1421 lines
57 KiB
C
1421 lines
57 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
/* Serialized, bounded administrative SSH command worker. */
|
|
|
|
#include "admin_ssh_console.h"
|
|
|
|
#include <errno.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
#include "console_completion.h"
|
|
#include "esp_console.h"
|
|
#include "freertos/FreeRTOS.h"
|
|
#include "freertos/queue.h"
|
|
#include "freertos/semphr.h"
|
|
#include "freertos/task.h"
|
|
#include "linenoise/linenoise.h"
|
|
#include "secure_random.h"
|
|
#include "user_database.h"
|
|
#include "web_serial_settings.h"
|
|
#include "web_account_settings.h"
|
|
#include "web_network_settings.h"
|
|
|
|
#define ADMIN_SSH_CONSOLE_MAX_SESSIONS 2U
|
|
#define ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY 4096U
|
|
#define ADMIN_SSH_CONSOLE_RESPONSE_RESERVE 512U
|
|
#define ADMIN_SSH_CONSOLE_REQUEST_QUEUE_LENGTH 4U
|
|
#define ADMIN_SSH_CONSOLE_TASK_STACK_SIZE 12288U
|
|
#define ADMIN_SSH_CONSOLE_TASK_PRIORITY 4U
|
|
#define ADMIN_UART_CONSOLE_TASK_STACK_SIZE 6144U
|
|
#define ADMIN_UART_CONSOLE_TASK_PRIORITY 3U
|
|
#define ADMIN_SSH_CONSOLE_MAX_ARGUMENTS 10U
|
|
#define ADMIN_SSH_CONSOLE_HISTORY_DEPTH 4U
|
|
#define ADMIN_SSH_CONTROL_QUEUE_LENGTH 2U
|
|
#define ADMIN_SSH_CONTROL_TASK_STACK_SIZE 4096U
|
|
#define ADMIN_SSH_CONTROL_TASK_PRIORITY 3U
|
|
|
|
typedef enum {
|
|
ADMIN_PROMPT_NONE = 0,
|
|
ADMIN_PROMPT_WAITING,
|
|
ADMIN_PROMPT_SUBMITTED,
|
|
ADMIN_PROMPT_CANCELLED,
|
|
ADMIN_PROMPT_DISCONNECTED,
|
|
} admin_prompt_state_t;
|
|
|
|
typedef struct {
|
|
bool active;
|
|
bool command_pending;
|
|
bool executing;
|
|
bool deferred_action_pending;
|
|
admin_ssh_console_token_t token;
|
|
const admin_console_owner_t *owner;
|
|
user_principal_t principal;
|
|
size_t input_length;
|
|
size_t input_cursor;
|
|
uint8_t input[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U];
|
|
uint8_t history[ADMIN_SSH_CONSOLE_HISTORY_DEPTH]
|
|
[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U];
|
|
uint8_t history_count;
|
|
int8_t history_position;
|
|
uint8_t draft[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U];
|
|
size_t draft_length;
|
|
uint8_t escape_state;
|
|
uint8_t escape_parameters[4];
|
|
size_t escape_parameter_length;
|
|
bool discard_next_lf;
|
|
admin_prompt_state_t prompt_state;
|
|
bool prompt_hidden;
|
|
size_t prompt_capacity;
|
|
size_t prompt_length;
|
|
uint8_t prompt_input[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U];
|
|
size_t output_start;
|
|
size_t output_length;
|
|
uint8_t output[ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY];
|
|
} admin_session_t;
|
|
|
|
typedef struct {
|
|
admin_ssh_deferred_action_type_t action;
|
|
admin_ssh_console_token_t token;
|
|
const admin_console_owner_t *owner;
|
|
uint32_t argument;
|
|
} admin_control_request_t;
|
|
|
|
typedef enum {
|
|
ADMIN_REQUEST_SSH = 0,
|
|
ADMIN_REQUEST_UART0,
|
|
ADMIN_REQUEST_DEFERRED,
|
|
ADMIN_REQUEST_SERIAL_SETTINGS,
|
|
ADMIN_REQUEST_ACCOUNT_SETTINGS,
|
|
ADMIN_REQUEST_NETWORK_SETTINGS,
|
|
} admin_request_origin_t;
|
|
|
|
typedef struct {
|
|
admin_request_origin_t origin;
|
|
admin_ssh_console_token_t token;
|
|
user_principal_t principal;
|
|
TaskHandle_t completion_task;
|
|
union {
|
|
uint8_t line[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U];
|
|
admin_control_request_t deferred;
|
|
uint32_t serial_settings_id;
|
|
uint32_t account_settings_id;
|
|
uint32_t network_settings_id;
|
|
};
|
|
} admin_request_t;
|
|
|
|
static portMUX_TYPE s_lock = portMUX_INITIALIZER_UNLOCKED;
|
|
static admin_session_t s_sessions[ADMIN_SSH_CONSOLE_MAX_SESSIONS];
|
|
/* Claimed under s_lock, used outside it; competing TAB input is backpressured. */
|
|
static bool s_completion_busy;
|
|
static char s_completion_output[CONSOLE_COMPLETION_OUTPUT_CAPACITY];
|
|
|
|
static StaticQueue_t s_request_queue_storage;
|
|
static uint8_t s_request_queue_bytes[ADMIN_SSH_CONSOLE_REQUEST_QUEUE_LENGTH *
|
|
sizeof(admin_request_t)];
|
|
static QueueHandle_t s_request_queue;
|
|
static StaticQueue_t s_control_queue_storage;
|
|
static uint8_t s_control_queue_bytes[ADMIN_SSH_CONTROL_QUEUE_LENGTH *
|
|
sizeof(admin_control_request_t)];
|
|
static QueueHandle_t s_control_queue;
|
|
static StaticSemaphore_t s_prompt_done_storage;
|
|
static SemaphoreHandle_t s_prompt_done;
|
|
static TaskHandle_t s_task;
|
|
static TaskHandle_t s_uart_task;
|
|
static TaskHandle_t s_control_task;
|
|
static bool s_initialized;
|
|
static bool s_dispatch_ready;
|
|
/* Accessed only by the single dispatcher task while a callback is running. */
|
|
static bool s_dispatch_remote;
|
|
static bool s_dispatch_output_previous_cr;
|
|
static admin_ssh_console_token_t s_dispatch_token;
|
|
static user_principal_t s_dispatch_principal;
|
|
|
|
bool admin_ssh_console_dispatch_is_remote(void)
|
|
{
|
|
return xTaskGetCurrentTaskHandle() == s_task && s_dispatch_remote;
|
|
}
|
|
|
|
bool admin_ssh_console_dispatch_is_web(void)
|
|
{
|
|
return admin_ssh_console_dispatch_is_remote() &&
|
|
s_dispatch_token.transport == ADMIN_CONSOLE_TRANSPORT_WEB;
|
|
}
|
|
|
|
const user_principal_t *admin_ssh_console_dispatch_principal(void)
|
|
{
|
|
return admin_ssh_console_dispatch_is_remote() ? &s_dispatch_principal : NULL;
|
|
}
|
|
|
|
static bool token_valid(const admin_ssh_console_token_t *token)
|
|
{
|
|
return token != NULL && token->slot_index < ADMIN_SSH_CONSOLE_MAX_SESSIONS &&
|
|
token->session_id != 0U && token->slot_generation != 0U;
|
|
}
|
|
|
|
static bool token_identity_matches(const admin_session_t *session,
|
|
const admin_ssh_console_token_t *token)
|
|
{
|
|
return token_valid(token) && session->token.session_id == token->session_id &&
|
|
session->token.transport == token->transport &&
|
|
session->token.slot_index == token->slot_index &&
|
|
session->token.slot_generation == token->slot_generation;
|
|
}
|
|
|
|
static bool token_matches(const admin_session_t *session,
|
|
const admin_ssh_console_token_t *token)
|
|
{
|
|
return session->active && token_identity_matches(session, token);
|
|
}
|
|
|
|
static bool session_is_current(const admin_ssh_console_token_t *token,
|
|
const user_principal_t *principal)
|
|
{
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
const admin_console_owner_t *owner = token_matches(session, token)
|
|
? session->owner : NULL;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (owner == NULL) {
|
|
return false;
