From 1d3aa1f7563a4f8a51fcd1227b06c3f8dfb5b9f0 Mon Sep 17 00:00:00 2001 From: Sven Slootweg Date: Sat, 23 Mar 2013 04:20:21 +0100 Subject: [PATCH] Make the panel establish and use an SSH tunnel instead of using php-ssh2 --- frontend/classes/node.php | 9 +- frontend/classes/sshconnector.php | 279 ++++++++++++++++++++++++------ 2 files changed, 233 insertions(+), 55 deletions(-) diff --git a/frontend/classes/node.php b/frontend/classes/node.php index dd5e954..f20b822 100644 --- a/frontend/classes/node.php +++ b/frontend/classes/node.php @@ -26,10 +26,12 @@ class Node extends CPHPDatabaseRecordClass 'PhysicalLocation' => "PhysicalLocation", 'PrivateKey' => "CustomPrivateKey", 'PublicKey' => "CustomPublicKey", - 'User' => "User" + 'User' => "User", + 'TunnelKey' => "TunnelKey" ), 'numeric' => array( - 'Port' => "Port" + 'Port' => "Port", + 'TunnelPort' => "TunnelPort" ), 'boolean' => array( 'HasCustomKey' => "HasCustomKey" @@ -47,6 +49,9 @@ class Node extends CPHPDatabaseRecordClass $this->ssh->host = $this->sHostname; $this->ssh->port = $this->sPort; $this->ssh->user = $this->sUser; + $this->ssh->tunnel_port = $this->sTunnelPort; + $this->ssh->tunnel_key = $this->sTunnelKey; + $this->ssh->node = $this; if($this->HasCustomKey === true) { diff --git a/frontend/classes/sshconnector.php b/frontend/classes/sshconnector.php index 643e832..8d3045b 100644 --- a/frontend/classes/sshconnector.php +++ b/frontend/classes/sshconnector.php @@ -35,15 +35,6 @@ class SshConnector extends CPHPBaseClass { try { - if($this->failed == false && ($this->connected == false || $this->authenticated == false)) - { - $this->Connect(); - } - elseif($this->failed == true) - { - throw new SshConnectException("Previous connection attempt failed."); - } - return $this->DoCommand($command, $throw_exception); } catch (SshConnectException $e) @@ -78,81 +69,263 @@ class SshConnector extends CPHPBaseClass public function Connect() { - $fp = @fsockopen($this->host, $this->port, $errno, $errstr, 3); - - if(!$fp) + /* TODO: TIME_WAIT status for a previous socket on the same port may cause issues + * when attempting to restart the command daemon. There is currently no way + * to detect this from the code, and it makes all subsequent requests fail + * (silently?) because the tunnel is available but nothing is listening on + * the other end. This kind of edge case should be detected and dealt with. + * A browser displays a 'no data received' error in this case. */ + if($this->failed) { - throw new SshConnectException("Could not connect to {$this->host}:{$this->port}: {$errstr}"); + throw new SshConnectException("A previous connection attempt failed."); + } + + $sHost = escapeshellarg($this->host); + $sUser = escapeshellarg($this->user); + $sPort = $this->tunnel_port = $this->node->uTunnelPort = $this->ChoosePort(); + $sKeyFile = escapeshellarg($this->key); + $this->node->uTunnelKey = $this->tunnel_key = random_string(16); + $sSessionKey = escapeshellarg($this->node->uTunnelKey); + + $command = "python /etc/cvm/start_tunnel.py {$sHost} {$sUser} {$sPort} {$sKeyFile} {$sSessionKey}"; + + $steps = array(); + + foreach(debug_backtrace() as $step) + { + try + { + $allargs = implode(", ", $step['args']); + } + catch (Exception $e) + { + $allargs = "[unserializable]"; + } + + $steps[] = "{$step['file']}:{$step['line']} => {$step['class']}{$step['type']}{$step['function']}({$allargs})"; } - fclose($fp); + cphp_debug_snapshot(array( + "action" => "start tunnel", + "db-tunnelkey" => $this->node->sTunnelKey, + "db-utunnelkey" => $this->node->uTunnelKey, + "ssh-tunnelkey" => $this->tunnel_key, + "arg-tunnelkey" => $sSessionKey, + "trace" => $steps + )); - $options = array( - 'hostkey' => $this->keytype - ); + exec($command, $output, $returncode); - if($this->connection = @ssh2_connect($this->host, $this->port, $options)) + if($returncode === 0) { - $this->connected = true; + /* autossh returns before the SSH connection has actually been established. We'll make the + * script sleep until a connection has been established, with a timeout of 10 seconds, after + * which an exception is raised. The polling interval is 100ms. */ - if(empty($this->passphrase)) + $start_time = time(); + + while(true) { - $result = @ssh2_auth_pubkey_file($this->connection, $this->user, $this->pubkey, $this->key); + if(time() > $start_time + 10) + { + throw new SshConnectException("The SSH tunnel could not be fully established within the timeout period."); + } + + if($pollsock = @fsockopen("localhost", $this->tunnel_port, $errno, $errstr, 1)) + { + /* The tunnel has been fully established. */ + + fclose($pollsock); + break; + } + + usleep(100000); } - else + + cphp_debug_snapshot(array( + "action" => "pre insert db", + "db-tunnelkey" => $this->node->sTunnelKey, + "db-utunnelkey" => $this->node->uTunnelKey, + "ssh-tunnelkey" => $this->tunnel_key, + "arg-tunnelkey" => $sSessionKey + )); + + $this->node->InsertIntoDatabase(); + + cphp_debug_snapshot(array( + "action" => "inserted db", + "db-tunnelkey" => $this->node->sTunnelKey, + "db-utunnelkey" => $this->node->uTunnelKey, + "ssh-tunnelkey" => $this->tunnel_key, + "arg-tunnelkey" => $sSessionKey + )); + + return