1
>
/*---------------------------------------------------------------------------------------------
sshRemoteAgentHostService.ts
2
>
* Copyright (c) Microsoft Corporation. All rights reserved.
3
>
* Licensed under the MIT License. See License.txt in the project root for license information.
4
>
*--------------------------------------------------------------------------------------------*/
5
>
6
>
import type WebSocket from 'ws';
7
>
import type { AnyAuthMethod, AuthenticationType, ConnectConfig } from 'ssh2';
8
>
import { promises as fsp } from 'fs';
9
>
import * as os from 'os';
10
>
import * as cp from 'child_process';
11
>
import { dirname, join, isAbsolute, basename } from '../../../base/common/path.js';
12
>
import { Emitter, Event } from '../../../base/common/event.js';
13
>
import { Disposable, DisposableMap, toDisposable } from '../../../base/common/lifecycle.js';
14
>
import { raceTimeout } from '../../../base/common/async.js';
15
>
import { CancellationError } from '../../../base/common/errors.js';
16
>
import { URI } from '../../../base/common/uri.js';
17
>
import { localize } from '../../../nls.js';
18
>
import { ILogService } from '../../log/common/log.js';
19
>
import { IProductService } from '../../product/common/productService.js';
20
>
import {
21
>
ISSHRemoteAgentHostMainService,
22
>
SSHAuthMethod,
23
>
type ISSHAgentHostConfig,
24
>
type ISSHAgentHostConfigSanitized,
25
>
type ISSHConnectProgress,
26
>
type ISSHConnectResult,
27
>
type ISSHKeyboardInteractivePrompt,
28
>
type ISSHKeyboardInteractiveRequest,
29
>
type ISSHResolvedConfig,
30
>
} from '../common/sshRemoteAgentHost.js';
31
>
import type { IRelayMessage } from '../common/relayTransport.js';
32
>
import {
33
>
buildAgentHostBaseCommand,
34
>
buildCLIDownloadUrl,
35
>
buildCleanupOldCLIsCommand,
36
>
buildFindFallbackCLICommand,
37
>
cleanupRemoteAgentHost,
38
>
extractAgentHostWebSocketURL,
39
>
findRunningAgentHost,
40
>
getRemoteCLIBin,
41
>
getRemoteCLIDataDir,
42
>
getRemoteCLIInstallRoot,
43
>
isValidFallbackCLIPath,
44
>
redactToken,
45
>
resolveRemotePlatform,
46
>
shellEscape,
47
>
writeAgentHostState,
48
>
} from './sshRemoteAgentHostHelpers.js';
49
>
import { parseSSHConfigHostEntries, parseSSHGOutput, stripSSHComment } from '../common/sshConfigParsing.js';
50
>
import { removeAnsiEscapeCodes } from '../../../base/common/strings.js';
51
>
52
>
/** Minimal subset of ssh2.ClientChannel used by this module (duplex stream). */
53
>
interface SSHChannel extends NodeJS.ReadWriteStream {
54
>
on(event: 'data', listener: (data: Buffer) => void): this;
55
>
on(event: 'close', listener: (code: number) => void): this;
56
>
on(event: 'error', listener: (err: Error) => void): this;
57
>
on(event: string, listener: (...args: unknown[]) => void): this;
58
>
stderr: { on(event: 'data', listener: (data: Buffer) => void): void };
59
>
close(): void;
60
>
}
61
>
62
>
/** Minimal subset of ssh2.Client used by this module. */
63
>
interface SSHClient {
64
>
on(event: 'ready', listener: () => void): SSHClient;
65
>
on(event: 'error', listener: (err: Error) => void): SSHClient;
66
>
on(event: 'close', listener: () => void): SSHClient;
67
>
removeListener(event: 'close', listener: () => void): SSHClient;
68
>
removeListener(event: 'error', listener: (err: Error) => void): SSHClient;
69
>
connect(config: ConnectConfig): void;
70
>
exec(command: string, callback: (err: Error | undefined, stream: SSHChannel) => void): SSHClient;
71
>
forwardOut(srcIP: string, srcPort: number, dstIP: string, dstPort: number, callback: (err: Error | undefined, channel: SSHChannel) => void): SSHClient;
72
>
end(): void;
73
>
}
74
>
75
>
const LOG_PREFIX = '[SSHRemoteAgentHost]';
76
>
77
>
/**
78
>
* Maximum time to wait for {@link SSHRemoteAgentHostMainService._createWebSocketRelay}
79
>
* to settle on the `replaceRelay` reconnect path before giving up. A silently
80
>
* dead SSH client (TCP half-open, ssh2 keepalive hasn't fired yet) can leave
81
>
* `forwardOut`'s callback unfired, hanging the whole `connect()` call. Bounding
82
>
* this surfaces a clean failure so the renderer can clear its pending-reconnect
83
>
* flag and retry, and so the dead SSH client gets ended (purging it from the
84
>
* shared-process `_connections` map).
85
>
*
86
>
* The value is just slightly larger than ssh2's default keepalive failure
87
>
* window (`keepaliveInterval * keepaliveCountMax` ~= 15s * 3 = 45s) so that in
88
>
* practice the SSH client itself will surface its own `'close'` first when
89
>
* the network is hard-down. Tests override this to a much smaller value.
90
>
*/
91
>
const RECONNECT_RELAY_TIMEOUT_MS = 60_000;
92
>
93
>
/**
94
>
* One entry in the queue of authentication attempts handed to ssh2's
95
>
* `authHandler`. Each attempt corresponds to one of the auth method shapes
96
>
* documented at https://www.npmjs.com/package/ssh2#client-methods.
97
>
*
98
>
* `keyPath` is internal-only metadata for logging — it is stripped before the
99
>
* attempt is returned to ssh2.
100
>
*/
101
>
export type SSHAuthAttempt =
102
>
| { readonly type: 'publickey'; readonly username: string; readonly key: Buffer; readonly keyPath: string; readonly encrypted?: boolean }
103
>
| { readonly type: 'agent'; readonly username: string; readonly agent: string }
104
>
| { readonly type: 'password'; readonly username: string; readonly password: string }
105
>
| { readonly type: 'keyboard-interactive'; readonly username: string };
106
>
107
function describeAuthAttempt(attempt: SSHAuthAttempt): string {
108
switch (attempt.type) {