fix typos, re-run protoc (#686)

* fix typos in docs

* use keys in named literal

For easier grepping, and better stability.

* libplugin: regenerate with v1.36.10

592ca79999 upgraded
the dependency, but didn't actually regenerate.
This commit is contained in:
Josh Bleecher Snyder 2025-12-04 12:58:56 -08:00 committed by GitHub
parent 584aae2d3a
commit 17c0645dc6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 645 additions and 1447 deletions

View file

@ -13,7 +13,7 @@ Make sure you have read [README.md](README.md) before starting.
### Get the code
rememeber to clone the submodules
remember to clone the submodules
```
git clone https://github.com/tg123/sshpiper
@ -42,7 +42,7 @@ more settings: <https://github.com/linuxserver/docker-openssh-server>
after you have done, attach to testrunner container:
```
docker exec -ti e2e_testrunner_1 bash
docker exec -ti e2e-testrunner-1 bash
```
then run test in `/src/e2e`
@ -57,9 +57,9 @@ go test
## Understanding how sshpiper works
### sshpiper seasoned cryto ssh lib
### sshpiper seasoned crypto ssh lib
The `crypto` folder contains the source code of the [sshpiper seasoned cryto ssh lib](./crypto/).
The `crypto` folder contains the source code of the [sshpiper seasoned crypto ssh lib](./crypto/).
It based on [crypto/ssh](https://golang.org/pkg/crypto/ssh/) and with a drop-in [sshpiper.go](./crypto/ssh/sshpiper.go) to expose all low level sshpiper required APIs.
### sshpiperd
@ -70,10 +70,10 @@ The plugins are responsible to figure out how to authenticate `downstream` and m
### plugin
The plugin is typically a grpc server that accepts requrests from `sshpiperd`.
The plugin is typically a grpc server that accepts requests from `sshpiperd`.
The proto defines in [sshpiper.proto](./proto/sshpiper.proto).
In most of the cases, the plugin connects with `sshpiperd` via `stdin/stdout`. The [ioconnn](./libplugin/ioconn/) wraps stdin/stdout to net.Conn for grpc use.
In most of the cases, the plugin connects with `sshpiperd` via `stdin/stdout`. The [ioconn](./libplugin/ioconn/) wraps stdin/stdout to net.Conn for grpc use.
`sshpiperd` also supports to create remote grpc connections to a plugin deploy in a different machine.
## Your first plugin
@ -97,7 +97,7 @@ Take `fixed` as an example:
```
Here means the `downstream` is sending password to `sshpiperd`. Then `sshpiperd` will call plugin's `PasswordCallback` to get the `upstream` to connect to.
The `upstream` object contains host port and auth info about how to connect to the `upstream`. you can aslo return an error to deny the connection.
The `upstream` object contains host port and auth info about how to connect to the `upstream`. you can also return an error to deny the connection.
### build and run the plugin
@ -112,4 +112,3 @@ you will get the executable in the current directory. say `myplugin`. start it w
```
sshpiperd /path/to/myplugin
```

View file

@ -69,7 +69,7 @@ ssh 127.0.0.1 -l user -p 2222
### math before login?
Here illustrates the example of `addional challenge` before the `fixed` plugin.
Here illustrates the example of `additional challenge` before the `fixed` plugin.
```
./out/sshpiperd -i /tmp/sshpiperkey --server-key-generate-mode notexist --log-level=trace ./out/simplemath -- ./out/fixed --target 127.0.0.1:5522
@ -80,12 +80,12 @@ Here illustrates the example of `addional challenge` before the `fixed` plugin.
### icons
* 🔀: routing plugin
* 🔒: addtional challenge plugin
* 🔒: additional challenge plugin
* 📈: metrics plugin
Plugin list
* [workingdir](plugin/workingdir/) 🔀: `/home`-like directory to managed upstreams routing by sshpiped.
* [workingdir](plugin/workingdir/) 🔀: `/home`-like directory to managed upstreams routing by sshpiperd.
* [yaml](plugin/yaml/) 🔀: config routing with a single yaml file.
* [docker](plugin/docker/) 🔀: pipe into docker containers.
* [kubernetes](plugin/kubernetes/) 🔀: manage pipes via Kubernetes CRD.
