extcap/sshdump.c

   1 /* sshdump.c
   2  * sshdump is extcap tool used to capture data using a remote ssh host
   3  *
   4  * Copyright 2015, Dario Lombardo
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13 #include "config.h"
  14 #define WS_LOG_DOMAIN "sshdump"
  15
  16 #include <extcap/extcap-base.h>
  17 #include <extcap/ssh-base.h>
  18 #include <wsutil/interface.h>
  19 #include <wsutil/file_util.h>
  20 #include <wsutil/strtoi.h>
  21 #include <wsutil/filesystem.h>
  22 #include <wsutil/privileges.h>
  23 #include <wsutil/please_report_bug.h>
  24 #include <wsutil/wslog.h>
  25
  26 #include <errno.h>
  27 #include <string.h>
  28 #include <fcntl.h>
  29
  30 #include <cli_main.h>
  31
  32 static gchar* sshdump_extcap_interface;
  33 #ifdef _WIN32
  34 #define DEFAULT_SSHDUMP_EXTCAP_INTERFACE "sshdump.exe"
  35 #else
  36 #define DEFAULT_SSHDUMP_EXTCAP_INTERFACE "sshdump"
  37 #endif
  38
  39 #define SSHDUMP_VERSION_MAJOR "1"
  40 #define SSHDUMP_VERSION_MINOR "0"
  41 #define SSHDUMP_VERSION_RELEASE "0"
  42
  43 #define SSH_READ_BLOCK_SIZE 256
  44
  45 enum {
  46         EXTCAP_BASE_OPTIONS_ENUM,
  47         OPT_HELP,
  48         OPT_VERSION,
  49         OPT_REMOTE_HOST,
  50         OPT_REMOTE_PORT,
  51         OPT_REMOTE_USERNAME,
  52         OPT_REMOTE_PASSWORD,
  53         OPT_REMOTE_INTERFACE,
  54         OPT_REMOTE_CAPTURE_COMMAND,
  55         OPT_REMOTE_FILTER,
  56         OPT_SSHKEY,
  57         OPT_SSHKEY_PASSPHRASE,
  58         OPT_PROXYCOMMAND,
  59         OPT_REMOTE_COUNT,
  60         OPT_REMOTE_SUDO,
  61         OPT_REMOTE_NOPROM
  62 };
  63
  64 static struct option longopts[] = {
  65         EXTCAP_BASE_OPTIONS,
  66         { "help", no_argument, NULL, OPT_HELP},
  67         { "version", no_argument, NULL, OPT_VERSION},
  68         SSH_BASE_OPTIONS,
  69         { "remote-capture-command", required_argument, NULL, OPT_REMOTE_CAPTURE_COMMAND},
  70         { "remote-sudo", no_argument, NULL, OPT_REMOTE_SUDO },
  71         { "remote-noprom", no_argument, NULL, OPT_REMOTE_NOPROM },
  72         { 0, 0, 0, 0}
  73 };
  74
  75 static char* interfaces_list_to_filter(GSList* if_list, unsigned int remote_port);
  76
  77 static int ssh_loop_read(ssh_channel channel, FILE* fp)
  78 {
  79         int nbytes;
  80         int ret = EXIT_SUCCESS;
  81         char buffer[SSH_READ_BLOCK_SIZE];
  82
  83         /* read from stdin until data are available */
  84         while (ssh_channel_is_open(channel) && !ssh_channel_is_eof(channel)) {
  85                 nbytes = ssh_channel_read(channel, buffer, SSH_READ_BLOCK_SIZE, 0);
  86                 if (nbytes < 0) {
  87                         ws_warning("Error reading from channel");
  88                         goto end;
  89                 }
  90                 if (nbytes == 0) {
  91                         break;
  92                 }
  93                 if (fwrite(buffer, 1, nbytes, fp) != (guint)nbytes) {
  94                         ws_warning("Error writing to fifo");
  95                         ret = EXIT_FAILURE;
  96                         goto end;
  97                 }
  98                 fflush(fp);
  99         }
 100
 101         /* read loop finished... maybe something wrong happened. Read from stderr */
 102         while (ssh_channel_is_open(channel) && !ssh_channel_is_eof(channel)) {
 103                 nbytes = ssh_channel_read(channel, buffer, SSH_READ_BLOCK_SIZE, 1);
 104                 if (nbytes < 0) {
 105                         ws_warning("Error reading from channel");
 106                         goto end;
 107                 }
 108                 if (fwrite(buffer, 1, nbytes, stderr) != (guint)nbytes) {
 109                         ws_warning("Error writing to stderr");
 110                         break;
 111                 }
