2019-07-24 01:46:43 +00:00
|
|
|
package api
|
|
|
|
|
|
|
|
import (
|
2019-07-29 19:52:13 +00:00
|
|
|
"context"
|
2019-11-20 20:59:48 +00:00
|
|
|
"crypto/x509"
|
2019-07-24 01:46:43 +00:00
|
|
|
"encoding/base64"
|
|
|
|
"encoding/json"
|
|
|
|
"net/http"
|
2019-11-27 01:45:32 +00:00
|
|
|
"time"
|
2019-07-24 01:46:43 +00:00
|
|
|
|
|
|
|
"github.com/pkg/errors"
|
2019-09-25 02:12:13 +00:00
|
|
|
"github.com/smallstep/certificates/authority"
|
2019-07-24 01:46:43 +00:00
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
2019-12-16 07:54:25 +00:00
|
|
|
"github.com/smallstep/certificates/errs"
|
2019-11-21 01:23:51 +00:00
|
|
|
"github.com/smallstep/certificates/sshutil"
|
2019-10-04 02:03:38 +00:00
|
|
|
"github.com/smallstep/certificates/templates"
|
2019-07-24 01:46:43 +00:00
|
|
|
"golang.org/x/crypto/ssh"
|
|
|
|
)
|
|
|
|
|
|
|
|
// SSHAuthority is the interface implemented by a SSH CA authority.
|
|
|
|
type SSHAuthority interface {
|
|
|
|
SignSSH(key ssh.PublicKey, opts provisioner.SSHOptions, signOpts ...provisioner.SignOption) (*ssh.Certificate, error)
|
2019-10-28 18:50:43 +00:00
|
|
|
RenewSSH(cert *ssh.Certificate) (*ssh.Certificate, error)
|
|
|
|
RekeySSH(cert *ssh.Certificate, key ssh.PublicKey, signOpts ...provisioner.SignOption) (*ssh.Certificate, error)
|
2019-08-03 00:48:34 +00:00
|
|
|
SignSSHAddUser(key ssh.PublicKey, cert *ssh.Certificate) (*ssh.Certificate, error)
|
2019-10-09 01:35:28 +00:00
|
|
|
GetSSHRoots() (*authority.SSHKeys, error)
|
|
|
|
GetSSHFederation() (*authority.SSHKeys, error)
|
2019-10-05 00:08:42 +00:00
|
|
|
GetSSHConfig(typ string, data map[string]string) ([]templates.Output, error)
|
2019-12-10 07:14:56 +00:00
|
|
|
CheckSSHHost(ctx context.Context, principal string, token string) (bool, error)
|
2019-11-21 01:23:51 +00:00
|
|
|
GetSSHHosts(cert *x509.Certificate) ([]sshutil.Host, error)
|
2019-11-15 02:24:58 +00:00
|
|
|
GetSSHBastion(user string, hostname string) (*authority.Bastion, error)
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
// SSHSignRequest is the request body of an SSH certificate request.
|
|
|
|
type SSHSignRequest struct {
|
2019-11-20 19:51:25 +00:00
|
|
|
PublicKey []byte `json:"publicKey"` // base64 encoded
|
|
|
|
OTT string `json:"ott"`
|
|
|
|
CertType string `json:"certType,omitempty"`
|
|
|
|
Principals []string `json:"principals,omitempty"`
|
|
|
|
ValidAfter TimeDuration `json:"validAfter,omitempty"`
|
|
|
|
ValidBefore TimeDuration `json:"validBefore,omitempty"`
|
|
|
|
AddUserPublicKey []byte `json:"addUserPublicKey,omitempty"`
|
|
|
|
KeyID string `json:"keyID"`
|
|
|
|
IdentityCSR CertificateRequest `json:"identityCSR,omitempty"`
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
// Validate validates the SSHSignRequest.
|
|
|
|
func (s *SSHSignRequest) Validate() error {
|
2019-09-26 20:22:07 +00:00
|
|
|
switch {
|
|
|
|
case s.CertType != "" && s.CertType != provisioner.SSHUserCert && s.CertType != provisioner.SSHHostCert:
|
|
|
|
return errors.Errorf("unknown certType %s", s.CertType)
|
|
|
|
case len(s.PublicKey) == 0:
|
|
|
|
return errors.New("missing or empty publicKey")
|
|
|
|
case len(s.OTT) == 0:
|
|
|
|
return errors.New("missing or empty ott")
|
|
|
|
default:
|
2019-11-20 19:51:25 +00:00
|
|
|
// Validate identity signature if provided
|
|
|
|
if s.IdentityCSR.CertificateRequest != nil {
|
|
|
|
if err := s.IdentityCSR.CertificateRequest.CheckSignature(); err != nil {
|
2019-11-27 22:48:14 +00:00
|
|
|
return errors.Wrap(err, "invalid identityCSR")
|
2019-11-20 19:51:25 +00:00
|
|
|
}
|
|
|
|
}
|
2019-09-26 20:22:07 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
// SSHSignResponse is the response object that returns the SSH certificate.
