o
gM @ s d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZ d dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZm Z m Z d dl m Z m Z m!Z! zd dl"m#Z# W n e$ys e%Z#Y nw zd d l&m'Z' W n e$y d d l'm'Z' Y nw d
Z(d Z)dZ*G d d
d
e+Z,G dd dej-Z-G dd de.Z/G dd de.Z0G dd de0e j1j2Z3G dd de0e j1j4Z5G dd de0e j6j7Z8dS ) N)ThreadPoolExecutor)IOLoop)options) cpu_count) is_valid_ip_address
is_valid_portis_valid_hostnameto_bytesto_strto_int
to_ip_address UnicodeTypeis_ip_hostnameis_same_primary_domainis_valid_encoding)Workerrecycle_workerclients)JSONDecodeError)urlparse Tc @ s e Zd ZdS )InvalidValueErrorN)__name__
__module__ __qualname__ r r 9/usr/local/lib/python3.10/dist-packages/webssh/handler.pyr ' s r c @ s$ e Zd Zdd Zdd Zdd ZdS ) SSHClientc C s^ g }|D ](\}}| }|dr|| j q|dr&|| j qtd||S )Npassword verificationzUnknown prompt: {})striplower
startswithappendr totp
ValueErrorformat)selftitle instructions prompt_listanswersprompt__promptr r r handler- s
zSSHClient.handlerc C s | j std| j|| d S )Nz!Need a verification code for 2fa.)r$ r%
_transportauth_interactive)r' usernamer/ r r r r1 9 s zSSHClient.auth_interactivec
G s4 || _ d }d}t }ddh}|d urAtd zt| j||}||@ }|s*W d S W n tjy@ } z| }W Y d } ~ nd } ~ ww |rOtd | || j S |d urtd z
| j
|| W d S tjy } z| }tt | dg }||@ }W Y d } ~ nd } ~ ww |rtd | || j S |d usJ |) NFzkeyboard-interactiver z Trying publickey authenticationzTrying publickey 2faz Trying password authentication
allowed_typeszTrying password 2fa) r setlogginginfor0 auth_publickeyparamiko SSHExceptionr1 r/
auth_passwordgetattr)
r' r2 r pkeyargssaved_exception
two_factorr3 two_factor_typeser r r _auth> sL
zSSHClient._authN)r r r r/ r1 rB r r r r r + s r c @ sH e Zd ZdZdddddZdd d
Zd d Zd
d Zdd Zdd Z dS )
PrivateKeyi @ RSADSSECDSAEd25519)rD DSAECOPENSSHN c C s0 || _ || _|| _| t|| _d | _d S N)
privatekeyfilenamer check_lengthioStringIOiostrlast_exception)r' rM r rN r r r __init__r s
zPrivateKey.__init__c C s t | j| jkr tdd S )NzInvalid key length.)lenrM
max_lengthr r' r r r rO z s zPrivateKey.check_lengthc C sn d }|D ],}| }|r0|dr0|dr0|d}t|dkr0|d }|r0||}|r0 nq|t|fS )Nz -----BEGIN z PRIVATE KEY----- )r r" endswithsplitrU get)r' rR tag_to_namenameline_linelsttagr r r
parse_name~ s
zPrivateKey.parse_namec
C s | j | td| td| tt|d }d }z |j| j |d}W |S tjy6 t d tj
t fyU } z|| _ tt
| W Y d }~|S d }~ww )NzReset offset to {}.z Try parsing it as {} type keyKey)r z%Need a passphrase to decrypt the key.)rR seekr5 debugr& r; r8 from_private_keyPasswordRequiredExceptionr r9 r% rS str)r' r_ offsetr pkeyclsr< excr r r get_specific_pkey s z PrivateKey.get_specific_pkeyc C s t d| j | | j| j\}}|s td| j| j | }| j r,t
| j nd }| |||}|d u rM|dkrMdD ]
}| |||}|rL nq?|rQ|S t t
| j d}| j rf|d| j 7 }t|)NzParsing private key {!r}zInvalid key {}.rG )rD rF rE z Invalid keyz, or wrong passphrase "{}" for decrypting it.)r5 r6 r& rN rd rR r^ r tellr r rn errorrj rS )r' r_ lengthrk r r< msgr r r get_pkey_obj s, zPrivateKey.get_pkey_obj)NrK )
r r r rV r^ rT rO rd rn rs r r r r rC g s
rC c @ sj e Zd ZddiZdZdddZdd Zd d
Zd d Zd
d Z dd Z
dd Z dd Z dd Z
dd ZdS ) MixinHandlerServer
TornadoServerzT{code} {reason}{code} {reason}Nc C s | || _| jd| _d S )N
origin_policy)
check_requestloopsettingsr] rw r' ry r r r
initialize s zMixinHandler.initializec C s | j jj}| || j j}g | _|r&| d | | jj | j
| j d d S |du r?| | j jt
j| j j}| j|dd d S || _d S )N )codereasonFT) permanent)request
