tailscale: Add tailssh server

Author: nekohasekai

adapter/platform.go

@@ -44,6 +44,22 @@ type PlatformInterface interface {
 	UsePlatformNeighborResolver() bool
 	StartNeighborMonitor(listener NeighborUpdateListener) error
 	CloseNeighborMonitor(listener NeighborUpdateListener) error
+
+	UsePlatformShell() bool
+	CheckPlatformShell() error
+	OpenShellSession(user *PlatformUser, command string, env []string, term string, rows int32, cols int32) (ShellSession, error)
+	LookupUser(username string) (*PlatformUser, error)
+	LookupSFTPServer() (string, error)
+	ReadSystemSSHHostKey() ([]byte, error)
+}
+
+type PlatformUser struct {
+	Username string
+	Uid      int
+	Gid      int
+	HomeDir  string
+	Shell    string
+	Groups   []int
 }
 
 type FindConnectionOwnerRequest struct {

adapter/tailscale.go

@@ -54,3 +54,11 @@ type TailscalePeer struct {
 	KeyExpiry      int64
 	LastSeen       int64
 }
+
+type ShellSession interface {
+	MasterFD() int32
+	Resize(rows int32, cols int32) error
+	Signal(signal int32) error
+	WaitExit() (int32, error)
+	Close() error
+}

docs/configuration/endpoint/tailscale.md

@@ -2,6 +2,10 @@
 icon: material/new-box
 ---
 
+!!! quote "Changes in sing-box 1.14.0"
+
+    :material-plus: [ssh_server](#ssh_server)
+
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [relay_server_port](#relay_server_port)  
@@ -36,6 +40,7 @@ icon: material/new-box
   "system_interface_name": "",
   "system_interface_mtu": 0,
   "udp_timeout": "5m",
+  "ssh_server": false,
 
   ... // Dial Fields
 }
@@ -148,6 +153,49 @@ UDP NAT expiration time.
 
 `5m` will be used by default.
 
+#### ssh_server
+
+!!! question "Since sing-box 1.14.0"
+
+Run a Tailscale SSH server on tailnet port 22.
+
+Access is controlled by the SSH ACL in the Tailscale admin console, which maps each connection to a local user. How that user is resolved, and which users are allowed, depends on the platform:
+
+- **Linux** and **macOS**: the user is resolved from the system user database. Switching to a user other than the one sing-box runs as requires running as root; without root, sessions are limited to the current user.
+- **Windows**: sessions run as the sing-box process identity; the mapped user is not impersonated, so a session mapped to a different local account is refused.
+- **Android**: the user is resolved by the app rather than the system user database. `root` is the superuser (UID 0) and `shell` is the ADB shell user (UID 2000); every other name is resolved as the package name of an installed application, running as that application's UID with its data directory as the home directory, so the target application must be installed. `termux` is a shortcut for `com.termux`, and `sing-box` for the app's own package name; when Termux is installed, the `root` and `termux` users load the Termux environment. Running as the sing-box application itself requires no root, while any other user requires granted root access; without root, sessions are limited to the sing-box user.
+- **macOS**: the SSH server is only available in the standalone version and requires the Root Helper; the App Store version is not supported.
+- **iOS** and **tvOS**: not yet supported.
+
+Object format:
+
+```json
+{
+  "enabled": true,
+  "disable_pty": false,
+  "disable_sftp": false,
+  "disable_forwarding": false
+}
+```
+
+Setting `ssh_server` value to `true` is equivalent to `{ "enabled": true }`.
+
+#### ssh_server.enabled
+
+Enable the SSH server.
+
+#### ssh_server.disable_pty
+
+Refuse PTY allocation requests.
+
+#### ssh_server.disable_sftp
+
+Refuse the SFTP subsystem.
+
+#### ssh_server.disable_forwarding
+
+Refuse local and remote TCP and Unix-socket forwarding, including SSH agent forwarding.
+
 ### Dial Fields
 
