From da6c47ecbe70446b0ec8a83b7c2b4fa00e11f749 Mon Sep 17 00:00:00 2001 From: Boshi Lian Date: Mon, 4 Oct 2021 02:16:23 +0000 Subject: [PATCH] add hostkey api --- sshpiperd/upstream/grpcupstream/grpc.go | 44 ++- sshpiperd/upstream/grpcupstream/plugin.go | 1 + .../grpcupstream/simpleserver/impl.go | 8 +- .../upstream/grpcupstream/upstream.pb.go | 281 ++++++++++++++---- .../upstream/grpcupstream/upstream.proto | 11 + .../upstream/grpcupstream/upstream_grpc.pb.go | 36 +++ 6 files changed, 309 insertions(+), 72 deletions(-) diff --git a/sshpiperd/upstream/grpcupstream/grpc.go b/sshpiperd/upstream/grpcupstream/grpc.go index 6b455fcf..4bd6fe67 100644 --- a/sshpiperd/upstream/grpcupstream/grpc.go +++ b/sshpiperd/upstream/grpcupstream/grpc.go @@ -2,7 +2,9 @@ package grpcupstream import ( "context" + "fmt" "net" + "time" "github.com/tg123/remotesigner" "github.com/tg123/remotesigner/grpcsigner" @@ -10,9 +12,16 @@ import ( "golang.org/x/crypto/ssh" ) +func (p *plugin) timeoutCtx() (context.Context, context.CancelFunc) { + d := time.Now().Add(time.Duration(p.Config.Timeout) * time.Second) + return context.WithDeadline(context.Background(), d) +} + func (p *plugin) mapauth(conn ssh.ConnMetadata, metadata string, typ MapAuthRequest_Authtype, param []byte) (ssh.AuthPipeType, ssh.AuthMethod, error) { - // TODO timeout - a, err := p.upstreamClient.MapAuth(context.TODO(), &MapAuthRequest{ + ctx, cancel := p.timeoutCtx() + defer cancel() + + a, err := p.upstreamClient.MapAuth(ctx, &MapAuthRequest{ UserName: conn.User(), FromAddr: conn.RemoteAddr().String(), AuthType: typ, @@ -55,10 +64,33 @@ func (p *plugin) mapauth(conn ssh.ConnMetadata, metadata string, typ MapAuthRequ } } -func (p *plugin) findUpstream(conn ssh.ConnMetadata, challengeContext ssh.AdditionalChallengeContext) (net.Conn, *ssh.AuthPipe, error) { +func (p *plugin) verifyHostKey(hostname string, remote net.Addr, key ssh.PublicKey) error { - // TODO timeout to config - u, err := p.upstreamClient.FindUpstream(context.TODO(), &FindUpstreamRequest{ + ctx, cancel := p.timeoutCtx() + defer cancel() + + v, err := p.upstreamClient.VerifyHostKey(ctx, &VerifyHostKeyRequest{ + Hostname: hostname, + Address: remote.String(), + Key: key.Marshal(), + }) + + if err != nil { + return err + } + + if !v.Verified { + return fmt.Errorf("host key mismatch") + } + + return nil +} + +func (p *plugin) findUpstream(conn ssh.ConnMetadata, challengeContext ssh.AdditionalChallengeContext) (net.Conn, *ssh.AuthPipe, error) { + ctx, cancel := p.timeoutCtx() + defer cancel() + + u, err := p.upstreamClient.FindUpstream(ctx, &FindUpstreamRequest{ UserName: conn.User(), FromAddr: conn.RemoteAddr().String(), }) @@ -73,7 +105,7 @@ func (p *plugin) findUpstream(conn ssh.ConnMetadata, challengeContext ssh.Additi a := &ssh.AuthPipe{ User: u.MappedUserName, - UpstreamHostKeyCallback: ssh.InsecureIgnoreHostKey(), // TODO replace with gRPC api + UpstreamHostKeyCallback: p.verifyHostKey, } a.NoneAuthCallback = func(conn ssh.ConnMetadata) (ssh.AuthPipeType, ssh.AuthMethod, error) { diff --git a/sshpiperd/upstream/grpcupstream/plugin.go b/sshpiperd/upstream/grpcupstream/plugin.go index 79d20f9c..664b08fa 100644 --- a/sshpiperd/upstream/grpcupstream/plugin.go +++ b/sshpiperd/upstream/grpcupstream/plugin.go @@ -20,6 +20,7 @@ type plugin struct { CA string `long:"upstream-grpc-ca" description:"ca file path" env:"SSHPIPERD_UPSTREAM_GRPC_CA" ini-name:"upstream-grpc-ca"` Cert string `long:"upstream-grpc-cert" description:"certificate