def ssh_exec_connect_to(display_desc, opts=None, debug_cb=None, ssh_fail_cb=ssh_connect_failed):
if not ssh_fail_cb:
ssh_fail_cb = ssh_connect_failed
sshpass_command = None
try:
cmd = list(display_desc["full_ssh"])
kwargs = {}
env = display_desc.get("env")
kwargs["stderr"] = sys.stderr
if WIN32:
from subprocess import CREATE_NEW_PROCESS_GROUP, CREATE_NEW_CONSOLE, STARTUPINFO, STARTF_USESHOWWINDOW
startupinfo = STARTUPINFO()
startupinfo.dwFlags |= STARTF_USESHOWWINDOW
startupinfo.wShowWindow = 0 #aka win32.con.SW_HIDE
flags = CREATE_NEW_PROCESS_GROUP | CREATE_NEW_CONSOLE
kwargs.update({
"startupinfo" : startupinfo,
"creationflags" : flags,
"stderr" : PIPE,
})
elif not display_desc.get("exit_ssh", False) and not OSX:
kwargs["start_new_session"] = True
remote_xpra = display_desc["remote_xpra"]
assert remote_xpra
socket_dir = display_desc.get("socket_dir")
proxy_command = display_desc["proxy_command"] #ie: "_proxy_start"
display_as_args = display_desc["display_as_args"] #ie: "--start=xterm :10"
remote_cmd = ""
for x in remote_xpra:
if not remote_cmd:
check = "if"
else:
check = "elif"
if x=="xpra":
#no absolute path, so use "which" to check that the command exists:
pc = ['%s which "%s" > /dev/null 2>&1; then' % (check, x)]
else:
pc = ['%s [ -x %s ]; then' % (check, x)]
pc += [x] + proxy_command + [shellquote(x) for x in display_as_args]
if socket_dir:
pc.append("--socket-dir=%s" % socket_dir)
remote_cmd += " ".join(pc)+";"
remote_cmd += "else echo \"no run-xpra command found\"; exit 1; fi"
if INITENV_COMMAND:
remote_cmd = INITENV_COMMAND + ";" + remote_cmd
#how many times we need to escape the remote command string
#depends on how many times the ssh command is parsed
nssh = sum(int(x=="ssh") for x in cmd)
if nssh>=2 and MAGIC_QUOTES:
for _ in range(nssh):
remote_cmd = shlex.quote(remote_cmd)
else:
remote_cmd = "'%s'" % remote_cmd
cmd.append("sh -c %s" % remote_cmd)
if debug_cb:
debug_cb("starting %s tunnel" % str(cmd[0]))
#non-string arguments can make Popen choke,
#instead of lazily converting everything to a string, we validate the command:
for x in cmd:
if not isinstance(x, str):
raise InitException("argument is not a string: %s (%s), found in command: %s" % (x, type(x), cmd))
password = display_desc.get("password")
if password and not display_desc.get("is_putty", False):
from xpra.platform.paths import get_sshpass_command
sshpass_command = get_sshpass_command()
if sshpass_command:
#sshpass -e ssh ...
cmd.insert(0, sshpass_command)
cmd.insert(1, "-e")
if env is None:
env = os.environ.copy()
env["SSHPASS"] = password
#the password will be used by ssh via sshpass,
#don't try to authenticate again over the ssh-proxy connection,
#which would trigger warnings if the server does not require
#authentication over unix-domain-sockets:
opts.password = None
del display_desc["password"]
if env:
kwargs["env"] = env
if is_debug_enabled("ssh"):
log.info("executing ssh command: %s" % (" ".join("\"%s\"" % x for x in cmd)))
child = Popen(cmd, stdin=PIPE, stdout=PIPE, **kwargs)
except OSError as e:
raise InitExit(EXIT_SSH_FAILURE,
"Error running ssh command '%s': %s" % (" ".join("\"%s\"" % x for x in cmd), e))
def abort_test(action):
""" if ssh dies, we don't need to try to read/write from its sockets """
e = child.poll()
if e is not None:
had_connected = conn.input_bytecount>0 or conn.output_bytecount>0
if had_connected:
error_message = "cannot %s using SSH" % action
else:
error_message = "SSH connection failure"
sshpass_error = None
if sshpass_command:
sshpass_error = {
1 : "Invalid command line argument",
2 : "Conflicting arguments given",
3 : "General runtime error",
4 : "Unrecognized response from ssh (parse error)",
5 : "Invalid/incorrect password",
6 : "Host public key is unknown. sshpass exits without confirming the new key.",
}.get(e)
if sshpass_error:
error_message += ": %s" % sshpass_error
if debug_cb:
debug_cb(error_message)
if ssh_fail_cb:
ssh_fail_cb(error_message)
if "ssh_abort" not in display_desc:
display_desc["ssh_abort"] = True
if not had_connected:
log.error("Error: SSH connection to the xpra server failed")
if sshpass_error:
log.error(" %s", sshpass_error)
else:
log.error(" check your username, hostname, display number, firewall, etc")
display_name = display_desc["display_name"]
log.error(" for server: %s", display_name)
else:
log.error("The SSH process has terminated with exit code %s", e)
cmd_info = " ".join(display_desc["full_ssh"])
log.error(" the command line used was:")
log.error(" %s", cmd_info)
raise ConnectionClosedException(error_message) from None
def stop_tunnel():
if POSIX:
#on posix, the tunnel may be shared with other processes
#so don't kill it... which may leave it behind after use.
