pax_global_header00006660000000000000000000000064150743454050014521gustar00rootroot0000000000000052 comment=417e7b8f6799bf4580e9bb91e8a3601607120de3 upterm-0.17.0/000077500000000000000000000000001507434540500131225ustar00rootroot00000000000000upterm-0.17.0/.github/000077500000000000000000000000001507434540500144625ustar00rootroot00000000000000upterm-0.17.0/.github/FUNDING.yml000066400000000000000000000000541507434540500162760ustar00rootroot00000000000000github: owenthereal open_collective: upterm upterm-0.17.0/.github/dependabot.yml000066400000000000000000000003171507434540500173130ustar00rootroot00000000000000version: 2 updates: - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" - package-ecosystem: "gomod" directory: "/" schedule: interval: "weekly" upterm-0.17.0/.github/workflows/000077500000000000000000000000001507434540500165175ustar00rootroot00000000000000upterm-0.17.0/.github/workflows/build-and-release.yaml000066400000000000000000000033451507434540500226650ustar00rootroot00000000000000name: Build and Release on: workflow_call: inputs: snapshot: description: 'Build snapshot (no publishing)' required: false default: true type: boolean docker_repo: description: 'Docker repository' required: false default: 'ghcr.io/owenthereal/upterm/uptermd' type: string jobs: goreleaser: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 with: fetch-depth: 0 - name: Set up Go uses: actions/setup-go@v6 with: go-version-file: go.mod check-latest: true - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Set up Docker QEMU uses: docker/setup-qemu-action@v3 with: platforms: 'amd64,arm64' - name: Login to ghcr.io if: ${{ !inputs.snapshot }} uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GH_TOKEN }} - name: Run GoReleaser (Snapshot) if: ${{ inputs.snapshot }} uses: goreleaser/goreleaser-action@v6 with: distribution: goreleaser version: '~> v2' args: release --clean --snapshot --skip=publish env: GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} DOCKER_REPO: ${{ inputs.docker_repo }} - name: Run GoReleaser (Release) if: ${{ !inputs.snapshot }} uses: goreleaser/goreleaser-action@v6 with: distribution: goreleaser version: '~> v2' args: release --clean env: GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} DOCKER_REPO: ${{ inputs.docker_repo }} upterm-0.17.0/.github/workflows/build.yaml000066400000000000000000000037111507434540500205040ustar00rootroot00000000000000name: Build on: push: branches: - master pull_request: permissions: contents: write packages: write jobs: build: name: Compile runs-on: ${{ matrix.os }} strategy: fail-fast: false matrix: os: [macos-latest, ubuntu-latest] steps: - uses: actions/checkout@v5 - name: Set up Go uses: actions/setup-go@v6 with: go-version-file: go.mod check-latest: true - name: Compile run: make install test-macos: name: Test (macOS) runs-on: macos-latest steps: - uses: actions/checkout@v5 - name: Set up Go uses: actions/setup-go@v6 with: go-version-file: go.mod check-latest: true - name: Test run: make test env: BASH_SILENCE_DEPRECATION_WARNING: 1 MUTE_FLAKY_TESTS: 1 test-ubuntu: name: Test (Ubuntu + Consul) runs-on: ubuntu-latest services: consul: image: consul:1.15 ports: - 8500:8500 options: >- --health-cmd "consul members" --health-interval 10s --health-timeout 5s --health-retries 5 steps: - uses: actions/checkout@v5 - name: Set up Go uses: actions/setup-go@v6 with: go-version-file: go.mod check-latest: true - name: Test run: make test env: BASH_SILENCE_DEPRECATION_WARNING: 1 MUTE_FLAKY_TESTS: 1 vet: name: Vet runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - name: Set up Go uses: actions/setup-go@v6 with: go-version-file: go.mod check-latest: true - name: Vet run: make vet build-and-release: name: Build and Release (Snapshot) uses: ./.github/workflows/build-and-release.yaml with: snapshot: true docker_repo: ghcr.io/owenthereal/upterm/uptermd secrets: inherit upterm-0.17.0/.github/workflows/codeql-analysis.yml000066400000000000000000000044361507434540500223410ustar00rootroot00000000000000# For most projects, this workflow file will not need changing; you simply need # to commit it to your repository. # # You may wish to alter this file to override the set of languages analyzed, # or to provide custom queries or build logic. # # ******** NOTE ******** # We have attempted to detect the languages in your repository. Please check # the `language` matrix defined below to confirm you have the correct set of # supported CodeQL languages. # name: "CodeQL" on: push: branches: [ master ] pull_request: # The branches below must be a subset of the branches above branches: [ master ] schedule: - cron: '26 15 * * 1' jobs: analyze: name: Analyze runs-on: ubuntu-latest permissions: actions: read contents: read security-events: write strategy: fail-fast: false matrix: language: [ 'go' ] # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] # Learn more about CodeQL language support at https://git.io/codeql-language-support steps: - name: Checkout repository uses: actions/checkout@v5 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. # queries: ./path/to/local/query, your-org/your-repo/queries@main # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild uses: github/codeql-action/autobuild@v4 # â„¹ï¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl # âœï¸ If the Autobuild fails above, remove it and uncomment the following three lines # and modify them (or add more) to build your code if your project # uses a compiled language #- run: | # make bootstrap # make release - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v4 upterm-0.17.0/.github/workflows/release.yaml000066400000000000000000000011661507434540500210270ustar00rootroot00000000000000name: Release on: push: tags: - 'v*' permissions: contents: write packages: write jobs: build-and-release: name: Release binaries and Docker images uses: ./.github/workflows/build-and-release.yaml with: snapshot: false docker_repo: ghcr.io/owenthereal/upterm/uptermd secrets: inherit deploy: name: Deploy app runs-on: ubuntu-latest needs: [build-and-release] steps: - uses: actions/checkout@v5 - uses: superfly/flyctl-actions/setup-flyctl@master - run: flyctl deploy --remote-only env: FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }} upterm-0.17.0/.gitignore000066400000000000000000000001151507434540500151070ustar00rootroot00000000000000build c.out release .terraform *.tfstate *.tfstate.backup dist bin CLAUDE.md upterm-0.17.0/.goreleaser.yml000066400000000000000000000134231507434540500160560ustar00rootroot00000000000000version: 2 builds: - id: upterm env: - CGO_ENABLED=0 goos: - linux - darwin goarch: - "386" - "amd64" - "arm" - "arm64" main: ./cmd/upterm ldflags: - -s -w -X github.com/owenthereal/upterm/internal/version.Version={{.Version}} -X github.com/owenthereal/upterm/internal/version.GitCommit={{.Commit}} -X github.com/owenthereal/upterm/internal/version.Date={{.CommitDate}} - id: uptermd env: - CGO_ENABLED=0 goos: - linux goarch: - "amd64" - "arm64" main: ./cmd/uptermd binary: uptermd ldflags: - -s -w -X github.com/owenthereal/upterm/internal/version.Version={{.Version}} -X github.com/owenthereal/upterm/internal/version.GitCommit={{.Commit}} -X github.com/owenthereal/upterm/internal/version.Date={{.CommitDate}} archives: - id: upterm name_template: '{{ .Binary }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}' wrap_in_directory: false ids: - upterm files: - LICENSE* - README* - etc/* - docs/* - id: uptermd name_template: '{{ .Binary }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}' wrap_in_directory: false ids: - uptermd files: - LICENSE* - README* homebrew_casks: - repository: owner: owenthereal name: homebrew-upterm commit_author: name: Owen Ou email: o@owenou.com homepage: https://upterm.dev description: Instant Terminal Sharing directory: Casks ids: - upterm license: "Apache 2.0" manpages: - "etc/man/man1/upterm.1" - "etc/man/man1/upterm-host.1" - "etc/man/man1/upterm-proxy.1" - "etc/man/man1/upterm-session.1" - "etc/man/man1/upterm-session-current.1" - "etc/man/man1/upterm-session-info.1" - "etc/man/man1/upterm-session-list.1" - "etc/man/man1/upterm-upgrade.1" - "etc/man/man1/upterm-version.1" completions: bash: "etc/completion/upterm.bash_completion.sh" zsh: "etc/completion/upterm.zsh_completion" hooks: post: install: | if system_command("/usr/bin/xattr", args: ["-h"]).exit_status == 0 system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/upterm"] end dockers: - image_templates: - "{{ .Env.DOCKER_REPO }}:{{ .Tag }}-amd64" - "{{ .Env.DOCKER_REPO }}:latest-amd64" dockerfile: Dockerfile.uptermd use: buildx build_flag_templates: - "--target=pre-built-binary" - "--platform=linux/amd64" - "--label=org.opencontainers.image.title={{ .ProjectName }}" - "--label=org.opencontainers.image.description=Upterm server daemon" - "--label=org.opencontainers.image.url=https://github.com/owenthereal/upterm" - "--label=org.opencontainers.image.source=https://github.com/owenthereal/upterm" - "--label=org.opencontainers.image.version={{ .Version }}" - '--label=org.opencontainers.image.created={{ time "2006-01-02T15:04:05Z07:00" }}' - "--label=org.opencontainers.image.revision={{ .FullCommit }}" - "--label=org.opencontainers.image.licenses=Apache-2.0" extra_files: - go.mod - go.sum ids: - uptermd goos: linux goarch: amd64 - image_templates: - "{{ .Env.DOCKER_REPO }}:{{ .Tag }}-arm64" - "{{ .Env.DOCKER_REPO }}:latest-arm64" dockerfile: Dockerfile.uptermd use: buildx build_flag_templates: - "--target=pre-built-binary" - "--platform=linux/arm64" - "--label=org.opencontainers.image.title={{ .ProjectName }}" - "--label=org.opencontainers.image.description=Upterm server daemon" - "--label=org.opencontainers.image.url=https://github.com/owenthereal/upterm" - "--label=org.opencontainers.image.source=https://github.com/owenthereal/upterm" - "--label=org.opencontainers.image.version={{ .Version }}" - '--label=org.opencontainers.image.created={{ time "2006-01-02T15:04:05Z07:00" }}' - "--label=org.opencontainers.image.revision={{ .FullCommit }}" - "--label=org.opencontainers.image.licenses=Apache-2.0" extra_files: - go.mod - go.sum ids: - uptermd goos: linux goarch: arm64 docker_manifests: - name_template: "{{ .Env.DOCKER_REPO }}:{{ .Tag }}" image_templates: - "{{ .Env.DOCKER_REPO }}:{{ .Tag }}-amd64" - "{{ .Env.DOCKER_REPO }}:{{ .Tag }}-arm64" - name_template: "{{ .Env.DOCKER_REPO }}:latest" image_templates: - "{{ .Env.DOCKER_REPO }}:latest-amd64" - "{{ .Env.DOCKER_REPO }}:latest-arm64" checksum: name_template: "checksums.txt" snapshot: version_template: "{{ incpatch .Version }}-snapshot" release: prerelease: auto name_template: "Upterm {{.Version}}" mode: append changelog: sort: asc use: github filters: exclude: - "^docs:" - "^script:" - "^go.mod:" - "^.github:" - Merge branch nfpms: #build:linux - license: Apache-2.0 maintainer: Owen Ou ids: - upterm homepage: https://github.com/owenthereal/upterm bindir: /usr/bin description: Instant Terminal Sharing file_name_template: '{{ .PackageName }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}' formats: - deb - rpm contents: - src: "./etc/man/man1/upterm*.1" dst: "/usr/share/man/man1" - src: "./etc/completion/upterm.bash_completion.sh" dst: "/usr/share/bash-completion/completions/upterm" - src: "./etc/completion/upterm.zsh_completion" dst: "/usr/share/zsh/site-functions/_upterm" upterm-0.17.0/CONTRIBUTING.md000066400000000000000000000101711507434540500153530ustar00rootroot00000000000000# Contributing When contributing to this repository, please first discuss the change you wish to make via issue, email, or any other method with the owners of this repository before making a change. Please note we have a code of conduct, please follow it in all your interactions with the project. ## Pull Request Process 1. Ensure any install or build dependencies are removed before the end of the layer when doing a build. 2. Update the README.md with details of changes to the interface, this includes new environment variables, exposed ports, useful file locations and container parameters. 3. Increase the version numbers in any examples files and the README.md to the new version that this Pull Request would represent. The versioning scheme we use is [SemVer](http://semver.org/). 4. You may merge the Pull Request in once you have the sign-off of two other developers, or if you do not have permission to do that, you may request the second reviewer to merge it for you. ## Code of Conduct ### Our Pledge In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. ### Our Standards Examples of behavior that contributes to creating a positive environment include: * Using welcoming and inclusive language * Being respectful of differing viewpoints and experiences * Gracefully accepting constructive criticism * Focusing on what is best for the community * Showing empathy towards other community members Examples of unacceptable behavior by participants include: * The use of sexualized language or imagery and unwelcome sexual attention or advances * Trolling, insulting/derogatory comments, and personal or political attacks * Public or private harassment * Publishing others' private information, such as a physical or electronic address, without explicit permission * Other conduct which could reasonably be considered inappropriate in a professional setting ### Our Responsibilities Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. ### Scope This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. ### Enforcement Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at [INSERT EMAIL ADDRESS]. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. ### Attribution This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version] [homepage]: http://contributor-covenant.org [version]: http://contributor-covenant.org/version/1/4/ upterm-0.17.0/Dockerfile.uptermd000066400000000000000000000015641507434540500166010ustar00rootroot00000000000000# syntax=docker/dockerfile:1 # Build stage - builds from source (used by Fly deployment) FROM golang:latest AS builder ARG TARGETOS ARG TARGETARCH WORKDIR /src ENV CGO_ENABLED=0 RUN --mount=target=. \ --mount=type=cache,target=/root/.cache/go-build \ --mount=type=cache,target=/go/pkg \ GOOS=$TARGETOS GOARCH=$TARGETARCH go install ./cmd/... # Base runtime stage FROM gcr.io/distroless/static:nonroot AS base WORKDIR /app ENV PATH="/app:${PATH}" # sshd ws & prometheus EXPOSE 2222 8080 9090 # Fly deployment stage (builds from source) FROM base AS uptermd-fly COPY --from=builder /go/bin/uptermd /go/bin/uptermd-fly /app/ ENTRYPOINT ["uptermd-fly"] # Pre-built binary stage (used by GoReleaser) FROM base AS pre-built-binary COPY uptermd /app/ ENTRYPOINT ["uptermd"] # Default stage FROM base AS uptermd COPY --from=builder /go/bin/uptermd /app/ ENTRYPOINT ["uptermd"] upterm-0.17.0/LICENSE000066400000000000000000000261351507434540500141360ustar00rootroot00000000000000 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. upterm-0.17.0/Makefile000066400000000000000000000027301507434540500145640ustar00rootroot00000000000000SHELL=/bin/bash -o pipefail BIN_DIR ?= $(CURDIR)/bin export PATH := $(BIN_DIR):$(PATH) .PHONY: tools tools: rm -rf $(BIN_DIR) && mkdir -p $(BIN_DIR) # goreleaser GOBIN=$(BIN_DIR) go install github.com/goreleaser/goreleaser@latest .PHONY: generate generate: proto .PHONY: docs docs: rm -rf docs && mkdir docs rm -rf etc && mkdir -p etc/man/man1 && mkdir -p etc/completion go run cmd/gendoc/main.go .PHONY: proto proto: docker run -v $(CURDIR)/server:/defs namely/protoc-all -f server.proto -l go --go-source-relative -o . docker run -v $(CURDIR)/host/api:/defs namely/protoc-all -f api.proto -l go --go-source-relative -o . .PHONY: build build: go build -o $(BIN_DIR)/upterm ./cmd/upterm go build -o $(BIN_DIR)/uptermd ./cmd/uptermd go build -o $(BIN_DIR)/uptermd-fly ./cmd/uptermd-fly .PHONY: install install: go install ./cmd/... TAG ?= latest REPO ?= ghcr.io/owenthereal/upterm/uptermd DOCKER_BUILD_FLAGS ?= --load .PHONY: docker_build docker_build: docker buildx build -t $(REPO):$(TAG) -f Dockerfile.uptermd $(DOCKER_BUILD_FLAGS) . GO_TEST_FLAGS ?= "" .PHONY: test test: go test ./... -timeout=120s -coverprofile=c.out -covermode=atomic -count=1 -race -v $(GO_TEST_FLAGS) .PHONY: vet vet: docker run --rm -v $(CURDIR):/app:z -w /app golangci/golangci-lint:latest golangci-lint run -v --timeout 15m --fix DOCKER_REPO ?= ghcr.io/owenthereal/upterm/uptermd .PHONY: goreleaser goreleaser: DOCKER_REPO=$(DOCKER_REPO) goreleaser release --clean --snapshot --skip=publish upterm-0.17.0/Procfile000066400000000000000000000001761507434540500146140ustar00rootroot00000000000000web: bin/uptermd --ssh-addr 0.0.0.0:2222 --ws-addr 0.0.0.0:$PORT --node-addr ${HEROKU_PRIVATE_IP:-0.0.0.0}:2222 --network mem upterm-0.17.0/README.md000066400000000000000000000313641507434540500144100ustar00rootroot00000000000000# Upterm [Upterm](https://github.com/owenthereal/upterm) is an open-source tool enabling developers to share terminal sessions securely over the web. It’s perfect for remote pair programming, accessing computers behind NATs/firewalls, remote debugging, and more. This is a [blog post](https://owenou.com/upterm) to describe Upterm in depth. ## :movie_camera: Quick Demo [![demo](https://raw.githubusercontent.com/owenthereal/upterm/gh-pages/demo.gif)](https://asciinema.org/a/efeKPxxzKi3pkyu9LWs1yqdbB) ## :rocket: Getting Started ## Installation ### Mac ```console brew install owenthereal/upterm/upterm ``` ### Standalone `upterm` can be easily installed as an executable. Download the latest [compiled binaries](https://github.com/owenthereal/upterm/releases) and put it in your executable path. ### From source ```console git clone git@github.com:owenthereal/upterm.git cd upterm go install ./cmd/upterm/... ``` ## :wrench: Basic Usage 1. Host starts a terminal session: ```console upterm host ``` 2. Host retrieves and shares the SSH connection string: ```console upterm session current ``` 3. Client connects using the shared string: ```console ssh TOKEN@uptermd.upterm.dev ``` ## :blue_book: Quick Reference Dive into more commands and advanced usage in the [documentation](docs/upterm.md). Below are some notable highlights: ### Command Execution Host a session with any desired command: ```console upterm host -- docker run --rm -ti ubuntu bash ``` ### Access Control Host a session with specified client public key(s) authorized to connect: ```console upterm host --authorized-key PATH_TO_PUBLIC_KEY ``` Authorize specified GitHub, GitLab, SourceHut, Codeberg users with their corresponding public keys: ```console upterm host --github-user username upterm host --gitlab-user username upterm host --srht-user username upterm host --codeberg-user username ``` ### Force command Host a session initiating `tmux new -t pair-programming`, while ensuring clients join with `tmux attach -t pair-programming`. This mirrors functionality provided by tmate: ```console upterm host --force-command 'tmux attach -t pair-programming' -- tmux new -t pair-programming ``` ### WebSocket Connection In scenarios where your host restricts ssh transport, establish a connection to `uptermd.upterm.dev` (or your self-hosted server) via WebSocket: ```console upterm host --server wss://uptermd.upterm.dev -- bash ``` Clients can connect to the host session via WebSocket as well: ```console ssh -o ProxyCommand='upterm proxy wss://TOKEN@uptermd.upterm.dev' TOKEN@uptermd.upterm.dev:443 ``` ### Debug GitHub Actions `upterm` can be integrated with GitHub Actions to enable real-time SSH debugging, allowing you to interact directly with the runner system during workflow execution. This is achieved through [action-upterm](https://github.com/owenthereal/action-upterm), which sets up an `upterm` session within your CI pipeline. To get started, include `action-upterm` in your GitHub Actions workflow as follows: ```yaml name: CI on: [push] jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Setup upterm session uses: owenthereal/action-upterm@v1 ``` This setup allows you to SSH into the workflow runner whenever you need to troubleshoot or inspect the execution environment. Find the SSH connection string in the `Checks` tab of your Pull Request or in the workflow logs. For comprehensive details on configuring and using this integration, visit the [action-upterm GitHub repo](https://github.com/owenthereal/action-upterm). ## :bulb: Tips ### Resolving Tmux Session Display Issue **Issue**: The command `upterm session current` does not display the current session when used within Tmux. **Cause**: This occurs because `upterm session current` requires the `UPTERM_ADMIN_SOCKET` environment variable, which is set in the specified command. Tmux, however, does not carry over environment variables not on its default list to any Tmux session unless instructed to do so ([Reference](http://man.openbsd.org/i386/tmux.1#GLOBAL_AND_SESSION_ENVIRONMENT)). **Solution**: To rectify this, add the following line to your `~/.tmux.conf`: ```conf set-option -ga update-environment " UPTERM_ADMIN_SOCKET" ``` ### Identifying Upterm Session **Issue**: It might be unclear whether your shell command is running in an upterm session, especially with common shell commands like `bash` or `zsh`. **Solution**: To provide a clear indication, amend your `~/.bashrc` or `~/.zshrc` with the following line. This decorates your prompt with an emoji whenever the shell command is running in an upterm session: ```bash export PS1="$([[ ! -z "${UPTERM_ADMIN_SOCKET}" ]] && echo -e '\xF0\x9F\x86\x99 ')$PS1" # Add an emoji to the prompt if `UPTERM_ADMIN_SOCKET` exists ``` ## :gear: How it works Upterm starts an SSH server (a.k.a. `sshd`) in the host machine and sets up a reverse SSH tunnel to a [Upterm server](https://github.com/owenthereal/upterm/tree/master/cmd/uptermd) (a.k.a. `uptermd`). Clients connect to a terminal session over the public internet via `uptermd` using `ssh` or `ssh` over WebSocket. ![upterm flowchart](https://raw.githubusercontent.com/owenthereal/upterm/gh-pages/upterm-flowchart.svg?sanitize=true) ## :hammer_and_wrench: Deployment ### Kubernetes You can deploy uptermd to a Kubernetes cluster. Install it with [helm](https://helm.sh): ```console helm repo add upterm https://upterm.dev helm repo update helm install uptermd upterm/uptermd ``` ### Fly.io The cheapest way to deploy a worry-free [Upterm server](https://github.com/owenthereal/upterm/tree/master/cmd/uptermd) (a.k.a. `uptermd`) is to use [Fly.io](https://fly.io). Fly offers a generous free tier and excellent global performance. The official uptermd community server is hosted on Fly. 1. Install the Fly CLI and authenticate: ```console curl -L https://fly.io/install.sh | sh flyctl auth login ``` 2. Copy and customize the [`fly.example.toml`](./fly.example.toml) file to `fly.toml` for your deployment configuration. 3. Deploy your uptermd server: ```console flyctl deploy ``` Your uptermd server will be available at `your-app-name.fly.dev`. You can connect using either SSH or WebSocket protocols. ### Heroku You can deploy an [Upterm server](https://github.com/owenthereal/upterm/tree/master/cmd/uptermd) (a.k.a. `uptermd`) to [Heroku](https://heroku.com). Note that Heroku discontinued their free tier in November 2022, so this option now requires paid plans. You can deploy with one click of the following button: [![Deploy](https://www.herokucdn.com/deploy/button.svg)](https://heroku.com/deploy) You can also automate the deployment with [Heroku Terraform](https://devcenter.heroku.com/articles/using-terraform-with-heroku). The Heroku Terraform scripts are in the [terraform/heroku folder](./terraform/heroku). A [util script](./bin/heroku-install) is provided for your convenience to automate everything: ```console git clone https://github.com/owenthereal/upterm cd upterm ``` Provision uptermd in Heroku Common Runtime. Follow instructions. ```console bin/heroku-install ``` Provision uptermd in Heroku Private Spaces. Follow instructions. ```console TF_VAR_heroku_region=REGION TF_VAR_heroku_space=SPACE_NAME TF_VAR_heroku_team=TEAM_NAME bin/heroku-install ``` You **must** use WebSocket as the protocol for a Heroku-deployed Uptermd server because the platform only support HTTP/HTTPS routing. This is how you host a session and join a session: Use the Heroku-deployed Uptermd server via WebSocket ```console upterm host --server wss://YOUR_HEROKU_APP_URL -- YOUR_COMMAND ``` A client connects to the host session via WebSocket ```console ssh -o ProxyCommand='upterm proxy wss://TOKEN@YOUR_HEROKU_APP_URL' TOKEN@YOUR_HEROKU_APP_URL:443 ``` ### Digital Ocean There is an util script that makes provisioning [Digital Ocean Kubernetes](https://www.digitalocean.com/products/kubernetes) and an Upterm server easier: ```bash TF_VAR_do_token=$DO_PAT \ TF_VAR_uptermd_host=uptermd.upterm.dev \ TF_VAR_uptermd_acme_email=YOUR_EMAIL \ TF_VAR_uptermd_helm_repo=http://localhost:8080 \ TF_VAR_uptermd_host_keys_dir=PATH_TO_HOST_KEYS \ bin/do-install ``` ### Systemd A hardened systemd service is provided in `systemd/uptermd.service`. You can use it to easily run a secured `uptermd` on your machine: ```console cp systemd/uptermd.service /etc/systemd/system/uptermd.service systemctl daemon-reload systemctl start uptermd ``` ### Traefik Below is an example `docker-compose` configuration for deploying `uptermd` behind [Traefik](https://doc.traefik.io/traefik/), including support for both SSH and WebSocket connections: ```yaml services: upterm: build: https://github.com/owenthereal/upterm labels: - "traefik.enable=true" - "traefik.docker.network=web" # SSH over TCP (port 2222) - "traefik.tcp.services.uptermd.loadbalancer.server.port=2222" - "traefik.tcp.services.uptermd.loadbalancer.proxyProtocol.version=2" # required for real IP forwarding over TCP - "traefik.tcp.routers.uptermd.service=uptermd" - "traefik.tcp.routers.uptermd.rule=HostSNI(`*`)" - "traefik.tcp.routers.uptermd.entrypoints=uptermd" # WebSocket over HTTPS (port 8443) - "traefik.http.services.uptermd-wss.loadbalancer.server.port=8443" - "traefik.http.routers.uptermd-wss.service=uptermd-wss" - "traefik.http.routers.uptermd-wss.rule=Host(`upterm.example.com`)" # edit as needed - "traefik.http.routers.uptermd-wss.entrypoints=websecure" - "traefik.http.routers.uptermd-wss.tls.certresolver=" command: - --ssh-addr=0.0.0.0:2222 - --ws-addr=0.0.0.0:8443 - --ssh-proxy-protocol networks: - web networks: web: external: true ``` **Important notes:** - **Proxy Protocol:** The `--ssh-proxy-protocol` flag (or `UPTERMD_SSH_PROXY_PROTOCOL=true` environment variable) tells `uptermd` to expect the [PROXY protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) header on incoming SSH connections. This is essential when using Traefik (or other TCP proxies like HAProxy or AWS ELB) to preserve the real client IP address. **If you enable `--ssh-proxy-protocol`, all incoming SSH connections must come through a proxy that supports and is configured to use the PROXY protocol. Direct SSH connections will fail, as `uptermd` will expect the protocol header.** - **Entrypoints:** Make sure to configure the appropriate [Traefik entrypoints](https://doc.traefik.io/traefik/routing/entrypoints/). This example uses two: one for SSH (`uptermd` on port `2222`) and one for WebSocket/HTTPS (`websecure` on port `443`). - **WebSocket:** The WebSocket service allows clients to connect to `uptermd` over HTTPS, which is useful in restrictive network environments. - **Certificates:** Replace `` with your actual Traefik certificate resolver for TLS. For more details on Traefik TCP and HTTP routing, see the [Traefik documentation](https://doc.traefik.io/traefik/routing/overview/). ## :chart_with_upwards_trend: Monitoring `uptermd` exposes Prometheus metrics at the `/metrics` endpoint when configured with `--metric-addr` (or `UPTERMD_METRIC_ADDR` environment variable). Available metrics: - `routing_connections_count` (Counter) - Total number of SSH connections accepted - `routing_active_connections_count` (Gauge) - Current number of active SSH connections - `routing_connection_duration_seconds` (Histogram) - Connection duration in seconds - `routing_errors_count` (Counter) - Total number of connection errors - `routing_connection_timeout_count` (Counter) - Number of connections that timed out during establishment ## :balance_scale: Comparison with Prior Arts Upterm stands as a modern alternative to [Tmate](https://tmate.io). Tmate originates as a fork from an older iteration of Tmux, extending terminal sharing capabilities atop Tmux 2.x. However, Tmate has no plans to align with the latest Tmux updates, compelling Tmate & Tmux users to manage two separate configurations. For instance, the necessity to [bind identical keys twice, conditionally](https://github.com/tmate-io/tmate/issues/108). On the flip side, Upterm is architected from the ground up to be an independent solution, not a fork. It embodies the idea of connecting the input & output of any shell command between a host and its clients, transcending beyond merely `tmux`. This paves the way for securely sharing terminal sessions utilizing containers. Written in Go, Upterm is more hack-friendly compared to Tmate, which is crafted in C, akin to Tmux. The seamless compilation of Upterm CLI and server (`uptermd`) into a single binary facilitates swift [deployment of your pairing server](#hammer_and_wrench-deployment) across any cloud environment, devoid of dependencies. ## License [Apache 2.0](https://github.com/owenthereal/upterm/blob/master/LICENSE) upterm-0.17.0/app.json000066400000000000000000000005761507434540500146050ustar00rootroot00000000000000{ "name": "Upterm", "keywords": [ "golang", "terminal", "upterm", "uptermd" ], "website": "https://upterm.dev", "success_url": "/getting-started", "description": "Secure Terminal Sharing", "repository": "https://github.com/owenthereal/upterm", "buildpacks": [ { "url": "heroku/go" } ] }upterm-0.17.0/charts/000077500000000000000000000000001507434540500144065ustar00rootroot00000000000000upterm-0.17.0/charts/uptermd/000077500000000000000000000000001507434540500160665ustar00rootroot00000000000000upterm-0.17.0/charts/uptermd/.helmignore000066400000000000000000000005351507434540500202230ustar00rootroot00000000000000# Patterns to ignore when building packages. # This supports shell glob matching, relative path matching, and # negation (prefixed with !). Only one pattern per line. .DS_Store # Common VCS dirs .git/ .gitignore .bzr/ .bzrignore .hg/ .hgignore .svn/ # Common backup files *.swp *.bak *.tmp *.orig *~ # Various IDEs .project .idea/ *.tmproj .vscode/ upterm-0.17.0/charts/uptermd/Chart.yaml000066400000000000000000000004571507434540500200210ustar00rootroot00000000000000apiVersion: v2 name: uptermd description: Secure Terminal Sharing type: application version: 0.2.0 appVersion: 0.14.3 home: https://upterm.dev sources: - https://github.com/owenthereal/upterm dependencies: maintainers: - name: Owen Ou email: o@owenou.com url: https://github.com/owenthereal upterm-0.17.0/charts/uptermd/templates/000077500000000000000000000000001507434540500200645ustar00rootroot00000000000000upterm-0.17.0/charts/uptermd/templates/NOTES.txt000066400000000000000000000022751507434540500215230ustar00rootroot00000000000000Host a terminal session by running these commands: {{- if contains "NodePort" .Values.service.type }} export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") upterm host --server ssh://$NODE_IP:22 -- bash {{- else if contains "LoadBalancer" .Values.service.type }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "upterm.fullname" . }}' export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "upterm.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") upterm host --server ssh://$SERVICE_IP:22 -- bash {{- else if contains "ClusterIP" .Values.service.type }} export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "upterm.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 2222:22 upterm host --server ssh://localhost:2222 -- bash {{- end }} upterm-0.17.0/charts/uptermd/templates/_helpers.tpl000066400000000000000000000034221507434540500224070ustar00rootroot00000000000000{{/* vim: set filetype=mustache: */}} {{/* Expand the name of the chart. */}} {{- define "upterm.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} {{- end }} {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). If release name contains chart name it will be used as a full name. */}} {{- define "upterm.fullname" -}} {{- if .Values.fullnameOverride }} {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} {{- else }} {{- $name := default .Chart.Name .Values.nameOverride }} {{- if contains $name .Release.Name }} {{- .Release.Name | trunc 63 | trimSuffix "-" }} {{- else }} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} {{- end }} {{- end }} {{- end }} {{/* Create chart name and version as used by the chart label. */}} {{- define "upterm.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} {{/* Common labels */}} {{- define "upterm.labels" -}} helm.sh/chart: {{ include "upterm.chart" . }} {{ include "upterm.selectorLabels" . }} {{- if .Chart.AppVersion }} app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} {{- end }} app.kubernetes.io/managed-by: {{ .Release.Service }} {{- end }} {{/* Selector labels */}} {{- define "upterm.selectorLabels" -}} app.kubernetes.io/name: {{ include "upterm.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} {{/* Create the name of the service account to use */}} {{- define "upterm.serviceAccountName" -}} {{- if .Values.serviceAccount.create }} {{- default (include "upterm.fullname" .) .Values.serviceAccount.name }} {{- else }} {{- default "default" .Values.serviceAccount.name }} {{- end }} {{- end }} upterm-0.17.0/charts/uptermd/templates/deployment.yaml000066400000000000000000000060221507434540500231300ustar00rootroot00000000000000apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "upterm.fullname" . }} labels: {{- include "upterm.labels" . | nindent 4 }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} {{- end }} selector: matchLabels: {{- include "upterm.selectorLabels" . | nindent 6 }} template: metadata: {{- with .Values.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} labels: {{- include "upterm.selectorLabels" . | nindent 8 }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "upterm.serviceAccountName" . }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} args: - --ssh-addr - $(POD_IP):22 {{- if .Values.websocket.enabled }} - --ws-addr - $(POD_IP):80 {{- end }} - --node-addr - $(POD_IP):22 - --hostname - {{ .Values.hostname }} {{- range $key, $val := .Values.host_keys }} {{ if hasSuffix ".pub" $key }} {{ else }} - --private-key - /host-keys/{{ $key }} {{- end }} {{- end }} - --network - mem - --metric-addr - $(POD_IP):9090 {{- if .Values.debug }} - --debug {{- end }} env: - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP ports: - containerPort: 22 name: sshd {{- if .Values.websocket.enabled }} - containerPort: 80 name: ws {{- end }} - containerPort: 9090 name: exporter readinessProbe: tcpSocket: port: 22 periodSeconds: 10 livenessProbe: tcpSocket: port: 22 periodSeconds: 20 resources: {{- toYaml .Values.resources | nindent 12 }} volumeMounts: - mountPath: /host-keys name: host-keys volumes: - name: host-keys secret: secretName: {{ include "upterm.fullname" . }} defaultMode: 0600 {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} upterm-0.17.0/charts/uptermd/templates/hpa.yaml000066400000000000000000000017241507434540500215240ustar00rootroot00000000000000{{- if .Values.autoscaling.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: {{ include "upterm.fullname" . }} labels: {{- include "upterm.labels" . | nindent 4 }} spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: {{ include "upterm.fullname" . }} minReplicas: {{ .Values.autoscaling.minReplicas }} maxReplicas: {{ .Values.autoscaling.maxReplicas }} metrics: {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - type: Resource resource: name: cpu target: type: Utilization averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} {{- end }} {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} - type: Resource resource: name: memory target: type: Utilization averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} {{- end }} {{- end }} upterm-0.17.0/charts/uptermd/templates/ingress.yaml000066400000000000000000000021231507434540500224200ustar00rootroot00000000000000{{- if .Values.websocket.enabled }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: {{ include "upterm.fullname" . }} labels: {{- include "upterm.labels" . | nindent 4 }} annotations: kubernetes.io/ingress.class: {{ .Values.websocket.ingress_nginx_ingress_class }} nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" nginx.ingress.kubernetes.io/limit-connections: "4" nginx.ingress.kubernetes.io/limit-rps: "5" cert-manager.io/issuer: {{ include "upterm.fullname" . }}-letsencrypt {{- with .Values.websocket.ingress.annotations }} {{- toYaml . | nindent 4 }} {{- end }} spec: tls: - hosts: - {{ .Values.hostname }} secretName: {{ .Values.hostname | replace "." "-" }}-tls rules: - host: {{ .Values.hostname }} http: paths: - path: / pathType: Prefix backend: service: name: {{ include "upterm.fullname" . }} port: number: 80 {{- end }} upterm-0.17.0/charts/uptermd/templates/issuer.yaml000066400000000000000000000013101507434540500222550ustar00rootroot00000000000000{{- if .Values.websocket.enabled }} apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: {{ include "upterm.fullname" . }}-letsencrypt labels: {{- include "upterm.labels" . | nindent 4 }} spec: acme: # The ACME server URL server: https://acme-v02.api.letsencrypt.org/directory # Email address used for ACME registration email: {{ .Values.websocket.cert_manager_acme_email }} # Name of a secret used to store the ACME account private key privateKeySecretRef: name: {{ include "upterm.fullname" . }}-letsencrypt # Enable the HTTP-01 challenge provider solvers: - http01: ingress: class: {{ .Values.websocket.ingress_nginx_ingress_class }} {{- end }} upterm-0.17.0/charts/uptermd/templates/secret.yaml000066400000000000000000000003631507434540500222370ustar00rootroot00000000000000apiVersion: v1 kind: Secret metadata: name: {{ include "upterm.fullname" . }} labels: {{- include "upterm.labels" . | nindent 4 }} type: Opaque data: {{- range $key, $val := .Values.host_keys }} {{ $key }}: {{ $val }} {{- end }} upterm-0.17.0/charts/uptermd/templates/service.yaml000066400000000000000000000010601507434540500224050ustar00rootroot00000000000000apiVersion: v1 kind: Service metadata: name: {{ include "upterm.fullname" . }} labels: {{- include "upterm.labels" . | nindent 4 }} {{- with .Values.service.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: type: {{ .Values.service.type }} ports: - port: 22 protocol: TCP targetPort: 22 name: sshd {{- if .Values.websocket.enabled }} - port: 80 protocol: TCP targetPort: 80 name: ws {{- end }} selector: {{- include "upterm.selectorLabels" . | nindent 4 }} upterm-0.17.0/charts/uptermd/templates/serviceaccount.yaml000066400000000000000000000004761507434540500237740ustar00rootroot00000000000000{{- if .Values.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "upterm.serviceAccountName" . }} labels: {{- include "upterm.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} {{- end }} upterm-0.17.0/charts/uptermd/templates/tests/000077500000000000000000000000001507434540500212265ustar00rootroot00000000000000upterm-0.17.0/charts/uptermd/templates/tests/test-connection.yaml000066400000000000000000000006001507434540500252220ustar00rootroot00000000000000apiVersion: v1 kind: Pod metadata: name: "{{ include "upterm.fullname" . }}-test-connection" labels: {{- include "upterm.labels" . | nindent 4 }} annotations: "helm.sh/hook": test-success spec: containers: - name: wget image: busybox command: ['wget'] args: ['{{ include "upterm.fullname" . }}:{{ .Values.service.port }}'] restartPolicy: Never upterm-0.17.0/charts/uptermd/values.yaml000066400000000000000000000027351507434540500202600ustar00rootroot00000000000000# Default values for upterm. # This is a YAML-formatted file. # Declare variables to be passed into your templates. replicaCount: 1 image: repository: ghcr.io/owenthereal/upterm/uptermd pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. tag: latest imagePullSecrets: [] nameOverride: "" fullnameOverride: "" debug: false serviceAccount: # Specifies whether a service account should be created create: true # Annotations to add to the service account annotations: {} # The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" podAnnotations: {} podSecurityContext: {} # fsGroup: 2000 securityContext: {} # capabilities: # drop: # - ALL # readOnlyRootFilesystem: true # runAsNonRoot: true # runAsUser: 1000 service: type: ClusterIP # Set to LoadBalancer to accept traffic from outside the cluster # type: LoadBalancer annotations: {} resources: limits: cpu: 100m memory: 512Mi requests: cpu: 100m memory: 512Mi autoscaling: enabled: false minReplicas: 1 maxReplicas: 10 targetCPUUtilizationPercentage: 80 targetMemoryUtilizationPercentage: 80 nodeSelector: {} tolerations: [] affinity: {} host_keys: {} hostname: my-upterm-host # Require ingress-nginx & cert-manager websocket: enabled: false cert_manager_acme_email: your_email ingress_nginx_ingress_class: nginx ingress: annotations: {} upterm-0.17.0/cmd/000077500000000000000000000000001507434540500136655ustar00rootroot00000000000000upterm-0.17.0/cmd/gendoc/000077500000000000000000000000001507434540500151245ustar00rootroot00000000000000upterm-0.17.0/cmd/gendoc/main.go000066400000000000000000000022211507434540500163740ustar00rootroot00000000000000package main import ( "os" "github.com/owenthereal/upterm/cmd/upterm/command" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/internal/version" "github.com/spf13/cobra/doc" ) func main() { logger := logging.Must(logging.Console()).With("component", "gendoc") defer func() { _ = logger.Close() }() rootCmd := command.Root() if err := doc.GenMarkdownTree(rootCmd, "./docs"); err != nil { logger.Error("failed generating markdown docs", "error", err) os.Exit(1) } header := &doc.GenManHeader{ Title: "UPTERM", Section: "1", Source: "Upterm " + version.String(), Manual: "Upterm Manual", } if err := doc.GenManTree(rootCmd, header, "./etc/man/man1"); err != nil { logger.Error("failed generating man pages", "error", err) os.Exit(1) } if err := rootCmd.GenBashCompletionFile("./etc/completion/upterm.bash_completion.sh"); err != nil { logger.Error("failed generating bash completion", "error", err) os.Exit(1) } if err := rootCmd.GenZshCompletionFile("./etc/completion/upterm.zsh_completion"); err != nil { logger.Error("failed generating zsh completion", "error", err) os.Exit(1) } } upterm-0.17.0/cmd/upterm/000077500000000000000000000000001507434540500152015ustar00rootroot00000000000000upterm-0.17.0/cmd/upterm/command/000077500000000000000000000000001507434540500166175ustar00rootroot00000000000000upterm-0.17.0/cmd/upterm/command/host.go000066400000000000000000000247151507434540500201340ustar00rootroot00000000000000package command import ( "context" "errors" "fmt" "log/slog" "net" "net/url" "os" "path/filepath" "time" "github.com/eiannone/keyboard" "github.com/gen2brain/beeep" "github.com/google/shlex" "github.com/hashicorp/go-multierror" "github.com/owenthereal/upterm/host" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/icon" uptermctx "github.com/owenthereal/upterm/internal/context" "github.com/spf13/cobra" ) // UserDiscardedError represents a user's intentional choice to discard the session type UserDiscardedError struct{} func (e UserDiscardedError) Error() string { return "session discarded by user" } // UserInterruptedError represents a user's Ctrl+C interruption type UserInterruptedError struct{} func (e UserInterruptedError) Error() string { return "interrupted by user" } var ( flagServer string flagForceCommand string flagPrivateKeys []string flagKnownHostsFilename string flagAuthorizedKeys string flagCodebergUsers []string flagGitHubUsers []string flagGitLabUsers []string flagSourceHutUsers []string flagReadOnly bool flagAccept bool ) func hostCmd() *cobra.Command { cmd := &cobra.Command{ Use: "host", Short: "Host a terminal session", Long: `Host a terminal session via a reverse SSH tunnel to the Upterm server, linking the IO of the host and client to a command's IO. Authentication against the Upterm server defaults to using private key files located at ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519, and ~/.ssh/id_rsa. If no private key file is found, it resorts to reading private keys from the SSH Agent. Absence of private keys in files or SSH Agent generates an on-the-fly private key. To authorize client connections, specify a authorized_key file with public keys using --authorized-keys.