func (sshClient *sshClient) authLogCallback(conn ssh.ConnMetadata, method string, err error) {
if err != nil {
if sshClient.sshServer.config.UseFail2Ban() {
clientIPAddress := psiphon.IPAddressFromAddr(conn.RemoteAddr())
if clientIPAddress != "" {
LogFail2Ban(clientIPAddress)
}
}
log.WithContextFields(LogFields{"error": err, "method": method}).Warning("authentication failed")
} else {
log.WithContextFields(LogFields{"error": err, "method": method}).Info("authentication success")
}
}
func (sshClient *sshClient) authLogCallback(conn ssh.ConnMetadata, method string, err error) {
if err != nil {
if method == "none" && err.Error() == "no auth passed yet" {
// In this case, the callback invocation is noise from auth negotiation
return
}
if sshClient.sshServer.support.Config.UseFail2Ban() {
clientIPAddress := psiphon.IPAddressFromAddr(conn.RemoteAddr())
if clientIPAddress != "" {
LogFail2Ban(clientIPAddress)
}
}
log.WithContextFields(LogFields{"error": err, "method": method}).Error("authentication failed")
} else {
log.WithContextFields(LogFields{"error": err, "method": method}).Debug("authentication success")
}
}
func (sshServer *sshServer) handleClient(tcpConn *net.TCPConn) {
sshClient := &sshClient{
sshServer: sshServer,
startTime: time.Now(),
geoIPData: GeoIPLookup(psiphon.IPAddressFromAddr(tcpConn.RemoteAddr())),
}
sshClient.trafficRules = sshServer.config.GetTrafficRules(sshClient.geoIPData.Country)
// Wrap the base TCP connection with an IdleTimeoutConn which will terminate
// the connection if no data is received before the deadline. This timeout is
// in effect for the entire duration of the SSH connection. Clients must actively
// use the connection or send SSH keep alive requests to keep the connection
// active.
conn := psiphon.NewIdleTimeoutConn(tcpConn, SSH_CONNECTION_READ_DEADLINE, false)
// Run the initial [obfuscated] SSH handshake in a goroutine so we can both
// respect shutdownBroadcast and implement a specific handshake timeout.
// The timeout is to reclaim network resources in case the handshake takes
// too long.
type sshNewServerConnResult struct {
conn net.Conn
sshConn *ssh.ServerConn
channels <-chan ssh.NewChannel
requests <-chan *ssh.Request
err error
}
resultChannel := make(chan *sshNewServerConnResult, 2)
if SSH_HANDSHAKE_TIMEOUT > 0 {
time.AfterFunc(time.Duration(SSH_HANDSHAKE_TIMEOUT), func() {
resultChannel <- &sshNewServerConnResult{err: errors.New("ssh handshake timeout")}
})
}
go func() {
result := &sshNewServerConnResult{}
if sshServer.useObfuscation {
result.conn, result.err = psiphon.NewObfuscatedSshConn(
psiphon.OBFUSCATION_CONN_MODE_SERVER, conn, sshServer.config.ObfuscatedSSHKey)
} else {
result.conn = conn
}
if result.err == nil {
sshServerConfig := &ssh.ServerConfig{
PasswordCallback: sshClient.passwordCallback,
AuthLogCallback: sshClient.authLogCallback,
ServerVersion: sshServer.config.SSHServerVersion,
}
sshServerConfig.AddHostKey(sshServer.sshHostKey)
result.sshConn, result.channels, result.requests, result.err =
ssh.NewServerConn(result.conn, sshServerConfig)
}
resultChannel <- result
}()
var result *sshNewServerConnResult
select {
case result = <-resultChannel:
case <-sshServer.shutdownBroadcast:
// Close() will interrupt an ongoing handshake
// TODO: wait for goroutine to exit before returning?