 112         }
 113
 114 end:
 115         if (ssh_channel_send_eof(channel) != SSH_OK) {
 116                 ws_warning("Error sending EOF in ssh channel");
 117                 ret = EXIT_FAILURE;
 118         }
 119         return ret;
 120 }
 121
 122 static char* local_interfaces_to_filter(const guint16 remote_port)
 123 {
 124         GSList* interfaces = local_interfaces_to_list();
 125         char* filter = interfaces_list_to_filter(interfaces, remote_port);
 126         g_slist_free_full(interfaces, g_free);
 127         return filter;
 128 }
 129
 130 static ssh_channel run_ssh_command(ssh_session sshs, const char* capture_command, const gboolean use_sudo, gboolean noprom,
 131                 const char* iface, const char* cfilter, const guint32 count)
 132 {
 133         gchar* cmdline;
 134         ssh_channel channel;
 135         char* quoted_iface = NULL;
 136         char* quoted_filter = NULL;
 137         char* count_str = NULL;
 138         unsigned int remote_port = 22;
 139
 140         channel = ssh_channel_new(sshs);
 141         if (!channel) {
 142                 ws_warning("Can't create channel");
 143                 return NULL;
 144         }
 145
 146         if (ssh_channel_open_session(channel) != SSH_OK) {
 147                 ws_warning("Can't open session");
 148                 ssh_channel_free(channel);
 149                 return NULL;
 150         }
 151
 152         ssh_options_get_port(sshs, &remote_port);
 153
 154         /* escape parameters to go save with the shell */
 155         if (capture_command && *capture_command) {
 156                 cmdline = g_strdup(capture_command);
 157                 ws_debug("Remote capture command has disabled other options");
 158         } else {
 159                 quoted_iface = iface ? g_shell_quote(iface) : NULL;
 160                 quoted_filter = g_shell_quote(cfilter ? cfilter : "");
 161                 if (count > 0)
 162                         count_str = g_strdup_printf("-c %u", count);
 163
 164                 cmdline = g_strdup_printf("%s tcpdump -U %s%s %s -w - %s %s",
 165                         use_sudo ? "sudo" : "",
 166                         quoted_iface ? "-i " : "",
 167                         quoted_iface ? quoted_iface : "",
 168                         noprom ? "-p" : "",
 169                         count_str ? count_str : "",
 170                         quoted_filter);
 171         }
 172
 173         ws_debug("Running: %s", cmdline);
 174         if (ssh_channel_request_exec(channel, cmdline) != SSH_OK) {
 175                 ws_warning("Can't request exec");
 176                 ssh_channel_close(channel);
 177                 ssh_channel_free(channel);
 178                 channel = NULL;
 179         }
 180
 181         g_free(quoted_iface);
 182         g_free(quoted_filter);
 183         g_free(cmdline);
 184         g_free(count_str);
 185
 186         return channel;
 187 }
 188
 189 static int ssh_open_remote_connection(const ssh_params_t* params, const char* iface, const char* cfilter,
 190         const char* capture_command, const gboolean use_sudo, gboolean noprom, const guint32 count, const char* fifo)
 191 {
 192         ssh_session sshs = NULL;
 193         ssh_channel channel = NULL;
 194         FILE* fp = stdout;
 195         int ret = EXIT_FAILURE;
 196         char* err_info = NULL;
 197
 198         if (g_strcmp0(fifo, "-")) {
 199                 /* Open or create the output file */
 200                 fp = fopen(fifo, "wb");
 201                 if (fp == NULL) {
 202                         ws_warning("Error creating output file: %s (%s)", fifo, g_strerror(errno));
 203                         return EXIT_FAILURE;
 204                 }
 205         }
 206
 207         sshs = create_ssh_connection(params, &err_info);
 208
