wip: wire up agent forward for libssh-rs

wezterm-ssh/Cargo.toml

@@ -31,10 +31,11 @@ portable-pty = { version="0.8", path = "../pty" }
 regex = "1"
 smol = "1.2"
 ssh2 = {version="0.9.3", features=["openssl-on-win32"], optional = true}
-libssh-rs = {version="0.2.1", features=["vendored"], optional = true}
-#libssh-rs = {path="../../libssh-rs/libssh-rs", features=["vendored"], optional = true}
+# libssh-rs = {version="0.2.1", features=["vendored"], optional = true}
+libssh-rs = {path="../../libssh-rs/libssh-rs", features=["vendored"], optional = true}
 thiserror = "1.0"
 socket2 = "0.5"
+uds_windows = "1.1.0"
 
 # Not used directly, but is used to centralize the openssl vendor feature selection
 async_ossl = { path = "../async_ossl" }

wezterm-ssh/examples/ssh.rs

@@ -58,6 +58,7 @@ fn main() {
     if let Some(user) = opts.user.as_ref() {
         config.insert("user".to_string(), user.to_string());
     }
+    config.insert("forwardagent".to_string(), "yes".to_string());
 
     let res = smol::block_on(async move {
         let (session, events) = Session::connect(config.clone())?;

wezterm-ssh/src/channelwrap.rs

@@ -146,6 +146,21 @@ impl ChannelWrap {
         }
     }
 
+    pub fn request_auth_agent_forwarding(&mut self) -> anyhow::Result<()> {
+        match self {
+            /* libssh2 doesn't properly support agent forwarding
+             * at this time:
+             * <https://github.com/libssh2/libssh2/issues/535> */
+            #[cfg(feature = "ssh2")]
+            Self::Ssh2(_chan) => Err(anyhow::anyhow!(
+                "ssh2 does not support request_auth_agent_forwarding"
+            )),
+
+            #[cfg(feature = "libssh-rs")]
+            Self::LibSsh(chan) => Ok(chan.request_auth_agent()?),
+        }
+    }
+
     pub fn resize_pty(&mut self, resize: &ResizePty) -> anyhow::Result<()> {
         match self {
             #[cfg(feature = "ssh2")]

wezterm-ssh/src/pty.rs

@@ -218,17 +218,13 @@ impl crate::sessioninner::SessionInner {
 
         let mut channel = sess.open_session()?;
 
-        /* libssh2 doesn't properly support agent forwarding
-         * at this time:
-         * <https://github.com/libssh2/libssh2/issues/535>
         if let Some("yes") = self.config.get("forwardagent").map(|s| s.as_str()) {
-            log::info!("requesting agent forwarding");
-            if let Err(err) = channel.request_auth_agent_forwarding() {
-                log::error!("Failed to establish agent forwarding: {:#}", err);
+            if let Some(_) = self.identity_agent() {
+                if let Err(err) = channel.request_auth_agent_forwarding() {
+                    log::error!("Failed to request agent forwarding: {:#}", err);
+                }
             }
-            log::info!("agent forwarding OK!");
         }
-        */
 
         channel.request_pty(&newpty)?;
 

wezterm-ssh/src/sessioninner.rs

@@ -243,6 +243,15 @@ impl SessionInner {
             .try_send(SessionEvent::Authenticated)
             .context("notifying user that session is authenticated")?;
 
+        if let Some("yes") = self.config.get("forwardagent").map(|s| s.as_str()) {
+            if self.identity_agent().is_some() {
+                // If we don't have agent forward enabled we don't setup the callback at all,
+                // so just return true (accepted).
+                sess.set_channel_open_request_auth_agent_callback(|| true);
+            } else {
+                log::error!("ForwardAgent is set to yes, but IdentityAgent is not set");
+            }
+        }
         sess.set_blocking(false);
         let mut sess = SessionWrap::with_libssh(sess);
         self.request_loop(&mut sess)
@@ -405,6 +414,7 @@ impl SessionInner {
             self.tick_io()?;
             self.drain_request_pipe();
             self.dispatch_pending_requests(sess)?;
+            self.connect_pending_agent_forward_channels(sess);
 
             if self.channels.is_empty() && self.session_was_dropped {
                 log::trace!(
@@ -517,8 +527,16 @@ impl SessionInner {
 
             let stdin = &mut chan.descriptors[0];
             if stdin.fd.is_some() && !stdin.buf.is_empty() {
-                write_from_buf(&mut chan.channel.writer(), &mut stdin.buf)
-                    .context("writing to channel")?;
+                if let Err(err) = write_from_buf(&mut chan.channel.writer(), &mut stdin.buf)
+                    .context("writing to channel")
+                {
+                    log::trace!(
+                        "Failed to write data to channel {} stdin: {:#}, closing pipe",
+                        id,
+                        err
+                    );
+                    stdin.fd.take();
+                }
             }
 
             for (idx, out) in chan
@@ -805,6 +823,64 @@ impl SessionInner {
         }
     }
 
