engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

support cross auth type mapping (#483)

Browse source 
* add testcase

* add fix

* Refactor skelpipe wrappers to separate password and private key handling
This commit is contained in:
Boshi Lian 2024-11-10 03:01:52 -08:00 • committed by GitHub
parent 503f112c5d
commit 085ba59c58
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 152 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

30
plugin/docker/skel.go
View file

@ -32,6 +32,14 @@ type skelpipeToWrapper struct {
username string
}
type skelpipeToPasswordWrapper struct {
skelpipeToWrapper
}
type skelpipeToPrivateKeyWrapper struct {
skelpipeToWrapper
}
func (s *skelpipeWrapper) From() []libplugin.SkelPipeFrom {
w := skelpipeFromWrapper{
@ -76,9 +84,21 @@ func (s *skelpipeFromWrapper) MatchConn(conn libplugin.ConnMetadata) (libplugin.
}
if matched {
return &skelpipeToWrapper{
skelpipeWrapper: s.skelpipeWrapper,
username: targetuser,
if s.pipe.PrivateKey != "" {
return &skelpipeToPrivateKeyWrapper{
skelpipeToWrapper: skelpipeToWrapper{
skelpipeWrapper: s.skelpipeWrapper,
username: targetuser,
},
}, nil
}
return &skelpipeToPasswordWrapper{
skelpipeToWrapper: skelpipeToWrapper{
skelpipeWrapper: s.skelpipeWrapper,
username: targetuser,
},
}, nil
}
@ -97,7 +117,7 @@ func (s *skelpipePublicKeyWrapper) TrustedUserCAKeys(conn libplugin.ConnMetadata
return nil, nil // TODO support this
}
func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
func (s *skelpipeToPrivateKeyWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
k, err := base64.StdEncoding.DecodeString(s.pipe.PrivateKey)
if err != nil {
return nil, nil, err
@ -106,7 +126,7 @@ func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []b
return k, nil, nil
}
func (s *skelpipeToWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
func (s *skelpipeToPasswordWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
return nil, nil
}

36
plugin/kubernetes/skel.go
View file

@ -44,6 +44,14 @@ type skelpipeToWrapper struct {
to *piperv1beta1.ToSpec
}
type skelpipeToPasswordWrapper struct {
skelpipeToWrapper
}
type skelpipeToPrivateKeyWrapper struct {
skelpipeToWrapper
}
func (s *skelpipeWrapper) From() []libplugin.SkelPipeFrom {
var froms []libplugin.SkelPipeFrom
for _, f := range s.pipe.Spec.From {
@ -108,11 +116,25 @@ func (s *skelpipeFromWrapper) MatchConn(conn libplugin.ConnMetadata) (libplugin.
}
if matched {
return &skelpipeToWrapper{
plugin: s.plugin,
pipe: s.pipe,
username: targetuser,
to: s.to,
if s.to.PrivateKeySecret.Name != "" {
return &skelpipeToPrivateKeyWrapper{
skelpipeToWrapper: skelpipeToWrapper{
plugin: s.plugin,
pipe: s.pipe,
username: targetuser,
to: s.to,
},
}, nil
}
return &skelpipeToPasswordWrapper{
skelpipeToWrapper: skelpipeToWrapper{
plugin: s.plugin,
pipe: s.pipe,
username: targetuser,
to: s.to,
},
}, nil
}
@ -156,7 +178,7 @@ func (s *skelpipePublicKeyWrapper) TrustedUserCAKeys(conn libplugin.ConnMetadata
return nil, nil // TODO support trusted_user_ca_keys
}
func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
func (s *skelpipeToPrivateKeyWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
log.Debugf("mapping to %v private key using secret %v", s.to.Host, s.to.PrivateKeySecret.Name)
secret, err := s.plugin.k8sclient.Secrets(s.pipe.Namespace).Get(context.Background(), s.to.PrivateKeySecret.Name, metav1.GetOptions{})
@ -189,7 +211,7 @@ func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []b
return privateKey, publicKey, nil
}
func (s *skelpipeToWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
func (s *skelpipeToPasswordWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
if s.to.PasswordSecret.Name != "" {
log.Debugf("mapping to %v password using secret %v", s.to.Host, s.to.PasswordSecret.Name)
secret, err := s.plugin.k8sclient.Secrets(s.pipe.Namespace).Get(context.Background(), s.to.PasswordSecret.Name, metav1.GetOptions{})

