Archives/smallstep-certificates
2
0
Fork 0
mirror of https://github.com/smallstep/certificates.git synced 2024-10-31 03:20:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use an actual Hosts type when returning ssh hosts

Browse Source
This commit is contained in:
max furman 2019-11-20 17:23:51 -08:00
parent 80ee3645c4
commit 927784237d
5 changed files with 29 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
api/ssh.go
View File

@ -10,6 +10,7 @@ import (
"github.com/pkg/errors"
"github.com/smallstep/certificates/authority"
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/certificates/sshutil"
"github.com/smallstep/certificates/templates"
"golang.org/x/crypto/ssh"
)
@ -24,7 +25,7 @@ type SSHAuthority interface {
GetSSHFederation() (*authority.SSHKeys, error)
GetSSHConfig(typ string, data map[string]string) ([]templates.Output, error)
CheckSSHHost(principal string) (bool, error)
GetSSHHosts(cert *x509.Certificate) ([]string, error)
GetSSHHosts(cert *x509.Certificate) ([]sshutil.Host, error)
GetSSHBastion(user string, hostname string) (*authority.Bastion, error)
}
@ -83,7 +84,7 @@ type SSHCertificate struct {
// SSHGetHostsResponse is the response object that returns the list of valid
// hosts for SSH.
type SSHGetHostsResponse struct {
Hosts []string `json:"hosts"`
Hosts []sshutil.Host `json:"hosts"`
}
// MarshalJSON implements the json.Marshaler interface. Returns a quoted,

3
authority/authority.go
View File

@ -8,6 +8,7 @@ import (
"sync"
"time"
"github.com/smallstep/certificates/sshutil"
"github.com/smallstep/certificates/templates"
"github.com/pkg/errors"
@ -41,7 +42,7 @@ type Authority struct {
initOnce bool
// Custom functions
sshBastionFunc func(user, hostname string) (*Bastion, error)
sshGetHostsFunc func(cert *x509.Certificate) ([]string, error)
sshGetHostsFunc func(cert *x509.Certificate) ([]sshutil.Host, error)
getIdentityFunc provisioner.GetIdentityFunc
}

3
authority/options.go
View File

@ -5,6 +5,7 @@ import (
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/certificates/db"
"github.com/smallstep/certificates/sshutil"
)
// Option sets options to the Authority.
@ -36,7 +37,7 @@ func WithSSHBastionFunc(fn func(user, host string) (*Bastion, error)) Option {
// WithSSHGetHosts sets a custom function to get the bastion for a
// given user-host pair.
func WithSSHGetHosts(fn func(cert *x509.Certificate) ([]string, error)) Option {
func WithSSHGetHosts(fn func(cert *x509.Certificate) ([]sshutil.Host, error)) Option {
return func(a *Authority) {
a.sshGetHostsFunc = fn
}

10
authority/ssh.go
View File

@ -12,6 +12,7 @@ import (
"github.com/pkg/errors"
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/certificates/db"
"github.com/smallstep/certificates/sshutil"
"github.com/smallstep/certificates/templates"
"github.com/smallstep/cli/crypto/randutil"
"github.com/smallstep/cli/jose"
@ -674,17 +675,22 @@ func (a *Authority) CheckSSHHost(principal string) (bool, error) {
}
// GetSSHHosts returns a list of valid host principals.
func (a *Authority) GetSSHHosts(cert *x509.Certificate) ([]string, error) {
func (a *Authority) GetSSHHosts(cert *x509.Certificate) ([]sshutil.Host, error) {
if a.sshGetHostsFunc != nil {
return a.sshGetHostsFunc(cert)
}
hosts, err := a.db.GetSSHHostPrincipals()
hostnames, err := a.db.GetSSHHostPrincipals()
if err != nil {
return nil, &apiError{
err: errors.Wrap(err, "getSSHHosts"),
code: http.StatusInternalServerError,
}
}
hosts := make([]sshutil.Host, len(hostnames))
for i, hn := range hostnames {
hosts[i] = sshutil.Host{Hostname: hn}
}
return hosts, nil
}

14
sshutil/types.go Normal file
View File

@ -0,0 +1,14 @@
package sshutil
// HostGroup defines expected attributes for a host group that a host might belong to.
type HostGroup struct {
ID string
Name string
}
// Host defines expected attributes for an ssh host.
type Host struct {
HostID string `json:"hid"`
HostGroups []HostGroup `json:"host_groups"`
Hostname string `json:"hostname"`
}