|
|
|
|
type SSHSignResponse struct {
|
2019-11-20 19:51:25 +00:00
|
|
|
Certificate SSHCertificate `json:"crt"`
|
|
|
|
AddUserCertificate *SSHCertificate `json:"addUserCrt,omitempty"`
|
|
|
|
IdentityCertificate []Certificate `json:"identityCrt,omitempty"`
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
// SSHRootsResponse represents the response object that returns the SSH user and
|
2019-09-26 20:22:07 +00:00
|
|
|
// host keys.
|
2019-10-09 01:35:28 +00:00
|
|
|
type SSHRootsResponse struct {
|
2019-10-09 01:09:41 +00:00
|
|
|
UserKeys []SSHPublicKey `json:"userKey,omitempty"`
|
|
|
|
HostKeys []SSHPublicKey `json:"hostKey,omitempty"`
|
2019-09-25 02:12:13 +00:00
|
|
|
}
|
|
|
|
|
2019-07-24 01:46:43 +00:00
|
|
|
// SSHCertificate represents the response SSH certificate.
|
|
|
|
type SSHCertificate struct {
|
2019-08-05 23:06:05 +00:00
|
|
|
*ssh.Certificate `json:"omitempty"`
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
|
2019-10-28 18:50:43 +00:00
|
|
|
// SSHGetHostsResponse is the response object that returns the list of valid
|
|
|
|
// hosts for SSH.
|
2019-10-25 20:47:49 +00:00
|
|
|
type SSHGetHostsResponse struct {
|
2019-11-21 01:23:51 +00:00
|
|
|
Hosts []sshutil.Host `json:"hosts"`
|
2019-10-25 20:47:49 +00:00
|
|
|
}
|
|
|
|
|
2019-09-09 04:05:36 +00:00
|
|
|
// MarshalJSON implements the json.Marshaler interface. Returns a quoted,
|
|
|
|
// base64 encoded, openssh wire format version of the certificate.
|
2019-07-24 01:46:43 +00:00
|
|
|
func (c SSHCertificate) MarshalJSON() ([]byte, error) {
|
|
|
|
if c.Certificate == nil {
|
|
|
|
return []byte("null"), nil
|
|
|
|
}
|
|
|
|
s := base64.StdEncoding.EncodeToString(c.Certificate.Marshal())
|
|
|
|
return []byte(`"` + s + `"`), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// UnmarshalJSON implements the json.Unmarshaler interface. The certificate is
|
2019-09-09 04:05:36 +00:00
|
|
|
// expected to be a quoted, base64 encoded, openssh wire formatted block of bytes.
|
2019-07-24 01:46:43 +00:00
|
|
|
func (c *SSHCertificate) UnmarshalJSON(data []byte) error {
|
|
|
|
var s string
|
|
|
|
if err := json.Unmarshal(data, &s); err != nil {
|
|
|
|
return errors.Wrap(err, "error decoding certificate")
|
|
|
|
}
|
2019-08-03 00:48:34 +00:00
|
|
|
if s == "" {
|
|
|
|
c.Certificate = nil
|
|
|
|
return nil
|
|
|
|
}
|
2019-07-24 01:46:43 +00:00
|
|
|
certData, err := base64.StdEncoding.DecodeString(s)
|
|
|
|
if err != nil {
|
2019-09-09 04:05:36 +00:00
|
|
|
return errors.Wrap(err, "error decoding ssh certificate")
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
pub, err := ssh.ParsePublicKey(certData)
|
|
|
|
if err != nil {
|
2019-09-09 04:05:36 +00:00
|
|
|
return errors.Wrap(err, "error parsing ssh certificate")
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
cert, ok := pub.(*ssh.Certificate)
|
|
|
|
if !ok {
|
2019-09-09 04:05:36 +00:00
|
|
|
return errors.Errorf("error decoding ssh certificate: %T is not an *ssh.Certificate", pub)
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
c.Certificate = cert
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-09-26 20:22:07 +00:00
|
|
|
// SSHPublicKey represents a public key in a response object.
|
|
|
|
type SSHPublicKey struct {
|
|
|
|
ssh.PublicKey
|
|
|
|
}
|
|
|
|
|
|
|
|
// MarshalJSON implements the json.Marshaler interface. Returns a quoted,
|
|
|
|
// base64 encoded, openssh wire format version of the public key.