|
|
}
|
|
bool account_current = false;
|
|
bool current = principal->role == USER_ROLE_ADMIN &&
|
|
user_database_principal_is_current(principal, &account_current) == ESP_OK &&
|
|
account_current && owner->is_current(token, principal);
|
|
/* External checks may close/reuse a slot. Never act on its replacement. */
|
|
taskENTER_CRITICAL(&s_lock);
|
|
bool matched = token_matches(session, token) && session->owner == owner;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (matched && !current) {
|
|
admin_ssh_console_close(token);
|
|
}
|
|
return matched && current;
|
|
}
|
|
|
|
bool admin_ssh_console_dispatch_is_current(void)
|
|
{
|
|
return xTaskGetCurrentTaskHandle() == s_task &&
|
|
(!s_dispatch_remote || session_is_current(&s_dispatch_token, &s_dispatch_principal));
|
|
}
|
|
|
|
static bool append_output_locked(admin_session_t *session,
|
|
const uint8_t *data, size_t length)
|
|
{
|
|
if (data == NULL || length > ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - session->output_length) {
|
|
return false;
|
|
}
|
|
size_t write_offset = (session->output_start + session->output_length) %
|
|
ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY;
|
|
size_t first = length;
|
|
if (first > ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - write_offset) {
|
|
first = ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - write_offset;
|
|
}
|
|
memcpy(session->output + write_offset, data, first);
|
|
if (length > first) {
|
|
memcpy(session->output, data + first, length - first);
|
|
}
|
|
session->output_length += length;
|
|
return true;
|
|
}
|
|
|
|
static bool worker_write(const admin_ssh_console_token_t *token,
|
|
const char *text)
|
|
{
|
|
if (!token_valid(token) || text == NULL) {
|
|
return false;
|
|
}
|
|
size_t length = strlen(text);
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
bool written = token_matches(session, token) &&
|
|
append_output_locked(session, (const uint8_t *)text, length);
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return written;
|
|
}
|
|
|
|
|
|
static void print_prompt(const admin_ssh_console_token_t *token)
|
|
{
|
|
(void)worker_write(token, "admin@serial-tool> ");
|
|
}
|
|
|
|
static bool redraw_line_locked(admin_session_t *session)
|
|
{
|
|
static const char prefix[] = "\r\x1b[2Kadmin@serial-tool> ";
|
|
char cursor_back[16] = {0};
|
|
size_t tail_length = session->input_length - session->input_cursor;
|
|
size_t cursor_back_length = 0U;
|
|
if (tail_length > 0U) {
|
|
int written = snprintf(cursor_back, sizeof(cursor_back), "\x1b[%uD",
|
|
(unsigned int)tail_length);
|
|
if (written < 0 || (size_t)written >= sizeof(cursor_back)) {
|
|
return false;
|
|
}
|
|
cursor_back_length = (size_t)written;
|
|
}
|
|
size_t required = sizeof(prefix) - 1U + session->input_length + cursor_back_length;
|
|
if (required > ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - session->output_length) {
|
|
return append_output_locked(session, (const uint8_t *)"\a", 1U);
|
|
}
|
|
(void)append_output_locked(session, (const uint8_t *)prefix, sizeof(prefix) - 1U);
|
|
(void)append_output_locked(session, session->input, session->input_length);
|
|
return cursor_back_length == 0U ||
|
|
append_output_locked(session, (const uint8_t *)cursor_back, cursor_back_length);
|
|
}
|
|
|
|
static void history_commit_locked(admin_session_t *session)
|
|
{
|
|
if (session->input_length == 0U ||
|
|
(session->history_count > 0U &&
|
|
strcmp((const char *)session->history[0], (const char *)session->input) == 0)) {
|
|
return;
|
|
}
|
|
for (size_t index = ADMIN_SSH_CONSOLE_HISTORY_DEPTH - 1U; index > 0U; --index) {
|
|
memcpy(session->history[index], session->history[index - 1U],
|
|
sizeof(session->history[index]));
|
|
}
|
|
memcpy(session->history[0], session->input, sizeof(session->history[0]));
|
|
if (session->history_count < ADMIN_SSH_CONSOLE_HISTORY_DEPTH) {
|
|
++session->history_count;
|
|
}
|
|
}
|
|
|
|
static void history_move_locked(admin_session_t *session, bool older);
|
|
|
|
static void editor_key_locked(admin_session_t *session, uint8_t key)
|
|
{
|
|
if (key == 'A' || key == 'B') {
|
|
history_move_locked(session, key == 'A');
|
|
return;
|
|
}
|
|
if (key == 'C' && session->input_cursor < session->input_length) {
|
|
++session->input_cursor;
|
|
} else if (key == 'D' && session->input_cursor > 0U) {
|
|
--session->input_cursor;
|
|
} else if (key == 'H') {
|
|
session->input_cursor = 0U;
|
|
} else if (key == 'F') {
|
|
session->input_cursor = session->input_length;
|
|
} else if (key == 'X' && session->input_cursor < session->input_length) {
|
|
memmove(session->input + session->input_cursor,
|
|
session->input + session->input_cursor + 1U,
|
|
session->input_length - session->input_cursor);
|
|
--session->input_length;
|
|
session->history_position = -1;
|
|
} else {
|
|
(void)append_output_locked(session, (const uint8_t *)"\a", 1U);
|
|
return;
|
|
}
|
|
(void)redraw_line_locked(session);
|
|
}
|
|
|
|
static void history_move_locked(admin_session_t *session, bool older)
|
|
{
|
|
if (older) {
|
|
if (session->history_count == 0U ||
|
|
session->history_position + 1 >= (int8_t)session->history_count) {
|
|
(void)append_output_locked(session, (const uint8_t *)"\a", 1U);
|
|
return;
|
|
}
|
|
if (session->history_position < 0) {
|
|
memcpy(session->draft, session->input, sizeof(session->draft));
|
|
session->draft_length = session->input_length;
|
|
}
|
|
++session->history_position;
|
|
memcpy(session->input, session->history[session->history_position],
|
|
sizeof(session->input));
|
|
session->input_length = strlen((const char *)session->input);
|
|
session->input_cursor = session->input_length;
|
|
} else {
|
|
if (session->history_position < 0) {
|
|
(void)append_output_locked(session, (const uint8_t *)"\a", 1U);
|
|
return;
|
|
}
|
|
--session->history_position;
|
|
if (session->history_position < 0) {
|
|
memcpy(session->input, session->draft, sizeof(session->input));
|
|
session->input_length = session->draft_length;
|
|
session->input_cursor = session->input_length;
|
|
} else {
|
|
memcpy(session->input, session->history[session->history_position],
|
|
sizeof(session->input));
|
|
session->input_length = strlen((const char *)session->input);
|
|
session->input_cursor = session->input_length;
|
|
}
|
|
}
|
|
(void)redraw_line_locked(session);
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_dispatch_read_input(
|
|