`, Example: ` # Host a terminal session running $SHELL, attaching client's IO to the host's: upterm host # Accept client connections automatically without prompts: upterm host --accept # Host a terminal session allowing only specified public key(s) to connect: upterm host --authorized-keys PATH_TO_AUTHORIZED_KEY_FILE # Host a session executing a custom command: upterm host -- docker run --rm -ti ubuntu bash # Host a 'tmux new -t pair-programming' session, forcing clients to join with 'tmux attach -t pair-programming': upterm host --force-command 'tmux attach -t pair-programming' -- tmux new -t pair-programming # Use a different Uptermd server, hosting a session via WebSocket: upterm host --server wss://YOUR_UPTERMD_SERVER -- YOUR_COMMAND`, PreRunE: validateShareRequiredFlags, RunE: shareRunE, } homeDir, err := os.UserHomeDir() if err != nil { slog.Error("error getting user home directory", "error", err) os.Exit(1) } cmd.PersistentFlags().StringVarP(&flagServer, "server", "", "ssh://uptermd.upterm.dev:22", "Specify the upterm server address (required). Supported protocols: ssh, ws, wss.") cmd.PersistentFlags().StringVarP(&flagForceCommand, "force-command", "f", "", "Enforce a specified command for clients to join, and link the command's input/output to the client's terminal.") cmd.PersistentFlags().StringSliceVarP(&flagPrivateKeys, "private-key", "i", defaultPrivateKeys(homeDir), "Specify private key files for public key authentication with the upterm server (required).") cmd.PersistentFlags().StringVarP(&flagKnownHostsFilename, "known-hosts", "", defaultKnownHost(homeDir), "Specify a file containing known keys for remote hosts (required).") cmd.PersistentFlags().StringVar(&flagAuthorizedKeys, "authorized-keys", "", "Specify a authorize_keys file listing authorized public keys for connection.") cmd.PersistentFlags().StringSliceVar(&flagCodebergUsers, "codeberg-user", nil, "Authorize specified Codeberg users by allowing their public keys to connect.") cmd.PersistentFlags().StringSliceVar(&flagGitHubUsers, "github-user", nil, "Authorize specified GitHub users by allowing their public keys to connect. Configure GitHub CLI environment variables as needed; see https://cli.github.com/manual/gh_help_environment for details.") cmd.PersistentFlags().StringSliceVar(&flagGitLabUsers, "gitlab-user", nil, "Authorize specified GitLab users by allowing their public keys to connect.") cmd.PersistentFlags().StringSliceVar(&flagSourceHutUsers, "srht-user", nil, "Authorize specified SourceHut users by allowing their public keys to connect.") cmd.PersistentFlags().BoolVar(&flagAccept, "accept", false, "Automatically accept client connections without prompts.") cmd.PersistentFlags().BoolVarP(&flagReadOnly, "read-only", "r", false, "Host a read-only session, preventing client interaction.") cmd.PersistentFlags().BoolVar(&flagHideClientIP, "hide-client-ip", false, "Hide client IP addresses from output (auto-enabled in CI environments)") return cmd } func validateShareRequiredFlags(c *cobra.Command, args []string) error { var result error if flagServer == "" { result = multierror.Append(result, fmt.Errorf("missing flag --server")) } else { u, err := url.Parse(flagServer) if err != nil { result = multierror.Append(result, fmt.Errorf("error parsing server URL: %w", err)) } if u != nil { if u.Scheme != "ssh" && u.Scheme != "ws" && u.Scheme != "wss" { result = multierror.Append(result, fmt.Errorf("unsupported server protocol %s", u.Scheme)) } if u.Scheme == "ssh" { _, _, err := net.SplitHostPort(u.Host) if err != nil { result = multierror.Append(result, err) } } // set default ports for ws or wss if u.Scheme == "ws" && u.Port() == "" { u.Host = u.Host + ":80" flagServer = u.String() } if u.Scheme == "wss" && u.Port() == "" { u.Host = u.Host + ":443" flagServer = u.String() } } } return result } func shareRunE(c *cobra.Command, args []string) error { var err error if len(args) == 0 { args, err = shlex.Split(os.Getenv("SHELL")) if err != nil { return err } if len(args) == 0 { return fmt.Errorf("no command is specified") } } var forceCommand []string if flagForceCommand != "" { forceCommand, err = shlex.Split(flagForceCommand) if err != nil { return fmt.Errorf("error parsing command %s: %w", flagForceCommand, err) } } logger := uptermctx.Logger(c.Context()) if logger == nil { return fmt.Errorf("logger not available") } var authorizedKeys []*host.AuthorizedKey if flagAuthorizedKeys != "" { aks, err := host.AuthorizedKeysFromFile(flagAuthorizedKeys) if err != nil { return fmt.Errorf("error reading authorized keys: %w", err) } authorizedKeys = append(authorizedKeys, aks) } if flagCodebergUsers != nil { codebergUserKeys, err := host.CodebergUserAuthorizedKeys(flagCodebergUsers) if err != nil { return fmt.Errorf("error reading Codeberg user keys: %w", err) } authorizedKeys = append(authorizedKeys, codebergUserKeys...) } if flagGitHubUsers != nil { gitHubUserKeys, err := host.GitHubUserAuthorizedKeys(flagGitHubUsers, logger.Logger) if err != nil { return fmt.Errorf("error reading GitHub user keys: %w", err) } authorizedKeys = append(authorizedKeys, gitHubUserKeys...) } if flagGitLabUsers != nil { gitLabUserKeys, err := host.GitLabUserAuthorizedKeys(flagGitLabUsers) if err != nil { return fmt.Errorf("error reading GitLab user keys: %w", err) } authorizedKeys = append(authorizedKeys, gitLabUserKeys...) } if flagSourceHutUsers != nil { sourceHutUserKeys, err := host.SourceHutUserAuthorizedKeys(flagSourceHutUsers) if err != nil { return fmt.Errorf("error reading SourceHut user keys: %w", err) } authorizedKeys = append(authorizedKeys, sourceHutUserKeys...) } signers, cleanup, err := host.Signers(flagPrivateKeys) if err != nil { return fmt.Errorf("error reading private keys: %w", err) } if cleanup != nil { defer cleanup() } hkcb, err := host.NewPromptingHostKeyCallback(os.Stdin, os.Stdout, flagKnownHostsFilename) if err != nil { return err } h := &host.Host{ Host: flagServer, Command: args, ForceCommand: forceCommand, Signers: signers, HostKeyCallback: hkcb, AuthorizedKeys: authorizedKeys, KeepAliveDuration: 50 * time.Second, // nlb is 350 sec & heroku router is 55 sec SessionCreatedCallback: displaySessionCallback, ClientJoinedCallback: clientJoinedCallback, ClientLeftCallback: clientLeftCallback, Stdin: os.Stdin, Stdout: os.Stdout, Logger: logger.Logger, ReadOnly: flagReadOnly, } err = h.Run(context.Background()) // Handle user actions specially - no help menu var userDiscardedErr UserDiscardedError var userInterruptedErr UserInterruptedError if errors.As(err, &userDiscardedErr) { return nil // Clean exit for user discard (exit code 0) } if errors.As(err, &userInterruptedErr) { // Set both flags to prevent help menu and error display c.SilenceUsage = true c.SilenceErrors = true return userInterruptedErr } return err } func clientJoinedCallback(c *api.Client) { _ = beeep.Notify("Upterm Client Joined", notifyBody(c), icon.Upterm) } func clientLeftCallback(c *api.Client) { _ = beeep.Notify("Upterm Client Left", notifyBody(c), icon.Upterm) } func notifyBody(c *api.Client) string { return clientDesc(c.Addr, c.Version, c.PublicKeyFingerprint) } func displaySessionCallback(session *api.GetSessionResponse) error { if err := displaySession(session); err != nil { return err } if flagAccept { return nil } if err := keyboard.Open(); err != nil { return err } defer func() { _ = keyboard.Close() }() fmt.Println("\n🤠Accept connections? [y/n] (or to force exit)") for { char, key, err := keyboard.GetKey() if err != nil { return err } else if key == keyboard.KeyCtrlC { fmt.Println("\nCancelled by user.") return UserInterruptedError{} } else if char == 'y' || char == 'Y' { fmt.Println("\n✅ Starting to accept connections...") return nil } else if char == 'n' || char == 'N' { fmt.Println("\n⌠Session discarded.") return UserDiscardedError{} } } } func defaultPrivateKeys(homeDir string) []string { var pks []string for _, f := range []string{ "id_ed25519", "id_ed25519_sk", "id_ecdsa", "id_ecdsa_sk", "id_dsa", "id_rsa", } { pk := filepath.Join(homeDir, ".ssh", f) if _, err := os.Stat(pk); os.IsNotExist(err) { continue } pks = append(pks, pk) } return pks } func defaultKnownHost(homeDir string) string { return filepath.Join(homeDir, ".ssh", "known_hosts") } upterm-0.17.0/cmd/upterm/command/host_test.go000066400000000000000000000023221507434540500211610ustar00rootroot00000000000000package command import ( "testing" "github.com/google/go-cmp/cmp" ) func Test_parseURL(t *testing.T) { cases := []struct { name string url string wantScheme string wantHost string wantPort string }{ { name: "port 443", url: "wss://foo.com:443", wantScheme: "wss", wantHost: "foo.com", wantPort: "443", }, { name: "port 80", url: "http://foo.com:80", wantScheme: "http", wantHost: "foo.com", wantPort: "80", }, { name: "port 22", url: "ssh://foo.com:22", wantScheme: "ssh", wantHost: "foo.com", wantPort: "22", }, { name: "no port", url: "wss://foo.com", wantScheme: "wss", wantHost: "foo.com", wantPort: "443", }, } for _, c := range cases { cc := c t.Run(cc.name, func(t *testing.T) { t.Parallel() _, scheme, host, port, err := parseURL(cc.url) if err != nil { t.Fatal(err) } if diff := cmp.Diff(cc.wantScheme, scheme); diff != "" { t.Fatal(diff) } if diff := cmp.Diff(cc.wantHost, host); diff != "" { t.Fatal(diff) } if diff := cmp.Diff(cc.wantPort, port); diff != "" { t.Fatal(diff) } }) } } upterm-0.17.0/cmd/upterm/command/privacy.go000066400000000000000000000034311507434540500206240ustar00rootroot00000000000000package command import "os" var ( flagHideClientIP bool ) // shouldHideClientIP determines if client IP addresses should be hidden from display. // // This function checks conditions in this priority order: // 1. Explicit --hide-client-ip flag (overrides everything) // 2. UPTERM_HIDE_CLIENT_IP environment variable (automatically bound by viper) // 3. Auto-detect CI environment (if neither flag nor env var set) // // This is particularly useful for CI/CD pipelines where session output is logged // and potentially publicly visible. By default, IPs are automatically hidden in // detected CI environments to prevent accidental exposure in build logs. // // Usage: // upterm host --hide-client-ip # Explicit flag // UPTERM_HIDE_CLIENT_IP=true upterm host # Environment variable (auto-bound) // upterm host # Auto-detects CI (GitHub Actions, etc.) func shouldHideClientIP() bool { // If flag is set (either via CLI flag or via UPTERM_HIDE_CLIENT_IP env var bound by viper) if flagHideClientIP { return true } // Auto-detect CI environments as fallback return isCI() } // isCI detects if the current process is running in a CI/CD environment // by checking for common CI environment variables. func isCI() bool { ciEnvVars := []string{ "CI", // Generic CI indicator (GitHub Actions, GitLab CI, etc.) "GITHUB_ACTIONS", // GitHub Actions "GITLAB_CI", // GitLab CI "CIRCLECI", // CircleCI "TRAVIS", // Travis CI "JENKINS_URL", // Jenkins "BUILDKITE", // Buildkite "TF_BUILD", // Azure Pipelines "TEAMCITY_VERSION", // TeamCity "BITBUCKET_BUILD_NUMBER", // Bitbucket Pipelines } for _, envVar := range ciEnvVars { if os.Getenv(envVar) != "" { return true } } return false } upterm-0.17.0/cmd/upterm/command/proxy.go000066400000000000000000000026461507434540500203370ustar00rootroot00000000000000package command import ( "context" "fmt" "io" "net/url" "os" "github.com/oklog/run" uio "github.com/owenthereal/upterm/io" "github.com/owenthereal/upterm/ws" "github.com/spf13/cobra" ) func proxyCmd() *cobra.Command { cmd := &cobra.Command{ Use: "proxy", Short: "Proxy a terminal session via WebSocket", Long: "Proxy a terminal session via WebSocket, to be used alongside SSH ProxyCommand.", Example: ` # Host shares a session running $SHELL over WebSocket: upterm host --server wss://uptermd.upterm.dev -- YOUR_COMMAND # Client connects to the host session via WebSocket: ssh -o ProxyCommand='upterm proxy wss://TOKEN@uptermd.upterm.dev' TOKEN:uptermd.uptermd.dev:443`, RunE: proxyRunE, } return cmd } func proxyRunE(c *cobra.Command, args []string) error { if len(args) == 0 { return fmt.Errorf("missing WebSocket url") } u, err := url.Parse(args[0]) if err != nil { return err } conn, err := ws.NewWSConn(u, true) if err != nil { return err } ctx, cancel := context.WithCancel(context.Background()) defer cancel() var g run.Group { g.Add(func() error { _, err := io.Copy(conn, uio.NewContextReader(ctx, os.Stdin)) return err }, func(err error) { _ = conn.Close() cancel() }) } { g.Add(func() error { _, err := io.Copy(os.Stdout, uio.NewContextReader(ctx, conn)) return err }, func(err error) { _ = conn.Close() cancel() }) } return g.Run() } upterm-0.17.0/cmd/upterm/command/root.go000066400000000000000000000102161507434540500201310ustar00rootroot00000000000000package command import ( "fmt" "os" "strings" uptermctx "github.com/owenthereal/upterm/internal/context" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/utils" "github.com/spf13/cobra" "github.com/spf13/pflag" "github.com/spf13/viper" ) func Root() *cobra.Command { rootCmd := &cobra.Command{ Use: "upterm", Short: "Instant Terminal Sharing", Long: `Upterm is an open-source solution for sharing terminal sessions instantly over secure SSH tunnels to the public internet. Environment Variables: All flags can be set via environment variables with the UPTERM_ prefix. Flag names are converted by replacing hyphens (-) with underscores (_). Examples: --hide-client-ip → UPTERM_HIDE_CLIENT_IP=true --read-only → UPTERM_READ_ONLY=true --accept → UPTERM_ACCEPT=true`, Example: ` # Host a terminal session running $SHELL, attaching client's IO to the host's: $ upterm host # Display the SSH connection string for sharing with client(s): $ upterm session current === SESSION_ID Command: /bin/bash Force Command: n/a Host: ssh://uptermd.upterm.dev:22 SSH Session: ssh TOKEN@uptermd.upterm.dev # A client connects to the host session via SSH: $ ssh TOKEN@uptermd.upterm.dev # Set flags via environment variables: $ UPTERM_HIDE_CLIENT_IP=true upterm host`, PersistentPreRunE: func(cmd *cobra.Command, args []string) error { // Bind all flags to environment variables with UPTERM_ prefix if err := bindFlagsToEnv(cmd); err != nil { return err } debug, _ := cmd.Flags().GetBool("debug") logPath, err := utils.UptermLogFilePath() if err != nil { return err } logOptions := []logging.Option{logging.File(logPath)} if debug { logOptions = append(logOptions, logging.Debug()) } logger, err := logging.New(logOptions...) if err != nil { return err } cmd.SetContext(uptermctx.WithLogger(cmd.Context(), logger)) return nil }, PersistentPostRunE: func(cmd *cobra.Command, args []string) error { if logger := uptermctx.Logger(cmd.Context()); logger != nil { return logger.Close() } return nil }, } rootCmd.PersistentFlags().Bool("debug", os.Getenv("DEBUG") != "", "enable debug logging") rootCmd.AddCommand(hostCmd()) rootCmd.AddCommand(proxyCmd()) rootCmd.AddCommand(sessionCmd()) rootCmd.AddCommand(upgradeCmd()) rootCmd.AddCommand(versionCmd()) return rootCmd } // bindFlagsToEnv binds all command flags to environment variables with UPTERM_ prefix. // This allows any flag to be set via environment variable, e.g.: // --hide-client-ip flag -> UPTERM_HIDE_CLIENT_IP env var // --read-only flag -> UPTERM_READ_ONLY env var func bindFlagsToEnv(cmd *cobra.Command) error { v := viper.New() // Visit all flags and bind them to viper cmd.Flags().VisitAll(func(flag *pflag.Flag) { if flag.Name != "help" { // Ignore binding errors - not all flags support environment variable binding _ = v.BindPFlag(flag.Name, flag) } }) // Enable automatic environment variable reading v.AutomaticEnv() // Replace hyphens with underscores for env var names (--hide-client-ip -> HIDE_CLIENT_IP) v.SetEnvKeyReplacer(strings.NewReplacer("-", "_")) // Set prefix so all env vars start with UPTERM_ (UPTERM_HIDE_CLIENT_IP) v.SetEnvPrefix("UPTERM") // Sync viper values back to flags cmd.Flags().VisitAll(func(flag *pflag.Flag) { if flag.Name != "help" && !flag.Changed && v.IsSet(flag.Name) { val := v.Get(flag.Name) // Ignore setting errors - not all flag types can be set from strings _ = cmd.Flags().Set(flag.Name, toString(val)) } }) return nil } // toString converts a value to string for flag setting. // Handles bool and string slice types specially, uses fmt.Sprintf for others. func toString(val interface{}) string { switch v := val.(type) { case bool: if v { return "true" } return "false" case string: return v case []string: // For string slice flags (e.g., --private-key), join with commas return strings.Join(v, ",") default: // For all other types (int, float, etc.), use fmt.Sprintf return fmt.Sprintf("%v", v) } } upterm-0.17.0/cmd/upterm/command/session.go000066400000000000000000000206621507434540500206370ustar00rootroot00000000000000package command import ( "context" "fmt" "net" "net/url" "os" "path/filepath" "strings" "github.com/olekukonko/tablewriter" "github.com/owenthereal/upterm/host" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/utils" "github.com/spf13/cobra" ) var ( flagAdminSocket string ) func sessionCmd() *cobra.Command { cmd := &cobra.Command{ Use: "session", Aliases: []string{"se"}, Short: "Display session", } cmd.AddCommand(current()) cmd.AddCommand(list()) cmd.AddCommand(show()) return cmd } func list() *cobra.Command { cmd := &cobra.Command{ Use: "list", Aliases: []string{"ls", "l"}, Short: "List shared sessions", Long: `List shared sessions. Session admin sockets are located in ~/.upterm.`, Example: ` # List shared sessions: upterm session list`, RunE: listRunE, } return cmd } func show() *cobra.Command { cmd := &cobra.Command{ Use: "info", Aliases: []string{"i"}, Short: "Display terminal session by name", Long: `Display terminal session by name.`, Example: ` # Display session by name: upterm session info NAME`, RunE: infoRunE, } cmd.Flags().BoolVar(&flagHideClientIP, "hide-client-ip", false, "Hide client IP addresses from output (auto-enabled in CI environments)") return cmd } func current() *cobra.Command { cmd := &cobra.Command{ Use: "current", Aliases: []string{"c"}, Short: "Display the current terminal session", Long: `Display the current terminal session. By default, this command retrieves the current session from the admin socket path specified in the UPTERM_ADMIN_SOCKET environment variable. This environment variable is set upon sharing a session with 'upterm host'.`, Example: ` # Display the active session as defined in $UPTERM_ADMIN_SOCKET: upterm session current # Display the session with a custom admin socket path: upterm session current --admin-socket ADMIN_SOCKET_PATH`, PreRunE: validateCurrentRequiredFlags, RunE: currentRunE, } cmd.PersistentFlags().StringVarP(&flagAdminSocket, "admin-socket", "", currentAdminSocketFile(), "admin unix domain socket (required)") cmd.Flags().BoolVar(&flagHideClientIP, "hide-client-ip", false, "Hide client IP addresses from output (auto-enabled in CI environments)") return cmd } func listRunE(c *cobra.Command, args []string) error { uptermDir, err := utils.CreateUptermDir() if err != nil { return err } sessions, err := listSessions(uptermDir) if err != nil { return err } if len(sessions) == 0 { fmt.Println("📡 Active Sessions (0)") fmt.Println("â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•") fmt.Println("\n🔠No active sessions found") fmt.Printf("\n💡 Get started:\n") fmt.Printf(" • Run 'upterm host' to share your terminal\n") fmt.Printf(" • Run 'upterm host --help' for more options\n") return nil } fmt.Printf("📡 Active Sessions (%d)\n", len(sessions)) fmt.Println("â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•â•") table := tablewriter.NewWriter(os.Stdout) table.Header(" ", "Session ID", "Command", "Host") for _, session := range sessions { // Create simplified row without Force Command (usually n/a) simplified := []string{ session[0], // Current marker session[1], // Session ID session[2], // Command session[4], // Host (skip Force Command) } if err := table.Append(simplified); err != nil { return err } } if err := table.Render(); err != nil { return err } fmt.Printf("\n💡 Tips:\n") fmt.Printf(" • Use 'upterm session current' to see details\n") fmt.Printf(" • Use 'upterm session info ' for specific session\n") return nil } func infoRunE(c *cobra.Command, args []string) error { if len(args) == 0 { return fmt.Errorf("missing session name") } uptermDir, err := utils.UptermDir() if err != nil { return err } return displaySessionFromAdminSocketPath(filepath.Join(uptermDir, host.AdminSocketFile(args[0]))) } func currentRunE(c *cobra.Command, args []string) error { return displaySessionFromAdminSocketPath(flagAdminSocket) } func listSessions(dir string) ([][]string, error) { result := make([][]string, 0) files, err := os.ReadDir(dir) if err != nil { return nil, err } currentAdminSocket := currentAdminSocketFile() for _, file := range files { // continue if the file is not SESSION.sock if filepath.Ext(file.Name()) != host.AdminSockExt { continue } adminSocket := filepath.Join(dir, file.Name()) session, err := session(adminSocket) if err != nil { continue } var current string if adminSocket == currentAdminSocket { current = "*" } result = append( result, []string{ current, session.SessionId, strings.Join(session.Command, " "), naIfEmpty(strings.Join(session.ForceCommand, " ")), session.Host, }) } return result, nil } func displaySessionFromAdminSocketPath(path string) error { session, err := session(path) if err != nil { return err } return displaySession(session) } func parseURL(str string) (u *url.URL, scheme string, host string, port string, err error) { u, err = url.Parse(str) if err != nil { return } scheme = u.Scheme host, port, err = net.SplitHostPort(u.Host) if err != nil { if !strings.Contains(err.Error(), "missing port in address") { return } err = nil host = u.Host switch u.Scheme { case "ssh": port = "22" case "ws": port = "80" case "wss": port = "443" } } return } func displaySession(session *api.GetSessionResponse) error { user := session.SshUser if user == "" { // Fallback to encoding for backward compatibility with older servers user = routing.NewEncodeDecoder(routing.ModeEmbedded).Encode(session.SessionId, session.NodeAddr) } u, scheme, host, port, err := parseURL(session.Host) if err != nil { return err } var hostPort string if port == "" || port == "80" || port == "443" { hostPort = host } else { hostPort = host + ":" + port } var sshCmd string if scheme == "ssh" { sshCmd = fmt.Sprintf("ssh %s@%s", user, host) if port != "22" { sshCmd = fmt.Sprintf("%s -p %s", sshCmd, port) } } else { sshCmd = fmt.Sprintf("ssh -o ProxyCommand='upterm proxy %s://%s@%s' %s@%s", scheme, user, hostPort, user, host+":"+port) } data := [][]string{ {"Command:", strings.Join(session.Command, " ")}, {"Force Command:", naIfEmpty(strings.Join(session.ForceCommand, " "))}, {"Host:", u.Scheme + "://" + hostPort}, {"Authorized Keys:", naIfEmpty(displayAuthorizedKeys(session.AuthorizedKeys))}, {"", ""}, {"➤ SSH Command:", sshCmd}, } isFirst := true for _, c := range session.ConnectedClients { var header string if isFirst { header = "Connected Client(s):" isFirst = false } data = append(data, []string{header, clientDesc(c.Addr, c.Version, c.PublicKeyFingerprint)}) } fmt.Printf("╭─ Session: %s ─╮\n", session.SessionId) table := tablewriter.NewWriter(os.Stdout) for _, row := range data { if err := table.Append(row); err != nil { return err } } if err := table.Render(); err != nil { return err } fmt.Printf("\n╰─ Run 'upterm session current' to display this again ─╯\n") return nil } func clientDesc(addr, clientVer, fingerprint string) string { if shouldHideClientIP() { addr = "[redacted]" } return fmt.Sprintf("%s %s %s", addr, clientVer, fingerprint) } func currentAdminSocketFile() string { return os.Getenv(upterm.HostAdminSocketEnvVar) } func session(adminSocket string) (*api.GetSessionResponse, error) { c, err := host.AdminClient(adminSocket) if err != nil { return nil, err } return c.GetSession(context.Background(), &api.GetSessionRequest{}) } func validateCurrentRequiredFlags(c *cobra.Command, args []string) error { missingFlagNames := []string{} if flagAdminSocket == "" { missingFlagNames = append(missingFlagNames, "admin-socket") } if len(missingFlagNames) > 0 { return fmt.Errorf(`required flag(s) "%s" not set`, strings.Join(missingFlagNames, ", ")) } return nil } func displayAuthorizedKeys(keys []*api.AuthorizedKey) string { var aks []string for _, ak := range keys { var fps []string for _, fp := range ak.PublicKeyFingerprints { fps = append(fps, fmt.Sprintf("- %s", fp)) } aks = append(aks, fmt.Sprintf("%s:\n%s", ak.Comment, strings.Join(fps, "\n"))) } return strings.Join(aks, "\n") } func naIfEmpty(s string) string { if s == "" { return "n/a" } return s } upterm-0.17.0/cmd/upterm/command/upgrade.go000066400000000000000000000073401507434540500206010ustar00rootroot00000000000000package command import ( "context" "fmt" "path/filepath" "runtime" "strings" "time" ggh "github.com/google/go-github/v48/github" uptermctx "github.com/owenthereal/upterm/internal/context" "github.com/owenthereal/upterm/internal/version" "github.com/spf13/cobra" "github.com/tj/go-update" "github.com/tj/go-update/progress" "github.com/tj/go/term" ) func upgradeCmd() *cobra.Command { cmd := &cobra.Command{ Use: "upgrade", Short: "Upgrade the CLI", Example: ` # Upgrade to the latest version upterm upgrade # Upgrade to a specific version $ upterm upgrade 0.2.0`, RunE: upgradeRunE, } return cmd } func upgradeRunE(c *cobra.Command, args []string) error { logger := uptermctx.Logger(c.Context()) if logger == nil { return fmt.Errorf("logger not available") } term.HideCursor() defer term.ShowCursor() m := &update.Manager{ Command: "upterm", Store: &store{ Owner: "owenthereal", Repo: "upterm", Version: version.String(), }, } var r release if len(args) > 0 { rr, err := m.GetRelease(trimVPrefix(args[0])) if err != nil { return fmt.Errorf("error fetching release: %s", err) } r = release{rr} } else { // fetch the new releases releases, err := m.LatestReleases() if err != nil { logger.Error("error fetching releases", "error", err) return fmt.Errorf("error fetching releases: %w", err) } // no updates if len(releases) == 0 { return fmt.Errorf("no updates") } // latest release r = release{releases[0]} } if version.String() == trimVPrefix(r.Version) { fmt.Println("Upterm is up-to-date") return nil } // find the tarball for this system a := r.FindTarballWithVersion(runtime.GOOS, runtime.GOARCH) if a == nil { return fmt.Errorf("no binary for your system") } // download tarball to a tmp dir tarball, err := a.DownloadProxy(progress.Reader) if err != nil { return fmt.Errorf("error downloading: %s", err) } // install it if err := m.Install(tarball); err != nil { return fmt.Errorf("error installing: %s", err) } fmt.Printf("Upgraded upterm %s to %s\n", version.String(), trimVPrefix(r.Version)) return nil } func trimVPrefix(s string) string { return strings.TrimPrefix(s, "v") } type release struct { *update.Release } func (r *release) FindTarballWithVersion(os, arch string) *update.Asset { s := fmt.Sprintf("%s_%s", os, arch) for _, a := range r.Assets { ext := filepath.Ext(a.Name) if strings.Contains(a.Name, s) && ext == ".gz" { return a } } return nil } type store struct { Owner string Repo string Version string } func (s *store) GetRelease(version string) (*update.Release, error) { ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) defer cancel() gh := ggh.NewClient(nil) r, res, err := gh.Repositories.GetReleaseByTag(ctx, s.Owner, s.Repo, "v"+version) if res.StatusCode == 404 { return nil, update.ErrNotFound } if err != nil { return nil, err } return githubRelease(r), nil } func (s *store) LatestReleases() ([]*update.Release, error) { ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) defer cancel() gh := ggh.NewClient(nil) r, _, err := gh.Repositories.GetLatestRelease(ctx, s.Owner, s.Repo) if err != nil { return nil, err } return []*update.Release{ githubRelease(r), }, nil } func githubRelease(r *ggh.RepositoryRelease) *update.Release { out := &update.Release{ Version: r.GetTagName(), Notes: r.GetBody(), PublishedAt: r.GetPublishedAt().Time, URL: r.GetURL(), } for _, a := range r.Assets { out.Assets = append(out.Assets, &update.Asset{ Name: a.GetName(), Size: a.GetSize(), URL: a.GetBrowserDownloadURL(), Downloads: a.GetDownloadCount(), }) } return out } upterm-0.17.0/cmd/upterm/command/version.go000066400000000000000000000005161507434540500206350ustar00rootroot00000000000000package command import ( "github.com/owenthereal/upterm/internal/version" "github.com/spf13/cobra" ) func versionCmd() *cobra.Command { cmd := &cobra.Command{ Use: "version", Short: "Show version", RunE: func(c *cobra.Command, args []string) error { version.PrintVersion("Upterm") return nil }, } return cmd } upterm-0.17.0/cmd/upterm/main.go000066400000000000000000000003511507434540500164530ustar00rootroot00000000000000package main import ( "log/slog" "os" "github.com/owenthereal/upterm/cmd/upterm/command" ) func main() { if err := command.Root().Execute(); err != nil { slog.Error("Error executing command", "error", err) os.Exit(1) } } upterm-0.17.0/cmd/uptermd-fly/000077500000000000000000000000001507434540500161355ustar00rootroot00000000000000upterm-0.17.0/cmd/uptermd-fly/main.go000066400000000000000000000026551507434540500174200ustar00rootroot00000000000000package main import ( "fmt" "log/slog" "os" "github.com/owenthereal/upterm/cmd/uptermd/command" ) func main() { flyAppName := os.Getenv("FLY_APP_NAME") if flyAppName == "" { slog.Error("FLY_APP_NAME is not set") os.Exit(1) } flyMachineID := os.Getenv("FLY_MACHINE_ID") if flyMachineID == "" { slog.Error("FLY_MACHINE_ID is not set") os.Exit(1) } config := map[string]any{ "UPTERMD_SSH_ADDR": "0.0.0.0:2222", "UPTERMD_WS_ADDR": "0.0.0.0:8080", "UPTERMD_NODE_ADDR": fmt.Sprintf("%s.vm.%s.internal:2222", flyMachineID, flyAppName), "UPTERMD_SSH_PROXY_PROTOCOL": "true", "UPTERMD_METRIC_ADDR": "0.0.0.0:9091", } flyConsulURL := os.Getenv("FLY_CONSUL_URL") if flyConsulURL != "" { config["UPTERMD_ROUTING"] = "consul" config["UPTERMD_CONSUL_URL"] = flyConsulURL config["UPTERMD_CONSUL_SESSION_TTL"] = "1h" slog.Info("Using Consul routing for multi-machine deployment") } else { config["UPTERMD_ROUTING"] = "embedded" slog.Info("Using embedded routing for single-machine deployment") } for key, value := range config { if err := os.Setenv(key, fmt.Sprintf("%v", value)); err != nil { slog.Error("failed to set environment variable", "key", key, "error", err) os.Exit(1) } } slog.Info("Starting uptermd on Fly.io", "config", config) if err := command.Root().Execute(); err != nil { slog.Error("command execution failed", "error", err) os.Exit(1) } } upterm-0.17.0/cmd/uptermd/000077500000000000000000000000001507434540500153455ustar00rootroot00000000000000upterm-0.17.0/cmd/uptermd/command/000077500000000000000000000000001507434540500167635ustar00rootroot00000000000000upterm-0.17.0/cmd/uptermd/command/root.go000066400000000000000000000070401507434540500202760ustar00rootroot00000000000000package command import ( "fmt" "os" "strings" uptermctx "github.com/owenthereal/upterm/internal/context" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/server" "github.com/owenthereal/upterm/utils" "github.com/spf13/cobra" "github.com/spf13/pflag" "github.com/spf13/viper" ) func Root() *cobra.Command { rootCmd := &rootCmd{} cmd := &cobra.Command{ Use: "uptermd", Short: "Upterm Daemon", RunE: rootCmd.RunE, } cmd.PersistentFlags().String("config", "", "server config") cmd.PersistentFlags().StringP("ssh-addr", "", utils.DefaultLocalhost("2222"), "ssh server address") cmd.PersistentFlags().StringP("ws-addr", "", "", "websocket server address") cmd.PersistentFlags().StringP("node-addr", "", "", "node address") cmd.PersistentFlags().StringSliceP("private-key", "", nil, "server private key") cmd.PersistentFlags().StringSliceP("hostname", "", nil, "server hostname for public-key authentication certificate principals. If empty, public-key authentication is used instead.") cmd.PersistentFlags().BoolP("ssh-proxy-protocol", "", false, "enable PROXY protocol support for the SSH listener (for use behind TCP proxies like Traefik, HAProxy, or AWS ELB)") cmd.PersistentFlags().StringP("network", "", "mem", "network provider") cmd.PersistentFlags().StringSliceP("network-opt", "", nil, "network provider option") cmd.PersistentFlags().StringP("metric-addr", "", "", "metric server address") cmd.PersistentFlags().BoolP("debug", "", os.Getenv("DEBUG") != "", "debug") cmd.PersistentFlags().String("routing", string(routing.ModeEmbedded), "session routing mode") cmd.PersistentFlags().String("consul-url", "", "consul URL for routing mode 'consul'") cmd.PersistentFlags().String("consul-session-ttl", server.DefaultSessionTTL.String(), "consul session TTL for routing mode 'consul'") cmd.PersistentFlags().String("sentry-dsn", "", "Sentry DSN for error tracking") cmd.AddCommand(versionCmd()) return cmd } type rootCmd struct { } func (cmd *rootCmd) RunE(c *cobra.Command, args []string) error { var opt server.Opt if err := unmarshalFlags(c, &opt); err != nil { return err } logOptions := []logging.Option{logging.Console()} if opt.Debug { logOptions = append(logOptions, logging.Debug()) } if opt.SentryDSN != "" { logOptions = append(logOptions, logging.Sentry(opt.SentryDSN)) } logger, err := logging.New(logOptions...) if err != nil { return err } defer func() { _ = logger.Close() }() c.SetContext(uptermctx.WithLogger(c.Context(), logger)) if err := server.Start(c.Context(), opt, logger.Logger); err != nil { logger.Error("failed to start uptermd", "error", err) return fmt.Errorf("failed to start uptermd: %w", err) } return nil } func unmarshalFlags(cmd *cobra.Command, opts interface{}) error { v := viper.New() cmd.Flags().VisitAll(func(flag *pflag.Flag) { flagName := flag.Name if flagName != "config" && flagName != "help" { if err := v.BindPFlag(flagName, flag); err != nil { panic(fmt.Errorf("error binding flag '%s': %w", flagName, err).Error()) } } }) v.AutomaticEnv() v.SetEnvKeyReplacer(strings.NewReplacer("-", "_")) v.SetEnvPrefix("UPTERMD") cfgFile, err := cmd.Flags().GetString("config") if err != nil { return err } if _, err := os.Stat(cfgFile); err == nil { v.SetConfigFile(cfgFile) } if err := v.ReadInConfig(); err != nil { if _, ok := err.(viper.ConfigFileNotFoundError); !ok { return fmt.Errorf("error loading config file %s: %w", cfgFile, err) } } return v.Unmarshal(opts) } upterm-0.17.0/cmd/uptermd/command/version.go000066400000000000000000000005171507434540500210020ustar00rootroot00000000000000package command import ( "github.com/owenthereal/upterm/internal/version" "github.com/spf13/cobra" ) func versionCmd() *cobra.Command { cmd := &cobra.Command{ Use: "version", Short: "Show version", RunE: func(c *cobra.Command, args []string) error { version.PrintVersion("Uptermd") return nil }, } return cmd } upterm-0.17.0/cmd/uptermd/main.go000066400000000000000000000003531507434540500166210ustar00rootroot00000000000000package main import ( "log/slog" "os" "github.com/owenthereal/upterm/cmd/uptermd/command" ) func main() { if err := command.Root().Execute(); err != nil { slog.Error("command execution failed", "error", err) os.Exit(1) } } upterm-0.17.0/docs/000077500000000000000000000000001507434540500140525ustar00rootroot00000000000000upterm-0.17.0/docs/upterm.md000066400000000000000000000030061507434540500157070ustar00rootroot00000000000000## upterm Instant Terminal Sharing ### Synopsis Upterm is an open-source solution for sharing terminal sessions instantly over secure SSH tunnels to the public internet. Environment Variables: All flags can be set via environment variables with the UPTERM_ prefix. Flag names are converted by replacing hyphens (-) with underscores (_). Examples: --hide-client-ip → UPTERM_HIDE_CLIENT_IP=true --read-only → UPTERM_READ_ONLY=true --accept → UPTERM_ACCEPT=true ### Examples ``` # Host a terminal session running $SHELL, attaching client's IO to the host's: $ upterm host # Display the SSH connection string for sharing with client(s): $ upterm session current === SESSION_ID Command: /bin/bash Force Command: n/a Host: ssh://uptermd.upterm.dev:22 SSH Session: ssh TOKEN@uptermd.upterm.dev # A client connects to the host session via SSH: $ ssh TOKEN@uptermd.upterm.dev # Set flags via environment variables: $ UPTERM_HIDE_CLIENT_IP=true upterm host ``` ### Options ``` --debug enable debug logging -h, --help help for upterm ``` ### SEE ALSO * [upterm host](upterm_host.md) - Host a terminal session * [upterm proxy](upterm_proxy.md) - Proxy a terminal session via WebSocket * [upterm session](upterm_session.md) - Display session * [upterm upgrade](upterm_upgrade.md) - Upgrade the CLI * [upterm version](upterm_version.md) - Show version ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_host.md000066400000000000000000000062771507434540500167610ustar00rootroot00000000000000## upterm host Host a terminal session ### Synopsis Host a terminal session via a reverse SSH tunnel to the Upterm server, linking the IO of the host and client to a command's IO. Authentication against the Upterm server defaults to using private key files located at ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519, and ~/.ssh/id_rsa. If no private key file is found, it resorts to reading private keys from the SSH Agent. Absence of private keys in files or SSH Agent generates an on-the-fly private key. To authorize client connections, specify a authorized_key file with public keys using --authorized-keys. ``` upterm host [flags] ``` ### Examples ``` # Host a terminal session running $SHELL, attaching client's IO to the host's: upterm host # Accept client connections automatically without prompts: upterm host --accept # Host a terminal session allowing only specified public key(s) to connect: upterm host --authorized-keys PATH_TO_AUTHORIZED_KEY_FILE # Host a session executing a custom command: upterm host -- docker run --rm -ti ubuntu bash # Host a 'tmux new -t pair-programming' session, forcing clients to join with 'tmux attach -t pair-programming': upterm host --force-command 'tmux attach -t pair-programming' -- tmux new -t pair-programming # Use a different Uptermd server, hosting a session via WebSocket: upterm host --server wss://YOUR_UPTERMD_SERVER -- YOUR_COMMAND ``` ### Options ``` --accept Automatically accept client connections without prompts. --authorized-keys string Specify a authorize_keys file listing authorized public keys for connection. --codeberg-user strings Authorize specified Codeberg users by allowing their public keys to connect. -f, --force-command string Enforce a specified command for clients to join, and link the command's input/output to the client's terminal. --github-user strings Authorize specified GitHub users by allowing their public keys to connect. Configure GitHub CLI environment variables as needed; see https://cli.github.com/manual/gh_help_environment for details. --gitlab-user strings Authorize specified GitLab users by allowing their public keys to connect. -h, --help help for host --hide-client-ip Hide client IP addresses from output (auto-enabled in CI environments) --known-hosts string Specify a file containing known keys for remote hosts (required). (default "/Users/owen/.ssh/known_hosts") -i, --private-key strings Specify private key files for public key authentication with the upterm server (required). (default [/Users/owen/.ssh/id_ed25519]) -r, --read-only Host a read-only session, preventing client interaction. --server string Specify the upterm server address (required). Supported protocols: ssh, ws, wss. (default "ssh://uptermd.upterm.dev:22") --srht-user strings Authorize specified SourceHut users by allowing their public keys to connect. ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm](upterm.md) - Instant Terminal Sharing ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_proxy.md000066400000000000000000000013421507434540500171510ustar00rootroot00000000000000## upterm proxy Proxy a terminal session via WebSocket ### Synopsis Proxy a terminal session via WebSocket, to be used alongside SSH ProxyCommand. ``` upterm proxy [flags] ``` ### Examples ``` # Host shares a session running $SHELL over WebSocket: upterm host --server wss://uptermd.upterm.dev -- YOUR_COMMAND # Client connects to the host session via WebSocket: ssh -o ProxyCommand='upterm proxy wss://TOKEN@uptermd.upterm.dev' TOKEN:uptermd.uptermd.dev:443 ``` ### Options ``` -h, --help help for proxy ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm](upterm.md) - Instant Terminal Sharing ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_session.md000066400000000000000000000010431507434540500174510ustar00rootroot00000000000000## upterm session Display session ### Options ``` -h, --help help for session ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm](upterm.md) - Instant Terminal Sharing * [upterm session current](upterm_session_current.md) - Display the current terminal session * [upterm session info](upterm_session_info.md) - Display terminal session by name * [upterm session list](upterm_session_list.md) - List shared sessions ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_session_current.md000066400000000000000000000020401507434540500212110ustar00rootroot00000000000000## upterm session current Display the current terminal session ### Synopsis Display the current terminal session. By default, this command retrieves the current session from the admin socket path specified in the UPTERM_ADMIN_SOCKET environment variable. This environment variable is set upon sharing a session with 'upterm host'. ``` upterm session current [flags] ``` ### Examples ``` # Display the active session as defined in $UPTERM_ADMIN_SOCKET: upterm session current # Display the session with a custom admin socket path: upterm session current --admin-socket ADMIN_SOCKET_PATH ``` ### Options ``` --admin-socket string admin unix domain socket (required) -h, --help help for current --hide-client-ip Hide client IP addresses from output (auto-enabled in CI environments) ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm session](upterm_session.md) - Display session ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_session_info.md000066400000000000000000000011221507434540500204620ustar00rootroot00000000000000## upterm session info Display terminal session by name ### Synopsis Display terminal session by name. ``` upterm session info [flags] ``` ### Examples ``` # Display session by name: upterm session info NAME ``` ### Options ``` -h, --help help for info --hide-client-ip Hide client IP addresses from output (auto-enabled in CI environments) ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm session](upterm_session.md) - Display session ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_session_list.md000066400000000000000000000007701507434540500205120ustar00rootroot00000000000000## upterm session list List shared sessions ### Synopsis List shared sessions. Session admin sockets are located in ~/.upterm. ``` upterm session list [flags] ``` ### Examples ``` # List shared sessions: upterm session list ``` ### Options ``` -h, --help help for list ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm session](upterm_session.md) - Display session ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_upgrade.md000066400000000000000000000007171507434540500174240ustar00rootroot00000000000000## upterm upgrade Upgrade the CLI ``` upterm upgrade [flags] ``` ### Examples ``` # Upgrade to the latest version upterm upgrade # Upgrade to a specific version $ upterm upgrade 0.2.0 ``` ### Options ``` -h, --help help for upgrade ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm](upterm.md) - Instant Terminal Sharing ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/docs/upterm_version.md000066400000000000000000000005061507434540500174560ustar00rootroot00000000000000## upterm version Show version ``` upterm version [flags] ``` ### Options ``` -h, --help help for version ``` ### Options inherited from parent commands ``` --debug enable debug logging ``` ### SEE ALSO * [upterm](upterm.md) - Instant Terminal Sharing ###### Auto generated by spf13/cobra on 14-Oct-2025 upterm-0.17.0/etc/000077500000000000000000000000001507434540500136755ustar00rootroot00000000000000upterm-0.17.0/etc/completion/000077500000000000000000000000001507434540500160465ustar00rootroot00000000000000upterm-0.17.0/etc/completion/upterm.bash_completion.sh000066400000000000000000000463371507434540500231000ustar00rootroot00000000000000# bash completion for upterm -*- shell-script -*- __upterm_debug() { if [[ -n ${BASH_COMP_DEBUG_FILE:-} ]]; then echo "$*" >> "${BASH_COMP_DEBUG_FILE}" fi } # Homebrew on Macs have version 1.3 of bash-completion which doesn't include # _init_completion. This is a very minimal version of that function. __upterm_init_completion() { COMPREPLY=() _get_comp_words_by_ref "$@" cur prev words cword } __upterm_index_of_word() { local w word=$1 shift index=0 for w in "$@"; do [[ $w = "$word" ]] && return index=$((index+1)) done index=-1 } __upterm_contains_word() { local w word=$1; shift for w in "$@"; do [[ $w = "$word" ]] && return done return 1 } __upterm_handle_go_custom_completion() { __upterm_debug "${FUNCNAME[0]}: cur is ${cur}, words[*] is ${words[*]}, #words[@] is ${#words[@]}" local shellCompDirectiveError=1 local shellCompDirectiveNoSpace=2 local shellCompDirectiveNoFileComp=4 local shellCompDirectiveFilterFileExt=8 local shellCompDirectiveFilterDirs=16 local out requestComp lastParam lastChar comp directive args # Prepare the command to request completions for the program. # Calling ${words[0]} instead of directly upterm allows handling aliases args=("${words[@]:1}") # Disable ActiveHelp which is not supported for bash completion v1 requestComp="UPTERM_ACTIVE_HELP=0 ${words[0]} __completeNoDesc ${args[*]}" lastParam=${words[$((${#words[@]}-1))]} lastChar=${lastParam:$((${#lastParam}-1)):1} __upterm_debug "${FUNCNAME[0]}: lastParam ${lastParam}, lastChar ${lastChar}" if [ -z "${cur}" ] && [ "${lastChar}" != "=" ]; then # If the last parameter is complete (there is a space following it) # We add an extra empty parameter so we can indicate this to the go method. __upterm_debug "${FUNCNAME[0]}: Adding extra empty parameter" requestComp="${requestComp} \"\"" fi __upterm_debug "${FUNCNAME[0]}: calling ${requestComp}" # Use eval to handle any environment variables and such out=$(eval "${requestComp}" 2>/dev/null) # Extract the directive integer at the very end of the output following a colon (:) directive=${out##*:} # Remove the directive out=${out%:*} if [ "${directive}" = "${out}" ]; then # There is not directive specified directive=0 fi __upterm_debug "${FUNCNAME[0]}: the completion directive is: ${directive}" __upterm_debug "${FUNCNAME[0]}: the completions are: ${out}" if [ $((directive & shellCompDirectiveError)) -ne 0 ]; then # Error code. No completion. __upterm_debug "${FUNCNAME[0]}: received error from custom completion go code" return else if [ $((directive & shellCompDirectiveNoSpace)) -ne 0 ]; then if [[ $(type -t compopt) = "builtin" ]]; then __upterm_debug "${FUNCNAME[0]}: activating no space" compopt -o nospace fi fi if [ $((directive & shellCompDirectiveNoFileComp)) -ne 0 ]; then if [[ $(type -t compopt) = "builtin" ]]; then __upterm_debug "${FUNCNAME[0]}: activating no file completion" compopt +o default fi fi fi if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then # File extension filtering local fullFilter filter filteringCmd # Do not use quotes around the $out variable or else newline # characters will be kept. for filter in ${out}; do fullFilter+="$filter|" done filteringCmd="_filedir $fullFilter" __upterm_debug "File filtering command: $filteringCmd" $filteringCmd elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then # File completion for directories only local subdir # Use printf to strip any trailing newline subdir=$(printf "%s" "${out}") if [ -n "$subdir" ]; then __upterm_debug "Listing directories in $subdir" __upterm_handle_subdirs_in_dir_flag "$subdir" else __upterm_debug "Listing directories in ." _filedir -d fi else while IFS='' read -r comp; do COMPREPLY+=("$comp") done < <(compgen -W "${out}" -- "$cur") fi } __upterm_handle_reply() { __upterm_debug "${FUNCNAME[0]}" local comp case $cur in -*) if [[ $(type -t compopt) = "builtin" ]]; then compopt -o nospace fi local allflags if [ ${#must_have_one_flag[@]} -ne 0 ]; then allflags=("${must_have_one_flag[@]}") else allflags=("${flags[*]} ${two_word_flags[*]}") fi while IFS='' read -r comp; do COMPREPLY+=("$comp") done < <(compgen -W "${allflags[*]}" -- "$cur") if [[ $(type -t compopt) = "builtin" ]]; then [[ "${COMPREPLY[0]}" == *= ]] || compopt +o nospace fi # complete after --flag=abc if [[ $cur == *=* ]]; then if [[ $(type -t compopt) = "builtin" ]]; then compopt +o nospace fi local index flag flag="${cur%=*}" __upterm_index_of_word "${flag}" "${flags_with_completion[@]}" COMPREPLY=() if [[ ${index} -ge 0 ]]; then PREFIX="" cur="${cur#*=}" ${flags_completion[${index}]} if [ -n "${ZSH_VERSION:-}" ]; then # zsh completion needs --flag= prefix eval "COMPREPLY=( \"\${COMPREPLY[@]/#/${flag}=}\" )" fi fi fi if [[ -z "${flag_parsing_disabled}" ]]; then # If flag parsing is enabled, we have completed the flags and can return. # If flag parsing is disabled, we may not know all (or any) of the flags, so we fallthrough # to possibly call handle_go_custom_completion. return 0; fi ;; esac # check if we are handling a flag with special work handling local index __upterm_index_of_word "${prev}" "${flags_with_completion[@]}" if [[ ${index} -ge 0 ]]; then ${flags_completion[${index}]} return fi # we are parsing a flag and don't have a special handler, no completion if [[ ${cur} != "${words[cword]}" ]]; then return fi local completions completions=("${commands[@]}") if [[ ${#must_have_one_noun[@]} -ne 0 ]]; then completions+=("${must_have_one_noun[@]}") elif [[ -n "${has_completion_function}" ]]; then # if a go completion function is provided, defer to that function __upterm_handle_go_custom_completion fi if [[ ${#must_have_one_flag[@]} -ne 0 ]]; then completions+=("${must_have_one_flag[@]}") fi while IFS='' read -r comp; do COMPREPLY+=("$comp") done < <(compgen -W "${completions[*]}" -- "$cur") if [[ ${#COMPREPLY[@]} -eq 0 && ${#noun_aliases[@]} -gt 0 && ${#must_have_one_noun[@]} -ne 0 ]]; then while IFS='' read -r comp; do COMPREPLY+=("$comp") done < <(compgen -W "${noun_aliases[*]}" -- "$cur") fi if [[ ${#COMPREPLY[@]} -eq 0 ]]; then if declare -F __upterm_custom_func >/dev/null; then # try command name qualified custom func __upterm_custom_func else # otherwise fall back to unqualified for compatibility declare -F __custom_func >/dev/null && __custom_func fi fi # available in bash-completion >= 2, not always present on macOS if declare -F __ltrim_colon_completions >/dev/null; then __ltrim_colon_completions "$cur" fi # If there is only 1 completion and it is a flag with an = it will be completed # but we don't want a space after the = if [[ "${#COMPREPLY[@]}" -eq "1" ]] && [[ $(type -t compopt) = "builtin" ]] && [[ "${COMPREPLY[0]}" == --*= ]]; then compopt -o nospace fi } # The arguments should be in the form "ext1|ext2|extn" __upterm_handle_filename_extension_flag() { local ext="$1" _filedir "@(${ext})" } __upterm_handle_subdirs_in_dir_flag() { local dir="$1" pushd "${dir}" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1 || return } __upterm_handle_flag() { __upterm_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}" # if a command required a flag, and we found it, unset must_have_one_flag() local flagname=${words[c]} local flagvalue="" # if the word contained an = if [[ ${words[c]} == *"="* ]]; then flagvalue=${flagname#*=} # take in as flagvalue after the = flagname=${flagname%=*} # strip everything after the = flagname="${flagname}=" # but put the = back fi __upterm_debug "${FUNCNAME[0]}: looking for ${flagname}" if __upterm_contains_word "${flagname}" "${must_have_one_flag[@]}"; then must_have_one_flag=() fi # if you set a flag which only applies to this command, don't show subcommands if __upterm_contains_word "${flagname}" "${local_nonpersistent_flags[@]}"; then commands=() fi # keep flag value with flagname as flaghash # flaghash variable is an associative array which is only supported in bash > 3. if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then if [ -n "${flagvalue}" ] ; then flaghash[${flagname}]=${flagvalue} elif [ -n "${words[ $((c+1)) ]}" ] ; then flaghash[${flagname}]=${words[ $((c+1)) ]} else flaghash[${flagname}]="true" # pad "true" for bool flag fi fi # skip the argument to a two word flag if [[ ${words[c]} != *"="* ]] && __upterm_contains_word "${words[c]}" "${two_word_flags[@]}"; then __upterm_debug "${FUNCNAME[0]}: found a flag ${words[c]}, skip the next argument" c=$((c+1)) # if we are looking for a flags value, don't show commands if [[ $c -eq $cword ]]; then commands=() fi fi c=$((c+1)) } __upterm_handle_noun() { __upterm_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}" if __upterm_contains_word "${words[c]}" "${must_have_one_noun[@]}"; then must_have_one_noun=() elif __upterm_contains_word "${words[c]}" "${noun_aliases[@]}"; then must_have_one_noun=() fi nouns+=("${words[c]}") c=$((c+1)) } __upterm_handle_command() { __upterm_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}" local next_command if [[ -n ${last_command} ]]; then next_command="_${last_command}_${words[c]//:/__}" else if [[ $c -eq 0 ]]; then next_command="_upterm_root_command" else next_command="_${words[c]//:/__}" fi fi c=$((c+1)) __upterm_debug "${FUNCNAME[0]}: looking for ${next_command}" declare -F "$next_command" >/dev/null && $next_command } __upterm_handle_word() { if [[ $c -ge $cword ]]; then __upterm_handle_reply return fi __upterm_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}" if [[ "${words[c]}" == -* ]]; then __upterm_handle_flag elif __upterm_contains_word "${words[c]}" "${commands[@]}"; then __upterm_handle_command elif [[ $c -eq 0 ]]; then __upterm_handle_command elif __upterm_contains_word "${words[c]}" "${command_aliases[@]}"; then # aliashash variable is an associative array which is only supported in bash > 3. if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then words[c]=${aliashash[${words[c]}]} __upterm_handle_command else __upterm_handle_noun fi else __upterm_handle_noun fi __upterm_handle_word } _upterm_help() { last_command="upterm_help" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--debug") must_have_one_flag=() must_have_one_noun=() has_completion_function=1 noun_aliases=() } _upterm_host() { last_command="upterm_host" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--accept") flags+=("--authorized-keys=") two_word_flags+=("--authorized-keys") flags+=("--codeberg-user=") two_word_flags+=("--codeberg-user") flags+=("--force-command=") two_word_flags+=("--force-command") two_word_flags+=("-f") flags+=("--github-user=") two_word_flags+=("--github-user") flags+=("--gitlab-user=") two_word_flags+=("--gitlab-user") flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--hide-client-ip") flags+=("--known-hosts=") two_word_flags+=("--known-hosts") flags+=("--private-key=") two_word_flags+=("--private-key") two_word_flags+=("-i") flags+=("--read-only") flags+=("-r") flags+=("--server=") two_word_flags+=("--server") flags+=("--srht-user=") two_word_flags+=("--srht-user") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_proxy() { last_command="upterm_proxy" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_session_current() { last_command="upterm_session_current" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--admin-socket=") two_word_flags+=("--admin-socket") flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--hide-client-ip") local_nonpersistent_flags+=("--hide-client-ip") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_session_help() { last_command="upterm_session_help" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--debug") must_have_one_flag=() must_have_one_noun=() has_completion_function=1 noun_aliases=() } _upterm_session_info() { last_command="upterm_session_info" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--hide-client-ip") local_nonpersistent_flags+=("--hide-client-ip") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_session_list() { last_command="upterm_session_list" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_session() { last_command="upterm_session" command_aliases=() commands=() commands+=("current") if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then command_aliases+=("c") aliashash["c"]="current" fi commands+=("help") commands+=("info") if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then command_aliases+=("i") aliashash["i"]="info" fi commands+=("list") if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then command_aliases+=("l") aliashash["l"]="list" command_aliases+=("ls") aliashash["ls"]="list" fi flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_upgrade() { last_command="upterm_upgrade" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_version() { last_command="upterm_version" command_aliases=() commands=() flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") flags+=("--debug") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } _upterm_root_command() { last_command="upterm" command_aliases=() commands=() commands+=("help") commands+=("host") commands+=("proxy") commands+=("session") if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then command_aliases+=("se") aliashash["se"]="session" fi commands+=("upgrade") commands+=("version") flags=() two_word_flags=() local_nonpersistent_flags=() flags_with_completion=() flags_completion=() flags+=("--debug") flags+=("--help") flags+=("-h") local_nonpersistent_flags+=("--help") local_nonpersistent_flags+=("-h") must_have_one_flag=() must_have_one_noun=() noun_aliases=() } __start_upterm() { local cur prev words cword split declare -A flaghash 2>/dev/null || : declare -A aliashash 2>/dev/null || : if declare -F _init_completion >/dev/null 2>&1; then _init_completion -s || return else __upterm_init_completion -n "=" || return fi local c=0 local flag_parsing_disabled= local flags=() local two_word_flags=() local local_nonpersistent_flags=() local flags_with_completion=() local flags_completion=() local commands=("upterm") local command_aliases=() local must_have_one_flag=() local must_have_one_noun=() local has_completion_function="" local last_command="" local nouns=() local noun_aliases=() __upterm_handle_word } if [[ $(type -t compopt) = "builtin" ]]; then complete -o default -F __start_upterm upterm else complete -o default -o nospace -F __start_upterm upterm fi # ex: ts=4 sw=4 et filetype=sh upterm-0.17.0/etc/completion/upterm.zsh_completion000066400000000000000000000171041507434540500223440ustar00rootroot00000000000000#compdef upterm compdef _upterm upterm # zsh completion for upterm -*- shell-script -*- __upterm_debug() { local file="$BASH_COMP_DEBUG_FILE" if [[ -n ${file} ]]; then echo "$*" >> "${file}" fi } _upterm() { local shellCompDirectiveError=1 local shellCompDirectiveNoSpace=2 local shellCompDirectiveNoFileComp=4 local shellCompDirectiveFilterFileExt=8 local shellCompDirectiveFilterDirs=16 local shellCompDirectiveKeepOrder=32 local lastParam lastChar flagPrefix requestComp out directive comp lastComp noSpace keepOrder local -a completions __upterm_debug "\n========= starting completion logic ==========" __upterm_debug "CURRENT: ${CURRENT}, words[*]: ${words[*]}" # The user could have moved the cursor backwards on the command-line. # We need to trigger completion from the $CURRENT location, so we need # to truncate the command-line ($words) up to the $CURRENT location. # (We cannot use $CURSOR as its value does not work when a command is an alias.) words=("${=words[1,CURRENT]}") __upterm_debug "Truncated words[*]: ${words[*]}," lastParam=${words[-1]} lastChar=${lastParam[-1]} __upterm_debug "lastParam: ${lastParam}, lastChar: ${lastChar}" # For zsh, when completing a flag with an = (e.g., upterm -n=) # completions must be prefixed with the flag setopt local_options BASH_REMATCH if [[ "${lastParam}" =~ '-.