| | |
| | | package com.gitblit.transport.ssh; |
| | | |
| | | import java.io.File; |
| | | import java.io.FileOutputStream; |
| | | import java.io.IOException; |
| | | import java.io.OutputStreamWriter; |
| | | import java.net.InetSocketAddress; |
| | | import java.security.KeyPair; |
| | | import java.security.KeyPairGenerator; |
| | | import java.text.MessageFormat; |
| | | import java.util.concurrent.atomic.AtomicBoolean; |
| | | |
| | | import javax.inject.Singleton; |
| | | |
| | | import org.apache.sshd.SshServer; |
| | | import org.apache.sshd.common.io.IoServiceFactoryFactory; |
| | | import org.apache.sshd.common.io.mina.MinaServiceFactoryFactory; |
| | | import org.apache.sshd.common.io.nio2.Nio2ServiceFactoryFactory; |
| | | import org.apache.sshd.server.keyprovider.PEMGeneratorHostKeyProvider; |
| | | import org.apache.sshd.common.keyprovider.FileKeyPairProvider; |
| | | import org.apache.sshd.common.util.SecurityUtils; |
| | | import org.bouncycastle.openssl.PEMWriter; |
| | | import org.eclipse.jgit.internal.JGitText; |
| | | import org.slf4j.Logger; |
| | | import org.slf4j.LoggerFactory; |
| | | |
| | | import com.gitblit.Constants; |
| | | import com.gitblit.IStoredSettings; |
| | | import com.gitblit.Keys; |
| | | import com.gitblit.git.GitblitReceivePackFactory; |
| | | import com.gitblit.git.GitblitUploadPackFactory; |
| | | import com.gitblit.git.RepositoryResolver; |
| | | import com.gitblit.manager.IGitblit; |
| | | import com.gitblit.transport.ssh.commands.CreateRepository; |
| | | import com.gitblit.transport.ssh.commands.DispatchCommand; |
| | | import com.gitblit.transport.ssh.commands.Receive; |
| | | import com.gitblit.transport.ssh.commands.ReviewCommand; |
| | | import com.gitblit.transport.ssh.commands.SetAccountCommand; |
| | | import com.gitblit.transport.ssh.commands.Upload; |
| | | import com.gitblit.transport.ssh.commands.VersionCommand; |
| | | import com.gitblit.utils.IdGenerator; |
| | | import com.gitblit.transport.ssh.commands.SshCommandFactory; |
| | | import com.gitblit.utils.JnaUtils; |
| | | import com.gitblit.utils.StringUtils; |
| | | import com.gitblit.utils.WorkQueue; |
| | | |
| | | import dagger.Module; |
| | | import dagger.ObjectGraph; |
| | | import dagger.Provides; |
| | | import com.google.common.io.Files; |
| | | |
| | | /** |
| | | * Manager for the ssh transport. Roughly analogous to the |
| | | * {@link com.gitblit.transport.git.GitDaemon} class. |
| | | * |
| | | * @author Eric Myhre |
| | | * |
| | | */ |
| | | public class SshDaemon { |
| | |
| | | public static enum SshSessionBackend { |
| | | MINA, NIO2 |
| | | } |
| | | |
| | | |
| | | /** |
| | | * 22: IANA assigned port number for ssh. Note that this is a distinct |
| | | * concept from gitblit's default conf for ssh port -- this "default" is |
| | |
| | | */ |
| | | public static final int DEFAULT_PORT = 22; |
| | | |
| | | private static final String HOST_KEY_STORE = "sshKeyStore.pem"; |
| | | |
| | | private final AtomicBoolean run; |
| | | |
| | | private final IGitblit gitblit; |
| | | private final SshServer sshd; |
| | | private final ObjectGraph injector; |
| | | |
| | | /** |
| | | * Construct the Gitblit SSH daemon. |
| | | * |
| | | * @param gitblit |
| | | * @param workQueue |
| | | */ |
| | | public SshDaemon(IGitblit gitblit, IdGenerator idGenerator) { |
| | | public SshDaemon(IGitblit gitblit, WorkQueue workQueue) { |
| | | this.gitblit = gitblit; |
| | | this.injector = ObjectGraph.create(new SshModule()); |
| | | |
| | | |
| | | IStoredSettings settings = gitblit.getSettings(); |
| | | int port = settings.getInteger(Keys.git.sshPort, 0); |
| | | String bindInterface = settings.getString(Keys.git.sshBindInterface, |
| | | "localhost"); |
| | | |
| | | IKeyManager keyManager = getKeyManager(); |
| | | // Ensure that Bouncy Castle is our JCE provider |