const char *prompt, uint8_t *output, size_t capacity,
|
|
bool hidden, size_t *output_length)
|
|
{
|
|
if (!admin_ssh_console_dispatch_is_remote() || prompt == NULL || output == NULL ||
|
|
output_length == NULL || capacity == 0U ||
|
|
capacity > ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U) {
|
|
return ESP_ERR_INVALID_ARG;
|
|
}
|
|
*output_length = 0U;
|
|
memset(output, 0, capacity);
|
|
(void)xSemaphoreTake(s_prompt_done, 0U);
|
|
if (!session_is_current(&s_dispatch_token, &s_dispatch_principal)) {
|
|
return ESP_ERR_NOT_FOUND;
|
|
}
|
|
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[s_dispatch_token.slot_index];
|
|
if (!token_matches(session, &s_dispatch_token) || !session->executing ||
|
|
session->prompt_state != ADMIN_PROMPT_NONE) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
secure_wipe(session->prompt_input, sizeof(session->prompt_input));
|
|
session->prompt_length = 0U;
|
|
session->prompt_capacity = capacity;
|
|
session->prompt_hidden = hidden;
|
|
session->prompt_state = ADMIN_PROMPT_WAITING;
|
|
bool published = append_output_locked(session, (const uint8_t *)prompt, strlen(prompt));
|
|
if (!published) {
|
|
session->prompt_state = ADMIN_PROMPT_NONE;
|
|
session->prompt_capacity = 0U;
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!published) {
|
|
return ESP_ERR_NO_MEM;
|
|
}
|
|
for (;;) {
|
|
/* The semaphore is only a hint: delayed/stale wakes cannot submit input. */
|
|
(void)xSemaphoreTake(s_prompt_done, pdMS_TO_TICKS(250U));
|
|
bool current = session_is_current(&s_dispatch_token, &s_dispatch_principal);
|
|
esp_err_t result = ESP_ERR_INVALID_STATE;
|
|
taskENTER_CRITICAL(&s_lock);
|
|
session = &s_sessions[s_dispatch_token.slot_index];
|
|
if (!token_identity_matches(session, &s_dispatch_token)) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_NOT_FOUND;
|
|
}
|
|
if (current && session->active && session->prompt_state == ADMIN_PROMPT_WAITING) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
continue;
|
|
}
|
|
if (!current || !session->active || session->prompt_state == ADMIN_PROMPT_DISCONNECTED) {
|
|
result = ESP_ERR_NOT_FOUND;
|
|
} else if (session->prompt_state == ADMIN_PROMPT_SUBMITTED) {
|
|
memcpy(output, session->prompt_input, session->prompt_length);
|
|
*output_length = session->prompt_length;
|
|
result = ESP_OK;
|
|
}
|
|
secure_wipe(session->prompt_input, sizeof(session->prompt_input));
|
|
session->prompt_length = 0U;
|
|
session->prompt_capacity = 0U;
|
|
session->prompt_hidden = false;
|
|
session->prompt_state = ADMIN_PROMPT_NONE;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return result;
|
|
}
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_dispatch_defer(
|
|
admin_ssh_deferred_action_type_t action, uint32_t argument)
|
|
{
|
|
if (!admin_ssh_console_dispatch_is_remote() || action == ADMIN_SSH_DEFER_NONE) {
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[s_dispatch_token.slot_index];
|
|
bool valid = token_matches(session, &s_dispatch_token) &&
|
|
!session->deferred_action_pending;
|
|
const admin_console_owner_t *owner = valid ? session->owner : NULL;
|
|
if (valid && ((unsigned)action > ADMIN_CONSOLE_DEFER_WEB_CERTIFICATE_ROTATE ||
|
|
!(owner->supported_actions & (1U << action)))) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_NOT_SUPPORTED;
|
|
}
|
|
if (valid) {
|
|
session->deferred_action_pending = true;
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!valid) {
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
admin_control_request_t request = {
|
|
.action = action,
|
|
.token = s_dispatch_token,
|
|
.owner = owner,
|
|
.argument = argument,
|
|
};
|
|
if (xQueueSend(s_control_queue, &request, 0U) == pdTRUE) {
|
|
return ESP_OK;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
session = &s_sessions[s_dispatch_token.slot_index];
|
|
if (token_matches(session, &s_dispatch_token)) {
|
|
session->deferred_action_pending = false;
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_TIMEOUT;
|
|
}
|
|
|
|
static int ssh_output_write(void *cookie, const char *buffer, int length)
|
|
{
|
|
const admin_ssh_console_token_t *token = cookie;
|
|
if (!token_valid(token) || buffer == NULL || length <= 0) {
|
|
return length == 0 ? 0 : -1;
|
|
}
|
|
|
|
size_t offset = 0U;
|
|
TickType_t deadline = xTaskGetTickCount() + pdMS_TO_TICKS(5000U);
|
|
while (offset < (size_t)length) {
|
|
const uint8_t value = (uint8_t)buffer[offset];
|
|
uint8_t translated[2] = {value, 0U};
|
|
size_t translated_length = 1U;
|
|
if (value == '\n' && !s_dispatch_output_previous_cr) {
|
|
translated[0] = '\r';
|
|
translated[1] = '\n';
|
|
translated_length = 2U;
|
|
}
|
|
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
bool active = token_matches(session, token);
|
|
size_t available = active
|
|
? ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - session->output_length
|
|
: 0U;
|
|
bool written = active && available >= translated_length &&
|
|
append_output_locked(session, translated, translated_length);
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
|
|
if (!active) {
|
|
errno = EPIPE;
|
|
return offset == 0U ? -1 : (int)offset;
|
|
}
|
|
if (written) {
|
|
s_dispatch_output_previous_cr = value == '\r';
|
|
++offset;
|
|
continue;
|
|
}
|
|
if ((int32_t)(xTaskGetTickCount() - deadline) >= 0) {
|
|
errno = EAGAIN;
|
|
return offset == 0U ? -1 : (int)offset;
|
|
}
|
|
vTaskDelay(pdMS_TO_TICKS(5U));
|
|
}
|
|
return length;
|
|
}
|
|
|
|
bool admin_ssh_console_web_user_command_allowed(
|
|
size_t argc, char **argv, const user_principal_t *principal)
|
|
{
|
|
if (argc == 0U || strcmp(argv[0], "user") != 0) return false;
|
|
if (argc == 1U ||
|
|
(argc == 2U && (strcmp(argv[1], "status") == 0 ||
|
|
strcmp(argv[1], "list") == 0)) ||
|
|
(argc == 3U && strcmp(argv[1], "show") == 0)) return true;
|
|
|
|
bool role_valid = argc >= 4U &&
|
|
(strcmp(argv[3], "user") == 0 || strcmp(argv[3], "admin") == 0);
|
|
bool mutation =
|
|
(argc == 4U && strcmp(argv[1], "add") == 0 && role_valid) ||
|
|
(argc == 3U && strcmp(argv[1], "password") == 0) ||
|
|
(argc == 4U && strcmp(argv[1], "delete") == 0 &&
|
|
strcmp(argv[3], "--force") == 0) ||
|
|
(argc == 5U && strcmp(argv[1], "role") == 0 && role_valid &&
|
|
strcmp(argv[4], "--force") == 0);
|
|
/* Parsed names use the database's exact, case-sensitive identity. Reject
|
|
* self even for no-op role changes; their handler still requests revocation.