file path" env:"SSHPIPERD_UPSTREAM_GRPC_CERT" ini-name:"upstream-grpc-cert"` Key string `long:"upstream-grpc-key" description:"key file path" env:"SSHPIPERD_UPSTREAM_GRPC_KEY" ini-name:"upstream-grpc-key"` + Timeout int `long:"upstream-grpc-timeout" description:"grpc call timeout in second" default:"10" env:"SSHPIPERD_UPSTREAM_GRPC_TIMEOUT" ini-name:"upstream-grpc-timeout"` } logger *log.Logger diff --git a/sshpiperd/upstream/grpcupstream/simpleserver/impl.go b/sshpiperd/upstream/grpcupstream/simpleserver/impl.go index f096923a..058ed7d1 100644 --- a/sshpiperd/upstream/grpcupstream/simpleserver/impl.go +++ b/sshpiperd/upstream/grpcupstream/simpleserver/impl.go @@ -6,13 +6,11 @@ import ( "io/ioutil" "log" - "github.com/tg123/remotesigner/grpcsigner" "github.com/tg123/sshpiper/sshpiperd/upstream/grpcupstream" ) type server struct { grpcupstream.UnimplementedUpstreamRegistryServer - grpcsigner.UnimplementedSignerServer ToType string `long:"totype" default:"PASSTHROUGH"` ToAddr string `long:"toaddr"` @@ -29,6 +27,12 @@ func (s *server) FindUpstream(_ context.Context, request *grpcupstream.FindUpstr }, nil } +func (s *server) VerifyHostKey(context.Context, *grpcupstream.VerifyHostKeyRequest) (*grpcupstream.VerifyHostKeyReply, error) { + return &grpcupstream.VerifyHostKeyReply{ + Verified: true, + }, nil +} + func (s *server) MapAuth(_ context.Context, request *grpcupstream.MapAuthRequest) (*grpcupstream.MapAuthReply, error) { totype := grpcupstream.MapAuthReply_Authtype(grpcupstream.MapAuthReply_Authtype_value[s.ToType]) log.Printf("mapping auth [%v] to [%v]", request.AuthType, totype) diff --git a/sshpiperd/upstream/grpcupstream/upstream.pb.go b/sshpiperd/upstream/grpcupstream/upstream.pb.go index 5263333c..49924222 100644 --- a/sshpiperd/upstream/grpcupstream/upstream.pb.go +++ b/sshpiperd/upstream/grpcupstream/upstream.pb.go @@ -66,7 +66,7 @@ func (x MapAuthRequest_Authtype) Number() protoreflect.EnumNumber { // Deprecated: Use MapAuthRequest_Authtype.Descriptor instead. func (MapAuthRequest_Authtype) EnumDescriptor() ([]byte, []int) { - return file_upstream_proto_rawDescGZIP(), []int{2, 0} + return file_upstream_proto_rawDescGZIP(), []int{4, 0} } type MapAuthReply_Authtype int32 @@ -124,7 +124,7 @@ func (x MapAuthReply_Authtype) Number() protoreflect.EnumNumber { // Deprecated: Use MapAuthReply_Authtype.Descriptor instead. func (MapAuthReply_Authtype) EnumDescriptor() ([]byte, []int) { - return file_upstream_proto_rawDescGZIP(), []int{3, 0} + return file_upstream_proto_rawDescGZIP(), []int{5, 0} } type FindUpstreamRequest struct { @@ -245,6 +245,116 @@ func (x *FindUpstreamReply) GetMetadata() string { return "" } +type VerifyHostKeyRequest struct { + state protoimpl.MessageState + sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + + Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"` + Address string `protobuf:"bytes,2,opt,name=address,proto3" json:"address,omitempty"` + Key []byte `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"` +} + +func (x *VerifyHostKeyRequest) Reset() { + *x = VerifyHostKeyRequest{} + if protoimpl.UnsafeEnabled { + mi := &file_upstream_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) + } +} + +func (x *VerifyHostKeyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*VerifyHostKeyRequest) ProtoMessage() {} + +func (x *VerifyHostKeyRequest) ProtoReflect() protoreflect.Message { + mi := &file_upstream_proto_msgTypes[2] + if protoimpl.UnsafeEnabled && x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use VerifyHostKeyRequest.ProtoReflect.Descriptor instead. +func (*VerifyHostKeyRequest) Descriptor() ([]byte, []int) { + return file_upstream_proto_rawDescGZIP(), []int{2} +} + +func (x *VerifyHostKeyRequest) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *VerifyHostKeyRequest) GetAddress() string { + if x != nil { + return x.Address + } + return "" +} + +func (x *VerifyHostKeyRequest) GetKey() []byte { + if x != nil { + return x.Key + } + return nil +} + +type VerifyHostKeyReply struct { + state protoimpl.MessageState + sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + + Verified bool `protobuf:"varint,1,opt,name=verified,proto3" json:"verified,omitempty"` +} + +func (x *VerifyHostKeyReply) Reset() { + *x = VerifyHostKeyReply{} + if protoimpl.UnsafeEnabled { + mi := &file_upstream_proto_msgTypes[3] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) + } +} + +func (x *VerifyHostKeyReply) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*VerifyHostKeyReply) ProtoMessage() {} + +func (x *VerifyHostKeyReply) ProtoReflect() protoreflect.Message { + mi := &file_upstream_proto_msgTypes[3] + if protoimpl.UnsafeEnabled && x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use VerifyHostKeyReply.ProtoReflect.Descriptor instead. +func (*VerifyHostKeyReply) Descriptor() ([]byte, []int) { + return file_upstream_proto_rawDescGZIP(), []int{3} +} + +func (x *VerifyHostKeyReply) GetVerified() bool { + if x != nil { + return x.Verified + } + return false +} + type MapAuthRequest struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache @@ -260,7 +370,7 @@ type MapAuthRequest struct { func (x *MapAuthRequest) Reset() { *x = MapAuthRequest{} if protoimpl.UnsafeEnabled { - mi := &file_upstream_proto_msgTypes[2] + mi := &file_upstream_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -273,7 +383,7 @@ func (x *MapAuthRequest) String() string { func (*MapAuthRequest) ProtoMessage() {} func (x *MapAuthRequest) ProtoReflect() protoreflect.Message { - mi := &file_upstream_proto_msgTypes[2] + mi := &file_upstream_proto_msgTypes[4] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -286,7 +396,7 @@ func (x *MapAuthRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MapAuthRequest.ProtoReflect.Descriptor instead. func (*MapAuthRequest) Descriptor() ([]byte, []int) { - return file_upstream_proto_rawDescGZIP(), []int{2} + return file_upstream_proto_rawDescGZIP(), []int{4} } func (x *MapAuthRequest) GetUserName() string { @@ -336,7 +446,7 @@ type MapAuthReply struct { func (x *MapAuthReply) Reset() { *x = MapAuthReply{} if protoimpl.UnsafeEnabled { - mi := &file_upstream_proto_msgTypes[3] + mi := &file_upstream_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -349,7 +459,7 @@ func (x *MapAuthReply) String() string { func (*MapAuthReply) ProtoMessage() {} func (x *MapAuthReply) ProtoReflect() protoreflect.Message { - mi := &file_upstream_proto_msgTypes[3] + mi := &file_upstream_proto_msgTypes[5] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -362,7 +472,7 @@ func (x *MapAuthReply) ProtoReflect() protoreflect.Message { // Deprecated: Use MapAuthReply.ProtoReflect.Descriptor instead. func (*MapAuthReply) Descriptor() ([]byte, []int) { - return file_upstream_proto_rawDescGZIP(), []int{3} + return file_upstream_proto_rawDescGZIP(), []int{5} } func (x *MapAuthReply) GetMappedAuthType() MapAuthReply_Authtype { @@ -395,53 +505,68 @@ var