| | | SecurityUtils.setRegisterBouncyCastle(true); |
| | | |
| | | // Generate host RSA and DSA keypairs and create the host keypair provider |
| | | File rsaKeyStore = new File(gitblit.getBaseFolder(), "ssh-rsa-hostkey.pem"); |
| | | File dsaKeyStore = new File(gitblit.getBaseFolder(), "ssh-dsa-hostkey.pem"); |
| | | generateKeyPair(rsaKeyStore, "RSA", 2048); |
| | | generateKeyPair(dsaKeyStore, "DSA", 0); |
| | | FileKeyPairProvider hostKeyPairProvider = new FileKeyPairProvider(); |
| | | hostKeyPairProvider.setFiles(new String [] { rsaKeyStore.getPath(), dsaKeyStore.getPath(), dsaKeyStore.getPath() }); |
| | | |
| | | // Client public key authenticator |
| | | CachingPublicKeyAuthenticator keyAuthenticator = |
| | | new CachingPublicKeyAuthenticator(gitblit.getPublicKeyManager(), gitblit); |
| | | |
| | | // Configure the preferred SSHD backend |
| | | String sshBackendStr = settings.getString(Keys.git.sshBackend, |
| | | SshSessionBackend.NIO2.name()); |
| | | SshSessionBackend backend = SshSessionBackend.valueOf(sshBackendStr); |
| | |
| | | backend == SshSessionBackend.MINA |
| | | ? MinaServiceFactoryFactory.class.getName() |
| | | : Nio2ServiceFactoryFactory.class.getName()); |
| | | |
| | | |
| | | // Create the socket address for binding the SSH server |
| | | int port = settings.getInteger(Keys.git.sshPort, 0); |
| | | String bindInterface = settings.getString(Keys.git.sshBindInterface, ""); |
| | | InetSocketAddress addr; |
| | | if (StringUtils.isEmpty(bindInterface)) { |
| | | addr = new InetSocketAddress(port); |
| | |
| | | addr = new InetSocketAddress(bindInterface, port); |
| | | } |
| | | |
| | | SshKeyAuthenticator publickeyAuthenticator = new SshKeyAuthenticator( |
| | | keyManager, gitblit); |
| | | // Create the SSH server |
| | | sshd = SshServer.setUpDefaultServer(); |
| | | sshd.setPort(addr.getPort()); |
| | | sshd.setHost(addr.getHostName()); |
| | | sshd.setKeyPairProvider(new PEMGeneratorHostKeyProvider(new File( |
| | | gitblit.getBaseFolder(), HOST_KEY_STORE).getPath())); |
| | | sshd.setPublickeyAuthenticator(publickeyAuthenticator); |
| | | sshd.setPasswordAuthenticator(new SshPasswordAuthenticator(gitblit)); |
| | | sshd.setSessionFactory(new SshSessionFactory()); |
| | | sshd.setKeyPairProvider(hostKeyPairProvider); |
| | | sshd.setPublickeyAuthenticator(keyAuthenticator); |
| | | sshd.setPasswordAuthenticator(new UsernamePasswordAuthenticator(gitblit)); |
| | | sshd.setSessionFactory(new SshServerSessionFactory()); |
| | | sshd.setFileSystemFactory(new DisabledFilesystemFactory()); |
| | | sshd.setTcpipForwardingFilter(new NonForwardingFilter()); |
| | | sshd.setCommandFactory(new SshCommandFactory(gitblit, workQueue)); |
| | | sshd.setShellFactory(new WelcomeShell(settings)); |
| | | |
| | | DispatchCommand gitblitCmd = new DispatchCommand(); |
| | | gitblitCmd.registerCommand(CreateRepository.class); |
| | | gitblitCmd.registerCommand(VersionCommand.class); |
| | | gitblitCmd.registerCommand(SetAccountCommand.class); |
| | | gitblitCmd.registerCommand(ReviewCommand.class); |
| | | |
| | | DispatchCommand gitCmd = new DispatchCommand(); |
| | | gitCmd.registerCommand(Upload.class); |
| | | gitCmd.registerCommand(Receive.class); |
| | | |
| | | DispatchCommand root = new DispatchCommand(); |
| | | root.registerDispatcher("gitblit", gitblitCmd); |
| | | root.registerDispatcher("git", gitCmd); |
| | | |
| | | root.setRepositoryResolver(new RepositoryResolver<SshDaemonClient>(gitblit)); |
| | | root.setUploadPackFactory(new GitblitUploadPackFactory<SshDaemonClient>(gitblit)); |
| | | root.setReceivePackFactory(new GitblitReceivePackFactory<SshDaemonClient>(gitblit)); |
| | | root.setAuthenticator(publickeyAuthenticator); |
| | | |
| | | SshCommandFactory commandFactory = new SshCommandFactory( |
| | | new WorkQueue(idGenerator), |