|
|
* Generation/output and key workflows remain outside this bounded slice. */
|
|
return mutation && principal != NULL && principal->role == USER_ROLE_ADMIN &&
|
|
principal->username_length > 0U &&
|
|
principal->username_length <= USER_DATABASE_USERNAME_CAPACITY &&
|
|
!(strlen(argv[2]) == principal->username_length &&
|
|
memcmp(argv[2], principal->username, principal->username_length) == 0);
|
|
}
|
|
|
|
static bool remote_command_allowed(const admin_request_t *request)
|
|
{
|
|
char copy[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U];
|
|
memcpy(copy, request->line, sizeof(copy));
|
|
char *argv[ADMIN_SSH_CONSOLE_MAX_ARGUMENTS] = {0};
|
|
/* Use exactly the same quote/escape parser as esp_console_run(). */
|
|
size_t argc = esp_console_split_argv(copy, argv, ADMIN_SSH_CONSOLE_MAX_ARGUMENTS);
|
|
/* Empty input is handled quietly by esp_console_run(), not UART0 policy. */
|
|
bool allowed = true;
|
|
if (argc >= 2U && strcmp(argv[0], "user") == 0 &&
|
|
strcmp(argv[1], "recover") == 0) {
|
|
allowed = false;
|
|
}
|
|
/* Temporary browser policy until lifecycle acknowledgements/revocation are
|
|
* coordinated (8D.7). Classify parsed canonical arguments, not raw prefixes.
|
|
* User mutations remain available through UART0/SSH, subject to their policy.
|
|
*/
|
|
if (request->token.transport == ADMIN_CONSOLE_TRANSPORT_WEB && argc > 0U) {
|
|
if (strcmp(argv[0], "web") == 0) {
|
|
allowed = (argc == 2U && (strcmp(argv[1], "status") == 0 ||
|
|
strcmp(argv[1], "stop") == 0)) ||
|
|
(argc == 4U && strcmp(argv[1], "certificate") == 0 &&
|
|
strcmp(argv[2], "rotate") == 0 && strcmp(argv[3], "--force") == 0);
|
|
} else if (strcmp(argv[0], "wifi") == 0 || strcmp(argv[0], "mdns") == 0) {
|
|
allowed = argc == 2U && strcmp(argv[1], "status") == 0;
|
|
} else if (strcmp(argv[0], "user") == 0) {
|
|
allowed = admin_ssh_console_web_user_command_allowed(
|
|
argc, argv, &request->principal);
|
|
} else if (strcmp(argv[0], "reboot") == 0) {
|
|
allowed = argc == 1U;
|
|
} else if (strcmp(argv[0], "ssh") == 0 && argc >= 2U) {
|
|
/* SSH-specific deferred actions are not yet supported by WEB. */
|
|
if (strcmp(argv[1], "stop") == 0 || strcmp(argv[1], "disconnect") == 0 ||
|
|
strcmp(argv[1], "reset") == 0 ||
|
|
(strcmp(argv[1], "host-key") == 0 &&
|
|
!(argc == 3U && strcmp(argv[2], "info") == 0))) {
|
|
allowed = false;
|
|
}
|
|
}
|
|
}
|
|
secure_wipe(copy, sizeof(copy));
|
|
return allowed;
|
|
}
|
|
|
|
static void report_command_result(esp_err_t error, int command_result)
|
|
{
|
|
if (error == ESP_ERR_NOT_FOUND) {
|
|
printf("Unrecognized command\n");
|
|
} else if (error == ESP_OK && command_result != 0) {
|
|
printf("Command returned non-zero error code: 0x%x (%s)\n",
|
|
command_result, esp_err_to_name(command_result));
|
|
} else if (error != ESP_OK && error != ESP_ERR_INVALID_ARG) {
|
|
printf("Internal error: %s\n", esp_err_to_name(error));
|
|
}
|
|
}
|
|
|
|
static int command_exit(int argc, char **argv)
|
|
{
|
|
(void)argv;
|
|
if (argc != 1) {
|
|
printf("Usage: exit\n");
|
|
return 1;
|
|
}
|
|
if (!admin_ssh_console_dispatch_is_remote()) {
|
|
printf("The exit command is available only from an administrative SSH session.\n");
|
|
return 1;
|
|
}
|
|
|
|
esp_err_t error = admin_ssh_console_dispatch_defer(
|
|
ADMIN_CONSOLE_DEFER_SELF_CLOSE, s_dispatch_token.session_id);
|
|
if (error != ESP_OK) {
|
|
printf("Could not schedule %s session close: %s\n",
|
|
s_dispatch_token.transport == 0U ? "SSH" : "remote", esp_err_to_name(error));
|
|
return 1;
|
|
}
|
|
printf("%s session close scheduled after output drains.\n",
|
|
s_dispatch_token.transport == 0U ? "SSH" : "Remote");
|
|
return 0;
|
|
}
|
|
|
|
static void dispatch_registered_command(admin_request_t *request)
|
|
{
|
|
FILE *saved_stdout = stdout;
|
|
FILE *saved_stderr = stderr;
|
|
FILE *remote_stream = NULL;
|
|
if (request->origin == ADMIN_REQUEST_SSH) {
|
|
remote_stream = funopen(&request->token, NULL, ssh_output_write, NULL, NULL);
|
|
if (remote_stream == NULL) {
|
|
(void)worker_write(&request->token, "Could not create command output stream.\r\n");
|
|
return;
|
|
}
|
|
setvbuf(remote_stream, NULL, _IONBF, 0);
|
|
stdout = remote_stream;
|
|
stderr = remote_stream;
|
|
s_dispatch_output_previous_cr = false;
|
|
s_dispatch_remote = true;
|
|
s_dispatch_token = request->token;
|
|
s_dispatch_principal = request->principal;
|
|
} else {
|
|
s_dispatch_remote = false;
|
|
secure_wipe(&s_dispatch_principal, sizeof(s_dispatch_principal));
|
|
}
|
|
|
|
int command_result = 0;
|
|
if (request->origin == ADMIN_REQUEST_UART0 ||
|
|
session_is_current(&request->token, &request->principal)) {
|
|
esp_err_t error = esp_console_run((const char *)request->line, &command_result);
|
|
report_command_result(error, command_result);
|
|
}
|
|
fflush(stdout);
|
|
|
|
s_dispatch_remote = false;
|
|
s_dispatch_output_previous_cr = false;
|
|
secure_wipe(&s_dispatch_token, sizeof(s_dispatch_token));
|
|
secure_wipe(&s_dispatch_principal, sizeof(s_dispatch_principal));
|
|
if (remote_stream != NULL) {
|
|
stdout = saved_stdout;
|
|
stderr = saved_stderr;
|
|
fclose(remote_stream);
|
|
}
|
|
}
|
|
|
|
static void dispatch_deferred_request(admin_request_t *request);
|
|
|
|
esp_err_t admin_ssh_console_submit_serial_settings(uint32_t id)
|
|
{
|
|
taskENTER_CRITICAL(&s_lock);
|
|
bool ready = s_dispatch_ready;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!ready || !id) return ESP_ERR_INVALID_STATE;
|
|
admin_request_t request = {.origin = ADMIN_REQUEST_SERIAL_SETTINGS, .serial_settings_id = id};
|
|
return xQueueSend(s_request_queue, &request, 0U) == pdTRUE ? ESP_OK : ESP_ERR_TIMEOUT;
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_submit_account_settings(uint32_t id)
|
|
{
|
|
taskENTER_CRITICAL(&s_lock);
|
|
bool ready = s_dispatch_ready;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!ready || !id) return ESP_ERR_INVALID_STATE;
|
|
admin_request_t request = {.origin = ADMIN_REQUEST_ACCOUNT_SETTINGS, .account_settings_id = id};
|
|
return xQueueSend(s_request_queue, &request, 0U) == pdTRUE ? ESP_OK : ESP_ERR_TIMEOUT;
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_submit_network_settings(uint32_t id)
|
|
{
|
|
taskENTER_CRITICAL(&s_lock);
|
|
bool ready = s_dispatch_ready;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!ready || !id) return ESP_ERR_INVALID_STATE;
|
|
admin_request_t request = {.origin = ADMIN_REQUEST_NETWORK_SETTINGS, .network_settings_id = id};
|
|
return xQueueSend(s_request_queue, &request, 0U) == pdTRUE ? ESP_OK : ESP_ERR_TIMEOUT;
|
|
}
|
|
|
|
static void worker_task(void *context)
|
|
{
|
|
(void)context;
|
|
for (;;) {
|
|
admin_request_t request;
|
|