@ -99,7 +99,7 @@ Plugin list
* [openpubkey](https://github.com/tg123/sshpiper-openpubkey)🔀🔒: integrate with [openpubkey](https://github.com/openpubkey/openpubkey)
* [metrics](plugin/metrics/) 📈: serve prometheus metrics on open connections and auth errors
## Screening recording
## Screen recording
### asciicast
@ -183,7 +183,7 @@ How this work
* low level sshpiper api is fully redesigned to support more routing protocols.
* plugins system totally redesigned to be more flexible and extensible.
* plugins are now sperated from main process and no longer a single big binary, this allow user to write their own plugins without touching `sshpiperd` code.
* plugins are now separated from main process and no longer a single big binary, this allow user to write their own plugins without touching `sshpiperd` code.
* `grpc` is first class now, the plugins are built on top of it
For plugins already in `v1`, you need change params to new params. However, not all plugins are migrated to `v1` yet, they are being migrated gradually. you can still use the old plugins in [`v0` branch](https://github.com/tg123/sshpiper/tree/v0)

View file

@ -606,7 +606,7 @@ func DialCmd(cmd *exec.Cmd) (*CmdPlugin, error) {
return nil, err
}
return &CmdPlugin{*g, ch}, nil
return &CmdPlugin{GrpcPlugin: *g, Quit: ch}, nil
}
func GetUniqueID(ctx ssh.ChallengeContext) string {

View file

@ -22,8 +22,8 @@ sudo snap restart sshpiperd
* `sshpiperd.port` listening port
* `sshpiperd.server-key` server key files, support wildcard
* `sshpiperd.server-key-data` server key in base64 format, server-key, server-key-generate-mode will be ignored if set
* `sshpiperd.server-key-generate-mode` server key generate mode, one of: disable, notexist, always. generated key will be written to `server-key` if * no`texist or always
* `sshpiperd.login-grace-time` sshpiperd forcely close the connection after this time if the pipe has not successfully established
* `sshpiperd.server-key-generate-mode` server key generate mode, one of: disable, notexist, always. generated key will be written to `server-key` if * notexist or always
* `sshpiperd.login-grace-time` sshpiperd forcibly close the connection after this time if the pipe has not successfully established
* `sshpiperd.log-level` log level, one of: trace, debug, info, warn, error, fatal, panic
* `sshpiperd.typescript-log-dir` create typescript format screen recording and save into the directory see https://linux.die.net/man/1/script
* `sshpiperd.banner-text` display a banner before authentication, would be ignored if banner file was set

File diff suppressed because it is too large Load diff

View file

@ -1,7 +1,7 @@
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
// versions:
// - protoc-gen-go-grpc v1.2.0
// - protoc v4.25.1
// - protoc-gen-go-grpc v1.6.0
// - protoc v6.32.1
// source: plugin.proto
package libplugin
@ -15,21 +15,38 @@ import (
// This is a compile-time assertion to ensure that this generated file
// is compatible with the grpc package it is being compiled against.
// Requires gRPC-Go v1.32.0 or later.
const _ = grpc.SupportPackageIsVersion7
// Requires gRPC-Go v1.64.0 or later.
const _ = grpc.SupportPackageIsVersion9
const (
SshPiperPlugin_Logs_FullMethodName = "/libplugin.SshPiperPlugin/Logs"
SshPiperPlugin_ListCallbacks_FullMethodName = "/libplugin.SshPiperPlugin/ListCallbacks"
SshPiperPlugin_NewConnection_FullMethodName = "/libplugin.SshPiperPlugin/NewConnection"
SshPiperPlugin_NextAuthMethods_FullMethodName = "/libplugin.SshPiperPlugin/NextAuthMethods"
SshPiperPlugin_NoneAuth_FullMethodName = "/libplugin.SshPiperPlugin/NoneAuth"
SshPiperPlugin_PasswordAuth_FullMethodName = "/libplugin.SshPiperPlugin/PasswordAuth"
SshPiperPlugin_PublicKeyAuth_FullMethodName = "/libplugin.SshPiperPlugin/PublicKeyAuth"
SshPiperPlugin_KeyboardInteractiveAuth_FullMethodName = "/libplugin.SshPiperPlugin/KeyboardInteractiveAuth"
SshPiperPlugin_UpstreamAuthFailureNotice_FullMethodName = "/libplugin.SshPiperPlugin/UpstreamAuthFailureNotice"
SshPiperPlugin_Banner_FullMethodName = "/libplugin.SshPiperPlugin/Banner"
SshPiperPlugin_VerifyHostKey_FullMethodName = "/libplugin.SshPiperPlugin/VerifyHostKey"
SshPiperPlugin_PipeCreateErrorNotice_FullMethodName = "/libplugin.SshPiperPlugin/PipeCreateErrorNotice"
SshPiperPlugin_PipeStartNotice_FullMethodName = "/libplugin.SshPiperPlugin/PipeStartNotice"
SshPiperPlugin_PipeErrorNotice_FullMethodName = "/libplugin.SshPiperPlugin/PipeErrorNotice"
)
// SshPiperPluginClient is the client API for SshPiperPlugin service.
