListenHost, ListenPort),
{allowed, {ListenHost, ToPort}} = receive X -> X after 500 -> timeout end,
{allowed, {ListenHost, ToPort}} = receive Y -> Y after 500 -> timeout end.

%%--------------------------------------------------------------------
tunnel_in_erlclient_erlserver_denied(Config) ->
SystemDir = proplists:get_value(data_dir, Config),
UserDir = proplists:get_value(priv_dir, Config),
{ToSock, ToHost, ToPort} = tunneling_listner(),
Self = self(),
DeniedFun = fun(HostToConnect, PortToConnect) ->
Self ! {denied, {HostToConnect, PortToConnect}},
denied
end,
{_Pid, Host, Port} = ssh_test_lib:daemon([{tcpip_tunnel_in, DeniedFun},
{system_dir, SystemDir},
{user_dir, UserDir},
{user_passwords, [{"foo", "bar"}]},
{failfun, fun ssh_test_lib:failfun/2}]),
C = ssh_test_lib:connect(Host, Port, [{silently_accept_hosts, true},
{user_dir, UserDir},
{user,"foo"},{password,"bar"},
{user_interaction, false}]),

ListenHost = inet:ntoa({127,0,0,1}),
{ok,ListenPort} = ssh:tcpip_tunnel_to_server(C, ListenHost,0, ToHost, ToPort, 2000),
{ok, Sock} = gen_tcp:connect(ListenHost, ListenPort, [{active, false}]),
{denied, {ListenHost, ToPort}} = receive Y -> Y after 500 -> timeout end,
{error, timeout} = gen_tcp:accept(ToSock, 2000),
{error, closed} = gen_tcp:recv(Sock, 0, 5000).

%%--------------------------------------------------------------------
tunnel_in_erlclient_openssh_server(_Config) ->
C = ssh_test_lib:connect(?SSH_DEFAULT_PORT, []),
Expand Down
Loading