|
|
|
|
func (p *SSHPublicKey) MarshalJSON() ([]byte, error) {
|
|
|
|
if p == nil || p.PublicKey == nil {
|
|
|
|
return []byte("null"), nil
|
|
|
|
}
|
|
|
|
s := base64.StdEncoding.EncodeToString(p.PublicKey.Marshal())
|
|
|
|
return []byte(`"` + s + `"`), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// UnmarshalJSON implements the json.Unmarshaler interface. The public key is
|
|
|
|
// expected to be a quoted, base64 encoded, openssh wire formatted block of
|
|
|
|
// bytes.
|
|
|
|
func (p *SSHPublicKey) UnmarshalJSON(data []byte) error {
|
|
|
|
var s string
|
|
|
|
if err := json.Unmarshal(data, &s); err != nil {
|
|
|
|
return errors.Wrap(err, "error decoding ssh public key")
|
|
|
|
}
|
|
|
|
if s == "" {
|
|
|
|
p.PublicKey = nil
|
2019-07-24 01:46:43 +00:00
|
|
|
return nil
|
|
|
|
}
|
2019-09-26 20:22:07 +00:00
|
|
|
data, err := base64.StdEncoding.DecodeString(s)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "error decoding ssh public key")
|
|
|
|
}
|
|
|
|
pub, err := ssh.ParsePublicKey(data)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "error parsing ssh public key")
|
|
|
|
}
|
|
|
|
p.PublicKey = pub
|
|
|
|
return nil
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
|
|
|
|
2019-10-04 02:03:38 +00:00
|
|
|
// Template represents the output of a template.
|
|
|
|
type Template = templates.Output
|
|
|
|
|
|
|
|
// SSHConfigRequest is the request body used to get the SSH configuration
|
|
|
|
// templates.
|
|
|
|
type SSHConfigRequest struct {
|
2019-10-05 00:08:42 +00:00
|
|
|
Type string `json:"type"`
|
|
|
|
Data map[string]string `json:"data"`
|
2019-10-04 02:03:38 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Validate checks the values of the SSHConfigurationRequest.
|
|
|
|
func (r *SSHConfigRequest) Validate() error {
|
|
|
|
switch r.Type {
|
|
|
|
case "":
|
|
|
|
r.Type = provisioner.SSHUserCert
|
|
|
|
return nil
|
|
|
|
case provisioner.SSHUserCert, provisioner.SSHHostCert:
|
|
|
|
return nil
|
|
|
|
default:
|
|
|
|
return errors.Errorf("unsupported type %s", r.Type)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// SSHConfigResponse is the response that returns the rendered templates.
|
|
|
|
type SSHConfigResponse struct {
|
|
|
|
UserTemplates []Template `json:"userTemplates,omitempty"`
|
|
|
|
HostTemplates []Template `json:"hostTemplates,omitempty"`
|
|
|
|
}
|
|
|
|
|
2019-10-10 20:08:57 +00:00
|
|
|
// SSHCheckPrincipalRequest is the request body used to check if a principal
|
|
|
|
// certificate has been created. Right now it only supported for hosts
|
|
|
|
// certificates.
|
|
|
|
type SSHCheckPrincipalRequest struct {
|
|
|
|
Type string `json:"type"`
|
|
|
|
Principal string `json:"principal"`
|
2019-12-10 07:14:56 +00:00
|
|
|
Token string `json:"token,omitempty"`
|
2019-10-10 20:08:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Validate checks the check principal request.
|
|
|
|
func (r *SSHCheckPrincipalRequest) Validate() error {
|
|
|
|
switch {
|
|
|
|
case r.Type != provisioner.SSHHostCert:
|
|
|
|
return errors.Errorf("unsupported type %s", r.Type)
|
|
|
|
case r.Principal == "":
|
|
|
|
return errors.New("missing or empty principal")
|
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// SSHCheckPrincipalResponse is the response body used to check if a principal
|
|
|
|
// exists.
|
|
|
|
type SSHCheckPrincipalResponse struct {
|
|
|
|
Exists bool `json:"exists"`
|
|
|
|
}
|
|
|
|
|
2019-11-15 02:24:58 +00:00
|
|
|
// SSHBastionRequest is the request body used to get the bastion for a given
|
|
|
|
// host.
|
|
|
|
type SSHBastionRequest struct {
|
|
|
|
User string `json:"user"`
|
|
|
|
Hostname string `json:"hostname"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate checks the values of the SSHBastionRequest.
|
|
|
|
func (r *SSHBastionRequest) Validate() error {
|
|
|
|
if r.Hostname == "" {
|
|
|
|
return errors.New("missing or empty hostname")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// SSHBastionResponse is the response body used to return the bastion for a
|
|
|
|
// given host.