if (xQueueReceive(s_request_queue, &request, portMAX_DELAY) != pdTRUE) {
|
|
continue;
|
|
}
|
|
if (request.origin == ADMIN_REQUEST_SERIAL_SETTINGS || request.origin == ADMIN_REQUEST_ACCOUNT_SETTINGS ||
|
|
request.origin == ADMIN_REQUEST_NETWORK_SETTINGS) {
|
|
if (request.origin == ADMIN_REQUEST_SERIAL_SETTINGS) web_serial_settings_execute(request.serial_settings_id);
|
|
else if (request.origin == ADMIN_REQUEST_ACCOUNT_SETTINGS) web_account_settings_execute(request.account_settings_id);
|
|
else web_network_settings_execute(request.network_settings_id);
|
|
secure_wipe(&request, sizeof(request));
|
|
continue;
|
|
}
|
|
if (request.origin == ADMIN_REQUEST_DEFERRED) {
|
|
dispatch_deferred_request(&request);
|
|
secure_wipe(&request, sizeof(request));
|
|
continue;
|
|
}
|
|
if (request.origin == ADMIN_REQUEST_UART0) {
|
|
dispatch_registered_command(&request);
|
|
if (request.completion_task != NULL) {
|
|
xTaskNotifyGive(request.completion_task);
|
|
}
|
|
secure_wipe(&request, sizeof(request));
|
|
continue;
|
|
}
|
|
|
|
bool current = session_is_current(&request.token, &request.principal);
|
|
bool active;
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[request.token.slot_index];
|
|
active = current && token_matches(session, &request.token) && session->command_pending &&
|
|
!session->executing;
|
|
if (active) {
|
|
session->executing = true;
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
bool authorized = active && remote_command_allowed(&request);
|
|
if (authorized) {
|
|
dispatch_registered_command(&request);
|
|
} else if (active) {
|
|
(void)worker_write(&request.token,
|
|
request.token.transport == ADMIN_CONSOLE_TRANSPORT_WEB
|
|
? "Command is unavailable from the web console; use UART0 or SSH where permitted. Recovery requires UART0.\r\n"
|
|
: "Command is restricted to physical UART0.\r\n");
|
|
}
|
|
current = session_is_current(&request.token, &request.principal);
|
|
bool prompt = false;
|
|
taskENTER_CRITICAL(&s_lock);
|
|
session = &s_sessions[request.token.slot_index];
|
|
if (token_matches(session, &request.token)) {
|
|
session->executing = false;
|
|
session->command_pending = false;
|
|
prompt = current &&
|
|
request.principal.role == USER_ROLE_ADMIN &&
|
|
!session->deferred_action_pending;
|
|
} else if (!session->active && session->executing &&
|
|
token_identity_matches(session, &request.token)) {
|
|
/* A disconnect invalidated this executing request; erase buffered secrets. */
|
|
secure_wipe(session, sizeof(*session));
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (prompt) {
|
|
print_prompt(&request.token);
|
|
}
|
|
secure_wipe(&request, sizeof(request));
|
|
}
|
|
}
|
|
|
|
static void finish_deferred_request(const admin_control_request_t *request,
|
|
esp_err_t result, bool cancelled)
|
|
{
|
|
char message[160];
|
|
const char *transport = request->token.transport == 0U ? "SSH" : "remote";
|
|
if (cancelled) {
|
|
snprintf(message, sizeof(message),
|
|
"Deferred action cancelled before %s output drained.\r\nadmin@serial-tool> ",
|
|
transport);
|
|
} else if (result == ESP_OK) {
|
|
snprintf(message, sizeof(message),
|
|
"Deferred %s action completed.\r\nadmin@serial-tool> ", transport);
|
|
} else {
|
|
snprintf(message, sizeof(message),
|
|
"Deferred %s action failed: %s\r\nadmin@serial-tool> ",
|
|
transport, esp_err_to_name(result));
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[request->token.slot_index];
|
|
if (token_matches(session, &request->token)) {
|
|
(void)append_output_locked(session, (const uint8_t *)message, strlen(message));
|
|
session->deferred_action_pending = false;
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
}
|
|
|
|
static void dispatch_deferred_request(admin_request_t *request)
|
|
{
|
|
const admin_control_request_t *action = &request->deferred;
|
|
bool current = session_is_current(&action->token, &request->principal);
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[action->token.slot_index];
|
|
bool active = current && token_matches(session, &action->token) &&
|
|
session->owner == action->owner && session->deferred_action_pending &&
|
|
!session->command_pending && !session->executing;
|
|
if (active) session->executing = true;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
|
|
/* Keep the slot reserved across lifecycle callbacks, including self-detach.
|
|
* Recheck after reservation just as the canonical runner does. */
|
|
esp_err_t result = ESP_ERR_NOT_FOUND;
|
|
if (active && session_is_current(&action->token, &request->principal)) {
|
|
result = action->owner->perform(&action->token, action->action, action->argument);
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
session = &s_sessions[action->token.slot_index];
|
|
if (active && token_identity_matches(session, &action->token)) {
|
|
if (session->active) session->executing = false;
|
|
else secure_wipe(session, sizeof(*session));
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
finish_deferred_request(action, result, false);
|
|
}
|
|
|
|
static void control_task(void *context)
|
|
{
|
|
(void)context;
|
|
for (;;) {
|
|
admin_control_request_t request;
|
|
if (xQueueReceive(s_control_queue, &request, portMAX_DELAY) != pdTRUE) {
|
|
continue;
|
|
}
|
|
TickType_t deadline = xTaskGetTickCount() + pdMS_TO_TICKS(10000U);
|
|
bool drained = false;
|
|
while ((int32_t)(xTaskGetTickCount() - deadline) < 0) {
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[request.token.slot_index];
|
|
bool current = token_matches(session, &request.token);
|
|
bool console_drained = current && !session->command_pending &&
|
|
session->output_length == 0U;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!current) {
|
|
break;
|
|
}
|
|
bool transport_drained = console_drained &&
|
|
request.owner->drained(&request.token);
|
|
if (console_drained && transport_drained) {
|
|
drained = true;
|
|
break;
|
|
}
|
|
vTaskDelay(pdMS_TO_TICKS(10U));
|
|
}
|
|
if (!drained) {
|
|
finish_deferred_request(&request, ESP_ERR_TIMEOUT, true);
|
|
secure_wipe(&request, sizeof(request));
|
|
continue;
|
|
}
|
|
vTaskDelay(pdMS_TO_TICKS(200U));
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[request.token.slot_index];
|
|
bool current = token_matches(session, &request.token) &&
|
|
session->owner == request.owner && session->deferred_action_pending;
|
|
admin_request_t queued = {
|
|
.origin = ADMIN_REQUEST_DEFERRED,
|
|
.deferred = request,
|
|
};
|
|
if (current) queued.principal = session->principal;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (current && (request.owner->dispatcher_actions & (1U << request.action))) {
|
|
/* Nonblocking handoff: a full dispatcher queue fails before mutation.
