SSH connection with HTTP Proxy

[JCHacking]

I need to connect via SSH to a server using a proxy which works with HTTP CONNECT, how can I do it?
I don't see any way with aiosocks to do it.

With this proxy configuration in PuTTY is how I get connected. (Data for example, not real data)

[ronf]

There's no built-in support for this in AsyncSSH today, and as you said aiosocks can't be used for this either. The aiohttp package does support HTTP CONNECT requests, but unfortunately it doesn't support the low level callback-based asyncio APIs for creating transports and protocols, which is what would be needed to work with AsyncSSH. The HTTP CONNECT mechanism is pretty simple, so it wouldn't be hard to built your own tunneling class which sent a "CONNECT host:port HTTP/1.1" followed by a blank line that and parsed the response looking for a response like "HTTP/1.1 200 OK" and skipped past additional header lines until you saw a blank line. After that, all output could be forwarded to AsyncSSH.

In the meantime, a workaround would be to use the proxy_command option. For instance, you could provide a proxy_command of 'nc -X connect -x proxy.com:3111 ssh_host 22' to tell Netcat to connect via HTTP CONNECT through proxy.com on port 3111 to the SSH server at ssh_host on port 22. This isn't very efficient, as you end up having a separate 'nc' process running for each connection you open that has to shuffle data from AsyncSSH to the proxy for the entire lifetime of the connection, but it should work.

[ronf]

Searching a bit, I was reminded that there was an attempt to implement an HTTP CONNECT tunnel a while back in #429. This still isn't something I'm looking to add directly in AsyncSSH right now, but you could experiment with that to see if it works for you. It would be more efficient than the proxy_command solution, avoiding the need for any external processes.

To use this, you'd instantiate an HTTPConnectorTunnel with arguments of the proxy host & port and an optional SSL context if you wanted to run SSH inside of SSL and then pass this tunnel object to asyncssh.connect() as a tunnel option. Note that there's no reason any of this code would have to be in the AsyncSSH connection.py module. It could just be part of your application.

[JCHacking]

Perfect, I've been looking at this initiative to be able to start from the code of these commits https://github.com/ronf/asyncssh/pull/429/files , so far everything works fine but I can't find this part:
protocol = protocol_factory() line 236
As far as I can see it does not seem to be a property that I can import, how would I do then?

[ronf]

I haven't tried the example code in #429 myself yet, but it looks like the call to protocol_factory() there should instead be a call to session_factory(), or you could rename the session_factory argument to create_connection() to be named protocol_factory. If I get a chance later tonight, I'll take a closer look.

[ronf]

Here's a slightly edited version of Nalin Goel's code from #429 which I was able to get to work:

import asyncio
import asyncssh
import ssl

class HTTPConnectorTunnel:
    def __init__(self, proxy_host, proxy_port, ssl_context = None):
        self._proxy_host = proxy_host
        self._proxy_port = proxy_port
        self._ssl_context = ssl_context

    async def create_connection(self, protocol_factory, remote_host, remote_port):
        reader, writer = await asyncio.open_connection(
            self._proxy_host, self._proxy_port, ssl=self._ssl_context)

        cmd_connect = f'CONNECT {remote_host}:{remote_port} ' \
                      f'HTTP/1.1\r\n\r\n'.encode('ascii')
        writer.write(cmd_connect)

        line = await reader.readline()
        if not line.startswith(b'HTTP/1.1 200 '):
            raise ConnectionError('Unexpected response: '
                                  f'{line.decode("utf-8", errors="ignore")}')

        async for line in reader:
            if line == b'\r\n':
                 break

        transport = writer.transport
        protocol = protocol_factory()
        transport.set_protocol(protocol)
        protocol.connection_made(transport)

        return transport, protocol

async def run():
    tunnel = HTTPConnectorTunnel('proxy_host', 3111)

    async with asyncssh.connect('remote_host', tunnel=tunnel):
        pass

asyncio.run(run())

[JCHacking]

Thank you!!! It seems to work, the only thing is the typing.

This would be the code I have done for this class:

class HTTPProxyTunnel:
    """HTTP Proxy Tunner.

    Attributes:
        __proxy: Address of the proxy to use
    """
    def __init__(self, proxy: str):
        """HTTP Proxy Tunner.

