Public Access
jaap-jan
6e39807cc0
A server Spelunk manages runs Spelunk's agent, which keeps a connection open
to Spelunk. A host can now be marked "Connect through Spelunk": a connect
asks Spelunk for a ticket, opens a WebSocket, and the agent connects to the
SSH server on the machine's own loopback, so the server needs no open SSH
port. Shells and file transfers both go this way.
Client, in Client.Session:
- SpelunkTunnel implements Spelunk's contract: POST
{api}/api/servers/{id}/tunnel-tickets with the API key as a bearer token
and {"port":N}, then a WebSocket to the API's own origin at the path
Spelunk returns, offering spelunk.tunnel.v1 and ticket.<ticket>. After the
upgrade the relay's RelayBridge carries the bytes unchanged. Every refusal
is a sentence: 401 key, 403 role (with Spelunk's detail), 404 server, 503
agent not connected, 401/503 on the upgrade, and close codes 4502 (agent
could not reach the port, or is too old: "Unknown stream kind") and 4503
(agent disconnected). Only a path is taken from the ticket response, so it
cannot send the ticket to another host.
- IConnectionRoute is what RelayRoute and SpelunkTunnelRoute have in common,
so the connect path has one shape for both.
Host model: HostSecret.Spelunk is a SpelunkRoute (normalised API base,
server id, and the id of the credential holding the API key), at payload
schema version 8. It is written last and only when present, so every other
host keeps its bytes and its version; an older build reads a Spelunk host
as read-only rather than dropping the route. A half-written route makes the
item unreadable instead of dialled. It merges as one value and is exclusive
with RelayEnabled. The API address must be https, or http to loopback.
The API key is an ordinary keychain credential whose password is the key,
referenced by id, so it is encrypted, synced, merged and rotated like every
other secret, one credential serves every server in the organisation, and
the used-by list and deletion warning count it.
Routing: OpenRouteAsync is the one decision for both transports. A Spelunk
host is never dialled directly, never probed after a failure, and a route
that hung up with a reason replaces SSH.NET's transport error.
UI: a "Connect through Spelunk" card beside the relay card in the desktop
drawer and the phone's editor; ticking one unticks the other.
dodossh://spelunk/connect?api=&server=&name=&host= links:
- SpelunkLink parses them strictly and never reads a credential from one.
- Program reads a link from the arguments; a launch that finds DodoSSH
running passes it down the doorbell as "dodossh.open-link <link>", which
the running instance parses again, bounded, and otherwise ignores whole.
The plain come-forward ring is unchanged.
- A saved host routed to that server on that Spelunk is connected to;
otherwise the editor opens on a new, unsaved Spelunk host, with the key
pre-chosen only when another host already sends it to that Spelunk. A link
that arrives while locked waits for the unlock.
- Windows registers the scheme under HKCU from Velopack's install and update
hooks and removes it on uninstall only if it still points at this
executable; the macOS plist template declares CFBundleURLTypes and the app
takes the URL from Avalonia's activation event; the Linux desktop entry
gets %u and MimeType=x-scheme-handler/dodossh.
83 lines
3.5 KiB
C#
83 lines
3.5 KiB
C#
using System.Runtime.Versioning;
|
|
using DodoSSH.Client.Session;
|
|
using Microsoft.Win32;
|
|
|
|
namespace DodoSSH.Client.App.Platform;
|
|
|
|
/// <summary>
|
|
/// Registers this executable as the handler for <c>dodossh://</c> links, for this user, on Windows.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para>
|
|
/// <b>Under HKCU\Software\Classes, because the install is per user.</b> Velopack installs into the user's
|
|
/// own profile with no elevation, and a handler registered machine-wide would need the elevation the
|
|
/// installer deliberately never asks for. Windows merges this key into <c>HKEY_CLASSES_ROOT</c> for the
|
|
/// user, which is all a browser consults.
|
|
/// </para>
|
|
/// <para>
|
|
/// <b>Written by Velopack's install and update hooks, removed by its uninstall hook</b> — see
|
|
/// <c>Program.Main</c>. An update rewrites it because the first update to a build that has this is how an
|
|
/// existing installation gets it at all, and because it costs nothing to say again.
|
|
/// </para>
|
|
/// <para>
|
|
/// <b>Removed only when it is still ours.</b> The release and the nightly are separate installations that
|
|
/// both answer <c>dodossh://</c>, and the last one installed holds the key. Uninstalling the other must not
|
|
/// take the handler away from the one that is still there.
|
|
/// </para>
|
|
/// </remarks>
|
|
[SupportedOSPlatform("windows")]
|
|
internal static class WindowsUrlScheme
|
|
{
|
|
private const string KeyPath = @"Software\Classes\" + SpelunkLink.Scheme;
|
|
private const string CommandPath = @"shell\open\command";
|
|
|
|
/// <summary>Points <c>dodossh://</c> at <paramref name="executable"/>.</summary>
|
|
internal static void Register(string executable)
|
|
{
|
|
using var scheme = Registry.CurrentUser.CreateSubKey(KeyPath);
|
|
|
|
scheme.SetValue(string.Empty, "URL:DodoSSH");
|
|
|
|
// Empty, and its presence is the whole of it: this value is what makes the key a URL scheme rather
|
|
// than a file type.
|
|
scheme.SetValue("URL Protocol", string.Empty);
|
|
|
|
using (var icon = scheme.CreateSubKey("DefaultIcon"))
|
|
{
|
|
icon.SetValue(string.Empty, $"\"{executable}\",0");
|
|
}
|
|
|
|
using var command = scheme.CreateSubKey(CommandPath);
|
|
|
|
command.SetValue(string.Empty, CommandFor(executable));
|
|
}
|
|
|
|
/// <summary>Takes the handler away, if it is still <paramref name="executable"/>'s.</summary>
|
|
internal static void Unregister(string executable)
|
|
{
|
|
string? registered;
|
|
|
|
using (var command = Registry.CurrentUser.OpenSubKey($@"{KeyPath}\{CommandPath}"))
|
|
{
|
|
registered = command?.GetValue(string.Empty) as string;
|
|
}
|
|
|
|
if (IsOurs(registered, executable))
|
|
{
|
|
Registry.CurrentUser.DeleteSubKeyTree(KeyPath, throwOnMissingSubKey: false);
|
|
}
|
|
}
|
|
|
|
/// <summary>The command Windows runs for a link: this executable, with the link as its one argument.</summary>
|
|
/// <remarks>
|
|
/// Both halves quoted. The path has spaces in it on any profile whose user name does, and the link is
|
|
/// handed over whole as <c>%1</c> — which Windows quotes into one argument only because it is quoted
|
|
/// here. Program.Main then reads it back and checks it before anything acts on it.
|
|
/// </remarks>
|
|
internal static string CommandFor(string executable) => $"\"{executable}\" \"%1\"";
|
|
|
|
/// <summary>Whether a registered command is the one <see cref="Register"/> writes for this executable.</summary>
|
|
internal static bool IsOurs(string? registered, string executable) =>
|
|
string.Equals(registered, CommandFor(executable), StringComparison.OrdinalIgnoreCase);
|
|
}
|