|
|
* Pending remains set until execution completes, not merely enqueue. */
|
|
if (xQueueSend(s_request_queue, &queued, 0U) != pdTRUE) {
|
|
finish_deferred_request(&request, ESP_ERR_TIMEOUT, false);
|
|
}
|
|
secure_wipe(&queued, sizeof(queued));
|
|
secure_wipe(&request, sizeof(request));
|
|
continue;
|
|
}
|
|
secure_wipe(&queued, sizeof(queued));
|
|
esp_err_t result = current ? request.owner->perform(
|
|
&request.token, request.action, request.argument) : ESP_ERR_NOT_FOUND;
|
|
finish_deferred_request(&request, result, false);
|
|
secure_wipe(&request, sizeof(request));
|
|
}
|
|
}
|
|
|
|
static void uart_frontend_task(void *context)
|
|
{
|
|
(void)context;
|
|
setvbuf(stdin, NULL, _IONBF, 0);
|
|
linenoiseSetMaxLineLen(ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY);
|
|
printf("\r\nType 'help' to get the list of commands.\r\n"
|
|
"Use UP/DOWN arrows for history and TAB for completion.\r\n");
|
|
|
|
for (;;) {
|
|
char *line = linenoise("serial-tool> ");
|
|
if (line == NULL) {
|
|
continue;
|
|
}
|
|
if (line[0] != '\0') {
|
|
(void)linenoiseHistoryAdd(line);
|
|
}
|
|
|
|
admin_request_t request = {
|
|
.origin = ADMIN_REQUEST_UART0,
|
|
.completion_task = xTaskGetCurrentTaskHandle(),
|
|
};
|
|
strlcpy((char *)request.line, line, sizeof(request.line));
|
|
linenoiseFree(line);
|
|
|
|
(void)ulTaskNotifyTake(pdTRUE, 0U);
|
|
if (xQueueSend(s_request_queue, &request, portMAX_DELAY) == pdTRUE) {
|
|
(void)ulTaskNotifyTake(pdTRUE, portMAX_DELAY);
|
|
} else {
|
|
printf("Administrative command queue unavailable.\n");
|
|
}
|
|
secure_wipe(&request, sizeof(request));
|
|
}
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_init(void)
|
|
{
|
|
taskENTER_CRITICAL(&s_lock);
|
|
if (s_initialized) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_OK;
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
s_request_queue = xQueueCreateStatic(ADMIN_SSH_CONSOLE_REQUEST_QUEUE_LENGTH,
|
|
sizeof(admin_request_t), s_request_queue_bytes,
|
|
&s_request_queue_storage);
|
|
s_control_queue = xQueueCreateStatic(ADMIN_SSH_CONTROL_QUEUE_LENGTH,
|
|
sizeof(admin_control_request_t),
|
|
s_control_queue_bytes, &s_control_queue_storage);
|
|
s_prompt_done = xSemaphoreCreateBinaryStatic(&s_prompt_done_storage);
|
|
if (s_request_queue == NULL || s_control_queue == NULL || s_prompt_done == NULL) {
|
|
return ESP_ERR_NO_MEM;
|
|
}
|
|
if (xTaskCreate(worker_task, "admin_ssh_console", ADMIN_SSH_CONSOLE_TASK_STACK_SIZE,
|
|
NULL, ADMIN_SSH_CONSOLE_TASK_PRIORITY, &s_task) != pdPASS) {
|
|
s_task = NULL;
|
|
return ESP_ERR_NO_MEM;
|
|
}
|
|
if (xTaskCreate(control_task, "admin_ssh_control", ADMIN_SSH_CONTROL_TASK_STACK_SIZE,
|
|
NULL, ADMIN_SSH_CONTROL_TASK_PRIORITY, &s_control_task) != pdPASS) {
|
|
s_control_task = NULL;
|
|
vTaskDelete(s_task);
|
|
s_task = NULL;
|
|
return ESP_ERR_NO_MEM;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
s_initialized = true;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_OK;
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_register_commands(void)
|
|
{
|
|
const esp_console_cmd_t command = {
|
|
.command = "exit",
|
|
.help = "Close the current administrative remote session",
|
|
.hint = NULL,
|
|
.func = &command_exit,
|
|
.argtable = NULL,
|
|
};
|
|
return esp_console_cmd_register(&command);
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_start_uart_frontend(void)
|
|
{
|
|
taskENTER_CRITICAL(&s_lock);
|
|
bool initialized = s_initialized;
|
|
bool already_started = s_dispatch_ready;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!initialized) {
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
if (already_started) {
|
|
return ESP_OK;
|
|
}
|
|
if (xTaskCreate(uart_frontend_task, "admin_uart_console",
|
|
ADMIN_UART_CONSOLE_TASK_STACK_SIZE, NULL,
|
|
ADMIN_UART_CONSOLE_TASK_PRIORITY, &s_uart_task) != pdPASS) {
|
|
s_uart_task = NULL;
|
|
return ESP_ERR_NO_MEM;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
s_dispatch_ready = true;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_OK;
|
|
}
|
|
|
|
static esp_err_t open_session(admin_ssh_console_token_t *token,
|
|
const user_principal_t *principal,
|
|
const admin_console_owner_t *owner, bool available)
|
|
{
|
|
if (token == NULL || token->session_id == 0U || token->slot_generation == 0U ||
|
|
(!available && !token_valid(token)) || principal == NULL || principal->role != USER_ROLE_ADMIN ||
|
|
owner == NULL || owner->is_current == NULL ||
|
|
owner->drained == NULL || owner->perform == NULL) {
|
|
return ESP_ERR_INVALID_ARG;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
bool ready = s_initialized && s_dispatch_ready;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (!ready) {
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
bool current = false;
|
|
if (user_database_principal_is_current(principal, ¤t) != ESP_OK || !current) {
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
size_t index = token->slot_index;
|
|
if (available) {
|
|
for (index = 0U; index < ADMIN_SSH_CONSOLE_MAX_SESSIONS; ++index) {
|
|
if (!s_sessions[index].active && !s_sessions[index].executing) {
|
|
break;
|
|
}
|
|
}
|
|
if (index == ADMIN_SSH_CONSOLE_MAX_SESSIONS) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
}
|
|
admin_session_t *session = &s_sessions[index];
|
|
if (session->active || session->executing) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_INVALID_STATE;
|
|
}
|
|
secure_wipe(session, sizeof(*session));
|
|
session->active = true;
|
|
session->history_position = -1;
|
|
token->slot_index = (uint8_t)index;
|
|
session->token = *token;
|
|
session->owner = owner;
|
|
session->principal = *principal;
|
|
const char *banner = token->transport == 0U
|
|
? "ESP32 Serial Swiss Army Knife administrative SSH shell\r\n"
|
|
: "ESP32 Serial Swiss Army Knife administrative remote shell\r\n";
|
|
static const char prompt[] =
|
|
"Run 'help' for supported remote administrative commands.\r\nadmin@serial-tool> ";
|
|
(void)append_output_locked(session, (const uint8_t *)banner, strlen(banner));
|
|
(void)append_output_locked(session, (const uint8_t *)prompt, sizeof(prompt) - 1U);
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_OK;
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_open_available(admin_ssh_console_token_t *token,
|
|
const user_principal_t *principal,
|
|
const admin_console_owner_t *owner)
|
|
{
|
|
return open_session(token, principal, owner, true);
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_open_owned(const admin_ssh_console_token_t *token,
|
|
const user_principal_t *principal,
|
|
const admin_console_owner_t *owner)
|
|
{
|
|
if (token == NULL) {
|
|
return ESP_ERR_INVALID_ARG;
|
|
}
|
|
