simon-git: putty (main): Simon Tatham

Sat May 22 14:15:07 BST 2021

TL;DR:
  62b694af New backend flag indicating support for CONF_ssh_nc_host.
  0553aec6 New Seat method, notify_remote_disconnect.
  0d3bb736 Initial support for in-process proxy SSH connections.

Repository:     https://git.tartarus.org/simon/putty.git
On the web:     https://git.tartarus.org/?p=simon/putty.git
Branch updated: main
Committer:      Simon Tatham <anakin at pobox.com>
Date:           2021-05-22 14:15:07

commit 62b694affc0ce0377576bb34ed005ad0c38cd013
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=62b694affc0ce0377576bb34ed005ad0c38cd013;hp=1e726c94e8d53c929a568a74fd54f71148550696
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat May 22 11:27:19 2021 +0100

    New backend flag indicating support for CONF_ssh_nc_host.

    This flag is set in backends which can be used programmatically to
    proxy a network connection in place of running a shell session. That
    is true of both SSH proper, and the psusan ssh-connection protocol.

    Nothing yet uses this flag, but something is about to.

 putty.h   | 2 ++
 ssh/ssh.c | 2 ++
 2 files changed, 4 insertions(+)

commit 0553aec60a0a7fdc01584db2df3e4b59925620d4
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=0553aec60a0a7fdc01584db2df3e4b59925620d4;hp=62b694affc0ce0377576bb34ed005ad0c38cd013
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat May 22 12:47:51 2021 +0100

    New Seat method, notify_remote_disconnect.

    This notifies the Seat that the entire backend session has finished
    and closed its network connection - or rather, that it _might_ have
    done, and that the frontend should check backend_connected() if it
    wasn't planning to do so already.

    The existing Seat implementations haven't needed this: the GUI ones
    don't actually need to do anything specific when the network
    connection goes away, and the CLI ones deal with it by being in charge
    of their own event loop so that they can easily check
    backend_connected() at every possible opportunity in any case. But I'm
    about to introduce a new Seat implementation that does need to know
    this, and doesn't have any other way to get notified of it.

 otherbackends/raw.c    |  2 ++
 otherbackends/rlogin.c |  1 +
 otherbackends/supdup.c |  1 +
 otherbackends/telnet.c |  1 +
 pscp.c                 |  1 +
 psftp.c                |  1 +
 putty.h                | 26 ++++++++++++++++++++++++++
 ssh/server.c           |  1 +
 ssh/sesschan.c         |  1 +
 ssh/ssh.c              |  3 +++
 unix/plink.c           |  1 +
 unix/window.c          |  1 +
 utils/nullseat.c       |  1 +
 windows/plink.c        |  1 +
 windows/window.c       |  1 +
 15 files changed, 43 insertions(+)

commit 0d3bb73608f1a5d1d5337e51736d48dad1436af5
web diff https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=0d3bb73608f1a5d1d5337e51736d48dad1436af5;hp=0553aec60a0a7fdc01584db2df3e4b59925620d4
Author: Simon Tatham <anakin at pobox.com>
Date:   Sat May 22 12:51:23 2021 +0100

    Initial support for in-process proxy SSH connections.

    This introduces a new entry to the radio-button list of proxy types,
    in which the 'Proxy host' box is taken to be the name of an SSH server
    or saved session. We make an entire subsidiary SSH connection to that
    host, open a direct-tcpip channel through it, and use that as the
    connection over which to run the primary network connection.

    The result is basically the same as if you used a local proxy
    subprocess, with a command along the lines of 'plink -batch %proxyhost
    -nc %host:%port'. But it's all done in-process, by having an SshProxy
    object implement the Socket trait to talk to the main connection, and
    implement Seat and LogPolicy to talk to its subsidiary SSH backend.
    All the refactoring in recent years has got us to the point where we
    can do that without both SSH instances fighting over some global
    variable or unique piece of infrastructure.

    From an end user perspective, doing SSH proxying in-process like this
    is a little bit easier to set up: it doesn't require you to bake the
    full pathname of Plink into your saved session (or to have it on the
    system PATH), and the SshProxy setup function automatically turns off
    SSH features that would be inappropriate in this context, such as
    additional port forwardings, or acting as a connection-sharing
    upstream. And it has minor advantages like getting the Event Log for
    the subsidiary connection interleaved in the main Event Log, as if it
    were stderr output from a proxy subcommand, without having to
    deliberately configure the subsidiary Plink into verbose mode.

    However, this is an initial implementation only, and it doesn't yet
    support the _big_ payoff for doing this in-process, which (I hope)
    will be the ability to handle interactive prompts from the subsidiary
    SSH connection via the same user interface as the primary one. For
    example, you might need to answer two password prompts in succession,
    or (the first time you use a session configured this way) confirm the
    host keys for both proxy and destination SSH servers. Comments in the
    new source file discuss some design thoughts on filling in this gap.

    For the moment, if the proxy SSH connection encounters any situation
    where an interactive prompt is needed, it will make the safe
    assumption, the same way 'plink -batch' would do. So it's at least no
    _worse_ than the existing technique of putting the proxy connection in
    a subprocess.

 CMakeLists.txt         |   3 +-
 config.c               |  30 ++-
 network.h              |   6 +
 nosshproxy.c           |  16 ++
 proxy.c                |   5 +
 putty.h                |   6 +-
 sshproxy.c             | 544 +++++++++++++++++++++++++++++++++++++++++++++++++
 unix/CMakeLists.txt    |   8 +-
 unix/config-unix.c     |   2 +
 windows/CMakeLists.txt |   2 +
 windows/config.c       |   2 +
 11 files changed, 610 insertions(+), 14 deletions(-)