 209         if (!sshs) {
 210                 ws_warning("Error creating connection.");
 211                 goto cleanup;
 212         }
 213
 214         channel = run_ssh_command(sshs, capture_command, use_sudo, noprom, iface, cfilter, count);
 215
 216         if (!channel) {
 217                 ws_warning("Can't run ssh command.");
 218                 goto cleanup;
 219         }
 220
 221         /* read from channel and write into fp */
 222         if (ssh_loop_read(channel, fp) != EXIT_SUCCESS) {
 223                 ws_warning("Error in read loop.");
 224                 ret = EXIT_FAILURE;
 225                 goto cleanup;
 226         }
 227
 228         ret = EXIT_SUCCESS;
 229 cleanup:
 230         if (err_info)
 231                 ws_warning("%s", err_info);
 232         g_free(err_info);
 233
 234         /* clean up and exit */
 235         ssh_cleanup(&sshs, &channel);
 236
 237         if (g_strcmp0(fifo, "-"))
 238                 fclose(fp);
 239         return ret;
 240 }
 241
 242 static char* interfaces_list_to_filter(GSList* interfaces, unsigned int remote_port)
 243 {
 244         GString* filter = g_string_new(NULL);
 245         GSList* cur;
 246
 247         // If no port is given, assume the default one. This might not be
 248         // correct if the port is looked up from the ssh config file, but it is
 249         // better than nothing.
 250         if (remote_port == 0) {
 251                 remote_port = 22;
 252         }
 253
 254         if (!interfaces) {
 255                 g_string_append_printf(filter, "not port %u", remote_port);
 256         } else {
 257                 g_string_append_printf(filter, "not ((host %s", (char*)interfaces->data);
 258                 cur = g_slist_next(interfaces);
 259                 while (cur) {
 260                         g_string_append_printf(filter, " or host %s", (char*)cur->data);
 261                         cur = g_slist_next(cur);
 262                 }
 263                 g_string_append_printf(filter, ") and port %u)", remote_port);
 264         }
 265         return g_string_free(filter, FALSE);
 266 }
 267
 268 static int list_config(char *interface, unsigned int remote_port)
 269 {
 270         unsigned inc = 0;
 271         char* ipfilter;
 272
 273         if (!interface) {
 274                 ws_warning("ERROR: No interface specified.");
 275                 return EXIT_FAILURE;
 276         }
 277
 278         if (g_strcmp0(interface, sshdump_extcap_interface)) {
 279                 ws_warning("ERROR: interface must be %s", sshdump_extcap_interface);
 280                 return EXIT_FAILURE;
 281         }
 282
 283         ipfilter = local_interfaces_to_filter(remote_port);
 284
 285         printf("arg {number=%u}{call=--remote-host}{display=Remote SSH server address}"
 286                 "{type=string}{tooltip=The remote SSH host. It can be both "
 287                 "an IP address or a hostname}{required=true}{group=Server}\n", inc++);
 288         printf("arg {number=%u}{call=--remote-port}{display=Remote SSH server port}"
 289                 "{type=unsigned}{tooltip=The remote SSH host port (1-65535)}"
 290                 "{range=1,65535}{group=Server}\n", inc++);
 291         printf("arg {number=%u}{call=--remote-username}{display=Remote SSH server username}"
 292                 "{type=string}{tooltip=The remote SSH username. If not provided, "
 293                 "the current user will be used}{group=Authentication}\n", inc++);
 294         printf("arg {number=%u}{call=--remote-password}{display=Remote SSH server password}"
 295                 "{type=password}{tooltip=The SSH password, used when other methods (SSH agent "
 296                 "or key files) are unavailable.}{group=Authentication}\n", inc++);