*=' ]]; then # We are dealing with a flag with an = flagPrefix="-P ${BASH_REMATCH}" fi # Prepare the command to obtain completions requestComp="${words[1]} __complete ${words[2,-1]}" if [ "${lastChar}" = "" ]; then # If the last parameter is complete (there is a space following it) # We add an extra empty parameter so we can indicate this to the go completion code. __upterm_debug "Adding extra empty parameter" requestComp="${requestComp} \"\"" fi __upterm_debug "About to call: eval ${requestComp}" # Use eval to handle any environment variables and such out=$(eval ${requestComp} 2>/dev/null) __upterm_debug "completion output: ${out}" # Extract the directive integer following a : from the last line local lastLine while IFS='\n' read -r line; do lastLine=${line} done < <(printf "%s\n" "${out[@]}") __upterm_debug "last line: ${lastLine}" if [ "${lastLine[1]}" = : ]; then directive=${lastLine[2,-1]} # Remove the directive including the : and the newline local suffix (( suffix=${#lastLine}+2)) out=${out[1,-$suffix]} else # There is no directive specified. Leave $out as is. __upterm_debug "No directive found. Setting do default" directive=0 fi __upterm_debug "directive: ${directive}" __upterm_debug "completions: ${out}" __upterm_debug "flagPrefix: ${flagPrefix}" if [ $((directive & shellCompDirectiveError)) -ne 0 ]; then __upterm_debug "Completion received error. Ignoring completions." return fi local activeHelpMarker="_activeHelp_ " local endIndex=${#activeHelpMarker} local startIndex=$((${#activeHelpMarker}+1)) local hasActiveHelp=0 while IFS='\n' read -r comp; do # Check if this is an activeHelp statement (i.e., prefixed with $activeHelpMarker) if [ "${comp[1,$endIndex]}" = "$activeHelpMarker" ];then __upterm_debug "ActiveHelp found: $comp" comp="${comp[$startIndex,-1]}" if [ -n "$comp" ]; then compadd -x "${comp}" __upterm_debug "ActiveHelp will need delimiter" hasActiveHelp=1 fi continue fi if [ -n "$comp" ]; then # If requested, completions are returned with a description. # The description is preceded by a TAB character. # For zsh's _describe, we need to use a : instead of a TAB. # We first need to escape any : as part of the completion itself. comp=${comp//:/\\:} local tab="$(printf '\t')" comp=${comp//$tab/:} __upterm_debug "Adding completion: ${comp}" completions+=${comp} lastComp=$comp fi done < <(printf "%s\n" "${out[@]}") # Add a delimiter after the activeHelp statements, but only if: # - there are completions following the activeHelp statements, or # - file completion will be performed (so there will be choices after the activeHelp) if [ $hasActiveHelp -eq 1 ]; then if [ ${#completions} -ne 0 ] || [ $((directive & shellCompDirectiveNoFileComp)) -eq 0 ]; then __upterm_debug "Adding activeHelp delimiter" compadd -x "--" hasActiveHelp=0 fi fi if [ $((directive & shellCompDirectiveNoSpace)) -ne 0 ]; then __upterm_debug "Activating nospace." noSpace="-S ''" fi if [ $((directive & shellCompDirectiveKeepOrder)) -ne 0 ]; then __upterm_debug "Activating keep order." keepOrder="-V" fi if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then # File extension filtering local filteringCmd filteringCmd='_files' for filter in ${completions[@]}; do if [ ${filter[1]} != '*' ]; then # zsh requires a glob pattern to do file filtering filter="\*.$filter" fi filteringCmd+=" -g $filter" done filteringCmd+=" ${flagPrefix}" __upterm_debug "File filtering command: $filteringCmd" _arguments '*:filename:'"$filteringCmd" elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then # File completion for directories only local subdir subdir="${completions[1]}" if [ -n "$subdir" ]; then __upterm_debug "Listing directories in $subdir" pushd "${subdir}" >/dev/null 2>&1 else __upterm_debug "Listing directories in ." fi local result _arguments '*:dirname:_files -/'" ${flagPrefix}" result=$? if [ -n "$subdir" ]; then popd >/dev/null 2>&1 fi return $result else __upterm_debug "Calling _describe" if eval _describe $keepOrder "completions" completions $flagPrefix $noSpace; then __upterm_debug "_describe found some completions" # Return the success of having called _describe return 0 else __upterm_debug "_describe did not find completions." __upterm_debug "Checking if we should do file completion." if [ $((directive & shellCompDirectiveNoFileComp)) -ne 0 ]; then __upterm_debug "deactivating file completion" # We must return an error code here to let zsh know that there were no # completions found by _describe; this is what will trigger other # matching algorithms to attempt to find completions. # For example zsh can match letters in the middle of words. return 1 else # Perform file completion __upterm_debug "Activating file completion" # We must return the result of this command, so it must be the # last command, or else we must store its result to return it. _arguments '*:filename:_files'" ${flagPrefix}" fi fi fi } # don't run the completion function when being source-ed or eval-ed if [ "$funcstack[1]" = "_upterm" ]; then _upterm fi upterm-0.17.0/etc/man/000077500000000000000000000000001507434540500144505ustar00rootroot00000000000000upterm-0.17.0/etc/man/man1/000077500000000000000000000000001507434540500153045ustar00rootroot00000000000000upterm-0.17.0/etc/man/man1/upterm-host.1000066400000000000000000000063021507434540500176560ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-host - Host a terminal session .SH SYNOPSIS \fBupterm host [flags]\fP .SH DESCRIPTION Host a terminal session via a reverse SSH tunnel to the Upterm server, linking the IO of the host and client to a command's IO. Authentication against the Upterm server defaults to using private key files located at ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519, and ~/.ssh/id_rsa. If no private key file is found, it resorts to reading private keys from the SSH Agent. Absence of private keys in files or SSH Agent generates an on-the-fly private key. To authorize client connections, specify a authorized_key file with public keys using --authorized-keys. .SH OPTIONS \fB--accept\fP[=false] Automatically accept client connections without prompts. .PP \fB--authorized-keys\fP="" Specify a authorize_keys file listing authorized public keys for connection. .PP \fB--codeberg-user\fP=[] Authorize specified Codeberg users by allowing their public keys to connect. .PP \fB-f\fP, \fB--force-command\fP="" Enforce a specified command for clients to join, and link the command's input/output to the client's terminal. .PP \fB--github-user\fP=[] Authorize specified GitHub users by allowing their public keys to connect. Configure GitHub CLI environment variables as needed; see https://cli.github.com/manual/gh_help_environment for details. .PP \fB--gitlab-user\fP=[] Authorize specified GitLab users by allowing their public keys to connect. .PP \fB-h\fP, \fB--help\fP[=false] help for host .PP \fB--hide-client-ip\fP[=false] Hide client IP addresses from output (auto-enabled in CI environments) .PP \fB--known-hosts\fP="/Users/owen/.ssh/known_hosts" Specify a file containing known keys for remote hosts (required). .PP \fB-i\fP, \fB--private-key\fP=[/Users/owen/.ssh/id_ed25519] Specify private key files for public key authentication with the upterm server (required). .PP \fB-r\fP, \fB--read-only\fP[=false] Host a read-only session, preventing client interaction. .PP \fB--server\fP="ssh://uptermd.upterm.dev:22" Specify the upterm server address (required). Supported protocols: ssh, ws, wss. .PP \fB--srht-user\fP=[] Authorize specified SourceHut users by allowing their public keys to connect. .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH EXAMPLE .EX # Host a terminal session running $SHELL, attaching client's IO to the host's: upterm host # Accept client connections automatically without prompts: upterm host --accept # Host a terminal session allowing only specified public key(s) to connect: upterm host --authorized-keys PATH_TO_AUTHORIZED_KEY_FILE # Host a session executing a custom command: upterm host -- docker run --rm -ti ubuntu bash # Host a 'tmux new -t pair-programming' session, forcing clients to join with 'tmux attach -t pair-programming': upterm host --force-command 'tmux attach -t pair-programming' -- tmux new -t pair-programming # Use a different Uptermd server, hosting a session via WebSocket: upterm host --server wss://YOUR_UPTERMD_SERVER -- YOUR_COMMAND .EE .SH SEE ALSO \fBupterm(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm-proxy.1000066400000000000000000000014441507434540500200640ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-proxy - Proxy a terminal session via WebSocket .SH SYNOPSIS \fBupterm proxy [flags]\fP .SH DESCRIPTION Proxy a terminal session via WebSocket, to be used alongside SSH ProxyCommand. .SH OPTIONS \fB-h\fP, \fB--help\fP[=false] help for proxy .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH EXAMPLE .EX # Host shares a session running $SHELL over WebSocket: upterm host --server wss://uptermd.upterm.dev -- YOUR_COMMAND # Client connects to the host session via WebSocket: ssh -o ProxyCommand='upterm proxy wss://TOKEN@uptermd.upterm.dev' TOKEN:uptermd.uptermd.dev:443 .EE .SH SEE ALSO \fBupterm(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm-session-current.1000066400000000000000000000021331507434540500220420ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-session-current - Display the current terminal session .SH SYNOPSIS \fBupterm session current [flags]\fP .SH DESCRIPTION Display the current terminal session. By default, this command retrieves the current session from the admin socket path specified in the UPTERM_ADMIN_SOCKET environment variable. This environment variable is set upon sharing a session with 'upterm host'. .SH OPTIONS \fB--admin-socket\fP="" admin unix domain socket (required) .PP \fB-h\fP, \fB--help\fP[=false] help for current .PP \fB--hide-client-ip\fP[=false] Hide client IP addresses from output (auto-enabled in CI environments) .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH EXAMPLE .EX # Display the active session as defined in $UPTERM_ADMIN_SOCKET: upterm session current # Display the session with a custom admin socket path: upterm session current --admin-socket ADMIN_SOCKET_PATH .EE .SH SEE ALSO \fBupterm-session(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm-session-info.1000066400000000000000000000012271507434540500213160ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-session-info - Display terminal session by name .SH SYNOPSIS \fBupterm session info [flags]\fP .SH DESCRIPTION Display terminal session by name. .SH OPTIONS \fB-h\fP, \fB--help\fP[=false] help for info .PP \fB--hide-client-ip\fP[=false] Hide client IP addresses from output (auto-enabled in CI environments) .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH EXAMPLE .EX # Display session by name: upterm session info NAME .EE .SH SEE ALSO \fBupterm-session(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm-session-list.1000066400000000000000000000010731507434540500213350ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-session-list - List shared sessions .SH SYNOPSIS \fBupterm session list [flags]\fP .SH DESCRIPTION List shared sessions. Session admin sockets are located in ~/.upterm. .SH OPTIONS \fB-h\fP, \fB--help\fP[=false] help for list .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH EXAMPLE .EX # List shared sessions: upterm session list .EE .SH SEE ALSO \fBupterm-session(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm-session.1000066400000000000000000000010101507434540500203530ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-session - Display session .SH SYNOPSIS \fBupterm session [flags]\fP .SH DESCRIPTION Display session .SH OPTIONS \fB-h\fP, \fB--help\fP[=false] help for session .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH SEE ALSO \fBupterm(1)\fP, \fBupterm-session-current(1)\fP, \fBupterm-session-info(1)\fP, \fBupterm-session-list(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm-upgrade.1000066400000000000000000000010601507434540500203240ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-upgrade - Upgrade the CLI .SH SYNOPSIS \fBupterm upgrade [flags]\fP .SH DESCRIPTION Upgrade the CLI .SH OPTIONS \fB-h\fP, \fB--help\fP[=false] help for upgrade .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH EXAMPLE .EX # Upgrade to the latest version upterm upgrade # Upgrade to a specific version $ upterm upgrade 0.2.0 .EE .SH SEE ALSO \fBupterm(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm-version.1000066400000000000000000000006451507434540500203720ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm-version - Show version .SH SYNOPSIS \fBupterm version [flags]\fP .SH DESCRIPTION Show version .SH OPTIONS \fB-h\fP, \fB--help\fP[=false] help for version .SH OPTIONS INHERITED FROM PARENT COMMANDS \fB--debug\fP[=false] enable debug logging .SH SEE ALSO \fBupterm(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/etc/man/man1/upterm.1000066400000000000000000000027341507434540500167100ustar00rootroot00000000000000.nh .TH "UPTERM" "1" "Oct 2025" "Upterm 0.0.0+dev" "Upterm Manual" .SH NAME upterm - Instant Terminal Sharing .SH SYNOPSIS \fBupterm [flags]\fP .SH DESCRIPTION Upterm is an open-source solution for sharing terminal sessions instantly over secure SSH tunnels to the public internet. .PP Environment Variables: All flags can be set via environment variables with the UPTERM_ prefix. Flag names are converted by replacing hyphens (-) with underscores (_). .PP Examples: --hide-client-ip → UPTERM_HIDE_CLIENT_IP=true --read-only → UPTERM_READ_ONLY=true --accept → UPTERM_ACCEPT=true .SH OPTIONS \fB--debug\fP[=false] enable debug logging .PP \fB-h\fP, \fB--help\fP[=false] help for upterm .SH EXAMPLE .EX # Host a terminal session running $SHELL, attaching client's IO to the host's: $ upterm host # Display the SSH connection string for sharing with client(s): $ upterm session current === SESSION_ID Command: /bin/bash Force Command: n/a Host: ssh://uptermd.upterm.dev:22 SSH Session: ssh TOKEN@uptermd.upterm.dev # A client connects to the host session via SSH: $ ssh TOKEN@uptermd.upterm.dev # Set flags via environment variables: $ UPTERM_HIDE_CLIENT_IP=true upterm host .EE .SH SEE ALSO \fBupterm-host(1)\fP, \fBupterm-proxy(1)\fP, \fBupterm-session(1)\fP, \fBupterm-upgrade(1)\fP, \fBupterm-version(1)\fP .SH HISTORY 14-Oct-2025 Auto generated by spf13/cobra upterm-0.17.0/fly.example.toml000066400000000000000000000037011507434540500162440ustar00rootroot00000000000000# Example Fly.io configuration for deploying your own uptermd server # Copy this file to fly.toml and customize the app name and other settings app = "my-uptermd-server" # Change this to your desired app name primary_region = "iad" # Change to your preferred region (iad, fra, nrt, etc.) kill_signal = "SIGINT" kill_timeout = "5s" [build] dockerfile = "Dockerfile.uptermd" build-target = "uptermd-fly" [experimental] entrypoint = ["uptermd-fly"] # Routing Configuration: # - If FLY_CONSUL_URL environment variable is set: uses Consul routing for multi-machine deployments # - If FLY_CONSUL_URL is not set: uses embedded routing for single-machine deployments (simpler setup) # For personal use, you don't need to set FLY_CONSUL_URL - embedded mode will be used automatically # Resource allocation - adjust based on your needs [vm] cpu_kind = "shared" cpus = 1 memory_mb = 256 # Increase if you expect high usage # SSH service (port 22) [[services]] protocol = "tcp" internal_port = 2222 auto_stop_machines = false auto_start_machines = true min_machines_running = 1 # Start with 1 for cost efficiency [[services.ports]] port = 22 handlers = ["proxy_proto"] proxy_proto_options = { version = "v2" } [services.concurrency] type = "connections" hard_limit = 500 # Reduced for personal use soft_limit = 400 [[services.tcp_checks]] interval = "15s" timeout = "2s" grace_period = "5s" restart_limit = 3 # WebSocket service (ports 80/443) [[services]] protocol = "tcp" internal_port = 8080 auto_stop_machines = false auto_start_machines = true min_machines_running = 1 # Start with 1 for cost efficiency [[services.ports]] port = 80 handlers = ["http"] force_https = true [[services.ports]] port = 443 handlers = ["tls", "http"] [services.concurrency] type = "connections" hard_limit = 500 # Reduced for personal use soft_limit = 400 [[services.http_checks]] interval = "30s" timeout = "5s" grace_period = "10s" restart_limit = 3 path = "/health" protocol = "http"upterm-0.17.0/fly.toml000066400000000000000000000022361507434540500146140ustar00rootroot00000000000000app = "upterm" kill_signal = "SIGINT" kill_timeout = "5s" [build] dockerfile = "Dockerfile.uptermd" build-target = "uptermd-fly" [metrics] port = 9091 path = "/metrics" [experimental] entrypoint = ["uptermd-fly"] [vm] cpu_kind = "shared" cpus = 1 memory_mb = 256 [[services]] protocol = "tcp" internal_port = 2222 auto_stop_machines = false auto_start_machines = true min_machines_running = 3 processes = ["app"] [[services.ports]] port = 22 handlers = ["proxy_proto"] proxy_proto_options = { version = "v2" } [services.concurrency] type = "connections" hard_limit = 2500 soft_limit = 2000 [[services.tcp_checks]] interval = "15s" timeout = "2s" grace_period = "5s" restart_limit = 3 [[services]] protocol = "tcp" internal_port = 8080 auto_stop_machines = false auto_start_machines = true min_machines_running = 3 processes = ["app"] [[services.ports]] port = 80 handlers = ["http"] force_https = true [[services.ports]] port = 443 handlers = ["tls", "http"] [services.concurrency] type = "connections" hard_limit = 2500 soft_limit = 2000 [[services.http_checks]] interval = "30s" timeout = "5s" grace_period = "10s" restart_limit = 3 path = "/health" protocol = "http" upterm-0.17.0/ftests/000077500000000000000000000000001507434540500144325ustar00rootroot00000000000000upterm-0.17.0/ftests/client_test.go000066400000000000000000000303001507434540500172720ustar00rootroot00000000000000package ftests import ( "context" "os" "path/filepath" "testing" "time" "github.com/owenthereal/upterm/host" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/routing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func testHostNoAuthorizedKeyAnyClientJoin(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) // Setup admin socket adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // Verify admin server - require session exists to continue session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) c := &Client{ PrivateKeys: []string{HostPrivateKey}, // use the wrong key } err = c.Join(session, clientJoinURL) require.NoError(err) } func testClientAuthorizedKeyNotMatching(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) assert := assert.New(t) // Setup admin socket adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, PermittedClientPublicKey: ClientPublicKeyContent, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // Verify admin server - require session exists to continue session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) c := &Client{ PrivateKeys: []string{HostPrivateKey}, // use the wrong key } err = c.Join(session, clientJoinURL) // Test authorization failure - use assert for expected error validation require.Error(err, "connection should be rejected with wrong key") assert.ErrorContains(err, "ssh: handshake failed", "should fail with SSH handshake error") } func testClientNonExistingSession(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, PermittedClientPublicKey: ClientPublicKeyContent, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // verify admin server session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) // verify input/output hostInputCh, hostOutputCh := h.InputOutput() hostScanner := scanner(hostOutputCh) hostInputCh <- "echo hello" require.Equal("echo hello", scan(hostScanner)) require.Equal("hello", scan(hostScanner)) c := &Client{ PrivateKeys: []string{ClientPrivateKey}, } session.SshUser = "non-existing-user" // set SSH user to non-existing err = c.Join(session, clientJoinURL) // Unfortunately there is no explicit error to the client. // But ssh handshake fails with the connection closed require.ErrorContains(err, "ssh: handshake failed") } func testClientAttachHostWithSameCommand(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) assert := assert.New(t) // Setup - use require for critical setup steps adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, PermittedClientPublicKey: ClientPublicKeyContent, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // verify admin server session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) // verify input/output hostInputCh, hostOutputCh := h.InputOutput() hostScanner := scanner(hostOutputCh) c := &Client{ PrivateKeys: []string{ClientPrivateKey}, } err = c.Join(session, clientJoinURL) require.NoError(err) remoteInputCh, remoteOutputCh := c.InputOutput() remoteScanner := scanner(remoteOutputCh) // host input hostInputCh <- "echo hello" assert.Equal("echo hello", scan(hostScanner), "host should echo command") assert.Equal("hello", scan(hostScanner), "host should show command output") // client output assert.Equal("echo hello", scan(remoteScanner), "client should see host command") assert.Equal("hello", scan(remoteScanner), "client should see host output") // client input remoteInputCh <- "echo hello again" assert.Equal("echo hello again", scan(remoteScanner), "client should echo its own command") assert.Equal("hello again", scan(remoteScanner), "client should see its own output") // host output // host should link to remote with the same input/output assert.Equal("echo hello again", scan(hostScanner), "host should see client command") assert.Equal("hello again", scan(hostScanner), "host should see client output") } func testClientAttachHostWithDifferentCommand(t *testing.T, hostShareURL string, hostNodeAddr, clientJoinURL string) { require := require.New(t) assert := assert.New(t) // Setup - use require for critical setup steps adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, ForceCommand: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, PermittedClientPublicKey: ClientPublicKeyContent, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // verify admin server session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) // verify input/output hostInputCh, hostOutputCh := h.InputOutput() hostScanner := scanner(hostOutputCh) hostInputCh <- "echo hello" assert.Equal("echo hello", scan(hostScanner), "host should echo initial command") assert.Equal("hello", scan(hostScanner), "host should show initial output") c := &Client{ PrivateKeys: []string{ClientPrivateKey}, } err = c.Join(session, clientJoinURL) require.NoError(err) remoteInputCh, remoteOutputCh := c.InputOutput() remoteScanner := scanner(remoteOutputCh) // Wait for ssh stdin/stdout to fully attach - critical for force command isolation time.Sleep(time.Second) remoteInputCh <- "echo hello again" assert.Equal("echo hello again", scan(remoteScanner), "client should echo its command") assert.Equal("hello again", scan(remoteScanner), "client should see its output") // host shouldn't be linked to remote hostInputCh <- "echo hello" assert.Equal("echo hello", scan(hostScanner), "host should echo second command independently") assert.Equal("hello", scan(hostScanner), "host should show second output independently") } func testClientAttachReadOnly(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) assert := assert.New(t) // Setup - use require for critical setup steps adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, PermittedClientPublicKey: ClientPublicKeyContent, ReadOnly: true, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // verify admin server session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) // verify input/output hostInputCh, hostOutputCh := h.InputOutput() hostScanner := scanner(hostOutputCh) c := &Client{ PrivateKeys: []string{ClientPrivateKey}, } err = c.Join(session, clientJoinURL) require.NoError(err) remoteInputCh, remoteOutputCh := c.InputOutput() remoteScanner := scanner(remoteOutputCh) // client output // client should get "welcome message" // \n // === Attached to read-only session === // \n assert.Equal("=== Attached to read-only session ===", scan(remoteScanner), "client should see read-only welcome message") // host input should still work hostInputCh <- "echo hello" assert.Equal("echo hello", scan(hostScanner), "host should echo command in read-only mode") assert.Equal("hello", scan(hostScanner), "host should show output in read-only mode") // client input should be disabled remoteInputCh <- "echo hello again" // client should read what was sent by hostInputCh and not what was sent on remoteInputCh assert.Equal("echo hello", scan(remoteScanner), "client should see host output, not its own input") select { // host shouldn't receive anything from client and because client input is disabled case str := <-hostOutputCh: t.Fatalf("host shouldn't receive client input: receive=%s", str) case <-time.After(sshAttachTimeout): testLogger.Debug("Read-only timeout confirmed - client input properly blocked") return } } func getAndVerifySession(t *testing.T, adminSocketFile string, wantHostURL, wantNodeURL string) *api.GetSessionResponse { require := require.New(t) adminClient, err := host.AdminClient(adminSocketFile) require.NoError(err) sess, err := adminClient.GetSession(context.Background(), &api.GetSessionRequest{}) require.NoError(err) checkSessionPayload(t, sess, wantHostURL, wantNodeURL) return sess } func checkSessionPayload(t *testing.T, sess *api.GetSessionResponse, wantHostURL, wantNodeURL string) { require := require.New(t) require.NotEmpty(sess.SessionId, "session ID should not be empty") require.Equal(wantHostURL, sess.Host, "host URL mismatch") require.Equal(wantNodeURL, sess.NodeAddr, "node URL mismatch") require.NotEmpty(sess.SshUser, "SSH user should not be empty") } // testOldClientToNewConsulServer tests backward compatibility scenario where // an old upterm client (using embedded format) connects to a new uptermd server running in Consul mode func testOldClientToNewConsulServer(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) // Setup admin socket adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // Get session info from host (this is in the new format for Consul mode) session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) // Create an embedded format SSH user (what old clients would send) embeddedEncoder := routing.NewEncodeDecoder(routing.ModeEmbedded) oldClientSSHUser := embeddedEncoder.Encode(session.SessionId, session.NodeAddr) t.Logf("Testing backward compatibility:") t.Logf(" Session ID: %s", session.SessionId) t.Logf(" Node Address: %s", session.NodeAddr) t.Logf(" New client SSH user (Consul format): %s", session.SshUser) t.Logf(" Old client SSH user (embedded format): %s", oldClientSSHUser) // Create a regular client but override the SSH username to simulate old client behavior c := &Client{ PrivateKeys: []string{ClientPrivateKey}, } // Create a modified session response with the old format SSH user oldFormatSession := &api.GetSessionResponse{ SessionId: session.SessionId, NodeAddr: session.NodeAddr, Host: session.Host, SshUser: oldClientSSHUser, // Use old embedded format instead of Consul format } // This should work thanks to our backward compatibility fix err = c.Join(oldFormatSession, clientJoinURL) require.NoError(err, "Old client with embedded format should be able to connect to Consul server") defer c.Close() t.Log("Backward compatibility test passed: old client successfully connected to new Consul server") } // setupAdminSocket creates a temporary admin socket and returns the socket file path func setupAdminSocket(t *testing.T) string { require := require.New(t) // Use a shorter temp dir to avoid Unix socket path length limits adminSockDir, err := os.MkdirTemp("", "up") require.NoError(err) t.Cleanup(func() { _ = os.RemoveAll(adminSockDir) }) return filepath.Join(adminSockDir, "u.sock") } upterm-0.17.0/ftests/ftests_test.go000066400000000000000000000450421507434540500173350ustar00rootroot00000000000000package ftests import ( "bufio" "bytes" "context" "encoding/base64" "fmt" "io" "net" "net/url" "os" "reflect" "runtime" "strings" "sync" "testing" "time" "log/slog" "github.com/go-kit/kit/metrics/provider" "github.com/oklog/run" "github.com/owenthereal/upterm/host" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/internal/testhelpers" uio "github.com/owenthereal/upterm/io" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/server" "github.com/owenthereal/upterm/utils" "github.com/owenthereal/upterm/ws" "github.com/pborman/ansi" "github.com/stretchr/testify/suite" "golang.org/x/crypto/ssh" ) var ( // Shared debug logger for all tests testLogger = logging.Must(logging.Console(), logging.Debug()).Logger ) const ( serverStartupTimeout = 3 * time.Second unixSocketWaitTimeout = 3 * time.Second keepAliveDuration = 2 * time.Second sshAttachTimeout = 500 * time.Millisecond // Test key material ServerPublicKeyContent = `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7wM3URdkoip/GKliykxrkz5k5U9OeX3y/bE0Nz/Pl6` ServerPrivateKeyContent = `-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACAO8DN1EXZKIqfxipYspMa5M+ZOVPTnl98v2xNDc/z5egAAAIj7+f6n+/n+ pwAAAAtzc2gtZWQyNTUxOQAAACAO8DN1EXZKIqfxipYspMa5M+ZOVPTnl98v2xNDc/z5eg AAAECJxt3qnAWGGklvhi4HTwyzY3EdjOAKpgXvcYTX6mDa+g7wM3URdkoip/GKliykxrkz 5k5U9OeX3y/bE0Nz/Pl6AAAAAAECAwQF -----END OPENSSH PRIVATE KEY-----` HostPublicKeyContent = `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOA+rMcwWFPJVE2g6EwRPkYmNJfaS/+gkyZ99aR/65uz` HostPrivateKeyContent = `-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACDgPqzHMFhTyVRNoOhMET5GJjSX2kv/oJMmffWkf+ubswAAAIiu5GOBruRj gQAAAAtzc2gtZWQyNTUxOQAAACDgPqzHMFhTyVRNoOhMET5GJjSX2kv/oJMmffWkf+ubsw AAAEDBHlsR95C/pGVHtQGpgrUi+Qwgkfnp9QlRKdEhhx4rxOA+rMcwWFPJVE2g6EwRPkYm NJfaS/+gkyZ99aR/65uzAAAAAAECAwQF -----END OPENSSH PRIVATE KEY-----` ClientPublicKeyContent = `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0EWrjdcHcuMfI8bGAyHPcGsAc/vd/gl5673pRkRBGY` ClientPrivateKeyContent = `-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACDdBFq43XB3LjHyPGxgMhz3BrAHP73f4Jeeu96UZEQRmAAAAIiRPFazkTxW swAAAAtzc2gtZWQyNTUxOQAAACDdBFq43XB3LjHyPGxgMhz3BrAHP73f4Jeeu96UZEQRmA AAAEDmpjZHP/SIyBTp6YBFPzUi18iDo2QHolxGRDpx+m7let0EWrjdcHcuMfI8bGAyHPcG sAc/vd/gl5673pRkRBGYAAAAAAECAwQF -----END OPENSSH PRIVATE KEY-----` ) var ( HostPrivateKey string ClientPrivateKey string ) // FtestCase represents a functional test case type FtestCase func(t *testing.T, hostURL, hostNodeAddr, clientJoinURL string) // AuthTestCases contains all authentication-related test functions var AuthTestCases = []FtestCase{ testHostNoAuthorizedKeyAnyClientJoin, testClientAuthorizedKeyNotMatching, testHostFailToShareWithoutPrivateKey, } // SessionTestCases contains all session management test functions var SessionTestCases = []FtestCase{ testClientNonExistingSession, } // ConnectionTestCases contains all connection-related test functions var ConnectionTestCases = []FtestCase{ testClientAttachHostWithSameCommand, testClientAttachHostWithDifferentCommand, testClientAttachReadOnly, } // CallbackTestCases contains all callback/event-related test functions var CallbackTestCases = []FtestCase{ testHostClientCallback, testHostSessionCreatedCallback, } // BackwardCompatibilityTestCases contains tests for backward compatibility scenarios var BackwardCompatibilityTestCases = []FtestCase{ testOldClientToNewConsulServer, } // FtestSuite runs functional tests with different session routing modes type FtestSuite struct { suite.Suite mode routing.Mode ts1 TestServer ts2 TestServer } func (suite *FtestSuite) SetupSuite() { // Setup key pairs remove, err := setupKeyPairs() suite.Require().NoError(err) suite.T().Cleanup(remove) // Create test servers with the specified routing mode suite.ts1, err = NewServerWithMode(ServerPrivateKeyContent, suite.mode) suite.Require().NoError(err) suite.ts2, err = NewServerWithMode(ServerPrivateKeyContent, suite.mode) suite.Require().NoError(err) } func (suite *FtestSuite) TearDownSuite() { if suite.ts1 != nil { _ = suite.ts1.Shutdown() } if suite.ts2 != nil { _ = suite.ts2.Shutdown() } } func (suite *FtestSuite) TestAuth() { suite.runTestCategory(AuthTestCases) } func (suite *FtestSuite) TestSession() { suite.runTestCategory(SessionTestCases) } func (suite *FtestSuite) TestConnection() { suite.runTestCategory(ConnectionTestCases) } func (suite *FtestSuite) TestCallbacks() { suite.runTestCategory(CallbackTestCases) } func (suite *FtestSuite) TestBackwardCompatibility() { // Only run backward compatibility tests in Consul mode // (since embedded mode doesn't need backward compatibility) if suite.mode != routing.ModeConsul { suite.T().Skip("Backward compatibility tests only run in Consul mode") return } suite.runTestCategory(BackwardCompatibilityTestCases) } func (suite *FtestSuite) runTestCategory(testCases []FtestCase) { protocols := []string{"ssh", "ws"} for _, protocol := range protocols { suite.T().Run(protocol, func(t *testing.T) { suite.runTestsForProtocol(protocol, testCases) }) } } func (suite *FtestSuite) runTestsForProtocol(protocol string, testCases []FtestCase) { topologies := []struct { name string hostURL string clientURL string }{ { name: "singleNode", hostURL: protocol + "://" + suite.getServerAddr(protocol, suite.ts1), clientURL: protocol + "://" + suite.getServerAddr(protocol, suite.ts1), }, { name: "multiNodes", hostURL: protocol + "://" + suite.getServerAddr(protocol, suite.ts1), clientURL: protocol + "://" + suite.getServerAddr(protocol, suite.ts2), }, } for _, topo := range topologies { suite.T().Run(topo.name, func(t *testing.T) { for _, testFunc := range testCases { testName := funcName(testFunc) t.Run(testName, func(t *testing.T) { t.Parallel() testFunc(t, topo.hostURL, suite.ts1.NodeAddr(), topo.clientURL) }) } }) } } func (suite *FtestSuite) getServerAddr(protocol string, server TestServer) string { if protocol == "ssh" { return server.SSHAddr() } return server.WSAddr() } // Test runners for different modes func TestEmbedded(t *testing.T) { suite.Run(t, &FtestSuite{mode: routing.ModeEmbedded}) } func TestConsul(t *testing.T) { // Skip if Consul is not available if !testhelpers.IsConsulAvailable() { t.Skip("Consul not available - set CONSUL_URL or ensure Consul is running on localhost:8500") } suite.Run(t, &FtestSuite{mode: routing.ModeConsul}) } func mustParseURL(urlStr string) *url.URL { u, err := url.Parse(urlStr) if err != nil { panic(fmt.Sprintf("failed to parse URL %s: %v", urlStr, err)) } return u } func funcName(i interface{}) string { name := runtime.FuncForPC(reflect.ValueOf(i).Pointer()).Name() split := strings.Split(name, ".") return split[len(split)-1] } type TestServer interface { SSHAddr() string WSAddr() string NodeAddr() string Shutdown() error } func NewServerWithMode(hostKey string, mode routing.Mode) (TestServer, error) { sshln, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { return nil, fmt.Errorf("failed to create SSH listener: %w", err) } wsln, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { _ = sshln.Close() return nil, fmt.Errorf("failed to create WebSocket listener: %w", err) } s := &Server{ hostKeyContent: hostKey, sshln: sshln, wsln: wsln, mode: mode, } // Start server in background startErrCh := make(chan error, 1) go func() { if err := s.start(); err != nil { testLogger.Error("error starting test server", "error", err, "mode", mode) startErrCh <- err } }() // Wait for server to start with timeout ctx, cancel := context.WithTimeout(context.Background(), serverStartupTimeout) defer cancel() // Wait for SSH server if err := utils.WaitForServer(ctx, s.SSHAddr()); err != nil { _ = s.Shutdown() return nil, fmt.Errorf("SSH server failed to start: %w", err) } // Wait for WebSocket server if err := utils.WaitForServer(ctx, s.WSAddr()); err != nil { _ = s.Shutdown() return nil, fmt.Errorf("WebSocket server failed to start: %w", err) } // Check for startup errors select { case err := <-startErrCh: _ = s.Shutdown() return nil, fmt.Errorf("server startup failed: %w", err) default: } return s, nil } type Server struct { Server *server.Server sshln net.Listener wsln net.Listener hostKeyContent string mode routing.Mode logger *slog.Logger shutdownOnce sync.Once mu sync.RWMutex } func (s *Server) start() error { signers, err := utils.CreateSigners([][]byte{[]byte(s.hostKeyContent)}) if err != nil { return fmt.Errorf("failed to create signers: %w", err) } var hostSigners []ssh.Signer for _, signer := range signers { cs := server.HostCertSigner{ Hostnames: []string{"127.0.0.1"}, } hostSigner, err := cs.SignCert(signer) if err != nil { return fmt.Errorf("failed to sign host certificate: %w", err) } hostSigners = append(hostSigners, hostSigner) } network := &server.MemoryProvider{} if err := network.SetOpts(nil); err != nil { return fmt.Errorf("failed to set network provider options: %w", err) } logger := testLogger.With( "mode", s.mode, "ssh", s.SSHAddr(), "ws", s.WSAddr(), ) s.logger = logger // Create session manager based on the mode var sm *server.SessionManager switch s.mode { case routing.ModeEmbedded: sm, err = server.NewSessionManager( routing.ModeEmbedded, server.WithSessionManagerLogger(logger), ) if err != nil { return fmt.Errorf("failed to create embedded session manager: %w", err) } case routing.ModeConsul: sm, err = server.NewSessionManager( routing.ModeConsul, server.WithSessionManagerLogger(logger), server.WithSessionManagerConsulURL(mustParseURL(testhelpers.ConsulURL())), ) if err != nil { return fmt.Errorf("failed to create consul session manager: %w", err) } default: return fmt.Errorf("unsupported routing mode: %s", s.mode) } s.mu.Lock() s.Server = &server.Server{ NodeAddr: s.SSHAddr(), // node addr is hard coded to ssh addr HostSigners: hostSigners, Signers: signers, NetworkProvider: network, MetricsProvider: provider.NewDiscardProvider(), SessionManager: sm, Logger: logger, } s.mu.Unlock() return s.Server.ServeWithContext(context.Background(), s.sshln, s.wsln) } func (s *Server) SSHAddr() string { return s.sshln.Addr().String() } func (s *Server) WSAddr() string { return s.wsln.Addr().String() } func (s *Server) NodeAddr() string { s.mu.RLock() defer s.mu.RUnlock() if s.Server == nil { return "" } return s.Server.NodeAddr } func (s *Server) Shutdown() error { var err error s.shutdownOnce.Do(func() { if s.logger != nil { s.logger.Info("shutting down test server") } if s.Server != nil { err = s.Server.Shutdown() } }) return err } type Host struct { *host.Host Command []string ForceCommand []string PrivateKeys []string AdminSocketFile string SessionCreatedCallback func(*api.GetSessionResponse) error ClientJoinedCallback func(*api.Client) ClientLeftCallback func(*api.Client) PermittedClientPublicKey string ReadOnly bool inputCh chan string outputCh chan string ctx context.Context cancel func() } func (c *Host) Close() { c.cancel() } func (c *Host) init() { c.ctx, c.cancel = context.WithCancel(context.Background()) c.inputCh = make(chan string) c.outputCh = make(chan string) } func (c *Host) Share(url string) error { c.init() stdinr, stdinw, err := os.Pipe() if err != nil { return err } stdoutr, stdoutw, err := os.Pipe() if err != nil { return err } signers, err := host.SignersFromFiles(c.PrivateKeys) if err != nil { return err } // permit client public key var authorizedKeys []*host.AuthorizedKey if c.PermittedClientPublicKey != "" { pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(c.PermittedClientPublicKey)) if err != nil { return err } authorizedKeys = append(authorizedKeys, &host.AuthorizedKey{PublicKeys: []ssh.PublicKey{pk}}) } if c.AdminSocketFile == "" { return fmt.Errorf("AdminSocketFile is required but not set") } logger := testLogger c.Host = &host.Host{ Host: url, Command: c.Command, ForceCommand: c.ForceCommand, Signers: signers, AuthorizedKeys: authorizedKeys, AdminSocketFile: c.AdminSocketFile, SessionCreatedCallback: c.SessionCreatedCallback, ClientJoinedCallback: c.ClientJoinedCallback, ClientLeftCallback: c.ClientLeftCallback, KeepAliveDuration: keepAliveDuration, Logger: logger, HostKeyCallback: ssh.InsecureIgnoreHostKey(), Stdin: stdinr, Stdout: stdoutw, ReadOnly: c.ReadOnly, } errCh := make(chan error) go func() { if err := c.Run(c.ctx); err != nil { testLogger.Error("error running host", "error", err) errCh <- err } }() if err := waitForUnixSocket(c.AdminSocketFile, errCh); err != nil { return err } var hostWg sync.WaitGroup hostWg.Add(2) // output go func() { hostWg.Done() w := writeFunc(func(p []byte) (int, error) { b, err := ansi.Strip(p) if err != nil { return 0, err } c.outputCh <- string(b) return len(p), nil }) if _, err := io.Copy(w, stdoutr); err != nil { testLogger.Error("error copying from stdout", "error", err) } }() // input go func() { hostWg.Done() for c := range c.inputCh { if _, err := io.Copy(stdinw, bytes.NewBufferString(c+"\n")); err != nil { testLogger.Error("error copying to stdin", "error", err) } } }() hostWg.Wait() return nil } func (c *Host) InputOutput() (chan string, chan string) { return c.inputCh, c.outputCh } type Client struct { PrivateKeys []string sshClient *ssh.Client session *ssh.Session sshStdin io.WriteCloser sshStdout io.Reader inputCh chan string outputCh chan string } func (c *Client) init() { c.inputCh = make(chan string) c.outputCh = make(chan string) } func (c *Client) InputOutput() (chan string, chan string) { return c.inputCh, c.outputCh } func (c *Client) Close() { _ = c.session.Close() _ = c.sshClient.Close() } func (c *Client) JoinWithContext(ctx context.Context, session *api.GetSessionResponse, clientJoinURL string) error { c.init() auths, err := authMethodsFromFiles(c.PrivateKeys) if err != nil { return err } config := &ssh.ClientConfig{ User: session.SshUser, Auth: auths, HostKeyCallback: ssh.InsecureIgnoreHostKey(), } u, err := url.Parse(clientJoinURL) if err != nil { return err } if u.Scheme == "ws" || u.Scheme == "wss" { encodedNodeAddr := base64.URLEncoding.EncodeToString([]byte(session.NodeAddr)) u, _ = url.Parse(u.String()) u.User = url.UserPassword(session.SessionId, encodedNodeAddr) c.sshClient, err = ws.NewSSHClient(u, config, true) } else { c.sshClient, err = ssh.Dial("tcp", u.Host, config) } if err != nil { return err } c.session, err = c.sshClient.NewSession() if err != nil { return err } if err = c.session.RequestPty("xterm", 40, 80, ssh.TerminalModes{}); err != nil { return err } c.sshStdin, err = c.session.StdinPipe() if err != nil { return err } c.sshStdout, err = c.session.StdoutPipe() if err != nil { return err } if err = c.session.Shell(); err != nil { return err } var g run.Group ctx, cancel := context.WithCancel(ctx) { // output g.Add(func() error { w := writeFunc(func(pp []byte) (int, error) { b, err := ansi.Strip(pp) if err != nil { return 0, err } c.outputCh <- string(b) return len(pp), nil }) _, err := io.Copy(w, uio.NewContextReader(ctx, c.sshStdout)) return err }, func(err error) { cancel() }) } { // input g.Add(func() error { for { select { case s := <-c.inputCh: if _, err := io.Copy(c.sshStdin, bytes.NewBufferString(s+"\n")); err != nil { return err } case <-ctx.Done(): return ctx.Err() } } }, func(err error) { cancel() }) } go func() { if err := g.Run(); err != nil { testLogger.Error("error joining host", "error", err) } }() return nil } func (c *Client) Join(session *api.GetSessionResponse, clientJoinURL string) error { return c.JoinWithContext(context.Background(), session, clientJoinURL) } func scanner(ch chan string) *bufio.Scanner { r, w := io.Pipe() s := bufio.NewScanner(r) go func() { for str := range ch { _, _ = w.Write([]byte(str)) } }() return s } func scan(s *bufio.Scanner) string { for s.Scan() { text := strings.TrimSpace(s.Text()) if text == "" { continue } return text } return s.Err().Error() } func waitForUnixSocket(socket string, errCh chan error) error { ctx, cancel := context.WithTimeout(context.Background(), unixSocketWaitTimeout) defer cancel() ticker := time.NewTicker(time.Second) defer ticker.Stop() for { select { case err := <-errCh: return err case <-ctx.Done(): return fmt.Errorf("timeout waiting for unix socket %s: %w", socket, ctx.Err()) case <-ticker.C: testLogger.Debug("waiting for unix socket", "socket", socket) if _, err := os.Stat(socket); err == nil { return nil } } } } type writeFunc func(p []byte) (n int, err error) func (rf writeFunc) Write(p []byte) (n int, err error) { return rf(p) } func authMethodsFromFiles(privateKeys []string) ([]ssh.AuthMethod, error) { signers, err := host.SignersFromFiles(privateKeys) if err != nil { return nil, err } var auths []ssh.AuthMethod for _, signer := range signers { auths = append(auths, ssh.PublicKeys(signer)) } return auths, nil } func setupKeyPairs() (func(), error) { var err error HostPrivateKey, err = writeTempFile("id_ed25519", HostPrivateKeyContent) if err != nil { return nil, err } ClientPrivateKey, err = writeTempFile("id_ed25519", ClientPrivateKeyContent) if err != nil { return nil, err } remove := func() { _ = os.Remove(HostPrivateKey) _ = os.Remove(ClientPrivateKey) } return remove, nil } func writeTempFile(name, content string) (string, error) { file, err := os.CreateTemp("", name) if err != nil { return "", err } defer func() { _ = file.Close() }() if _, err := file.Write([]byte(content)); err != nil { return "", err } return file.Name(), nil } upterm-0.17.0/ftests/host_test.go000066400000000000000000000073221507434540500170010ustar00rootroot00000000000000package ftests import ( "context" "os" "testing" "time" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/utils" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "golang.org/x/crypto/ssh" ) func testHostClientCallback(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) assert := assert.New(t) jch := make(chan *api.Client) lch := make(chan *api.Client) // Setup admin socket adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "-c", "PS1='' BASH_SILENCE_DEPRECATION_WARNING=1 bash --norc"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, PermittedClientPublicKey: ClientPublicKeyContent, ClientJoinedCallback: func(c *api.Client) { jch <- c }, ClientLeftCallback: func(c *api.Client) { lch <- c }, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() // verify admin server session := getAndVerifySession(t, adminSocketFile, hostShareURL, hostNodeAddr) ctx, cancel := context.WithCancel(context.Background()) defer cancel() c := &Client{ PrivateKeys: []string{ClientPrivateKey}, } err = c.JoinWithContext(ctx, session, clientJoinURL) require.NoError(err) var clientID string select { case cc := <-jch: pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(ClientPublicKeyContent)) require.NoError(err) assert.NotEmpty(cc.Id, "client id can't be empty") clientID = cc.Id assert.Equal(utils.FingerprintSHA256(pk), cc.PublicKeyFingerprint, "public key fingerprint should match") assert.Equal("SSH-2.0-Go", cc.Version, "client version should match") case <-time.After(2 * time.Second): t.Fatal("client joined callback is not called") } // client leaves cancel() c.Close() select { case cc := <-lch: assert.NotEmpty(cc.Id, "client id can't be empty") pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(ClientPublicKeyContent)) require.NoError(err) assert.Equal(clientID, cc.Id, "client ID should match on leave") assert.Equal(utils.FingerprintSHA256(pk), cc.PublicKeyFingerprint, "public key fingerprint should match on leave") assert.Equal("SSH-2.0-Go", cc.Version, "client version should match on leave") case <-time.After(2 * time.Second): if os.Getenv("MUTE_FLAKY_TESTS") != "" { testLogger.Error("FLAKY_TEST: client left callback is not called") } else { t.Fatal("client left callback is not called") } } } func testHostSessionCreatedCallback(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) assert := assert.New(t) // Setup admin socket adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash", "--norc"}, ForceCommand: []string{"vim"}, PrivateKeys: []string{HostPrivateKey}, AdminSocketFile: adminSocketFile, SessionCreatedCallback: func(session *api.GetSessionResponse) error { assert.Equal([]string{"bash", "--norc"}, session.Command, "command should match") assert.Equal([]string{"vim"}, session.ForceCommand, "force command should match") checkSessionPayload(t, session, hostShareURL, hostNodeAddr) return nil }, } err := h.Share(hostShareURL) require.NoError(err) defer h.Close() } func testHostFailToShareWithoutPrivateKey(t *testing.T, hostShareURL, hostNodeAddr, clientJoinURL string) { require := require.New(t) // Setup admin socket adminSocketFile := setupAdminSocket(t) h := &Host{ Command: []string{"bash"}, AdminSocketFile: adminSocketFile, } err := h.Share(hostShareURL) require.Error(err, "should fail without private key") require.ErrorContains(err, "Permission denied (publickey)", "should fail with permission denied error") } upterm-0.17.0/go.mod000066400000000000000000000140241507434540500142310ustar00rootroot00000000000000// +heroku goVersion 1.25.3 // +heroku install ./cmd/uptermd/... module github.com/owenthereal/upterm go 1.25.3 require ( github.com/VividCortex/gohistogram v1.0.0 // indirect github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect github.com/apex/log v1.9.0 // indirect github.com/buger/goterm v1.0.4 // indirect; idirect github.com/c4milo/unpackit v0.0.0-20170704181138-4ed373e9ef1c // indirect github.com/creack/pty v1.1.24 github.com/dchest/uniuri v1.2.0 github.com/dsnet/compress v0.0.1 // indirect github.com/gen2brain/beeep v0.11.1 github.com/getsentry/sentry-go v0.35.3 github.com/getsentry/sentry-go/slog v0.35.3 github.com/go-kit/kit v0.13.0 github.com/google/go-cmp v0.7.0 github.com/google/go-querystring v1.1.0 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 github.com/gorilla/websocket v1.5.3 github.com/gosuri/uilive v0.0.4 // indirect github.com/gosuri/uiprogress v0.0.1 // indirect github.com/hashicorp/consul/api v1.32.4 github.com/hashicorp/go-multierror v1.1.1 github.com/influxdata/influxdb1-client v0.0.0-20220302092344-a9ab5670611c // indirect github.com/jpillora/chisel v1.11.3 github.com/klauspost/pgzip v1.2.6 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/oklog/run v1.2.0 github.com/olebedev/emitter v0.0.0-20230411050614-349169dec2ba github.com/olekukonko/tablewriter v1.1.0 github.com/pborman/ansi v1.0.0 github.com/prometheus/client_golang v1.23.2 github.com/rs/xid v1.6.0 github.com/spf13/cobra v1.10.1 github.com/tj/go v1.8.7 github.com/ulikunitz/xz v0.5.15 // indirect golang.org/x/crypto v0.42.0 google.golang.org/grpc v1.76.0 google.golang.org/protobuf v1.36.10 ) require ( github.com/avast/retry-go/v4 v4.6.1 github.com/charmbracelet/ssh v0.0.0-20250429213052-383d50896132 github.com/cli/go-gh/v2 v2.12.2 github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 github.com/google/go-github/v48 v48.2.0 github.com/hashicorp/go-version v1.7.0 github.com/pires/go-proxyproto v0.8.1 github.com/samber/slog-multi v1.5.0 github.com/spf13/pflag v1.0.10 github.com/spf13/viper v1.21.0 github.com/stretchr/testify v1.11.1 github.com/tj/go-update v2.2.4+incompatible golang.org/x/term v0.36.0 ) require ( git.sr.ht/~jackmordaunt/go-toast v1.1.2 // indirect github.com/armon/go-metrics v0.4.1 // indirect github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/charmbracelet/x/conpty v0.1.0 // indirect github.com/charmbracelet/x/errors v0.0.0-20250606192012-6931dbeeced5 // indirect github.com/charmbracelet/x/termios v0.1.1 // indirect github.com/cli/safeexec v1.0.1 // indirect github.com/cli/shurcooL-graphql v0.0.4 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/esiqveland/notify v0.13.3 // indirect github.com/fatih/color v1.16.0 // indirect github.com/fsnotify/fsnotify v1.9.0 // indirect github.com/go-kit/log v0.2.1 // indirect github.com/go-logfmt/logfmt v0.6.0 // indirect github.com/go-ole/go-ole v1.3.0 // indirect github.com/go-viper/mapstructure/v2 v2.4.0 // indirect github.com/godbus/dbus/v5 v5.1.0 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-hclog v1.5.0 // indirect github.com/hashicorp/go-immutable-radix v1.3.1 // indirect github.com/hashicorp/go-rootcerts v1.0.2 // indirect github.com/hashicorp/golang-lru v0.5.4 // indirect github.com/hashicorp/serf v0.10.1 // indirect github.com/henvic/httpretty v0.1.4 // indirect github.com/hooklift/assert v0.1.