89ab72bee0
* all: run gofumpt https://github.com/mvdan/gofumpt The main appeal for me here is that my (and many other peoples') editors run this on save, so doing a single diff here keeps other diffs minimal. * .github/workflows: add gofumpt checker
103 lines
2.3 KiB
Go
103 lines
2.3 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/tg123/sshpiper/cmd/sshpiperd/internal/plugin"
|
|
"github.com/urfave/cli/v2"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/credentials"
|
|
"google.golang.org/grpc/credentials/insecure"
|
|
)
|
|
|
|
func createNetGrpcPlugin(args []string) (grpcPlugin *plugin.GrpcPlugin, err error) {
|
|
app := &cli.App{
|
|
Name: "grpc",
|
|
Usage: "sshpiperd grpc plugin",
|
|
HideHelpCommand: true,
|
|
HideHelp: true,
|
|
Flags: []cli.Flag{
|
|
&cli.StringFlag{
|
|
Name: "endpoint",
|
|
Usage: "grpc endpoint address",
|
|
EnvVars: []string{"SSHPIPERD_GRPC_ENDPOINT"},
|
|
Required: true,
|
|
},
|
|
&cli.BoolFlag{
|
|
Name: "insecure",
|
|
Usage: "disable tls",
|
|
EnvVars: []string{"SSHPIPERD_GRPC_INSECURE"},
|
|
},
|
|
&cli.StringFlag{
|
|
Name: "key",
|
|
Usage: "grpc client key path",
|
|
EnvVars: []string{"SSHPIPERD_GRPC_KEY"},
|
|
},
|
|
&cli.StringFlag{
|
|
Name: "cert",
|
|
Usage: "grpc client cert path",
|
|
EnvVars: []string{"SSHPIPERD_GRPC_CERT"},
|
|
},
|
|
&cli.StringFlag{
|
|
Name: "cacert",
|
|
Usage: "grpc ca cert path",
|
|
EnvVars: []string{"SSHPIPERD_GRPC_CACERT"},
|
|
},
|
|
},
|
|
Action: func(c *cli.Context) error {
|
|
var secopt grpc.DialOption
|
|
if c.Bool("insecure") {
|
|
secopt = grpc.WithTransportCredentials(insecure.NewCredentials())
|
|
} else {
|
|
|
|
clientCert, err := tls.LoadX509KeyPair(c.String("cert"), c.String("key"))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
config := &tls.Config{
|
|
Certificates: []tls.Certificate{clientCert},
|
|
}
|
|
|
|
cacert := c.String("cacert")
|
|
if cacert != "" {
|
|
ca, err := os.ReadFile(cacert)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
certPool := x509.NewCertPool()
|
|
if !certPool.AppendCertsFromPEM(ca) {
|
|
return fmt.Errorf("failed to append ca")
|
|
}
|
|
|
|
config.RootCAs = certPool
|
|
}
|
|
|
|
secopt = grpc.WithTransportCredentials(credentials.NewTLS(config))
|
|
}
|
|
|
|
conn, err := grpc.NewClient(c.String("endpoint"), secopt)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
grpcPlugin, err = plugin.DialGrpc(conn)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
grpcPlugin.Name = fmt.Sprintf("grpc://%s", c.String("endpoint"))
|
|
|
|
return nil
|
|
},
|
|
}
|
|
|
|
if err := app.Run(args); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return grpcPlugin, nil
|
|
}
|