+    fn connect_pending_agent_forward_channels(&mut self, sess: &mut SessionWrap) {
+        fn process_one(sess: &mut SessionInner, channel: ChannelWrap) -> anyhow::Result<()> {
+            let identity_agent = sess
+                .identity_agent()
+                .ok_or_else(|| anyhow!("no identity agent in config"))?;
+            let mut fd = {
+                #[cfg(unix)]
+                {
+                    use std::os::unix::net::UnixStream;
+                    FileDescriptor::new(UnixStream::connect(&identity_agent)?)
+                }
+                #[cfg(windows)]
+                unsafe {
+                    use std::os::windows::io::{FromRawSocket, IntoRawSocket};
+                    use uds_windows::UnixStream;
+                    FileDescriptor::from_raw_socket(
+                        UnixStream::connect(&identity_agent)?.into_raw_socket(),
+                    )
+                }
+            };
+
+            let channel_id = sess.next_channel_id;
+            sess.next_channel_id += 1;
+
+            fd.set_non_blocking(true)?;
+            let read_from_agent = fd;
+            let write_to_agent = read_from_agent.try_clone()?;
+
+            let info = ChannelInfo {
+                channel_id,
+                channel,
+                exit: None,
+                exited: false,
+                descriptors: [
+                    DescriptorState {
+                        fd: Some(read_from_agent),
+                        buf: VecDeque::with_capacity(8192),
+                    },
+                    DescriptorState {
+                        fd: Some(write_to_agent),
+                        buf: VecDeque::with_capacity(8192),
+                    },
+                    DescriptorState {
+                        fd: None,
+                        buf: VecDeque::with_capacity(8192),
+                    },
+                ],
+            };
+            sess.channels.insert(channel_id, info);
+            Ok(())
+        }
+        while let Some(channel) = sess.accept_agent_forward() {
+            if let Err(err) = process_one(self, channel) {
+                log::error!("error connecting agent forward: {:#}", err);
+            }
+        }
+    }
+
     pub fn signal_channel(&mut self, info: &SignalChannel) -> anyhow::Result<()> {
         let chan_info = self
             .channels
@@ -944,6 +1020,13 @@ impl SessionInner {
             }
         }
     }
+
+    pub fn identity_agent(&self) -> Option<String> {
+        self.config
+            .get("identityagent")
+            .map(|s| s.to_owned())
+            .or_else(|| std::env::var("SSH_AUTH_SOCK").ok())
+    }
 }
 
 fn write_from_buf<W: Write>(w: &mut W, buf: &mut VecDeque<u8>) -> std::io::Result<()> {

wezterm-ssh/src/sessionwrap.rs

@@ -92,4 +92,16 @@ impl SessionWrap {
             }
         }
     }
+
+    pub fn accept_agent_forward(&mut self) -> Option<ChannelWrap> {
+        match self {
+            // Unimplemented for now, an error message was printed earlier when the user tries to
+            // enable agent forwarding so just return nothing here.
+            #[cfg(feature = "ssh2")]
+            Self::Ssh2(_sess) => None,
+
+            #[cfg(feature = "libssh-rs")]
+            Self::LibSsh(sess) => sess.sess.accept_agent_forward().map(ChannelWrap::LibSsh),
+        }
+    }
 }

wezterm-ssh/src/sftpwrap.rs

@@ -38,6 +38,7 @@ impl SftpWrap {
             Self::LibSsh(sftp) => {
                 use crate::sftp::types::WriteMode;
                 use libc::{O_APPEND, O_RDONLY, O_RDWR, O_WRONLY};
+                use libssh_rs::OpenFlags;
                 use std::convert::TryInto;
                 let accesstype = match (opts.write, opts.read) {
                     (Some(WriteMode::Append), true) => O_RDWR | O_APPEND,
@@ -47,8 +48,11 @@ impl SftpWrap {
                     (None, true) => O_RDONLY,
                     (None, false) => 0,
                 };
-                let file =
-                    sftp.open(filename.as_str(), accesstype, opts.mode.try_into().unwrap())?;
+                let file = sftp.open(
+                    filename.as_str(),
+                    OpenFlags::from_bits_truncate(accesstype),
+                    opts.mode.try_into().unwrap(),
+                )?;
                 Ok(FileWrap::LibSsh(file))
             }
         }