connectioncontext is_forbidden host_name _transforms
set_statusfinishhtmlr& _status_code_reasonget_redirect_urlr sslporturiredirect)r' r resultto_urlr r r rx s
zMixinHandler.check_requestc C s | j dkrdS t|}|j }td| | jj d}td| ||kr-dS | j dkr4dS | j dkrJt
| d d
d | d d
d S || j v S ) N*Tz
netloc: {}Hostzhost: {}sameFprimary:rZ r ) rw r netlocr! r5 rg r& r headersr] r rsplit)r' origin
parsed_originr hostr r r check_origin s
zMixinHandler.check_originc C s |j d }|j}d }|r||vrtd|| dS |jdkrDtr/t|s/t|}|j s/dS t
j rF|d u r:t|}|j sHtd dS d S d S d S )Nr z,IP {!r} not found in trusted downstream {!r}ThttpFz'Public plain http request is forbidden.) addresstrusted_downstreamr5 warningr& _orig_protocol redirectingr r
is_privater fbidhttp)r' r hostnameiprb
ip_addressr r r r s,
zMixinHandler.is_forbiddenc C s" |dkrdnd| }d |||S )Ni rK z:%szhttps://{}{}{})r& )r' r portr r r r r s z MixinHandler.get_redirect_urlc C s | j D ]}| j| qd S rL )custom_headersitems
set_header)r' headerr r r set_default_headers s z MixinHandler.set_default_headersc C s | |}|std||S )NzMissing value {}) get_argumentr r& )r' r_ valuer r r get_value s
zMixinHandler.get_valuec C s | j jd d S )N )r r rW r r r get_context_addr s z MixinHandler.get_context_addrc C s t jr | p
| S | S rL )r xheadersget_real_client_addrr rW r r r get_client_addr s z MixinHandler.get_client_addrc C sv | j j}|| j jdkr| j jd}n|| j jddv r'| j jd}nd S t|}|d u s5t|s7d}||fS )Nz X-Real-Ipz X-Real-PortzX-Forwarded-ForrK zX-Forwarded-Porti )r remote_ipr r] r r )r' r r r r r r s z!MixinHandler.get_real_client_addrrL )r r r r r r| rx r r r r r r r r r r r r rt s
rt c s$ e Zd Z fddZdd Z ZS )NotFoundHandlerc s t t| d S rL )superr r| rW __class__r r r| 4 s zNotFoundHandler.initializec C s t jd)Ni )tornadoweb HTTPErrorrW r r r prepare7 s zNotFoundHandler.prepare)r r r r| r
__classcell__r r r r r 2 s r c s e Zd Zee d dZ fddZ fddZdd Zd d
Z d d Z
d
d Z dd Z dd Z
dd Zdd Zdd Z fddZdd Zd d Zejjd d Z ZS )! IndexHandler ) max_workersc sZ t t| | || _|| _| | _| jdd| _ | jdd| _
t d d d d| _ d S )Nrg FfontrK )idstatusencoding)
r r r| policyhost_keys_settingsget_ssh_client
ssh_clientrz r] rg r dictr )r' ry r r r r r r| ? s
zIndexHandler.initializec s~ t r1| jjdkr1|d}|r t|d dd }|r || _| jj| jd | d | | j d S t
t | j |fi | d S )NPOSTexc_inforZ log_messager )
swallow_http_errorsr methodr] r; r r updater r r r write_error)r' status_codekwargsr r r r r r H s
zIndexHandler.write_errorc C s: t }| jd |_| jd |_| jd |_|| j |S )Nsystem_host_keys host_keyshost_keys_filename)r r _system_host_keys
_host_keys_host_keys_filenameset_missing_host_key_policyr )r' sshr r r r U s zIndexHandler.get_ssh_clientc C s` d}| j j|}|r$|d d }|d d }| j||d }||fS | |d}d}||fS )NrM r rN body)r_ rK )r filesr] decode_argumentr r )r' r_ rb rN datar r r r get_privatekey] s zIndexHandler.get_privatekeyc C s, | d}t|st|std||S )Nr zInvalid hostname: {})r r r r r& )r' r r r r get_hostnamel s
zIndexHandler.get_hostnamec C s> | dd}|s
tS t|}|d u st|s td||S )Nr rK zInvalid port: {})r DEFAULT_PORTr r r r& )r' r r r r r get_portr s zIndexHandler.get_portc C sZ |dkr|nd ||}| jj|d u r)| jj|d u r+tjdd ||d S d S )Nr z[{}]:{}r} z#Connection to {}:{} is not allowed.)r& r r lookupr r r r )r' r r keyr r r lookup_hostname| s z IndexHandler.lookup_hostnamec C s | }| }| d}| dd}| \}}| dd}| dd}t| jtjr2| || |r=t
||| } nd } || j _
||||| f}
t|
|
S )Nr2 r rK
passphraser$ )r r r r r
isinstancer r8 RejectPolicyr rC rs r r$ r5 rg ) r' r r r2 r rM rN r r$ r< r= r r r get_args s