//
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
type SshPiperPluginClient interface {
Logs(ctx context.Context, in *StartLogRequest, opts ...grpc.CallOption) (SshPiperPlugin_LogsClient, error)
Logs(ctx context.Context, in *StartLogRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Log], error)
ListCallbacks(ctx context.Context, in *ListCallbackRequest, opts ...grpc.CallOption) (*ListCallbackResponse, error)
NewConnection(ctx context.Context, in *NewConnectionRequest, opts ...grpc.CallOption) (*NewConnectionResponse, error)
NextAuthMethods(ctx context.Context, in *NextAuthMethodsRequest, opts ...grpc.CallOption) (*NextAuthMethodsResponse, error)
NoneAuth(ctx context.Context, in *NoneAuthRequest, opts ...grpc.CallOption) (*NoneAuthResponse, error)
PasswordAuth(ctx context.Context, in *PasswordAuthRequest, opts ...grpc.CallOption) (*PasswordAuthResponse, error)
PublicKeyAuth(ctx context.Context, in *PublicKeyAuthRequest, opts ...grpc.CallOption) (*PublicKeyAuthResponse, error)
KeyboardInteractiveAuth(ctx context.Context, opts ...grpc.CallOption) (SshPiperPlugin_KeyboardInteractiveAuthClient, error)
KeyboardInteractiveAuth(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage], error)
UpstreamAuthFailureNotice(ctx context.Context, in *UpstreamAuthFailureNoticeRequest, opts ...grpc.CallOption) (*UpstreamAuthFailureNoticeResponse, error)
Banner(ctx context.Context, in *BannerRequest, opts ...grpc.CallOption) (*BannerResponse, error)
VerifyHostKey(ctx context.Context, in *VerifyHostKeyRequest, opts ...grpc.CallOption) (*VerifyHostKeyResponse, error)
@ -46,12 +63,13 @@ func NewSshPiperPluginClient(cc grpc.ClientConnInterface) SshPiperPluginClient {
return &sshPiperPluginClient{cc}
}
func (c *sshPiperPluginClient) Logs(ctx context.Context, in *StartLogRequest, opts ...grpc.CallOption) (SshPiperPlugin_LogsClient, error) {
stream, err := c.cc.NewStream(ctx, &SshPiperPlugin_ServiceDesc.Streams[0], "/libplugin.SshPiperPlugin/Logs", opts...)
func (c *sshPiperPluginClient) Logs(ctx context.Context, in *StartLogRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Log], error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
stream, err := c.cc.NewStream(ctx, &SshPiperPlugin_ServiceDesc.Streams[0], SshPiperPlugin_Logs_FullMethodName, cOpts...)
