122 lines
3.4 KiB
C
122 lines
3.4 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
/* Authenticated, bounded wolfSSH transport for the serial session broker. */
|
|
|
|
#pragma once
|
|
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
#include "esp_err.h"
|
|
#include "session_broker.h"
|
|
#include "user_database.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#define SSH_TRANSPORT_PORT 22U
|
|
#define SSH_TRANSPORT_MAX_SESSIONS 2U
|
|
#define SSH_TRANSPORT_IO_BUFFER_SIZE 512U
|
|
#define SSH_TRANSPORT_HANDSHAKE_TIMEOUT_SECONDS 15U
|
|
|
|
typedef enum {
|
|
SSH_TRANSPORT_SESSION_FREE = 0,
|
|
SSH_TRANSPORT_SESSION_HANDSHAKE,
|
|
SSH_TRANSPORT_SESSION_ACTIVE,
|
|
SSH_TRANSPORT_SESSION_CLOSING,
|
|
} ssh_transport_session_state_t;
|
|
|
|
typedef enum {
|
|
SSH_TRANSPORT_ROUTE_NONE = 0,
|
|
SSH_TRANSPORT_ROUTE_BROKER,
|
|
SSH_TRANSPORT_ROUTE_ADMIN_CONSOLE,
|
|
} ssh_transport_session_route_t;
|
|
|
|
typedef struct {
|
|
uint64_t starts;
|
|
uint64_t start_failures;
|
|
uint64_t stops;
|
|
uint64_t tcp_connections;
|
|
uint64_t capacity_rejections;
|
|
uint64_t handshake_successes;
|
|
uint64_t handshake_failures;
|
|
uint64_t handshake_timeouts;
|
|
uint64_t authentication_attempts;
|
|
uint64_t authentication_failures;
|
|
uint64_t request_rejections;
|
|
uint64_t broker_connections;
|
|
uint64_t broker_failures;
|
|
uint64_t disconnections;
|
|
uint64_t writer_requests;
|
|
uint64_t writer_grants;
|
|
uint64_t writer_denials;
|
|
uint64_t writer_revocations;
|
|
uint64_t rx_bytes;
|
|
uint64_t rx_accepted_bytes;
|
|
uint64_t rx_rejected_bytes;
|
|
uint64_t tx_bytes;
|
|
uint64_t io_failures;
|
|
uint64_t session_revocations;
|
|
uint64_t admin_console_admissions;
|
|
uint64_t admin_console_admission_failures;
|
|
uint64_t admin_console_input_rejections;
|
|
} ssh_transport_counters_t;
|
|
|
|
typedef struct {
|
|
bool active;
|
|
bool authenticated;
|
|
bool principal_valid;
|
|
bool writer;
|
|
bool close_requested;
|
|
bool rx_pending;
|
|
bool tx_pending;
|
|
bool admin_command_pending;
|
|
uint32_t admin_output_pending;
|
|
uint32_t session_id;
|
|
uint32_t generation;
|
|
int socket_fd;
|
|
session_broker_client_id_t broker_client_id;
|
|
ssh_transport_session_state_t state;
|
|
ssh_transport_session_route_t route;
|
|
user_role_t user_role;
|
|
user_auth_method_t auth_method;
|
|
char username[USER_DATABASE_USERNAME_CAPACITY + 1U];
|
|
char peer[48];
|
|
} ssh_transport_session_snapshot_t;
|
|
|
|
typedef struct {
|
|
bool initialized;
|
|
bool running;
|
|
bool transitioning;
|
|
uint16_t port;
|
|
esp_err_t last_error;
|
|
uint32_t active_sessions;
|
|
int32_t task_core_id;
|
|
uint32_t task_stack_size;
|
|
uint32_t task_stack_free_minimum;
|
|
ssh_transport_session_snapshot_t sessions[SSH_TRANSPORT_MAX_SESSIONS];
|
|
ssh_transport_counters_t counters;
|
|
} ssh_transport_snapshot_t;
|
|
|
|
/* Installs wolfCrypt RNG/PSRAM hooks and starts the sole wolfSSH owner task. */
|
|
esp_err_t ssh_transport_init(void);
|
|
esp_err_t ssh_transport_start(void);
|
|
esp_err_t ssh_transport_stop(void);
|
|
|
|
/* Serialize stop, persistent host-key replacement, and conditional restart. */
|
|
esp_err_t ssh_transport_replace_host_key(bool reset);
|
|
|
|
esp_err_t ssh_transport_get_snapshot(ssh_transport_snapshot_t *snapshot);
|
|
esp_err_t ssh_transport_clear_counters(void);
|
|
|
|
/* Close one session, one account's sessions, or every transport session. */
|
|
esp_err_t ssh_transport_disconnect(uint32_t session_id);
|
|
esp_err_t ssh_transport_revoke_user(const uint8_t *username,
|
|
size_t username_length);
|
|
esp_err_t ssh_transport_revoke_sessions(void);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|