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jackmordaunt/icns/v3 v3.0.1 // indirect github.com/jpillora/sizestr v1.0.0 // indirect github.com/klauspost/compress v1.18.0 // indirect github.com/lucasb-eyer/go-colorful v1.2.0 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-runewidth v0.0.16 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/muesli/termenv v0.16.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect github.com/olekukonko/errors v1.1.0 // indirect github.com/olekukonko/ll v0.0.9 // indirect github.com/pelletier/go-toml/v2 v2.2.4 // indirect github.com/pkg/errors v0.9.1 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.66.1 // indirect github.com/prometheus/procfs v0.16.1 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/sagikazarmark/locafero v0.11.0 // indirect github.com/samber/lo v1.51.0 // indirect github.com/samber/slog-common v0.19.0 // indirect github.com/sergeymakinen/go-bmp v1.0.0 // indirect github.com/sergeymakinen/go-ico v1.0.0-beta.0 // indirect github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect github.com/spf13/afero v1.15.0 // indirect github.com/spf13/cast v1.10.0 // indirect github.com/subosito/gotenv v1.6.0 // indirect github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af // indirect github.com/thlib/go-timezone-local v0.0.6 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp v0.0.0-20250808145144-a408d31f581a // indirect golang.org/x/net v0.45.0 // indirect golang.org/x/sync v0.17.0 // indirect golang.org/x/sys v0.37.0 // indirect golang.org/x/text v0.30.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) replace golang.org/x/crypto => github.com/tg123/sshpiper.crypto v0.43.0-sshpiper-20251012 upterm-0.17.0/go.sum000066400000000000000000001541301507434540500142610ustar00rootroot00000000000000git.sr.ht/~jackmordaunt/go-toast v1.1.2 h1:/yrfI55LRt1M7H1vkaw+NaH1+L1CDxrqDltwm5euVuE= git.sr.ht/~jackmordaunt/go-toast v1.1.2/go.mod h1:jA4OqHKTQ4AFBdwrSnwnskUIIS3HYzlJSgdzCKqfavo= github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ= github.com/VividCortex/gohistogram v1.0.0 h1:6+hBz+qvs0JOrrNhhmR7lFxo5sINxBCGXrdtl/UvroE= github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/apex/log v1.3.0/go.mod h1:jd8Vpsr46WAe3EZSQ/IUMs2qQD/GOycT5rPWCO1yGcs= github.com/apex/log v1.9.0 h1:FHtw/xuaM8AgmvDDTI9fiwoAL25Sq2cxojnZICUU8l0= github.com/apex/log v1.9.0/go.mod h1:m82fZlWIuiWzWP04XCTXmnX0xRkYYbCdYn8jbJeLBEA= github.com/apex/logs v0.0.4/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo= github.com/apex/logs v1.0.0/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo= github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy8kCu4PNA+aP7WUV72eXWJeP9/r3/K9aLE= github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3stzu0Xys= github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA= github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4= github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/atotto/clipboard v0.1.2/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI= github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk= github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA= github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo= github.com/aws/aws-sdk-go v1.31.9/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0= github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I= github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k= github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs= github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 h1:GKTyiRCL6zVf5wWaqKnf+7Qs6GbEPfd4iMOitWzXJx8= github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8/go.mod h1:spo1JLcs67NmW1aVLEgtA8Yy1elc+X8y5SRW1sFW4Og= github.com/buger/goterm v0.0.0-20181115115552-c206103e1f37/go.mod h1:u9UyCz2eTrSGy6fbupqJ54eY5c4IC8gREQ1053dK12U= github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY= github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE= github.com/c4milo/unpackit v0.0.0-20170704181138-4ed373e9ef1c h1:aprLqMn7gSPT+vdDSl+/E6NLEuArwD/J7IWd8bJt5lQ= github.com/c4milo/unpackit v0.0.0-20170704181138-4ed373e9ef1c/go.mod h1:Ie6SubJv/NTO9Q0UBH0QCl3Ve50lu9hjbi5YJUw03TE= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/charmbracelet/ssh v0.0.0-20250429213052-383d50896132 h1:ILyX/vWS/SeHfyuMFAsaV95jEKrwivNUkA8tE7JEXs4= github.com/charmbracelet/ssh v0.0.0-20250429213052-383d50896132/go.mod h1:R9cISUs5kAH4Cq/rguNbSwcR+slE5Dfm8FEs//uoIGE= github.com/charmbracelet/x/conpty v0.1.0 h1:4zc8KaIcbiL4mghEON8D72agYtSeIgq8FSThSPQIb+U= github.com/charmbracelet/x/conpty v0.1.0/go.mod h1:rMFsDJoDwVmiYM10aD4bH2XiRgwI7NYJtQgl5yskjEQ= github.com/charmbracelet/x/errors v0.0.0-20250606192012-6931dbeeced5 h1:AyGATHeNg6E509HyLWbYxXjdsiBEWOnyh1NX1725vY4= github.com/charmbracelet/x/errors v0.0.0-20250606192012-6931dbeeced5/go.mod h1:nmnmDtAEAq9i8KHhoYE3SvXMjYPuS219MWbawvAumQ4= github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY= github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo= github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag= github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I= github.com/cli/go-gh/v2 v2.12.2 h1:EtocmDAH7dKrH2PscQOQVo7PbFD5G6uYx4rSKY2w1SY= github.com/cli/go-gh/v2 v2.12.2/go.mod h1:g2IjwHEo27fgItlS9wUbRaXPYurZEXPp1jrxf3piC6g= github.com/cli/safeexec v1.0.1 h1:e/C79PbXF4yYTN/wauC4tviMxEV13BwljGj0N9j+N00= github.com/cli/safeexec v1.0.1/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q= github.com/cli/shurcooL-graphql v0.0.4 h1:6MogPnQJLjKkaXPyGqPRXOI2qCsQdqNfUY1QSJu2GuY= github.com/cli/shurcooL-graphql v0.0.4/go.mod h1:3waN4u02FiZivIV+p1y4d0Jo1jc6BViMA73C+sZo2fk= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo= github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dchest/uniuri v1.2.0 h1:koIcOUdrTIivZgSLhHQvKgqdWZq5d7KdMEWF1Ud6+5g= github.com/dchest/uniuri v1.2.0/go.mod h1:fSzm4SLHzNZvWLvWJew423PhAzkpNQYq+uNLq4kxhkY= github.com/dsnet/compress v0.0.1 h1:PlZu0n3Tuv04TzpfPbrnI0HW/YwodEXDS+oPKahKF0Q= github.com/dsnet/compress v0.0.1/go.mod h1:Aw8dCMJ7RioblQeTqt88akK31OvO8Dhf5JflhBbQEHo= github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY= github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg= github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg= github.com/esiqveland/notify v0.13.3 h1:QCMw6o1n+6rl+oLUfg8P1IIDSFsDEb2WlXvVvIJbI/o= github.com/esiqveland/notify v0.13.3/go.mod h1:hesw/IRYTO0x99u1JPweAl4+5mwXJibQVUcP0Iu5ORE= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/gen2brain/beeep v0.11.1 h1:EbSIhrQZFDj1K2fzlMpAYlFOzV8YuNe721A58XcCTYI= github.com/gen2brain/beeep v0.11.1/go.mod h1:jQVvuwnLuwOcdctHn/uyh8horSBNJ8uGb9Cn2W4tvoc= github.com/getsentry/sentry-go v0.35.3 h1:u5IJaEqZyPdWqe/hKlBKBBnMTSxB/HenCqF3QLabeds= github.com/getsentry/sentry-go v0.35.3/go.mod h1:mdL49ixwT2yi57k5eh7mpnDyPybixPzlzEJFu0Z76QA= github.com/getsentry/sentry-go/slog v0.35.3 h1:4MQEfo3U25jxKhrRYMS6wPXpW3WXSrjSRmDQZroalaw= github.com/getsentry/sentry-go/slog v0.35.3/go.mod h1:BhcfZ6LB5VpHAl6kOKf0Bsy2AXJbTl9Nit9Zq4KApus= github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA= github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= github.com/go-kit/kit v0.13.0 h1:OoneCcHKHQ03LfBpoQCUfCluwd2Vt3ohz+kvbJneZAU= github.com/go-kit/kit v0.13.0/go.mod h1:phqEHMMUbyrCFCTgH48JueqrM3md2HcAZ8N3XE4FKDg= github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU= github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4= github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE= github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78= github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs= github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4= github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-github/v48 v48.2.0 h1:68puzySE6WqUY9KWmpOsDEQfDZsso98rT6pZcz9HqcE= github.com/google/go-github/v48 v48.2.0/go.mod h1:dDlehKBDo850ZPvCTK0sEqTCVWcrGl2LcDiajkYi89Y= github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8= github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/gosuri/uilive v0.0.4 h1:hUEBpQDj8D8jXgtCdBu7sWsy5sbW/5GhuO8KBwJ2jyY= github.com/gosuri/uilive v0.0.4/go.mod h1:V/epo5LjjlDE5RJUcqx8dbw+zc93y5Ya3yg8tfZ74VI= github.com/gosuri/uiprogress v0.0.1 h1:0kpv/XY/qTmFWl/SkaJykZXrBBzwwadmW8fRb7RJSxw= github.com/gosuri/uiprogress v0.0.1/go.mod h1:C1RTYn4Sc7iEyf6j8ft5dyoZ4212h8G1ol9QQluh5+0= github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw= github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI= github.com/hashicorp/consul/api v1.32.4 h1:xNe27KcBNYHbqWX/6c6WTAlPoZlZv8onDEySmjcspO0= github.com/hashicorp/consul/api v1.32.4/go.mod h1:jy0q71iTvUGfbCwo+ExBF0gEesE5cY2TSeAz2EoNG8E= github.com/hashicorp/consul/sdk v0.16.3 h1:kI/oax+yeaoremkh36G/f4Q13ivdFF4AE+Co/LlZa0Q= github.com/hashicorp/consul/sdk v0.16.3/go.mod h1:TSPshuYdi1OQwpLund2vkTHpp4WnLyhf7Q/YihGMtp0= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c= github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc= github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM= github.com/hashicorp/go-msgpack v0.5.5 h1:i9R9JSrqIz0QVLz3sz+i3YJdT7TTSLcfLLzJi9aZTuI= github.com/hashicorp/go-msgpack v0.5.5/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM= github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA= github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs= github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc= github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8= github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU= github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc= github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A= github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4= github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8= github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY= github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc= github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4= github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64= github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc= github.com/hashicorp/memberlist v0.5.0 h1:EtYPN8DpAURiapus508I4n9CzHs2W+8NZGbmmR/prTM= github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4mHgHUZ8lrOI0= github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY= github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4= github.com/henvic/httpretty v0.1.4 h1:Jo7uwIRWVFxkqOnErcoYfH90o3ddQyVrSANeS4cxYmU= github.com/henvic/httpretty v0.1.4/go.mod h1:Dn60sQTZfbt2dYsdUSNsCljyF4AfdqnuJFDLJA1I4AM= github.com/hooklift/assert v0.1.0 h1:UZzFxx5dSb9aBtvMHTtnPuvFnBvcEhHTPb9+0+jpEjs= github.com/hooklift/assert v0.1.0/go.mod h1:pfexfvIHnKCdjh6CkkIZv5ic6dQ6aU2jhKghBlXuwwY= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/influxdata/influxdb1-client v0.0.0-20220302092344-a9ab5670611c h1:qSHzRbhzK8RdXOsAdfDgO49TtqC1oZ+acxPrkfTxcCs= github.com/influxdata/influxdb1-client v0.0.0-20220302092344-a9ab5670611c/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo= github.com/jackmordaunt/icns/v3 v3.0.1 h1:xxot6aNuGrU+lNgxz5I5H0qSeCjNKp8uTXB1j8D4S3o= github.com/jackmordaunt/icns/v3 v3.0.1/go.mod h1:5sHL59nqTd2ynTnowxB/MDQFhKNqkK8X687uKNygaSQ= github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k= github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik= github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgbbvHEiQClaW2NsSzMyGHqN+rDFqY705q49KG0= github.com/jpillora/chisel v1.11.3 h1:TWN/WjWLsUr/uhE1HzuNJZkgCHLdCUrZIgxVfST8UT0= github.com/jpillora/chisel v1.11.3/go.mod h1:8GZhM4xXpYZGCwAk88cOQhtv9IlfZS8cu01lYOpvMNE= github.com/jpillora/sizestr v1.0.0 h1:4tr0FLxs1Mtq3TnsLDV+GYUWG7Q26a6s+tV5Zfw2ygw= github.com/jpillora/sizestr v1.0.0/go.mod h1:bUhLv4ctkknatr6gR42qPxirmd5+ds1u7mzD+MZ33f0= github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A= github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek= github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU= github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY= github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ= github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ= github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso= github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI= github.com/miekg/dns v1.1.43 h1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg= github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4= github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI= github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc= github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ= github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8= github.com/oklog/run v1.2.0 h1:O8x3yXwah4A73hJdlrwo/2X6J62gE5qTMusH0dvz60E= github.com/oklog/run v1.2.0/go.mod h1:mgDbKRSwPhJfesJ4PntqFUbKQRZ50NgmZTSPlFA0YFk= github.com/olebedev/emitter v0.0.0-20230411050614-349169dec2ba h1:/Q5vvLs180BFH7u+Nakdrr1B9O9RAxVaIurFQy0c8QQ= github.com/olebedev/emitter v0.0.0-20230411050614-349169dec2ba/go.mod h1:eT2/Pcsim3XBjbvldGiJBvvgiqZkAFyiOJJsDKXs/ts= github.com/olekukonko/errors v1.1.0 h1:RNuGIh15QdDenh+hNvKrJkmxxjV4hcS50Db478Ou5sM= github.com/olekukonko/errors v1.1.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y= github.com/olekukonko/ll v0.0.9 h1:Y+1YqDfVkqMWuEQMclsF9HUR5+a82+dxJuL1HHSRpxI= github.com/olekukonko/ll v0.0.9/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g= github.com/olekukonko/tablewriter v1.1.0 h1:N0LHrshF4T39KvI96fn6GT8HEjXRXYNDrDjKFDB7RIY= github.com/olekukonko/tablewriter v1.1.0/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY= github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/pborman/ansi v1.0.0 h1:OqjHMhvlSuCCV5JT07yqPuJPQzQl+WXsiZ14gZsqOrQ= github.com/pborman/ansi v1.0.0/go.mod h1:SgWzwMAx1X/Ez7i90VqF8LRiQtx52pWDiQP+x3iGnzw= github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4= github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4= github.com/pingcap/errors v0.11.4/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8= github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0= github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU= github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI= github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s= github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4= github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs= github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A= github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg= github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog= github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU= github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts= github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc= github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik= github.com/samber/lo v1.51.0 h1:kysRYLbHy/MB7kQZf5DSN50JHmMsNEdeY24VzJFu7wI= github.com/samber/lo v1.51.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0= github.com/samber/slog-common v0.19.0 h1:fNcZb8B2uOLooeYwFpAlKjkQTUafdjfqKcwcC89G9YI= github.com/samber/slog-common v0.19.0/go.mod h1:dTz+YOU76aH007YUU0DffsXNsGFQRQllPQh9XyNoA3M= github.com/samber/slog-multi v1.5.0 h1:UDRJdsdb0R5vFQFy3l26rpX3rL3FEPJTJ2yKVjoiT1I= github.com/samber/slog-multi v1.5.0/go.mod h1:im2Zi3mH/ivSY5XDj6LFcKToRIWPw1OcjSVSdXt+2d0= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= github.com/sergeymakinen/go-bmp v1.0.0 h1:SdGTzp9WvCV0A1V0mBeaS7kQAwNLdVJbmHlqNWq0R+M= github.com/sergeymakinen/go-bmp v1.0.0/go.mod h1:/mxlAQZRLxSvJFNIEGGLBE/m40f3ZnUifpgVDlcUIEY= github.com/sergeymakinen/go-ico v1.0.0-beta.0 h1:m5qKH7uPKLdrygMWxbamVn+tl2HfiA3K6MFJw4GfZvQ= github.com/sergeymakinen/go-ico v1.0.0-beta.0/go.mod h1:wQ47mTczswBO5F0NoDt7O0IXgnV4Xy3ojrroMQzyhUk= github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM= github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM= github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs= github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw= github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U= github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I= github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg= github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY= github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo= github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stripe/stripe-go v70.15.0+incompatible/go.mod h1:A1dQZmO/QypXmsL0T8axYZkSN/uA/T/A64pfKdBAMiY= github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8= github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU= github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af h1:6yITBqGTE2lEeTPG04SN9W+iWHCRyHqlVYILiSXziwk= github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af/go.mod h1:4F09kP5F+am0jAwlQLddpoMDM+iewkxxt6nxUQ5nq5o= github.com/tg123/sshpiper.crypto v0.43.0-sshpiper-20251012 h1:fmASLZKO1/uZ75Cafid4TvSOrX9PVA036gXhIH/6uHw= github.com/tg123/sshpiper.crypto v0.43.0-sshpiper-20251012/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0= github.com/thlib/go-timezone-local v0.0.6 h1:Ii3QJ4FhosL/+eCZl6Hsdr4DDU4tfevNoV83yAEo2tU= github.com/thlib/go-timezone-local v0.0.6/go.mod h1:/Tnicc6m/lsJE0irFMA0LfIwTBo4QP7A8IfyIv4zZKI= github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0= github.com/tj/assert v0.0.1/go.mod h1:lsg+GHQ0XplTcWKGxFLf/XPcPxWO8x2ut5jminoR2rA= github.com/tj/assert v0.0.3 h1:Df/BlaZ20mq6kuai7f5z2TvPFiwC3xaWJSDQNiIS3Rk= github.com/tj/assert v0.0.3/go.mod h1:Ne6X72Q+TB1AteidzQncjw9PabbMp4PBMZ1k+vd1Pvk= github.com/tj/go v1.8.7 h1:a7M1Xo+QKmlUHEzZj2LX0LHqkh7/LpOa6Or8luBvY/c= github.com/tj/go v1.8.7/go.mod h1:88DQADQo0c0fHmWNcr88pIGUHlV5du8aGtON+S1jr5A= github.com/tj/go-buffer v1.1.0/go.mod h1:iyiJpfFcR2B9sXu7KvjbT9fpM4mOelRSDTbntVj52Uc= github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0= github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao= github.com/tj/go-spin v1.1.0/go.mod h1:Mg1mzmePZm4dva8Qz60H2lHwmJ2loum4VIrLgVnKwh4= github.com/tj/go-update v2.2.4+incompatible h1:7Rkw5ZyRSFb3QyEWM7sHCy9rCy1/r66elkOyGlfnZFc= github.com/tj/go-update v2.2.4+incompatible/go.mod h1:waFwwyiAhGey2e+dNoYQ/iLhIcFqhCW7zL/+vDU1WLo= github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM= github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8= github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY= github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ= go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I= go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE= go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E= go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI= go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg= go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc= go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps= go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4= go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/exp v0.0.0-20250808145144-a408d31f581a h1:Y+7uR/b1Mw2iSXZ3G//1haIiSElDQZ8KWh0h+sZPG90= golang.org/x/exp v0.0.0-20250808145144-a408d31f581a/go.mod h1:rT6SFzZ7oxADUDx58pcaKFTcZ+inxAa9fTrYx/uVYwg= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ= golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc= golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds= golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA= golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8= golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg= golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM= golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210331175145-43e1dd70ce54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0= golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4= golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488/go.mod h1:fGb/2+tgXXjhjHsTNdVEEMZNWA0quBnfrO+AfoDSAKw= golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053/go.mod h1:+nZKN+XVh4LCiA9DV3ywrzN4gumyCnKjau3NGb9SGoE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ= golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0= golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA= golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q= golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA= golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA= golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU= golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU= golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4= golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k= golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI= golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg= golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw= golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s= golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE= golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b h1:zPKJod4w6F1+nRGDI9ubnXYhU9NSWoFAijkHkUXeTK8= google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A= google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A= google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c= google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/h2non/gock.v1 v1.1.2 h1:jBbHXgGBK/AoPVfJh5x4r/WxIrElvbLel8TCZkkZJoY= gopkg.in/h2non/gock.v1 v1.1.2/go.mod h1:n7UGz/ckNChHiK05rDoiC4MYSunEC/lyaUm2WWaDva0= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200602174320-3e3e88ca92fa/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= upterm-0.17.0/host/000077500000000000000000000000001507434540500140775ustar00rootroot00000000000000upterm-0.17.0/host/adminclient.go000066400000000000000000000010561507434540500167170ustar00rootroot00000000000000package host import ( "fmt" "github.com/owenthereal/upterm/host/api" "google.golang.org/grpc" "google.golang.org/grpc/credentials/insecure" ) const ( AdminSockExt = ".sock" ) func AdminSocketFile(sessionID string) string { return fmt.Sprintf("%s%s", sessionID, AdminSockExt) } func AdminClient(socket string) (api.AdminServiceClient, error) { // Use mtls conn, err := grpc.NewClient("unix://"+socket, grpc.WithTransportCredentials(insecure.NewCredentials())) if err != nil { return nil, err } return api.NewAdminServiceClient(conn), nil } upterm-0.17.0/host/api/000077500000000000000000000000001507434540500146505ustar00rootroot00000000000000upterm-0.17.0/host/api/api.pb.go000066400000000000000000000445511507434540500163610ustar00rootroot00000000000000// Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.28.1 // protoc v3.21.6 // source: api.proto package api import ( protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" reflect "reflect" sync "sync" ) const ( // Verify that this generated code is sufficiently up-to-date. _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) // Verify that runtime/protoimpl is sufficiently up-to-date. _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) ) type Identifier_Type int32 const ( Identifier_HOST Identifier_Type = 0 Identifier_CLIENT Identifier_Type = 1 ) // Enum value maps for Identifier_Type. var ( Identifier_Type_name = map[int32]string{ 0: "HOST", 1: "CLIENT", } Identifier_Type_value = map[string]int32{ "HOST": 0, "CLIENT": 1, } ) func (x Identifier_Type) Enum() *Identifier_Type { p := new(Identifier_Type) *p = x return p } func (x Identifier_Type) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } func (Identifier_Type) Descriptor() protoreflect.EnumDescriptor { return file_api_proto_enumTypes[0].Descriptor() } func (Identifier_Type) Type() protoreflect.EnumType { return &file_api_proto_enumTypes[0] } func (x Identifier_Type) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } // Deprecated: Use Identifier_Type.Descriptor instead. func (Identifier_Type) EnumDescriptor() ([]byte, []int) { return file_api_proto_rawDescGZIP(), []int{4, 0} } type GetSessionRequest struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields } func (x *GetSessionRequest) Reset() { *x = GetSessionRequest{} if protoimpl.UnsafeEnabled { mi := &file_api_proto_msgTypes[0] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *GetSessionRequest) String() string { return protoimpl.X.MessageStringOf(x) } func (*GetSessionRequest) ProtoMessage() {} func (x *GetSessionRequest) ProtoReflect() protoreflect.Message { mi := &file_api_proto_msgTypes[0] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use GetSessionRequest.ProtoReflect.Descriptor instead. func (*GetSessionRequest) Descriptor() ([]byte, []int) { return file_api_proto_rawDescGZIP(), []int{0} } type GetSessionResponse struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"` Command []string `protobuf:"bytes,2,rep,name=command,proto3" json:"command,omitempty"` ForceCommand []string `protobuf:"bytes,3,rep,name=force_command,json=forceCommand,proto3" json:"force_command,omitempty"` Host string `protobuf:"bytes,4,opt,name=host,proto3" json:"host,omitempty"` NodeAddr string `protobuf:"bytes,5,opt,name=node_addr,json=nodeAddr,proto3" json:"node_addr,omitempty"` ConnectedClients []*Client `protobuf:"bytes,6,rep,name=connected_clients,json=connectedClients,proto3" json:"connected_clients,omitempty"` AuthorizedKeys []*AuthorizedKey `protobuf:"bytes,7,rep,name=authorized_keys,json=authorizedKeys,proto3" json:"authorized_keys,omitempty"` SshUser string `protobuf:"bytes,8,opt,name=ssh_user,json=sshUser,proto3" json:"ssh_user,omitempty"` // SSH username for client connections } func (x *GetSessionResponse) Reset() { *x = GetSessionResponse{} if protoimpl.UnsafeEnabled { mi := &file_api_proto_msgTypes[1] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *GetSessionResponse) String() string { return protoimpl.X.MessageStringOf(x) } func (*GetSessionResponse) ProtoMessage() {} func (x *GetSessionResponse) ProtoReflect() protoreflect.Message { mi := &file_api_proto_msgTypes[1] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use GetSessionResponse.ProtoReflect.Descriptor instead. func (*GetSessionResponse) Descriptor() ([]byte, []int) { return file_api_proto_rawDescGZIP(), []int{1} } func (x *GetSessionResponse) GetSessionId() string { if x != nil { return x.SessionId } return "" } func (x *GetSessionResponse) GetCommand() []string { if x != nil { return x.Command } return nil } func (x *GetSessionResponse) GetForceCommand() []string { if x != nil { return x.ForceCommand } return nil } func (x *GetSessionResponse) GetHost() string { if x != nil { return x.Host } return "" } func (x *GetSessionResponse) GetNodeAddr() string { if x != nil { return x.NodeAddr } return "" } func (x *GetSessionResponse) GetConnectedClients() []*Client { if x != nil { return x.ConnectedClients } return nil } func (x *GetSessionResponse) GetAuthorizedKeys() []*AuthorizedKey { if x != nil { return x.AuthorizedKeys } return nil } func (x *GetSessionResponse) GetSshUser() string { if x != nil { return x.SshUser } return "" } type AuthorizedKey struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields PublicKeyFingerprints []string `protobuf:"bytes,1,rep,name=public_key_fingerprints,json=publicKeyFingerprints,proto3" json:"public_key_fingerprints,omitempty"` Comment string `protobuf:"bytes,2,opt,name=comment,proto3" json:"comment,omitempty"` } func (x *AuthorizedKey) Reset() { *x = AuthorizedKey{} if protoimpl.UnsafeEnabled { mi := &file_api_proto_msgTypes[2] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *AuthorizedKey) String() string { return protoimpl.X.MessageStringOf(x) } func (*AuthorizedKey) ProtoMessage() {} func (x *AuthorizedKey) ProtoReflect() protoreflect.Message { mi := &file_api_proto_msgTypes[2] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use AuthorizedKey.ProtoReflect.Descriptor instead. func (*AuthorizedKey) Descriptor() ([]byte, []int) { return file_api_proto_rawDescGZIP(), []int{2} } func (x *AuthorizedKey) GetPublicKeyFingerprints() []string { if x != nil { return x.PublicKeyFingerprints } return nil } func (x *AuthorizedKey) GetComment() string { if x != nil { return x.Comment } return "" } type Client struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"` Addr string `protobuf:"bytes,3,opt,name=addr,proto3" json:"addr,omitempty"` PublicKeyFingerprint string `protobuf:"bytes,4,opt,name=public_key_fingerprint,json=publicKeyFingerprint,proto3" json:"public_key_fingerprint,omitempty"` } func (x *Client) Reset() { *x = Client{} if protoimpl.UnsafeEnabled { mi := &file_api_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *Client) String() string { return protoimpl.X.MessageStringOf(x) } func (*Client) ProtoMessage() {} func (x *Client) ProtoReflect() protoreflect.Message { mi := &file_api_proto_msgTypes[3] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use Client.ProtoReflect.Descriptor instead. func (*Client) Descriptor() ([]byte, []int) { return file_api_proto_rawDescGZIP(), []int{3} } func (x *Client) GetId() string { if x != nil { return x.Id } return "" } func (x *Client) GetVersion() string { if x != nil { return x.Version } return "" } func (x *Client) GetAddr() string { if x != nil { return x.Addr } return "" } func (x *Client) GetPublicKeyFingerprint() string { if x != nil { return x.PublicKeyFingerprint } return "" } type Identifier struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` Type Identifier_Type `protobuf:"varint,2,opt,name=type,proto3,enum=api.Identifier_Type" json:"type,omitempty"` NodeAddr string `protobuf:"bytes,3,opt,name=node_addr,json=nodeAddr,proto3" json:"node_addr,omitempty"` } func (x *Identifier) Reset() { *x = Identifier{} if protoimpl.UnsafeEnabled { mi := &file_api_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *Identifier) String() string { return protoimpl.X.MessageStringOf(x) } func (*Identifier) ProtoMessage() {} func (x *Identifier) ProtoReflect() protoreflect.Message { mi := &file_api_proto_msgTypes[4] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use Identifier.ProtoReflect.Descriptor instead. func (*Identifier) Descriptor() ([]byte, []int) { return file_api_proto_rawDescGZIP(), []int{4} } func (x *Identifier) GetId() string { if x != nil { return x.Id } return "" } func (x *Identifier) GetType() Identifier_Type { if x != nil { return x.Type } return Identifier_HOST } func (x *Identifier) GetNodeAddr() string { if x != nil { return x.NodeAddr } return "" } var File_api_proto protoreflect.FileDescriptor var file_api_proto_rawDesc = []byte{ 0x0a, 0x09, 0x61, 0x70, 0x69, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x22, 0x13, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xb5, 0x02, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12, 0x38, 0x0a, 0x11, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x3b, 0x0a, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x73, 0x68, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x73, 0x68, 0x55, 0x73, 0x65, 0x72, 0x22, 0x61, 0x0a, 0x0d, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x12, 0x36, 0x0a, 0x17, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x22, 0x7c, 0x0a, 0x06, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x64, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x61, 0x64, 0x64, 0x72, 0x12, 0x34, 0x0a, 0x16, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x22, 0x81, 0x01, 0x0a, 0x0a, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x28, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x41, 0x64, 0x64, 0x72, 0x22, 0x1c, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x4f, 0x53, 0x54, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x4c, 0x49, 0x45, 0x4e, 0x54, 0x10, 0x01, 0x32, 0x4f, 0x0a, 0x0c, 0x41, 0x64, 0x6d, 0x69, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x28, 0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x77, 0x65, 0x6e, 0x74, 0x68, 0x65, 0x72, 0x65, 0x61, 0x6c, 0x2f, 0x75, 0x70, 0x74, 0x65, 0x72, 0x6d, 0x2f, 0x68, 0x6f, 0x73, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( file_api_proto_rawDescOnce sync.Once file_api_proto_rawDescData = file_api_proto_rawDesc ) func file_api_proto_rawDescGZIP() []byte { file_api_proto_rawDescOnce.Do(func() { file_api_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_proto_rawDescData) }) return file_api_proto_rawDescData } var file_api_proto_enumTypes = make([]protoimpl.EnumInfo, 1) var file_api_proto_msgTypes = make([]protoimpl.MessageInfo, 5) var file_api_proto_goTypes = []interface{}{ (Identifier_Type)(0), // 0: api.Identifier.Type (*GetSessionRequest)(nil), // 1: api.GetSessionRequest (*GetSessionResponse)(nil), // 2: api.GetSessionResponse (*AuthorizedKey)(nil), // 3: api.AuthorizedKey (*Client)(nil), // 4: api.Client (*Identifier)(nil), // 5: api.Identifier } var file_api_proto_depIdxs = []int32{ 4, // 0: api.GetSessionResponse.connected_clients:type_name -> api.Client 3, // 1: api.GetSessionResponse.authorized_keys:type_name -> api.AuthorizedKey 0, // 2: api.Identifier.type:type_name -> api.Identifier.Type 1, // 3: api.AdminService.GetSession:input_type -> api.GetSessionRequest 2, // 4: api.AdminService.GetSession:output_type -> api.GetSessionResponse 4, // [4:5] is the sub-list for method output_type 3, // [3:4] is the sub-list for method input_type 3, // [3:3] is the sub-list for extension type_name 3, // [3:3] is the sub-list for extension extendee 0, // [0:3] is the sub-list for field type_name } func init() { file_api_proto_init() } func file_api_proto_init() { if File_api_proto != nil { return } if !protoimpl.UnsafeEnabled { file_api_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*GetSessionRequest); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } file_api_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*GetSessionResponse); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } file_api_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*AuthorizedKey); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } file_api_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*Client); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } file_api_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*Identifier); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } } type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: file_api_proto_rawDesc, NumEnums: 1, NumMessages: 5, NumExtensions: 0, NumServices: 1, }, GoTypes: file_api_proto_goTypes, DependencyIndexes: file_api_proto_depIdxs, EnumInfos: file_api_proto_enumTypes, MessageInfos: file_api_proto_msgTypes, }.Build() File_api_proto = out.File file_api_proto_rawDesc = nil file_api_proto_goTypes = nil file_api_proto_depIdxs = nil } upterm-0.17.0/host/api/api.proto000066400000000000000000000015571507434540500165160ustar00rootroot00000000000000syntax = "proto3"; package api; option go_package = "github.com/owenthereal/upterm/host/api"; service AdminService { rpc GetSession(GetSessionRequest) returns (GetSessionResponse) {} } message GetSessionRequest {} message GetSessionResponse { string session_id = 1; repeated string command = 2; repeated string force_command = 3; string host = 4; string node_addr = 5; repeated Client connected_clients = 6; repeated AuthorizedKey authorized_keys = 7; string ssh_user = 8; // SSH username for client connections } message AuthorizedKey { repeated string public_key_fingerprints = 1; string comment = 2; } message Client { string id = 1; string version = 2; string addr = 3; string public_key_fingerprint = 4; } message Identifier { string id = 1; Type type = 2; string node_addr = 3; enum Type { HOST = 0; CLIENT = 1; } } upterm-0.17.0/host/api/api_grpc.pb.go000066400000000000000000000070221507434540500173640ustar00rootroot00000000000000// Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: // - protoc-gen-go-grpc v1.2.0 // - protoc v3.21.6 // source: api.proto package api import ( context "context" grpc "google.golang.org/grpc" codes "google.golang.org/grpc/codes" status "google.golang.org/grpc/status" ) // This is a compile-time assertion to ensure that this generated file // is compatible with the grpc package it is being compiled against. // Requires gRPC-Go v1.32.0 or later. const _ = grpc.SupportPackageIsVersion7 // AdminServiceClient is the client API for AdminService service. // // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. type AdminServiceClient interface { GetSession(ctx context.Context, in *GetSessionRequest, opts ...grpc.CallOption) (*GetSessionResponse, error) } type adminServiceClient struct { cc grpc.ClientConnInterface } func NewAdminServiceClient(cc grpc.ClientConnInterface) AdminServiceClient { return &adminServiceClient{cc} } func (c *adminServiceClient) GetSession(ctx context.Context, in *GetSessionRequest, opts ...grpc.CallOption) (*GetSessionResponse, error) { out := new(GetSessionResponse) err := c.cc.Invoke(ctx, "/api.AdminService/GetSession", in, out, opts...) if err != nil { return nil, err } return out, nil } // AdminServiceServer is the server API for AdminService service. // All implementations should embed UnimplementedAdminServiceServer // for forward compatibility type AdminServiceServer interface { GetSession(context.Context, *GetSessionRequest) (*GetSessionResponse, error) } // UnimplementedAdminServiceServer should be embedded to have forward compatible implementations. type UnimplementedAdminServiceServer struct { } func (UnimplementedAdminServiceServer) GetSession(context.Context, *GetSessionRequest) (*GetSessionResponse, error) { return nil, status.Errorf(codes.Unimplemented, "method GetSession not implemented") } // UnsafeAdminServiceServer may be embedded to opt out of forward compatibility for this service. // Use of this interface is not recommended, as added methods to AdminServiceServer will // result in compilation errors. type UnsafeAdminServiceServer interface { mustEmbedUnimplementedAdminServiceServer() } func RegisterAdminServiceServer(s grpc.ServiceRegistrar, srv AdminServiceServer) { s.RegisterService(&AdminService_ServiceDesc, srv) } func _AdminService_GetSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { in := new(GetSessionRequest) if err := dec(in); err != nil { return nil, err } if interceptor == nil { return srv.(AdminServiceServer).GetSession(ctx, in) } info := &grpc.UnaryServerInfo{ Server: srv, FullMethod: "/api.AdminService/GetSession", } handler := func(ctx context.Context, req interface{}) (interface{}, error) { return srv.(AdminServiceServer).GetSession(ctx, req.(*GetSessionRequest)) } return interceptor(ctx, in, info, handler) } // AdminService_ServiceDesc is the grpc.ServiceDesc for AdminService service. // It's only intended for direct use with grpc.RegisterService, // and not to be introspected or modified (even as a copy) var AdminService_ServiceDesc = grpc.ServiceDesc{ ServiceName: "api.AdminService", HandlerType: (*AdminServiceServer)(nil), Methods: []grpc.MethodDesc{ { MethodName: "GetSession", Handler: _AdminService_GetSession_Handler, }, }, Streams: []grpc.StreamDesc{}, Metadata: "api.proto", } upterm-0.17.0/host/authorizedkeys.go000066400000000000000000000073321507434540500175050ustar00rootroot00000000000000package host import ( "fmt" "io" "net/http" "net/url" "os" "strings" "time" "log/slog" "github.com/cli/go-gh/v2/pkg/api" "golang.org/x/crypto/ssh" ) const ( codebergKeysUrlFmt = "https://codeberg.org/%s" gitHubKeysUrlFmt = "https://github.com/%s" gitLabKeysUrlFmt = "https://gitlab.com/%s" sourceHutKeysUrlFmt = "https://meta.sr.ht/~%s" ) type AuthorizedKey struct { PublicKeys []ssh.PublicKey Comment string } func AuthorizedKeysFromFile(file string) (*AuthorizedKey, error) { authorizedKeysBytes, err := os.ReadFile(file) if err != nil { return nil, nil } return parseAuthorizedKeys(authorizedKeysBytes, file) } func CodebergUserAuthorizedKeys(usernames []string) ([]*AuthorizedKey, error) { return usersPublicKeys(codebergKeysUrlFmt, usernames) } func GitHubUserAuthorizedKeys(usernames []string, logger *slog.Logger) ([]*AuthorizedKey, error) { var ( authorizedKeys []*AuthorizedKey seen = make(map[string]bool) ) for _, username := range usernames { if _, found := seen[username]; !found { seen[username] = true pks, err := githubUserPublicKeys(username, logger) if err != nil { return nil, err } aks, err := parseAuthorizedKeys(pks, username) if err != nil { return nil, err } authorizedKeys = append(authorizedKeys, aks) } } return authorizedKeys, nil } func GitLabUserAuthorizedKeys(usernames []string) ([]*AuthorizedKey, error) { return usersPublicKeys(gitLabKeysUrlFmt, usernames) } func SourceHutUserAuthorizedKeys(usernames []string) ([]*AuthorizedKey, error) { return usersPublicKeys(sourceHutKeysUrlFmt, usernames) } func parseAuthorizedKeys(keysBytes []byte, comment string) (*AuthorizedKey, error) { var authorizedKeys []ssh.PublicKey for len(keysBytes) > 0 { pubKey, _, _, rest, err := ssh.ParseAuthorizedKey(keysBytes) if err != nil { return nil, err } authorizedKeys = append(authorizedKeys, pubKey) keysBytes = rest } return &AuthorizedKey{ PublicKeys: authorizedKeys, Comment: comment, }, nil } func githubUserPublicKeys(username string, logger *slog.Logger) ([]byte, error) { client, err := api.DefaultRESTClient() if err != nil { if strings.Contains(err.Error(), "authentication token not found for host") { // fallback to use the public GH API logger.Warn("no GitHub token found, falling back to public API", "error", err) return userPublicKeys(gitHubKeysUrlFmt, username) } return nil, err } keys := []struct { Key string `json:"key"` }{} if err := client.Get(fmt.Sprintf("users/%s/keys", url.PathEscape(username)), &keys); err != nil { return nil, err } var authorizedKeys []string for _, key := range keys { authorizedKeys = append(authorizedKeys, key.Key) } return []byte(strings.Join(authorizedKeys, "\n")), nil } func usersPublicKeys(urlFmt string, usernames []string) ([]*AuthorizedKey, error) { var ( authorizedKeys []*AuthorizedKey seen = make(map[string]bool) ) for _, username := range usernames { if _, found := seen[username]; !found { seen[username] = true keyBytes, err := userPublicKeys(urlFmt, username) if err != nil { return nil, fmt.Errorf("[%s]: %s", username, err) } userKeys, err := parseAuthorizedKeys(keyBytes, username) if err != nil { return nil, fmt.Errorf("[%s]: %s", username, err) } authorizedKeys = append(authorizedKeys, userKeys) } } return authorizedKeys, nil } func userPublicKeys(urlFmt string, username string) ([]byte, error) { path := url.PathEscape(fmt.Sprintf("%s.keys", username)) client := http.Client{ Timeout: 5 * time.Second, } resp, err := client.Get(fmt.Sprintf(urlFmt, path)) if err != nil { return nil, err } defer func() { _ = resp.Body.Close() }() return io.ReadAll(resp.Body) } upterm-0.17.0/host/host.go000066400000000000000000000251051507434540500154060ustar00rootroot00000000000000package host import ( "bufio" "context" "fmt" "io" "net" "net/url" "os" "path/filepath" "strings" "time" "log/slog" "github.com/oklog/run" "github.com/olebedev/emitter" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/host/internal" "github.com/owenthereal/upterm/internal/version" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/utils" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/knownhosts" ) func NewPromptingHostKeyCallback(stdin io.Reader, stdout io.Writer, knownHostsFilename string) (ssh.HostKeyCallback, error) { if err := createFileIfNotExist(knownHostsFilename); err != nil { return nil, err } cb, err := knownhosts.New(knownHostsFilename) if err != nil { return nil, err } hkcb := hostKeyCallback{ stdin: stdin, stdout: stdout, file: knownHostsFilename, HostKeyCallback: cb, } return hkcb.checkHostKey, nil } const ( markerCert = "@cert-authority" errKeyMismatch = ` @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the %s key sent by the remote host is %s. Please contact your system administrator. Add correct host key in %s to get rid of this message. Offending %s key in %s:%d` errNoAuthoritiesHostname = "ssh: no authorities for hostname" ) type hostKeyCallback struct { stdin io.Reader stdout io.Writer file string ssh.HostKeyCallback } func (cb hostKeyCallback) checkHostKey(hostname string, remote net.Addr, key ssh.PublicKey) error { if err := cb.HostKeyCallback(hostname, remote, key); err != nil { kerr, ok := err.(*knownhosts.KeyError) // Return err if it's neither key error or no authorities hostname error if !ok && !strings.HasPrefix(err.Error(), errNoAuthoritiesHostname) { return err } // If keer.Want is non-empty, there was a mismatch, which can signify a MITM attack if kerr != nil && len(kerr.Want) != 0 { kk := kerr.Want[0] // TODO: take care of multiple key mismatches fp := utils.FingerprintSHA256(kk.Key) kt := keyType(kk.Key.Type()) return fmt.Errorf(errKeyMismatch, kt, fp, kk.Filename, kt, kk.Filename, kk.Line) } return cb.promptForConfirmation(hostname, remote, key) } return nil } func (cb hostKeyCallback) promptForConfirmation(hostname string, remote net.Addr, key ssh.PublicKey) error { cert, isCert := key.(*ssh.Certificate) if isCert { key = cert.SignatureKey } fp := utils.FingerprintSHA256(key) _, _ = fmt.Fprintf(cb.stdout, "The authenticity of host '%s (%s)' can't be established.\n", knownhosts.Normalize(hostname), knownhosts.Normalize(remote.String())) _, _ = fmt.Fprintf(cb.stdout, "%s key fingerprint is %s.