if err != nil {
return nil, err
}
x := &sshPiperPluginLogsClient{stream}
x := &grpc.GenericClientStream[StartLogRequest, Log]{ClientStream: stream}
if err := x.ClientStream.SendMsg(in); err != nil {
return nil, err
}
@ -61,26 +79,13 @@ func (c *sshPiperPluginClient) Logs(ctx context.Context, in *StartLogRequest, op
return x, nil
}
type SshPiperPlugin_LogsClient interface {
Recv() (*Log, error)
grpc.ClientStream
}
type sshPiperPluginLogsClient struct {
grpc.ClientStream
}
func (x *sshPiperPluginLogsClient) Recv() (*Log, error) {
m := new(Log)
if err := x.ClientStream.RecvMsg(m); err != nil {
return nil, err
}
return m, nil
}
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
type SshPiperPlugin_LogsClient = grpc.ServerStreamingClient[Log]
func (c *sshPiperPluginClient) ListCallbacks(ctx context.Context, in *ListCallbackRequest, opts ...grpc.CallOption) (*ListCallbackResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(ListCallbackResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/ListCallbacks", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_ListCallbacks_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -88,8 +93,9 @@ func (c *sshPiperPluginClient) ListCallbacks(ctx context.Context, in *ListCallba
}
func (c *sshPiperPluginClient) NewConnection(ctx context.Context, in *NewConnectionRequest, opts ...grpc.CallOption) (*NewConnectionResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(NewConnectionResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/NewConnection", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_NewConnection_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -97,8 +103,9 @@ func (c *sshPiperPluginClient) NewConnection(ctx context.Context, in *NewConnect
}
func (c *sshPiperPluginClient) NextAuthMethods(ctx context.Context, in *NextAuthMethodsRequest, opts ...grpc.CallOption) (*NextAuthMethodsResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(NextAuthMethodsResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/NextAuthMethods", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_NextAuthMethods_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -106,8 +113,9 @@ func (c *sshPiperPluginClient) NextAuthMethods(ctx context.Context, in *NextAuth
}
func (c *sshPiperPluginClient) NoneAuth(ctx context.Context, in *NoneAuthRequest, opts ...grpc.CallOption) (*NoneAuthResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(NoneAuthResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/NoneAuth", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_NoneAuth_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -115,8 +123,9 @@ func (c *sshPiperPluginClient) NoneAuth(ctx context.Context, in *NoneAuthRequest
}
func (c *sshPiperPluginClient) PasswordAuth(ctx context.Context, in *PasswordAuthRequest, opts ...grpc.CallOption) (*PasswordAuthResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(PasswordAuthResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/PasswordAuth", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_PasswordAuth_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -124,48 +133,32 @@ func (c *sshPiperPluginClient) PasswordAuth(ctx context.Context, in *PasswordAut
}
func (c *sshPiperPluginClient) PublicKeyAuth(ctx context.Context, in *PublicKeyAuthRequest, opts ...grpc.CallOption) (*PublicKeyAuthResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(PublicKeyAuthResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/PublicKeyAuth", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_PublicKeyAuth_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *sshPiperPluginClient) KeyboardInteractiveAuth(ctx context.Context, opts ...grpc.CallOption) (SshPiperPlugin_KeyboardInteractiveAuthClient, error) {
stream, err := c.cc.NewStream(ctx, &SshPiperPlugin_ServiceDesc.Streams[1], "/libplugin.SshPiperPlugin/KeyboardInteractiveAuth", opts...)
func (c *sshPiperPluginClient) KeyboardInteractiveAuth(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage], error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
stream, err := c.cc.NewStream(ctx, &SshPiperPlugin_ServiceDesc.Streams[1], SshPiperPlugin_KeyboardInteractiveAuth_FullMethodName, cOpts...)
if err != nil {
return nil, err
}
x := &sshPiperPluginKeyboardInteractiveAuthClient{stream}
x := &grpc.GenericClientStream[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage]{ClientStream: stream}
return x, nil
}
type SshPiperPlugin_KeyboardInteractiveAuthClient interface {
Send(*KeyboardInteractiveAuthMessage) error
Recv() (*KeyboardInteractiveAuthMessage, error)
grpc.ClientStream
}
type sshPiperPluginKeyboardInteractiveAuthClient struct {
grpc.ClientStream
}
func (x *sshPiperPluginKeyboardInteractiveAuthClient) Send(m *KeyboardInteractiveAuthMessage) error {
return x.ClientStream.SendMsg(m)
}
func (x *sshPiperPluginKeyboardInteractiveAuthClient) Recv() (*KeyboardInteractiveAuthMessage, error) {
m := new(KeyboardInteractiveAuthMessage)
if err := x.ClientStream.RecvMsg(m); err != nil {
