SSH 协议与反向代理实战:从握手原理到多容器接入网关

func main() {
    hostKey := mustLoadSigner("/data/ssh-proxy/host_ed25519")  // 持久化, 重启不变
    proxyKey := mustLoadSigner("/data/ssh-proxy/proxy_ed25519") // 登容器用

    cfg := &ssh.ServerConfig{
        PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
            container := conn.User()           // ← 路由键 = 容器名
            info, err := lookupAPI(container)  // 调元数据 API(按连接缓存)
            if err != nil {
                return nil, err
            }
            if !info.AllowKey(key) {           // 库会自动验签, 这里只判授权
                return nil, fmt.Errorf("key not authorized")
            }
            return &ssh.Permissions{Extensions: map[string]string{ // 带到 post-auth
                "ip": info.IP, "port": info.Port, "user": info.UpstreamUser,
            }}, nil
        },
    }
    cfg.AddHostKey(hostKey)

    ln, _ := net.Listen("tcp", ":2222")
    for {
        c, err := ln.Accept()
        if err != nil {
            continue
        }
        go handle(c, cfg, proxyKey)
    }
}

func handle(downTCP net.Conn, serverCfg *ssh.ServerConfig, proxyKey ssh.Signer) {
    // 1) 终止下游:解出「用户那条 SSH」
    downConn, downChans, downReqs, err := ssh.NewServerConn(downTCP, serverCfg)
    if err != nil {
        downTCP.Close()
        return
    }
    defer downConn.Close()

    ext := downConn.Permissions.Extensions
    addr := net.JoinHostPort(ext["ip"], ext["port"])

    // 2) 建立上游:用 NewClientConn(而非 ssh.Dial),以便拿到容器侧主动开的 channel(支持 -R)
    upTCP, err := net.DialTimeout("tcp", addr, 10*time.Second)
    if err != nil {
        return
    }
    upConn, upChans, upReqs, err := ssh.NewClientConn(upTCP, addr, &ssh.ClientConfig{
        User:            ext["user"],
        Auth:            []ssh.AuthMethod{ssh.PublicKeys(proxyKey)},
        HostKeyCallback: ssh.InsecureIgnoreHostKey(), // 内网; 或 pin 容器 host key
    })
    if err != nil {
        upTCP.Close()
        return
    }
    defer upConn.Close()

    // 3) 双向对接
    go forwardGlobalReqs(downReqs, upConn) // 用户 → 容器(全局请求)
    go forwardGlobalReqs(upReqs, downConn) // 容器 → 用户
    go func() { // 用户主动开的 channel(session / direct-tcpip)
        for nc := range downChans {
            go bridgeChannel(nc, upConn)
        }
    }()
    go func() { // 容器主动开的 channel(forwarded-tcpip / x11)
        for nc := range upChans {
            go bridgeChannel(nc, downConn)
        }
    }()

    downConn.Wait() // 任一侧断开, defer 关掉另一侧
}

// ServerConn 内嵌 ssh.Conn, ClientConn 也是 ssh.Conn, 所以本函数双向通用
func bridgeChannel(nc ssh.NewChannel, target ssh.Conn) {
    // 在对端开同类型 channel; ExtraData 原样透传
    // (direct-tcpip 的「目标 host:port」就藏在 ExtraData 里, 必须原封不动)
    targetCh, targetReqs, err := target.OpenChannel(nc.ChannelType(), nc.ExtraData())
    if err != nil {
        if oce, ok := err.(*ssh.OpenChannelError); ok {
            nc.Reject(oce.Reason, oce.Message)
        } else {
            nc.Reject(ssh.ConnectionFailed, err.Error())
        }
        return
    }
    originCh, originReqs, err := nc.Accept()
    if err != nil {
        targetCh.Close()
        return
    }

    // 转发 channel 内请求: pty-req/shell/exec/window-change ↔ exit-status/exit-signal
    go forwardChannelReqs(originReqs, targetCh)
    go forwardChannelReqs(targetReqs, originCh)

    // 双向拷贝 stdout/stdin + stderr; 某方向读完用 CloseWrite 传 EOF(而非 Close)
    var wg sync.WaitGroup
    cp := func(dst, src ssh.Channel) {
        wg.Add(1)
        go func() { defer wg.Done(); io.Copy(dst, src); dst.CloseWrite() }()
    }
    cpErr := func(dst, src ssh.Channel) {
        wg.Add(1)
        go func() { defer wg.Done(); io.Copy(dst.Stderr(), src.Stderr()) }()
    }
    cp(targetCh, originCh)
    cp(originCh, targetCh)
    cpErr(targetCh, originCh)
    cpErr(originCh, targetCh)
    wg.Wait()
    originCh.Close()
    targetCh.Close()
}

// channel 请求: 回复不带 payload
func forwardChannelReqs(in <-chan *ssh.Request, target ssh.Channel) {
    for r := range in {
        ok, err := target.SendRequest(r.Type, r.WantReply, r.Payload)
        if err != nil {
            if r.WantReply {
                r.Reply(false, nil)
            }
            continue
        }
        if r.WantReply {
            r.Reply(ok, nil)
        }
    }
}

// 全局请求: 回复可带 payload(如 tcpip-forward 端口为 0 时返回分配的端口)
func forwardGlobalReqs(in <-chan *ssh.Request, target ssh.Conn) {
    for r := range in {
        ok, payload, err := target.SendRequest(r.Type, r.WantReply, r.Payload)
        if err != nil {
            if r.WantReply {
                r.Reply(false, nil)
            }
            continue
        }
        if r.WantReply {
            r.Reply(ok, payload)
        }
    }
}