183 lines
8.4 KiB
JavaScript
183 lines
8.4 KiB
JavaScript
'use strict';
|
||
|
||
/*
|
||
* Clusev terminal sidecar.
|
||
*
|
||
* php-fpm cannot hold an interactive PTY, so this small Node service does it. The browser opens a
|
||
* WebSocket (proxied by nginx/Caddy at /terminal/ws) carrying a single-use token. The sidecar
|
||
* exchanges that token at the Clusev app's internal resolve endpoint (authenticated by a shared
|
||
* secret over the private Docker network) for a connection spec, then:
|
||
* - kind=server → opens an SSH PTY to the target server (ssh2) with the decrypted credential, or
|
||
* - kind=host → spawns a local shell PTY (node-pty) in this sidecar ("the Clusev terminal").
|
||
* It then forwards bytes + window resizes both ways. Credentials never reach the browser; the token
|
||
* is single-use and short-lived; the sidecar is only reachable behind the app's reverse proxy.
|
||
*/
|
||
|
||
const http = require('http');
|
||
const crypto = require('crypto');
|
||
const { WebSocketServer } = require('ws');
|
||
const { Client } = require('ssh2');
|
||
|
||
const PORT = parseInt(process.env.TERMINAL_PORT || '3000', 10);
|
||
const APP_URL = (process.env.APP_INTERNAL_URL || 'http://app:80').replace(/\/$/, '');
|
||
const SECRET = process.env.TERMINAL_SIDECAR_SECRET || '';
|
||
|
||
const server = http.createServer((req, res) => {
|
||
res.writeHead(200, { 'Content-Type': 'text/plain' });
|
||
res.end('clusev-terminal-sidecar\n');
|
||
});
|
||
|
||
// No path filter: only /terminal/ws is routed here by the reverse proxy, so every upgrade is a
|
||
// terminal session. The token comes from the query string.
|
||
const wss = new WebSocketServer({ server, maxPayload: 1 << 20 });
|
||
|
||
function send(ws, obj) {
|
||
if (ws.readyState === 1) {
|
||
try { ws.send(JSON.stringify(obj)); } catch (_) { /* socket gone */ }
|
||
}
|
||
}
|
||
|
||
async function resolve(token) {
|
||
const ctrl = new AbortController();
|
||
const t = setTimeout(() => ctrl.abort(), 5000);
|
||
try {
|
||
const r = await fetch(`${APP_URL}/_internal/terminal/resolve`, {
|
||
method: 'POST',
|
||
headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'X-Sidecar-Secret': SECRET },
|
||
body: JSON.stringify({ token }),
|
||
signal: ctrl.signal,
|
||
});
|
||
if (!r.ok) throw new Error('resolve ' + r.status);
|
||
return await r.json();
|
||
} finally {
|
||
clearTimeout(t);
|
||
}
|
||
}
|
||
|
||
// Client → sidecar messages: {type:'data',data} keystrokes, {type:'resize',cols,rows} window change.
|
||
function bindInput(ws, io) {
|
||
ws.on('message', (raw) => {
|
||
let m;
|
||
try { m = JSON.parse(raw.toString()); } catch (_) { return; }
|
||
if (m.type === 'data' && typeof m.data === 'string') io.write(m.data);
|
||
else if (m.type === 'resize') io.resize(Math.max(1, m.cols | 0), Math.max(1, m.rows | 0));
|
||
});
|
||
}
|
||
|
||
// Parse the TOFU-pinned host key the app sends (phpseclib's "<algo> <base64>" string) into the raw
|
||
// wire-format key for comparison with what ssh2 presents. Returns:
|
||
// null → no pin configured (empty/absent) → accept, TOFU first-use
|
||
// false → a pin IS present but is malformed/undecodable → FAIL CLOSED (never silently unpin)
|
||
// Buffer → the pinned key to enforce
|
||
function parseHostKeyPin(hostKey) {
|
||
if (typeof hostKey !== 'string' || hostKey.trim() === '') return null; // no pin
|
||
const parts = hostKey.trim().split(/\s+/);
|
||
const b64 = (parts.length >= 2 ? parts[1] : parts[0]) || '';
|
||
if (b64 === '') return false;
|
||
let buf;
|
||
try { buf = Buffer.from(b64, 'base64'); } catch (_) { return false; }
|
||
// Buffer.from is lenient (skips invalid chars); re-encode and compare to reject non-canonical/garbage.
|
||
if (buf.length === 0 || buf.toString('base64').replace(/=+$/, '') !== b64.replace(/=+$/, '')) return false;
|
||
return buf;
|
||
}
|
||
|
||
function startSsh(ws, spec, size) {
|
||
const conn = new Client();
|
||
let stream = null;
|
||
const pin = parseHostKeyPin(spec.host_key); // null | false | Buffer
|
||
|
||
conn.on('ready', () => {
|
||
conn.shell({ term: 'xterm-256color', cols: size.cols, rows: size.rows }, (err, s) => {
|
||
if (err) { send(ws, { type: 'error', data: 'PTY: ' + err.message }); conn.end(); return; }
|
||
stream = s;
|
||
send(ws, { type: 'ready' });
|
||
s.on('data', (d) => send(ws, { type: 'data', data: d.toString('utf8') }));
|
||
if (s.stderr) s.stderr.on('data', (d) => send(ws, { type: 'data', data: d.toString('utf8') }));
|
||
s.on('close', () => conn.end());
|
||
bindInput(ws, {
|
||
write: (d) => { try { s.write(d); } catch (_) {} },
|
||
resize: (c, r) => { try { s.setWindow(r, c, 0, 0); } catch (_) {} },
|
||
});
|
||
});
|
||
});
|
||
conn.on('error', (e) => { send(ws, { type: 'error', data: 'SSH: ' + e.message }); try { ws.close(); } catch (_) {} });
|
||
conn.on('close', () => { try { ws.close(); } catch (_) {} });
|
||
// Some hosts negotiate the password via keyboard-interactive rather than the password method.