return nil, err
}
return m, nil
}
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
type SshPiperPlugin_KeyboardInteractiveAuthClient = grpc.BidiStreamingClient[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage]
func (c *sshPiperPluginClient) UpstreamAuthFailureNotice(ctx context.Context, in *UpstreamAuthFailureNoticeRequest, opts ...grpc.CallOption) (*UpstreamAuthFailureNoticeResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UpstreamAuthFailureNoticeResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/UpstreamAuthFailureNotice", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_UpstreamAuthFailureNotice_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -173,8 +166,9 @@ func (c *sshPiperPluginClient) UpstreamAuthFailureNotice(ctx context.Context, in
}
func (c *sshPiperPluginClient) Banner(ctx context.Context, in *BannerRequest, opts ...grpc.CallOption) (*BannerResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(BannerResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/Banner", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_Banner_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -182,8 +176,9 @@ func (c *sshPiperPluginClient) Banner(ctx context.Context, in *BannerRequest, op
}
func (c *sshPiperPluginClient) VerifyHostKey(ctx context.Context, in *VerifyHostKeyRequest, opts ...grpc.CallOption) (*VerifyHostKeyResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(VerifyHostKeyResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/VerifyHostKey", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_VerifyHostKey_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -191,8 +186,9 @@ func (c *sshPiperPluginClient) VerifyHostKey(ctx context.Context, in *VerifyHost
}
func (c *sshPiperPluginClient) PipeCreateErrorNotice(ctx context.Context, in *PipeCreateErrorNoticeRequest, opts ...grpc.CallOption) (*PipeCreateErrorNoticeResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(PipeCreateErrorNoticeResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/PipeCreateErrorNotice", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_PipeCreateErrorNotice_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -200,8 +196,9 @@ func (c *sshPiperPluginClient) PipeCreateErrorNotice(ctx context.Context, in *Pi
}
func (c *sshPiperPluginClient) PipeStartNotice(ctx context.Context, in *PipeStartNoticeRequest, opts ...grpc.CallOption) (*PipeStartNoticeResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(PipeStartNoticeResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/PipeStartNotice", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_PipeStartNotice_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -209,8 +206,9 @@ func (c *sshPiperPluginClient) PipeStartNotice(ctx context.Context, in *PipeStar
}
func (c *sshPiperPluginClient) PipeErrorNotice(ctx context.Context, in *PipeErrorNoticeRequest, opts ...grpc.CallOption) (*PipeErrorNoticeResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(PipeErrorNoticeResponse)
err := c.cc.Invoke(ctx, "/libplugin.SshPiperPlugin/PipeErrorNotice", in, out, opts...)
err := c.cc.Invoke(ctx, SshPiperPlugin_PipeErrorNotice_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
@ -219,16 +217,16 @@ func (c *sshPiperPluginClient) PipeErrorNotice(ctx context.Context, in *PipeErro
// SshPiperPluginServer is the server API for SshPiperPlugin service.
// All implementations must embed UnimplementedSshPiperPluginServer
// for forward compatibility
// for forward compatibility.
type SshPiperPluginServer interface {
Logs(*StartLogRequest, SshPiperPlugin_LogsServer) error
Logs(*StartLogRequest, grpc.ServerStreamingServer[Log]) error
ListCallbacks(context.Context, *ListCallbackRequest) (*ListCallbackResponse, error)
NewConnection(context.Context, *NewConnectionRequest) (*NewConnectionResponse, error)
NextAuthMethods(context.Context, *NextAuthMethodsRequest) (*NextAuthMethodsResponse, error)
NoneAuth(context.Context, *NoneAuthRequest) (*NoneAuthResponse, error)
PasswordAuth(context.Context, *PasswordAuthRequest) (*PasswordAuthResponse, error)
PublicKeyAuth(context.Context, *PublicKeyAuthRequest) (*PublicKeyAuthResponse, error)
KeyboardInteractiveAuth(SshPiperPlugin_KeyboardInteractiveAuthServer) error
KeyboardInteractiveAuth(grpc.BidiStreamingServer[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage]) error
UpstreamAuthFailureNotice(context.Context, *UpstreamAuthFailureNoticeRequest) (*UpstreamAuthFailureNoticeResponse, error)
Banner(context.Context, *BannerRequest) (*BannerResponse, error)
VerifyHostKey(context.Context, *VerifyHostKeyRequest) (*VerifyHostKeyResponse, error)
@ -238,53 +236,57 @@ type SshPiperPluginServer interface {
mustEmbedUnimplementedSshPiperPluginServer()
}
// UnimplementedSshPiperPluginServer must be embedded to have forward compatible implementations.
type UnimplementedSshPiperPluginServer struct {
}
// UnimplementedSshPiperPluginServer must be embedded to have
// forward compatible implementations.