\n", keyType(key.Type()), fp) _, _ = fmt.Fprintf(cb.stdout, "Are you sure you want to continue connecting (yes/no/[fingerprint])? ") reader := bufio.NewReader(cb.stdin) for { confirm, err := reader.ReadString('\n') if err != nil { return err } confirm = strings.TrimSpace(confirm) if confirm == "yes" || confirm == fp { return cb.appendHostLine(isCert, hostname, key) } if confirm == "no" { return fmt.Errorf("Host key verification failed") } _, _ = fmt.Fprintf(cb.stdout, "Please type 'yes', 'no' or the fingerprint: ") } } func (cb hostKeyCallback) appendHostLine(isCert bool, hostname string, key ssh.PublicKey) error { f, err := os.OpenFile(cb.file, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) if err != nil { return err } defer func() { _ = f.Close() }() // Only store the hostname, not the IP address. // This prevents breakage when server IPs change due to: // - Load balancers and auto-scaling // - Cloud redeployments // - CDN/proxy rotation // - IPv6 address rotation // The security benefit of storing IPs is minimal in modern infrastructure // since we already trust DNS, and MITM attacks would need to compromise // both DNS and the host key. addr := []string{hostname} line := knownhosts.Line(addr, key) if isCert { line = fmt.Sprintf("%s %s", markerCert, line) } if _, err := f.WriteString(line + "\n"); err != nil { return err } return nil } type Host struct { Host string KeepAliveDuration time.Duration Command []string ForceCommand []string Signers []ssh.Signer HostKeyCallback ssh.HostKeyCallback AuthorizedKeys []*AuthorizedKey AdminSocketFile string SessionCreatedCallback func(*api.GetSessionResponse) error ClientJoinedCallback func(*api.Client) ClientLeftCallback func(*api.Client) Logger *slog.Logger Stdin *os.File Stdout *os.File ReadOnly bool } func (c *Host) Run(ctx context.Context) error { u, err := url.Parse(c.Host) if err != nil { return fmt.Errorf("error parsing host url: %s", err) } if c.Stdin == nil { c.Stdin = os.Stdin } if c.Stdout == nil { c.Stdout = os.Stdout } var aks []ssh.PublicKey for _, ak := range c.AuthorizedKeys { aks = append(aks, ak.PublicKeys...) } logger := c.Logger.With("server", u.String()) logger.Info("Establishing reverse tunnel") rt := internal.ReverseTunnel{ Host: u, Signers: c.Signers, HostKeyCallback: c.HostKeyCallback, AuthorizedKeys: aks, KeepAliveDuration: c.KeepAliveDuration, Logger: logger.With("component", "reverse-tunnel"), } sessResp, err := rt.Establish(ctx) if err != nil { return err } defer rt.Close() // Check server version compatibility after establishing connection serverVersion := string(rt.ServerVersion()) logger.Debug("detected server version", "server_version", serverVersion) // Check for version compatibility if result := version.CheckCompatibility(serverVersion); !result.Compatible { displayVersionWarning(c.Stdout, logger, result) } if c.AdminSocketFile == "" { dir, err := utils.CreateUptermDir() if err != nil { return err } c.AdminSocketFile = filepath.Join(dir, AdminSocketFile(sessResp.SessionID)) defer func() { _ = os.Remove(c.AdminSocketFile) }() } logger = logger.With("session", sessResp.SessionID) logger.Info("Established reverse tunnel") session := &api.GetSessionResponse{ SessionId: sessResp.SessionID, Host: u.String(), NodeAddr: sessResp.NodeAddr, SshUser: sessResp.SshUser, Command: c.Command, ForceCommand: c.ForceCommand, AuthorizedKeys: toApiAuthorizedKeys(c.AuthorizedKeys), } if c.SessionCreatedCallback != nil { if err := c.SessionCreatedCallback(session); err != nil { return err } } clientRepo := internal.NewClientRepo() eventEmitter := emitter.New(1) logger = logger.With("cmd", c.Command, "force_cmd", c.ForceCommand) var g run.Group { ctx, cancel := context.WithCancel(ctx) s := internal.AdminServer{ Session: session, ClientRepo: clientRepo, } g.Add(func() error { return s.Serve(ctx, c.AdminSocketFile) }, func(err error) { _ = s.Shutdown(ctx) cancel() }) } { g.Add(func() error { for evt := range eventEmitter.On(upterm.EventClientJoined) { args := evt.Args if len(args) == 0 { continue } client, ok := args[0].(*api.Client) if ok { _ = clientRepo.Add(client) logger.Info("Client joined", "client", client.Addr) if c.ClientJoinedCallback != nil { c.ClientJoinedCallback(client) } } } return nil }, func(err error) { eventEmitter.Off(upterm.EventClientJoined) }) } { g.Add(func() error { for evt := range eventEmitter.On(upterm.EventClientLeft) { args := evt.Args if len(args) == 0 { continue } cid, ok := args[0].(string) if ok { client := clientRepo.Get(cid) if client != nil { logger.Info("Client left", "client", client.Addr) clientRepo.Delete(cid) if c.ClientLeftCallback != nil { c.ClientLeftCallback(client) } } } } return nil }, func(err error) { eventEmitter.Off(upterm.EventClientLeft) }) } { logger.Info("Starting sshd server") defer logger.Info("Finishing sshd server") ctx, cancel := context.WithCancel(ctx) sshServer := internal.Server{ Command: c.Command, CommandEnv: []string{fmt.Sprintf("%s=%s", upterm.HostAdminSocketEnvVar, c.AdminSocketFile)}, ForceCommand: c.ForceCommand, Signers: c.Signers, AuthorizedKeys: aks, EventEmitter: eventEmitter, KeepAliveDuration: c.KeepAliveDuration, Stdin: c.Stdin, Stdout: c.Stdout, Logger: logger.With("component", "server"), ReadOnly: c.ReadOnly, } g.Add(func() error { return sshServer.ServeWithContext(ctx, rt.Listener()) }, func(err error) { cancel() }) } return g.Run() } func keyType(t string) string { return strings.ToUpper(strings.TrimPrefix(t, "ssh-")) } func createFileIfNotExist(file string) error { _, err := os.Stat(file) if os.IsNotExist(err) { dir := filepath.Dir(file) if err := os.MkdirAll(dir, 0700); err != nil { return err } file, err := os.Create(file) if err != nil { return err } defer func() { _ = file.Close() }() } return nil } func toApiAuthorizedKeys(aks []*AuthorizedKey) []*api.AuthorizedKey { var apiAks []*api.AuthorizedKey for _, ak := range aks { var fps []string for _, pk := range ak.PublicKeys { fps = append(fps, utils.FingerprintSHA256(pk)) } apiAks = append(apiAks, &api.AuthorizedKey{ PublicKeyFingerprints: fps, Comment: ak.Comment, }) } return apiAks } // displayVersionWarning prints a formatted version mismatch warning to the given writer func displayVersionWarning(out io.Writer, logger *slog.Logger, result *version.CompatibilityResult) { messages := []struct { text string debugMsg string }{ {"[WARNING] VERSION MISMATCH DETECTED\n", "failed to display version warning header"}, {result.Message + "\n", "failed to display version warning message"}, {fmt.Sprintf("Host version: %s\n", result.HostVersion), "failed to display host version"}, {fmt.Sprintf("Server version: %s\n", result.ServerVersion), "failed to display server version"}, {"\nThis may cause compatibility issues. Consider updating to matching versions.\n\n", "failed to display version warning footer"}, } for _, msg := range messages { if _, err := fmt.Fprint(out, msg.text); err != nil { logger.Debug(msg.debugMsg, "error", err) } } } upterm-0.17.0/host/host_test.go000066400000000000000000000122011507434540500164360ustar00rootroot00000000000000package host import ( "bytes" "net" "os" "path/filepath" "strings" "testing" "github.com/owenthereal/upterm/utils" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "golang.org/x/crypto/ssh" ) const ( testPublicKey = `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0EWrjdcHcuMfI8bGAyHPcGsAc/vd/gl5673pRkRBGY` ) func Test_hostKeyCallbackKnowHostsFileNotExist(t *testing.T) { dir := t.TempDir() knownHostsFile := filepath.Join(dir, "known_hosts") stdin := bytes.NewBufferString("yes\n") // Simulate typing "yes" in stdin stdout := bytes.NewBuffer(nil) pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(testPublicKey)) if err != nil { t.Fatal(err) } fp := utils.FingerprintSHA256(pk) cb, err := NewPromptingHostKeyCallback(stdin, stdout, knownHostsFile) if err != nil { t.Fatal(err) } addr := &net.TCPAddr{ IP: net.IPv4(127, 0, 0, 1), Port: 22, } if err := cb("127.0.0.1:22", addr, pk); err != nil { t.Fatal(err) } if !strings.Contains(stdout.String(), "ED25519 key fingerprint is "+fp) { t.Fatalf("stdout should contain fingerprint %s: %s", fp, stdout) } } func Test_hostKeyCallback(t *testing.T) { tempfile := filepath.Join(t.TempDir(), "known_hosts") err := os.WriteFile(tempfile, []byte("[127.0.0.1]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKpVcpc3t5GZHQFlbSLyj6sQY4wWLjNZsLTkfo9Cdjit\n"), 0600) require.NoError(t, err) stdin := bytes.NewBufferString("yes\n") // Simulate typing "yes" in stdin stdout := bytes.NewBuffer(nil) pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(testPublicKey)) require.NoError(t, err) fp := utils.FingerprintSHA256(pk) cb, err := NewPromptingHostKeyCallback(stdin, stdout, tempfile) require.NoError(t, err) // 127.0.0.1:22 is not in known_hosts addr := &net.TCPAddr{ IP: net.IPv4(127, 0, 0, 1), Port: 22, } err = cb("127.0.0.1:22", addr, pk) require.NoError(t, err) assert.Contains(t, stdout.String(), "ED25519 key fingerprint is "+fp) // 127.0.0.1:23 is in known_hosts addr = &net.TCPAddr{ IP: net.IPv4(127, 0, 0, 1), Port: 23, } err = cb("127.0.0.1:23", addr, pk) assert.Error(t, err, "key mismatched error is expected") assert.Contains(t, err.Error(), "Offending ED25519 key in "+tempfile) } func Test_hostKeyCallbackIPv6WithPort(t *testing.T) { tempfile := filepath.Join(t.TempDir(), "known_hosts") stdin := bytes.NewBufferString("yes\n") stdout := bytes.NewBuffer(nil) pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(testPublicKey)) require.NoError(t, err) cb, err := NewPromptingHostKeyCallback(stdin, stdout, tempfile) require.NoError(t, err) // Test IPv6 address with port - even though remote is IPv6, // only hostname should be stored for operational flexibility addr := &net.TCPAddr{ IP: net.ParseIP("2a09:8280:1::3:4b89"), Port: 443, } hostname := "uptermd.upterm.dev:443" err = cb(hostname, addr, pk) require.NoError(t, err) // Read the known_hosts file and verify the entry is properly formatted content, err := os.ReadFile(tempfile) require.NoError(t, err) contentStr := string(content) // Should contain the hostname with port assert.Contains(t, contentStr, "[uptermd.upterm.dev]:443", "known_hosts should contain hostname with port") // Should NOT contain the IP address - only hostname for operational flexibility // This prevents breakage when IPs change due to load balancers, redeployments, etc. assert.NotContains(t, contentStr, "2a09:8280:1::3:4b89", "known_hosts should NOT contain IP address to avoid breakage on IP changes") } func Test_hostKeyCallbackIPv6WithCertAuthority(t *testing.T) { tempfile := filepath.Join(t.TempDir(), "known_hosts") stdin := bytes.NewBufferString("yes\n") stdout := bytes.NewBuffer(nil) pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(testPublicKey)) require.NoError(t, err) // Create a certificate cert := &ssh.Certificate{ Key: pk, CertType: ssh.HostCert, SignatureKey: pk, } cb, err := NewPromptingHostKeyCallback(stdin, stdout, tempfile) require.NoError(t, err) // Test IPv6 address with certificate authority addr := &net.TCPAddr{ IP: net.ParseIP("2a09:8280:1::3:4b89"), Port: 443, } hostname := "uptermd.upterm.dev:443" err = cb(hostname, addr, cert) require.NoError(t, err) // Read the known_hosts file and verify the entry is properly formatted content, err := os.ReadFile(tempfile) require.NoError(t, err) contentStr := string(content) // Should contain @cert-authority marker assert.Contains(t, contentStr, "@cert-authority", "known_hosts should contain @cert-authority marker") // Should contain the hostname with port assert.Contains(t, contentStr, "[uptermd.upterm.dev]:443", "known_hosts should contain hostname with port") // Should NOT include the IP address for operational flexibility assert.NotContains(t, contentStr, "2a09:8280:1::3:4b89", "known_hosts should NOT contain IP address to avoid breakage on IP changes") // Expected format: @cert-authority [hostname]:port ssh-ed25519 key // NOT: @cert-authority [hostname]:port,[ip]:port ssh-ed25519 key assert.Contains(t, contentStr, "@cert-authority [uptermd.upterm.dev]:443 ssh-ed25519", "known_hosts should have correct cert-authority format with only hostname") } upterm-0.17.0/host/internal/000077500000000000000000000000001507434540500157135ustar00rootroot00000000000000upterm-0.17.0/host/internal/adminserver.go000066400000000000000000000024561507434540500205700ustar00rootroot00000000000000package internal import ( "context" "net" "sync" "github.com/owenthereal/upterm/host/api" "google.golang.org/grpc" ) type AdminServer struct { Session *api.GetSessionResponse ClientRepo *ClientRepo srv *grpc.Server sync.Mutex } func (s *AdminServer) Serve(ctx context.Context, sock string) error { ln, err := net.Listen("unix", sock) if err != nil { return err } s.Lock() s.srv = grpc.NewServer() api.RegisterAdminServiceServer(s.srv, &adminServiceServer{ Session: s.Session, ClientRepo: s.ClientRepo, }) s.Unlock() return s.srv.Serve(ln) } func (s *AdminServer) Shutdown(ctx context.Context) error { s.Lock() defer s.Unlock() if s.srv != nil { s.srv.GracefulStop() } return nil } type adminServiceServer struct { Session *api.GetSessionResponse ClientRepo *ClientRepo } func (s *adminServiceServer) GetSession(ctx context.Context, in *api.GetSessionRequest) (*api.GetSessionResponse, error) { return &api.GetSessionResponse{ SessionId: s.Session.SessionId, Host: s.Session.Host, NodeAddr: s.Session.NodeAddr, SshUser: s.Session.SshUser, Command: s.Session.Command, ForceCommand: s.Session.ForceCommand, AuthorizedKeys: s.Session.AuthorizedKeys, ConnectedClients: s.ClientRepo.Clients(), }, nil } upterm-0.17.0/host/internal/client.go000066400000000000000000000015051507434540500175210ustar00rootroot00000000000000package internal import ( "fmt" "sync" "github.com/owenthereal/upterm/host/api" ) func NewClientRepo() *ClientRepo { return &ClientRepo{} } type ClientRepo struct { clients sync.Map } func (c *ClientRepo) Add(client *api.Client) error { _, loaded := c.clients.LoadOrStore(client.Id, client) if loaded { return fmt.Errorf("client already exists") } return nil } func (c *ClientRepo) Delete(clientId string) { c.clients.Delete(clientId) } func (c *ClientRepo) Get(clientId string) *api.Client { val, _ := c.clients.Load(clientId) if val != nil { return val.(*api.Client) } return nil } func (c *ClientRepo) Clients() []*api.Client { var clients []*api.Client c.clients.Range(func(key, value interface{}) bool { cc := value.(*api.Client) clients = append(clients, cc) return true }) return clients } upterm-0.17.0/host/internal/command.go000066400000000000000000000057641507434540500176740ustar00rootroot00000000000000package internal import ( "context" "fmt" "io" "os" "os/exec" "os/signal" "syscall" "github.com/oklog/run" "github.com/olebedev/emitter" uio "github.com/owenthereal/upterm/io" "golang.org/x/term" ) func newCommand( name string, args []string, env []string, stdin *os.File, stdout *os.File, eventEmitter *emitter.Emitter, writers *uio.MultiWriter, ) *command { return &command{ name: name, args: args, env: env, stdin: stdin, stdout: stdout, eventEmitter: eventEmitter, writers: writers, } } type command struct { name string args []string env []string cmd *exec.Cmd ptmx *pty stdin *os.File stdout *os.File writers *uio.MultiWriter eventEmitter *emitter.Emitter ctx context.Context } func (c *command) Start(ctx context.Context) (*pty, error) { c.ctx = ctx c.cmd = exec.CommandContext(ctx, c.name, c.args...) c.cmd.Env = append(c.env, os.Environ()...) var err error c.ptmx, err = startPty(c.cmd) if err != nil { return nil, fmt.Errorf("unable to start pty: %w", err) } return c.ptmx, nil } func (c *command) Run() error { // Set stdin in raw mode. isTty := term.IsTerminal(int(c.stdin.Fd())) if isTty { oldState, err := term.MakeRaw(int(c.stdin.Fd())) if err != nil { return fmt.Errorf("unable to set terminal to raw mode: %w", err) } defer func() { _ = term.Restore(int(c.stdin.Fd()), oldState) }() } var g run.Group if isTty { // pty ch := make(chan os.Signal, 1) signal.Notify(ch, syscall.SIGWINCH) ch <- syscall.SIGWINCH // Initial resize. ctx, cancel := context.WithCancel(c.ctx) tee := terminalEventEmitter{c.eventEmitter} g.Add(func() error { for { select { case <-ctx.Done(): close(ch) return ctx.Err() case <-ch: h, w, err := getPtysize(c.stdin) if err != nil { return err } tee.TerminalWindowChanged("local", c.ptmx, w, h) } } }, func(err error) { tee.TerminalDetached("local", c.ptmx) cancel() }) } { // input ctx, cancel := context.WithCancel(c.ctx) g.Add(func() error { _, err := io.Copy(c.ptmx, uio.NewContextReader(ctx, c.stdin)) return err }, func(err error) { cancel() }) } { // output if err := c.writers.Append(c.stdout); err != nil { return err } ctx, cancel := context.WithCancel(c.ctx) g.Add(func() error { _, err := io.Copy(c.writers, uio.NewContextReader(ctx, c.ptmx)) return ptyError(err) }, func(err error) { c.writers.Remove(os.Stdout) cancel() }) } { ctx, cancel := context.WithCancel(c.ctx) g.Add(func() error { done := make(chan error, 1) go func() { done <- c.cmd.Wait() }() select { case err := <-done: return err case <-ctx.Done(): // Context cancelled, kill the process and wait for it to exit if c.cmd.Process != nil { _ = c.cmd.Process.Kill() } <-done // Wait for the process to actually exit return ctx.Err() } }, func(err error) { _ = c.ptmx.Close() cancel() }) } return g.Run() } upterm-0.17.0/host/internal/event.go000066400000000000000000000061131507434540500173640ustar00rootroot00000000000000package internal import ( "context" "fmt" "io" "strings" "log/slog" "github.com/olebedev/emitter" "github.com/owenthereal/upterm/upterm" ) const ( errBadFileDescriptor = "bad file descriptor" ) type terminal struct { ID string Pty *pty Window window } type window struct { Width int Height int } type terminalEventEmitter struct { eventEmitter *emitter.Emitter } func (t terminalEventEmitter) TerminalWindowChanged(id string, pty *pty, w, h int) { tt := terminal{ ID: id, Pty: pty, Window: window{ Width: w, Height: h, }, } t.eventEmitter.Emit(upterm.EventTerminalWindowChanged, tt) } func (t terminalEventEmitter) TerminalDetached(id string, pty *pty) { tt := terminal{ ID: id, Pty: pty, } t.eventEmitter.Emit(upterm.EventTerminalDetached, tt) } type terminalEventHandler struct { eventEmitter *emitter.Emitter logger *slog.Logger } func (t terminalEventHandler) Handle(ctx context.Context) error { winCh := t.eventEmitter.On(upterm.EventTerminalWindowChanged, emitter.Sync, emitter.Skip) dtCh := t.eventEmitter.On(upterm.EventTerminalDetached, emitter.Sync, emitter.Skip) defer func() { t.eventEmitter.Off(upterm.EventTerminalWindowChanged, winCh) t.eventEmitter.Off(upterm.EventTerminalDetached, dtCh) }() m := make(map[io.ReadWriteCloser]map[string]terminal) for { select { case evt := <-winCh: if err := t.handleWindowChanged(evt, m); err != nil { t.logger.Error("error handling window changed", "error", err) } case evt := <-dtCh: if err := t.handleTerminalDetached(evt, m); err != nil { t.logger.Error("error handling terminal detached", "error", err) } case <-ctx.Done(): return ctx.Err() } } } func (t terminalEventHandler) handleWindowChanged(evt emitter.Event, m map[io.ReadWriteCloser]map[string]terminal) error { args := evt.Args if len(args) == 0 { return fmt.Errorf("expect terminal window change event to have at least one argument") } tt, ok := args[0].(terminal) if !ok { return fmt.Errorf("expect terminal window change event to receive a terminal") } pty := tt.Pty ts, ok := m[pty] if !ok { ts = make(map[string]terminal) m[pty] = ts } ts[tt.ID] = tt if err := resizeWindow(pty, ts); err != nil && !strings.Contains(err.Error(), errBadFileDescriptor) { return fmt.Errorf("error resizing window: %w", err) } return nil } func (t terminalEventHandler) handleTerminalDetached(evt emitter.Event, m map[io.ReadWriteCloser]map[string]terminal) error { args := evt.Args if len(args) == 0 { return fmt.Errorf("expect terminal window change event to have at least one argument") } tt, ok := args[0].(terminal) if !ok { return fmt.Errorf("expect terminal window change event to receive a terminal") } pty := tt.Pty ts, ok := m[pty] if ok { delete(ts, tt.ID) } if len(ts) == 0 { delete(m, pty) } return nil } func resizeWindow(ptmx *pty, ts map[string]terminal) error { var w, h int for _, t := range ts { if w == 0 || w > t.Window.Width { w = t.Window.Width } if h == 0 || h > t.Window.Height { h = t.Window.Height } } return ptmx.Setsize(h, w) } upterm-0.17.0/host/internal/pty.go000066400000000000000000000026431507434540500170630ustar00rootroot00000000000000package internal import ( "os" "os/exec" "sync" "syscall" ptylib "github.com/creack/pty" ) func startPty(c *exec.Cmd) (*pty, error) { f, err := ptylib.Start(c) if err != nil { return nil, err } return wrapPty(f), nil } // Linux kernel return EIO when attempting to read from a master pseudo // terminal which no longer has an open slave. So ignore error here. // See https://github.com/creack/pty/issues/21 func ptyError(err error) error { if pathErr, ok := err.(*os.PathError); !ok || pathErr.Err != syscall.EIO { return err } return nil } func getPtysize(f *os.File) (h, w int, err error) { return ptylib.Getsize(f) } func wrapPty(f *os.File) *pty { return &pty{File: f} } // Pty is a wrapper of the pty *os.File that provides a read/write mutex. // This is to prevent data race that might happen for reszing, reading and closing. // See ftests failure: // * https://travis-ci.org/owenthereal/upterm/jobs/632489866 // * https://travis-ci.org/owenthereal/upterm/jobs/632458125 type pty struct { *os.File sync.RWMutex } func (pty *pty) Setsize(h, w int) error { pty.RLock() defer pty.RUnlock() size := &ptylib.Winsize{ Rows: uint16(h), Cols: uint16(w), } return ptylib.Setsize(pty.File, size) } func (pty *pty) Read(p []byte) (n int, err error) { pty.RLock() defer pty.RUnlock() return pty.File.Read(p) } func (pty *pty) Close() error { pty.Lock() defer pty.Unlock() return pty.File.Close() } upterm-0.17.0/host/internal/reversetunnel.go000066400000000000000000000104101507434540500211370ustar00rootroot00000000000000package internal import ( "context" "fmt" "log/slog" "net" "net/url" "os/user" "strings" "time" "github.com/owenthereal/upterm/server" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/ws" "golang.org/x/crypto/ssh" "google.golang.org/protobuf/proto" ) const ( publickeyAuthError = "ssh: unable to authenticate, attempted methods [none]" ) type ReverseTunnel struct { *ssh.Client Host *url.URL Signers []ssh.Signer AuthorizedKeys []ssh.PublicKey KeepAliveDuration time.Duration HostKeyCallback ssh.HostKeyCallback Logger *slog.Logger ln net.Listener } func (c *ReverseTunnel) Close() { _ = c.ln.Close() _ = c.Client.Close() } func (c *ReverseTunnel) Listener() net.Listener { return c.ln } func (c *ReverseTunnel) Establish(ctx context.Context) (*server.CreateSessionResponse, error) { user, err := user.Current() if err != nil { return nil, err } baseLogger := c.Logger if baseLogger == nil { baseLogger = slog.Default() } var ( auths []ssh.AuthMethod publicKeys [][]byte authorizedKeys [][]byte ) for _, signer := range c.Signers { auths = append(auths, ssh.PublicKeys(signer)) publicKeys = append(publicKeys, ssh.MarshalAuthorizedKey(signer.PublicKey())) } for _, ak := range c.AuthorizedKeys { authorizedKeys = append(authorizedKeys, ssh.MarshalAuthorizedKey(ak)) } config := &ssh.ClientConfig{ User: user.Username, Auth: auths, ClientVersion: upterm.HostSSHClientVersion, // Enforce a restricted set of algorithms for security // TODO: make this configurable if necessary HostKeyAlgorithms: []string{ ssh.CertAlgoED25519v01, ssh.CertAlgoRSASHA512v01, ssh.CertAlgoRSASHA256v01, ssh.KeyAlgoED25519, ssh.KeyAlgoRSASHA512, ssh.KeyAlgoRSASHA256, }, HostKeyCallback: c.HostKeyCallback, } if isWSScheme(c.Host.Scheme) { u, _ := url.Parse(c.Host.String()) // clone u.User = url.UserPassword(user.Username, "") c.Client, err = ws.NewSSHClient(u, config, false) } else { c.Client, err = ssh.Dial("tcp", c.Host.Host, config) } if err != nil { return nil, sshDialError(c.Host.String(), err) } sessResp, err := c.createSession(user.Username, publicKeys, authorizedKeys) if err != nil { return nil, fmt.Errorf("error creating session: %w", err) } c.ln, err = c.Listen("unix", sessResp.SessionID) if err != nil { return nil, fmt.Errorf("unable to create reverse tunnel: %w", err) } // make sure connection is alive go keepAlive(ctx, c.KeepAliveDuration, func() { // TODO: ping with session ID _, _, err := c.SendRequest(upterm.OpenSSHKeepAliveRequestType, true, nil) if err != nil { baseLogger.Error("error pinging server", "error", err) } }) return sessResp, nil } func (c *ReverseTunnel) createSession(user string, hostPublicKeys [][]byte, clientAuthorizedKeys [][]byte) (*server.CreateSessionResponse, error) { req := &server.CreateSessionRequest{ HostUser: user, HostPublicKeys: hostPublicKeys, ClientAuthorizedKeys: clientAuthorizedKeys, } b, err := proto.Marshal(req) if err != nil { return nil, err } ok, body, err := c.SendRequest(upterm.ServerCreateSessionRequestType, true, b) if err != nil { return nil, fmt.Errorf("error initializing session: %w", err) } if !ok { return nil, fmt.Errorf("could not initialize session: %s", body) } var resp server.CreateSessionResponse if err := proto.Unmarshal(body, &resp); err != nil { return nil, fmt.Errorf("error unmarshaling created session: %w", err) } return &resp, nil } func keepAlive(ctx context.Context, d time.Duration, fn func()) { ticker := time.NewTicker(d) defer ticker.Stop() for { select { case <-ctx.Done(): return case <-ticker.C: fn() } } } func isWSScheme(scheme string) bool { return scheme == "ws" || scheme == "wss" } type PermissionDeniedError struct { host string err error } func (e *PermissionDeniedError) Error() string { return fmt.Sprintf("%s: Permission denied (publickey).", e.host) } func (e *PermissionDeniedError) Unwrap() error { return e.err } func sshDialError(host string, err error) error { if strings.Contains(err.Error(), publickeyAuthError) { return &PermissionDeniedError{ host: host, err: err, } } return fmt.Errorf("ssh dial error: %w", err) } upterm-0.17.0/host/internal/server.go000066400000000000000000000157201507434540500175550ustar00rootroot00000000000000package internal import ( "context" "fmt" "io" "log/slog" "net" "os" "os/exec" "time" gssh "github.com/charmbracelet/ssh" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/server" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/utils" "github.com/oklog/run" "github.com/olebedev/emitter" uio "github.com/owenthereal/upterm/io" "golang.org/x/crypto/ssh" ) type Server struct { Command []string CommandEnv []string ForceCommand []string Signers []ssh.Signer AuthorizedKeys []ssh.PublicKey EventEmitter *emitter.Emitter KeepAliveDuration time.Duration Stdin *os.File Stdout *os.File Logger *slog.Logger ReadOnly bool } func (s *Server) ServeWithContext(ctx context.Context, l net.Listener) error { writers := uio.NewMultiWriter(5) cmdCtx, cmdCancel := context.WithCancel(ctx) defer cmdCancel() cmd := newCommand( s.Command[0], s.Command[1:], s.CommandEnv, s.Stdin, s.Stdout, s.EventEmitter, writers, ) ptmx, err := cmd.Start(cmdCtx) if err != nil { return fmt.Errorf("error starting command: %w", err) } var g run.Group { ctx, cancel := context.WithCancel(ctx) teh := terminalEventHandler{ eventEmitter: s.EventEmitter, logger: s.Logger, } g.Add(func() error { return teh.Handle(ctx) }, func(err error) { cancel() }) } { g.Add(func() error { return cmd.Run() }, func(err error) { cmdCancel() }) } { ctx, cancel := context.WithCancel(ctx) sh := sessionHandler{ forceCommand: s.ForceCommand, ptmx: ptmx, eventEmmiter: s.EventEmitter, writers: writers, keepAliveDuration: s.KeepAliveDuration, ctx: ctx, logger: s.Logger, readonly: s.ReadOnly, } ph := publicKeyHandler{ AuthorizedKeys: s.AuthorizedKeys, EventEmmiter: s.EventEmitter, Logger: s.Logger, } var ss []gssh.Signer for _, signer := range s.Signers { ss = append(ss, signer) } server := gssh.Server{ HostSigners: ss, Handler: sh.HandleSession, Version: upterm.HostSSHServerVersion, PublicKeyHandler: ph.HandlePublicKey, ConnectionFailedCallback: func(conn net.Conn, err error) { s.Logger.Error("connection failed", "error", err) }, } g.Add(func() error { return server.Serve(l) }, func(err error) { // kill ssh sessionHandler cancel() // shut down ssh server _ = server.Shutdown(ctx) }) } return g.Run() } type publicKeyHandler struct { AuthorizedKeys []ssh.PublicKey EventEmmiter *emitter.Emitter Logger *slog.Logger } func (h *publicKeyHandler) HandlePublicKey(ctx gssh.Context, key gssh.PublicKey) bool { checker := server.UserCertChecker{} auth, pk, err := checker.Authenticate(ctx.User(), key) if err != nil { h.Logger.Error("error parsing auth request from cert", "error", err) return false } // TODO: sshproxy already rejects unauthorized keys // Does host still need to check them? if len(h.AuthorizedKeys) == 0 { emitClientJoinEvent(h.EventEmmiter, ctx.SessionID(), auth, pk) return true } for _, k := range h.AuthorizedKeys { if utils.KeysEqual(k, pk) { emitClientJoinEvent(h.EventEmmiter, ctx.SessionID(), auth, pk) return true } } h.Logger.Info("unauthorized public key") return false } type sessionHandler struct { forceCommand []string ptmx *pty eventEmmiter *emitter.Emitter writers *uio.MultiWriter keepAliveDuration time.Duration ctx context.Context logger *slog.Logger readonly bool } func (h *sessionHandler) HandleSession(sess gssh.Session) { sessionID := sess.Context().Value(gssh.ContextKeySessionID).(string) defer emitClientLeftEvent(h.eventEmmiter, sessionID) ptyReq, winCh, isPty := sess.Pty() if !isPty { _, _ = io.WriteString(sess, "PTY is required.\n") _ = sess.Exit(1) } var ( g run.Group err error ptmx = h.ptmx ) // simulate openssh keepalive { ctx, cancel := context.WithCancel(h.ctx) g.Add(func() error { ticker := time.NewTicker(h.keepAliveDuration) defer ticker.Stop() for { select { case <-ticker.C: if _, err := sess.SendRequest(upterm.OpenSSHKeepAliveRequestType, true, nil); err != nil { h.logger.Debug("error pinging client to keepalive", "error", err) } case <-ctx.Done(): return ctx.Err() } } }, func(err error) { cancel() }) } if len(h.forceCommand) > 0 { var cmd *exec.Cmd ctx, cancel := context.WithCancel(h.ctx) defer cancel() cmd, ptmx, err = startAttachCmd(ctx, h.forceCommand, ptyReq.Term) if err != nil { h.logger.Error("error starting force command", "error", err) _ = sess.Exit(1) return } { // reattach output g.Add(func() error { _, err := io.Copy(sess, uio.NewContextReader(ctx, ptmx)) return ptyError(err) }, func(err error) { cancel() _ = ptmx.Close() }) } { g.Add(func() error { return cmd.Wait() }, func(err error) { cancel() _ = ptmx.Close() }) } } else { // output if err := h.writers.Append(sess); err != nil { _ = sess.Exit(1) return } defer h.writers.Remove(sess) } { // pty ctx, cancel := context.WithCancel(h.ctx) tee := terminalEventEmitter{h.eventEmmiter} g.Add(func() error { for { select { case win := <-winCh: tee.TerminalWindowChanged(sessionID, ptmx, win.Width, win.Height) case <-ctx.Done(): return ctx.Err() } } }, func(err error) { tee.TerminalDetached(sessionID, ptmx) cancel() }) } // if a readonly session has been requested, don't connect stdin if h.readonly { // write to client to notify them that they have connected to a read-only session _, _ = io.WriteString(sess, "\r\n=== Attached to read-only session ===\r\n\r\n") } else { // input ctx, cancel := context.WithCancel(h.ctx) g.Add(func() error { _, err := io.Copy(ptmx, uio.NewContextReader(ctx, sess)) return err }, func(err error) { cancel() }) } if err := g.Run(); err != nil { if exitError, ok := err.(*exec.ExitError); ok { _ = sess.Exit(exitError.ExitCode()) } else { _ = sess.Exit(1) } } else { _ = sess.Exit(0) } } func emitClientJoinEvent(eventEmmiter *emitter.Emitter, sessionID string, auth *server.AuthRequest, pk ssh.PublicKey) { c := &api.Client{ Id: sessionID, Version: auth.ClientVersion, Addr: auth.RemoteAddr, PublicKeyFingerprint: utils.FingerprintSHA256(pk), } eventEmmiter.Emit(upterm.EventClientJoined, c) } func emitClientLeftEvent(eventEmmiter *emitter.Emitter, sessionID string) { eventEmmiter.Emit(upterm.EventClientLeft, sessionID) } func startAttachCmd(ctx context.Context, c []string, term string) (*exec.Cmd, *pty, error) { cmd := exec.CommandContext(ctx, c[0], c[1:]...) cmd.Env = append(os.Environ(), fmt.Sprintf("TERM=%s", term)) pty, err := startPty(cmd) return cmd, pty, err } upterm-0.17.0/host/signer.go000066400000000000000000000057521507434540500157260ustar00rootroot00000000000000package host import ( "bytes" "crypto/x509" "errors" "fmt" "net" "os" "strings" "syscall" "github.com/owenthereal/upterm/utils" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/agent" "golang.org/x/term" ) const ( errCannotDecodeEncryptedPrivateKeys = "cannot decode encrypted private keys" ) type errDescryptingPrivateKey struct { file string } func (e *errDescryptingPrivateKey) Error() string { return fmt.Sprintf("error decrypting private key %s", e.file) } // Signers return signers based on the following conditions: // If SSH agent is running and has keys, it returns signers from SSH agent, otherwise return signers from private keys; // If neither works, it generates a signer on the fly. func Signers(privateKeys []string) ([]ssh.Signer, func(), error) { var ( signers []ssh.Signer cleanup func() err error ) signers, cleanup, err = signersFromSSHAgent(os.Getenv("SSH_AUTH_SOCK")) if len(signers) == 0 || err != nil { signers, err = SignersFromFiles(privateKeys) } if err != nil { signers, err = utils.CreateSigners(nil) } return signers, cleanup, err } func SignersFromFiles(privateKeys []string) ([]ssh.Signer, error) { var signers []ssh.Signer for _, file := range privateKeys { s, err := signerFromFile(file, promptForPassphrase) if err == nil { signers = append(signers, s) } } return signers, nil } func signersFromSSHAgent(socket string) ([]ssh.Signer, func(), error) { cleanup := func() {} if socket == "" { return nil, cleanup, fmt.Errorf("SSH Agent is not running") } conn, err := net.Dial("unix", socket) if err != nil { return nil, cleanup, err } cleanup = func() { _ = conn.Close() } client := agent.NewClient(conn) signers, err := client.Signers() return signers, cleanup, err } func signerFromFile(file string, promptForPassphrase func(file string) ([]byte, error)) (ssh.Signer, error) { key, err := readPrivateKeyFromFile(file, promptForPassphrase) if err != nil { return nil, err } return ssh.NewSignerFromKey(key) } func readPrivateKeyFromFile(file string, promptForPassphrase func(file string) ([]byte, error)) (interface{}, error) { pb, err := os.ReadFile(file) if err != nil { return nil, err } key, err := ssh.ParseRawPrivateKey(pb) if err == nil { return key, err } var e *ssh.PassphraseMissingError if !errors.As(err, &e) && !strings.Contains(err.Error(), errCannotDecodeEncryptedPrivateKeys) { return nil, err } // simulate ssh client to retry 3 times for i := 0; i < 3; i++ { pass, err := promptForPassphrase(file) if err != nil { return nil, err } key, err := ssh.ParseRawPrivateKeyWithPassphrase(pb, bytes.TrimSpace(pass)) if err == nil { return key, nil } if !errors.Is(err, x509.IncorrectPasswordError) { return nil, err } } return nil, &errDescryptingPrivateKey{file} } func promptForPassphrase(file string) ([]byte, error) { defer fmt.Println("") // clear return fmt.Printf("Enter passphrase for key '%s': ", file) return term.ReadPassword(int(syscall.Stdin)) } upterm-0.17.0/host/signer_test.go000066400000000000000000000147211507434540500167610ustar00rootroot00000000000000package host import ( "os" "path/filepath" "strings" "testing" "github.com/google/go-cmp/cmp" ) const ( // Passphrase is "1234" rsaPrivateKey = `-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABBEESOQn3 hoU95qcZuP7CjjAAAAEAAAAAEAAAIXAAAAB3NzaC1yc2EAAAADAQABAAACAQCt//y3H4he Ri1+3bO+FsqKyGTw5YQnu6MChEaDJY2SJqFCHGEwBAWGsuaDZPb6P+V16I5u2H+MtKBWDb kVK9760DkAFimuQ4XTtIzPhyb+Jc95wvNW6pAYXoetVlZIbzNzMEykE41kOMq19SNS3snv E5mYzfd2B6AGw3T2SubfF6G0staxtEYwlsWP/N+YIR4yLz11bxwuuTee/eMldvKZfzQQXI uopANU2mnAmoOqsG0G+DKNuXw7F7zd7lxus8zBF3fszur7Sc9APbWab5phJXWzE81ME2Z0 Rro3/l/5mD3YqmS6+jyIqlvqR150Uf/2rKawVgzxZWvQhe1+gGIktavL85dO9VnxA/BASY M0caqFY/KwVpAs/mZ18SpjgPaEzm3H5eeTJRFMrwRusyunPTDv8lmAAXsr/ZMhd1gBkDiG E/YuTfekv8rMbkZNeB2HuXavcRTuCqY8y44ehe+sRug9nwykPnfRqjIeAm9zh+zknfJGl5 TONHKnEj5tudpUvTd38ZnOM+CTzMHbSDOwkSLAp9mCzrbWc6OIeVqsqibPmia4SxyP7wxn szfH1MOkuCmphiCzk4nicYDhMW6jjXhRKok4yNIU9wqj0MMEKS3RKblAzCu7VFVTDrLSJI zs7Ch0RIuGnVTQ5S4O156Kr9hL535k6c6/NUXbylXtuwAAB0BoB2MIcsYKGTdrHayerk4e O+5ACB6GxBYT0xEQ9959ioF+RgFaXiGDv9fYrJSjUp11uok0LWoLzGXD0w2/+LCMiOO75R DSmiPRdQbfMgm8p+etBF5QHg4tcVnMjYHCqFtPDwyyYRHwHmYi9qx+iZqBooEgyExmuahu oT/6Z5ntycBo9543oDVQVJOMYDNh/u9AC2Wke7j7LufhKNg/Rd3Gg1BWI9IwVCeU8A4Gqa Z9fnvrkTRcKFYF5fakxXKnfdHNQco3zxdXGEnbcY34PR/CD5R0J666zoJEeYp25jJd9Opb MBKss07yrZq90KIQEveVC6L7tCJpNmRXHN1iQpkq+WKSlX/lMxTanW7KFcKU6qFhFi2m4V eEGPlAU6tOpsYthkElBhxeBRzwW4lzCDfZErYbtNFGiT+xGxVIzkQIQdH++Y8waNHZ4mNv xX5a0/CxMkipUS0CDfZ8XEwHDkQDko1cdwq13PD+AGZvWIDP20EQ3MqrWqb/ho0QJbWLd7 W6QlwxVewUxfFlBdnpGFpin0RDXsQUZ2IxNuIzzpcAslILtBhQdfXkMAwomQWhs0qxiyEc W9jMyYv20J+oR+wc8xVZEBw7KfM52Zl9J90t0nBwghswiykx4BYzu9PwY52gdJOWkMZq1b cEPXBa7Y/nAPObXQp/hWwfhKdi5WjXiXCI//nMshRm1bLRqAmFVex9K6UpEY3Svl/fDBe3 fR21qPi7zEmbZXh9abrPibF6UGZxl54yzKdSS3J/9BletdagYo+WhcV460Dg2hjy2XrrpM tLcmUQegINRmr3mJ2nHHw5b6X61UJDto/AgEDlZuTh35YBnUwibi7dlbepRfJ8XgWhHxM+ 21Qg+nmD+I2u8a8d2gnuTiv7m4A/M/bA9E4YbaligZvw4w7Zd18cBzYgb43nNiV82tBFz9 hCd+9HlwNQnaJ9EL/tyFwJ1IkyQCF3YLTV3KaMUvHWDXYdNbktnrSgJazQgou7KNjN0nbm rtKAU1+iN/QgmBSOD3Rq6WnP2co4EqocEluBBb4eF6yOQ3jEd+icRkL/a0Wpc9NU7jMPll HfDIzaaGVGSFB13pYdIZNckgctpHGZnnB1jhLzaWzwjumBmt1g//wN3HeMxiQfFMrl78yP qJjceag13J+QdrSawLzf/ulXUALQKnpdPnvuwGlXnUbpXrqtP/J+qJwjpyuit8an5k7foI yK/1pPw0gz9j/KsebhXuZF7gxlZZCtkbdmCtrEVOqo/yIX02eGshFhO/h76QXvi1hz4SR2 H6oB1KapvJlqd+txTIDf/zhlPP7vHPXsMUcumclsg+iP/mpleo51TFpD456A0g905fnjJr OKBftowi9IhYZM8bPKis1K7NWfz3uE90Mc8jky0e6XzlxKi4rF9ZKMuvm9b/QA9v6HYUNJ kadcq5GaVjL8hlgtMnRYDyClYoPsqyyuFP+rjWfEUPWANKzFR5rku6l2e5nTxm756azYDs XDupgd4Oo5w7KONgkLJffF+X4ClLfWnrlIm2EWF1Tw0E7XleaccnggUNUMg+4uY12IG8zb 4CyDE4vFgeqY9+d3fxg/d33aOVyFB60hiqmYhni+Tf7z1yKRoqE44SiIEF+GDmnAaJuz91 EO9r1P5xpW22Fgp3MFaqZh2Jrp9g5Ai4UC9mxQvXK/Y+He582IMoXaXEpp7SuIDOuDSv0i uU2Pm47jiPRFFIOtv1Zf6tJMAkY2wlN4W2nl5GdQwWQ7CNzaTtfquX1ckQIV8wlpbZH9Wn myfnyc90/5ZQUlmX1nwg7UatSky1DxJfIMpePWqDNaeCJxKnMW/spO5PgEar/TKVzvYRh7 0FCP0+c44GzgMkvx3HuPQro4LEeHUbeWjtQCKj1Vh/e8BIoUV4iw7vWJCk2/GzDm7QhcRD 1rKbFgHs4aOg0gkCQOfHuE5jNJrBYO2PdmuQOT8v1um02yv1simYmmetLg+aW1t7akvbWM XztiGLpnwCRY3KemwNydG/5d/D+FvAovg8I7zAjLTIlnicL3P+MMt0O05e7mYYZXGKfb+S Md0uKlDJ+7DunkAH3P2NQe0AJVI6oX4oko20gx+3+XhL6SIsp3/Bo1KFG2utncUgnK1OMX ezOenHBL3QdMsZHEmvgX+GqttoFO/ILqzXeRcn7bC0Vc1TdceDDjsVeWDiNlx6kRHCyYCM YXxsw1NVcpHtL9gAhqa8cyuHFpUCFA98EE0QX3bqbYtDlidqqsVUdprxXi3GfnpdhdRueM SVF3wK7yXwu2554Rs/HuLf+rxOrHsF8ZfSWAxtdDqxwuFt5UFstr9HupRgt8ik8XodIVdb WDzQFezZ5FudCmO23iNsXuUxs/j8lAYAC4gmTxoFYhAEhulUCjv+dVRe9lP0W1uygohVho XBcvbGIDxNBoIlPFRM+bqvIDC1sQi3MIh3l/NZQxxIkW/+I4uClYpmNGXPZaNZNhpdv1PJ a9rQ== -----END OPENSSH PRIVATE KEY----- ` // nolint rsaPublicKey = `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCt//y3H4heRi1+3bO+FsqKyGTw5YQnu6MChEaDJY2SJqFCHGEwBAWGsuaDZPb6P+V16I5u2H+MtKBWDbkVK9760DkAFimuQ4XTtIzPhyb+Jc95wvNW6pAYXoetVlZIbzNzMEykE41kOMq19SNS3snvE5mYzfd2B6AGw3T2SubfF6G0staxtEYwlsWP/N+YIR4yLz11bxwuuTee/eMldvKZfzQQXIuopANU2mnAmoOqsG0G+DKNuXw7F7zd7lxus8zBF3fszur7Sc9APbWab5phJXWzE81ME2Z0Rro3/l/5mD3YqmS6+jyIqlvqR150Uf/2rKawVgzxZWvQhe1+gGIktavL85dO9VnxA/BASYM0caqFY/KwVpAs/mZ18SpjgPaEzm3H5eeTJRFMrwRusyunPTDv8lmAAXsr/ZMhd1gBkDiGE/YuTfekv8rMbkZNeB2HuXavcRTuCqY8y44ehe+sRug9nwykPnfRqjIeAm9zh+zknfJGl5TONHKnEj5tudpUvTd38ZnOM+CTzMHbSDOwkSLAp9mCzrbWc6OIeVqsqibPmia4SxyP7wxnszfH1MOkuCmphiCzk4nicYDhMW6jjXhRKok4yNIU9wqj0MMEKS3RKblAzCu7VFVTDrLSJIzs7Ch0RIuGnVTQ5S4O156Kr9hL535k6c6/NUXbylXtuw==` // Passphrase is "1234" ed25519PriavteKey = `-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCGNomvLJ kXLr+TqkGZ2fuiAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIA9dIfLyILssYzKI VY7UQenn2Il6cUeeYppVwDSAiqPzAAAAsAied6o/EzONSz0GmRvzUIUmK899O+N/ARFc9c sSq5R8Qu+iqFOtgNFnPI1/wu22agUYxs3h6Su4Jv6WbySJpJhHhIN/6pZ4DZgj4zWGGSJl 5Kt2/q0hzzuxmO6hTGUGLArVXbJEXxTPV/jo/1w8qBYyB1rdKal1dN0OzUlCP1568WR8wq CUI+b0Gxfqa/HSKlS23Iu7ZeWoMakwvcg5A5M8E/ihBLSDNsCJU8pgZ9FD -----END OPENSSH PRIVATE KEY----- ` // nolint ed25519PublicKey = `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA9dIfLyILssYzKIVY7UQenn2Il6cUeeYppVwDSAiqPz jou@oou-ltm.internal.salesforce.com` ) func Test_signerFromFile(t *testing.T) { cases := []struct { name string privateKey string passphrase string errMsg string }{ { name: "rsa private key wrong passphrase", privateKey: rsaPrivateKey, passphrase: "wrong passphrase", errMsg: "error decrypting private key", }, { name: "rsa private key correct passphrase", privateKey: rsaPrivateKey, passphrase: "1234", }, { name: "ed25519 private key wrong passphrase", privateKey: ed25519PriavteKey, passphrase: "wrong passphrase", errMsg: "error decrypting private key", }, { name: "ed25519 private key correct passphrase", privateKey: ed25519PriavteKey, passphrase: "1234", }, } for _, cc := range cases { c := cc t.Run(c.name, func(t *testing.T) { t.Parallel() dir := t.TempDir() tmpfn := filepath.Join(dir, "private_key") if err := os.WriteFile(tmpfn, []byte(c.privateKey), 0600); err != nil { t.Fatal(err) } _, err := signerFromFile(tmpfn, func(file string) ([]byte, error) { if want, got := tmpfn, file; want != got { t.Fatalf("file mismatched, want=%s got=%s:\n%s", want, got, cmp.Diff(want, got)) } return []byte(c.passphrase), nil }) if err == nil && c.errMsg != "" { t.Fatal("error shouldn't be nil") } if err != nil && c.errMsg == "" { t.Fatalf("error should be nil but it's %s", err.Error()) } if err != nil && !strings.Contains(err.Error(), c.errMsg) { t.Fatalf("unexpected error message, want=%q, got=%q", c.errMsg, err.Error()) } }) } } upterm-0.17.0/icon/000077500000000000000000000000001507434540500140525ustar00rootroot00000000000000upterm-0.17.0/icon/upterm.go000066400000000000000000000001151507434540500157120ustar00rootroot00000000000000package icon import ( _ "embed" ) //go:embed upterm.png var Upterm []byte upterm-0.17.0/icon/upterm.png000066400000000000000000000031141507434540500160730ustar00rootroot00000000000000‰PNG  IHDR szzôIDATxœ¼W[lT[þÖÞk—™NgZf˜¡¡µ(ñb@FLŒF_â%Ñè #†Ä˜ä ¤&>h‚Þ0¼hb|Ъ(>”œ89=CiP(C§÷ΞÙ3{]Nþµöž™r8prJùÓÕÙ³×åûÖÿÿ¿Öp´Ø‘c?àÉŽAÇåá¸Ìü­Ê´ù§¥(i%‡Eµ‹IØ\k %%„ ÌK²ÐL”¡WRH8 .*’Ãc ë˜x[­…FUº`.7D9Óf]Äë*LÂ6 FyZÈ$ñ­;Á†‹Wî`¬¸lžåñ—ööbÏ ˜x´€ßþg íËâ+ûÞ¡4¸ãØmk Ôpû~ÿ»9¹€¡§Â7öï28¿»|f}ĸ\“+”‚R°Íd:  ë0hI»³I)…D"/‘B{*„’.w‘L¥Mÿdiu!‘lãèÉåðÉ\ï+dqáŸ7!БÎØp°’ˆq¹–Ê,îHm>µV`Ì1ϦEQˆÇ™g'ídõPàÃ70³â;û7âèزyúK\nì˜B­b,©à R2jª)­›$”££h·Œ§± â°¸qg gM_ow’î猧èÙÖ ëvdðtЙݰÎK$Á¢É”Ÿä:R75šÔCã!Ïul®G®§wô•„øNÇ9]ñÜèŽIëÒ±QªXœ›©ÙĪŒ– ÿt)•R¢*í%…@(®qIÒi©Oî¾ÕHvfÅe߈+Û3°˜Ï»¬>ÿ2kÉkƒk@ÇŠ|™W¢Ss¥dI+µÅxI Ì‘lΚy`X)ùmªlŒÔ±6? šÆZ:¥†yX+•Ä×8÷RÜgêà…éMJ•²OØîØ«W‹øTÅåÞ‡¯1>¹^£^ ˆÀÉ¿]8óÚ2Þ¸ve¤ÿcûµŸq]Þ_0Ì‘]2Þs‹ÒMEÇ{Õ_ò«¾ò¯¿>ÕüqÛ¿÷ã„ç ºœdp š½U2­µÒª¤¤Âpèï¿9ÝøyþVÿÿJF‹bµ²-IEND®B`‚upterm-0.17.0/internal/000077500000000000000000000000001507434540500147365ustar00rootroot00000000000000upterm-0.17.0/internal/context/000077500000000000000000000000001507434540500164225ustar00rootroot00000000000000upterm-0.17.0/internal/context/logging.go000066400000000000000000000006611507434540500204020ustar00rootroot00000000000000package context import ( "context" "github.com/owenthereal/upterm/internal/logging" ) type contextKey string const loggerKey contextKey = "logger" func WithLogger(ctx context.Context, logger *logging.Logger) context.Context { return context.WithValue(ctx, loggerKey, logger) } func Logger(ctx context.Context) *logging.Logger { if logger, ok := ctx.Value(loggerKey).(*logging.Logger); ok { return logger } return nil } upterm-0.17.0/internal/logging/000077500000000000000000000000001507434540500163645ustar00rootroot00000000000000upterm-0.17.0/internal/logging/logging.go000066400000000000000000000075011507434540500203440ustar00rootroot00000000000000package logging import ( "context" "fmt" "io" "log/slog" "os" "path/filepath" "time" "github.com/getsentry/sentry-go" slogsentry "github.com/getsentry/sentry-go/slog" "github.com/owenthereal/upterm/internal/version" slogmulti "github.com/samber/slog-multi" ) const ( sentryFlushTimeout = 2 * time.Second ) // Logger wraps slog.Logger with cleanup capability and dynamic handlers type Logger struct { *slog.Logger cleanupFuncs []func() error } // Close cleans up resources func (l *Logger) Close() error { for _, cleanup := range l.cleanupFuncs { if err := cleanup(); err != nil { return err } } return nil } // With returns a new logger with additional attributes func (l *Logger) With(args ...any) *Logger { return &Logger{ Logger: l.Logger.With(args...), cleanupFuncs: l.cleanupFuncs, } } // WithGroup returns a new logger with a group func (l *Logger) WithGroup(name string) *Logger { return &Logger{ Logger: l.Logger.WithGroup(name), cleanupFuncs: l.cleanupFuncs, } } // Option configures a logger type Option func(*config) error type config struct { level slog.Level outputs []io.Writer handlers []slog.Handler cleanupFuncs []func() error } // New creates a logger with options (for upterm client) func New(opts ...Option) (*Logger, error) { cfg := &config{ level: slog.LevelInfo, } for _, opt := range opts { if err := opt(cfg); err != nil { return nil, err } } // Default to stderr if no outputs specified if len(cfg.outputs) == 0 { cfg.outputs = []io.Writer{os.Stderr} } // Always add JSON handler for normal logging cfg.handlers = append(cfg.handlers, slog.NewJSONHandler(io.MultiWriter(cfg.outputs...), &slog.HandlerOptions{Level: cfg.level})) return &Logger{ Logger: slog.New(slogmulti.Fanout(cfg.handlers...)), cleanupFuncs: cfg.cleanupFuncs, }, nil } // Must wraps NewWithOptions and panics on error func Must(opts ...Option) *Logger { logger, err := New(opts...) if err != nil { panic(err) } return logger } // Level sets the log level func Level(level slog.Level) Option { return func(c *config) error { c.level = level return nil } } // Debug sets debug level func Debug() Option { return Level(slog.LevelDebug) } // Console logs to stderr func Console() Option { return func(c *config) error { c.outputs = append(c.outputs, os.Stderr) return nil } } // File logs to a file (path is required) func File(path string) Option { return func(c *config) error { if path == "" { return fmt.Errorf("log file path is required") } if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil { return fmt.Errorf("failed to create log directory: %w", err) } file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644) if err != nil { return fmt.Errorf("failed to open log file %q: %w", path, err) } c.outputs = append(c.outputs, file) c.cleanupFuncs = append(c.cleanupFuncs, file.Close) return nil } } // Sentry enables Sentry error reporting func Sentry(dsn string) Option { return func(c *config) error { if dsn == "" { return nil } sentryHandler, cleanup, err := newSentryHandler(dsn) if err != nil { return err } c.handlers = append(c.handlers, sentryHandler) c.cleanupFuncs = append(c.cleanupFuncs, cleanup) return nil } } func newSentryHandler(dsn string) (slog.Handler, func() error, error) { err := sentry.Init(sentry.ClientOptions{ Dsn: dsn, Environment: "production", Release: version.Version, AttachStacktrace: true, }) if err != nil { return nil, nil, err } handler := slogsentry.Option{ Level: slog.LevelError, }.NewSentryHandler(context.Background()) cleanup := func() error { ok := sentry.Flush(sentryFlushTimeout) if !ok { return fmt.Errorf("sentry flush timeout") } return nil } return handler, cleanup, nil } upterm-0.17.0/internal/testhelpers/000077500000000000000000000000001507434540500173005ustar00rootroot00000000000000upterm-0.17.0/internal/testhelpers/consul.go000066400000000000000000000026601507434540500211360ustar00rootroot00000000000000package testhelpers import ( "context" "net/url" "os" "time" "github.com/hashicorp/consul/api" ) const ( // ConsulHealthCheckTimeout is the timeout for Consul health checks ConsulHealthCheckTimeout = 2 * time.Second ) // IsConsulAvailable checks if Consul is running and accessible with timeout handling func IsConsulAvailable() bool { config := api.DefaultConfig() consulURLStr := ConsulURL() u, err := url.Parse(consulURLStr) if err != nil { return false } config.Address = u.Host client, err := api.NewClient(config) if err != nil { return false } // Try to get leader with timeout - simple health check ctx, cancel := context.WithTimeout(context.Background(), ConsulHealthCheckTimeout) defer cancel() done := make(chan bool, 1) go func() { _, err = client.Status().Leader() done <- err == nil }() select { case result := <-done: return result case <-ctx.Done(): return false } } // ConsulURL returns the Consul URL from environment or default func ConsulURL() string { addr := os.Getenv("CONSUL_URL") if addr == "" { addr = "http://localhost:8500" } return addr } // ConsulClient creates a new Consul API client func ConsulClient() (*api.Client, error) { config := api.DefaultConfig() consulURL, err := url.Parse(ConsulURL()) if err != nil { return nil, err } config.Address = consulURL.Host client, err := api.NewClient(config) if err != nil { return nil, err } return client, nil } upterm-0.17.0/internal/version/000077500000000000000000000000001507434540500164235ustar00rootroot00000000000000upterm-0.17.0/internal/version/version.go000066400000000000000000000122201507434540500204340ustar00rootroot00000000000000// Package version provides version management and compatibility checking for upterm/uptermd. // // This package centralizes version handling across the upterm ecosystem, including: // - Single source of truth for version constants // - Semantic version parsing and comparison // - SSH server version extraction and validation // - Host/server compatibility checking with detailed results // // The main entry point is CheckCompatibility() which compares the current host version // with a server's SSH version string and returns detailed compatibility information. // // Example usage: // // result := version.CheckCompatibility("SSH-2.0-uptermd-0.14.3") // if !result.Compatible { // fmt.Printf("Warning: %s\n", result.Message) // fmt.Printf("Host: %s, Server: %s\n", result.HostVersion, result.ServerVersion) // } package version import ( "fmt" "regexp" "github.com/hashicorp/go-version" "github.com/owenthereal/upterm/upterm" ) // Version is the semantic version of upterm/uptermd // This is the single source of truth for both client and server versions // Can be overridden at build time with ldflags var Version = "0.0.0+dev" // Build-time variables set via ldflags var ( GitCommit string // Git commit SHA Date string // Build date ) // BuildInfo contains version and build information type BuildInfo struct { Version string `json:"version"` GitCommit string `json:"git_commit,omitempty"` BuildDate string `json:"build_date,omitempty"` } // Parse parses a version string using hashicorp's go-version library func Parse(v string) (*version.Version, error) { return version.NewVersion(v) } // ParseFromSSHVersion extracts version from SSH version strings like "SSH-2.0-uptermd-0.14.3" // Uses regex for precise parsing and supports complex semantic versions like "1.0.0-beta.1+build.123" func ParseFromSSHVersion(sshVersion string) (*version.Version, error) { // Build regex pattern using the constant to ensure consistency // Escape dots in the server version string for regex safety escapedServerVersion := regexp.QuoteMeta(upterm.ServerSSHServerVersion) pattern := fmt.Sprintf(`^%s-(.