github.com/gravitational/teleport/api@v0.0.0-20240507183017-3110591cbafc/utils/sshutils/callback.go (about)

     1  /*
     2  Copyright 2021 Gravitational, Inc.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package sshutils
    18  
    19  import (
    20  	"context"
    21  	"log/slog"
    22  
    23  	"github.com/gravitational/trace"
    24  	"github.com/jonboulle/clockwork"
    25  	"golang.org/x/crypto/ssh"
    26  )
    27  
    28  // CheckersGetter defines a function that returns a list of ssh public keys.
    29  type CheckersGetter func() ([]ssh.PublicKey, error)
    30  
    31  // HostKeyCallbackConfig is the host key callback configuration.
    32  type HostKeyCallbackConfig struct {
    33  	// GetHostCheckers is used to fetch host checking (public) keys.
    34  	GetHostCheckers CheckersGetter
    35  	// HostKeyFallback sets optional callback to check non-certificate keys.
    36  	HostKeyFallback ssh.HostKeyCallback
    37  	// FIPS allows to set FIPS mode which will validate algorithms.
    38  	FIPS bool
    39  	// OnCheckCert is called on SSH certificate validation.
    40  	OnCheckCert func(*ssh.Certificate) error
    41  	// Clock is used to set the Checker Time
    42  	Clock clockwork.Clock
    43  }
    44  
    45  // Check validates the config.
    46  func (c *HostKeyCallbackConfig) Check() error {
    47  	if c.GetHostCheckers == nil {
    48  		return trace.BadParameter("missing GetHostCheckers")
    49  	}
    50  	if c.Clock == nil {
    51  		c.Clock = clockwork.NewRealClock()
    52  	}
    53  	return nil
    54  }
    55  
    56  // NewHostKeyCallback returns host key callback function with the specified parameters.
    57  func NewHostKeyCallback(conf HostKeyCallbackConfig) (ssh.HostKeyCallback, error) {
    58  	if err := conf.Check(); err != nil {
    59  		return nil, trace.Wrap(err)
    60  	}
    61  	checker := CertChecker{
    62  		CertChecker: ssh.CertChecker{
    63  			IsHostAuthority: makeIsHostAuthorityFunc(conf.GetHostCheckers),
    64  			HostKeyFallback: conf.HostKeyFallback,
    65  			Clock:           conf.Clock.Now,
    66  		},
    67  		FIPS:        conf.FIPS,
    68  		OnCheckCert: conf.OnCheckCert,
    69  	}
    70  	return checker.CheckHostKey, nil
    71  }
    72  
    73  func makeIsHostAuthorityFunc(getCheckers CheckersGetter) func(key ssh.PublicKey, host string) bool {
    74  	return func(key ssh.PublicKey, host string) bool {
    75  		checkers, err := getCheckers()
    76  		if err != nil {
    77  			slog.ErrorContext(context.Background(), "Failed to get checkers.", "host", host, "error", err)
    78  			return false
    79  		}
    80  		for _, checker := range checkers {
    81  			switch v := key.(type) {
    82  			case *ssh.Certificate:
    83  				if KeysEqual(v.SignatureKey, checker) {
    84  					return true
    85  				}
    86  			default:
    87  				if KeysEqual(key, checker) {
    88  					return true
    89  				}
    90  			}
    91  		}
    92  		slog.DebugContext(context.Background(), "No CA found for target host.", "host", host)
    93  		return false
    94  	}
    95  }