file_upstream_proto_rawDesc = []byte{ 0x70, 0x70, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, - 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xf8, - 0x01, 0x0a, 0x0e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, - 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, - 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, - 0x08, 0x66, 0x72, 0x6f, 0x6d, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, - 0x08, 0x66, 0x72, 0x6f, 0x6d, 0x41, 0x64, 0x64, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x6d, 0x65, 0x74, - 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x65, 0x74, - 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x41, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, - 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, - 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, - 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x74, 0x79, 0x70, 0x65, 0x52, 0x08, - 0x61, 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x68, - 0x50, 0x61, 0x72, 0x61, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x61, 0x75, 0x74, - 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x22, 0x31, 0x0a, 0x08, 0x41, 0x75, 0x74, 0x68, 0x74, 0x79, - 0x70, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, - 0x50, 0x41, 0x53, 0x53, 0x57, 0x4f, 0x52, 0x44, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x50, 0x55, - 0x42, 0x4c, 0x49, 0x43, 0x4b, 0x45, 0x59, 0x10, 0x02, 0x22, 0xe9, 0x01, 0x0a, 0x0c, 0x4d, 0x61, - 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x4b, 0x0a, 0x0e, 0x6d, 0x61, - 0x70, 0x70, 0x65, 0x64, 0x41, 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, - 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, - 0x6d, 0x2e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x2e, 0x41, - 0x75, 0x74, 0x68, 0x74, 0x79, 0x70, 0x65, 0x52, 0x0e, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x41, - 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x28, 0x0a, 0x0f, 0x6d, 0x61, 0x70, 0x70, 0x65, - 0x64, 0x41, 0x75, 0x74, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, - 0x52, 0x0f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x41, 0x75, 0x74, 0x68, 0x50, 0x61, 0x72, 0x61, - 0x6d, 0x22, 0x62, 0x0a, 0x08, 0x41, 0x75, 0x74, 0x68, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, - 0x0b, 0x50, 0x41, 0x53, 0x53, 0x54, 0x48, 0x52, 0x4f, 0x55, 0x47, 0x48, 0x10, 0x00, 0x12, 0x0b, - 0x0a, 0x07, 0x44, 0x49, 0x53, 0x43, 0x41, 0x52, 0x44, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x4e, - 0x4f, 0x4e, 0x45, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x50, 0x41, 0x53, 0x53, 0x57, 0x4f, 0x52, - 0x44, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x4b, 0x45, - 0x59, 0x10, 0x04, 0x12, 0x10, 0x0a, 0x0c, 0x52, 0x45, 0x4d, 0x4f, 0x54, 0x45, 0x53, 0x49, 0x47, - 0x4e, 0x45, 0x52, 0x10, 0x05, 0x32, 0xaf, 0x01, 0x0a, 0x10, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, - 0x61, 0x6d, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x12, 0x54, 0x0a, 0x0c, 0x46, 0x69, - 0x6e, 0x64, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x21, 0x2e, 0x67, 0x72, 0x70, - 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x55, 0x70, - 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, - 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x46, 0x69, 0x6e, - 0x64, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x22, 0x00, - 0x12, 0x45, 0x0a, 0x07, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x12, 0x1c, 0x2e, 