true; + } + else + { + throw new SshConnectException("Could not establish tunnel to {$this->host}:{$this->port}."); + } + } + + private function ChoosePort() + { + try + { + $sPorts = array(); + + foreach(Node::CreateFromQuery("SELECT * FROM nodes WHERE `TunnelPort` != 0") as $node) { - $result = @ssh2_auth_pubkey_file($this->connection, $this->user, $this->pubkey, $this->key, $this->passphrase); + $sPorts[] = $node->sTunnelPort; + $sPorts[] = $node->sTunnelPort + 1; + $sPorts[] = $node->sTunnelPort + 2; } - if($result === true) + /* TODO: Figure out a more intelligent way of choosing ports. */ + $start = max($sPorts) + 1; + } + catch (NotFoundException $e) + { + $start = 2000; + } + + $current = $start; + + while(true) + { + if($current > 65534) + { + throw new SshConnectException("No free tunnel ports left."); + } + + if(!$this->TestPort($current)) { - $this->authenticated = true; - return true; + if(!$this->TestPort($current + 1)) + { + if(!$this->TestPort($current + 2)) + { + break; + } + else + { + $current = $current + 3; + } + } + else + { + $current = $current + 2; + } } else { - throw new SshAuthException("Could not connect to {$this->host}:{$this->port}: Key authentication failed"); + $current = $current + 1; } } + + return $current; + } + + private function TestPort($port) + { + if($testsock = @fsockopen("localhost", $port, $errno, $errstr, 1)) + { + fclose($testsock); + return true; + } else { - throw new SshConnectException("Could not connect to {$this->host}:{$this->port}: {$error}"); + return false; } - - return false; } - private function DoCommand($command, $throw_exception) + private function DoCommand($command, $throw_exception, $allow_retry = true) { - $command = base64_encode(json_encode($command)); - $command = "{$this->helper} {$command}"; + cphp_debug_snapshot(array( + "action" => "pre run command", + "db-tunnelkey" => $this->node->sTunnelKey, + "db-utunnelkey" => $this->node->uTunnelKey, + "ssh-tunnelkey" => $this->tunnel_key, + "command" => $command, + "allow-retry" => $allow_retry + )); - $stream = ssh2_exec($this->connection, $command); - $error_stream = ssh2_fetch_stream($stream, SSH2_STREAM_STDERR); + $cmd = urlencode(json_encode($command)); + $url = "http://localhost:{$this->tunnel_port}/?key={$this->tunnel_key}&command={$cmd}"; - stream_set_blocking($stream, true); - stream_set_blocking($error_stream, true); - - $result = stream_get_contents($stream); - $error = stream_get_contents($error_stream); - - if(strpos($error, "No such file or directory") !== false) + $context = stream_context_create(array( + 'http' => array( + 'timeout' => 2.0 + ) + )); + + $response = @file($url, 0, $context); + + cphp_debug_snapshot(array( + "action" => "post run command", + "db-tunnelkey" => $this->node->sTunnelKey, + "db-utunnelkey" => $this->node->uTunnelKey, + "ssh-tunnelkey" => $this->tunnel_key, + "command" => $command, + "allow-retry" => $allow_retry, + "response" => $response + )); + + if($response === false) + { + /* Determine why the connection failed, and what we need to do to fix it. */ + if($testsock = @fsockopen("localhost", $this->tunnel_port, $errno, $errstr, 1)) + { + /* The socket works fine. */ + fclose($testsock); + + /* Since the socket works but we can't make a request, there is most + * likely a serious problem with the command daemon (stuck, crashed, + * etc.) We'll throw an exception. TODO: Log error. */ + $this->failed = true; + throw new SshCommandException("The command daemon is unavailable."); + } + else + { + /* The tunnel is gone for some reason. Either the connection broke + * and autossh is busy reconnecting, or autossh broke entirely. We + * will attempt to connect to the monitoring port to see if autossh + * is still running or not. */ + if($testsock = @fsockopen("localhost", ($this->tunnel_port + 2), $errno, $errstr, 1)) + { + /* The socket works fine. */ + fclose($testsock); + + /* Most likely autossh is very busy trying to reconnect to the node. We'll throw a + * connection exception for now. TODO: Consider waiting with a specified timeout. */ + $this->failed = true; + throw new SshConnectException("The SSH connection to this node is currently unavailable."); + } + else + { + if($allow_retry) + { + $this->Connect(); + $res = $this->DoCommand($command, $throw_exception, false); + } + else + { + $this->failed = true; + throw new SshConnectException("Could not connect to node."); + /* TODO: Log error, this is probably very bad. */ + } + } + } + } + else { - throw new Exception("The runhelper is not installed on the node or an error occurred."); + $response = json_decode(implode("", $response)); } - $returndata = json_decode($result); - - $returndata->stderr = trim($returndata->stderr); - - fclose($stream); - fclose($error_stream); - - if($returndata->returncode != 0 && $throw_exception === true) + if($response->returncode != 0 && $throw_exception === true) { - throw new SshExitException("Non-zero exit code returned: {$returndata->stderr}", $returndata->returncode); + throw new SshExitException("Non-zero exit code returned: {$response->stderr}", $response->returncode); } - return $returndata; + return $response; } }