Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
(v7) Host certificate checker and postgres connection fixes (#57)
- Loading branch information
Showing
51 changed files
with
1,115 additions
and
268 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| /* | ||
| Copyright 2021 Gravitational, Inc. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package sshutils | ||
|
|
||
| import ( | ||
| "github.com/gravitational/trace" | ||
| "github.com/sirupsen/logrus" | ||
| "golang.org/x/crypto/ssh" | ||
| ) | ||
|
|
||
| // CheckersGetter defines a function that returns a list of ssh public keys. | ||
| type CheckersGetter func() ([]ssh.PublicKey, error) | ||
|
|
||
| // HostKeyCallbackConfig is the host key callback configuration. | ||
| type HostKeyCallbackConfig struct { | ||
| // GetHostCheckers is used to fetch host checking (public) keys. | ||
| GetHostCheckers CheckersGetter | ||
| // HostKeyFallback sets optional callback to check non-certificate keys. | ||
| HostKeyFallback ssh.HostKeyCallback | ||
| // FIPS allows to set FIPS mode which will validate algorithms. | ||
| FIPS bool | ||
| // OnCheckCert is called on SSH certificate validation. | ||
| OnCheckCert func(*ssh.Certificate) | ||
| } | ||
|
|
||
| // Check validates the config. | ||
| func (c *HostKeyCallbackConfig) Check() error { | ||
| if c.GetHostCheckers == nil { | ||
| return trace.BadParameter("missing GetHostCheckers") | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // NewHostKeyCallback returns host key callback function with the specified parameters. | ||
| func NewHostKeyCallback(conf HostKeyCallbackConfig) (ssh.HostKeyCallback, error) { | ||
| if err := conf.Check(); err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
| checker := CertChecker{ | ||
| CertChecker: ssh.CertChecker{ | ||
| IsHostAuthority: makeIsHostAuthorityFunc(conf.GetHostCheckers), | ||
| HostKeyFallback: conf.HostKeyFallback, | ||
| }, | ||
| FIPS: conf.FIPS, | ||
| OnCheckCert: conf.OnCheckCert, | ||
| } | ||
| return checker.CheckHostKey, nil | ||
| } | ||
|
|
||
| func makeIsHostAuthorityFunc(getCheckers CheckersGetter) func(key ssh.PublicKey, host string) bool { | ||
| return func(key ssh.PublicKey, host string) bool { | ||
| checkers, err := getCheckers() | ||
| if err != nil { | ||
| logrus.WithError(err).Errorf("Failed to get checkers for %v.", host) | ||
| return false | ||
| } | ||
| for _, checker := range checkers { | ||
| switch v := key.(type) { | ||
| case *ssh.Certificate: | ||
| if KeysEqual(v.SignatureKey, checker) { | ||
| return true | ||
| } | ||
| default: | ||
| if KeysEqual(key, checker) { | ||
| return true | ||
| } | ||
| } | ||
| } | ||
| logrus.Debugf("No CA for host %v.", host) | ||
| return false | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| /* | ||
| Copyright 2019-2021 Gravitational, Inc. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package sshutils | ||
|
|
||
| import ( | ||
| "crypto/rsa" | ||
| "net" | ||
|
|
||
| "github.com/gravitational/teleport/api/constants" | ||
|
|
||
| "github.com/gravitational/trace" | ||
| "golang.org/x/crypto/ssh" | ||
| ) | ||
|
|
||
| // CertChecker is a drop-in replacement for ssh.CertChecker. In FIPS mode, | ||
| // checks if the certificate (or key) were generated with a supported algorithm. | ||
| type CertChecker struct { | ||
| ssh.CertChecker | ||
|
|
||
| // FIPS means in addition to checking the validity of the key or | ||
| // certificate, also check that FIPS 140-2 algorithms were used. | ||
| FIPS bool | ||
|
|
||
| // OnCheckCert is called when validating host certificate. | ||
| OnCheckCert func(*ssh.Certificate) | ||
| } | ||
|
|
||
| // Authenticate checks the validity of a user certificate. | ||
| func (c *CertChecker) Authenticate(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) { | ||
| err := c.validateFIPS(key) | ||
| if err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
|
|
||
| perms, err := c.CertChecker.Authenticate(conn, key) | ||
| if err != nil { | ||
| return nil, trace.Wrap(err) | ||
| } | ||
|
|
||
| return perms, nil | ||
| } | ||
|
|
||
| // CheckCert checks certificate metadata and signature. | ||
| func (c *CertChecker) CheckCert(principal string, cert *ssh.Certificate) error { | ||
| err := c.validateFIPS(cert) | ||
| if err != nil { | ||
| return trace.Wrap(err) | ||
| } | ||
|
|
||
| err = c.CertChecker.CheckCert(principal, cert) | ||
| if err != nil { | ||
| return trace.Wrap(err) | ||
| } | ||
|
|
||
| if c.OnCheckCert != nil { | ||
| c.OnCheckCert(cert) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // CheckHostKey checks the validity of a host certificate. | ||
| func (c *CertChecker) CheckHostKey(addr string, remote net.Addr, key ssh.PublicKey) error { | ||
| err := c.validateFIPS(key) | ||
| if err != nil { | ||
| return trace.Wrap(err) | ||
| } | ||
|
|
||
| err = c.CertChecker.CheckHostKey(addr, remote, key) | ||
| if err != nil { | ||
| return trace.Wrap(err) | ||
| } | ||
|
|
||
| if cert, ok := key.(*ssh.Certificate); ok && c.OnCheckCert != nil { | ||
| c.OnCheckCert(cert) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (c *CertChecker) validateFIPS(key ssh.PublicKey) error { | ||
| // When not in FIPS mode, accept all algorithms and key sizes. | ||
| if !c.FIPS { | ||
| return nil | ||
| } | ||
|
|
||
| switch cert := key.(type) { | ||
| case *ssh.Certificate: | ||
| err := validateFIPSAlgorithm(cert.Key) | ||
| if err != nil { | ||
| return trace.Wrap(err) | ||
| } | ||
| err = validateFIPSAlgorithm(cert.SignatureKey) | ||
| if err != nil { | ||
| return trace.Wrap(err) | ||
| } | ||
| return nil | ||
| default: | ||
| return validateFIPSAlgorithm(key) | ||
| } | ||
| } | ||
|
|
||
| func validateFIPSAlgorithm(key ssh.PublicKey) error { | ||
| cryptoKey, ok := key.(ssh.CryptoPublicKey) | ||
| if !ok { | ||
| return trace.BadParameter("unable to determine underlying public key") | ||
| } | ||
| k, ok := cryptoKey.CryptoPublicKey().(*rsa.PublicKey) | ||
| if !ok { | ||
| return trace.BadParameter("only RSA keys supported") | ||
| } | ||
| if k.N.BitLen() != constants.RSAKeySize { | ||
| return trace.BadParameter("found %v-bit key, only %v-bit supported", k.N.BitLen(), constants.RSAKeySize) | ||
| } | ||
| return nil | ||
| } |
Oops, something went wrong.