From 29a7a231ae19e528db364658a4e7db1cb1f27bf9 Mon Sep 17 00:00:00 2001 From: Boshi Lian Date: Sun, 26 Jun 2022 23:10:33 +0000 Subject: [PATCH] recover yaml driver --- sshpiperd/e2e/docker-compose.yml | 34 ++++++++++---------- sshpiperd/e2e/test.sh | 26 ++++++++-------- sshpiperd/loader.go | 2 +- sshpiperd/sshpiperd.go | 2 +- sshpiperd/upstream/yaml/yaml.go | 53 ++++++++++++++++---------------- 5 files changed, 59 insertions(+), 58 deletions(-) diff --git a/sshpiperd/e2e/docker-compose.yml b/sshpiperd/e2e/docker-compose.yml index a73efff8..e1875103 100644 --- a/sshpiperd/e2e/docker-compose.yml +++ b/sshpiperd/e2e/docker-compose.yml @@ -24,7 +24,7 @@ services: - "/test.sh" depends_on: - piper - # - piper_yaml + - piper_yaml # - piper_mysql # - piper_pg # - piper_mssql @@ -49,22 +49,22 @@ services: depends_on: - host1 - host2 - # piper_yaml: - # environment: - # - "SSHPIPERD_UPSTREAM_DRIVER=yaml" - # - "SSHPIPERD_UPSTREAM_YAML_NOCHECKPERM=true" - # - "SSHPIPERD_UPSTREAM_YAML_FILE=/sshpiperd.yaml" - # - "SSHPIPERD_AUDITOR=typescript-logger" - # - "SSHPIPERD_BANNERTEXT=hellopiper" - # - "SSHPIPERD_LOG_LEVEL=trace" - # build: ../.. - # volumes: - # - localkey:/local - # - workingdir:/var/sshpiper - # - ./sshpiperd.yaml:/sshpiperd.yaml - # depends_on: - # - host1 - # - host2 + piper_yaml: + environment: + - "SSHPIPERD_UPSTREAM_DRIVER=yaml" + - "SSHPIPERD_UPSTREAM_YAML_NOCHECKPERM=true" + - "SSHPIPERD_UPSTREAM_YAML_FILE=/sshpiperd.yaml" + - "SSHPIPERD_AUDITOR=typescript-logger" + - "SSHPIPERD_BANNERTEXT=hellopiper" + - "SSHPIPERD_LOG_LEVEL=trace" + build: ../.. + volumes: + - localkey:/local + - workingdir:/var/sshpiper + - ./sshpiperd.yaml:/sshpiperd.yaml + depends_on: + - host1 + - host2 # piper_sqlite: # environment: # - "SSHPIPERD_UPSTREAM_DRIVER=sqlite" diff --git a/sshpiperd/e2e/test.sh b/sshpiperd/e2e/test.sh index aa54c18a..0a2a4052 100755 --- a/sshpiperd/e2e/test.sh +++ b/sshpiperd/e2e/test.sh @@ -2,7 +2,7 @@ /wait.sh piper 2222 -# /wait.sh piper_yaml 2222 +/wait.sh piper_yaml 2222 #/wait.sh piper_sqlite 2222 # /wait.sh piper_mysql 2222 # /wait.sh piper_pg 2222 @@ -49,10 +49,10 @@ runtest(){ grep $rnd /workingdir/$user/* - # if [ $? -ne 0 ];then - # echo -e "grep typescript logger" $fail - # exit 1 - # fi + if [ $? -ne 0 ];then + echo -e "grep typescript logger" $fail + exit 1 + fi grep "hellopiper" /tmp/$host.stderr @@ -71,14 +71,14 @@ runtest "host2 with password:" "host2" "host2" "sshpass -p root ssh -v host2@pip # runtest "msql host2 with password:" "host2" "host2" "sshpass -p root ssh host2@piper_mssql -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2" -# runtest "yaml host2 with password passthrough:" "host2" "passthrough" "sshpass -p root ssh passthrough@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2" -# runtest "yaml host2 with password mappasspass:" "host2" "mappasspass" "sshpass -p pass ssh mappasspass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2" -# runtest "yaml host1 with password mappasskey:" "host1" "mappasskey" "sshpass -p pass ssh mappasskey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1" -# runtest "yaml host2 with password mapkeypass:" "host2" "mapkeypass" "ssh mapkeypass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host2" -# runtest "yaml host2 with key mapkeykey:" "host1" "mapkeykey" "ssh mapkeykey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1" -# runtest "yaml host2 with key mapkeykey2:" "host1" "mapkeykey2" "ssh mapkeykey2@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1" -# runtest "yaml host2 with password regex:" "host2" "regex000" "sshpass -p root ssh regex000@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2" -# runtest "yaml host1 with none host1:" "host1" "host1" "ssh host1@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1" +runtest "yaml host2 with password passthrough:" "host2" "passthrough" "sshpass -p root ssh passthrough@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2" +runtest "yaml host2 with password mappasspass:" "host2" "mappasspass" "sshpass -p pass ssh mappasspass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2" +runtest "yaml host1 with password mappasskey:" "host1" "mappasskey" "sshpass -p pass ssh mappasskey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1" +runtest "yaml host2 with password mapkeypass:" "host2" "mapkeypass" "ssh mapkeypass@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host2" +runtest "yaml host2 with key mapkeykey:" "host1" "mapkeykey" "ssh mapkeykey@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1" +runtest "yaml host2 with key mapkeykey2:" "host1" "mapkeykey2" "ssh mapkeykey2@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /local/id_rsa2 cat /names/host1" +runtest "yaml host2 with password regex:" "host2" "regex000" "sshpass -p root ssh regex000@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host2" +runtest "yaml host1 with none host1:" "host1" "host1" "ssh host1@piper_yaml -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null cat /names/host1" # runtest "grpc host1 with remotesigner:" "host1" "host1" "ssh host1@piper_grpc_remotesigner_host1 -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o PasswordAuthentication=no cat /names/host1" # runtest "grpc host1 with privatekey:" "host1" "host1" "ssh host1@piper_grpc_privatekey_host1 -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o PasswordAuthentication=no cat /names/host1" diff --git a/sshpiperd/loader.go b/sshpiperd/loader.go index 785878b6..91a79fea 100644 --- a/sshpiperd/loader.go +++ b/sshpiperd/loader.go @@ -5,7 +5,7 @@ import ( // _ "github.com/tg123/sshpiper/sshpiperd/upstream/grpcupstream" // _ "github.com/tg123/sshpiper/sshpiperd/upstream/kubernetes" _ "github.com/tg123/sshpiper/sshpiperd/upstream/workingdir" -// _ "github.com/tg123/sshpiper/sshpiperd/upstream/yaml" +_ "github.com/tg123/sshpiper/sshpiperd/upstream/yaml" // _ "github.com/tg123/sshpiper/sshpiperd/challenger/authy" // _ "github.com/tg123/sshpiper/sshpiperd/challenger/azdevicecode" diff --git a/sshpiperd/sshpiperd.go b/sshpiperd/sshpiperd.go index 3975d52c..215c0051 100644 --- a/sshpiperd/sshpiperd.go +++ b/sshpiperd/sshpiperd.go @@ -123,7 +123,7 @@ func installDrivers(piper *ssh.PiperConfig, config *piperdConfig, logger *log.Lo // return nil // }, // }, - // // auditor driver + // auditor driver { "Auditor", config.AuditorDriver, diff --git a/sshpiperd/upstream/yaml/yaml.go b/sshpiperd/upstream/yaml/yaml.go index 106bc3e8..40f45f05 100644 --- a/sshpiperd/upstream/yaml/yaml.go +++ b/sshpiperd/upstream/yaml/yaml.go @@ -11,6 +11,7 @@ import ( "regexp" "github.com/tg123/sshpiper/sshpiperd/upstream" + "github.com/tg123/sshpiper/sshpiperd/v0bridge" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/knownhosts" "gopkg.in/yaml.v3" @@ -105,7 +106,7 @@ func (p *plugin) loadConfig() (piperConfig, error) { type createPipeCtx struct { pipe pipeConfig conn ssh.ConnMetadata - challengeContext ssh.AdditionalChallengeContext + challengeContext ssh.ChallengeContext } func (p *plugin) loadFileOrDecode(file string, base64data string, ctx createPipeCtx) ([]byte, error) { @@ -136,7 +137,7 @@ func (p *plugin) loadFileOrDecode(file string, base64data string, ctx createPipe return nil, nil } -func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challengeContext ssh.AdditionalChallengeContext) (*ssh.AuthPipe, error) { +func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challengeContext ssh.ChallengeContext) (*v0bridge.AuthPipe, error) { ctx := createPipeCtx{pipe, conn, challengeContext} hostKeyCallback := ssh.InsecureIgnoreHostKey() @@ -157,20 +158,20 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng } } - to := func(key ssh.PublicKey) (ssh.AuthPipeType, ssh.AuthMethod, error) { + to := func(key ssh.PublicKey) (v0bridge.AuthPipeType, ssh.AuthMethod, error) { switch pipe.Authmap.To.Type { case "none": - return ssh.AuthPipeTypeNone, nil, nil + return v0bridge.AuthPipeTypeNone, nil, nil case "password": - return ssh.AuthPipeTypeMap, ssh.Password(pipe.Authmap.To.Password), nil + return v0bridge.AuthPipeTypeMap, ssh.Password(pipe.Authmap.To.Password), nil case "privatekey": privateBytes, err := p.loadFileOrDecode(pipe.Authmap.To.PrivateKey, pipe.Authmap.To.PrivateKeyData, ctx) if err != nil { - return ssh.AuthPipeTypeDiscard, nil, err + return v0bridge.AuthPipeTypeDiscard, nil, err } // did not find to 1 private key try key map @@ -178,7 +179,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng for _, privkey := range pipe.Authmap.To.KeyMap { rest, err := p.loadFileOrDecode(privkey.AuthorizedKeys, privkey.AuthorizedKeysData, ctx) if err != nil { - return ssh.AuthPipeTypeDiscard, nil, err + return v0bridge.AuthPipeTypeDiscard, nil, err } var authedPubkey ssh.PublicKey @@ -186,7 +187,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng for len(rest) > 0 { authedPubkey, _, _, rest, err = ssh.ParseAuthorizedKey(rest) if err != nil { - return ssh.AuthPipeTypeDiscard, nil, err + return v0bridge.AuthPipeTypeDiscard, nil, err } keydata := key.Marshal() @@ -195,7 +196,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng privateBytes, err = p.loadFileOrDecode(privkey.PrivateKey, privkey.PrivateKeyData, ctx) if err != nil { - return ssh.AuthPipeTypeDiscard, nil, err + return v0bridge.AuthPipeTypeDiscard, nil, err } if len(privateBytes) > 0 { @@ -209,32 +210,32 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng } if len(privateBytes) == 0 { - return ssh.AuthPipeTypeDiscard, nil, fmt.Errorf("no private key found") + return v0bridge.AuthPipeTypeDiscard, nil, fmt.Errorf("no private key found") } private, err := ssh.ParsePrivateKey(privateBytes) if err != nil { - return ssh.AuthPipeTypeDiscard, nil, err + return v0bridge.AuthPipeTypeDiscard, nil, err } - return ssh.AuthPipeTypeMap, ssh.PublicKeys(private), nil + return v0bridge.AuthPipeTypeMap, ssh.PublicKeys(private), nil default: p.logger.Printf("unsupport type [%v] fallback to passthrough", pipe.Authmap.To.Type) } if pipe.Authmap.NoPassthrough { - return ssh.AuthPipeTypeDiscard, nil, nil + return v0bridge.AuthPipeTypeDiscard, nil, nil } - return ssh.AuthPipeTypePassThrough, nil, nil + return v0bridge.AuthPipeTypePassThrough, nil, nil } allowPasswords := make(map[string]bool) var allowPubKeys []ssh.PublicKey allowAnyPubKey := false - a := &ssh.AuthPipe{ + a := &v0bridge.AuthPipe{ User: pipe.Authmap.MappedUsername, UpstreamHostKeyCallback: hostKeyCallback, @@ -245,7 +246,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng case "none": if a.NoneAuthCallback == nil { - a.NoneAuthCallback = func(conn ssh.ConnMetadata) (ssh.AuthPipeType, ssh.AuthMethod, error) { + a.NoneAuthCallback = func(conn ssh.ConnMetadata) (v0bridge.AuthPipeType, ssh.AuthMethod, error) { return to(nil) } } @@ -254,7 +255,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng allowPasswords[from.Password] = true if a.PasswordCallback == nil { - a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (ssh.AuthPipeType, ssh.AuthMethod, error) { + a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (v0bridge.AuthPipeType, ssh.AuthMethod, error) { _, ok := allowPasswords[string(password)] @@ -263,10 +264,10 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng } if pipe.Authmap.NoPassthrough { - return ssh.AuthPipeTypeDiscard, nil, nil + return v0bridge.AuthPipeTypeDiscard, nil, nil } - return ssh.AuthPipeTypePassThrough, nil, nil + return v0bridge.AuthPipeTypePassThrough, nil, nil } } @@ -294,7 +295,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng } if a.PublicKeyCallback == nil { - a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (ssh.AuthPipeType, ssh.AuthMethod, error) { + a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (v0bridge.AuthPipeType, ssh.AuthMethod, error) { if allowAnyPubKey { return to(key) @@ -309,24 +310,24 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng } if pipe.Authmap.NoPassthrough { - return ssh.AuthPipeTypeDiscard, nil, nil + return v0bridge.AuthPipeTypeDiscard, nil, nil } // will fail but discard will lead a timeout - return ssh.AuthPipeTypePassThrough, nil, nil + return v0bridge.AuthPipeTypePassThrough, nil, nil } } case "any": - a.NoneAuthCallback = func(conn ssh.ConnMetadata) (ssh.AuthPipeType, ssh.AuthMethod, error) { + a.NoneAuthCallback = func(conn ssh.ConnMetadata) (v0bridge.AuthPipeType, ssh.AuthMethod, error) { return to(nil) } - a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (ssh.AuthPipeType, ssh.AuthMethod, error) { + a.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (v0bridge.AuthPipeType, ssh.AuthMethod, error) { return to(nil) } - a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (ssh.AuthPipeType, ssh.AuthMethod, error) { + a.PublicKeyCallback = func(conn ssh.ConnMetadata, key ssh.PublicKey) (v0bridge.AuthPipeType, ssh.AuthMethod, error) { return to(key) } @@ -341,7 +342,7 @@ func (p *plugin) createAuthPipe(pipe pipeConfig, conn ssh.ConnMetadata, challeng return a, nil } -func (p *plugin) findUpstream(conn ssh.ConnMetadata, challengeContext ssh.AdditionalChallengeContext) (net.Conn, *ssh.AuthPipe, error) { +func (p *plugin) findUpstream(conn ssh.ConnMetadata, challengeContext ssh.ChallengeContext) (net.Conn, *v0bridge.AuthPipe, error) { user := conn.User() config, err := p.loadConfig()