|
||
conn.on('keyboard-interactive', (name, instr, lang, prompts, finish) => finish(prompts.map(() => spec.secret || '')));
|
||
ws.on('close', () => { try { if (stream) stream.close(); } catch (_) {} conn.end(); });
|
||
|
||
const cfg = { host: spec.host, port: spec.port || 22, username: spec.username, readyTimeout: 15000, keepaliveInterval: 20000 };
|
||
// Pin the host key against the app's TOFU record — refuse a mismatch (MITM) before sending the
|
||
// credential. null = no pin (Clusev host / never-contacted server) → accept like TOFU first use;
|
||
// false = a stored-but-malformed pin → FAIL CLOSED (a corrupted record must not silently unpin).
|
||
cfg.hostVerifier = (key, cb) => {
|
||
if (pin === null) { if (cb) cb(true); return true; }
|
||
if (pin === false) {
|
||
send(ws, { type: 'error', data: 'Host-Key-Pin ungültig — Verbindung abgebrochen.' });
|
||
if (cb) cb(false);
|
||
|
||
return false;
|
||
}
|
||
const buf = Buffer.isBuffer(key) ? key : Buffer.from(key || '');
|
||
const ok = buf.length === pin.length && crypto.timingSafeEqual(buf, pin);
|
||
if (!ok) send(ws, { type: 'error', data: 'Host-Key stimmt nicht — möglicher MITM. Verbindung abgebrochen.' });
|
||
if (cb) cb(ok);
|
||
return ok;
|
||
};
|
||
if (spec.auth_type === 'key') {
|
||
cfg.privateKey = spec.secret;
|
||
if (spec.passphrase) cfg.passphrase = spec.passphrase;
|
||
} else {
|
||
cfg.password = spec.secret;
|
||
cfg.tryKeyboard = true;
|
||
}
|
||
try { conn.connect(cfg); } catch (e) { send(ws, { type: 'error', data: 'SSH: ' + e.message }); ws.close(); }
|
||
}
|
||
|
||
wss.on('connection', async (ws, req) => {
|
||
// Same-origin guard (defence in depth): the reverse proxy forwards the panel's real Host (nginx
|
||
// `Host $host`; Caddy passes it through), so a browser's Origin must match it. A cross-site page
|
||
// could never read a token anyway, but this rejects any future leakage being replayed off-origin.
|
||
// Non-browser clients send no Origin and are still gated by the single-use token + shared secret.
|
||
const origin = req.headers.origin;
|
||
if (origin) {
|
||
// Compare HOSTNAME only — the proxy's forwarded Host (nginx `$host`) carries no port, while the
|
||
// browser's Origin does on a non-standard panel port (APP_PORT≠80/443). Stripping the port both
|
||
// sides keeps the hostname boundary (the security-relevant part) without false-rejecting those.
|
||
const reqHost = (req.headers.host || '').replace(/:\d+$/, '');
|
||
let sameOrigin = false;
|
||
try { sameOrigin = new URL(origin).hostname === reqHost; } catch (_) {}
|
||
if (!sameOrigin) { send(ws, { type: 'error', data: 'Ungültige Herkunft.' }); ws.close(); return; }
|
||
}
|
||
|
||
let token = '';
|
||
const size = { cols: 80, rows: 24 };
|
||
try {
|
||
const q = new URL(req.url, 'http://x').searchParams;
|
||
token = q.get('token') || '';
|
||
// Open the PTY at the browser's reported grid so the first screenful matches the viewport. Clamp
|
||
// to sane bounds (a bad/huge value must never reach pty/ssh); fall back to 80×24 when absent.
|
||
const c = parseInt(q.get('cols'), 10);
|
||
const r = parseInt(q.get('rows'), 10);
|
||
if (c >= 1 && c <= 1000) size.cols = c;
|
||
if (r >= 1 && r <= 1000) size.rows = r;
|
||
} catch (_) {}
|
||
if (!token || !SECRET) { send(ws, { type: 'error', data: 'Sitzung ungültig.' }); ws.close(); return; }
|
||
|
||
let spec;
|
||
try {
|
||
spec = await resolve(token);
|
||
} catch (e) {
|
||
send(ws, { type: 'error', data: 'Sitzung abgelaufen oder ungültig.' });
|
||
ws.close();
|
||
return;
|
||
}
|
||
|
||
// resolve() always returns kind:'server' (the host terminal resolves to an SSH login too), so the
|
||
// sidecar only ever opens an SSH PTY — there is no local-shell path.
|
||
if (spec && spec.kind === 'server' && spec.host && spec.username) startSsh(ws, spec, size);
|
||
else { send(ws, { type: 'error', data: 'Kein gültiges Ziel.' }); ws.close(); }
|
||
});
|
||
|
||
server.listen(PORT, '0.0.0.0', () => console.log(`clusev-terminal-sidecar listening on :${PORT}`));
|