Building SSH proxy

[ghost]

Hi,
I want to build an SSH proxy for cloning Git repositories over SSH. I have a VM running on 192.168.122.37. When I run git clone [email protected]:/home/git/repo from the host, it clones the repo successfully. Now, I want to build an SSH proxy to run on localhost:22, so that when I run git clone git@localhost:/home/git/repo, it will clone the repo on the VM machine.
How could i build that?

[Eugeny]

You might wanna check out Warpgate, a project in the same GitHub org as russh, which does exactly what you're describing using russh

[ghost]

Thank you for your answer! Warpgate is a large code base. Could you please provide me a tiny example of its functionality here? I will be thankful to you.

[Eugeny]

It's impossible to single it out as a small example, but Warpgate is just creating an Russh server (https://github.com/warp-tech/warpgate/blob/main/warpgate-protocol-ssh/src/server/russh_handler.rs), waiting for a client to connect, and then opens its own Russh client connection (https://github.com/warp-tech/warpgate/blob/main/warpgate-protocol-ssh/src/client/mod.rs) and then forwards operations between the two

[ghost]

I modified the echo server example to include a client connected to another server running on :2223. When data is received on the server running on :2222, the code already sends back Got data: ... to the client. I want the client I created to send every piece of data received on server :2222 to the other server running on :2223. How can this be done?

use std::collections::HashMap;
use std::sync::Arc;
use std::time::Duration;

use anyhow::Result;
use async_trait::async_trait;
use russh::server::{Msg, Server as _, Session};
use russh::*;
use russh_keys::*;
use tokio::sync::Mutex;

#[tokio::main]
async fn main() -> Result<()> {
    env_logger::builder()
        .filter_level(log::LevelFilter::Debug)
        .init();

    let config = russh::server::Config {
        inactivity_timeout: Some(std::time::Duration::from_secs(3600)),
        auth_rejection_time: std::time::Duration::from_secs(3),
        auth_rejection_time_initial: Some(std::time::Duration::from_secs(0)),
        keys: vec![russh_keys::key::KeyPair::generate_ed25519().unwrap()],
        ..Default::default()
    };
    let config = Arc::new(config);

    // Make my client that connect to other server running on `:2223`
    let key_pair = load_secret_key("/home/git/.ssh/id_rsa", None)?;
    let ccfg = client::Config {
        inactivity_timeout: Some(Duration::from_secs(5)),
        ..<_>::default()
    };
    let csh = Client {};
    let mut c_session = client::connect(Arc::new(ccfg), ("127.0.0.1", 2223), csh).await?;
    let auth_res = c_session
        .authenticate_publickey("git", Arc::new(key_pair))
        .await?;

    if !auth_res {
        anyhow::bail!("Client authentication failed");
    }
    println!("my client created sucessfully");

    let mut sh = Server {
        clients: Arc::new(Mutex::new(HashMap::new())),
        id: 0,
        c_session: Arc::new(c_session),
    };

    sh.run_on_address(config, ("0.0.0.0", 2222)).await.unwrap();

    Ok(())
}

#[derive(Clone)]
struct Client {}

#[async_trait]
impl client::Handler for Client {
    type Error = russh::Error;

    async fn check_server_key(
        &mut self,
        _server_public_key: &key::PublicKey,
    ) -> Result<bool, Self::Error> {
        Ok(true)
    }
}

#[derive(Clone)]
struct Server {
    clients: Arc<Mutex<HashMap<(usize, ChannelId), russh::server::Handle>>>,
    id: usize,
    /// client session
    c_session: Arc<russh::client::Handle<Client>>,
}

impl Server {
    async fn post(&mut self, data: CryptoVec) {
        let mut clients = self.clients.lock().await;
        for ((id, channel), ref mut s) in clients.iter_mut() {
            if *id != self.id {
                let _ = s.data(*channel, data.clone()).await;
            }
        }
    }
}

impl server::Server for Server {
    type Handler = Self;
    fn new_client(&mut self, _: Option<std::net::SocketAddr>) -> Self {
        let s = self.clone();
        self.id += 1;
        s
    }
}

#[async_trait]
impl server::Handler for Server {
    type Error = anyhow::Error;

    async fn channel_open_session(
        &mut self,
        channel: Channel<Msg>,
        session: &mut Session,
    ) -> Result<bool, Self::Error> {
        {
            let mut clients = self.clients.lock().await;
            clients.insert((self.id, channel.id()), session.handle());
        }
        Ok(true)
    }

    async fn auth_publickey(
        &mut self,
        _: &str,
        _: &key::PublicKey,
    ) -> Result<server::Auth, Self::Error> {
        Ok(server::Auth::Accept)
    }

    async fn data(
        &mut self,
        channel: ChannelId,
        data: &[u8],
        session: &mut Session,
    ) -> Result<(), Self::Error> {
        let data = CryptoVec::from(format!("Got data: {}\r\n", String::from_utf8_lossy(data)));
        self.post(data.clone()).await;
        session.data(channel, data);

        // How to make my client send data
        // to `localhost:2223` server

        Ok(())
    }
}

[Eugeny]

I can't provide you general programming help. To have a fully functional proxy, you need to do the same for every other Handler event, including channel opening.

[ghost]

Thank you, I figure out How to do that.