conn.Close()
return
}
if result.err != nil {
conn.Close()
log.WithContextFields(LogFields{"error": result.err}).Warning("handshake failed")
return
}
sshClient.Lock()
sshClient.sshConn = result.sshConn
sshClient.Unlock()
clientID, ok := sshServer.registerClient(sshClient)
if !ok {
conn.Close()
log.WithContext().Warning("register failed")
return
}
defer sshServer.unregisterClient(clientID)
go ssh.DiscardRequests(result.requests)
sshClient.handleChannels(result.channels)
}
func (sshServer *sshServer) handleClient(tunnelProtocol string, clientConn net.Conn) {
sshServer.registerAcceptedClient(tunnelProtocol)
defer sshServer.unregisterAcceptedClient(tunnelProtocol)
geoIPData := sshServer.support.GeoIPService.Lookup(
psiphon.IPAddressFromAddr(clientConn.RemoteAddr()))
// TODO: apply reload of TrafficRulesSet to existing clients
sshClient := newSshClient(
sshServer,
tunnelProtocol,
geoIPData,
sshServer.support.TrafficRulesSet.GetTrafficRules(geoIPData.Country))
// Wrap the base client connection with an ActivityMonitoredConn which will
// terminate the connection if no data is received before the deadline. This
// timeout is in effect for the entire duration of the SSH connection. Clients
// must actively use the connection or send SSH keep alive requests to keep
// the connection active.
activityConn := psiphon.NewActivityMonitoredConn(
clientConn,
SSH_CONNECTION_READ_DEADLINE,
false,
nil)
clientConn = activityConn
// Further wrap the connection in a rate limiting ThrottledConn.
rateLimits := sshClient.trafficRules.GetRateLimits(tunnelProtocol)
clientConn = psiphon.NewThrottledConn(
clientConn,
rateLimits.DownstreamUnlimitedBytes,
int64(rateLimits.DownstreamBytesPerSecond),
rateLimits.UpstreamUnlimitedBytes,
int64(rateLimits.UpstreamBytesPerSecond))
// Run the initial [obfuscated] SSH handshake in a goroutine so we can both
// respect shutdownBroadcast and implement a specific handshake timeout.
// The timeout is to reclaim network resources in case the handshake takes
// too long.
type sshNewServerConnResult struct {
conn net.Conn
sshConn *ssh.ServerConn
channels <-chan ssh.NewChannel
requests <-chan *ssh.Request
err error
}
resultChannel := make(chan *sshNewServerConnResult, 2)
if SSH_HANDSHAKE_TIMEOUT > 0 {
time.AfterFunc(time.Duration(SSH_HANDSHAKE_TIMEOUT), func() {
resultChannel <- &sshNewServerConnResult{err: errors.New("ssh handshake timeout")}
})
}
go func(conn net.Conn) {
sshServerConfig := &ssh.ServerConfig{
PasswordCallback: sshClient.passwordCallback,
AuthLogCallback: sshClient.authLogCallback,
ServerVersion: sshServer.support.Config.SSHServerVersion,
}
sshServerConfig.AddHostKey(sshServer.sshHostKey)
result := &sshNewServerConnResult{}
// Wrap the connection in an SSH deobfuscator when required.
if psiphon.TunnelProtocolUsesObfuscatedSSH(tunnelProtocol) {
// Note: NewObfuscatedSshConn blocks on network I/O
// TODO: ensure this won't block shutdown
conn, result.err = psiphon.NewObfuscatedSshConn(
psiphon.OBFUSCATION_CONN_MODE_SERVER,
clientConn,
sshServer.support.Config.ObfuscatedSSHKey)
if result.err != nil {
result.err = psiphon.ContextError(result.err)
}
}
if result.err == nil {
result.sshConn, result.channels, result.requests, result.err =
ssh.NewServerConn(conn, sshServerConfig)
}
resultChannel <- result
}(clientConn)
var result *sshNewServerConnResult
select {
case result = <-resultChannel:
case <-sshServer.shutdownBroadcast:
// Close() will interrupt an ongoing handshake
// TODO: wait for goroutine to exit before returning?
clientConn.Close()
return
}
if result.err != nil {
clientConn.Close()
// This is a Debug log due to noise. The handshake often fails due to I/O
// errors as clients frequently interrupt connections in progress when
// client-side load balancing completes a connection to a different server.
log.WithContextFields(LogFields{"error": result.err}).Debug("handshake failed")
return
}
sshClient.Lock()
sshClient.sshConn = result.sshConn
sshClient.activityConn = activityConn
sshClient.Unlock()
clientID, ok := sshServer.registerEstablishedClient(sshClient)
if !ok {
clientConn.Close()
log.WithContext().Warning("register failed")
return
}
defer sshServer.unregisterEstablishedClient(clientID)
sshClient.runClient(result.channels, result.requests)
// Note: sshServer.unregisterClient calls sshClient.Close(),
// which also closes underlying transport Conn.
}