0x67, 0x72, - 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x4d, 0x61, 0x70, 0x41, 0x75, - 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x67, 0x72, 0x70, 0x63, + 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x5e, + 0x0a, 0x14, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x48, 0x6f, 0x73, 0x74, 0x4b, 0x65, 0x79, 0x52, + 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, + 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, + 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x02, 0x20, + 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, + 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x22, 0x30, + 0x0a, 0x12, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x48, 0x6f, 0x73, 0x74, 0x4b, 0x65, 0x79, 0x52, + 0x65, 0x70, 0x6c, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, + 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, + 0x22, 0xf8, 0x01, 0x0a, 0x0e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, + 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x18, + 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, + 0x1a, 0x0a, 0x08, 0x66, 0x72, 0x6f, 0x6d, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x08, 0x66, 0x72, 0x6f, 0x6d, 0x41, 0x64, 0x64, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x6d, + 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, + 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x41, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x54, + 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, - 0x52, 0x65, 0x70, 0x6c, 0x79, 0x22, 0x00, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, - 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x67, 0x31, 0x32, 0x33, 0x2f, 0x73, 0x73, 0x68, 0x70, - 0x69, 0x70, 0x65, 0x72, 0x2f, 0x73, 0x73, 0x68, 0x70, 0x69, 0x70, 0x65, 0x72, 0x64, 0x2f, 0x75, - 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, - 0x72, 0x65, 0x61, 0x6d, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x74, 0x79, 0x70, 0x65, + 0x52, 0x08, 0x61, 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x75, + 0x74, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x61, + 0x75, 0x74, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x22, 0x31, 0x0a, 0x08, 0x41, 0x75, 0x74, 0x68, + 0x74, 0x79, 0x70, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x00, 0x12, 0x0c, + 0x0a, 0x08, 0x50, 0x41, 0x53, 0x53, 0x57, 0x4f, 0x52, 0x44, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, + 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x4b, 0x45, 0x59, 0x10, 0x02, 0x22, 0xe9, 0x01, 0x0a, 0x0c, + 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x4b, 0x0a, 0x0e, + 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x41, 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, 0x65, 0x18, 0x01, + 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, + 0x65, 0x61, 0x6d, 0x2e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x70, 0x6c, 0x79, + 0x2e, 0x41, 0x75, 0x74, 0x68, 0x74, 0x79, 0x70, 0x65, 0x52, 0x0e, 0x6d, 0x61, 0x70, 0x70, 0x65, + 0x64, 0x41, 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x28, 0x0a, 0x0f, 0x6d, 0x61, 0x70, + 0x70, 0x65, 0x64, 0x41, 0x75, 0x74, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x18, 0x02, 0x20, 0x01, + 0x28, 0x0c, 0x52, 0x0f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x41, 0x75, 0x74, 0x68, 0x50, 0x61, + 0x72, 0x61, 0x6d, 0x22, 0x62, 0x0a, 0x08, 0x41, 0x75, 0x74, 0x68, 0x74, 0x79, 0x70, 0x65, 0x12, + 0x0f, 0x0a, 0x0b, 0x50, 0x41, 