23
plugin/workingdir/skel.go
View file

@ -42,6 +42,14 @@ type skelpipeToWrapper struct {
skelpipeWrapper
}
type skelpipeToPasswordWrapper struct {
skelpipeToWrapper
}
type skelpipeToPrivateKeyWrapper struct {
skelpipeToWrapper
}
func (s *skelpipeWrapper) From() []libplugin.SkelPipeFrom {
w := skelpipeFromWrapper{
@ -76,8 +84,15 @@ func (s *skelpipeToWrapper) KnownHosts(conn libplugin.ConnMetadata) ([]byte, err
}
func (s *skelpipeFromWrapper) MatchConn(conn libplugin.ConnMetadata) (libplugin.SkelPipeTo, error) {
return &skelpipeToWrapper{
skelpipeWrapper: s.skelpipeWrapper,
if s.dir.Exists(userKeyFile) {
return &skelpipeToPrivateKeyWrapper{
skelpipeToWrapper: skelpipeToWrapper(*s),
}, nil
}
return &skelpipeToPasswordWrapper{
skelpipeToWrapper: skelpipeToWrapper(*s),
}, nil
}
@ -93,7 +108,7 @@ func (s *skelpipePublicKeyWrapper) TrustedUserCAKeys(conn libplugin.ConnMetadata
return nil, nil // TODO support this
}
func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
func (s *skelpipeToPrivateKeyWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
k, err := s.dir.Readfile(userKeyFile)
if err != nil {
return nil, nil, err
@ -102,7 +117,7 @@ func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []b
return k, nil, nil
}
func (s *skelpipeToWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
func (s *skelpipeToPasswordWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
return nil, nil
}

33
plugin/yaml/skel.go
View file

@ -33,6 +33,14 @@ type skelpipeToWrapper struct {
to *yamlPipeTo
}
type skelpipeToPasswordWrapper struct {
skelpipeToWrapper
}
type skelpipeToPrivateKeyWrapper struct {
skelpipeToWrapper
}
func (s *skelpipeWrapper) From() []libplugin.SkelPipeFrom {
var froms []libplugin.SkelPipeFrom
for _, f := range s.pipe.From {
@ -99,10 +107,23 @@ func (s *skelpipeFromWrapper) MatchConn(conn libplugin.ConnMetadata) (libplugin.
}
if matched {
return &skelpipeToWrapper{
config: s.config,
username: targetuser,
to: s.to,
if s.to.PrivateKey != "" || s.to.PrivateKeyData != "" {
return &skelpipeToPrivateKeyWrapper{
skelpipeToWrapper: skelpipeToWrapper{
config: s.config,
username: targetuser,
to: s.to,
},
}, nil
}
return &skelpipeToPasswordWrapper{
skelpipeToWrapper: skelpipeToWrapper{
config: s.config,
username: targetuser,
to: s.to,
},
}, nil
}
@ -125,7 +146,7 @@ func (s *skelpipePublicKeyWrapper) TrustedUserCAKeys(conn libplugin.ConnMetadata
})
}
func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
func (s *skelpipeToPrivateKeyWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
p, err := s.config.loadFileOrDecode(s.to.PrivateKey, s.to.PrivateKeyData, map[string]string{
"DOWNSTREAM_USER": conn.User(),
"UPSTREAM_USER": s.username,
@ -138,7 +159,7 @@ func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []b
return p, nil, nil
}
func (s *skelpipeToWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
func (s *skelpipeToPasswordWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
return nil, nil
}