        Args:
            proxy: Address of the proxy to use
        """
        self.__proxy: str = proxy

    async def create_connection(self, session_factory: asyncssh.session.SSHTCPSessionFactory[bytes], host: str,
                                port: int) -> tuple[asyncssh.SSHTCPChannel[bytes], asyncssh.SSHTCPSession[bytes]]:
        """Create Connection for http proxy.

        Args:
            session_factory: Session Factory from create tunnel
            host: Host Address to connect
            port: Port to connect

        Returns:
            Connection with HTTP Proxy
        """
        reader: asyncio.StreamReader
        writer: asyncio.StreamWriter
        reader, writer = await asyncio.open_connection(
            self.__proxy[:self.__proxy.index(":")],
            int(self.__proxy[self.__proxy.index(":") + 1:])
        )

        writer.write(f"CONNECT {host}:{port} HTTP/1.1\r\n\r\n".encode("ASCII"))

        line: bytes = await reader.readline()
        if not line.startswith(b"HTTP/1.1 200 "):
            raise ConnectionError(f"Unexpected response: {line.decode('utf-8', errors='ignore')}")

        async for line in reader:
            if line == b"\r\n":
                break

        transport: asyncio.WriteTransport = writer.transport
        protocol: asyncssh.SSHTCPSession[bytes] = session_factory()
        transport.set_protocol(protocol)
        protocol.connection_made(transport)
        return transport, protocol

But mypy detects these typing errors:

error: Argument 1 to "set_protocol" of "BaseTransport" has incompatible type "SSHTCPSession[bytes]"; ex
pected "BaseProtocol"  [arg-type]
error: Argument 1 to "connection_made" of "SSHTCPSession" has incompatible type "WriteTransport"; expec
ted "SSHTCPChannel[bytes]"  [arg-type]
error: Incompatible return value type (got "Tuple[WriteTransport, SSHTCPSession[bytes]]", expected "Tup
le[SSHTCPChannel[bytes], SSHTCPSession[bytes]]")  [return-value]

As far as I can see, although it works at the typing level, there are the following incompatibilities:

• asyncio.WriteTransport does not have set_protocol method
• asyncssh.SSHTCPSession does not accept WriteTransport type as first constructor parameter
• SSHTCPChannel and WriteTransport are not equivalent at the typing level to be correct.

Should I ignore these errors or is there a correct way to type this so that it does not give these type errors?

[ronf]

The types you're using here (and those in #429) are not quite right. Those types made sense for when tunneling SSH over itself, but not when doing so with transports and protocols coming from asyncio.

One version of this which works for me in terms of typing is:

import asyncio
import asyncssh
import ssl

from typing import Optional, Tuple, Type


class HTTPConnectorTunnel:
    def __init__(self, proxy_host: str, proxy_port: int,
                 ssl_context: Optional[ssl.SSLContext] = None) -> None:
        self._proxy_host = proxy_host
        self._proxy_port = proxy_port
        self._ssl_context = ssl_context

    async def create_connection(
            self, protocol_factory: Type[asyncio.BaseProtocol],
            remote_host: str, remote_port: int) -> Tuple[asyncio.BaseTransport,
                                                         asyncio.BaseProtocol]:
        reader, writer = await asyncio.open_connection(
            self._proxy_host, self._proxy_port, ssl=self._ssl_context)

        cmd_connect = f'CONNECT {remote_host}:{remote_port} ' \
                      f'HTTP/1.1\r\n\r\n'.encode('ascii')
        writer.write(cmd_connect)

        line = await reader.readline()
        if not line.startswith(b'HTTP/1.1 200 '):
            raise ConnectionError('Unexpected response: '
                                  f'{line.decode("utf-8", errors="ignore")}')

        async for line in reader:
            if line == b'\r\n':
                 break

        transport = writer.transport
        protocol = protocol_factory()
        transport.set_protocol(protocol)
        protocol.connection_made(transport)
        return transport, protocol

async def run() -> None:
    tunnel = HTTPConnectorTunnel('localhost', 9999)

    async with asyncssh.connect('localhost', 2222, tunnel=tunnel):
        pass

asyncio.run(run())

The set_protocol() method exists on BaseProtocol, which is a parent of WriteTransport. As for SSHTCPSession and SSHTCPChannel, those aren't right when getting an asyncio StreamReader and StreamWriter from asyncio.open_connection().

[JCHacking]

Thank you very much, it works perfect!!!! 🎉