//
// NOTE: this should be embedded by value instead of pointer to avoid a nil
// pointer dereference when methods are called.
type UnimplementedSshPiperPluginServer struct{}
func (UnimplementedSshPiperPluginServer) Logs(*StartLogRequest, SshPiperPlugin_LogsServer) error {
return status.Errorf(codes.Unimplemented, "method Logs not implemented")
func (UnimplementedSshPiperPluginServer) Logs(*StartLogRequest, grpc.ServerStreamingServer[Log]) error {
return status.Error(codes.Unimplemented, "method Logs not implemented")
}
func (UnimplementedSshPiperPluginServer) ListCallbacks(context.Context, *ListCallbackRequest) (*ListCallbackResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method ListCallbacks not implemented")
return nil, status.Error(codes.Unimplemented, "method ListCallbacks not implemented")
}
func (UnimplementedSshPiperPluginServer) NewConnection(context.Context, *NewConnectionRequest) (*NewConnectionResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method NewConnection not implemented")
return nil, status.Error(codes.Unimplemented, "method NewConnection not implemented")
}
func (UnimplementedSshPiperPluginServer) NextAuthMethods(context.Context, *NextAuthMethodsRequest) (*NextAuthMethodsResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method NextAuthMethods not implemented")
return nil, status.Error(codes.Unimplemented, "method NextAuthMethods not implemented")
}
func (UnimplementedSshPiperPluginServer) NoneAuth(context.Context, *NoneAuthRequest) (*NoneAuthResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method NoneAuth not implemented")
return nil, status.Error(codes.Unimplemented, "method NoneAuth not implemented")
}
func (UnimplementedSshPiperPluginServer) PasswordAuth(context.Context, *PasswordAuthRequest) (*PasswordAuthResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method PasswordAuth not implemented")
return nil, status.Error(codes.Unimplemented, "method PasswordAuth not implemented")
}
func (UnimplementedSshPiperPluginServer) PublicKeyAuth(context.Context, *PublicKeyAuthRequest) (*PublicKeyAuthResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method PublicKeyAuth not implemented")
return nil, status.Error(codes.Unimplemented, "method PublicKeyAuth not implemented")
}
func (UnimplementedSshPiperPluginServer) KeyboardInteractiveAuth(SshPiperPlugin_KeyboardInteractiveAuthServer) error {
return status.Errorf(codes.Unimplemented, "method KeyboardInteractiveAuth not implemented")
func (UnimplementedSshPiperPluginServer) KeyboardInteractiveAuth(grpc.BidiStreamingServer[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage]) error {
return status.Error(codes.Unimplemented, "method KeyboardInteractiveAuth not implemented")
}
func (UnimplementedSshPiperPluginServer) UpstreamAuthFailureNotice(context.Context, *UpstreamAuthFailureNoticeRequest) (*UpstreamAuthFailureNoticeResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method UpstreamAuthFailureNotice not implemented")
return nil, status.Error(codes.Unimplemented, "method UpstreamAuthFailureNotice not implemented")
}
func (UnimplementedSshPiperPluginServer) Banner(context.Context, *BannerRequest) (*BannerResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method Banner not implemented")
return nil, status.Error(codes.Unimplemented, "method Banner not implemented")
}
func (UnimplementedSshPiperPluginServer) VerifyHostKey(context.Context, *VerifyHostKeyRequest) (*VerifyHostKeyResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method VerifyHostKey not implemented")
return nil, status.Error(codes.Unimplemented, "method VerifyHostKey not implemented")
}
func (UnimplementedSshPiperPluginServer) PipeCreateErrorNotice(context.Context, *PipeCreateErrorNoticeRequest) (*PipeCreateErrorNoticeResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method PipeCreateErrorNotice not implemented")
return nil, status.Error(codes.Unimplemented, "method PipeCreateErrorNotice not implemented")
}
func (UnimplementedSshPiperPluginServer) PipeStartNotice(context.Context, *PipeStartNoticeRequest) (*PipeStartNoticeResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method PipeStartNotice not implemented")
return nil, status.Error(codes.Unimplemented, "method PipeStartNotice not implemented")
}
func (UnimplementedSshPiperPluginServer) PipeErrorNotice(context.Context, *PipeErrorNoticeRequest) (*PipeErrorNoticeResponse, error) {
return nil, status.Errorf(codes.Unimplemented, "method PipeErrorNotice not implemented")
return nil, status.Error(codes.Unimplemented, "method PipeErrorNotice not implemented")
}
func (UnimplementedSshPiperPluginServer) mustEmbedUnimplementedSshPiperPluginServer() {}
func (UnimplementedSshPiperPluginServer) testEmbeddedByValue() {}
// UnsafeSshPiperPluginServer may be embedded to opt out of forward compatibility for this service.