+)$`, escapedServerVersion) re := regexp.MustCompile(pattern) matches := re.FindStringSubmatch(sshVersion) if len(matches) != 2 { return nil, fmt.Errorf("not a valid uptermd SSH version: %s", sshVersion) } // Extract and parse the version string versionStr := matches[1] v, err := Parse(versionStr) if err != nil { return nil, fmt.Errorf("invalid version format in SSH string %s: %w", sshVersion, err) } return v, nil } // Current returns the current version as a parsed version object // Panics if Version constant is not a valid semantic version func Current() *version.Version { v, err := Parse(Version) if err != nil { panic(fmt.Sprintf("invalid version constant %q: %v", Version, err)) } return v } // String returns the current version as a string func String() string { return Version } // GetBuildInfo returns comprehensive build information func GetBuildInfo() BuildInfo { return BuildInfo{ Version: Version, GitCommit: GitCommit, BuildDate: Date, } } // PrintVersion prints version information with the given binary name func PrintVersion(binaryName string) { buildInfo := GetBuildInfo() fmt.Printf("%s version %s\n", binaryName, buildInfo.Version) if buildInfo.GitCommit != "" { fmt.Printf("Git commit: %s\n", buildInfo.GitCommit) } if buildInfo.BuildDate != "" { fmt.Printf("Build date: %s\n", buildInfo.BuildDate) } } // ServerSSHVersion returns the SSH server version string with embedded version func ServerSSHVersion() string { return fmt.Sprintf("%s-%s", upterm.ServerSSHServerVersion, Version) } // CompatibilityResult contains the result of version compatibility checking type CompatibilityResult struct { Compatible bool HostVersion string ServerVersion string Message string } // CheckCompatibility checks if the server version is compatible with the current host version // Always returns a result - Compatible=false for unparseable server versions to indicate incompatibility func CheckCompatibility(sshVersion string) *CompatibilityResult { hostVersion := Current() hostVersionStr := "v" + hostVersion.String() serverVersion, err := ParseFromSSHVersion(sshVersion) if err != nil { // Can't parse server version - could be older upterm server or non-upterm server return &CompatibilityResult{ Compatible: false, HostVersion: hostVersionStr, ServerVersion: "unknown", Message: "Unable to determine server version - possibly older upterm server or non-upterm server", } } serverVersionStr := "v" + serverVersion.String() // Check if major versions match (semantic versioning compatibility) hostMajor := hostVersion.Segments()[0] serverMajor := serverVersion.Segments()[0] if hostMajor != serverMajor { return &CompatibilityResult{ Compatible: false, HostVersion: hostVersionStr, ServerVersion: serverVersionStr, Message: fmt.Sprintf("Major version mismatch: host %s, server %s", hostVersionStr, serverVersionStr), } } return &CompatibilityResult{ Compatible: true, HostVersion: hostVersionStr, ServerVersion: serverVersionStr, Message: "", } } upterm-0.17.0/internal/version/version_test.go000066400000000000000000000105671507434540500215070ustar00rootroot00000000000000package version import ( "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestParseFromSSHVersion(t *testing.T) { tests := []struct { name string sshVersion string expectedVer string expectError bool }{ { name: "valid uptermd SSH version", sshVersion: "SSH-2.0-uptermd-0.14.3", expectedVer: "0.14.3", expectError: false, }, { name: "SSH version without numeric version", sshVersion: "SSH-2.0-openssh", expectedVer: "", expectError: true, }, { name: "malformed version", sshVersion: "SSH-2.0-uptermd-invalid", expectedVer: "", expectError: true, }, { name: "no version suffix", sshVersion: "SSH-2.0-uptermd", expectedVer: "", expectError: true, }, { name: "complex semantic version with prerelease", sshVersion: "SSH-2.0-uptermd-1.0.0-beta.1", expectedVer: "1.0.0-beta.1", expectError: false, }, { name: "complex semantic version with build metadata", sshVersion: "SSH-2.0-uptermd-1.0.0+build.123", expectedVer: "1.0.0+build.123", expectError: false, }, { name: "complex semantic version with both prerelease and build", sshVersion: "SSH-2.0-uptermd-2.0.0-rc.1+20220101", expectedVer: "2.0.0-rc.1+20220101", expectError: false, }, { name: "wrong server name - should fail", sshVersion: "SSH-2.0-upterm-server-0.14.3", expectedVer: "", expectError: true, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { version, err := ParseFromSSHVersion(tt.sshVersion) if tt.expectError { assert.Error(t, err) return } require.NoError(t, err) assert.Equal(t, tt.expectedVer, version.String()) }) } } func TestCheckCompatibility(t *testing.T) { tests := []struct { name string sshVersion string expectedComp bool expectedHost string expectedSvr string expectedMsg string }{ { name: "same versions", sshVersion: "SSH-2.0-uptermd-" + Version, expectedComp: true, expectedHost: "v" + Version, expectedSvr: "v" + Version, expectedMsg: "", }, { name: "same major, different minor", sshVersion: "SSH-2.0-uptermd-0.15.0", expectedComp: true, expectedHost: "v" + Version, expectedSvr: "v0.15.0", expectedMsg: "", }, { name: "different major versions", sshVersion: "SSH-2.0-uptermd-1.0.0", expectedComp: false, expectedHost: "v" + Version, expectedSvr: "v1.0.0", expectedMsg: "Major version mismatch: host v" + Version + ", server v1.0.0", }, { name: "different server (openssh) - treated as unknown", sshVersion: "SSH-2.0-openssh-8.0", expectedComp: false, expectedHost: "v" + Version, expectedSvr: "unknown", expectedMsg: "Unable to determine server version - possibly older upterm server or non-upterm server", }, { name: "unparseable server version (no version) - incompatible", sshVersion: "SSH-2.0-openssh", expectedComp: false, expectedHost: "v" + Version, expectedSvr: "unknown", expectedMsg: "Unable to determine server version - possibly older upterm server or non-upterm server", }, { name: "malformed SSH version - incompatible", sshVersion: "invalid-version-string", expectedComp: false, expectedHost: "v" + Version, expectedSvr: "unknown", expectedMsg: "Unable to determine server version - possibly older upterm server or non-upterm server", }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { result := CheckCompatibility(tt.sshVersion) assert.Equal(t, tt.expectedComp, result.Compatible) assert.Equal(t, tt.expectedHost, result.HostVersion) assert.Equal(t, tt.expectedSvr, result.ServerVersion) assert.Equal(t, tt.expectedMsg, result.Message) }) } } func TestServerSSHVersion(t *testing.T) { expected := "SSH-2.0-uptermd-" + Version actual := ServerSSHVersion() assert.Equal(t, expected, actual) } func TestCurrent(t *testing.T) { // Test that Current() returns a valid version and doesn't panic v := Current() assert.NotNil(t, v) assert.Equal(t, Version, v.String()) } func TestCurrentPanic(t *testing.T) { // This test would only fail if Version constant is invalid // which would be a build-time issue, but we test the panic behavior assert.NotPanics(t, func() { Current() }) } upterm-0.17.0/io/000077500000000000000000000000001507434540500135315ustar00rootroot00000000000000upterm-0.17.0/io/reader.go000066400000000000000000000013321507434540500153210ustar00rootroot00000000000000package io import ( "context" "io" ) func NewContextReader(ctx context.Context, r io.Reader) io.Reader { return contextReader{ Reader: r, ctx: ctx, } } type contextReader struct { io.Reader ctx context.Context } type readResult struct { n int err error } func (r contextReader) Read(p []byte) (n int, err error) { c := make(chan readResult, 1) go func(ctx context.Context, reader io.Reader) { // close by the sender defer close(c) // return early if context is done select { case <-ctx.Done(): return default: } n, err := reader.Read(p) c <- readResult{n, err} }(r.ctx, r.Reader) select { case rr := <-c: return rr.n, rr.err case <-r.ctx.Done(): return 0, r.ctx.Err() } } upterm-0.17.0/io/reader_test.go000066400000000000000000000045021507434540500163620ustar00rootroot00000000000000package io import ( "bytes" "context" "io" "testing" "time" "github.com/google/go-cmp/cmp" ) func Test_ContextReader(t *testing.T) { t.Run("happy path", func(t *testing.T) { t.Parallel() r := bytes.NewBufferString("hello1") w := bytes.NewBuffer(nil) _, _ = io.Copy(w, NewContextReader(context.Background(), r)) want := "hello1" got := w.String() if diff := cmp.Diff(want, got); diff != "" { t.Errorf("want=%s got=%s:\n%s", want, got, diff) } }) t.Run("pass in canceled context", func(t *testing.T) { t.Parallel() r := readFunc(func(p []byte) (int, error) { t.Error("should never get here") return 0, nil }) w := bytes.NewBuffer(nil) ctx, cancel := context.WithCancel(context.Background()) cancel() _, err := io.Copy(w, NewContextReader(ctx, r)) want := context.Canceled got := err if diff := cmp.Diff(want.Error(), got.Error()); diff != "" { t.Errorf("want=%s got=%s:\n%s", want, got, diff) } }) t.Run("cancel context during copy", func(t *testing.T) { t.Parallel() r := readFunc(func(p []byte) (int, error) { time.Sleep(5 * time.Second) // simulate slow read t.Error("should never get here") return 0, nil }) w := bytes.NewBuffer(nil) ctx, cancel := context.WithCancel(context.Background()) go func() { time.Sleep(1 * time.Second) // cancel ctx before any read cancel() }() _, err := io.Copy(w, NewContextReader(ctx, r)) want := context.Canceled got := err if diff := cmp.Diff(want.Error(), got.Error()); diff != "" { t.Errorf("want=%s got=%s:\n%s", want, got, diff) } }) t.Run("cancel context after copy", func(t *testing.T) { t.Parallel() ch := make(chan string, 1) ch <- "hello2" // feed with one read and then it hangs r := readFunc(func(p []byte) (int, error) { s := <-ch return bytes.NewBufferString(s).Read(p) }) w := bytes.NewBuffer(nil) ctx, cancel := context.WithCancel(context.Background()) go func() { time.Sleep(3 * time.Second) // cancel ctx after first read cancel() }() _, err := io.Copy(w, NewContextReader(ctx, r)) want := context.Canceled got := err if diff := cmp.Diff(want.Error(), got.Error()); diff != "" { t.Errorf("want=%s got=%s:\n%s", want, got, diff) } }) } type readFunc func(p []byte) (n int, err error) func (rf readFunc) Read(p []byte) (n int, err error) { return rf(p) } upterm-0.17.0/io/writer.go000066400000000000000000000036201507434540500153750ustar00rootroot00000000000000package io import ( "io" "sync" ) type buffer struct { mu sync.Mutex queue [][]byte size int } func (c *buffer) Append(p []byte) { c.mu.Lock() defer c.mu.Unlock() // remove first element if queue is full if len(c.queue) >= c.size { c.queue = c.queue[1:] } pp := make([]byte, len(p)) copy(pp, p) c.queue = append(c.queue, pp) } func (c *buffer) Size() int { c.mu.Lock() defer c.mu.Unlock() return len(c.queue) } func (c *buffer) Data() [][]byte { c.mu.Lock() defer c.mu.Unlock() result := make([][]byte, len(c.queue)) return append(result, c.queue...) } func NewMultiWriter(bufferSize int, writers ...io.Writer) *MultiWriter { return &MultiWriter{ writers: writers, buffer: &buffer{size: bufferSize}, } } // MultiWriter is a concurrent safe writer that allows appending/removing writers. // Newly appended writers get the last write to preserve last output. type MultiWriter struct { writeMu sync.Mutex writers []io.Writer buffer *buffer } func (t *MultiWriter) Append(writers ...io.Writer) error { // write last buffer to new writers if t.buffer.Size() > 0 { for _, w := range writers { for _, d := range t.buffer.Data() { _, err := w.Write(d) if err != nil { return err } } } } t.writeMu.Lock() defer t.writeMu.Unlock() t.writers = append(t.writers, writers...) return nil } func (t *MultiWriter) Remove(writers ...io.Writer) { t.writeMu.Lock() defer t.writeMu.Unlock() for i := len(t.writers) - 1; i > 0; i-- { for _, v := range writers { if t.writers[i] == v { t.writers = append(t.writers[:i], t.writers[i+1:]...) break } } } } func (t *MultiWriter) Write(p []byte) (n int, err error) { t.buffer.Append(p) t.writeMu.Lock() defer t.writeMu.Unlock() for _, w := range t.writers { n, err = w.Write(p) if err != nil { return } if n != len(p) { err = io.ErrShortWrite return } } return len(p), nil } upterm-0.17.0/io/writer_test.go000066400000000000000000000017751507434540500164450ustar00rootroot00000000000000package io import ( "bytes" "io" "testing" "github.com/stretchr/testify/assert" ) func Test_MultiWriter(t *testing.T) { assert := assert.New(t) w1 := bytes.NewBuffer(nil) w := NewMultiWriter(1, w1) r := bytes.NewBufferString("hello1") _, _ = io.Copy(w, r) assert.Equal("hello1", w1.String()) // append w2 r = bytes.NewBufferString("hello2") w2 := bytes.NewBuffer(nil) _ = w.Append(w2) _, _ = io.Copy(w, r) assert.Equal("hello1hello2", w1.String()) assert.Equal("hello1hello2", w2.String()) // append w3 r = bytes.NewBufferString("hello3") w3 := bytes.NewBuffer(nil) _ = w.Append(w3) _, _ = io.Copy(w, r) assert.Equal("hello1hello2hello3", w1.String()) assert.Equal("hello1hello2hello3", w2.String()) assert.Equal("hello2hello3", w3.String()) // remove w2 r = bytes.NewBufferString("hello4") w.Remove(w2) _, _ = io.Copy(w, r) assert.Equal("hello1hello2hello3hello4", w1.String()) assert.Equal("hello1hello2hello3", w2.String()) assert.Equal("hello2hello3hello4", w3.String()) } upterm-0.17.0/memlistener/000077500000000000000000000000001507434540500154465ustar00rootroot00000000000000upterm-0.17.0/memlistener/memlistener.go000066400000000000000000000047541507434540500203330ustar00rootroot00000000000000package memlistener import ( "errors" "fmt" "net" "sync" "google.golang.org/grpc/test/bufconn" ) var ( errMissingAddress = errors.New("missing address") ) const ( defaultBufferSize = 256 * 1024 ) type addr struct{} func (addr) Network() string { return "mem" } func (addr) String() string { return "mem" } type errListenerAlreadyExist struct { addr string } func (e errListenerAlreadyExist) Error() string { return fmt.Sprintf("listener with address %s already exist", e.addr) } type errListenerNotFound struct { addr string } func (e errListenerNotFound) Error() string { return fmt.Sprintf("listener with address %s not found", e.addr) } func New() *MemoryListener { return &MemoryListener{} } type MemoryListener struct { listeners sync.Map } func (l *MemoryListener) Listen(network, address string) (net.Listener, error) { return l.ListenMem(network, address, defaultBufferSize) } func (l *MemoryListener) ListenMem(network, address string, sz int) (net.Listener, error) { switch network { case "mem", "memory": default: return nil, &net.OpError{Op: "listen", Net: network, Source: nil, Addr: addr{}, Err: net.UnknownNetworkError(network)} } if address == "" { return nil, &net.OpError{Op: "listen", Net: network, Source: nil, Addr: addr{}, Err: errMissingAddress} } ln := &memlistener{ Listener: bufconn.Listen(sz), addr: address, closeFunc: l.removeListener, } actual, loaded := l.listeners.LoadOrStore(address, ln) if loaded { return nil, &net.OpError{Op: "listen", Net: network, Source: nil, Addr: addr{}, Err: errListenerAlreadyExist{address}} } return actual.(net.Listener), nil } func (l *MemoryListener) Dial(network, address string) (net.Conn, error) { switch network { case "mem", "memory": default: return nil, &net.OpError{Op: "dial", Net: network, Source: addr{}, Addr: addr{}, Err: net.UnknownNetworkError(network)} } if address == "" { return nil, &net.OpError{Op: "dial", Net: network, Source: addr{}, Addr: addr{}, Err: errMissingAddress} } val, exist := l.listeners.Load(address) if !exist { return nil, &net.OpError{Op: "dial", Net: network, Source: addr{}, Addr: addr{}, Err: errListenerNotFound{address}} } ln := val.(*memlistener) return ln.Dial() } func (l *MemoryListener) removeListener(address string) { l.listeners.Delete(address) } type memlistener struct { *bufconn.Listener addr string closeFunc func(addr string) } func (m *memlistener) Close() error { defer m.closeFunc(m.addr) return m.Listener.Close() } upterm-0.17.0/memlistener/memlistener_test.go000066400000000000000000000025561507434540500213700ustar00rootroot00000000000000package memlistener import ( "strings" "testing" "github.com/google/go-cmp/cmp" ) func Test_MemListener_Listen(t *testing.T) { t.Parallel() l := New() sln, err := l.Listen("mem", "path_foo") if err != nil { t.Fatal(err) } defer func() { _ = sln.Close() }() // error on listener with the same address _, err = l.Listen("mem", "path_foo") want, got := errListenerAlreadyExist{"path_foo"}, err if !strings.Contains(got.Error(), want.Error()) { t.Fatalf("got doesn't contain want (-want +got):\n%s", cmp.Diff(want.Error(), got.Error())) } } func Test_MemListener_Dial(t *testing.T) { t.Parallel() l := New() _, err := l.Dial("mem", "not_exist") want, got := errListenerNotFound{"not_exist"}, err if !strings.Contains(got.Error(), want.Error()) { t.Fatalf("got doesn't contain want (-want +got):\n%s", cmp.Diff(want.Error(), got.Error())) } } func Test_MemListener_RemoveListener(t *testing.T) { t.Parallel() l := New() sln, err := l.Listen("mem", "path_bar") if err != nil { t.Fatal(err) } sln2, ok := l.listeners.Load("path_bar") if !ok { t.Fatal("listener path not found") } if want, got := sln, sln2; want != got { t.Fatalf("listeners not equal: want=%v, got=%v", want, got) } if err := sln.Close(); err != nil { t.Fatal(err) } _, ok = l.listeners.Load("path_bar") if ok { t.Fatal("listener path shouldn't be found") } } upterm-0.17.0/routing/000077500000000000000000000000001507434540500146115ustar00rootroot00000000000000upterm-0.17.0/routing/encoding.go000066400000000000000000000057521507434540500167370ustar00rootroot00000000000000package routing import ( "encoding/base64" "fmt" "strings" ) var ( ErrInvalidSSHUser = fmt.Errorf("invalid SSH user") ) // Encoder defines the interface for encoding session information into SSH usernames type Encoder interface { // Encode encodes a session ID and node address into an SSH username Encode(sessionID, nodeAddr string) string } // Decoder defines the interface for decoding SSH usernames into session information type Decoder interface { // Decode decodes an SSH username into session ID and node address Decode(sshUser string) (sessionID, nodeAddr string, err error) } // ModeProvider defines the interface for getting the routing mode type ModeProvider interface { // Mode returns the routing mode for this encoder/decoder Mode() Mode } // EncodeDecoder defines the composite interface for encoding and decoding SSH usernames type EncodeDecoder interface { Encoder Decoder ModeProvider } // NewEncoder creates an Encoder for the specified routing mode func NewEncoder(mode Mode) Encoder { return NewEncodeDecoder(mode) } // NewDecoder creates a Decoder for the specified routing mode func NewDecoder(mode Mode) Decoder { return NewEncodeDecoder(mode) } // NewEncodeDecoder creates an EncodeDecoder for the specified routing mode func NewEncodeDecoder(mode Mode) EncodeDecoder { switch mode { case ModeEmbedded: return &EmbeddedEncodeDecoder{} case ModeConsul: return &ConsulEncodeDecoder{} default: return &EmbeddedEncodeDecoder{} // Default to embedded } } // EmbeddedEncodeDecoder implements EncodeDecoder for embedded routing mode type EmbeddedEncodeDecoder struct{} func (e *EmbeddedEncodeDecoder) Encode(sessionID, nodeAddr string) string { return sessionID + ":" + base64.URLEncoding.EncodeToString([]byte(nodeAddr)) } func (e *EmbeddedEncodeDecoder) Decode(sshUser string) (sessionID, nodeAddr string, err error) { split := strings.SplitN(sshUser, ":", 2) if len(split) != 2 { return "", "", ErrInvalidSSHUser } nodeAddrBytes, err := base64.URLEncoding.DecodeString(split[1]) if err != nil { return "", "", fmt.Errorf("failed to decode node address: %w", err) } return split[0], string(nodeAddrBytes), nil } func (e *EmbeddedEncodeDecoder) Mode() Mode { return ModeEmbedded } // ConsulEncodeDecoder implements EncodeDecoder for Consul routing mode type ConsulEncodeDecoder struct{} func (c *ConsulEncodeDecoder) Encode(sessionID, nodeAddr string) string { return sessionID } func (c *ConsulEncodeDecoder) Decode(sshUser string) (sessionID, nodeAddr string, err error) { if sshUser == "" { return "", "", ErrInvalidSSHUser } // In Consul mode, the SSH user is just the session ID // Handle mixed-mode scenarios: if SSH user contains ":" (embedded format), // extract only the session ID part (before the colon) for compatibility if colonIndex := strings.Index(sshUser, ":"); colonIndex != -1 { sessionID = sshUser[:colonIndex] } else { sessionID = sshUser } return sessionID, "", nil } func (c *ConsulEncodeDecoder) Mode() Mode { return ModeConsul } upterm-0.17.0/routing/encoding_test.go000066400000000000000000000057251507434540500177760ustar00rootroot00000000000000package routing import ( "testing" "github.com/stretchr/testify/suite" ) // EncodeDecoderTestSuite tests the EncodeDecoder implementations type EncodeDecoderTestSuite struct { suite.Suite } func (suite *EncodeDecoderTestSuite) TestEmbeddedEncodeDecoder() { sessionID := "test-session-123" nodeAddr := "node1.example.com:22" encoder := NewEncodeDecoder(ModeEmbedded) // Test encoding encoded := encoder.Encode(sessionID, nodeAddr) suite.Contains(encoded, ":") suite.Contains(encoded, sessionID) // Test decoding decodedSessionID, decodedNodeAddr, err := encoder.Decode(encoded) suite.NoError(err) suite.Equal(sessionID, decodedSessionID) suite.Equal(nodeAddr, decodedNodeAddr) suite.Equal(ModeEmbedded, encoder.Mode()) } func (suite *EncodeDecoderTestSuite) TestConsulEncodeDecoder() { sessionID := "test-session-456" encoder := NewEncodeDecoder(ModeConsul) // Test encoding (should just return session ID) encoded := encoder.Encode(sessionID, "any-node") suite.Equal(sessionID, encoded) // Test decoding decodedSessionID, decodedNodeAddr, err := encoder.Decode(encoded) suite.NoError(err) suite.Equal(sessionID, decodedSessionID) suite.Empty(decodedNodeAddr) suite.Equal(ModeConsul, encoder.Mode()) } func (suite *EncodeDecoderTestSuite) TestEmbeddedDecodeInvalidFormats() { decoder := NewEncodeDecoder(ModeEmbedded) testCases := []struct { input string description string }{ {"no-colon-here", "no colon separator"}, {"", "empty string"}, {"session:invalid-base64===!@#$", "invalid base64 characters"}, } for _, tc := range testCases { suite.Run(tc.description, func() { _, _, err := decoder.Decode(tc.input) suite.Error(err) }) } } func (suite *EncodeDecoderTestSuite) TestConsulDecodeInvalidFormats() { decoder := NewEncodeDecoder(ModeConsul) // Test empty session ID _, _, err := decoder.Decode("") suite.Error(err) } func (suite *EncodeDecoderTestSuite) TestConsulDecodeBackwardCompatibility() { sessionID := "test-session-123" nodeAddr := "127.0.0.1:2222" // Create an embedded format SSH user (what old clients send) embeddedEncoder := NewEncodeDecoder(ModeEmbedded) embeddedSSHUser := embeddedEncoder.Encode(sessionID, nodeAddr) // Test that Consul decoder can handle embedded format consulDecoder := NewEncodeDecoder(ModeConsul) decodedSessionID, decodedNodeAddr, err := consulDecoder.Decode(embeddedSSHUser) suite.NoError(err) suite.Equal(sessionID, decodedSessionID, "should extract session ID from embedded format") suite.Empty(decodedNodeAddr, "consul decoder should return empty node address") // Test that it still works with pure consul format decodedSessionID2, decodedNodeAddr2, err2 := consulDecoder.Decode(sessionID) suite.NoError(err2) suite.Equal(sessionID, decodedSessionID2, "should handle pure consul format") suite.Empty(decodedNodeAddr2, "consul decoder should return empty node address") } // Test suite runners func TestEncodeDecoderSuite(t *testing.T) { suite.Run(t, new(EncodeDecoderTestSuite)) } upterm-0.17.0/routing/modes.go000066400000000000000000000004511507434540500162470ustar00rootroot00000000000000package routing // Mode defines how session routing information is stored and encoded type Mode string const ( // ModeEmbedded embeds node address in the session identifier (default) ModeEmbedded Mode = "embedded" // ModeConsul looks up node address from Consul ModeConsul Mode = "consul" ) upterm-0.17.0/script/000077500000000000000000000000001507434540500144265ustar00rootroot00000000000000upterm-0.17.0/script/changelog000077500000000000000000000006661507434540500163130ustar00rootroot00000000000000#!/usr/bin/env bash set -e head="${1:-HEAD}" for sha in `git rev-list -n 100 --first-parent "$head"^`; do previous_tag="$(git tag -l --points-at "$sha" 'v*' 2>/dev/null || true)" [ -z "$previous_tag" ] || break done if [ -z "$previous_tag" ]; then echo "Couldn't detect previous version tag" >&2 exit 1 fi git log --no-merges --format='%C(auto,green)* %s%C(auto,reset)%n%w(0,2,2)%+b' \ --reverse "${previous_tag}..${head}" upterm-0.17.0/script/do-install000077500000000000000000000011611507434540500164210ustar00rootroot00000000000000#!/usr/bin/env bash set -e function join { local IFS="$1"; shift; echo "$*"; } SECRETS=($(ls -d $TF_VAR_uptermd_host_keys_dir)) ARRAY=() for f in ${SECRETS[@]} do ARRAY+=("\"$(basename $f)\"=\"$(cat $f | base64 -w 0)\"") done HOST_KEYS="{" HOST_KEYS+=$(join , ${ARRAY[@]}) HOST_KEYS+="}" TERRAFORM_STATES_DIR=$(PWD)/terraform_states mkdir -p $TERRAFORM_STATES_DIR pushd ./terraform/digitalocean > /dev/null echo "Initializing terraform..." terraform init echo "Applying terraform..." terraform apply \ -state $TERRAFORM_STATES_DIR/digitalocean.tfstate \ -var uptermd_host_keys="$HOST_KEYS" popd > /dev/null upterm-0.17.0/script/heroku-install000077500000000000000000000006221507434540500173150ustar00rootroot00000000000000#!/usr/bin/env bash set -e TERRAFORM_STATES_DIR=$(pwd)/terraform_states mkdir -p $TERRAFORM_STATES_DIR pushd ./terraform/heroku echo "Initializing terraform..." terraform init echo "Applying terraform..." export TF_VAR_git_commit_sha="${TF_VAR_git_commit_sha:-$(git rev-parse HEAD)}" # default version to current HEAD terraform apply -state $TERRAFORM_STATES_DIR/heroku.tfstate popd > /dev/null upterm-0.17.0/script/publish-release000077500000000000000000000010711507434540500174370ustar00rootroot00000000000000#!/usr/bin/env bash set -e project_name="owenthereal/upterm" tag_name="${1?}" [[ $tag_name == *-* ]] && pre=1 || pre= notes="$(git tag --list "$tag_name" --format='%(contents:subject)%0a%0a%(contents:body)')" if hub release --include-drafts | grep -q "^${tag_name}\$"; then hub release edit "$tag_name" -m "" elif [ $(wc -l <<<"$notes") -gt 1 ]; then hub release create ${pre:+--prerelease} - "$tag_name" <<<"$notes" else { echo "${project_name} ${tag_name#v}" echo bin/changelog } | hub release create --draft ${pre:+--prerelease} - "$tag_name" fi upterm-0.17.0/script/publish-website000077500000000000000000000015201507434540500174600ustar00rootroot00000000000000#!/usr/bin/env bash set -e # Cleanup function cleanup() { if [ -d "$tmp_dir" ]; then rm -rf "$tmp_dir" fi if [ -n "$current_branch" ] && [ "$(git rev-parse --abbrev-ref HEAD)" != "$current_branch" ]; then git checkout "$current_branch" 2>/dev/null || true fi } trap cleanup EXIT current_branch=$(git rev-parse --abbrev-ref HEAD) tmp_dir=$(mktemp -d -t upterm-XXXXXXXXXX) upterm_dir=${PWD} pushd $tmp_dir helm package $upterm_dir/charts/uptermd && helm repo index . cp $upterm_dir/README.md index.md cp -r $upterm_dir/docs . cp $upterm_dir/fly.example.toml . popd > /dev/null git checkout gh-pages cp -r $tmp_dir/* . cp -r $tmp_dir/.* . 2>/dev/null || true git add . if git diff --staged --quiet; then echo "No changes to commit" else git commit -m "Generated website" git push origin gh-pages fi upterm-0.17.0/script/tag-release000077500000000000000000000010001507434540500165340ustar00rootroot00000000000000#!/usr/bin/env bash set -e version_file="cmd/upterm/command/version.go" if git diff --exit-code >/dev/null -- "$version_file"; then echo "Update the version in $version_file and try again." >&2 exit 1 fi version="$(grep -w 'Version =' "$version_file" | cut -d'"' -f2)" sed -i'' "s/appVersion: .*/appVersion: $version/g" charts/uptermd/Chart.yaml make docs git commit -m "Release Upterm $version" -- "$version_file" "docs/*" "etc/*" "charts/*" git tag "v${version}" git push origin HEAD "v${version}" upterm-0.17.0/server/000077500000000000000000000000001507434540500144305ustar00rootroot00000000000000upterm-0.17.0/server/cert.go000066400000000000000000000064661507434540500157300ustar00rootroot00000000000000package server import ( "crypto/rand" "fmt" "time" "github.com/owenthereal/upterm/upterm" "golang.org/x/crypto/ssh" "google.golang.org/protobuf/proto" ) var ( errCertNotSignedByHost = fmt.Errorf("ssh cert not signed by host") ) type UserCertChecker struct { UserKeyFallback func(user string, key ssh.PublicKey) (ssh.PublicKey, error) } // Authenticate tries to pass auth request and public key from a cert. // If the public key is not a cert, it calls the UserKeyFallback func. Otherwise it returns an error. func (c *UserCertChecker) Authenticate(user string, key ssh.PublicKey) (*AuthRequest, ssh.PublicKey, error) { cert, ok := key.(*ssh.Certificate) if !ok { if c.UserKeyFallback != nil { key, err := c.UserKeyFallback(user, key) return nil, key, err } return nil, nil, fmt.Errorf("public key not a cert") } return parseAuthRequestFromCert(user, cert) } // parseAuthRequestFromCert parses auth request and public key from a cert. // The public key is always the signature key of the cert. func parseAuthRequestFromCert(principal string, cert *ssh.Certificate) (*AuthRequest, ssh.PublicKey, error) { key := cert.SignatureKey if cert.CertType != ssh.UserCert { return nil, key, fmt.Errorf("ssh: cert has type %d", cert.CertType) } checker := &ssh.CertChecker{} if err := checker.CheckCert(principal, cert); err != nil { return nil, key, err } if len(cert.Extensions) == 0 { return nil, key, errCertNotSignedByHost } ext, ok := cert.Extensions[upterm.SSHCertExtension] if !ok { return nil, key, errCertNotSignedByHost } var auth AuthRequest if err := proto.Unmarshal([]byte(ext), &auth); err != nil { return nil, key, err } key, _, _, _, err := ssh.ParseAuthorizedKey(auth.AuthorizedKey) if err != nil { return nil, key, fmt.Errorf("error parsing public key from auth request: %w", err) } return &auth, key, nil } type UserCertSigner struct { SessionID string User string AuthRequest *AuthRequest } func (g *UserCertSigner) SignCert(signer ssh.Signer) (ssh.Signer, error) { b, err := proto.Marshal(g.AuthRequest) if err != nil { return nil, fmt.Errorf("error marshaling auth request: %w", err) } at := time.Now() bt := at.Add(1 * time.Minute) // cert valid for 1 min cert := &ssh.Certificate{ Key: signer.PublicKey(), CertType: ssh.UserCert, KeyId: g.SessionID, ValidPrincipals: []string{g.User}, ValidAfter: uint64(at.Unix()), ValidBefore: uint64(bt.Unix()), Permissions: ssh.Permissions{ Extensions: map[string]string{upterm.SSHCertExtension: string(b)}, }, } // TODO: use different key to sign if err := cert.SignCert(rand.Reader, signer); err != nil { return nil, fmt.Errorf("error signing host cert: %w", err) } cs, err := ssh.NewCertSigner(cert, signer) if err != nil { return nil, fmt.Errorf("error generating host signer: %w", err) } return cs, nil } type HostCertSigner struct { Hostnames []string } func (s *HostCertSigner) SignCert(signer ssh.Signer) (ssh.Signer, error) { cert := &ssh.Certificate{ Key: signer.PublicKey(), CertType: ssh.HostCert, KeyId: "uptermd", ValidPrincipals: s.Hostnames, ValidBefore: ssh.CertTimeInfinity, } if err := cert.SignCert(rand.Reader, signer); err != nil { return nil, err } return ssh.NewCertSigner(cert, signer) } upterm-0.17.0/server/metrics.go000066400000000000000000000011541507434540500164260ustar00rootroot00000000000000package server import ( "context" "net/http" "sync" "github.com/prometheus/client_golang/prometheus/promhttp" ) type metricServer struct { server *http.Server mux sync.Mutex } func (m *metricServer) Shutdown(ctx context.Context) error { m.mux.Lock() defer m.mux.Unlock() if m.server == nil { return nil } return m.server.Shutdown(ctx) } func (m *metricServer) ListenAndServe(addr string) error { mux := http.NewServeMux() mux.Handle("/metrics", promhttp.Handler()) m.mux.Lock() m.server = &http.Server{ Addr: addr, Handler: mux, } m.mux.Unlock() return m.server.ListenAndServe() } upterm-0.17.0/server/network.go000066400000000000000000000076131507434540500164570ustar00rootroot00000000000000package server import ( "fmt" "net" "os" "path/filepath" "github.com/owenthereal/upterm/memlistener" "github.com/rs/xid" ) var networks networkProviders func init() { networks = []NetworkProvider{&UnixProvider{}, &MemoryProvider{}} } type networkProviders []NetworkProvider func (n networkProviders) Get(name string) NetworkProvider { for _, p := range n { if p.Name() == name { return p } } return nil } type NetworkProvider interface { SetOpts(opts NetworkOptions) error Session() SessionDialListener SSHD() SSHDDialListener Name() string Opts() string } type NetworkOptions map[string]string type SessionDialListener interface { Listen(sesisonID string) (net.Listener, error) Dial(sessionID string) (net.Conn, error) } type SSHDDialListener interface { Listen() (net.Listener, error) Dial() (net.Conn, error) } type MemoryProvider struct { SocketPath string memln *memlistener.MemoryListener } func (p *MemoryProvider) Name() string { return "mem" } func (p *MemoryProvider) Opts() string { return fmt.Sprintf("ssh-socket-path=%s", p.SocketPath) } func (p *MemoryProvider) SetOpts(opts NetworkOptions) error { p.SocketPath = xid.New().String() p.memln = memlistener.New() return nil } func (p *MemoryProvider) Session() SessionDialListener { return &memorySessionDialListener{memln: p.memln} } func (p *MemoryProvider) SSHD() SSHDDialListener { return &memorySSHDDialListener{socketPath: p.SocketPath, memln: p.memln} } type memorySSHDDialListener struct { socketPath string memln *memlistener.MemoryListener } func (l *memorySSHDDialListener) Listen() (net.Listener, error) { return l.memln.Listen("mem", l.socketPath) } func (l *memorySSHDDialListener) Dial() (net.Conn, error) { return l.memln.Dial("mem", l.socketPath) } type memorySessionDialListener struct { memln *memlistener.MemoryListener } func (d *memorySessionDialListener) Listen(sessionID string) (net.Listener, error) { return d.memln.Listen("mem", sessionID) } func (d *memorySessionDialListener) Dial(sessionID string) (net.Conn, error) { return d.memln.Dial("mem", sessionID) } type UnixProvider struct { sessionSocketDir string sshdSocketPath string } func (p *UnixProvider) Opts() string { return fmt.Sprintf("session-socket-dir=%s,sshd-socket-path=%s", p.sessionSocketDir, p.sshdSocketPath) } func (p *UnixProvider) SetOpts(opts NetworkOptions) error { var ok bool p.sessionSocketDir, ok = opts["session-socket-dir"] if !ok { dir, err := os.MkdirTemp("", "uptermd") if err != nil { return fmt.Errorf("missing \"session-socket-dir\" option for network provider %s", p.Name()) } p.sessionSocketDir = dir } p.sshdSocketPath, ok = opts["sshd-socket-path"] if !ok { dir, err := os.MkdirTemp("", "uptermd") if err != nil { return fmt.Errorf("missing \"sshd-socket-path\" option for network provider %s", p.Name()) } p.sshdSocketPath = filepath.Join(dir, "sshd.sock") } return nil } func (p *UnixProvider) Session() SessionDialListener { return &unixSessionDialListener{SocketDir: p.sessionSocketDir} } func (p *UnixProvider) SSHD() SSHDDialListener { return &unixSSHDDialListener{SocketPath: p.sshdSocketPath} } func (p *UnixProvider) Name() string { return "unix" } type unixSSHDDialListener struct { SocketPath string } func (d *unixSSHDDialListener) Listen() (net.Listener, error) { return net.Listen("unix", d.SocketPath) } func (d *unixSSHDDialListener) Dial() (net.Conn, error) { return net.Dial("unix", d.SocketPath) } type unixSessionDialListener struct { SocketDir string } func (d *unixSessionDialListener) Listen(sessionID string) (net.Listener, error) { return net.Listen("unix", d.socketPath(sessionID)) } func (d *unixSessionDialListener) Dial(sessionID string) (net.Conn, error) { return net.Dial("unix", d.socketPath(sessionID)) } func (d *unixSessionDialListener) socketPath(sessionID string) string { return filepath.Join(d.SocketDir, sessionID+".sock") } upterm-0.17.0/server/server.go000066400000000000000000000333721507434540500162750ustar00rootroot00000000000000package server import ( "context" "encoding/base64" "errors" "fmt" "net" "net/url" "os" "slices" "strings" "sync" "time" "log/slog" "github.com/go-kit/kit/metrics/provider" "github.com/oklog/run" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/utils" "github.com/owenthereal/upterm/ws" "github.com/pires/go-proxyproto" "golang.org/x/crypto/ssh" ) const ( tcpDialTimeout = 1 * time.Second ) type Opt struct { SSHAddr string `mapstructure:"ssh-addr"` SSHProxyProtocol bool `mapstructure:"ssh-proxy-protocol"` WSAddr string `mapstructure:"ws-addr"` NodeAddr string `mapstructure:"node-addr"` PrivateKeys []string `mapstructure:"private-key"` Hostnames []string `mapstructure:"hostname"` Network string `mapstructure:"network"` NetworkOpts []string `mapstructure:"network-opt"` MetricAddr string `mapstructure:"metric-addr"` Debug bool `mapstructure:"debug"` Routing routing.Mode `mapstructure:"routing"` ConsulURL string `mapstructure:"consul-url"` ConsulSessionTTL string `mapstructure:"consul-session-ttl"` SentryDSN string `mapstructure:"sentry-dsn"` } // Validate validates the server configuration func (opt *Opt) Validate() error { // Basic validation if opt.SSHAddr == "" { return fmt.Errorf("ssh-addr is required") } // Routing-specific validation routingMode := opt.Routing if routingMode == "" { routingMode = routing.ModeEmbedded } switch routingMode { case routing.ModeConsul: return opt.validateConsulConfig() case routing.ModeEmbedded: return opt.validateEmbeddedConfig() default: return fmt.Errorf("unsupported routing mode: %s", routingMode) } } // validateConsulConfig validates Consul-specific configuration func (opt *Opt) validateConsulConfig() error { if opt.ConsulURL == "" { return fmt.Errorf("consul-url is required for consul routing mode") } // Validate Consul URL format if _, err := url.Parse(opt.ConsulURL); err != nil { return fmt.Errorf("invalid consul URL format: %w", err) } // Validate TTL format if provided if opt.ConsulSessionTTL != "" { if _, err := time.ParseDuration(opt.ConsulSessionTTL); err != nil { return fmt.Errorf("invalid consul session TTL format: %w", err) } } return nil } // validateEmbeddedConfig validates embedded mode configuration func (opt *Opt) validateEmbeddedConfig() error { // No special validation needed for embedded mode return nil } func Start(ctx context.Context, opt Opt, logger *slog.Logger) error { // Validate configuration upfront if err := opt.Validate(); err != nil { return fmt.Errorf("configuration validation failed: %w", err) } network := networks.Get(opt.Network) if network == nil { return fmt.Errorf("unsupported network provider %q", opt.Network) } opts := parseNetworkOpt(opt.NetworkOpts) if err := network.SetOpts(opts); err != nil { return fmt.Errorf("network provider option error: %s", err) } privateKeys, err := utils.ReadFiles(opt.PrivateKeys) if err != nil { return nil } if pp := os.Getenv("PRIVATE_KEY"); pp != "" { privateKeys = append(privateKeys, []byte(pp)) } signers, err := utils.CreateSigners(privateKeys) if err != nil { return err } // key signers + corresponding cert signers hostSigners := slices.Clone(signers) for _, s := range signers { hs := HostCertSigner{ Hostnames: opt.Hostnames, } ss, err := hs.SignCert(s) if err != nil { return err } hostSigners = append(hostSigners, ss) } // logger is already the parameter, just add context logger = logger.With("app", "uptermd", "network", opt.Network, "network_opt", opt.NetworkOpts) var ( sshln net.Listener wsln net.Listener ) if opt.SSHAddr != "" { sshln, err = net.Listen("tcp", opt.SSHAddr) if err != nil { return err } logger = logger.With("ssh_addr", sshln.Addr().String()) if opt.SSHProxyProtocol { // Wrap the SSH listener with proxyproto.Listener to preserve the real client IP // when connections are coming through a TCP proxy (e.g., AWS ELB, HAProxy). sshln = &proxyproto.Listener{Listener: sshln} } } if opt.WSAddr != "" { wsln, err = net.Listen("tcp", opt.WSAddr) if err != nil { return err } logger = logger.With("ws_addr", wsln.Addr().String()) } // fallback node addr to ssh addr or ws addr if empty nodeAddr := opt.NodeAddr if nodeAddr == "" && sshln != nil { nodeAddr = sshln.Addr().String() } if nodeAddr == "" && wsln != nil { nodeAddr = wsln.Addr().String() } if nodeAddr == "" { return fmt.Errorf("node address can't by empty") } logger = logger.With("node_addr", nodeAddr) var g run.Group { var mp provider.Provider if opt.MetricAddr == "" { mp = provider.NewDiscardProvider() } else { mp = provider.NewPrometheusProvider("upterm", "uptermd") } // Determine session routing mode sessionRouting := opt.Routing if sessionRouting == "" { sessionRouting = routing.ModeEmbedded // Default to embedded mode } // Create session manager with the appropriate routing mode var sessionManager *SessionManager switch sessionRouting { case routing.ModeConsul: var consulTTL time.Duration if opt.ConsulSessionTTL != "" { if parsedTTL, err := time.ParseDuration(opt.ConsulSessionTTL); err == nil { consulTTL = parsedTTL } else { logger.Warn("invalid consul session TTL, using default", "error", err) } } // Parse Consul address as URL consulURL, err := url.Parse(opt.ConsulURL) if err != nil { return fmt.Errorf("invalid consul address URL: %w", err) } sm, err := NewSessionManager(routing.ModeConsul, WithSessionManagerLogger(logger.With("component", "session-manager")), WithSessionManagerConsulURL(consulURL), WithSessionManagerConsulTTL(consulTTL)) if err != nil { return fmt.Errorf("failed to create consul session manager: %w", err) } sessionManager = sm logger.Info("using consul session store for routing") case routing.ModeEmbedded: sm, err := NewSessionManager(routing.ModeEmbedded, WithSessionManagerLogger(logger.With("component", "session-manager"))) if err != nil { return fmt.Errorf("failed to create embedded session manager: %w", err) } sessionManager = sm logger.Info("using embedded session routing (in-memory session store)") default: return fmt.Errorf("invalid session routing mode: %s (supported: %s, %s)", sessionRouting, routing.ModeEmbedded, routing.ModeConsul) } s := &Server{ NodeAddr: nodeAddr, HostSigners: hostSigners, Signers: signers, NetworkProvider: network, SessionManager: sessionManager, Logger: logger.With("component", "server"), MetricsProvider: mp, } g.Add(func() error { return s.ServeWithContext(ctx, sshln, wsln) }, func(err error) { if err := s.Shutdown(); err != nil { logger.Error("error during server shutdown", "error", err) } }) } { if opt.MetricAddr != "" { logger = logger.With("metric_addr", opt.MetricAddr) m := &metricServer{} g.Add(func() error { return m.ListenAndServe(opt.MetricAddr) }, func(err error) { _ = m.Shutdown(ctx) }) } } logger.Info("starting server") defer logger.Info("shutting down server") return g.Run() } func parseNetworkOpt(opts []string) NetworkOptions { result := make(NetworkOptions) for _, opt := range opts { split := strings.SplitN(opt, "=", 2) result[split[0]] = split[1] } return result } type Server struct { NodeAddr string HostSigners []ssh.Signer Signers []ssh.Signer NetworkProvider NetworkProvider MetricsProvider provider.Provider SessionManager *SessionManager Logger *slog.Logger sshln net.Listener wsln net.Listener mux sync.Mutex ctx context.Context cancel func() } func (s *Server) Shutdown() error { s.mux.Lock() defer s.mux.Unlock() var err error // Stop accepting new connections first if s.sshln != nil { if sshErr := s.sshln.Close(); sshErr != nil { err = errors.Join(err, fmt.Errorf("ssh listener close: %w", sshErr)) } } if s.wsln != nil { if wsErr := s.wsln.Close(); wsErr != nil { err = errors.Join(err, fmt.Errorf("websocket listener close: %w", wsErr)) } } // Cancel context to signal graceful shutdown if s.cancel != nil { s.cancel() } // Clean up sessions created by this node if sessionErr := s.SessionManager.Shutdown(s.NodeAddr); sessionErr != nil { s.Logger.Error("failed to cleanup sessions during shutdown", "error", sessionErr) err = errors.Join(err, fmt.Errorf("session cleanup: %w", sessionErr)) } else { s.Logger.Debug("cleaned up sessions during shutdown") } if err == nil { s.Logger.Debug("server shutdown completed") } return err } func (s *Server) ServeWithContext(ctx context.Context, sshln net.Listener, wsln net.Listener) error { s.mux.Lock() s.sshln, s.wsln = sshln, wsln s.ctx, s.cancel = context.WithCancel(ctx) s.mux.Unlock() sshdDialListener := s.NetworkProvider.SSHD() sessionDialListener := s.NetworkProvider.Session() var g run.Group { g.Add(func() error { <-s.ctx.Done() return s.ctx.Err() }, func(err error) { s.cancel() }) } { if sshln != nil { cd := sidewayConnDialer{ NodeAddr: s.NodeAddr, SSHDDialListener: sshdDialListener, SessionDialListener: sessionDialListener, NeighbourDialer: tcpConnDialer{}, Logger: s.Logger.With("component", "ssh-conn-dialer"), } sp := &sshProxy{ HostSigners: s.HostSigners, Signers: s.Signers, NodeAddr: s.NodeAddr, ConnDialer: cd, SessionManager: s.SessionManager, Logger: s.Logger.With("component", "ssh-proxy"), MetricsProvider: s.MetricsProvider, } g.Add(func() error { return sp.Serve(sshln) }, func(err error) { if err := sp.Shutdown(); err != nil { sp.Logger.Error("error during ssh proxy shutdown", "error", err) } }) } } { if wsln != nil { var cd connDialer if sshln == nil { cd = sidewayConnDialer{ NodeAddr: s.NodeAddr, SSHDDialListener: sshdDialListener, SessionDialListener: sessionDialListener, NeighbourDialer: wsConnDialer{}, Logger: s.Logger.With("component", "ws-conn-dialer"), } } else { // If sshln is not nil, always dial to SSHProxy. // So Host/Client -> WSProxy -> SSHProxy -> sshd/Session // This makes sure that SSHProxy terminates all SSH requests // which provides a consistent authentication mechanism. cd = sshProxyDialer{ sshProxyAddr: sshln.Addr().String(), Logger: s.Logger.With("component", "ws-sshproxy-dialer"), } } ws := &webSocketProxy{ ConnDialer: cd, SessionManager: s.SessionManager, Logger: s.Logger.With("component", "ws-proxy"), } g.Add(func() error { return ws.Serve(wsln) }, func(err error) { if err := ws.Shutdown(); err != nil { ws.Logger.Error("error during websocket proxy shutdown", "error", err) } }) } } { ln, err := sshdDialListener.Listen() if err != nil { return err } sshd := sshd{ SessionManager: s.SessionManager, HostSigners: s.HostSigners, // TODO: use different host keys NodeAddr: s.NodeAddr, SessionDialListener: sessionDialListener, Logger: s.Logger.With("component", "sshd"), } g.Add(func() error { return sshd.Serve(ln) }, func(err error) { if err := sshd.Shutdown(); err != nil { sshd.Logger.Error("error during sshd shutdown", "error", err) } }) } return g.Run() } type connDialer interface { Dial(id *api.Identifier) (net.Conn, error) } type sshProxyDialer struct { sshProxyAddr string Logger *slog.Logger } func (d sshProxyDialer) Dial(id *api.Identifier) (net.Conn, error) { // If it's a host request, dial to SSHProxy in the same node. // Otherwise, dial to the specified SSHProxy. if id.Type == api.Identifier_HOST { d.Logger.With("host", id.Id, "sshproxy_addr", d.sshProxyAddr).Info("dialing sshproxy sshd") return net.DialTimeout("tcp", d.sshProxyAddr, tcpDialTimeout) } d.Logger.With("session", id.Id, "sshproxy_addr", d.sshProxyAddr, "addr", id.NodeAddr).Info("dialing sshproxy session") return net.DialTimeout("tcp", id.NodeAddr, tcpDialTimeout) } type tcpConnDialer struct { } func (d tcpConnDialer) Dial(id *api.Identifier) (net.Conn, error) { return net.DialTimeout("tcp", id.NodeAddr, tcpDialTimeout) } type wsConnDialer struct { } func (d wsConnDialer) Dial(id *api.Identifier) (net.Conn, error) { u, err := url.Parse("ws://" + id.NodeAddr) if err != nil { return nil, err } encodedNodeAddr := base64.StdEncoding.EncodeToString([]byte(id.NodeAddr)) u.User = url.UserPassword(id.Id, encodedNodeAddr) return ws.NewWSConn(u, true) } type sidewayConnDialer struct { NodeAddr string SSHDDialListener SSHDDialListener SessionDialListener SessionDialListener NeighbourDialer connDialer Logger *slog.Logger } func (cd sidewayConnDialer) Dial(id *api.Identifier) (net.Conn, error) { logger := cd.Logger.With("session", id.Id, "node", cd.NodeAddr, "type", api.Identifier_Type_name[int32(id.Type)]) if id.Type == api.Identifier_HOST { logger.Info("dialing sshd") return cd.SSHDDialListener.Dial() } else { host, port, ee := net.SplitHostPort(id.NodeAddr) if ee != nil { return nil, fmt.Errorf("host address %s is malformed: %w", id.NodeAddr, ee) } addr := net.JoinHostPort(host, port) logger = logger.With("addr", addr) // if current node is matching, dial to session. // Otherwise, dial to neighbour node if cd.NodeAddr == addr { logger.Info("dialing session") return cd.SessionDialListener.Dial(id.Id) } logger.Info("dialing neighbour") return cd.NeighbourDialer.Dial(id) } } upterm-0.17.0/server/server.pb.go000066400000000000000000000251621507434540500166730ustar00rootroot00000000000000// Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.28.1 // protoc v3.21.6 // source: server.proto package server import ( protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" reflect "reflect" sync "sync" ) const ( // Verify that this generated code is sufficiently up-to-date. _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) // Verify that runtime/protoimpl is sufficiently up-to-date. _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) ) type CreateSessionRequest struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields HostUser string `protobuf:"bytes,1,opt,name=hostUser,proto3" json:"hostUser,omitempty"` HostPublicKeys [][]byte `protobuf:"bytes,2,rep,name=hostPublicKeys,proto3" json:"hostPublicKeys,omitempty"` ClientAuthorizedKeys [][]byte `protobuf:"bytes,3,rep,name=clientAuthorizedKeys,proto3" json:"clientAuthorizedKeys,omitempty"` } func (x *CreateSessionRequest) Reset() { *x = CreateSessionRequest{} if protoimpl.UnsafeEnabled { mi := &file_server_proto_msgTypes[0] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *CreateSessionRequest) String() string { return protoimpl.X.MessageStringOf(x) } func (*CreateSessionRequest) ProtoMessage() {} func (x *CreateSessionRequest) ProtoReflect() protoreflect.Message { mi := &file_server_proto_msgTypes[0] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use CreateSessionRequest.ProtoReflect.Descriptor instead. func (*CreateSessionRequest) Descriptor() ([]byte, []int) { return file_server_proto_rawDescGZIP(), []int{0} } func (x *CreateSessionRequest) GetHostUser() string { if x != nil { return x.HostUser } return "" } func (x *CreateSessionRequest) GetHostPublicKeys() [][]byte { if x != nil { return x.HostPublicKeys } return nil } func (x *CreateSessionRequest) GetClientAuthorizedKeys() [][]byte { if x != nil { return x.ClientAuthorizedKeys } return nil } type CreateSessionResponse struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields SessionID string `protobuf:"bytes,1,opt,name=sessionID,proto3" json:"sessionID,omitempty"` NodeAddr string `protobuf:"bytes,2,opt,name=nodeAddr,proto3" json:"nodeAddr,omitempty"` SshUser string `protobuf:"bytes,3,opt,name=ssh_user,json=sshUser,proto3" json:"ssh_user,omitempty"` // SSH username for client connections } func (x *CreateSessionResponse) Reset() { *x = CreateSessionResponse{} if protoimpl.UnsafeEnabled { mi := &file_server_proto_msgTypes[1] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *CreateSessionResponse) String() string { return protoimpl.X.MessageStringOf(x) } func (*CreateSessionResponse) ProtoMessage() {} func (x *CreateSessionResponse) ProtoReflect() protoreflect.Message { mi := &file_server_proto_msgTypes[1] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use CreateSessionResponse.ProtoReflect.Descriptor instead. func (*CreateSessionResponse) Descriptor() ([]byte, []int) { return file_server_proto_rawDescGZIP(), []int{1} } func (x *CreateSessionResponse) GetSessionID() string { if x != nil { return x.SessionID } return "" } func (x *CreateSessionResponse) GetNodeAddr() string { if x != nil { return x.NodeAddr } return "" } func (x *CreateSessionResponse) GetSshUser() string { if x != nil { return x.SshUser } return "" } type AuthRequest struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields ClientVersion string `protobuf:"bytes,1,opt,name=client_version,json=clientVersion,proto3" json:"client_version,omitempty"` RemoteAddr string `protobuf:"bytes,2,opt,name=remote_addr,json=remoteAddr,proto3" json:"remote_addr,omitempty"` AuthorizedKey []byte `protobuf:"bytes,3,opt,name=authorized_key,json=authorizedKey,proto3" json:"authorized_key,omitempty"` } func (x *AuthRequest) Reset() { *x = AuthRequest{} if protoimpl.UnsafeEnabled { mi := &file_server_proto_msgTypes[2] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } } func (x *AuthRequest) String() string { return protoimpl.X.MessageStringOf(x) } func (*AuthRequest) ProtoMessage() {} func (x *AuthRequest) ProtoReflect() protoreflect.Message { mi := &file_server_proto_msgTypes[2] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { ms.StoreMessageInfo(mi) } return ms } return mi.MessageOf(x) } // Deprecated: Use AuthRequest.ProtoReflect.Descriptor instead. func (*AuthRequest) Descriptor() ([]byte, []int) { return file_server_proto_rawDescGZIP(), []int{2} } func (x *AuthRequest) GetClientVersion() string { if x != nil { return x.ClientVersion } return "" } func (x *AuthRequest) GetRemoteAddr() string { if x != nil { return x.RemoteAddr } return "" } func (x *AuthRequest) GetAuthorizedKey() []byte { if x != nil { return x.AuthorizedKey } return nil } var File_server_proto protoreflect.FileDescriptor var file_server_proto_rawDesc = []byte{ 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x22, 0x8e, 0x01, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x26, 0x0a, 0x0e, 0x68, 0x6f, 0x73, 0x74, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e, 0x68, 0x6f, 0x73, 0x74, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x14, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x73, 0x22, 0x6c, 0x0a, 0x15, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x44, 0x12, 0x1a, 0x0a, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x73, 0x68, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x73, 0x68, 0x55, 0x73, 0x65, 0x72, 0x22, 0x7c, 0x0a, 0x0b, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x77, 0x65, 0x6e, 0x74, 0x68, 0x65, 0x72, 0x65, 0x61, 0x6c, 0x2f, 0x75, 0x70, 0x74, 0x65, 0x72, 0x6d, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( file_server_proto_rawDescOnce sync.Once file_server_proto_rawDescData = file_server_proto_rawDesc ) func file_server_proto_rawDescGZIP() []byte { file_server_proto_rawDescOnce.Do(func() { file_server_proto_rawDescData = protoimpl.X.CompressGZIP(file_server_proto_rawDescData) }) return file_server_proto_rawDescData } var file_server_proto_msgTypes = make([]protoimpl.MessageInfo, 3) var file_server_proto_goTypes = []interface{}{ (*CreateSessionRequest)(nil), // 0: server.CreateSessionRequest (*CreateSessionResponse)(nil), // 1: server.CreateSessionResponse (*AuthRequest)(nil), // 2: server.AuthRequest } var file_server_proto_depIdxs = []int32{ 0, // [0:0] is the sub-list for method output_type 0, // [0:0] is the sub-list for method input_type 0, // [0:0] is the sub-list for extension type_name 0, // [0:0] is the sub-list for extension extendee 0, // [0:0] is the sub-list for field type_name } func init() { file_server_proto_init() } func file_server_proto_init() { if File_server_proto != nil { return } if !protoimpl.UnsafeEnabled { file_server_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*CreateSessionRequest); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } file_server_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*CreateSessionResponse); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } file_server_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*AuthRequest); i { case 0: return &v.state case 1: return &v.sizeCache case 2: return &v.unknownFields default: return nil } } } type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: file_server_proto_rawDesc, NumEnums: 0, NumMessages: 3, NumExtensions: 0, NumServices: 0, }, GoTypes: file_server_proto_goTypes, DependencyIndexes: file_server_proto_depIdxs, MessageInfos: file_server_proto_msgTypes, }.Build() File_server_proto = out.File file_server_proto_rawDesc = nil file_server_proto_goTypes = nil file_server_proto_depIdxs = nil } upterm-0.17.0/server/server.proto000066400000000000000000000007461507434540500170320ustar00rootroot00000000000000syntax = "proto3"; package server; option go_package = "github.com/owenthereal/upterm/server"; message CreateSessionRequest { string hostUser = 1; repeated bytes hostPublicKeys = 2; repeated bytes clientAuthorizedKeys = 3; } message CreateSessionResponse { string sessionID = 1; string nodeAddr = 2; string ssh_user = 3; // SSH username for client connections } message AuthRequest { string client_version = 1; string remote_addr = 2; bytes authorized_key = 3; } upterm-0.17.0/server/session.go000066400000000000000000000716461507434540500164600ustar00rootroot00000000000000package server import ( "encoding/json" "errors" "fmt" "net/http" "net/url" "path" "reflect" "strings" "sync" "time" "log/slog" "github.com/avast/retry-go/v4" "github.com/hashicorp/consul/api" "github.com/hashicorp/consul/api/watch" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/utils" "golang.org/x/crypto/ssh" ) // ErrSessionNotFound represents a non-retryable session not found error type ErrSessionNotFound struct { SessionID string } func (e *ErrSessionNotFound) Error() string { return fmt.Sprintf("session %s not found", e.SessionID) } const ( DefaultSessionTTL = 30 * time.Minute // Default TTL for session data in Consul DefaultConsulTimeout = 5 * time.Second // Default timeout for Consul operations DefaultWatchTimeout = 10 * time.Minute // Default timeout for Consul watch operations (long-polling) DefaultMaxRetries = 3 // Default number of retries for Consul operations DefaultRetryDelay = 100 * time.Millisecond // Default delay between retries DefaultKeyPrefix = "uptermd" // Default key prefix for Consul storage UnusedNodeAddress = "localhost" // Placeholder address for node registration (not used but required by Consul) ) // Session represents the complete session information type Session struct { ID string NodeAddr string HostUser string HostPublicKeys []ssh.PublicKey ClientAuthorizedKeys []ssh.PublicKey } // MarshalJSON implements custom JSON marshaling for Session func (s *Session) MarshalJSON() ([]byte, error) { type sessionJSON struct { ID string NodeAddr string HostUser string HostPublicKeys [][]byte ClientAuthorizedKeys [][]byte } var hostKeys [][]byte for _, key := range s.HostPublicKeys { hostKeys = append(hostKeys, ssh.MarshalAuthorizedKey(key)) } var clientKeys [][]byte for _, key := range s.ClientAuthorizedKeys { clientKeys = append(clientKeys, ssh.MarshalAuthorizedKey(key)) } return json.Marshal(sessionJSON{ ID: s.ID, NodeAddr: s.NodeAddr, HostUser: s.HostUser, HostPublicKeys: hostKeys, ClientAuthorizedKeys: clientKeys, }) } // UnmarshalJSON implements custom JSON unmarshaling for Session func (s *Session) UnmarshalJSON(data []byte) error { type sessionJSON struct { ID string NodeAddr string HostUser string HostPublicKeys [][]byte ClientAuthorizedKeys [][]byte } var temp sessionJSON if err := json.Unmarshal(data, &temp); err != nil { return err } s.ID = temp.ID s.NodeAddr = temp.NodeAddr s.HostUser = temp.HostUser // Parse host public keys for _, keyBytes := range temp.HostPublicKeys { key, _, _, _, err := ssh.ParseAuthorizedKey(keyBytes) if err != nil { return fmt.Errorf("failed to parse host public key: %w", err) } s.HostPublicKeys = append(s.HostPublicKeys, key) } // Parse client authorized keys for _, keyBytes := range temp.ClientAuthorizedKeys { key, _, _, _, err := ssh.ParseAuthorizedKey(keyBytes) if err != nil { return fmt.Errorf("failed to parse client authorized key: %w", err) } s.ClientAuthorizedKeys = append(s.ClientAuthorizedKeys, key) } return nil } // IsClientKeyAllowed checks if a client key is authorized for this session func (s *Session) IsClientKeyAllowed(key ssh.PublicKey) bool { if len(s.ClientAuthorizedKeys) == 0 { return true } for _, k := range s.ClientAuthorizedKeys { if utils.KeysEqual(k, key) { return true } } return false } // SessionStore defines the interface for session storage type SessionStore interface { // Store complete session data Store(session *Session) error // Get complete session data Get(sessionID string) (*Session, error) // Delete session data Delete(sessionID string) error // BatchDelete multiple sessions efficiently BatchDelete(sessionIDs []string) error // List all sessions (for cleanup and management) List() ([]*Session, error) // Close cleans up resources and stops background processes Close() error } // sessionCache provides thread-safe in-memory caching for sessions type sessionCache struct { sessions map[string]*Session mutex sync.RWMutex logger *slog.Logger } // newSessionCache creates a new session cache func newSessionCache(logger *slog.Logger) *sessionCache { return &sessionCache{ sessions: make(map[string]*Session), logger: logger, } } // Get retrieves a session from cache func (c *sessionCache) Get(sessionID string) (*Session, bool) { c.mutex.RLock() defer c.mutex.RUnlock() session, exists := c.sessions[sessionID] return session, exists } // Has checks if a session exists in cache without retrieving it (useful for testing) func (c *sessionCache) Has(sessionID string) bool { c.mutex.RLock() defer c.mutex.RUnlock() _, exists := c.sessions[sessionID] return exists } // Set stores a session in cache func (c *sessionCache) Set(sessionID string, session *Session) { c.mutex.Lock() defer c.mutex.Unlock() c.sessions[sessionID] = session c.logger.Debug("cached session", "session", sessionID) } // Delete removes a session from cache func (c *sessionCache) Delete(sessionID string) { c.mutex.Lock() defer c.mutex.Unlock() delete(c.sessions, sessionID) c.logger.Debug("removed session from cache", "session", sessionID) } // BatchDelete removes multiple sessions from cache func (c *sessionCache) BatchDelete(sessionIDs []string) { c.mutex.Lock() defer c.mutex.Unlock() for _, sessionID := range sessionIDs { delete(c.sessions, sessionID) } c.logger.Debug("batch removed sessions from cache", "count", len(sessionIDs)) } // ReplaceAll atomically replaces all sessions in cache func (c *sessionCache) ReplaceAll(newSessions map[string]*Session) (added, updated, deleted int) { c.mutex.Lock() defer c.mutex.Unlock() // Calculate changes for logging for sessionID, newSession := range newSessions { if oldSession, exists := c.sessions[sessionID]; exists { if !reflect.DeepEqual(oldSession, newSession) { updated++ } } else { added++ } } // Count deleted sessions for sessionID := range c.sessions { if _, exists := newSessions[sessionID]; !exists { deleted++ } } // Replace the entire session map atomically c.sessions = newSessions if added > 0 || updated > 0 || deleted > 0 { c.logger.Info("updated session cache", "total", len(newSessions), "added", added, "updated", updated, "deleted", deleted) } return added, updated, deleted } // consulSessionStore implements SessionStore using Consul KV with hybrid read-through cache type consulSessionStore struct { client *api.Client logger *slog.Logger ttl time.Duration keyPrefix string // Hybrid cache for instant lookups with fallback to Consul cache *sessionCache // Watch management watchPlan *watch.Plan } // newConsulSessionStore creates a new ConsulSessionStore func newConsulSessionStore(consulURL *url.URL, ttl time.Duration, logger *slog.Logger) (*consulSessionStore, error) { config := api.DefaultConfig() config.Address = consulURL.Host config.Scheme = consulURL.Scheme config.HttpClient = &http.Client{ Timeout: DefaultConsulTimeout, Transport: &http.Transport{ MaxIdleConns: 100, MaxIdleConnsPerHost: 20, IdleConnTimeout: 90 * time.Second, DisableKeepAlives: false, }, } if u := consulURL.User; u != nil { config.Token, _ = u.Password() } client, err := api.NewClient(config) if err != nil { return nil, fmt.Errorf("failed to create consul client: %w", err) } var keyPrefix string if v := strings.TrimPrefix(consulURL.Path, "/"); v != "" { keyPrefix = v } else { keyPrefix = DefaultKeyPrefix } if ttl == 0 { ttl = DefaultSessionTTL } store := &consulSessionStore{ client: client, logger: logger, ttl: ttl, keyPrefix: keyPrefix, cache: newSessionCache(logger), } // Register the node with Consul if err := store.registerNode(); err != nil { return nil, fmt.Errorf("failed to register node with consul: %w", err) } // Initialize session replication by starting the watch if err := store.startSessionWatch(config); err != nil { return nil, fmt.Errorf("failed to start session watch: %w", err) } return store, nil } // Store complete session data in Consul func (c *consulSessionStore) Store(session *Session) error { if session == nil { return fmt.Errorf("session cannot be nil") } if session.ID == "" { return fmt.Errorf("session ID cannot be empty") } // Outside retry: deterministic operations kvStoreKey := c.SessionKey(session.ID) // Serialize session data as JSON first to fail fast on marshaling errors sessionData, err := json.Marshal(session) if err != nil { return fmt.Errorf("failed to marshal session data: %w", err) } // Create a Consul session for distributed locking and TTL management consulLockSession := c.createConsulLockSession(session.ID) // Inside retry: only network operations err = retry.Do( func() error { consulLockSessionID, _, err := c.client.Session().CreateNoChecks(consulLockSession, nil) if err != nil { return fmt.Errorf("failed to create consul lock session: %w", err) } // Store the complete session data with distributed lock and TTL kvPair := &api.KVPair{ Key: kvStoreKey, Value: sessionData, Session: consulLockSessionID, } lockAcquired, _, err := c.client.KV().Acquire(kvPair, nil) if err != nil { return fmt.Errorf("failed to store session data: %w", err) } if !lockAcquired { return fmt.Errorf("failed to acquire distributed lock for session %s", session.ID) } return nil }, retry.Attempts(DefaultMaxRetries), retry.Delay(DefaultRetryDelay), retry.OnRetry(func(n uint, err error) { c.logger.Debug("retrying consul store operation", "operation", "store", "attempt", n+1, "error", err, ) }), ) if err != nil { return err } // Immediately update local cache for strong consistency c.cache.Set(session.ID, session) c.logger.Debug("stored session data in consul and cache", "session", session.ID, "node", session.NodeAddr, "key", kvStoreKey, ) return nil } // Get session data with hybrid read-through cache func (c *consulSessionStore) Get(sessionID string) (*Session, error) { if sessionID == "" { return nil, fmt.Errorf("session ID cannot be empty") } // Try local cache first for instant lookup if session, exists := c.cache.Get(sessionID); exists { c.logger.Debug("retrieved session data from cache", "session", sessionID, "node", session.NodeAddr, ) return session, nil } // Cache miss - fetch from Consul for strong consistency return c.getFromConsulAndCache(sessionID) } // getFromConsulAndCache fetches session from Consul and updates local cache func (c *consulSessionStore) getFromConsulAndCache(sessionID string) (*Session, error) { kvStoreKey := c.SessionKey(sessionID) var session *Session err := retry.Do( func() error { kvPair, _, err := c.client.KV().Get(kvStoreKey, nil) if err != nil { return fmt.Errorf("failed to get session data: %w", err) } if kvPair == nil { return &ErrSessionNotFound{SessionID: sessionID} } var s Session if err := json.Unmarshal(kvPair.Value, &s); err != nil { return fmt.Errorf("failed to unmarshal session data: %w", err) } session = &s return nil }, retry.Attempts(DefaultMaxRetries), retry.Delay(DefaultRetryDelay), retry.RetryIf(func(err error) bool { // Don't retry if session is not found - it's a business logic error, not a network error var notFoundErr *ErrSessionNotFound return !errors.As(err, ¬FoundErr) }), retry.OnRetry(func(n uint, err error) { c.logger.Debug("retrying consul get operation", "operation", "get_from_consul", "attempt", n+1, "error", err, ) }), ) if err != nil { return nil, err } // Update local cache with fetched data c.cache.Set(sessionID, session) c.logger.Debug("retrieved session data from consul and cached", "session", sessionID, "node", session.NodeAddr, ) return session, nil } // Delete session data from Consul func (c *consulSessionStore) Delete(sessionID string) error { if sessionID == "" { return fmt.Errorf("session ID cannot be empty") } // Outside retry: deterministic operations kvStoreKey := c.SessionKey(sessionID) // Inside retry: only network operations err := retry.Do( func() error { _, err := c.client.KV().Delete(kvStoreKey, nil) if err != nil { return fmt.Errorf("failed to delete session data: %w", err) } return nil }, retry.Attempts(DefaultMaxRetries), retry.Delay(DefaultRetryDelay), retry.OnRetry(func(n uint, err error) { c.logger.Debug("retrying consul delete operation", "operation", "delete", "attempt", n+1, "error", err, ) }), ) if err != nil { return err } // Immediately remove from local cache for strong consistency c.cache.Delete(sessionID) c.logger.Debug("deleted session data from consul and cache", "session", sessionID, "key", kvStoreKey, ) return nil } // BatchDelete multiple sessions efficiently using Consul transactions func (c *consulSessionStore) BatchDelete(sessionIDs []string) error { if len(sessionIDs) == 0 { return nil } // Consul's official transaction limit is 64 operations // Reference: https://developer.hashicorp.com/consul/api-docs/txn const maxBatchSize = 64 for i := 0; i < len(sessionIDs); i += maxBatchSize { end := min(i+maxBatchSize, len(sessionIDs)) if err := c.deleteBatch(sessionIDs[i:end]); err != nil { return err } } // Immediately remove from local cache for strong consistency c.cache.BatchDelete(sessionIDs) c.logger.Debug("batch deleted sessions from consul and cache", "count", len(sessionIDs)) return nil } // deleteBatch deletes a batch of sessions using Consul transaction func (c *consulSessionStore) deleteBatch(sessionIDs []string) error { ops := make([]*api.KVTxnOp, len(sessionIDs)) for i, sessionID := range sessionIDs { kvStoreKey := c.SessionKey(sessionID) ops[i] = &api.KVTxnOp{ Verb: api.KVDelete, Key: kvStoreKey, } } return retry.Do( func() error { ok, response, _, err := c.client.KV().Txn(ops, nil) if err != nil { return fmt.Errorf("failed to execute batch delete transaction: %w", err) } if !ok { return fmt.Errorf("batch delete transaction failed: %v", response.Errors) } return nil }, retry.Attempts(DefaultMaxRetries), retry.Delay(DefaultRetryDelay), retry.OnRetry(func(n uint, err error) { c.logger.Debug("retrying consul batch delete operation", "operation", "batch_delete", "attempt", n+1, "count", len(sessionIDs), "error", err, ) }), ) } // List all sessions from Consul func (c *consulSessionStore) List() ([]*Session, error) { var sessions []*Session err := retry.Do( func() error { pairs, _, err := c.client.KV().List(c.SessionsKey(), nil) if err != nil { return fmt.Errorf("failed to list sessions: %w", err) } sessions = make([]*Session, 0, len(pairs)) for _, pair := range pairs { var session Session if err := json.Unmarshal(pair.Value, &session); err != nil { // Skip invalid sessions but continue processing c.logger.Warn("failed to unmarshal session, skipping", "error", err, "key", pair.Key) continue } sessions = append(sessions, &session) } return nil }, retry.Attempts(DefaultMaxRetries), retry.Delay(DefaultRetryDelay), retry.OnRetry(func(n uint, err error) { c.logger.Debug("retrying consul list operation", "operation", "list", "attempt", n+1, "error", err, ) }), ) if err != nil { return nil, err } c.logger.Debug("listed sessions from consul", "count", len(sessions)) return sessions, nil } func (c *consulSessionStore) NodeName() string { return path.Join(c.keyPrefix, DefaultKeyPrefix) } // SessionKey generates the Consul KV store key for a session func (c *consulSessionStore) SessionKey(sessionID string) string { return path.Join(c.keyPrefix, "sessions", sessionID) } func (c *consulSessionStore) SessionsKey() string { return path.Join(c.keyPrefix, "sessions") } // KeyPrefix returns the root key prefix used by this store (useful for cleanup in tests) func (c *consulSessionStore) KeyPrefix() string { return c.keyPrefix + "/" } // registerNode registers this node with Consul func (c *consulSessionStore) registerNode() error { _, err := c.client.Catalog().Register(&api.CatalogRegistration{ Node: c.NodeName(), Address: UnusedNodeAddress, // not used but required }, nil) if err != nil { return fmt.Errorf("register node %q: %w", c.NodeName(), err) } return nil } // createConsulLockSession creates a Consul session for distributed locking func (c *consulSessionStore) createConsulLockSession(sessionID string) *api.SessionEntry { return &api.SessionEntry{ Name: sessionID, Node: c.NodeName(), TTL: c.ttl.String(), Behavior: api.SessionBehaviorDelete, LockDelay: time.Second, } } // startSessionWatch initializes the Consul watch to maintain full session replica func (c *consulSessionStore) startSessionWatch(cfg *api.Config) error { // Create watch plan for all sessions params := map[string]interface{}{ "type": "keyprefix", "prefix": c.SessionsKey(), "token": cfg.Token, } watchPlan, err := watch.Parse(params) if err != nil { return fmt.Errorf("failed to create watch plan: %w", err) } // Set up the handler to update local session replica watchPlan.Handler = func(idx uint64, data interface{}) { if kvPairs, ok := data.(api.KVPairs); ok { c.updateSessionReplica(kvPairs) } } c.watchPlan = watchPlan // Create a separate config for watch operations with longer timeout // Consul watches use long-polling and need extended timeouts watchConfig := *cfg // Copy the config watchConfig.HttpClient = &http.Client{ Timeout: DefaultWatchTimeout, // Allow long-polling for Consul watches Transport: &http.Transport{ MaxIdleConns: 100, MaxIdleConnsPerHost: 20, IdleConnTimeout: 90 * time.Second, DisableKeepAlives: false, }, } // Start watching in background go func() { c.logger.Info("starting session watch for full replication") if err := watchPlan.RunWithConfig(watchConfig.Address, &watchConfig); err != nil { c.logger.Error("session watch failed", "error", err) } }() return nil } // updateSessionReplica updates the local session replica based on Consul data func (c *consulSessionStore) updateSessionReplica(kvPairs api.KVPairs) { // Create new session map from Consul data newSessions := make(map[string]*Session) for _, kvPair := range kvPairs { var session Session if err := json.Unmarshal(kvPair.Value, &session); err != nil { c.logger.Warn("failed to unmarshal session data", "error", err, "key", kvPair.Key) continue } // Use session.ID from the unmarshaled value directly newSessions[session.ID] = &session } // Atomically replace cache contents and get change statistics c.cache.ReplaceAll(newSessions) } // Close gracefully stops the session watch and cleans up resources func (c *consulSessionStore) Close() error { if c.watchPlan != nil { c.watchPlan.Stop() } return nil } // HasInCache checks if a session exists in the local cache (useful for testing watch functionality) func (c *consulSessionStore) HasInCache(sessionID string) bool { return c.cache.Has(sessionID) } // memorySessionStore is a simple in-memory implementation for testing/fallback type memorySessionStore struct { sessions map[string]*Session logger *slog.Logger mutex sync.RWMutex } // newMemorySessionStore creates a new MemorySessionStore func newMemorySessionStore(logger *slog.Logger) *memorySessionStore { return &memorySessionStore{ sessions: make(map[string]*Session), logger: logger, } } func (m *memorySessionStore) Store(session *Session) error { m.mutex.Lock() defer m.mutex.Unlock() m.sessions[session.ID] = session m.logger.Debug("stored session data in memory", "session", session.ID, "node", session.NodeAddr, ) return nil } func (m *memorySessionStore) Get(sessionID string) (*Session, error) { m.mutex.RLock() defer m.mutex.RUnlock() session, exists := m.sessions[sessionID] if !exists { return nil, &ErrSessionNotFound{SessionID: sessionID} } return session, nil } func (m *memorySessionStore) Delete(sessionID string) error { m.mutex.Lock() defer m.mutex.Unlock() delete(m.sessions, sessionID) m.logger.Debug("deleted session data from memory", "session", sessionID, ) return nil } // BatchDelete multiple sessions efficiently from memory func (m *memorySessionStore) BatchDelete(sessionIDs []string) error { m.mutex.Lock() defer m.mutex.Unlock() for _, sessionID := range sessionIDs { delete(m.sessions, sessionID) } m.logger.Debug("batch deleted sessions from memory", "count", len(sessionIDs)) return nil } // List all sessions from memory func (m *memorySessionStore) List() ([]*Session, error) { m.mutex.RLock() defer m.mutex.RUnlock() sessions := make([]*Session, 0, len(m.sessions)) for _, session := range m.sessions { sessions = append(sessions, session) } m.logger.Debug("listed sessions from memory", "count", len(sessions)) return sessions, nil } // Close cleans up memory store resources (no-op for memory store) func (m *memorySessionStore) Close() error { return nil } // NewSession creates Session from session parameters func NewSession(sessionID, nodeAddr, hostUser string, hostPublicKeys, clientAuthorizedKeys [][]byte) *Session { var hostKeys []ssh.PublicKey for _, keyBytes := range hostPublicKeys { if key, _, _, _, err := ssh.ParseAuthorizedKey(keyBytes); err == nil { hostKeys = append(hostKeys, key) } } var clientKeys []ssh.PublicKey for _, keyBytes := range clientAuthorizedKeys { if key, _, _, _, err := ssh.ParseAuthorizedKey(keyBytes); err == nil { clientKeys = append(clientKeys, key) } } return &Session{ ID: sessionID, NodeAddr: nodeAddr, HostUser: hostUser, HostPublicKeys: hostKeys, ClientAuthorizedKeys: clientKeys, } } // SessionManager provides a high-level interface for session management, // combining session storage with connection ID encoding based on routing mode type SessionManager struct { store SessionStore encodeDecoder routing.EncodeDecoder } // SessionManagerConfig holds configuration for creating a SessionManager type SessionManagerConfig struct { Mode routing.Mode Logger *slog.Logger ConsulURL *url.URL ConsulTTL time.Duration } // SessionManagerOption is a functional option for configuring SessionManager type SessionManagerOption func(*SessionManagerConfig) // WithSessionManagerLogger sets the logger for the session manager func WithSessionManagerLogger(logger *slog.Logger) SessionManagerOption { return func(c *SessionManagerConfig) { c.Logger = logger } } // WithSessionManagerConsulURL sets the Consul URL for consul mode func WithSessionManagerConsulURL(consulURL *url.URL) SessionManagerOption { return func(c *SessionManagerConfig) { c.ConsulURL = consulURL } } // WithSessionManagerConsulTTL sets the session TTL for consul mode func WithSessionManagerConsulTTL(ttl time.Duration) SessionManagerOption { return func(c *SessionManagerConfig) { c.ConsulTTL = ttl } } // NewSessionManager creates a new SessionManager with the specified routing mode and options // // Examples: // // // Embedded mode (simple, with default logger) // sm, err := NewSessionManager(routing.ModeEmbedded) // // // Embedded mode with custom logger // sm, err := NewSessionManager(routing.ModeEmbedded, WithSessionManagerLogger(logger)) // // // Consul mode with minimal configuration // sm, err := NewSessionManager(routing.ModeConsul, WithSessionManagerConsulURL("http://localhost:8500")) // // // Consul mode with full configuration // sm, err := NewSessionManager(routing.ModeConsul, // WithSessionManagerLogger(logger), // WithSessionManagerConsulURL("http://consul.example.com:8500"), // WithSessionManagerConsulTTL(1*time.Hour)) func NewSessionManager(mode routing.Mode, opts ...SessionManagerOption) (*SessionManager, error) { config := &SessionManagerConfig{ Mode: mode, Logger: slog.Default(), ConsulTTL: DefaultSessionTTL, } // Apply all options for _, opt := range opts { opt(config) } switch mode { case routing.ModeEmbedded: return newEmbeddedSessionManager(config.Logger), nil case routing.ModeConsul: return newConsulSessionManager(config.ConsulURL, config.ConsulTTL, config.Logger) default: return nil, fmt.Errorf("unsupported routing mode: %s", mode) } } // newSessionManagerWithStore creates a SessionManager with explicit store and encoder (for advanced testing) func newSessionManagerWithStore(store SessionStore, encodeDecoder routing.EncodeDecoder) *SessionManager { return &SessionManager{ store: store, encodeDecoder: encodeDecoder, } } // newEmbeddedSessionManager creates a SessionManager for embedded mode with memory storage func newEmbeddedSessionManager(logger *slog.Logger) *SessionManager { store := newMemorySessionStore(logger) encodeDecoder := routing.NewEncodeDecoder(routing.ModeEmbedded) return newSessionManagerWithStore(store, encodeDecoder) } // newConsulSessionManager creates a SessionManager for consul mode with Consul storage func newConsulSessionManager(consulURL *url.URL, ttl time.Duration, logger *slog.Logger) (*SessionManager, error) { store, err := newConsulSessionStore(consulURL, ttl, logger) if err != nil { return nil, err } encodeDecoder := routing.NewEncodeDecoder(routing.ModeConsul) return newSessionManagerWithStore(store, encodeDecoder), nil } // CreateSession stores the session and returns the encoded SSH user identifier func (sm *SessionManager) CreateSession(session *Session) (string, error) { if err := sm.store.Store(session); err != nil { return "", err } // Encode the SSH user identifier using the encoder return sm.encodeDecoder.Encode(session.ID, session.NodeAddr), nil } // GetSession retrieves a session by ID func (sm *SessionManager) GetSession(sessionID string) (*Session, error) { return sm.store.Get(sessionID) } // DeleteSession removes a session by ID func (sm *SessionManager) DeleteSession(sessionID string) error { return sm.store.Delete(sessionID) } // shouldValidateSessionExistence returns true if session existence should be validated // based on the current routing mode and operational requirements. // // Both embedded and Consul modes are valid deployment options: // - Embedded mode: For single-node or simple deployments without external dependencies // - Consul mode: For multi-node deployments requiring shared session state func (sm *SessionManager) shouldValidateSessionExistence() bool { // In Consul mode: validate existence (shared store accessible across all nodes) // In embedded mode: skip validation (session data is local to each node) return sm.encodeDecoder.Mode() == routing.ModeConsul } // ResolveSSHUser resolves an SSH username by decoding it and conditionally validating session existence // In embedded mode: only decodes (session may be on another node) // In consul mode: decodes and validates (shared store across all nodes) func (sm *SessionManager) ResolveSSHUser(sshUser string) (sessionID, nodeAddr string, err error) { // Decode the SSH user using our encoder sessionID, nodeAddr, err = sm.encodeDecoder.Decode(sshUser) if err != nil { return "", "", fmt.Errorf("failed to decode SSH user: %w", err) } // Validate session existence based on routing mode strategy if sm.shouldValidateSessionExistence() { session, err := sm.store.Get(sessionID) if err != nil { return "", "", fmt.Errorf("session %s not found: %w", sessionID, err) } return session.ID, session.NodeAddr, nil } return sessionID, nodeAddr, nil } // GetEncodeDecoder returns the EncodeDecoder used by this session manager func (sm *SessionManager) GetEncodeDecoder() routing.EncodeDecoder { return sm.encodeDecoder } // GetRoutingMode returns the routing mode of this session manager func (sm *SessionManager) GetRoutingMode() routing.Mode { return sm.encodeDecoder.Mode() } // GetStore returns the underlying SessionStore for compatibility func (sm *SessionManager) GetStore() SessionStore { return sm.store } // Shutdown cleans up sessions created by this node during server shutdown func (sm *SessionManager) Shutdown(nodeAddr string) error { // Get all sessions sessions, err := sm.store.List() if err != nil { return fmt.Errorf("failed to list sessions for cleanup: %w", err) } if len(sessions) > 0 { // Collect session IDs for this node var sessionIDsToDelete []string for _, session := range sessions { if session.NodeAddr == nodeAddr { sessionIDsToDelete = append(sessionIDsToDelete, session.ID) } } // Batch delete sessions for this node if len(sessionIDsToDelete) > 0 { if err := sm.store.BatchDelete(sessionIDsToDelete); err != nil { return fmt.Errorf("failed to batch delete sessions during shutdown: %w", err) } } } // Close the store to clean up resources (e.g., stop watch goroutines) if err := sm.store.Close(); err != nil { return fmt.Errorf("failed to close session store: %w", err) } return nil } upterm-0.17.0/server/session_test.go000066400000000000000000000413441507434540500175070ustar00rootroot00000000000000package server import ( "fmt" "log/slog" "net/url" "testing" "time" "github.com/hashicorp/consul/api" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/internal/testhelpers" "github.com/owenthereal/upterm/routing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/suite" ) var ( // Shared debug logger for session tests sessionTestLogger = logging.Must(logging.Console(), logging.Debug()).Logger ) // This file contains comprehensive tests for the session management system. // Tests are organized by layers with proper separation of concerns: // // SessionManager Layer (behavior tests): // - EmbeddedSessionManagerTestSuite: Tests SessionManager with embedded routing // - ConsulSessionManagerTestSuite: Tests SessionManager with consul routing // // Store Layer (implementation tests): // - MemoryStoreTestSuite: Tests memory store operations directly // - ConsulStoreTestSuite: Tests consul store operations and replication // // SessionManager Layer Tests - Focus on routing mode behavior // // EmbeddedSessionManagerTestSuite tests SessionManager behavior in embedded mode type EmbeddedSessionManagerTestSuite struct { suite.Suite sm *SessionManager logger *slog.Logger } func (suite *EmbeddedSessionManagerTestSuite) SetupTest() { suite.logger = sessionTestLogger suite.sm = newEmbeddedSessionManager(suite.logger) } func (suite *EmbeddedSessionManagerTestSuite) TestCreateAndResolveSession() { sessionID := "test-session-123" nodeAddr := "127.0.0.1:2222" session := &Session{ ID: sessionID, NodeAddr: nodeAddr, } // Test CreateSession returns encoded SSH user for embedded mode sshUser, err := suite.sm.CreateSession(session) suite.NoError(err) suite.Contains(sshUser, sessionID) suite.Contains(sshUser, ":") // embedded mode uses "sessionID:base64(nodeAddr)" format // Test ResolveSSHUser decodes correctly resolvedSessionID, resolvedNodeAddr, err := suite.sm.ResolveSSHUser(sshUser) suite.NoError(err) suite.Equal(sessionID, resolvedSessionID) suite.Equal(nodeAddr, resolvedNodeAddr) // Test GetSession retrieves the session retrievedSession, err := suite.sm.GetSession(sessionID) suite.NoError(err) suite.Equal(sessionID, retrievedSession.ID) suite.Equal(nodeAddr, retrievedSession.NodeAddr) } func (suite *EmbeddedSessionManagerTestSuite) TestResolveSSHUser_DoesNotValidateExistence() { // In embedded mode, ResolveSSHUser should not validate session existence // because sessions may exist on other nodes in distributed deployments sessionID := "nonexistent-session" nodeAddr := "127.0.0.1:2222" // Create SSH user for non-existent session using embedded encoding encodeDecoder := suite.sm.GetEncodeDecoder() sshUser := encodeDecoder.Encode(sessionID, nodeAddr) // Should return session info even if it doesn't exist in store resolvedSessionID, resolvedNodeAddr, err := suite.sm.ResolveSSHUser(sshUser) suite.NoError(err) suite.Equal(sessionID, resolvedSessionID) suite.Equal(nodeAddr, resolvedNodeAddr) } func (suite *EmbeddedSessionManagerTestSuite) TestResolveSSHUser_InvalidFormats() { testCases := []struct { input string description string }{ {"no-colon-here", "no colon separator"}, {"", "empty string"}, {"session:invalid-base64===!@#$", "invalid base64 characters"}, } for _, tc := range testCases { suite.Run(tc.description, func() { _, _, err := suite.sm.ResolveSSHUser(tc.input) suite.Error(err) }) } } func (suite *EmbeddedSessionManagerTestSuite) TestRoutingMode() { suite.Equal(routing.ModeEmbedded, suite.sm.GetRoutingMode()) } func (suite *EmbeddedSessionManagerTestSuite) TestDeleteSession() { sessionID := "test-delete-session" session := &Session{ ID: sessionID, NodeAddr: "127.0.0.1:2222", } // Create session _, err := suite.sm.CreateSession(session) suite.NoError(err) // Verify it exists _, err = suite.sm.GetSession(sessionID) suite.NoError(err) // Delete session err = suite.sm.DeleteSession(sessionID) suite.NoError(err) // Verify it's deleted _, err = suite.sm.GetSession(sessionID) suite.Error(err) } // ConsulSessionManagerTestSuite tests SessionManager behavior in consul mode type ConsulSessionManagerTestSuite struct { suite.Suite sm *SessionManager client *api.Client } func (suite *ConsulSessionManagerTestSuite) SetupSuite() { // Skip if Consul is not available if !testhelpers.IsConsulAvailable() { suite.T().Skip("Consul not available - set CONSUL_URL or ensure Consul is running on localhost:8500") } consulURL, err := url.Parse(testhelpers.ConsulURL()) suite.Require().NoError(err) sm, err := newConsulSessionManager(consulURL, 5*time.Minute, sessionTestLogger) suite.Require().NoError(err) suite.sm = sm // Setup client for cleanup client, err := testhelpers.ConsulClient() suite.Require().NoError(err) suite.client = client } func (suite *ConsulSessionManagerTestSuite) TearDownSuite() { if suite.client != nil && suite.sm != nil { // Clean up test data using the actual key prefix from the store if store, ok := suite.sm.GetStore().(*consulSessionStore); ok { _, err := suite.client.KV().DeleteTree(store.KeyPrefix(), nil) suite.NoError(err) } } } func (suite *ConsulSessionManagerTestSuite) TestCreateAndResolveSession() { sessionID := fmt.Sprintf("test-consul-session-%d", time.Now().UnixNano()) nodeAddr := "192.168.1.100:2222" session := &Session{ ID: sessionID, NodeAddr: nodeAddr, HostUser: "testuser", } // Test CreateSession returns just session ID for consul mode sshUser, err := suite.sm.CreateSession(session) suite.NoError(err) suite.Equal(sessionID, sshUser) // Consul mode returns just session ID // Test GetSession retrieves the session immediately (strong consistency) retrievedSession, err := suite.sm.GetSession(sessionID) suite.NoError(err) suite.NotNil(retrievedSession) suite.Equal(sessionID, retrievedSession.ID) suite.Equal(nodeAddr, retrievedSession.NodeAddr) // Test ResolveSSHUser validates session existence and returns session info resolvedSessionID, resolvedNodeAddr, err := suite.sm.ResolveSSHUser(sessionID) suite.NoError(err) suite.Equal(sessionID, resolvedSessionID) suite.Equal(nodeAddr, resolvedNodeAddr) // Cleanup err = suite.sm.DeleteSession(sessionID) suite.NoError(err) } func (suite *ConsulSessionManagerTestSuite) TestResolveSSHUser_ValidatesExistence() { // In consul mode, ResolveSSHUser should validate session existence because // all nodes share the same Consul store sessionID := fmt.Sprintf("nonexistent-session-%d", time.Now().UnixNano()) // Try to resolve non-existent session - should fail _, _, err := suite.sm.ResolveSSHUser(sessionID) suite.Error(err, "Should fail for non-existent session in consul mode") // Create the session and try again session := &Session{ ID: sessionID, NodeAddr: "192.168.1.100:2222", } _, err = suite.sm.CreateSession(session) suite.NoError(err) // Now it should work immediately (strong consistency) resolvedSessionID, resolvedNodeAddr, err := suite.sm.ResolveSSHUser(sessionID) suite.NoError(err) suite.Equal(sessionID, resolvedSessionID) suite.Equal(session.NodeAddr, resolvedNodeAddr) // Clean up err = suite.sm.DeleteSession(sessionID) suite.NoError(err) } func (suite *ConsulSessionManagerTestSuite) TestRoutingMode() { suite.Equal(routing.ModeConsul, suite.sm.GetRoutingMode()) } // // Store Layer Tests - Focus on storage implementation details // // MemoryStoreTestSuite tests the memory store implementation directly type MemoryStoreTestSuite struct { suite.Suite store *memorySessionStore logger *slog.Logger } func (suite *MemoryStoreTestSuite) SetupTest() { suite.logger = sessionTestLogger suite.store = newMemorySessionStore(suite.logger) } func (suite *MemoryStoreTestSuite) TestStoreOperations() { sessionID := "test-memory-session" session := &Session{ ID: sessionID, NodeAddr: "127.0.0.1:2222", } // Test Store err := suite.store.Store(session) suite.NoError(err) // Test Store duplicate (should succeed - overwrites) err = suite.store.Store(session) suite.NoError(err) // Test Get retrievedSession, err := suite.store.Get(sessionID) suite.NoError(err) suite.Equal(session.ID, retrievedSession.ID) suite.Equal(session.NodeAddr, retrievedSession.NodeAddr) // Test Update (Store is used for both create and update) session.NodeAddr = "192.168.1.100:2222" err = suite.store.Store(session) suite.NoError(err) retrievedSession, err = suite.store.Get(sessionID) suite.NoError(err) suite.Equal("192.168.1.100:2222", retrievedSession.NodeAddr) // Test Delete err = suite.store.Delete(sessionID) suite.NoError(err) // Verify deletion _, err = suite.store.Get(sessionID) suite.Error(err) // Test Delete non-existent (should succeed - idempotent) err = suite.store.Delete("nonexistent") suite.NoError(err) } func (suite *MemoryStoreTestSuite) TestBatchOperations() { sessions := []*Session{ {ID: "batch-1", NodeAddr: "192.168.1.1:2222"}, {ID: "batch-2", NodeAddr: "192.168.1.2:2222"}, {ID: "batch-3", NodeAddr: "192.168.1.3:2222"}, } // Store all sessions for _, session := range sessions { err := suite.store.Store(session) suite.NoError(err) } // Test List allSessions, err := suite.store.List() suite.NoError(err) suite.Len(allSessions, 3) // Test BatchDelete sessionIDs := []string{"batch-1", "batch-2", "batch-3"} err = suite.store.BatchDelete(sessionIDs) suite.NoError(err) // Verify all deleted for _, sessionID := range sessionIDs { _, err = suite.store.Get(sessionID) suite.Error(err) } } func (suite *MemoryStoreTestSuite) TestClose() { // Memory store Close is a no-op but should not error err := suite.store.Close() suite.NoError(err) } // ConsulStoreTestSuite tests the consul store implementation directly including replication type ConsulStoreTestSuite struct { suite.Suite store1 *consulSessionStore // First store instance store2 *consulSessionStore // Second store instance client *api.Client } func (suite *ConsulStoreTestSuite) SetupSuite() { // Skip if Consul is not available if !testhelpers.IsConsulAvailable() { suite.T().Skip("Consul not available - set CONSUL_URL or ensure Consul is running on localhost:8500") } consulURL, err := url.Parse(testhelpers.ConsulURL()) suite.Require().NoError(err) // Create two store instances to simulate multi-node setup store1, err := newConsulSessionStore(consulURL, 5*time.Minute, sessionTestLogger) suite.Require().NoError(err) suite.store1 = store1 store2, err := newConsulSessionStore(consulURL, 5*time.Minute, sessionTestLogger) suite.Require().NoError(err) suite.store2 = store2 // Setup client for cleanup client, err := testhelpers.ConsulClient() suite.Require().NoError(err) suite.client = client } func (suite *ConsulStoreTestSuite) TearDownSuite() { if suite.store1 != nil { _ = suite.store1.Close() } if suite.store2 != nil { _ = suite.store2.Close() } if suite.client != nil { // Clean up test data using the actual key prefix from the store _, err := suite.client.KV().DeleteTree(suite.store1.KeyPrefix(), nil) suite.NoError(err) } } func (suite *ConsulStoreTestSuite) TestBasicStoreOperations() { sessionID := fmt.Sprintf("test-consul-basic-%d", time.Now().UnixNano()) session := &Session{ ID: sessionID, NodeAddr: "127.0.0.1:2222", HostUser: "testuser", } // Test Store err := suite.store1.Store(session) suite.NoError(err) // Test Get - should be immediately available (strong consistency) retrievedSession, err := suite.store1.Get(sessionID) suite.NoError(err) suite.Equal(session.ID, retrievedSession.ID) suite.Equal(session.NodeAddr, retrievedSession.NodeAddr) suite.Equal(session.HostUser, retrievedSession.HostUser) // Test Update (requires delete first due to Consul session locking mechanism) err = suite.store1.Delete(sessionID) suite.NoError(err) // Should be immediately deleted (strong consistency) _, err = suite.store1.Get(sessionID) suite.Error(err) session.NodeAddr = "192.168.1.100:2222" err = suite.store1.Store(session) suite.NoError(err) // Should be immediately available (strong consistency) retrievedSession, err = suite.store1.Get(sessionID) suite.NoError(err) suite.Equal("192.168.1.100:2222", retrievedSession.NodeAddr) // Test Delete err = suite.store1.Delete(sessionID) suite.NoError(err) // Should be immediately deleted (strong consistency) _, err = suite.store1.Get(sessionID) suite.Error(err) } func (suite *ConsulStoreTestSuite) TestReplicationViaCacheAndWatch() { sessionID := "replication-test" session := &Session{ ID: sessionID, NodeAddr: "192.168.1.100:2222", HostUser: "testuser", } // Store session in store1 err := suite.store1.Store(session) suite.NoError(err) defer func() { _ = suite.store1.Delete(sessionID) }() // Wait for watch to propagate to store2's cache suite.waitForSessionInCache(sessionID) // Verify data integrity and measure lookup performance start := time.Now() retrievedSession, err := suite.store2.Get(sessionID) duration := time.Since(start) suite.NoError(err) suite.Equal(sessionID, retrievedSession.ID) suite.Equal("192.168.1.100:2222", retrievedSession.NodeAddr) suite.Equal("testuser", retrievedSession.HostUser) suite.Less(duration, 1*time.Millisecond, "Memory lookup should be instant") } func (suite *ConsulStoreTestSuite) TestReplicationHandlesDeletion() { sessionID := "deletion-replication-test" session := &Session{ ID: sessionID, NodeAddr: "172.16.0.1:2222", HostUser: "deleteuser", } // Store session and wait for replication err := suite.store1.Store(session) suite.NoError(err) suite.waitForSessionInCache(sessionID) // Delete from store1 err = suite.store1.Delete(sessionID) suite.NoError(err) // Wait for deletion to propagate via watch suite.waitForSessionRemovedFromCache(sessionID) // Verify session is actually deleted _, err = suite.store2.Get(sessionID) suite.Error(err, "Session should not be accessible after deletion") } func (suite *ConsulStoreTestSuite) TestSessionNotFoundNoRetry() { // Test that session not found errors are not retried unnecessarily nonExistentSessionID := fmt.Sprintf("nonexistent-%d", time.Now().UnixNano()) // This should fail quickly without retries start := time.Now() _, err := suite.store1.Get(nonExistentSessionID) duration := time.Since(start) suite.Error(err) suite.Contains(err.Error(), "not found") // Should fail quickly (under 100ms) since we don't retry "not found" errors suite.Less(duration, 100*time.Millisecond, "Session not found should fail quickly without retries") } func (suite *ConsulStoreTestSuite) TestBatchOperations() { sessions := []*Session{ {ID: "batch-consul-1", NodeAddr: "192.168.1.1:2222", HostUser: "user1"}, {ID: "batch-consul-2", NodeAddr: "192.168.1.2:2222", HostUser: "user2"}, {ID: "batch-consul-3", NodeAddr: "192.168.1.3:2222", HostUser: "user3"}, } // Store all sessions in store1 for _, session := range sessions { err := suite.store1.Store(session) suite.NoError(err) } defer func() { for _, session := range sessions { _ = suite.store1.Delete(session.ID) } }() // Wait for all sessions to propagate via watch suite.EventuallyWithT(func(t *assert.CollectT) { assert := assert.New(t) for _, session := range sessions { assert.True(suite.store2.HasInCache(session.ID), "Session %s should be in store2's cache", session.ID) } }, 2*time.Second, 10*time.Millisecond) // Test List operation allSessions, err := suite.store1.List() suite.NoError(err) suite.GreaterOrEqual(len(allSessions), 3) // May have other sessions from parallel tests // Test BatchDelete sessionIDs := []string{"batch-consul-1", "batch-consul-2", "batch-consul-3"} err = suite.store1.BatchDelete(sessionIDs) suite.NoError(err) // Verify all sessions are deleted for _, sessionID := range sessionIDs { _, err = suite.store1.Get(sessionID) suite.Error(err) } } // Helper methods for replication testing func (suite *ConsulStoreTestSuite) waitForSessionInCache(sessionID