 !!! note

docs/configuration/endpoint/tailscale.zh.md

@@ -2,6 +2,10 @@
 icon: material/new-box
 ---
 
+!!! quote "sing-box 1.14.0 中的更改"
+
+    :material-plus: [ssh_server](#ssh_server)
+
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: [relay_server_port](#relay_server_port)  
@@ -36,6 +40,7 @@ icon: material/new-box
   "system_interface_name": "",
   "system_interface_mtu": 0,
   "udp_timeout": "5m",
+  "ssh_server": false,
 
   ... // 拨号字段
 }
@@ -147,6 +152,49 @@ UDP NAT 过期时间。
 
 默认使用 `5m`。
 
+#### ssh_server
+
+!!! question "自 sing-box 1.14.0 起"
+
+在 tailnet 的 TCP 22 端口上运行 Tailscale SSH 服务器。
+
+访问控制由 Tailscale 管理控制台中的 SSH ACL 决定，它将每个连接映射到一个本地用户。该用户如何解析、以及允许哪些用户，取决于平台：
+
+- **Linux** 和 **macOS**：从系统用户数据库解析用户。要切换到 sing-box 运行身份以外的用户需要以 root 运行；非 root 时，会话仅限于当前用户。
+- **Windows**：会话以 sing-box 进程的身份运行；映射的用户不会被模拟，因此映射到其他本地账户的会话将被拒绝。
+- **Android**：用户由应用解析，而非系统用户数据库。`root` 即超级用户（UID 0），`shell` 为 ADB shell 用户（UID 2000）；其他名称均作为已安装应用的包名解析，以该应用的 UID 运行，并使用其数据目录作为主目录，因此目标应用必须已安装。`termux` 是 `com.termux` 的快捷方式，`sing-box` 是应用自身包名的快捷方式；当 Termux 已安装时，`root` 和 `termux` 用户将加载 Termux 环境。以 sing-box 应用自身身份运行无需 root，其他用户则需要已授予的 root 权限；非 root 时，会话仅限于 sing-box 用户。
+- **macOS**：SSH 服务器仅在独立版本中可用，且需要 Root Helper；App Store 版本不支持。
+- **iOS** 和 **tvOS**：暂不支持。
+
+对象格式：
+
+```json
+{
+  "enabled": true,
+  "disable_pty": false,
+  "disable_sftp": false,
+  "disable_forwarding": false
+}
+```
+
+将 `ssh_server` 值设置为 `true` 等同于 `{ "enabled": true }`。
+
+#### ssh_server.enabled
+
+启用 SSH 服务器。
+
+#### ssh_server.disable_pty
+
+拒绝 PTY 分配请求。
+
+#### ssh_server.disable_sftp
+
+拒绝 SFTP 子系统。
+
+#### ssh_server.disable_forwarding
+
+拒绝本地和远程的 TCP 与 Unix 套接字转发，包括 SSH agent 转发。
+
 ### 拨号字段
 
 !!! note

experimental/libbox/config.go

@@ -167,6 +167,30 @@ func (s *platformInterfaceStub) CloseNeighborMonitor(listener adapter.NeighborUp
 	return nil
 }
 
+func (s *platformInterfaceStub) UsePlatformShell() bool {
+	return false
+}
+
+func (s *platformInterfaceStub) CheckPlatformShell() error {
+	return nil
+}
+
+func (s *platformInterfaceStub) OpenShellSession(user *adapter.PlatformUser, command string, env []string, term string, rows int32, cols int32) (adapter.ShellSession, error) {
+	return nil, os.ErrInvalid
+}
+
+func (s *platformInterfaceStub) LookupSFTPServer() (string, error) {
+	return "", os.ErrInvalid
+}
+
+func (s *platformInterfaceStub) ReadSystemSSHHostKey() ([]byte, error) {
+	return nil, os.ErrInvalid
+}
+
+func (s *platformInterfaceStub) LookupUser(username string) (*adapter.PlatformUser, error) {
+	return nil, os.ErrInvalid
+}
+
 func (s *platformInterfaceStub) UsePlatformLocalDNSTransport() bool {
 	return false
 }