// Use of this interface is not recommended, as added methods to SshPiperPluginServer will
@ -294,6 +296,13 @@ type UnsafeSshPiperPluginServer interface {
}
func RegisterSshPiperPluginServer(s grpc.ServiceRegistrar, srv SshPiperPluginServer) {
// If the following call panics, it indicates UnimplementedSshPiperPluginServer was
// embedded by pointer and is nil. This will cause panics if an
// unimplemented method is ever invoked, so we test this at initialization
// time to prevent it from happening at runtime later due to I/O.
if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
t.testEmbeddedByValue()
}
s.RegisterService(&SshPiperPlugin_ServiceDesc, srv)
}
@ -302,21 +311,11 @@ func _SshPiperPlugin_Logs_Handler(srv interface{}, stream grpc.ServerStream) err
if err := stream.RecvMsg(m); err != nil {
return err
}
return srv.(SshPiperPluginServer).Logs(m, &sshPiperPluginLogsServer{stream})
return srv.(SshPiperPluginServer).Logs(m, &grpc.GenericServerStream[StartLogRequest, Log]{ServerStream: stream})
}
type SshPiperPlugin_LogsServer interface {
Send(*Log) error
grpc.ServerStream
}
type sshPiperPluginLogsServer struct {
grpc.ServerStream
}
func (x *sshPiperPluginLogsServer) Send(m *Log) error {
return x.ServerStream.SendMsg(m)
}
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
type SshPiperPlugin_LogsServer = grpc.ServerStreamingServer[Log]
func _SshPiperPlugin_ListCallbacks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(ListCallbackRequest)
@ -328,7 +327,7 @@ func _SshPiperPlugin_ListCallbacks_Handler(srv interface{}, ctx context.Context,
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/ListCallbacks",
FullMethod: SshPiperPlugin_ListCallbacks_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).ListCallbacks(ctx, req.(*ListCallbackRequest))
@ -346,7 +345,7 @@ func _SshPiperPlugin_NewConnection_Handler(srv interface{}, ctx context.Context,
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/NewConnection",
FullMethod: SshPiperPlugin_NewConnection_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).NewConnection(ctx, req.(*NewConnectionRequest))
@ -364,7 +363,7 @@ func _SshPiperPlugin_NextAuthMethods_Handler(srv interface{}, ctx context.Contex
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/NextAuthMethods",
FullMethod: SshPiperPlugin_NextAuthMethods_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).NextAuthMethods(ctx, req.(*NextAuthMethodsRequest))
@ -382,7 +381,7 @@ func _SshPiperPlugin_NoneAuth_Handler(srv interface{}, ctx context.Context, dec
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/NoneAuth",
FullMethod: SshPiperPlugin_NoneAuth_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).NoneAuth(ctx, req.(*NoneAuthRequest))
@ -400,7 +399,7 @@ func _SshPiperPlugin_PasswordAuth_Handler(srv interface{}, ctx context.Context,
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/PasswordAuth",
FullMethod: SshPiperPlugin_PasswordAuth_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).PasswordAuth(ctx, req.(*PasswordAuthRequest))
@ -418,7 +417,7 @@ func _SshPiperPlugin_PublicKeyAuth_Handler(srv interface{}, ctx context.Context,
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/PublicKeyAuth",
FullMethod: SshPiperPlugin_PublicKeyAuth_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).PublicKeyAuth(ctx, req.(*PublicKeyAuthRequest))
@ -427,30 +426,11 @@ func _SshPiperPlugin_PublicKeyAuth_Handler(srv interface{}, ctx context.Context,
}
func _SshPiperPlugin_KeyboardInteractiveAuth_Handler(srv interface{}, stream grpc.ServerStream) error {
return srv.(SshPiperPluginServer).KeyboardInteractiveAuth(&sshPiperPluginKeyboardInteractiveAuthServer{stream})
return srv.(SshPiperPluginServer).KeyboardInteractiveAuth(&grpc.GenericServerStream[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage]{ServerStream: stream})
}
type SshPiperPlugin_KeyboardInteractiveAuthServer interface {
Send(*KeyboardInteractiveAuthMessage) error
Recv() (*KeyboardInteractiveAuthMessage, error)
grpc.ServerStream
}
type sshPiperPluginKeyboardInteractiveAuthServer struct {
grpc.ServerStream
}
func (x *sshPiperPluginKeyboardInteractiveAuthServer) Send(m *KeyboardInteractiveAuthMessage) error {
return x.ServerStream.SendMsg(m)
}
func (x *sshPiperPluginKeyboardInteractiveAuthServer) Recv() (*KeyboardInteractiveAuthMessage, error) {
m := new(KeyboardInteractiveAuthMessage)