#but at least make sure we close all the pipes:
for name,fd in {
"stdin" : child.stdin,
"stdout" : child.stdout,
"stderr" : child.stderr,
}.items():
try:
if fd:
fd.close()
except Exception as e:
print("error closing ssh tunnel %s: %s" % (name, e))
if not display_desc.get("exit_ssh", False):
#leave it running
return
try:
if child.poll() is None:
child.terminate()
except Exception as e:
print("error trying to stop ssh tunnel process: %s" % e)
host = display_desc["host"]
port = display_desc.get("ssh-port", 22)
username = display_desc.get("username")
display = display_desc.get("display")
info = {
"host" : host,
"port" : port,
}
from xpra.net.bytestreams import TwoFileConnection
conn = TwoFileConnection(child.stdin, child.stdout,
abort_test, target=(host, port),
socktype="ssh", close_cb=stop_tunnel, info=info)
conn.endpoint = host_target_string("ssh", username, host, port, display)
conn.timeout = 0 #taken care of by abort_test
conn.process = (child, "ssh", cmd)
if kwargs.get("stderr")==PIPE:
def stderr_reader():
errs = []
while child.poll() is None:
try:
v = child.stderr.readline()
except OSError:
log("stderr_reader()", exc_info=True)
break
if not v:
log("SSH EOF on stderr of %s", cmd)
break
s = bytestostr(v.rstrip(b"\n\r"))
if s:
errs.append(s)
if errs:
log.warn("remote SSH stderr:")
for e in errs:
log.warn(" %s", e)
start_thread(stderr_reader, "ssh-stderr-reader", daemon=True)
return conn
def ssh_paramiko_connect_to(display_desc):
#plain socket attributes:
dtype = display_desc["type"]
host = display_desc["host"]
port = display_desc.get("ssh-port", 22)
#ssh and command attributes:
username = display_desc.get("username") or get_username()
if "proxy_host" in display_desc:
display_desc.setdefault("proxy_username", get_username())
password = display_desc.get("password")
remote_xpra = display_desc["remote_xpra"]
proxy_command = display_desc["proxy_command"] #ie: "_proxy_start"
socket_dir = display_desc.get("socket_dir")
display = display_desc.get("display")
display_as_args = display_desc["display_as_args"] #ie: "--start=xterm :10"
paramiko_config = display_desc.copy()
paramiko_config.update(display_desc.get("paramiko-config", {}))
socket_info = {
"host" : host,
"port" : port,
}
def get_keyfiles(host_config, config_name="key"):
keyfiles = (host_config or {}).get("identityfile") or get_default_keyfiles()
keyfile = paramiko_config.get(config_name)
if keyfile:
keyfiles.insert(0, keyfile)
return keyfiles
with nogssapi_context():
from paramiko import SSHConfig, ProxyCommand
ssh_config = SSHConfig()
user_config_file = os.path.expanduser("~/.ssh/config")
sock = None
host_config = None
if os.path.exists(user_config_file):
with open(user_config_file) as f:
ssh_config.parse(f)
log("parsed user config '%s': %i hosts found", user_config_file, len(ssh_config.get_hostnames()))
host_config = ssh_config.lookup(host)
if host_config:
log("got host config for '%s': %s", host, host_config)
chost = host_config.get("hostname", host)
cusername = host_config.get("user", username)
cport = host_config.get("port", port)
try:
port = int(cport)
except (TypeError, ValueError):
raise InitExit(EXIT_SSH_FAILURE, "invalid ssh port specified: '%s'" % cport) from None
proxycommand = host_config.get("proxycommand")
if proxycommand:
log("found proxycommand='%s' for host '%s'", proxycommand, chost)
sock = ProxyCommand(proxycommand)
log("ProxyCommand(%s)=%s", proxycommand, sock)
from xpra.child_reaper import getChildReaper
cmd = getattr(sock, "cmd", [])
def proxycommand_ended(proc):
log("proxycommand_ended(%s) exit code=%s", proc, proc.poll())
getChildReaper().add_process(sock.process, "paramiko-ssh-client", cmd, True, True,
callback=proxycommand_ended)
proxy_keys = get_keyfiles(host_config, "proxy_key")
log("proxy keys=%s", proxy_keys)