| | | root); |
| | | |
| | | sshd.setCommandFactory(commandFactory); |
| | | // Set the server id. This can be queried with: |
| | | // ssh-keyscan -t rsa,dsa -p 29418 localhost |
| | | String version = String.format("%s (%s-%s)", Constants.getGitBlitVersion().replace(' ', '_'), |
| | | sshd.getVersion(), sshBackendStr); |
| | | sshd.getProperties().put(SshServer.SERVER_IDENTIFICATION, version); |
| | | |
| | | run = new AtomicBoolean(false); |
| | | } |
| | |
| | | public String formatUrl(String gituser, String servername, String repository) { |
| | | if (sshd.getPort() == DEFAULT_PORT) { |
| | | // standard port |
| | | return MessageFormat.format("{0}@{1}/{2}", gituser, servername, |
| | | return MessageFormat.format("ssh://{0}@{1}/{2}", gituser, servername, |
| | | repository); |
| | | } else { |
| | | // non-standard port |
| | |
| | | run.set(false); |
| | | |
| | | try { |
| | | ((SshCommandFactory) sshd.getCommandFactory()).stop(); |
| | | sshd.stop(); |
| | | } catch (InterruptedException e) { |
| | | log.error("SSH Daemon stop interrupted", e); |
| | | } |
| | | } |
| | | } |
| | | |
| | | protected IKeyManager getKeyManager() { |
| | | IKeyManager keyManager = null; |
| | | IStoredSettings settings = gitblit.getSettings(); |
| | | String clazz = settings.getString(Keys.git.sshKeysManager, FileKeyManager.class.getName()); |
| | | if (StringUtils.isEmpty(clazz)) { |
| | | clazz = FileKeyManager.class.getName(); |
| | | } |
| | | try { |
| | | Class<? extends IKeyManager> managerClass = (Class<? extends IKeyManager>) Class.forName(clazz); |
| | | keyManager = injector.get(managerClass).start(); |
| | | if (keyManager.isReady()) { |
| | | log.info("{} is ready.", keyManager); |
| | | } else { |
| | | log.warn("{} is disabled.", keyManager); |
| | | } |
| | | } catch (Exception e) { |
| | | log.error("failed to create ssh key manager " + clazz, e); |
| | | keyManager = injector.get(NullKeyManager.class).start(); |
| | | } |
| | | return keyManager; |
| | | } |
| | | |
| | | /** |
| | | * A nested Dagger graph is used for constructor dependency injection of |
| | | * complex classes. |
| | | * |
| | | * @author James Moger |
| | | * |
| | | */ |
| | | @Module( |
| | | library = true, |
| | | injects = { |
| | | NullKeyManager.class, |
| | | FileKeyManager.class |
| | | } |
| | | ) |
| | | class SshModule { |
| | | |
| | | @Provides @Singleton NullKeyManager provideNullKeyManager() { |
| | | return new NullKeyManager(); |
| | | } |
| | | |
| | | @Provides @Singleton FileKeyManager provideFileKeyManager() { |
| | | return new FileKeyManager(SshDaemon.this.gitblit); |
| | | } |
| | | } |
| | | private void generateKeyPair(File file, String algorithm, int keySize) { |
| | | if (file.exists()) { |
| | | return; |
| | | } |
| | | try { |
| | | KeyPairGenerator generator = SecurityUtils.getKeyPairGenerator(algorithm); |
| | | if (keySize != 0) { |
| | | generator.initialize(keySize); |
| | | log.info("Generating {}-{} SSH host keypair...", algorithm, keySize); |
| | | } else { |
| | | log.info("Generating {} SSH host keypair...", algorithm); |
| | | } |
| | | KeyPair kp = generator.generateKeyPair(); |
| | | |
| | | // create an empty file and set the permissions |
| | | Files.touch(file); |
| | | try { |
| | | JnaUtils.setFilemode(file, JnaUtils.S_IRUSR | JnaUtils.S_IWUSR); |
| | | } catch (UnsatisfiedLinkError | UnsupportedOperationException e) { |
| | | // Unexpected/Unsupported OS or Architecture |
| | | } |
| | | |
| | | FileOutputStream os = new FileOutputStream(file); |
| | | PEMWriter w = new PEMWriter(new OutputStreamWriter(os)); |
| | | w.writeObject(kp); |
| | | w.flush(); |
| | | w.close(); |
| | | } catch (Exception e) { |
| | | log.warn(MessageFormat.format("Unable to generate {0} keypair", algorithm), e); |
| | | return; |
| | | } |
| | | } |
| | | } |