Nicola Murino
7d695da948
ForwardToAgent and ForwardToRemote only read the main stream of the auth-agent@openssh.com channels they accept. If a peer sends data on the channel's extended (stderr) stream the bytes accumulate in the client-side extPending buffer and the receive window is never replenished, because the window is only adjusted as a side effect of ReadExtended. That can pin up to channelWindowSize (2 MiB) of memory per channel and silently stalls any stderr traffic once the window is exhausted. The auth-agent protocol does not use stderr, so a well-behaved peer never sends anything on it. To stay tolerant of misbehaving peers without leaving the channel half-stuck, drain the stderr stream into io.Discard, mirroring the existing DiscardRequests pattern. The goroutine exits when the channel is closed because Stderr().Read returns io.EOF. Add a regression test that opens an agent-forwarding channel and writes more than the default window on the stderr stream from the server side. Without the fix the write blocks once the remote window is exhausted; with the fix the bytes are drained and the agent stream remains usable. Change-Id: Iadf8ea6ca726c058421bbc39f92e0100579fda17 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/783720 Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
106 lines
2.2 KiB
Go
106 lines
2.2 KiB
Go
// Copyright 2014 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package agent
|
|
|
|
import (
|
|
"errors"
|
|
"io"
|
|
"net"
|
|
"sync"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
// RequestAgentForwarding sets up agent forwarding for the session.
|
|
// ForwardToAgent or ForwardToRemote should be called to route
|
|
// the authentication requests.
|
|
func RequestAgentForwarding(session *ssh.Session) error {
|
|
ok, err := session.SendRequest("auth-agent-req@openssh.com", true, nil)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !ok {
|
|
return errors.New("forwarding request denied")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ForwardToAgent routes authentication requests to the given keyring.
|
|
func ForwardToAgent(client *ssh.Client, keyring Agent) error {
|
|
channels := client.HandleChannelOpen(channelType)
|
|
if channels == nil {
|
|
return errors.New("agent: already have handler for " + channelType)
|
|
}
|
|
|
|
go func() {
|
|
for ch := range channels {
|
|
channel, reqs, err := ch.Accept()
|
|
if err != nil {
|
|
continue
|
|
}
|
|
go ssh.DiscardRequests(reqs)
|
|
go io.Copy(io.Discard, channel.Stderr())
|
|
go func() {
|
|
ServeAgent(keyring, channel)
|
|
channel.Close()
|
|
}()
|
|
}
|
|
}()
|
|
return nil
|
|
}
|
|
|
|
const channelType = "auth-agent@openssh.com"
|
|
|
|
// ForwardToRemote routes authentication requests to the ssh-agent
|
|
// process serving on the given unix socket.
|
|
func ForwardToRemote(client *ssh.Client, addr string) error {
|
|
channels := client.HandleChannelOpen(channelType)
|
|
if channels == nil {
|
|
return errors.New("agent: already have handler for " + channelType)
|
|
}
|
|
conn, err := net.Dial("unix", addr)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
conn.Close()
|
|
|
|
go func() {
|
|
for ch := range channels {
|
|
channel, reqs, err := ch.Accept()
|
|
if err != nil {
|
|
continue
|
|
}
|
|
go ssh.DiscardRequests(reqs)
|
|
go io.Copy(io.Discard, channel.Stderr())
|
|
go forwardUnixSocket(channel, addr)
|
|
}
|
|
}()
|
|
return nil
|
|
}
|
|
|
|
func forwardUnixSocket(channel ssh.Channel, addr string) {
|
|
conn, err := net.Dial("unix", addr)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
var wg sync.WaitGroup
|
|
wg.Add(2)
|
|
go func() {
|
|
io.Copy(conn, channel)
|
|
conn.(*net.UnixConn).CloseWrite()
|
|
wg.Done()
|
|
}()
|
|
go func() {
|
|
io.Copy(channel, conn)
|
|
channel.CloseWrite()
|
|
wg.Done()
|
|
}()
|
|
|
|
wg.Wait()
|
|
conn.Close()
|
|
channel.Close()
|
|
}
|