admin_ssh_console_token_t copy = *token;
|
|
return open_session(©, principal, owner, false);
|
|
}
|
|
|
|
void admin_ssh_console_close(const admin_ssh_console_token_t *token)
|
|
{
|
|
if (!token_valid(token)) {
|
|
return;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
bool matched = token_matches(session, token);
|
|
bool wake_prompt = false;
|
|
if (matched) {
|
|
if (session->prompt_state != ADMIN_PROMPT_NONE) {
|
|
session->prompt_state = ADMIN_PROMPT_DISCONNECTED;
|
|
secure_wipe(session->prompt_input, sizeof(session->prompt_input));
|
|
session->prompt_length = 0U;
|
|
wake_prompt = true;
|
|
}
|
|
session->active = false;
|
|
if (!session->executing) {
|
|
secure_wipe(session, sizeof(*session));
|
|
}
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (wake_prompt) {
|
|
(void)xSemaphoreGive(s_prompt_done);
|
|
}
|
|
}
|
|
|
|
bool admin_ssh_console_accepts_input(const admin_ssh_console_token_t *token)
|
|
{
|
|
if (!token_valid(token)) {
|
|
return false;
|
|
}
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
bool shell_input = !session->command_pending && !session->deferred_action_pending;
|
|
bool prompt_input = session->command_pending && session->executing &&
|
|
session->prompt_state == ADMIN_PROMPT_WAITING;
|
|
bool accepts = token_matches(session, token) && !session->deferred_action_pending &&
|
|
(shell_input || prompt_input) &&
|
|
session->output_length <= ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY -
|
|
ADMIN_SSH_CONSOLE_RESPONSE_RESERVE;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return accepts;
|
|
}
|
|
|
|
bool admin_ssh_console_feed_input(const admin_ssh_console_token_t *token,
|
|
const uint8_t *data, size_t length,
|
|
size_t *consumed)
|
|
{
|
|
if (consumed == NULL || !token_valid(token) || (data == NULL && length != 0U)) {
|
|
return false;
|
|
}
|
|
*consumed = 0U;
|
|
for (size_t index = 0U; index < length; ++index) {
|
|
admin_request_t request = {0};
|
|
bool submit = false;
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
if (!token_matches(session, token) || session->deferred_action_pending) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return *consumed != 0U;
|
|
}
|
|
uint8_t value = data[index];
|
|
if (session->command_pending) {
|
|
if (!session->executing || session->prompt_state != ADMIN_PROMPT_WAITING) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return *consumed != 0U;
|
|
}
|
|
bool wake_prompt = false;
|
|
if (session->discard_next_lf && value == '\n') {
|
|
session->discard_next_lf = false;
|
|
} else {
|
|
session->discard_next_lf = false;
|
|
if (value == '\r' || value == '\n') {
|
|
session->discard_next_lf = value == '\r';
|
|
session->prompt_state = ADMIN_PROMPT_SUBMITTED;
|
|
(void)append_output_locked(session, (const uint8_t *)"\r\n", 2U);
|
|
wake_prompt = true;
|
|
} else if (value == 0x03U) {
|
|
secure_wipe(session->prompt_input, sizeof(session->prompt_input));
|
|
session->prompt_length = 0U;
|
|
session->prompt_state = ADMIN_PROMPT_CANCELLED;
|
|
(void)append_output_locked(session, (const uint8_t *)"^C\r\n", 4U);
|
|
wake_prompt = true;
|
|
} else if (value == 0x08U || value == 0x7fU) {
|
|
if (session->prompt_length > 0U) {
|
|
session->prompt_input[--session->prompt_length] = 0U;
|
|
if (!session->prompt_hidden) {
|
|
(void)append_output_locked(session,
|
|
(const uint8_t *)"\b \b", 3U);
|
|
}
|
|
}
|
|
} else if (value >= 0x20U && value <= 0x7eU) {
|
|
if (session->prompt_length + 1U < session->prompt_capacity) {
|
|
session->prompt_input[session->prompt_length++] = value;
|
|
if (!session->prompt_hidden) {
|
|
(void)append_output_locked(session, &value, 1U);
|
|
}
|
|
} else {
|
|
(void)append_output_locked(session, (const uint8_t *)"\a", 1U);
|
|
}
|
|
}
|
|
}
|
|
++*consumed;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (wake_prompt) {
|
|
(void)xSemaphoreGive(s_prompt_done);
|
|
}
|
|
continue;
|
|
}
|
|
if (session->output_length >= ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY -
|
|
ADMIN_SSH_CONSOLE_RESPONSE_RESERVE) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return *consumed != 0U;
|
|
}
|
|
if (session->discard_next_lf && value == '\n') {
|
|
session->discard_next_lf = false;
|
|
++*consumed;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
continue;
|
|
}
|
|
session->discard_next_lf = false;
|
|
if (session->escape_state != 0U) {
|
|
if (session->escape_state == 1U) {
|
|
if (value == '[') {
|
|
session->escape_state = 2U;
|
|
session->escape_parameter_length = 0U;
|
|
} else if (value == 'O') {
|
|
session->escape_state = 3U;
|
|
} else {
|
|
session->escape_state = 0U;
|
|
}
|
|
} else if (session->escape_state == 3U) {
|
|
editor_key_locked(session, value);
|
|
session->escape_state = 0U;
|
|
} else if (value >= 'A' && value <= 'Z') {
|
|
editor_key_locked(session, value);
|
|
session->escape_state = 0U;
|
|
} else if (value == '~') {
|
|
uint8_t key = 0U;
|
|
if (session->escape_parameter_length > 0U) {
|
|
switch (session->escape_parameters[0]) {
|
|
case '1':
|
|
case '7':
|
|
key = 'H';
|
|
break;
|
|
case '3':
|
|
key = 'X';
|
|
break;
|
|
case '4':
|
|
case '8':
|
|
key = 'F';
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
editor_key_locked(session, key);
|
|
session->escape_state = 0U;
|
|
} else if ((value == ';' || (value >= '0' && value <= '9')) &&
|
|
session->escape_parameter_length < sizeof(session->escape_parameters)) {
|
|
session->escape_parameters[session->escape_parameter_length++] = value;
|
|
} else {
|
|
session->escape_state = 0U;
|
|
}
|
|
++*consumed;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
continue;
|
|
}
|
|
if (value == 0x1bU) {
|
|
session->escape_state = 1U;
|
|
++*consumed;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
continue;
|
|
}
|
|
if (value == '\t') {
|
|
if (s_completion_busy) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return *consumed != 0U;
|
|
}
|
|
if (session->input_cursor != session->input_length) {
|
|
(void)append_output_locked(session, (const uint8_t *)"\a", 1U);
|
|
++*consumed;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
continue;
|
|
}
|
|
char current[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U];
|
|
memcpy(current, session->input, sizeof(current));
|
|
s_completion_busy = true;
|
|
++*consumed;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
char completed[ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY + 1U] = {0};
|
|
size_t candidates_length = 0U;
|
|
bool expanded = console_completion_expand(current, completed,
|
|
sizeof(completed));
|
|
bool candidates_formatted = !expanded &&
|
|
console_completion_format_matches(current, s_completion_output,
|
|
sizeof(s_completion_output),
|
|
&candidates_length);