if err := x.ServerStream.RecvMsg(m); err != nil {
return nil, err
}
return m, nil
}
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
type SshPiperPlugin_KeyboardInteractiveAuthServer = grpc.BidiStreamingServer[KeyboardInteractiveAuthMessage, KeyboardInteractiveAuthMessage]
func _SshPiperPlugin_UpstreamAuthFailureNotice_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UpstreamAuthFailureNoticeRequest)
@ -462,7 +442,7 @@ func _SshPiperPlugin_UpstreamAuthFailureNotice_Handler(srv interface{}, ctx cont
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/UpstreamAuthFailureNotice",
FullMethod: SshPiperPlugin_UpstreamAuthFailureNotice_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).UpstreamAuthFailureNotice(ctx, req.(*UpstreamAuthFailureNoticeRequest))
@ -480,7 +460,7 @@ func _SshPiperPlugin_Banner_Handler(srv interface{}, ctx context.Context, dec fu
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/Banner",
FullMethod: SshPiperPlugin_Banner_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).Banner(ctx, req.(*BannerRequest))
@ -498,7 +478,7 @@ func _SshPiperPlugin_VerifyHostKey_Handler(srv interface{}, ctx context.Context,
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/VerifyHostKey",
FullMethod: SshPiperPlugin_VerifyHostKey_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).VerifyHostKey(ctx, req.(*VerifyHostKeyRequest))
@ -516,7 +496,7 @@ func _SshPiperPlugin_PipeCreateErrorNotice_Handler(srv interface{}, ctx context.
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/PipeCreateErrorNotice",
FullMethod: SshPiperPlugin_PipeCreateErrorNotice_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).PipeCreateErrorNotice(ctx, req.(*PipeCreateErrorNoticeRequest))
@ -534,7 +514,7 @@ func _SshPiperPlugin_PipeStartNotice_Handler(srv interface{}, ctx context.Contex
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/PipeStartNotice",
FullMethod: SshPiperPlugin_PipeStartNotice_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).PipeStartNotice(ctx, req.(*PipeStartNoticeRequest))
@ -552,7 +532,7 @@ func _SshPiperPlugin_PipeErrorNotice_Handler(srv interface{}, ctx context.Contex
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: "/libplugin.SshPiperPlugin/PipeErrorNotice",
FullMethod: SshPiperPlugin_PipeErrorNotice_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(SshPiperPluginServer).PipeErrorNotice(ctx, req.(*PipeErrorNoticeRequest))

View file

@ -7,7 +7,7 @@ put ip to jail for a while after failed to login for several times.
put this plugin after other plugins, like:
```
sshpiperd <main plguin> -- failtoban
sshpiperd <main plugin> -- failtoban
```

View file

@ -1,8 +1,8 @@
# kubernetes plugin for sshpiperd
The kubernetes plugin for sshpiperd provides native kubernetes CRD integretion and allow you manage sshpiper by `kubectl get pipes` and `kubectl apply -f pipe.yaml`
The kubernetes plugin for sshpiperd provides native kubernetes CRD integration and allow you manage sshpiper by `kubectl get pipes` and `kubectl apply -f pipe.yaml`
this plugin is inpsired by the [first version kubernetes plugin](https://github.com/pockost/sshpipe-k8s-lib/) for v0 sshpier by [pockost](https://github.com/pockost)
this plugin is inspired by the [first version kubernetes plugin](https://github.com/pockost/sshpipe-k8s-lib/) for v0 sshpiper by [pockost](https://github.com/pockost)
## Usage

View file

@ -8,7 +8,7 @@ some basic idea of yaml config file:
* any `from` in `pipe` fits `downstream` authentication will be considered as the `pipe` matched.
* `username_regex_match` can be used to match with regex
* to.Username can be template of regex match groups, example: `from.username: "^password_(.*?)_regex$"` and `to.username: $1"`, will match `password_user_regex` to `user`, more sytax see <https://pkg.go.dev/regexp#Regexp.Expand>
* to.Username can be template of regex match groups, example: `from.username: "^password_(.*?)_regex$"` and `to.username: $1"`, will match `password_user_regex` to `user`, more syntax see <https://pkg.go.dev/regexp#Regexp.Expand>
* `authorized_keys`, `known_hosts` are array `path/to/target/file` or single string, but there are also `authorized_keys_data`, `known_hosts_data` accepting base64 inline data, file and data will be merged if both are set
* `private_key` is `path/to/target/file`, but there are also `private_key_data` accepting base64 inline data, file wins if both are set