 297         printf("arg {number=%u}{call=--sshkey}{display=Path to SSH private key}"
 298                 "{type=fileselect}{tooltip=The path on the local filesystem of the private ssh key}"
 299                 "{mustexist=true}{group=Authentication}\n", inc++);
 300         printf("arg {number=%u}{call=--sshkey-passphrase}{display=SSH key passphrase}"
 301                 "{type=password}{tooltip=Passphrase to unlock the SSH private key}{group=Authentication}\n",
 302                 inc++);
 303         printf("arg {number=%u}{call=--proxycommand}{display=ProxyCommand}"
 304                 "{type=string}{tooltip=The command to use as proxy for the SSH connection}"
 305                 "{group=Authentication}\n", inc++);
 306         printf("arg {number=%u}{call=--remote-interface}{display=Remote interface}"
 307                 "{type=string}{tooltip=The remote network interface used for capture"
 308                 "}{group=Capture}\n", inc++);
 309         printf("arg {number=%u}{call=--remote-capture-command}{display=Remote capture command}"
 310                 "{type=string}{tooltip=The remote command used to capture}{group=Capture}\n", inc++);
 311         printf("arg {number=%u}{call=--remote-sudo}{display=Use sudo on the remote machine}"
 312                 "{type=boolean}{tooltip=Prepend the capture command with sudo on the remote machine}"
 313                 "{group=Capture}\n", inc++);
 314         printf("arg {number=%u}{call=--remote-noprom}{display=No promiscuous mode}"
 315                 "{type=boolflag}{tooltip=Don't use promiscuous mode on the remote machine}{group=Capture}"
 316                 "\n", inc++);
 317         printf("arg {number=%u}{call=--remote-filter}{display=Remote capture filter}{type=string}"
 318                 "{tooltip=The remote capture filter}", inc++);
 319         if (ipfilter)
 320                 printf("{default=%s}", ipfilter);
 321         printf("{group=Capture}\n");
 322         printf("arg {number=%u}{call=--remote-count}{display=Packets to capture}"
 323                 "{type=unsigned}{default=0}{tooltip=The number of remote packets to capture. (Default: inf)}"
 324                 "{group=Capture}\n", inc++);
 325
 326         extcap_config_debug(&inc);
 327
 328         g_free(ipfilter);
 329
 330         return EXIT_SUCCESS;
 331 }
 332
 333 static char* concat_filters(const char* extcap_filter, const char* remote_filter)
 334 {
 335         if (!extcap_filter && remote_filter)
 336                 return g_strdup(remote_filter);
 337
 338         if (!remote_filter && extcap_filter)
 339                 return g_strdup(extcap_filter);
 340
 341         if (!remote_filter && !extcap_filter)
 342                 return NULL;
 343
 344         return g_strdup_printf("(%s) and (%s)", extcap_filter, remote_filter);
 345 }
 346
 347 int main(int argc, char *argv[])
 348 {
 349         char* err_msg;
 350         int result;
 351         int option_idx = 0;
 352         ssh_params_t* ssh_params = ssh_params_new();
 353         char* remote_interface = NULL;
 354         char* remote_capture_command = NULL;
 355         char* remote_filter = NULL;
 356         guint32 count = 0;
 357         int ret = EXIT_FAILURE;
 358         extcap_parameters* extcap_conf = g_new0(extcap_parameters, 1);
 359         char* help_url;
 360         char* help_header = NULL;
 361         gboolean use_sudo = FALSE;
 362         gboolean noprom = FALSE;
 363         gchar* interface_description = g_strdup("SSH remote capture");
 364
 365         sshdump_extcap_interface = g_path_get_basename(argv[0]);
 366
 367         /*
 368          * Get credential information for later use.
 369          */
 370         init_process_policies();
 371
 372         /*
 373          * Attempt to get the pathname of the directory containing the
 374          * executable file.
