server.go

// Copyright 2016 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// TODO: High-level file comment.
package main

import (
	"bufio"
	"crypto/rand"
	"crypto/rsa"
	"fmt"
	"golang.org/x/crypto/ssh"
	"io"
	"net"
	"os"
	"strconv"
	"strings"
)

var (
	AllowAnonymous = false
)

// Manage the SSH Server
type Server struct {
	ServerConfig   ssh.ServerConfig
	Socket         net.Listener
	AuthorizedKeys map[string]bool
	Credentials map[string]string
	stop           chan bool
	done           chan bool
}

var keyNames = []string{
	"ssh_host_dsa_key",
	"ssh_host_ecdsa_key",
	"ssh_host_rsa_key",
}
/*
cd config
ssh-keygen -q -N "" -t rsa -b 4096 -f ./ssh_host_rsa_key
ssh-keygen -q -N "" -t dsa -b 1024 -f ./ssh_host_dsa_key
ssh-keygen -q -N "" -t ecdsa -b 521 -f ./ssh_host_ecdsa_key
*/


func NewServer() *Server {
	s := &Server{}
	s.AuthorizedKeys = make(map[string]bool)
	s.Credentials = make(map[string]string)
	s.ServerConfig.NoClientAuth= AllowAnonymous
	s.ServerConfig.MaxAuthTries = 10
	s.ServerConfig.PasswordCallback = s.VerifyPassword
	s.ServerConfig.PublicKeyCallback = s.VerifyPublicKey
	s.ServerConfig.BannerCallback = s.Banner
	s.stop = make(chan bool)
	s.done = make(chan bool, 1)
	return s
}

func (s *Server) listen(port int16) error {
	sPort := ":" + strconv.Itoa(int(port))
	if sock, err := net.Listen("tcp", sPort); err != nil {
		dbg.Debug("Unable to listen: %v", err)
		return err
	} else {
		dbg.Debug("Listening on %s", sPort)
		s.Socket = sock
	}
	return nil
}

func (s *Server) acceptChannel() <-chan net.Conn {
	c := make(chan net.Conn)
	go func() {
		defer close(c)
		for {
			conn, err := s.Socket.Accept()
			if err != nil {
				dbg.Debug("Unable to accept: %v", err)
				return
			}
			dbg.Debug("Accepted connection from: %s", conn.RemoteAddr())
			c <- conn
		}
	}()
	return c
}

func (s *Server) handleConn(conn net.Conn) {
	sConn, err := NewServerConn(conn, s)
	if err != nil {
		if err == io.EOF {
			dbg.Debug("Connection closed by remote host.")
			return
		}
		dbg.Debug("Unable to negotiate SSH: %v", err)
		return
	}
	dbg.Debug("Authenticated client from: %s", sConn.RemoteAddr())

	go sConn.HandleConn()
}

func (s *Server) serveLoop() error {
	acceptChan := s.acceptChannel()
	defer func() {
		dbg.Debug("done serveLoop")
		s.Socket.Close()
		s.done <- true
	}()
	for {
		dbg.Debug("select...")
		select {
		case conn, ok := <-acceptChan:
			if ok {
				s.handleConn(conn)
			} else {
				dbg.Debug("failed to accept")
				acceptChan = nil
				return nil
			}
		case <-s.stop:
			dbg.Debug("Stop signal received, stopping.")
			return nil
		}
	}
	return nil
}

func (s *Server) ListenAndServe(port int16) (error, func()) {
	if err := s.listen(port); err != nil {
		return err, nil
	}
	go s.serveLoop()
	return nil, s.Stop
}

func (s *Server) ListenAndServeForever(port int16) error {
	if err, _ := s.ListenAndServe(port); err != nil {
		return err
	}
	s.Wait()
	return nil
}

// Wait for server shutdown
func (s *Server) Wait() {
	dbg.Debug("Waiting for shutdown.")
	<-s.done
}

// Ask for shutdown
func (s *Server) Stop() {
	dbg.Debug("requesting shutdown.")
	s.stop <- true
	close(s.stop)
}

func (s *Server) AddAuthorizedKeys(keyData []byte) {
	for len(keyData) > 0 {
		newKey, _, _, left, err := ssh.ParseAuthorizedKey(keyData)
		keyData = left
		if err != nil {
			dbg.Debug("Error parsing key: %v", err)
			break
		}
		s.AuthorizedKeys[string(newKey.Marshal())] = true
	}
}

func (s *Server) AddCredentials( user string, password string ) {
	dbg.Debug("Add credentials for %s", user)
	s.Credentials[user] = password
}

func (s *Server) AddCredentialsFromFile( filename string ) {
    nb := 0
    file, err := os.Open(filename)
    if err != nil {
        s.AddCredentials("user","pass")
        fmt.Println(err)
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
	words := strings.Fields(scanner.Text())
        s.AddCredentials(words[0],words[1])
	nb = nb + 1
    }
    if( nb == 0 ) { s.AddCredentials("user","pass") }
    if err := scanner.Err(); err != nil {
        fmt.Println(err)
    }
}

func (s *Server) VerifyPublicKey(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
	keyStr := string(key.Marshal())
	if _, ok := s.AuthorizedKeys[keyStr]; !ok {
		dbg.Debug("Key not found!")
		return nil, fmt.Errorf("No valid key found.")
	}
	dbg.Debug("Authentication with public key")
	return &ssh.Permissions{}, nil
}

func (s *Server) AddHostkey(keyData []byte) error {
	key, err := ssh.ParsePrivateKey(keyData)
	if err == nil {
		s.ServerConfig.AddHostKey(key)
		return nil
	}
	return err
}

func (s *Server) RandomHostkey() error {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return err
	}
	signer, err := ssh.NewSignerFromSigner(key)
	if err != nil {
		return err
	}
	s.ServerConfig.AddHostKey(signer)
	return nil
}

func (s *Server) Banner(conn ssh.ConnMetadata) (string) {
	return "This is sshdog\nAvailable authentication methods:\n  - password\n  - public key\n"
}

func (s *Server) VerifyPassword(conn ssh.ConnMetadata, password []byte)  (*ssh.Permissions, error) {
	if pass,ok := s.Credentials[conn.User()]; !ok || pass!=string(password) {
		dbg.Debug( "Wrong password" )
		return nil, fmt.Errorf("password rejected for %q", conn.User())
	}
	dbg.Debug("Authentication with password")
	return &ssh.Permissions{}, nil
}