experimental/libbox/native_shell_session.go

@@ -0,0 +1,78 @@
+//go:build linux || android || (darwin && !ios)
+
+package libbox
+
+import (
+	"github.com/sagernet/sing-box/protocol/tailscale/tailssh"
+	"github.com/sagernet/sing/common"
+)
+
+type nativeShellSession struct {
+	shell *tailssh.Shell
+}
+
+func OpenNativeShellSession(
+	shell, cwd string,
+	args, environ StringIterator,
+	term string,
+	rows, cols, uid, gid int32,
+	groups Int32Iterator,
+) (ShellSession, error) {
+	sh, err := tailssh.OpenPtyShell(
+		shell,
+		iteratorToArray[string](args),
+		iteratorToArray[string](environ),
+		cwd,
+		int(uid), int(gid),
+		common.Map(iteratorToArray[int32](groups), func(g int32) int { return int(g) }),
+		uint16(rows), uint16(cols),
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &nativeShellSession{shell: sh}, nil
+}
+
+func OpenNativePipeSession(
+	shell, cwd string,
+	args, environ StringIterator,
+	uid, gid int32,
+	groups Int32Iterator,
+) (ShellSession, error) {
+	sh, err := tailssh.OpenSocketpairShell(
+		shell,
+		iteratorToArray[string](args),
+		iteratorToArray[string](environ),
+		cwd,
+		int(uid), int(gid),
+		common.Map(iteratorToArray[int32](groups), func(g int32) int { return int(g) }),
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &nativeShellSession{shell: sh}, nil
+}
+
+func (s *nativeShellSession) MasterFD() int32 {
+	return int32(s.shell.MasterFD())
+}
+
+func (s *nativeShellSession) Resize(rows, cols int32) error {
+	return s.shell.Resize(uint16(rows), uint16(cols))
+}
+
+func (s *nativeShellSession) Signal(sig int32) error {
+	return s.shell.Signal(int(sig))
+}
+
+func (s *nativeShellSession) WaitExit() (int32, error) {
+	status, err := s.shell.Wait()
+	if err != nil {
+		return 0, err
+	}
+	return int32(status), nil
+}
+
+func (s *nativeShellSession) Close() error {
+	return s.shell.Close()
+}

experimental/libbox/native_shell_session_stub.go

@@ -0,0 +1,26 @@
+//go:build !linux && !android && (!darwin || ios)
+
+package libbox
+
+import (
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+func OpenNativeShellSession(
+	shell, cwd string,
+	args, environ StringIterator,
+	term string,
+	rows, cols, uid, gid int32,
+	groups Int32Iterator,
+) (ShellSession, error) {
+	return nil, E.New("native shell session not supported on this platform")
+}
+
+func OpenNativePipeSession(
+	shell, cwd string,
+	args, environ StringIterator,
+	uid, gid int32,
+	groups Int32Iterator,
+) (ShellSession, error) {
+	return nil, E.New("native pipe session not supported on this platform")
+}

experimental/libbox/platform.go

@@ -21,6 +21,30 @@ type PlatformInterface interface {
 	StartNeighborMonitor(listener NeighborUpdateListener) error
 	CloseNeighborMonitor(listener NeighborUpdateListener) error
 	RegisterMyInterface(name string)
+	UsePlatformShell() bool
+	CheckPlatformShell() error
+	OpenShellSession(user *PlatformUser, command string, environ StringIterator, term string, rows int32, cols int32) (ShellSession, error)
+	LookupUser(username string) (*PlatformUser, error)
+	LookupSFTPServer() (*StringBox, error)
+	ReadSystemSSHHostKey() (*StringBox, error)
+}
+
+type PlatformUser struct {
+	Username string
+	Uid      int32
+	Gid      int32
+	HomeDir  string
+	Shell    string
+
+	groups []int32
+}
+
+func (u *PlatformUser) SetGroups(groups Int32Iterator) {
+	u.groups = iteratorToArray[int32](groups)
+}
+
+func (u *PlatformUser) Groups() Int32Iterator {
+	return newIterator(u.groups)
 }
 
 type NeighborUpdateListener interface {