 375          */
 376         err_msg = init_progfile_dir(argv[0]);
 377         if (err_msg != NULL) {
 378                 ws_warning("Can't get pathname of directory containing the captype program: %s.",
 379                         err_msg);
 380                 g_free(err_msg);
 381         }
 382
 383         help_url = data_file_url("sshdump.html");
 384         extcap_base_set_util_info(extcap_conf, argv[0], SSHDUMP_VERSION_MAJOR, SSHDUMP_VERSION_MINOR,
 385                 SSHDUMP_VERSION_RELEASE, help_url);
 386         g_free(help_url);
 387         add_libssh_info(extcap_conf);
 388         if (g_strcmp0(sshdump_extcap_interface, DEFAULT_SSHDUMP_EXTCAP_INTERFACE)) {
 389                 gchar* temp = interface_description;
 390                 interface_description = g_strdup_printf("%s, custom version", interface_description);
 391                 g_free(temp);
 392         }
 393         extcap_base_register_interface(extcap_conf, sshdump_extcap_interface, interface_description, 147, "Remote capture dependent DLT");
 394         g_free(interface_description);
 395
 396         help_header = g_strdup_printf(
 397                 " %s --extcap-interfaces\n"
 398                 " %s --extcap-interface=%s --extcap-dlts\n"
 399                 " %s --extcap-interface=%s --extcap-config\n"
 400                 " %s --extcap-interface=%s --remote-host myhost --remote-port 22222 "
 401                 "--remote-username myuser --remote-interface eth2 --remote-capture-command 'tcpdump -U -i eth0 -w -' "
 402                 "--fifo=FILENAME --capture\n", argv[0], argv[0], sshdump_extcap_interface, argv[0],
 403                 sshdump_extcap_interface, argv[0], sshdump_extcap_interface);
 404         extcap_help_add_header(extcap_conf, help_header);
 405         g_free(help_header);
 406         extcap_help_add_option(extcap_conf, "--help", "print this help");
 407         extcap_help_add_option(extcap_conf, "--version", "print the version");
 408         extcap_help_add_option(extcap_conf, "--remote-host <host>", "the remote SSH host");
 409         extcap_help_add_option(extcap_conf, "--remote-port <port>", "the remote SSH port");
 410         extcap_help_add_option(extcap_conf, "--remote-username <username>", "the remote SSH username");
 411         extcap_help_add_option(extcap_conf, "--remote-password <password>", "the remote SSH password. If not specified, ssh-agent and ssh-key are used");
 412         extcap_help_add_option(extcap_conf, "--sshkey <public key path>", "the path of the ssh key");
 413         extcap_help_add_option(extcap_conf, "--sshkey-passphrase <public key passphrase>", "the passphrase to unlock public ssh");
 414         extcap_help_add_option(extcap_conf, "--proxycommand <proxy command>", "the command to use as proxy the the ssh connection");
 415         extcap_help_add_option(extcap_conf, "--remote-interface <iface>", "the remote capture interface");
 416         extcap_help_add_option(extcap_conf, "--remote-capture-command <capture command>", "the remote capture command");
 417         extcap_help_add_option(extcap_conf, "--remote-sudo", "use sudo on the remote machine to capture");
 418         extcap_help_add_option(extcap_conf, "--remote-noprom", "don't use promiscuous mode on the remote machine");
 419         extcap_help_add_option(extcap_conf, "--remote-filter <filter>", "a filter for remote capture (default: don't "
 420                 "listen on local interfaces IPs)");
 421         extcap_help_add_option(extcap_conf, "--remote-count <count>", "the number of packets to capture");
 422
 423         opterr = 0;
 424         optind = 0;
 425
 426         if (argc == 1) {
 427                 extcap_help_print(extcap_conf);
 428                 goto end;
 429         }
 430
 431         while ((result = getopt_long(argc, argv, ":", longopts, &option_idx)) != -1) {
 432
 433                 switch (result) {
 434
 435                 case OPT_HELP:
 436                         extcap_help_print(extcap_conf);
 437                         ret = EXIT_SUCCESS;
 438                         goto end;
 439
 440                 case OPT_VERSION:
 441                         extcap_version_print(extcap_conf);
 442                         ret = EXIT_SUCCESS;
 443                         goto end;
 444
 445                 case OPT_REMOTE_HOST:
 446                         g_free(ssh_params->host);
 447                         ssh_params->host = g_strdup(optarg);
 448                         break;
 449
 450                 case OPT_REMOTE_PORT:
 451                         if (!ws_strtou16(optarg, NULL, &ssh_params->port) || ssh_params->port == 0) {
 452                                 ws_warning("Invalid port: %s", optarg);
 453                                 goto end;
 454                         }
 455                         break;
 456
 457                 case OPT_REMOTE_USERNAME:
 458                         g_free(ssh_params->username);
