Add support for using CA certs for upstream ssh connection (#210)

e2e/ca_test.go

@@ -0,0 +1,60 @@
+package e2e_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func TestCa(t *testing.T) {
+
+	piperaddr, piperport := nextAvailablePiperAddress()
+
+	piper, _, _, err := runCmd("/sshpiperd/sshpiperd",
+		"-p",
+		piperport,
+		"/sshpiperd/plugins/testcaplugin",
+		"--target",
+		"host-capublickey:2222",
+	)
+
+	if err != nil {
+		t.Errorf("failed to run sshpiperd: %v", err)
+	}
+
+	defer killCmd(piper)
+
+	waitForEndpointReady(piperaddr)
+
+	randtext := uuid.New().String()
+	targetfie := uuid.New().String()
+
+	c, stdin, stdout, err := runCmd(
+		"ssh",
+		"-v",
+		"-o",
+		"StrictHostKeyChecking=no",
+		"-o",
+		"UserKnownHostsFile=/dev/null",
+		"-p",
+		piperport,
+		"-l",
+		"client_123",
+		"127.0.0.1",
+		fmt.Sprintf(`sh -c "echo -n %v > /shared/%v"`, randtext, targetfie),
+	)
+
+	if err != nil {
+		t.Errorf("failed to ssh to piper-fixed, %v", err)
+	}
+
+	defer killCmd(c)
+
+	enterPassword(stdin, stdout, "pass")
+
+	time.Sleep(time.Second) // wait for file flush
+
+	checkSharedFileContent(t, targetfie, randtext)
+}

e2e/cahost/Dockerfile

@@ -0,0 +1,19 @@
+FROM debian:bookworm-slim
+
+EXPOSE 2222
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY ca.pub /etc/ssh/trusted-ca.pub
+
+RUN apt -y update \
+    && apt -y install --no-install-recommends --no-install-suggests openssh-server \
+    && mkdir -p /run/sshd \
+    && adduser --disabled-password --gecos "" client_123 \
+    && passwd -d client_123 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY sshd_config /etc/ssh/sshd_config
+
+ENTRYPOINT ["/usr/sbin/sshd", "-D", "-e", "-f", "/etc/ssh/sshd_config"]
+

e2e/cahost/ca

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACCa8wnkN2vpvD5wPylJiviQHwtbTO0htoJBpltvZ149ZwAAAJCXKgKTlyoC
+kwAAAAtzc2gtZWQyNTUxOQAAACCa8wnkN2vpvD5wPylJiviQHwtbTO0htoJBpltvZ149Zw
+AAAEDt/vP5TaisrihzBV6UwHTFH4PwXtRz6MpWrbjmCciBgprzCeQ3a+m8PnA/KUmK+JAf
+C1tM7SG2gkGmW29nXj1nAAAAC3BnaWJzb25Ad3NsAQI=
+-----END OPENSSH PRIVATE KEY-----

e2e/cahost/ca.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJrzCeQ3a+m8PnA/KUmK+JAfC1tM7SG2gkGmW29nXj1n

e2e/cahost/sshd_config

@@ -0,0 +1,23 @@
+Port 2222
+
+# Trust our CA
+TrustedUserCAKeys /etc/ssh/trusted-ca.pub
+
+# Allow pubkey
+PubkeyAuthentication yes
+
+# Don't allow passwords
+PasswordAuthentication no
+# Don't allow host auth
+HostbasedAuthentication no
+# No challenge response
+ChallengeResponseAuthentication no
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem       sftp    /usr/lib/openssh/sftp-server
+
+# Change this if you have issues
+LogLevel INFO

e2e/docker-compose.yml

@@ -31,6 +31,17 @@ services:
     volumes:
       - shared:/shared      
       - sshconfig_publickey:/config
+
+  host-capublickey:
+    build: ./cahost
+    labels:
+      - sshpiper.port=2222
+      - sshpiper.network=e2e_default
+    volumes:
+      - shared:/shared
+    networks:
+      - default
+
     
   host-k8s-proxy:
     build: ./kubetools
@@ -89,6 +100,7 @@ services:
     depends_on:
       - host-publickey
       - host-password
+      - host-capublickey
       - host-k8s-proxy
 
   # ensure sshpiperd image works

e2e/e2eentry.sh

@@ -3,6 +3,11 @@
 # use entrypoint.sh to generate the ssh_host_ed25519_key
 PLUGIN="dummy_badname/" bash /sshpiperd/entrypoint.sh 2>/dev/null
 
+# Create an ssh key pair and then sign the public key with the ca cert
+chmod 600 cahost/ca
+ssh-keygen -t ssh-ed25519 -f /etc/ssh/ssh_user -N ""
+ssh-keygen -s cahost/ca -I ssh_user -n client_123 /etc/ssh/ssh_user.pub
+
 if [ "${SSHPIPERD_DEBUG}" == "1" ]; then
     echo "enter debug on hold mode"
     echo "run [docker exec -ti e2e_testrunner_1 bash] to run to attach"