SSH proxy / socket

[afourmy]

Hello,

In netmiko, we can pass a socket to the BaseConnection via the sock parameter. This is useful to proxy through a jump server.

Is there a way to do the same thing with Scrapli ? I found a Socket section in the API Docs / Transport section of the docs but it is unclear whether that can be used for SSH tunneling.

Netmiko sock parameter: https://github.com/ktbyers/netmiko/blob/develop/netmiko/base_connection.py#L180

Thanks

[carlmontanari]

Hey @afourmy

If you are using system transport there is no socket (in scrapli at least) since we are just wrapping /bin/ssh -- that means you get all your normal openssh things "for free" -- including proxy jump/control persist/kex/cipher/etc. stuff. In this case you would just setup your normal proxy things in your ssh config file.

If you are using asyncssh you should also just use the ssh config file as asyncssh picks up many ssh config file things including proxy jump.

In the case of paramiko/ssh2, the short answer is "no" there is no way to pass a socket, but if you really want to you of course can (yay python flexibility!). You would need to simply make your own socket object and set it after creating your connection but before opening. You'd just need to make the object satisfy this classes interface (should really just be open/close/isalive -- so just a tiny tiny wrapper around normal socket). then set it like conn.transport.socket = my socket prior to opening.

HTH!

[afourmy]

Ok I'll give the wrapper solution a try, thanks !

[carlmontanari]

If you get something going and it works well for you I'd be open to reswizzling ssh2/paramiko transports to support this too. Probably no cycles to do that for a while but would be open to a PR or I can just keep it in the back of my mind for a rainy day 😁

[afourmy]

I wasn't able to make it work so far. What I've tried:

1. open a channel with paramiko

client = SSHClient()
client.set_missing_host_key_policy(AutoAddPolicy())
client.connect(...)
sock = client.get_transport().open_channel("direct-tcpip", (ip_address, port), ("", 0))

That sock is what can be passed to netmiko sock argument, it is a socket-like paramiko.channel.Channel.

2. define the wrapper around socket for scrapli. I tried to keep it as simple as possible, perhaps I'm missing something. The channel is already opened by Paramiko open_channel so I'm not doing anything in Socket.open.

class Socket:
    def __init__(self, sock):
        self.sock = sock

    def open(self) -> None:
        return

    def close(self) -> None:
        self.sock.close()

    def isalive(self) -> bool:
        return True

3. set the socket before opening Scrapli connection:

connection.transport.socket = Socket(sock)
connection.open()

There is no explicit failure (no stacktrace returned by Scrapli) but it seems that the socket is not used by Scrapli, the connection doesn't go through the jump host.

[carlmontanari]

Cool, will take a peak tomorrow and see if I can see whats up, will keep you posted!

[carlmontanari]

Ah I see what you're trying to do now. Sorry didn't really click before.

sock = client.get_transport().open_channel("direct-tcpip", (ip_address, port), ("", 0))

Is not a "normal" socket, its some paramiko magic. So just passing that in as a "normal" socket which scrapli uses to open the initial connection is not going to fly.

The short answer now I think is what you want is going to take a bit more work. Totally doable, just more work. Realistically you would need to add a transport option (for example like this) that accepts the paramiko channel object thing (sock) and then opens the connection in a different way. Its been a long time since I looked at any paramiko stuff so not 100% the details on what would need to happen there, but shouldn't really be too difficult I dont think (famous last words). I think the biggest rub will be that scrapli is (for whatever reason... honestly don't know/remember at this point!) using the low level paramiko api bits so I'd have to get back up to speed on things a bit more to remember enough to be useful!