 459                         ssh_params->username = g_strdup(optarg);
 460                         break;
 461
 462                 case OPT_REMOTE_PASSWORD:
 463                         g_free(ssh_params->password);
 464                         ssh_params->password = g_strdup(optarg);
 465                         memset(optarg, 'X', strlen(optarg));
 466                         break;
 467
 468                 case OPT_SSHKEY:
 469                         g_free(ssh_params->sshkey_path);
 470                         ssh_params->sshkey_path = g_strdup(optarg);
 471                         break;
 472
 473                 case OPT_SSHKEY_PASSPHRASE:
 474                         g_free(ssh_params->sshkey_passphrase);
 475                         ssh_params->sshkey_passphrase = g_strdup(optarg);
 476                         memset(optarg, 'X', strlen(optarg));
 477                         break;
 478
 479                 case OPT_PROXYCOMMAND:
 480                         g_free(ssh_params->proxycommand);
 481                         ssh_params->proxycommand = g_strdup(optarg);
 482                         break;
 483
 484                 case OPT_REMOTE_INTERFACE:
 485                         g_free(remote_interface);
 486                         remote_interface = g_strdup(optarg);
 487                         break;
 488
 489                 case OPT_REMOTE_CAPTURE_COMMAND:
 490                         g_free(remote_capture_command);
 491                         remote_capture_command = g_strdup(optarg);
 492                         break;
 493
 494                 case OPT_REMOTE_SUDO:
 495                         use_sudo = TRUE;
 496                         break;
 497
 498                 case OPT_REMOTE_FILTER:
 499                         g_free(remote_filter);
 500                         remote_filter = g_strdup(optarg);
 501                         break;
 502
 503                 case OPT_REMOTE_COUNT:
 504                         if (!ws_strtou32(optarg, NULL, &count)) {
 505                                 ws_warning("Invalid value for count: %s", optarg);
 506                                 goto end;
 507                         }
 508                         break;
 509
 510                 case OPT_REMOTE_NOPROM:
 511                         noprom = TRUE;
 512                         break;
 513
 514                 case ':':
 515                         /* missing option argument */
 516                         ws_warning("Option '%s' requires an argument", argv[optind - 1]);
 517                         break;
 518
 519                 default:
 520                         if (!extcap_base_parse_options(extcap_conf, result - EXTCAP_OPT_LIST_INTERFACES, optarg)) {
 521                                 ws_warning("Invalid option: %s", argv[optind - 1]);
 522                                 goto end;
 523                         }
 524                 }
 525         }
 526
 527         extcap_cmdline_debug(argv, argc);
 528
 529         if (extcap_base_handle_interface(extcap_conf)) {
 530                 ret = EXIT_SUCCESS;
 531                 goto end;
 532         }
 533
 534         if (extcap_conf->show_config) {
 535                 ret = list_config(extcap_conf->interface, ssh_params->port);
 536                 goto end;
 537         }
 538
 539         err_msg = ws_init_sockets();
 540         if (err_msg != NULL) {
 541                 ws_warning("ERROR: %s", err_msg);
 542                 g_free(err_msg);
 543                 ws_warning("%s", please_report_bug());
 544                 goto end;
 545         }
 546
 547         if (extcap_conf->capture) {
 548                 char* filter;
 549
 550                 if (!ssh_params->host) {
 551                         ws_warning("Missing parameter: --remote-host");
 552                         goto end;
 553                 }
 554                 filter = concat_filters(extcap_conf->capture_filter, remote_filter);
 555                 ssh_params->debug = extcap_conf->debug;
 556                 ret = ssh_open_remote_connection(ssh_params, remote_interface,
 557                         filter, remote_capture_command, use_sudo, noprom, count, extcap_conf->fifo);
 558                 g_free(filter);
 559         } else {
 560                 ws_debug("You should not come here... maybe some parameter missing?");
 561                 ret = EXIT_FAILURE;
 562         }
 563
 564 end:
 565         /* clean up stuff */
 566         ssh_params_free(ssh_params);
 567         g_free(remote_capture_command);
 568         g_free(remote_interface);
 569         g_free(remote_filter);
 570         extcap_base_cleanup(&extcap_conf);
 571         return ret;
 572 }
 573
 574 /*
 575  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 576  *
 577  * Local variables:
 578  * c-basic-offset: 8
 579  * tab-width: 8
 580  * indent-tabs-mode: t
 581  * End:
 582  *
 583  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 584  * :indentSize=8:tabSize=8:noTabs=false:
 585  */