0x53, 0x53, 0x54, 0x48, 0x52, 0x4f, 0x55, 0x47, 0x48, 0x10, 0x00, + 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x49, 0x53, 0x43, 0x41, 0x52, 0x44, 0x10, 0x01, 0x12, 0x08, 0x0a, + 0x04, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x50, 0x41, 0x53, 0x53, 0x57, + 0x4f, 0x52, 0x44, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, + 0x4b, 0x45, 0x59, 0x10, 0x04, 0x12, 0x10, 0x0a, 0x0c, 0x52, 0x45, 0x4d, 0x4f, 0x54, 0x45, 0x53, + 0x49, 0x47, 0x4e, 0x45, 0x52, 0x10, 0x05, 0x32, 0x88, 0x02, 0x0a, 0x10, 0x55, 0x70, 0x73, 0x74, + 0x72, 0x65, 0x61, 0x6d, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x12, 0x54, 0x0a, 0x0c, + 0x46, 0x69, 0x6e, 0x64, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x21, 0x2e, 0x67, + 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x46, 0x69, 0x6e, 0x64, + 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, + 0x1f, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x46, + 0x69, 0x6e, 0x64, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x52, 0x65, 0x70, 0x6c, 0x79, + 0x22, 0x00, 0x12, 0x57, 0x0a, 0x0d, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x48, 0x6f, 0x73, 0x74, + 0x4b, 0x65, 0x79, 0x12, 0x22, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, + 0x61, 0x6d, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x48, 0x6f, 0x73, 0x74, 0x4b, 0x65, 0x79, + 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, + 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x48, 0x6f, 0x73, + 0x74, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x07, 0x4d, + 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x12, 0x1c, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, + 0x74, 0x72, 0x65, 0x61, 0x6d, 0x2e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, + 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, + 0x65, 0x61, 0x6d, 0x2e, 0x4d, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x70, 0x6c, 0x79, + 0x22, 0x00, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, + 0x2f, 0x74, 0x67, 0x31, 0x32, 0x33, 0x2f, 0x73, 0x73, 0x68, 0x70, 0x69, 0x70, 0x65, 0x72, 0x2f, + 0x73, 0x73, 0x68, 0x70, 0x69, 0x70, 0x65, 0x72, 0x64, 0x2f, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, + 0x61, 0x6d, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x62, + 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( @@ -457,24 +582,28 @@ func file_upstream_proto_rawDescGZIP() []byte { } var file_upstream_proto_enumTypes = make([]protoimpl.EnumInfo, 2) -var file_upstream_proto_msgTypes = make([]protoimpl.MessageInfo, 4) +var file_upstream_proto_msgTypes = make([]protoimpl.MessageInfo, 6) var file_upstream_proto_goTypes = []interface{}{ (MapAuthRequest_Authtype)(0), // 0: grpcupstream.MapAuthRequest.Authtype (MapAuthReply_Authtype)(0), // 1: grpcupstream.MapAuthReply.Authtype (*FindUpstreamRequest)(nil), // 2: grpcupstream.FindUpstreamRequest (*FindUpstreamReply)(nil), // 3: grpcupstream.FindUpstreamReply - (*MapAuthRequest)(nil), // 4: grpcupstream.MapAuthRequest - (*MapAuthReply)(nil), // 5: grpcupstream.MapAuthReply + (*VerifyHostKeyRequest)(nil), // 4: grpcupstream.VerifyHostKeyRequest + (*VerifyHostKeyReply)(nil), // 5: grpcupstream.VerifyHostKeyReply + (*MapAuthRequest)(nil), // 6: grpcupstream.MapAuthRequest + (*MapAuthReply)(nil), // 7: grpcupstream.MapAuthReply } var file_upstream_proto_depIdxs = []int32{ 0, // 0: grpcupstream.MapAuthRequest.authType:type_name -> grpcupstream.MapAuthRequest.Authtype 1, // 1: grpcupstream.MapAuthReply.mappedAuthType:type_name -> grpcupstream.MapAuthReply.Authtype 2, // 2: grpcupstream.UpstreamRegistry.FindUpstream:input_type -> grpcupstream.FindUpstreamRequest - 4, // 3: grpcupstream.UpstreamRegistry.MapAuth:input_type -> grpcupstream.MapAuthRequest - 3, // 4: grpcupstream.UpstreamRegistry.FindUpstream:output_type -> grpcupstream.FindUpstreamReply - 5, // 5: grpcupstream.UpstreamRegistry.MapAuth:output_type -> grpcupstream.MapAuthReply - 4, // [4:6] is the sub-list for method output_type - 2, // [2:4] is the sub-list for method input_type + 4, // 3: grpcupstream.UpstreamRegistry.VerifyHostKey:input_type -> grpcupstream.VerifyHostKeyRequest + 6, // 4: grpcupstream.UpstreamRegistry.MapAuth:input_type -> grpcupstream.MapAuthRequest + 3, // 5: grpcupstream.UpstreamRegistry.FindUpstream:output_type -> grpcupstream.FindUpstreamReply + 5, // 6: grpcupstream.UpstreamRegistry.VerifyHostKey:output_type -> grpcupstream.VerifyHostKeyReply + 7, // 7: grpcupstream.UpstreamRegistry.MapAuth:output_type -> grpcupstream.MapAuthReply + 5, // [5:8] is the sub-list for method output_type + 2, // [2:5] is the sub-list for method input_type 2, // [2:2] is the sub-list for extension type_name 2, // [2:2] is the sub-list for extension extendee 0, // [0:2] is the sub-list for field type_name @@ -511,7 +640,7 @@ func file_upstream_proto_init() { } } file_upstream_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} { - switch v := v.(*MapAuthRequest); i { + switch v := v.(*VerifyHostKeyRequest); i { case 0: return &v.state case 1: @@ -523,6 +652,30 @@ func file_upstream_proto_init() { } } file_upstream_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} { + switch v := v.(*VerifyHostKeyReply); i { + case 0: + return &v.state + case 1: + return &v.sizeCache + case 2: + return &v.unknownFields + default: + return nil + } + } + file_upstream_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} { + switch v := v.(*MapAuthRequest); i { + case 0: + return &v.state + case 1: + return &v.sizeCache + case 2: + return &v.unknownFields + default: + return nil + } + } + file_upstream_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*MapAuthReply); i { case 0: return &v.state @@ -541,7 +694,7 @@ func file_upstream_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: file_upstream_proto_rawDesc, NumEnums: 2, - NumMessages: 4, + NumMessages: 6, NumExtensions: 0, NumServices: 1, }, diff --git a/sshpiperd/upstream/grpcupstream/upstream.proto b/sshpiperd/upstream/grpcupstream/upstream.proto index 5b6a62fa..b1095f40 100644 --- a/sshpiperd/upstream/grpcupstream/upstream.proto +++ b/sshpiperd/upstream/grpcupstream/upstream.proto @@ -6,6 +6,7 @@ option go_package = "github.com/tg123/sshpiper/sshpiperd/upstream/grpcupstream"; service UpstreamRegistry { rpc FindUpstream (FindUpstreamRequest) returns (FindUpstreamReply) {} + rpc VerifyHostKey (VerifyHostKeyRequest) returns (VerifyHostKeyReply) {} rpc MapAuth(MapAuthRequest) returns (MapAuthReply) {} } @@ -20,6 +21,16 @@ message FindUpstreamReply { string metadata = 3; } +message VerifyHostKeyRequest { + string hostname = 1; + string address = 2; + bytes key = 3; +} + +message VerifyHostKeyReply { + bool verified = 1; +} + message MapAuthRequest { string userName = 1; string fromAddr = 2; diff --git a/sshpiperd/upstream/grpcupstream/upstream_grpc.pb.go b/sshpiperd/upstream/grpcupstream/upstream_grpc.pb.go index 5cf702d2..7c8044a1 100644 --- a/sshpiperd/upstream/grpcupstream/upstream_grpc.pb.go +++ b/sshpiperd/upstream/grpcupstream/upstream_grpc.pb.go @@ -19,6 +19,7 @@ const _ = grpc.SupportPackageIsVersion7 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. type UpstreamRegistryClient interface { FindUpstream(ctx context.Context, in *FindUpstreamRequest, opts ...grpc.CallOption) (*FindUpstreamReply, error) + VerifyHostKey(ctx context.Context, in *VerifyHostKeyRequest, opts ...grpc.CallOption) (*VerifyHostKeyReply, error) MapAuth(ctx context.Context, in *MapAuthRequest, opts ...grpc.CallOption) (*MapAuthReply, error) } @@ -39,6 +40,15 @@ func (c *upstreamRegistryClient) FindUpstream(ctx context.Context, in *FindUpstr return out, nil } +func (c *upstreamRegistryClient) VerifyHostKey(ctx context.Context, in *VerifyHostKeyRequest, opts ...grpc.CallOption) (*VerifyHostKeyReply, error) { + out := new(VerifyHostKeyReply) + err := c.cc.Invoke(ctx, "/grpcupstream.UpstreamRegistry/VerifyHostKey", in, out, opts...) + if err != nil { + return nil, err + } + return out, nil +} + func (c *upstreamRegistryClient) MapAuth(ctx context.Context, in *MapAuthRequest, opts ...grpc.CallOption) (*MapAuthReply, error) { out := new(MapAuthReply) err := c.cc.Invoke(ctx, "/grpcupstream.UpstreamRegistry/MapAuth", in, out, opts...) @@ -53,6 +63,7 @@ func (c *upstreamRegistryClient) MapAuth(ctx context.Context, in *MapAuthRequest // for forward compatibility type UpstreamRegistryServer interface { FindUpstream(context.Context, *FindUpstreamRequest) (*FindUpstreamReply, error) + VerifyHostKey(context.Context, *VerifyHostKeyRequest) (*VerifyHostKeyReply, error) MapAuth(context.Context, *MapAuthRequest) (*MapAuthReply, error) mustEmbedUnimplementedUpstreamRegistryServer() } @@ -64,6 +75,9 @@ type UnimplementedUpstreamRegistryServer struct { func (UnimplementedUpstreamRegistryServer) FindUpstream(context.Context, *FindUpstreamRequest) (*FindUpstreamReply, error) { return nil, status.Errorf(codes.Unimplemented, "method FindUpstream not implemented") } +func (UnimplementedUpstreamRegistryServer) VerifyHostKey(context.Context, *VerifyHostKeyRequest) (*VerifyHostKeyReply, error) { + return nil, status.Errorf(codes.Unimplemented, "method VerifyHostKey not implemented") +} func (UnimplementedUpstreamRegistryServer) MapAuth(context.Context, *MapAuthRequest) (*MapAuthReply, error) { return nil, status.Errorf(codes.Unimplemented, "method MapAuth not implemented") } @@ -98,6 +112,24 @@ func _UpstreamRegistry_FindUpstream_Handler(srv interface{}, ctx context.Context return interceptor(ctx, in, info, handler) } +func _UpstreamRegistry_VerifyHostKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(VerifyHostKeyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(UpstreamRegistryServer).VerifyHostKey(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: "/grpcupstream.UpstreamRegistry/VerifyHostKey", + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(UpstreamRegistryServer).VerifyHostKey(ctx, req.(*VerifyHostKeyRequest)) + } + return interceptor(ctx, in, info, handler) +} + func _UpstreamRegistry_MapAuth_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { in := new(MapAuthRequest) if err := dec(in); err != nil { @@ -127,6 +159,10 @@ var UpstreamRegistry_ServiceDesc = grpc.ServiceDesc{ MethodName: "FindUpstream", Handler: _UpstreamRegistry_FindUpstream_Handler, }, + { + MethodName: "VerifyHostKey", + Handler: _UpstreamRegistry_VerifyHostKey_Handler, + }, { MethodName: "MapAuth", Handler: _UpstreamRegistry_MapAuth_Handler,