SSH connection fails with empty webhook environment variables

[civilizeddev]

In the .env file, there are environment variables like:

shellhub/.env

Lines 76 to 79 in ca2f81e

	# Webhook config
	SHELLHUB_WEBHOOK_URL=
	SHELLHUB_WEBHOOK_PORT=
	SHELLHUB_WEBHOOK_SCHEME=

shellhub/docker-compose.yml

Lines 15 to 17 in ca2f81e

	- WEBHOOK_URL=${SHELLHUB_WEBHOOK_URL}
	- WEBHOOK_PORT=${SHELLHUB_WEBHOOK_PORT}
	- WEBHOOK_SCHEME=${SHELLHUB_WEBHOOK_SCHEME}

It seems that these are used to awake the device agent via webhook before making an SSH remote connection to the shellhub's SSH server. However, in the example code, all of these are left blank. If executed with these blank values, it causes a panic during the SSH connection operation.

time="2023-08-21T01:31:11Z" level=info msg="SSH connection started" sshid=username@SSHID
time="2023-08-21T01:31:12Z" level=info msg="SSH connection closed" sshid=username@SSHID
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x38 pc=0x78ccf6]

goroutine 2903 [running]:
github.com/shellhub-io/shellhub/pkg/api/webhook.buildURL(0xc0000d4340, {0x8c3538, 0x1})
    /go/src/github.com/shellhub-io/shellhub/pkg/api/webhook/webhook.go:109 +0xf6
github.com/shellhub-io/shellhub/pkg/api/webhook.(*webhookClient).Connect(0xc0000d4340, 0xc00007cf70?)
    /go/src/github.com/shellhub-io/shellhub/pkg/api/webhook/webhook.go:91 +0x6eb
github.com/shellhub-io/shellhub/ssh/server/handler.SSHHandler.func1({0x992198?, 0xc00007cf70})
    /go/src/github.com/shellhub-io/shellhub/ssh/server/handler/ssh.go:98 +0x462
github.com/gliderlabs/ssh.(*session).handleRequests.func1()
    /go/pkg/mod/github.com/gliderlabs/ssh@v0.3.5/session.go:261 +0x2d
created by github.com/gliderlabs/ssh.(*session).handleRequests
    /go/pkg/mod/github.com/gliderlabs/ssh@v0.3.5/session.go:260 +0x51c
Stream closed EOF for shellhub/shellhub-ssh-756c498b94-7prdz (ssh)

I'm questioning whether a webhook is really necessary before an SSH remote connection. Moreover, there's no way to optionally bypass this webhook call.

This has been causing me difficulties. I suspect there might be a bug in the codebase.

shellhub/ssh/server/handler/ssh.go

Lines 97 to 110 in ca2f81e

	if wh := webhook.NewClient(); wh != nil {
	res, err := wh.Connect(sess.Lookup)
	if errors.Is(err, webhook.ErrForbidden) {
	sendAndInformError(client, err, ErrWebhook)
	return
	}
	if sess.Pty {
	client.Write([]byte(fmt.Sprintf("Wait %d seconds while the agent starts\n", res.Timeout))) // nolint:errcheck
	}
	time.Sleep(time.Duration(res.Timeout) * time.Second)
	}

shellhub/pkg/api/webhook/webhook.go

Lines 46 to 48 in ca2f81e

	host: opts.WebhookURL,
	port: opts.WebhookPort,
	scheme: opts.WebhookScheme,

I'd appreciate an explanation on this.

• Shouldn't the system work even if the webhook-related environment variable values are left blank?
• If not, what should be input here?
• What needs to be done on the device's agent?

There's no explanation about this in the documentation.

I'm doubting if the community code is really executable. I sincerely hope for some assistance. Thank you.

Repro (Go Playground)

• https://goplay.tools/snippet/FU5zvuvxbUX

Related

• On-demand agent connections #717

[civilizeddev]

I found that by entering "http" into SHELLHUB_WEBHOOK_SCHEME, at least it doesn't cause a panic. However, its meaning is hard to understand. An explanation is needed.

https://goplay.tools/snippet/Qon8lT16u2D

[gustavosbarreto]

It seems that these are used to awake the device agent via webhook before making an SSH remote connection to the shellhub's SSH server

Correct.

I'm questioning whether a webhook is really necessary before an SSH remote connection. Moreover, there's no way to optionally bypass this webhook call.

No, a webhook is not really necessary, and yes, there's a way to disable it.

There's no explanation about this in the documentation

This feature was originally designed for a specific use case within the ShellHub Enterprise Edition. That's why it wasn't included in the documentation.

I'm doubting if the community code is really executable. I sincerely hope for some assistance. Thank you.

The community edition is indeed fully functional within the environment it was designed for, which is Docker Compose. It seems that you might be attempting to deploy the containers on Kubernetes, which can indeed be challenging. However, it's worth noting that we do not support this functionality in the community edition. This limitation exists because Kubernetes deployment is often associated with enterprise-level usage, for which we offer the ShellHub Cloud and Enterprise editions.

However, we are committed to providing clarity the questions you've raised.

[civilizeddev]

It seems that you might be attempting to deploy the containers on Kubernetes, which can indeed be challenging.

That's right. It was very challenging. The nginx conf.d was set up primarily for Docker, so it felt like a puzzle to set up my own chart. As I troubleshooted and solved various puzzles, I've come this far. I feel like I'm almost there now.

[gustavosbarreto]

Shouldn't the system work even if the webhook-related environment variable values are left blank?
If not, what should be input here?

There's an unexpected behavior in the package we utilize to read environment variables (https://github.com/kelseyhightower/envconfig). In this package, a non-existing variable is treated differently from a variable with a empty value. This behavior might not align with the common assumption that empty values and non-existing variables should have the same effect.

To bypass the webhook, you need to define a empty value for the WEBHOOK_ * variables.

[civilizeddev]

Thank you for the kind explanation. The problem has been resolved.