engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Feat: fail2ban whitelist (#546)

Browse source 
* feat: support whitelist in failtoban plugin

* test: add e2e test for failtoban ignore ip

* refactor: use netipx for easy contains check
This commit is contained in:
diedpigs 2025-03-15 06:23:09 -05:00 • committed by GitHub
parent 486bd74534
commit 9ff3550786
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 294 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

232
e2e/failtoban_test.go
View file

@ -240,3 +240,235 @@ func TestFailtobanPipeCreateFail(t *testing.T) {
}
}
}
func TestFailtobanIgnoreIP(t *testing.T) {
piperaddr, piperport := nextAvailablePiperAddress()
piper, _, _, err := runCmd("/sshpiperd/sshpiperd",
"-p",
piperport,
"/sshpiperd/plugins/fixed",
"--target",
"host-password:2222",
"--",
"/sshpiperd/plugins/failtoban",
"--max-failures",
"3",
"--ignore-ip",
"127.0.0.1",
)
if err != nil {
t.Errorf("failed to run sshpiperd: %v", err)
}
defer killCmd(piper)
waitForEndpointReady(piperaddr)
{
randtext := uuid.New().String()
targetfie := uuid.New().String()
c, stdin, stdout, err := runCmd(
"ssh",
"-v",
"-o",
"StrictHostKeyChecking=no",
"-o",
"UserKnownHostsFile=/dev/null",
"-p",
piperport,
"-l",
"user",
"127.0.0.1",
fmt.Sprintf(`sh -c "echo -n %v > /shared/%v"`, randtext, targetfie),
)
if err != nil {
t.Errorf("failed to ssh to piper-workingdir, %v", err)
}
defer killCmd(c)
enterPassword(stdin, stdout, "pass")
time.Sleep(time.Second) // wait for file flush
checkSharedFileContent(t, targetfie, randtext)
}
// run 3 times with wrong password
{
c, stdin, stdout, err := runCmd(
"ssh",
"-v",
"-o",
"StrictHostKeyChecking=no",
"-o",
"UserKnownHostsFile=/dev/null",
"-p",
piperport,
"-l",
"user",
"127.0.0.1",
)
if err != nil {
t.Errorf("failed to ssh to piper-fixed, %v", err)
}
defer killCmd(c)
enterPassword(stdin, stdout, "wrongpass1")
enterPassword(stdin, stdout, "wrongpass2")
enterPassword(stdin, stdout, "wrongpass3")
}
{
randtext := uuid.New().String()
targetfie := uuid.New().String()
c, stdin, stdout, err := runCmd(
"ssh",
"-v",
"-o",
"StrictHostKeyChecking=no",
"-o",
"UserKnownHostsFile=/dev/null",
"-p",
piperport,
"-l",
"user",
"127.0.0.1",
fmt.Sprintf(`sh -c "echo -n %v > /shared/%v"`, randtext, targetfie),
)
if err != nil {
t.Errorf("failed to ssh to piper-workingdir, %v", err)
}
defer killCmd(c)
enterPassword(stdin, stdout, "pass")
time.Sleep(time.Second) // wait for file flush
checkSharedFileContent(t, targetfie, randtext)
}
}
func TestFailtobanIgnoreCIDR(t *testing.T) {
piperaddr, piperport := nextAvailablePiperAddress()
piper, _, _, err := runCmd("/sshpiperd/sshpiperd",
"-p",
piperport,
"/sshpiperd/plugins/fixed",
"--target",
"host-password:2222",
"--",
"/sshpiperd/plugins/failtoban",
"--max-failures",
"3",
"--ignore-ip",
"127.0.0.1/8",
)
if err != nil {
t.Errorf("failed to run sshpiperd: %v", err)
}
defer killCmd(piper)
waitForEndpointReady(piperaddr)
{
randtext := uuid.New().String()
targetfie := uuid.New().String()
c, stdin, stdout, err := runCmd(
"ssh",
"-v",
"-o",
"StrictHostKeyChecking=no",
"-o",
"UserKnownHostsFile=/dev/null",
"-p",
piperport,
"-l",
"user",
"127.0.0.1",
fmt.Sprintf(`sh -c "echo -n %v > /shared/%v"`, randtext, targetfie),
)
if err != nil {
t.Errorf("failed to ssh to piper-workingdir, %v", err)
}
defer killCmd(c)
enterPassword(stdin, stdout, "pass")
time.Sleep(time.Second) // wait for file flush
checkSharedFileContent(t, targetfie, randtext)
}
// run 3 times with wrong password
{
c, stdin, stdout, err := runCmd(
"ssh",
"-v",
"-o",
"StrictHostKeyChecking=no",
"-o",
"UserKnownHostsFile=/dev/null",
"-p",
piperport,
"-l",
"user",
"127.0.0.1",
)
if err != nil {
t.Errorf("failed to ssh to piper-fixed, %v", err)
}
defer killCmd(c)
enterPassword(stdin, stdout, "wrongpass1")
enterPassword(stdin, stdout, "wrongpass2")
enterPassword(stdin, stdout, "wrongpass3")
}
{
randtext := uuid.New().String()
targetfie := uuid.New().String()
c, stdin, stdout, err := runCmd(
"ssh",
"-v",
"-o",
"StrictHostKeyChecking=no",
"-o",
"UserKnownHostsFile=/dev/null",
"-p",
piperport,
"-l",
"user",
"127.0.0.1",
fmt.Sprintf(`sh -c "echo -n %v > /shared/%v"`, randtext, targetfie),
)
if err != nil {
t.Errorf("failed to ssh to piper-workingdir, %v", err)
}
defer killCmd(c)
enterPassword(stdin, stdout, "pass")
time.Sleep(time.Second) // wait for file flush
checkSharedFileContent(t, targetfie, randtext)
}
}