zIndexHandler.get_argsc C s8 z t | d}W n
ty Y d S w t|r|S d S )Nascii)r
r UnicodeDecodeErrorr )r' r r r r r parse_encoding s zIndexHandler.parse_encodingc C s ddg}|D ]O}z
|j |ddd\}}}W n tjy/ } z
tt| W Y d }~qd }~ww z| }W n
tjy@ Y qw t d
|| | |}|rU| S qt d dS ) Nz $SHELL -ilc "locale charmap"z$SHELL -ic "locale charmap"TrZ )get_ptytimeoutz {!r} => {!r}z&Could not detect the default encoding.zutf-8)
exec_commandr8 r9 r5 r6 rj readsocketr rg r& r r ) r' r commandscommandr- stdoutrm r r r r r get_default_encoding s2
z!IndexHandler.get_default_encodingc C s | j }|d d }tdj| z |j|dtji W n0 tjy+ t dj| t
j y6 t d t
j yA t d t
j
yL t dw | dd pTd
}|j|d }|d t| j|||}tjrqtj|_|S | ||_|S )
Nr zConnecting to {}:{}r zUnable to connect to {}:{}zBad authentication type.zAuthentication failed.z
Bad host key.termrK xterm)r r )r r5 r6 r& connectr r r rp r% r8 BadAuthenticationTypeAuthenticationExceptionBadHostKeyExceptionr invoke_shell setblockingr ry r r )r' r= r dst_addrr chanworkerr r r ssh_connect s.
zIndexHandler.ssh_connectc sn | dd}| jjd}|p|}|r1tt| |s"tj dd|s3| j
dkr5| d| d S d S d S d S )N_originrK Originr} z&Cross origin operation is not allowed.r zAccess-Control-Allow-Origin) r r r r] r r r r r r rw r )r' event_origin
header_originr r r r r s zIndexHandler.check_originc C s d S rL r rW r r r head s zIndexHandler.headc C s | j d| j| jd d S )Nz
index.html)rg r )renderrg r rW r r r r] s zIndexHandler.getc
c sP | j r| ddrtd| \}}t|i }|r*t|tjkr*t j
dd| z|
}W n tyI } z t j
dt|d }~ww | j| j|}z|V }W n% ttjfy| } ztt | jjt|d W Y d }~n(d }~ww |s|t|< ||f|_|||j < | j tj t | | jj|j |j!d | "| j d S ) Nrp rK zUncaught exceptionr} zToo many live connections.i r )r r )#rg r r% r r r] rU r maxconnr r r r r r rj executorsubmitr r8 r9 r5 rp traceback
format_excr r src_addrr ry
call_laterdelayr r write)r' r r workersr= rm futurer r r r post s:
zIndexHandler.post)r r r r r r r| r r r r r r r r r r r r r] r gen coroutiner r r r r r r ; s$
r c s4 e Zd Z fddZdd Zdd Zdd Z ZS ) WsockHandlerc s t t| | d | _d S rL )r r r|
worker_refr{ r r r r| s
zWsockHandler.initializec
C s | | _tdj| j t| jd }|s | jdd d S z| d}W n t j
j t fyF } z| jt
|d W Y d }~d S d }~ww ||}|rnd ||< | d || t|| _| j|j|tj d S | jdd d S )NzConnected from {}:{}r z Websocket authentication failed.r r T)r r r5 r6 r& r r] closer r r MissingArgumentErrorr rj set_nodelay set_handlerweakrefrefr ry add_handlerfdr READ)r' r worker_idrm r r r r open s(
zWsockHandler.openc
C s t dj|g| jR | }|s$t dj| j | jdd d S |jr/| jdd d S zt|}W n
t y@ Y d S w t
|t sHd S | d}|rlt
|dkrlz|jj| W n ttjtjfyk Y nw | d}|rt
|tr|j| | d S d S d S ) Nz{!r} from {}:{}z,received message to closed worker from {}:{}zNo worker foundr z
Worker closedresizer r )r5 rg r& r r r closedjsonloadsr r r r] rU r
resize_pty TypeErrorstructrp r8 r9 r
data_to_dstr# on_write)r' messager rr r) r r r r
on_message/ s@
zWsockHandler.on_messagec C sJ t dj| j | jsd| _| jr| nd }|r#|j| jd d S d S )NzDisconnected from {}:{}zclient disconnectedr )r5 r6 r& r close_reasonr r )r' r r r r on_closeT s zWsockHandler.on_close)r r r r| r( r3 r5 r r r r r r s
%r )9rP r+ r5 r r/ r r" r8 tornado.webr concurrent.futuresr tornado.ioloopr tornado.optionsr tornado.processr webssh.utilsr r r r r
r r r
r r r
webssh.workerr r r json.decoderr ImportErrorr% urllib.parser r r r Exceptionr r objectrC rt r ErrorHandlerr RequestHandlerr websocketWebSocketHandlerr r r r r sH 4 <Sx W