|
|
taskENTER_CRITICAL(&s_lock);
|
|
session = &s_sessions[token->slot_index];
|
|
if (token_matches(session, token) && !session->command_pending &&
|
|
memcmp(current, session->input, sizeof(current)) == 0) {
|
|
if (expanded) {
|
|
strlcpy((char *)session->input, completed, sizeof(session->input));
|
|
session->input_length = strlen((const char *)session->input);
|
|
session->input_cursor = session->input_length;
|
|
session->history_position = -1;
|
|
(void)redraw_line_locked(session);
|
|
} else if (candidates_formatted && candidates_length > 0U &&
|
|
candidates_length + 2U + sizeof("admin@serial-tool> ") - 1U +
|
|
session->input_length <=
|
|
ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - session->output_length) {
|
|
(void)append_output_locked(session, (const uint8_t *)"\r\n", 2U);
|
|
(void)append_output_locked(session, (const uint8_t *)s_completion_output,
|
|
candidates_length);
|
|
(void)redraw_line_locked(session);
|
|
} else {
|
|
(void)append_output_locked(session, (const uint8_t *)"\a", 1U);
|
|
}
|
|
}
|
|
secure_wipe(s_completion_output, sizeof(s_completion_output));
|
|
s_completion_busy = false;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
secure_wipe(current, sizeof(current));
|
|
secure_wipe(completed, sizeof(completed));
|
|
continue;
|
|
}
|
|
bool exit_requested = value == 0x04U && session->input_length == 0U;
|
|
if (value == '\r' || value == '\n' || exit_requested) {
|
|
session->discard_next_lf = value == '\r';
|
|
if (exit_requested) {
|
|
memcpy(request.line, "exit", sizeof("exit"));
|
|
} else {
|
|
history_commit_locked(session);
|
|
memcpy(request.line, session->input, session->input_length);
|
|
}
|
|
request.origin = ADMIN_REQUEST_SSH;
|
|
request.token = *token;
|
|
request.principal = session->principal;
|
|
secure_wipe(session->input, sizeof(session->input));
|
|
session->input_length = 0U;
|
|
session->input_cursor = 0U;
|
|
session->history_position = -1;
|
|
session->command_pending = true;
|
|
(void)append_output_locked(session,
|
|
(const uint8_t *)(exit_requested ? "^D\r\n" : "\r\n"),
|
|
exit_requested ? sizeof("^D\r\n") - 1U
|
|
: sizeof("\r\n") - 1U);
|
|
submit = true;
|
|
} else if (value == 0x03U) {
|
|
secure_wipe(session->input, sizeof(session->input));
|
|
session->input_length = 0U;
|
|
session->input_cursor = 0U;
|
|
session->history_position = -1;
|
|
(void)append_output_locked(session, (const uint8_t *)"^C\r\n",
|
|
sizeof("^C\r\n") - 1U);
|
|
(void)append_output_locked(session, (const uint8_t *)"admin@serial-tool> ",
|
|
sizeof("admin@serial-tool> ") - 1U);
|
|
} else if (value == 0x08U || value == 0x7fU) {
|
|
if (session->input_cursor > 0U) {
|
|
memmove(session->input + session->input_cursor - 1U,
|
|
session->input + session->input_cursor,
|
|
session->input_length - session->input_cursor + 1U);
|
|
--session->input_cursor;
|
|
--session->input_length;
|
|
session->history_position = -1;
|
|
(void)redraw_line_locked(session);
|
|
}
|
|
} else if (value >= 0x20U && value <= 0x7eU) {
|
|
if (session->input_length >= ADMIN_SSH_CONSOLE_COMMAND_LINE_CAPACITY) {
|
|
session->input_length = 0U;
|
|
session->input_cursor = 0U;
|
|
(void)append_output_locked(session, (const uint8_t *)
|
|
"\r\nCommand too long; discarded.\r\nadmin@serial-tool> ",
|
|
sizeof("\r\nCommand too long; discarded.\r\nadmin@serial-tool> ") - 1U);
|
|
} else {
|
|
memmove(session->input + session->input_cursor + 1U,
|
|
session->input + session->input_cursor,
|
|
session->input_length - session->input_cursor + 1U);
|
|
session->input[session->input_cursor++] = value;
|
|
++session->input_length;
|
|
session->history_position = -1;
|
|
if (session->input_cursor == session->input_length) {
|
|
(void)append_output_locked(session, &value, 1U);
|
|
} else {
|
|
(void)redraw_line_locked(session);
|
|
}
|
|
}
|
|
}
|
|
++*consumed;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
if (submit && xQueueSend(s_request_queue, &request, 0U) != pdTRUE) {
|
|
taskENTER_CRITICAL(&s_lock);
|
|
session = &s_sessions[token->slot_index];
|
|
if (token_matches(session, token)) {
|
|
session->command_pending = false;
|
|
(void)append_output_locked(session, (const uint8_t *)
|
|
"Administrative command queue is busy.\r\nadmin@serial-tool> ",
|
|
sizeof("Administrative command queue is busy.\r\nadmin@serial-tool> ") - 1U);
|
|
}
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
}
|
|
secure_wipe(&request, sizeof(request));
|
|
}
|
|
return true;
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_read_output(const admin_ssh_console_token_t *token,
|
|
uint8_t *data, size_t capacity,
|
|
size_t *received)
|
|
{
|
|
if (received == NULL || data == NULL || capacity == 0U || !token_valid(token)) {
|
|
return ESP_ERR_INVALID_ARG;
|
|
}
|
|
*received = 0U;
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
if (!token_matches(session, token)) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_NOT_FOUND;
|
|
}
|
|
size_t copied = session->output_length < capacity ? session->output_length : capacity;
|
|
size_t first = copied;
|
|
if (first > ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - session->output_start) {
|
|
first = ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY - session->output_start;
|
|
}
|
|
memcpy(data, session->output + session->output_start, first);
|
|
secure_wipe(session->output + session->output_start, first);
|
|
if (copied > first) {
|
|
memcpy(data + first, session->output, copied - first);
|
|
secure_wipe(session->output, copied - first);
|
|
}
|
|
session->output_start = (session->output_start + copied) %
|
|
ADMIN_SSH_CONSOLE_OUTPUT_CAPACITY;
|
|
session->output_length -= copied;
|
|
*received = copied;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_OK;
|
|
}
|
|
|
|
esp_err_t admin_ssh_console_get_session_snapshot(
|
|
const admin_ssh_console_token_t *token,
|
|
admin_ssh_console_session_snapshot_t *snapshot)
|
|
{
|
|
if (snapshot == NULL || !token_valid(token)) {
|
|
return ESP_ERR_INVALID_ARG;
|
|
}
|
|
memset(snapshot, 0, sizeof(*snapshot));
|
|
taskENTER_CRITICAL(&s_lock);
|
|
admin_session_t *session = &s_sessions[token->slot_index];
|
|
if (!token_matches(session, token)) {
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_ERR_NOT_FOUND;
|
|
}
|
|
snapshot->active = true;
|
|
snapshot->command_pending = session->command_pending;
|
|
snapshot->input_pending = session->input_length != 0U;
|
|
snapshot->output_pending = session->output_length != 0U;
|
|
snapshot->deferred_action_pending = session->deferred_action_pending;
|
|
snapshot->input_length = session->input_length;
|
|
snapshot->output_length = session->output_length;
|
|
taskEXIT_CRITICAL(&s_lock);
|
|
return ESP_OK;
|
|
}
|