from paramiko.client import SSHClient
ssh_client = SSHClient()
ssh_client.load_system_host_keys()
log("ssh proxy command connect to %s", (chost, cport, sock))
ssh_client.connect(chost, cport, sock=sock)
transport = ssh_client.get_transport()
do_ssh_paramiko_connect_to(transport, chost,
cusername, password,
host_config or ssh_config.lookup("*"),
proxy_keys,
paramiko_config)
chan = paramiko_run_remote_xpra(transport, proxy_command, remote_xpra, socket_dir, display_as_args)
peername = (chost, cport)
conn = SSHProxyCommandConnection(chan, peername, peername, socket_info)
conn.target = host_target_string("ssh", cusername, chost, port, display)
conn.timeout = SOCKET_TIMEOUT
conn.start_stderr_reader()
conn.process = (sock.process, "ssh", cmd)
from xpra.net import bytestreams
from paramiko.ssh_exception import ProxyCommandFailure
bytestreams.CLOSED_EXCEPTIONS = tuple(list(bytestreams.CLOSED_EXCEPTIONS)+[ProxyCommandFailure])
return conn
keys = get_keyfiles(host_config)
from xpra.scripts.main import socket_connect
from paramiko.transport import Transport
from paramiko import SSHException
if "proxy_host" in display_desc:
proxy_host = display_desc["proxy_host"]
proxy_port = display_desc.get("proxy_port", 22)
proxy_username = display_desc.get("proxy_username", username)
proxy_password = display_desc.get("proxy_password", password)
proxy_keys = get_keyfiles(host_config, "proxy_key")
sock = socket_connect(dtype, proxy_host, proxy_port)
middle_transport = Transport(sock)
middle_transport.use_compression(False)
try:
middle_transport.start_client()
except SSHException as e:
log("start_client()", exc_info=True)
raise InitExit(EXIT_SSH_FAILURE, "SSH negotiation failed: %s" % e) from None
proxy_host_config = ssh_config.lookup(host)
do_ssh_paramiko_connect_to(middle_transport, proxy_host,
proxy_username, proxy_password,
proxy_host_config or ssh_config.lookup("*"),
proxy_keys,
paramiko_config)
log("Opening proxy channel")
chan_to_middle = middle_transport.open_channel("direct-tcpip", (host, port), ('localhost', 0))
transport = Transport(chan_to_middle)
transport.use_compression(False)
try:
transport.start_client()
except SSHException as e:
log("start_client()", exc_info=True)
raise InitExit(EXIT_SSH_FAILURE, "SSH negotiation failed: %s" % e)
do_ssh_paramiko_connect_to(transport, host,
username, password,
host_config or ssh_config.lookup("*"),
keys,
paramiko_config)
chan = paramiko_run_remote_xpra(transport, proxy_command, remote_xpra, socket_dir, display_as_args)
peername = (host, port)
conn = SSHProxyCommandConnection(chan, peername, peername, socket_info)
conn.target = "%s via %s" % (
host_target_string("ssh", username, host, port, display),
host_target_string("ssh", proxy_username, proxy_host, proxy_port, None),
)
conn.timeout = SOCKET_TIMEOUT
conn.start_stderr_reader()
return conn
#plain TCP connection to the server,
#we open it then give the socket to paramiko:
sock = socket_connect(dtype, host, port)
sockname = sock.getsockname()
peername = sock.getpeername()
log("paramiko socket_connect: sockname=%s, peername=%s", sockname, peername)
transport = Transport(sock)
transport.use_compression(False)
try:
transport.start_client()
except SSHException as e:
log("start_client()", exc_info=True)
raise InitExit(EXIT_SSH_FAILURE, "SSH negotiation failed: %s" % e) from None
do_ssh_paramiko_connect_to(transport, host, username, password,
host_config or ssh_config.lookup("*"),
keys,
paramiko_config)
chan = paramiko_run_remote_xpra(transport, proxy_command, remote_xpra, socket_dir, display_as_args)
conn = SSHSocketConnection(chan, sock, sockname, peername, (host, port), socket_info)
conn.target = host_target_string("ssh", username, host, port, display)
conn.timeout = SOCKET_TIMEOUT
conn.start_stderr_reader()
return conn