string) { suite.EventuallyWithT(func(t *assert.CollectT) { assert := assert.New(t) assert.True(suite.store2.HasInCache(sessionID), "Session should be in store2's cache via watch") }, 2*time.Second, 10*time.Millisecond) } func (suite *ConsulStoreTestSuite) waitForSessionRemovedFromCache(sessionID string) { suite.EventuallyWithT(func(t *assert.CollectT) { assert := assert.New(t) assert.False(suite.store2.HasInCache(sessionID), "Session should be removed from store2's cache via watch") }, 2*time.Second, 10*time.Millisecond) } // // Test Suite Runners // func TestEmbeddedSessionManagerTestSuite(t *testing.T) { suite.Run(t, new(EmbeddedSessionManagerTestSuite)) } func TestConsulSessionManagerTestSuite(t *testing.T) { suite.Run(t, new(ConsulSessionManagerTestSuite)) } func TestMemoryStoreTestSuite(t *testing.T) { suite.Run(t, new(MemoryStoreTestSuite)) } func TestConsulStoreTestSuite(t *testing.T) { suite.Run(t, new(ConsulStoreTestSuite)) } upterm-0.17.0/server/sshd.go000066400000000000000000000067011507434540500157240ustar00rootroot00000000000000package server import ( "context" "fmt" "net" "sync" "time" "github.com/charmbracelet/ssh" "github.com/owenthereal/upterm/internal/version" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/utils" "log/slog" gossh "golang.org/x/crypto/ssh" "google.golang.org/protobuf/proto" ) var ( serverShutDownDeadline = 1 * time.Second ) type ServerInfo struct { NodeAddr string } type sshd struct { SessionManager *SessionManager HostSigners []gossh.Signer NodeAddr string SessionDialListener SessionDialListener Logger *slog.Logger server *ssh.Server mux sync.Mutex } func (s *sshd) Shutdown() error { s.mux.Lock() defer s.mux.Unlock() if s.server != nil { ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(serverShutDownDeadline)) defer cancel() return s.server.Shutdown(ctx) } return nil } func (s *sshd) Serve(ln net.Listener) error { var signers []ssh.Signer for _, signer := range s.HostSigners { signers = append(signers, signer) } sh := newStreamlocalForwardHandler( s.SessionManager, s.SessionDialListener, s.Logger.With("com", "stream-local-handler"), ) s.mux.Lock() s.server = &ssh.Server{ HostSigners: signers, Handler: func(s ssh.Session) { _ = s.Exit(1) // disable ssh login }, ConnectionFailedCallback: func(conn net.Conn, err error) { s.Logger.Error("connection failed", "error", err) }, ServerConfigCallback: func(ctx ssh.Context) *gossh.ServerConfig { config := &gossh.ServerConfig{ ServerVersion: version.ServerSSHVersion(), } return config }, ReversePortForwardingCallback: ssh.ReversePortForwardingCallback(func(ctx ssh.Context, host string, port uint32) (granted bool) { s.Logger.Info("attempt to bind", "tunnel-host", host, "tunnel-port", port) return true }), PublicKeyHandler: func(ctx ssh.Context, key ssh.PublicKey) bool { checker := UserCertChecker{} _, _, err := checker.Authenticate(ctx.User(), key) if err != nil { s.Logger.Error("error parsing auth request from cert", "error", err) return false } // TOOD: validate pk return true }, ChannelHandlers: make(map[string]ssh.ChannelHandler), // disallow channel requests, e.g. shell RequestHandlers: map[string]ssh.RequestHandler{ streamlocalForwardChannelType: sh.Handler, cancelStreamlocalForwardChannelType: sh.Handler, upterm.ServerCreateSessionRequestType: s.createSessionHandler, }, } s.mux.Unlock() return s.server.Serve(ln) } func (s *sshd) createSessionHandler(ctx ssh.Context, srv *ssh.Server, req *gossh.Request) (bool, []byte) { var sessReq CreateSessionRequest if err := proto.Unmarshal(req.Payload, &sessReq); err != nil { return false, []byte(err.Error()) } sessionID := utils.GenerateSessionID() // Store complete session data for routing and session management session := NewSession( sessionID, s.NodeAddr, sessReq.HostUser, sessReq.HostPublicKeys, sessReq.ClientAuthorizedKeys, ) sshUser, err := s.SessionManager.CreateSession(session) if err != nil { s.Logger.Error("failed to create session", "error", err, "session", sessionID, "node", s.NodeAddr, ) return false, []byte(fmt.Sprintf("failed to create session: %v", err)) } sessResp := &CreateSessionResponse{ SessionID: sessionID, NodeAddr: s.NodeAddr, SshUser: sshUser, } b, err := proto.Marshal(sessResp) if err != nil { return false, []byte(err.Error()) } return true, b } upterm-0.17.0/server/sshd_test.go000066400000000000000000000045651507434540500167710ustar00rootroot00000000000000package server import ( "context" "net" "strings" "testing" "time" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/utils" "golang.org/x/crypto/ssh" ) const ( TestPublicKeyContent = `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0EWrjdcHcuMfI8bGAyHPcGsAc/vd/gl5673pRkRBGY` TestPrivateKeyContent = `-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACDdBFq43XB3LjHyPGxgMhz3BrAHP73f4Jeeu96UZEQRmAAAAIiRPFazkTxW swAAAAtzc2gtZWQyNTUxOQAAACDdBFq43XB3LjHyPGxgMhz3BrAHP73f4Jeeu96UZEQRmA AAAEDmpjZHP/SIyBTp6YBFPzUi18iDo2QHolxGRDpx+m7let0EWrjdcHcuMfI8bGAyHPcG sAc/vd/gl5673pRkRBGYAAAAAAECAwQF -----END OPENSSH PRIVATE KEY-----` ) func Test_sshd_DisallowSession(t *testing.T) { logger := logging.Must(logging.Console(), logging.Debug()).Logger ln, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { t.Fatal(err) } defer func() { _ = ln.Close() }() addr := ln.Addr().String() signer, err := ssh.ParsePrivateKey([]byte(TestPrivateKeyContent)) if err != nil { t.Fatal(err) } // Set up cert signer for sshd public key validation cs := UserCertSigner{ SessionID: "1234", User: "owen", AuthRequest: &AuthRequest{ ClientVersion: upterm.HostSSHClientVersion, RemoteAddr: addr, AuthorizedKey: []byte(TestPublicKeyContent), }, } certSigner, err := cs.SignCert(signer) if err != nil { t.Fatal(err) } sshd := &sshd{ SessionManager: func() *SessionManager { sm, _ := NewSessionManager(routing.ModeEmbedded, WithSessionManagerLogger(logger)) return sm }(), HostSigners: []ssh.Signer{signer}, NodeAddr: addr, Logger: logger, } go func() { _ = sshd.Serve(ln) }() ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) defer cancel() if err := utils.WaitForServer(ctx, addr); err != nil { t.Fatal(err) } config := &ssh.ClientConfig{ Auth: []ssh.AuthMethod{ssh.PublicKeys(certSigner)}, User: "owen", HostKeyCallback: ssh.InsecureIgnoreHostKey(), } client, err := ssh.Dial("tcp", addr, config) if err != nil { t.Fatal(err) } _, err = client.NewSession() if err == nil || !strings.Contains(err.Error(), "unsupported channel type") { t.Fatalf("expect unsupported channel type error but got %v", err) } } upterm-0.17.0/server/sshhandler.go000066400000000000000000000143621507434540500171200ustar00rootroot00000000000000package server import ( "context" "errors" "io" "net" "strings" "sync" "github.com/charmbracelet/ssh" "github.com/oklog/run" "log/slog" gossh "golang.org/x/crypto/ssh" ) const ( forwardedStreamlocalChannelType = "forwarded-streamlocal@openssh.com" streamlocalForwardChannelType = "streamlocal-forward@openssh.com" cancelStreamlocalForwardChannelType = "cancel-streamlocal-forward@openssh.com" ) type streamlocalChannelForwardMsg struct { SocketPath string } type forwardedStreamlocalPayload struct { SocketPath string Reserved0 string } // isExpectedShutdownError returns true if the error is expected during normal session shutdown func isExpectedShutdownError(err error) bool { if err == nil { return false } // Context cancellation is normal during shutdown if errors.Is(err, context.Canceled) { return true } // EOF and connection closed errors are normal during shutdown if errors.Is(err, io.EOF) { return true } errStr := err.Error() // Common shutdown-related error messages shutdownMessages := []string{ "closed", "connection reset", "broken pipe", "use of closed network connection", } for _, msg := range shutdownMessages { if strings.Contains(errStr, msg) { return true } } return false } func newStreamlocalForwardHandler( sessionManager *SessionManager, sessionDialListener SessionDialListener, logger *slog.Logger, ) *streamlocalForwardHandler { return &streamlocalForwardHandler{ sessionManager: sessionManager, sessionDialListener: sessionDialListener, forwards: make(map[string]net.Listener), logger: logger, } } type streamlocalForwardHandler struct { sessionManager *SessionManager sessionDialListener SessionDialListener forwards map[string]net.Listener logger *slog.Logger sync.Mutex } func (h *streamlocalForwardHandler) listen(ctx ssh.Context, ln net.Listener, sessionID string, logger *slog.Logger) error { conn := ctx.Value(ssh.ContextKeyConn).(*gossh.ServerConn) for { c, err := ln.Accept() if err != nil { return err } go h.handleConnection(ctx, conn, c, sessionID, logger) } } func (h *streamlocalForwardHandler) handleConnection(ctx ssh.Context, conn *gossh.ServerConn, localConn net.Conn, sessionID string, logger *slog.Logger) { defer func() { if err := localConn.Close(); err != nil { logger.Debug("error closing local connection", "error", err) } }() payload := gossh.Marshal(&forwardedStreamlocalPayload{ SocketPath: sessionID, }) ch, reqs, err := conn.OpenChannel(forwardedStreamlocalChannelType, payload) if err != nil { logger.Error("error opening channel", "error", err) return } defer func() { if err := ch.Close(); err != nil { logger.Debug("error closing SSH channel", "error", err) } }() var g run.Group // Context cancellation handler { g.Add(func() error { <-ctx.Done() return ctx.Err() }, func(err error) { // Context cancelled, close all connections }) } // SSH request handler { g.Add(func() error { gossh.DiscardRequests(reqs) return nil }, func(err error) { // Requests handler stopped }) } // Copy from local to SSH channel { g.Add(func() error { _, err := io.Copy(ch, localConn) return err }, func(err error) { // Copy stopped }) } // Copy from SSH channel to local { g.Add(func() error { _, err := io.Copy(localConn, ch) return err }, func(err error) { // Copy stopped }) } if err := g.Run(); err != nil && err != context.Canceled { logger.Error("error handling connection", "error", err) } } func (h *streamlocalForwardHandler) Handler(ctx ssh.Context, srv *ssh.Server, req *gossh.Request) (bool, []byte) { switch req.Type { case streamlocalForwardChannelType: var reqPayload streamlocalChannelForwardMsg if err := gossh.Unmarshal(req.Payload, &reqPayload); err != nil { h.logger.Error("error parsing streamlocal payload", "error", err) return false, []byte(err.Error()) } if srv.ReversePortForwardingCallback == nil || !srv.ReversePortForwardingCallback(ctx, reqPayload.SocketPath, 0) { return false, []byte("port forwarding is disabled") } sessionID := reqPayload.SocketPath logger := h.logger.With("session-id", sessionID) // validate session exists if _, err := h.sessionManager.GetSession(sessionID); err != nil { return false, []byte(err.Error()) } ln, err := h.sessionDialListener.Listen(sessionID) if err != nil { logger.Error("error listening socket", "error", err) return false, []byte(err.Error()) } h.trackListener(sessionID, ln) var g run.Group { g.Add(func() error { <-ctx.Done() return ctx.Err() }, func(err error) { h.closeListener(sessionID) }) } { g.Add(func() error { return h.listen(ctx, ln, sessionID, logger) }, func(err error) { h.closeListener(sessionID) }) } go func(sessionID string) { if err := g.Run(); err != nil { // Log expected shutdown errors at debug level, critical errors at error level if isExpectedShutdownError(err) { h.logger.Debug("ssh session ended", "session-id", sessionID) } else { h.logger.Error("error handling ssh session", "error", err, "session-id", sessionID) } } }(sessionID) return true, nil case cancelStreamlocalForwardChannelType: var reqPayload streamlocalChannelForwardMsg if err := gossh.Unmarshal(req.Payload, &reqPayload); err != nil { h.logger.Error("error parsing streamlocal payload", "error", err) return false, []byte(err.Error()) } sessionID := reqPayload.SocketPath h.closeListener(sessionID) return true, nil default: return false, nil } } func (h *streamlocalForwardHandler) trackListener(sessionID string, ln net.Listener) { h.Lock() defer h.Unlock() h.forwards[sessionID] = ln } func (h *streamlocalForwardHandler) closeListener(sessionID string) { h.Lock() defer h.Unlock() logger := h.logger.With("session-id", sessionID) ln, ok := h.forwards[sessionID] if !ok { // Already closed return } if err := ln.Close(); err != nil { logger.Error("error closing listener", "error", err) } else { logger.Debug("closed listener") } delete(h.forwards, sessionID) if err := h.sessionManager.DeleteSession(sessionID); err != nil { logger.Error("error deleting session", "error", err) } } upterm-0.17.0/server/sshhandler_test.go000066400000000000000000000072531507434540500201600ustar00rootroot00000000000000package server import ( "context" "errors" "fmt" "io" "net" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/suite" ) type SSHHandlerTestSuite struct { suite.Suite } func TestSSHHandlerTestSuite(t *testing.T) { suite.Run(t, new(SSHHandlerTestSuite)) } func (s *SSHHandlerTestSuite) TestIsExpectedShutdownError() { tests := []struct { name string err error expected bool }{ { name: "nil error", err: nil, expected: false, }, { name: "context canceled", err: context.Canceled, expected: true, }, { name: "context deadline exceeded", err: context.DeadlineExceeded, expected: false, }, { name: "io.EOF", err: io.EOF, expected: true, }, { name: "connection closed", err: errors.New("connection closed"), expected: true, }, { name: "use of closed network connection", err: errors.New("use of closed network connection"), expected: true, }, { name: "connection reset by peer", err: errors.New("read tcp 127.0.0.1:8080->127.0.0.1:8081: connection reset by peer"), expected: true, }, { name: "broken pipe", err: errors.New("write tcp 127.0.0.1:8080->127.0.0.1:8081: broken pipe"), expected: true, }, { name: "generic network error with connection reset", err: &net.OpError{Op: "read", Net: "tcp", Err: errors.New("connection reset by peer")}, expected: true, }, { name: "unexpected error", err: errors.New("unexpected database error"), expected: false, }, { name: "authentication failure", err: errors.New("ssh: handshake failed: authentication failed"), expected: false, }, { name: "permission denied", err: errors.New("permission denied"), expected: false, }, } for _, tt := range tests { s.Run(tt.name, func() { result := isExpectedShutdownError(tt.err) assert.Equal(s.T(), tt.expected, result, "isExpectedShutdownError(%v) should return %v", tt.err, tt.expected) }) } } func (s *SSHHandlerTestSuite) TestIsExpectedShutdownError_EdgeCases() { // Test error with "closed" in middle of message err := errors.New("the connection was closed unexpectedly") assert.True(s.T(), isExpectedShutdownError(err), "Expected 'closed' substring to be detected as shutdown error") // Test multiple shutdown indicators err = errors.New("broken pipe: connection closed") assert.True(s.T(), isExpectedShutdownError(err), "Expected multiple shutdown indicators to be detected") // Test partial matches that will trigger (which is fine for "closed") err = errors.New("unclosed parenthesis") assert.True(s.T(), isExpectedShutdownError(err), "'unclosed' contains 'closed' substring and should match") // Test empty error message err = errors.New("") assert.False(s.T(), isExpectedShutdownError(err), "Empty error message should not be expected shutdown error") } func (s *SSHHandlerTestSuite) TestIsExpectedShutdownError_WrappedErrors() { // Test wrapped context.Canceled wrappedCanceled := errors.New("operation failed: context canceled") assert.False(s.T(), isExpectedShutdownError(wrappedCanceled), "String-wrapped context canceled should not match errors.Is check") // Test actual wrapped context.Canceled using fmt.Errorf actualWrapped := fmt.Errorf("operation failed: %w", context.Canceled) assert.True(s.T(), isExpectedShutdownError(actualWrapped), "Properly wrapped context.Canceled should be detected") // Test wrapped io.EOF wrappedEOF := fmt.Errorf("read operation failed: %w", io.EOF) assert.True(s.T(), isExpectedShutdownError(wrappedEOF), "Properly wrapped io.EOF should be detected") } upterm-0.17.0/server/sshproxy.go000066400000000000000000000123441507434540500166620ustar00rootroot00000000000000package server import ( "fmt" "log/slog" "net" "sync" "github.com/go-kit/kit/metrics/provider" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/utils" "golang.org/x/crypto/ssh" ) type sshProxy struct { HostSigners []ssh.Signer Signers []ssh.Signer NodeAddr string ConnDialer connDialer SessionManager *SessionManager Logger *slog.Logger MetricsProvider provider.Provider routing *SSHRouting mux sync.Mutex } func (r *sshProxy) Shutdown() error { r.mux.Lock() defer r.mux.Unlock() if r.routing != nil { return r.routing.Shutdown() } return nil } func (r *sshProxy) Serve(ln net.Listener) error { r.mux.Lock() r.routing = &SSHRouting{ HostSigners: r.HostSigners, AuthPiper: &authPiper{ HostSigners: r.HostSigners, Signers: r.Signers, SessionManager: r.SessionManager, ConnDialer: r.ConnDialer, NodeAddr: r.NodeAddr, }, Decoder: r.SessionManager.GetEncodeDecoder(), MetricsProvider: r.MetricsProvider, Logger: r.Logger, } r.mux.Unlock() return r.routing.Serve(ln) } type authPiper struct { NodeAddr string SessionManager *SessionManager ConnDialer connDialer Signers []ssh.Signer HostSigners []ssh.Signer } func (a authPiper) PublicKeyCallback(conn ssh.ConnMetadata, pk ssh.PublicKey, challengeCtx ssh.ChallengeContext) (*ssh.Upstream, error) { checker := UserCertChecker{ UserKeyFallback: func(user string, key ssh.PublicKey) (ssh.PublicKey, error) { return key, nil }, } auth, key, err := checker.Authenticate(conn.User(), pk) if err == errCertNotSignedByHost { err = nil } if err != nil { return nil, fmt.Errorf("error checking user cert: %w", err) } // Use the public-key if a key can't be parsed from cert if key == nil { key = pk } if auth == nil { auth = &AuthRequest{ ClientVersion: string(conn.ClientVersion()), RemoteAddr: conn.RemoteAddr().String(), AuthorizedKey: ssh.MarshalAuthorizedKey(key), } } hostSess, err := a.hostSession(conn) if err != nil { return nil, err } // TODO: simplify auth key validation by moving it to host validation only if hostSess != nil && !hostSess.IsClientKeyAllowed(key) { return nil, fmt.Errorf("public key not allowed") } signers, err := a.newUserCertSigners(conn, auth) if err != nil { return nil, fmt.Errorf("error creating cert signers: %w", err) } c, err := a.dialUpstream(conn) if err != nil { return nil, fmt.Errorf("error dialing upstream: %w", err) } hostKeyCb := func(hostname string, remote net.Addr, key ssh.PublicKey) error { if hostSess == nil { // check host keys for sideway connections for _, s := range a.HostSigners { if utils.KeysEqual(key, s.PublicKey()) { return nil } } } else { for _, pk := range hostSess.HostPublicKeys { if utils.KeysEqual(key, pk) { return nil } } } return fmt.Errorf("ssh: host key mismatch") } return &ssh.Upstream{ Conn: c, Address: conn.RemoteAddr().String(), ClientConfig: ssh.ClientConfig{ HostKeyCallback: hostKeyCb, Auth: []ssh.AuthMethod{ssh.PublicKeys(signers...)}, }, }, nil } func (a *authPiper) dialUpstream(conn ssh.ConnMetadata) (net.Conn, error) { var ( user = conn.User() clientVersion = string(conn.ClientVersion()) ) // Determine connection type and create identifier accordingly var id *api.Identifier if clientVersion == upterm.HostSSHClientVersion { // HOST connection: user is the session ID id = &api.Identifier{ Id: user, Type: api.Identifier_HOST, } } else { // CLIENT connection: decode the SSH user sessionID, nodeAddr, err := a.SessionManager.ResolveSSHUser(user) if err != nil { return nil, fmt.Errorf("error resolving SSH user %s: %w", user, err) } id = &api.Identifier{ Id: sessionID, NodeAddr: nodeAddr, Type: api.Identifier_CLIENT, } } c, err := a.ConnDialer.Dial(id) if err != nil { return nil, err } return c, nil } func (a authPiper) newUserCertSigners(conn ssh.ConnMetadata, auth *AuthRequest) ([]ssh.Signer, error) { var certSigners []ssh.Signer for _, s := range a.Signers { ucs := UserCertSigner{ SessionID: string(conn.SessionID()), User: conn.User(), AuthRequest: auth, } cs, err := ucs.SignCert(s) if err != nil { return nil, err } certSigners = append(certSigners, cs) } return certSigners, nil } // hostSession returns a session if the routing is required to be done on client side and the current // is proxy node. func (a *authPiper) hostSession(conn ssh.ConnMetadata) (*Session, error) { user := conn.User() clientVersion := string(conn.ClientVersion()) // HOST connections don't validate authorized keys if clientVersion == upterm.HostSSHClientVersion { return nil, nil } // CLIENT connection: decode the SSH user to get session ID and node address sessionID, nodeAddr, err := a.SessionManager.ResolveSSHUser(user) if err != nil { return nil, fmt.Errorf("error decoding SSH user %s: %w", user, err) } // Don't validate authorized key if the node does not match the request that routing is needed if a.NodeAddr != nodeAddr { return nil, nil } return a.SessionManager.GetSession(sessionID) } upterm-0.17.0/server/sshproxy_test.go000066400000000000000000000063031507434540500177170ustar00rootroot00000000000000package server import ( "context" "crypto/rand" "net" "strings" "testing" "time" "github.com/go-kit/kit/metrics/provider" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/utils" "github.com/rs/xid" "golang.org/x/crypto/ssh" ) func Test_sshProxy_dialUpstream(t *testing.T) { logger := logging.Must(logging.Console(), logging.Debug()).Logger signer, err := ssh.ParsePrivateKey([]byte(TestPrivateKeyContent)) if err != nil { t.Fatal(err) } cs := HostCertSigner{ Hostnames: []string{"127.0.0.1"}, } hostSigner, err := cs.SignCert(signer) if err != nil { t.Fatal(err) } proxyLn, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { t.Fatal(err) } defer func() { _ = proxyLn.Close() }() proxyAddr := proxyLn.Addr().String() cd := sidewayConnDialer{ NodeAddr: proxyAddr, NeighbourDialer: tcpConnDialer{}, Logger: logger, } proxy := &sshProxy{ HostSigners: []ssh.Signer{hostSigner}, Signers: []ssh.Signer{signer}, SessionManager: newEmbeddedSessionManager(logger), NodeAddr: proxyAddr, ConnDialer: cd, Logger: logger, MetricsProvider: provider.NewDiscardProvider(), } go func() { _ = proxy.Serve(proxyLn) }() ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) defer cancel() if err := utils.WaitForServer(ctx, proxyAddr); err != nil { t.Fatal(err) } sshLn, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { t.Fatal(err) } defer func() { _ = sshLn.Close() }() sshdAddr := sshLn.Addr().String() sshd := &sshd{ SessionManager: newEmbeddedSessionManager(logger), HostSigners: []ssh.Signer{signer}, NodeAddr: sshdAddr, Logger: logger, } go func() { _ = sshd.Serve(sshLn) }() if err := utils.WaitForServer(ctx, sshdAddr); err != nil { t.Fatal(err) } encoder := routing.NewEncodeDecoder(routing.ModeEmbedded) user := encoder.Encode(xid.New().String(), sshdAddr) ucs, err := testCertSigner(user, signer) if err != nil { t.Fatal(err) } cases := []struct { Name string Signer ssh.Signer }{ { Name: "public-key auth", Signer: signer, }, { Name: "public-key user cert auth", Signer: ucs, }, } for _, c := range cases { cc := c t.Run(c.Name, func(t *testing.T) { config := &ssh.ClientConfig{ User: user, Auth: []ssh.AuthMethod{ssh.PublicKeys(cc.Signer)}, HostKeyCallback: ssh.InsecureIgnoreHostKey(), } client, err := ssh.Dial("tcp", proxyAddr, config) // proxy to sshd if err != nil { t.Fatal(err) } _, err = client.NewSession() if err == nil || !strings.Contains(err.Error(), "unsupported channel type") { t.Fatalf("expect unsupported channel type error but got %v", err) } }) } } func testCertSigner(user string, signer ssh.Signer) (ssh.Signer, error) { cert := &ssh.Certificate{ Key: signer.PublicKey(), CertType: ssh.UserCert, KeyId: "1234", ValidPrincipals: []string{user}, ValidBefore: ssh.CertTimeInfinity, } if err := cert.SignCert(rand.Reader, signer); err != nil { return nil, err } return ssh.NewCertSigner(cert, signer) } upterm-0.17.0/server/sshrouting.go000066400000000000000000000117271507434540500171740ustar00rootroot00000000000000package server import ( "errors" "fmt" "log/slog" "net" "sync" "time" "github.com/go-kit/kit/metrics" "github.com/go-kit/kit/metrics/provider" "github.com/owenthereal/upterm/internal/version" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/upterm" "golang.org/x/crypto/ssh" ) var ( ErrListnerClosed = errors.New("routing: listener closed") pipeEstablishingTimeout = 60 * time.Second ) type SSHRouting struct { HostSigners []ssh.Signer AuthPiper *authPiper Decoder routing.Decoder Logger *slog.Logger MetricsProvider provider.Provider listener net.Listener mux sync.Mutex doneChan chan struct{} } type routingInstruments struct { connections metrics.Counter activeConnections metrics.Gauge connectionDuration metrics.Histogram errors metrics.Counter connectionTimeouts metrics.Counter } func newSSHRoutingInstruments(p provider.Provider) *routingInstruments { return &routingInstruments{ connections: p.NewCounter("routing_connections_count"), errors: p.NewCounter("routing_errors_count"), activeConnections: p.NewGauge("routing_active_connections_count"), connectionDuration: p.NewHistogram("routing_connection_duration_seconds", 50), connectionTimeouts: p.NewCounter("routing_connection_timeout_count"), } } func (p *SSHRouting) Serve(ln net.Listener) error { p.mux.Lock() p.listener = ln p.mux.Unlock() piperCfg := &ssh.PiperConfig{ PublicKeyCallback: p.AuthPiper.PublicKeyCallback, ServerVersion: version.ServerSSHVersion(), NextAuthMethods: func(conn ssh.ConnMetadata, challengeCtx ssh.ChallengeContext) ([]string, error) { // Fail early if the user is not a valid identifier. user := conn.User() if user != "" { clientVersion := string(conn.ClientVersion()) // HOST connections: just validate user is not empty if clientVersion == upterm.HostSSHClientVersion { if user == "" { return nil, fmt.Errorf("empty session ID for host connection") } } else { // CLIENT connections: validate SSH user format _, _, err := p.Decoder.Decode(user) if err != nil { return nil, fmt.Errorf("invalid SSH user format: %w", err) } } } return []string{"publickey"}, nil }, } for _, s := range p.HostSigners { piperCfg.AddHostKey(s) } inst := newSSHRoutingInstruments(p.MetricsProvider) var tempDelay time.Duration // how long to sleep on accept failure for { dconn, err := ln.Accept() if err != nil { select { case <-p.getDoneChan(): return ErrListnerClosed default: } if ne, ok := err.(net.Error); ok && ne.Timeout() { if tempDelay == 0 { tempDelay = 5 * time.Millisecond } else { tempDelay *= 2 } if max := 1 * time.Second; tempDelay > max { tempDelay = max } p.Logger.Error("tcp: Accept error; retrying", "error", err, "retry_delay", tempDelay) time.Sleep(tempDelay) continue } p.Logger.Error("failed to accept connection", "error", err) inst.errors.Add(1) return err } tempDelay = 0 logger := p.Logger.With("addr", dconn.RemoteAddr()) go func(dconn net.Conn, inst *routingInstruments, logger *slog.Logger) { startTime := time.Now() defer func() { _ = dconn.Close() }() defer func() { // Track connection duration in seconds durationSec := time.Since(startTime).Seconds() inst.connectionDuration.Observe(durationSec) }() defer inst.activeConnections.Add(-1) inst.connections.Add(1) inst.activeConnections.Add(1) pipec := make(chan *ssh.PiperConn) errorc := make(chan error) go func() { defer func() { close(pipec) close(errorc) }() pconn, err := ssh.NewSSHPiperConn(dconn, piperCfg) if err != nil { errorc <- err return } pipec <- pconn }() select { case pconn := <-pipec: defer pconn.Close() if err := pconn.Wait(); err != nil { logger.Debug("error waiting for pipe", "error", err) inst.errors.Add(1) } case err := <-errorc: logger.Debug("connection establishing failed", "error", err) inst.errors.Add(1) case <-time.After(pipeEstablishingTimeout): logger.Debug("pipe establishing timeout") inst.connectionTimeouts.Add(1) } }(dconn, inst, logger) } } func (p *SSHRouting) Shutdown() error { p.mux.Lock() lnerr := p.closeListenersLocked() p.closeDoneChanLocked() p.mux.Unlock() return lnerr } func (p *SSHRouting) getDoneChan() <-chan struct{} { p.mux.Lock() defer p.mux.Unlock() return p.getDoneChanLocked() } func (p *SSHRouting) getDoneChanLocked() chan struct{} { if p.doneChan == nil { p.doneChan = make(chan struct{}) } return p.doneChan } func (p *SSHRouting) closeDoneChanLocked() { ch := p.getDoneChanLocked() select { case <-ch: // Already closed. Don't close again. default: // Safe to close here. We're the only closer, guarded // by p.mux. close(ch) } } func (p *SSHRouting) closeListenersLocked() error { return p.listener.Close() } upterm-0.17.0/server/wsproxy.go000066400000000000000000000106611507434540500165160ustar00rootroot00000000000000package server import ( "context" "fmt" "io" "net" "net/http" "strings" "sync" "time" "github.com/gorilla/websocket" "github.com/oklog/run" "github.com/owenthereal/upterm/host/api" "github.com/owenthereal/upterm/routing" "github.com/owenthereal/upterm/upterm" "github.com/owenthereal/upterm/ws" "log/slog" ) type webSocketProxy struct { ConnDialer connDialer SessionManager *SessionManager Logger *slog.Logger srv *http.Server mux sync.Mutex } func webHandler(h http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch { case r.URL.Path == "/health": w.Header().Set("Content-Type", "text/plain") w.WriteHeader(http.StatusOK) _, _ = w.Write([]byte("OK")) return case strings.HasPrefix(r.URL.Path, "/getting-started"): w.Header().Add("Content-Type", "text/plain") // TODO: better getting-started guide data := `1. Install the upterm CLI by following https://github.com/owenthereal/upterm#installation. 2. On your machine, host a session with "upterm host --server wss://%s -- YOUR_COMMAND". More details in https://github.com/owenthereal/upterm#quick-start. 3. Your pair(s) join the session with "ssh -o ProxyCommand='upterm proxy wss://TOKEN@%s' TOKEN@%s:443". ` _, _ = fmt.Fprintf(w, data, r.Host, r.Host, r.Host) return default: h.ServeHTTP(w, r) } }) } func (s *webSocketProxy) Serve(ln net.Listener) error { s.mux.Lock() s.srv = &http.Server{ Handler: webHandler(&wsHandler{ ConnDialer: s.ConnDialer, SessionManager: s.SessionManager, Logger: s.Logger, }), } s.mux.Unlock() return s.srv.Serve(ln) } func (s *webSocketProxy) Shutdown() error { s.mux.Lock() defer s.mux.Unlock() if s.srv != nil { ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(serverShutDownDeadline)) defer cancel() return s.srv.Shutdown(ctx) } return nil } var upgrader = websocket.Upgrader{ ReadBufferSize: 1024, WriteBufferSize: 1024, CheckOrigin: func(r *http.Request) bool { return true }, } type wsHandler struct { ConnDialer connDialer SessionManager *SessionManager Logger *slog.Logger } // ServeHTTP checks the following header: // * Authorization // * Upterm-Client-Version func (h *wsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { clientVersion := r.Header.Get(upterm.HeaderUptermClientVersion) if clientVersion == "" { h.httpError(w, fmt.Errorf("missing upterm client version")) return } user, pass, ok := r.BasicAuth() if !ok { h.httpError(w, fmt.Errorf("basic auth failed")) return } sshUser := user if h.SessionManager.GetRoutingMode() == routing.ModeEmbedded { sshUser = user + ":" + pass } wsc, err := upgrader.Upgrade(w, r, nil) if err != nil { h.httpError(w, fmt.Errorf("ws upgrade failed")) return } wsconn := ws.WrapWSConn(wsc) defer func() { _ = wsconn.Close() }() // Determine connection type and decode identifier using SessionManager var id *api.Identifier if string(clientVersion) == upterm.HostSSHClientVersion { // HOST connection: sshUser is the session ID id = &api.Identifier{ Id: sshUser, Type: api.Identifier_HOST, } } else { // CLIENT connection: decode the SSH user using SessionManager sessionID, nodeAddr, err := h.SessionManager.ResolveSSHUser(sshUser) if err != nil { h.wsError(wsc, fmt.Errorf("error resolving SSH user %s: %w", sshUser, err), "error resolving SSH user") return } id = &api.Identifier{ Id: sessionID, NodeAddr: nodeAddr, Type: api.Identifier_CLIENT, } } conn, err := h.ConnDialer.Dial(id) if err != nil { h.wsError(wsc, err, "error dialing") return } var o sync.Once cl := func() { _ = wsconn.Close() _ = conn.Close() } var g run.Group { g.Add(func() error { _, err := io.Copy(wsconn, conn) return err }, func(err error) { o.Do(cl) }) } { g.Add(func() error { _, err := io.Copy(conn, wsconn) return err }, func(err error) { o.Do(cl) }) } if err := g.Run(); err != nil { h.wsError(wsc, err, "error piping") } } func (h *wsHandler) httpError(w http.ResponseWriter, err error) { h.Logger.Error("http error", "error", err) w.WriteHeader(400) _, _ = w.Write([]byte(err.Error())) } func (h *wsHandler) wsError(ws *websocket.Conn, err error, msg string) { h.Logger.Error(msg, "error", err) _ = ws.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseInternalServerErr, err.Error())) } upterm-0.17.0/server/wsproxy_test.go000066400000000000000000000043641507434540500175600ustar00rootroot00000000000000package server import ( "bufio" "io" "net" "net/http/httptest" "net/url" "testing" "github.com/google/go-cmp/cmp" "github.com/owenthereal/upterm/internal/logging" "github.com/owenthereal/upterm/ws" "google.golang.org/grpc/test/bufconn" ) type testSshdDialListener struct { *bufconn.Listener } func (l *testSshdDialListener) Dial() (net.Conn, error) { return l.Listener.Dial() } func (l *testSshdDialListener) Listen() (net.Listener, error) { return l.Listener, nil } type testSessionDialListener struct { *bufconn.Listener } func (l *testSessionDialListener) Dial(id string) (net.Conn, error) { return l.Listener.Dial() } func (l *testSessionDialListener) Listen(id string) (net.Listener, error) { return l.Listener, nil } func Test_WebSocketProxy_Host(t *testing.T) { testLogger := logging.Must(logging.Console(), logging.Debug()).Logger cd := sidewayConnDialer{ SSHDDialListener: &testSshdDialListener{bufconn.Listen(1024)}, SessionDialListener: &testSessionDialListener{bufconn.Listen(1024)}, Logger: testLogger, } logger := testLogger wsh := &wsHandler{ ConnDialer: cd, SessionManager: newEmbeddedSessionManager(logger), Logger: logger, } ts := httptest.NewServer(wsh) defer ts.Close() u, err := url.Parse(ts.URL) if err != nil { t.Fatal(err) } u.Scheme = "ws" u.User = url.UserPassword("owen", "") wsc, err := ws.NewWSConn(u, false) if err != nil { t.Fatal(err) } rr, rw := io.Pipe() rs := bufio.NewScanner(rr) go func(wsc net.Conn, w io.Writer) { _, _ = io.Copy(w, wsc) }(wsc, rw) ln, err := cd.SSHDDialListener.Listen() if err != nil { t.Fatal(err) } conn, err := ln.Accept() if err != nil { t.Fatal(err) } wr, ww := io.Pipe() ws := bufio.NewScanner(wr) go func() { _, _ = io.Copy(ww, conn) }() // test read _, _ = conn.Write([]byte("read\n")) // need CR because func scan scans by line if diff := cmp.Diff("read", scan(rs)); diff != "" { t.Fatal(diff) } // test write if _, err := wsc.Write([]byte("write\n")); err != nil { // need CR because func scan scans by line t.Fatal(err) } if diff := cmp.Diff("write", scan(ws)); diff != "" { t.Fatal(diff) } } func scan(s *bufio.Scanner) string { for s.Scan() { return s.Text() } return s.Err().Error() } upterm-0.17.0/systemd/000077500000000000000000000000001507434540500146125ustar00rootroot00000000000000upterm-0.17.0/systemd/uptermd.service000066400000000000000000000011411507434540500176510ustar00rootroot00000000000000[Unit] Description=upterm secure terminal sharing After=network-online.target Wants=network-online.target systemd-networkd-wait-online.service [Service] ExecStart=/usr/bin/uptermd --ssh-addr 0.0.0.0:2222 IPAccounting=yes IPAddressAllow=localhost IPAddressDeny=any DynamicUser=yes PrivateTmp=yes PrivateUsers=yes PrivateDevices=yes NoNewPrivileges=true ProtectSystem=strict ProtectHome=yes ProtectClock=yes ProtectControlGroups=yes ProtectKernelLogs=yes ProtectKernelModules=yes ProtectKernelTunables=yes ProtectProc=invisible CapabilityBoundingSet=CAP_NET_BIND_SERVICE [Install] WantedBy=multi-user.target upterm-0.17.0/terraform/000077500000000000000000000000001507434540500151235ustar00rootroot00000000000000upterm-0.17.0/terraform/digitalocean/000077500000000000000000000000001507434540500175465ustar00rootroot00000000000000upterm-0.17.0/terraform/digitalocean/charts.tf000066400000000000000000000070071507434540500213710ustar00rootroot00000000000000locals { ingress_nginx_values = { controller = { ingressClassResource = { name = "nginx" controllerValue : "k8s.io/ingress-nginx" } admissionWebhooks = { enabled = false } service = { type = "LoadBalancer" annotations = { "service.beta.kubernetes.io/do-loadbalancer-name" = "${var.do_k8s_name}-lb" "service.beta.kubernetes.io/do-loadbalancer-protocol" = "tcp" } } } tcp = { 22 = "uptermd/uptermd:22" } } cert_manager_values = { installCRDs = true global = { leaderElection = { namespace = "cert-manager" } } } metrics_server_values = { extraArgs = { "kubelet-preferred-address-types" = "InternalIP" } } uptermd_values = { image = { repository = "ghcr.io/owenthereal/upterm/uptermd" tag = data.github_release.upterm.release_tag } autoscaling = { minReplicas = 2 maxReplicas = 5 } hostname = var.uptermd_host websocket = { enabled = true ingress_nginx_ingress_class = "nginx" cert_manager_acme_email = var.uptermd_acme_email } host_keys = { for k, v in var.uptermd_host_keys : k => v } debug = true } } data "github_release" "upterm" { owner = "owenthereal" repository = "upterm" retrieve_by = "latest" } provider "helm" { kubernetes { host = digitalocean_kubernetes_cluster.upterm.endpoint token = digitalocean_kubernetes_cluster.upterm.kube_config[0].token cluster_ca_certificate = base64decode(digitalocean_kubernetes_cluster.upterm.kube_config[0].cluster_ca_certificate) } } resource "helm_release" "ingress_nginx" { depends_on = [digitalocean_kubernetes_cluster.upterm, local_file.kubeconfig] name = "ingress-nginx" chart = "ingress-nginx" repository = "https://kubernetes.github.io/ingress-nginx" version = "4.0.16" namespace = "upterm-ingress-nginx" wait = var.wait_for_k8s_resources create_namespace = true values = [yamlencode(local.ingress_nginx_values)] } resource "helm_release" "cert_manager" { depends_on = [digitalocean_kubernetes_cluster.upterm, local_file.kubeconfig] name = "cert-manager" chart = "cert-manager" repository = "https://charts.jetstack.io" version = "1.7.0" namespace = "cert-manager" wait = var.wait_for_k8s_resources create_namespace = true values = [yamlencode(local.cert_manager_values)] } resource "helm_release" "upterm_metrics_server" { depends_on = [digitalocean_kubernetes_cluster.upterm, local_file.kubeconfig] name = "metrics-server" chart = "metrics-server" repository = "https://charts.bitnami.com/bitnami" version = "5.5.1" namespace = "metrics-server" wait = var.wait_for_k8s_resources create_namespace = true values = [yamlencode(local.metrics_server_values)] } resource "helm_release" "uptermd" { depends_on = [helm_release.ingress_nginx, helm_release.cert_manager, helm_release.upterm_metrics_server] name = "uptermd" chart = "uptermd" repository = var.uptermd_helm_repo namespace = "uptermd" create_namespace = true wait = var.wait_for_k8s_resources values = [yamlencode(local.uptermd_values)] } upterm-0.17.0/terraform/digitalocean/do.tf000066400000000000000000000015101507434540500205000ustar00rootroot00000000000000data "digitalocean_kubernetes_versions" "k8s_version" {} resource "digitalocean_kubernetes_cluster" "upterm" { name = var.do_k8s_name region = var.do_region auto_upgrade = false version = data.digitalocean_kubernetes_versions.k8s_version.latest_version node_pool { name = "autoscale-worker-pool" size = var.do_node_size auto_scale = true min_nodes = var.do_min_nodes max_nodes = var.do_max_nodes tags = [var.do_k8s_name] labels = { "app" = var.do_k8s_name } } } resource "local_file" "kubeconfig" { count = var.write_kubeconfig ? 1 : 0 content = digitalocean_kubernetes_cluster.upterm.kube_config[0].raw_config filename = var.kubeconfig_path file_permission = "0644" directory_permission = "0755" } upterm-0.17.0/terraform/digitalocean/output.tf000066400000000000000000000002641507434540500214430ustar00rootroot00000000000000output "kubeconfig" { depends_on = [digitalocean_kubernetes_cluster.upterm] value = digitalocean_kubernetes_cluster.upterm.kube_config[0].raw_config sensitive = true } upterm-0.17.0/terraform/digitalocean/providers.tf000066400000000000000000000005751507434540500221250ustar00rootroot00000000000000terraform { required_providers { digitalocean = { source = "digitalocean/digitalocean" version = "~> 2.0" } helm = { source = "hashicorp/helm" version = "~> 2.0" } github = { source = "integrations/github" version = "~> 4.0" } } required_version = ">= 0.13" } provider "digitalocean" { token = var.do_token } upterm-0.17.0/terraform/digitalocean/variables.tf000066400000000000000000000020621507434540500220510ustar00rootroot00000000000000### Digital Ocean ### variable "do_token" {} variable "do_region" { type = string default = "sfo2" } variable "do_k8s_name" { type = string default = "upterm-cluster" } variable "do_min_nodes" { type = number default = 1 } variable "do_max_nodes" { type = number default = 3 } variable "do_node_size" { type = string default = "s-2vcpu-4gb" } variable "write_kubeconfig" { type = bool default = false } variable "kubeconfig_path" { type = string default = "~/.kube/config" } ### Digital Ocean ### ### Charts ### variable "wait_for_k8s_resources" { type = bool default = true } variable "uptermd_host" { type = string } variable "uptermd_acme_email" { type = string } variable "uptermd_host_keys" { type = map(string) # { filename=content } description = "Host keys in the format of {\"rsa_key.pub\"=\"...\", \"rsa_key\"=\"...\"}" } variable "uptermd_helm_repo" { type = string default = "https://upterm.dev" description = "Configurable for testing purpose" } ### Charts ### upterm-0.17.0/terraform/heroku/000077500000000000000000000000001507434540500164205ustar00rootroot00000000000000upterm-0.17.0/terraform/heroku/main.tf000066400000000000000000000045351507434540500177060ustar00rootroot00000000000000variable "heroku_app_name" { description = "Heroku app name" } variable "heroku_region" { description = "Heroku region" default = "us" } variable "heroku_space" { description = "Name of the Heroku space" default = "" } variable "git_commit_sha" { description = "Git commit sha on GitHub" default = "master" } variable "heroku_team" { description = "Heroku team" default = "" } locals { app_id = var.heroku_space == "" ? heroku_app.uptermd_common_runtime.*.id[0] : heroku_app.uptermd_private_spaces.*.id[0] app_name = var.heroku_space == "" ? heroku_app.uptermd_common_runtime.*.name[0] : heroku_app.uptermd_private_spaces.*.name[0] } resource "heroku_app" "uptermd_common_runtime" { count = var.heroku_team == "" ? 1 : 0 name = var.heroku_app_name region = var.heroku_region buildpacks = ["heroku/go"] space = var.heroku_space acm = false sensitive_config_vars = { PRIVATE_KEY = "${tls_private_key.private_key.private_key_pem}" } } resource "heroku_app" "uptermd_private_spaces" { count = var.heroku_team == "" ? 0 : 1 name = var.heroku_app_name region = var.heroku_region buildpacks = ["heroku/go"] space = var.heroku_space acm = false sensitive_config_vars = { PRIVATE_KEY = "${tls_private_key.private_key.private_key_pem}" } organization { name = var.heroku_team } } resource "tls_private_key" "private_key" { algorithm = "RSA" rsa_bits = "4096" } resource "heroku_app_feature" "spaces-dns-discovery" { app_id = local.app_id name = "spaces-dns-discovery" enabled = var.heroku_space == "" ? false : true } resource "heroku_build" "uptermd" { app_id = local.app_id source { url = "https://github.com/owenthereal/upterm/archive/${var.git_commit_sha}.tar.gz" version = var.git_commit_sha } } resource "heroku_formation" "uptermd" { app_id = local.app_id type = "web" quantity = var.heroku_space == "" ? 1 : 2 size = var.heroku_space == "" ? "eco" : "private-s" depends_on = [heroku_build.uptermd] } output "step_1_share_session" { value = "upterm host --server wss://${local.app_name}.herokuapp.com -- YOUR_COMMAND" } output "step_2_join_session" { value = "ssh -o ProxyCommand='upterm proxy wss://TOKEN@${local.app_name}.herokuapp.com' TOKEN@${local.app_name}.herokuapp.com:443" } upterm-0.17.0/terraform/heroku/providers.tf000066400000000000000000000002411507434540500207650ustar00rootroot00000000000000terraform { required_providers { heroku = { source = "heroku/heroku" version = "5.2.1" } } } provider "heroku" { } provider "tls" { } upterm-0.17.0/upterm/000077500000000000000000000000001507434540500144365ustar00rootroot00000000000000upterm-0.17.0/upterm/const.go000066400000000000000000000014741507434540500161210ustar00rootroot00000000000000package upterm const ( // host HostSSHClientVersion = "SSH-2.0-upterm-host-client" HostSSHServerVersion = "SSH-2.0-upterm-host-server" HostAdminSocketEnvVar = "UPTERM_ADMIN_SOCKET" // client ClientSSHClientVersion = "SSH-2.0-upterm-client-client" // server ServerSSHServerVersion = "SSH-2.0-uptermd" ServerServerInfoRequestType = "upterm-server-info@upterm.dev" ServerCreateSessionRequestType = "upterm-create-session@upterm.dev" // header HeaderUptermClientVersion = "Upterm-Client-Version" // misc OpenSSHKeepAliveRequestType = "keepalive@openssh.com" SSHCertExtension = "upterm-auth-request" EventClientJoined = "client-joined" EventClientLeft = "client-left" EventTerminalWindowChanged = "terminal-window-changed" EventTerminalDetached = "terminal-detached" ) upterm-0.17.0/utils/000077500000000000000000000000001507434540500142625ustar00rootroot00000000000000upterm-0.17.0/utils/testing.go000066400000000000000000000012201507434540500162610ustar00rootroot00000000000000package utils import ( "context" "fmt" "net" "time" ) // WaitForServer waits for a server to be available at the given address with context support func WaitForServer(ctx context.Context, addr string) error { ticker := time.NewTicker(100 * time.Millisecond) defer ticker.Stop() for { select { case <-ctx.Done(): return fmt.Errorf("timeout waiting for server at %s: %w", addr, ctx.Err()) case <-ticker.C: conn, err := net.DialTimeout("tcp", addr, 100*time.Millisecond) if err != nil { continue } if err := conn.Close(); err != nil { return fmt.Errorf("error closing connection: %w", err) } return nil } } } upterm-0.17.0/utils/utils.go000066400000000000000000000046321507434540500157560ustar00rootroot00000000000000package utils import ( "crypto/ed25519" "crypto/sha256" "encoding/base64" "fmt" "os" "path/filepath" "strings" gssh "github.com/charmbracelet/ssh" "github.com/dchest/uniuri" "golang.org/x/crypto/ssh" ) const ( logFile = "upterm.log" ) func UptermDir() (string, error) { homedir, err := os.UserHomeDir() if err != nil { return "", err } return filepath.Join(homedir, ".upterm"), nil } func CreateUptermDir() (string, error) { dir, err := UptermDir() if err != nil { return "", err } if err := os.MkdirAll(dir, 0755); err != nil { return "", err } return dir, nil } func UptermLogFilePath() (string, error) { dir, err := UptermDir() if err != nil { return "", err } return filepath.Join(dir, logFile), nil } func OpenHostLogFile() (*os.File, error) { dir, err := CreateUptermDir() if err != nil { return nil, err } return os.OpenFile(filepath.Join(dir, logFile), os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0755) } func DefaultLocalhost(defaultPort string) string { port := os.Getenv("PORT") if port == "" { port = defaultPort } return fmt.Sprintf("127.0.0.1:%s", port) } func CreateSigners(privateKeys [][]byte) ([]ssh.Signer, error) { var signers []ssh.Signer for _, pk := range privateKeys { signer, err := ssh.ParsePrivateKey(pk) if err != nil { return nil, err } signers = append(signers, signer) } // generate one if no signer if len(signers) == 0 { _, epk, err := ed25519.GenerateKey(nil) if err != nil { return nil, err } signer, err := ssh.NewSignerFromKey(epk) if err != nil { return nil, err } signers = append(signers, signer) } return signers, nil } func ReadFiles(paths []string) ([][]byte, error) { var files [][]byte for _, p := range paths { b, err := os.ReadFile(p) if err != nil { return nil, fmt.Errorf("failed to read file %s: %w", p, err) } files = append(files, b) } return files, nil } func GenerateSessionID() string { return uniuri.NewLen(uniuri.UUIDLen) } func FingerprintSHA256(key ssh.PublicKey) string { hash := sha256.Sum256(key.Marshal()) b64hash := base64.StdEncoding.EncodeToString(hash[:]) return fmt.Sprintf("SHA256:%s", strings.TrimRight(b64hash, "=")) } func KeysEqual(pk1 ssh.PublicKey, pk2 ssh.PublicKey) bool { return gssh.KeysEqual(publicKey(pk1), publicKey(pk2)) } func publicKey(pk ssh.PublicKey) ssh.PublicKey { cert, ok := pk.(*ssh.Certificate) if ok { pk = cert.Key } return pk } upterm-0.17.0/ws/000077500000000000000000000000001507434540500135535ustar00rootroot00000000000000upterm-0.17.0/ws/client.go000066400000000000000000000035371507434540500153700ustar00rootroot00000000000000package ws import ( "encoding/base64" "net" "net/http" "net/url" "github.com/gorilla/websocket" chshare "github.com/jpillora/chisel/share" "github.com/owenthereal/upterm/upterm" "golang.org/x/crypto/ssh" ) // NewSSHClient creates a ssh client via ws. // The url must include username as session id and password as encoded node address. // isUptermClient indicates whether the client is host client or client client. func NewSSHClient(u *url.URL, config *ssh.ClientConfig, isUptermClient bool) (*ssh.Client, error) { conn, err := NewWSConn(u, isUptermClient) if err != nil { return nil, err } c, chans, reqs, err := ssh.NewClientConn(conn, u.Host, config) if err != nil { return nil, err } return ssh.NewClient(c, chans, reqs), nil } // NewWSConn creates a ws net.Conn. // The url must include username as session id and password as encoded node address. // isUptermClient indicates whether the client is host client or client client. func NewWSConn(u *url.URL, isUptermClient bool) (net.Conn, error) { u, _ = url.Parse(u.String()) // clone user := u.User u.User = nil // ws spec doesn't support basic auth encodedNodeAddr, _ := user.Password() header := webSocketDialHeader(user.Username(), encodedNodeAddr, isUptermClient) wsc, _, err := websocket.DefaultDialer.Dial(u.String(), header) if err != nil { return nil, err } return WrapWSConn(wsc), nil } func WrapWSConn(ws *websocket.Conn) net.Conn { return chshare.NewWebSocketConn(ws) } func webSocketDialHeader(sessionID, encodedNodeAddr string, isClient bool) http.Header { auth := base64.StdEncoding.EncodeToString([]byte(sessionID + ":" + encodedNodeAddr)) header := make(http.Header) header.Add("Authorization", "Basic "+auth) ver := upterm.HostSSHClientVersion if isClient { ver = upterm.ClientSSHClientVersion } header.Add(upterm.HeaderUptermClientVersion, ver) return header }