|
|
|
|
type SSHBastionResponse struct {
|
|
|
|
Hostname string `json:"hostname"`
|
|
|
|
Bastion *authority.Bastion `json:"bastion,omitempty"`
|
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
// SSHSign is an HTTP handler that reads an SignSSHRequest with a one-time-token
|
2019-07-24 01:46:43 +00:00
|
|
|
// (ott) from the body and creates a new SSH certificate with the information in
|
|
|
|
// the request.
|
2019-10-09 01:35:28 +00:00
|
|
|
func (h *caHandler) SSHSign(w http.ResponseWriter, r *http.Request) {
|
|
|
|
var body SSHSignRequest
|
2019-07-24 01:46:43 +00:00
|
|
|
if err := ReadJSON(r.Body, &body); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(errors.Wrap(err, "error reading request body")))
|
2019-07-24 01:46:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
logOtt(w, body.OTT)
|
|
|
|
if err := body.Validate(); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(err))
|
2019-07-24 01:46:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-07-26 01:42:32 +00:00
|
|
|
publicKey, err := ssh.ParsePublicKey(body.PublicKey)
|
2019-07-24 01:46:43 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(errors.Wrap(err, "error parsing publicKey")))
|
2019-07-24 01:46:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-08-03 00:48:34 +00:00
|
|
|
var addUserPublicKey ssh.PublicKey
|
|
|
|
if body.AddUserPublicKey != nil {
|
|
|
|
addUserPublicKey, err = ssh.ParsePublicKey(body.AddUserPublicKey)
|
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(errors.Wrap(err, "error parsing addUserPublicKey")))
|
2019-08-03 00:48:34 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-07-24 01:46:43 +00:00
|
|
|
opts := provisioner.SSHOptions{
|
|
|
|
CertType: body.CertType,
|
2019-11-06 23:53:16 +00:00
|
|
|
KeyID: body.KeyID,
|
2019-07-24 01:46:43 +00:00
|
|
|
Principals: body.Principals,
|
|
|
|
ValidBefore: body.ValidBefore,
|
|
|
|
ValidAfter: body.ValidAfter,
|
|
|
|
}
|
|
|
|
|
2019-12-20 21:30:05 +00:00
|
|
|
ctx := provisioner.NewContextWithMethod(context.Background(), provisioner.SSHSignMethod)
|
2019-07-29 19:52:13 +00:00
|
|
|
signOpts, err := h.Authority.Authorize(ctx, body.OTT)
|
2019-07-24 01:46:43 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.Unauthorized(err))
|
2019-07-24 01:46:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
cert, err := h.Authority.SignSSH(publicKey, opts, signOpts...)
|
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.Forbidden(err))
|
2019-07-24 01:46:43 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-08-05 23:06:05 +00:00
|
|
|
var addUserCertificate *SSHCertificate
|
2019-08-03 00:48:34 +00:00
|
|
|
if addUserPublicKey != nil && cert.CertType == ssh.UserCert && len(cert.ValidPrincipals) == 1 {
|
2019-08-05 23:06:05 +00:00
|
|
|
addUserCert, err := h.Authority.SignSSHAddUser(addUserPublicKey, cert)
|
2019-08-03 00:48:34 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.Forbidden(err))
|
2019-08-03 00:48:34 +00:00
|
|
|
return
|
|
|
|
}
|
2019-08-05 23:06:05 +00:00
|
|
|
addUserCertificate = &SSHCertificate{addUserCert}
|
2019-08-03 00:48:34 +00:00
|
|
|
}
|
|
|
|
|
2019-11-20 19:51:25 +00:00
|
|
|
// Sign identity certificate if available.
|
|
|
|
var identityCertificate []Certificate
|
|
|
|
if cr := body.IdentityCSR.CertificateRequest; cr != nil {
|
2019-11-27 03:09:01 +00:00
|
|
|
var opts provisioner.Options
|
|
|
|
// Use same duration as ssh certificate for user certificates
|
2019-11-27 22:48:14 +00:00
|
|
|
if cert.CertType == ssh.UserCert {
|
2019-11-27 03:09:01 +00:00
|
|
|
opts = provisioner.Options{
|
|
|
|
NotBefore: provisioner.NewTimeDuration(time.Unix(int64(cert.ValidAfter), 0)),
|
|
|
|
NotAfter: provisioner.NewTimeDuration(time.Unix(int64(cert.ValidBefore), 0)),
|
|
|
|
}
|
2019-11-20 19:51:25 +00:00
|
|
|
}
|
|
|
|
ctx := authority.NewContextWithSkipTokenReuse(context.Background())
|
|
|
|
ctx = provisioner.NewContextWithMethod(ctx, provisioner.SignMethod)
|
|
|
|
signOpts, err := h.Authority.Authorize(ctx, body.OTT)
|
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.Unauthorized(err))
|
2019-11-20 19:51:25 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
certChain, err := h.Authority.Sign(cr, opts, signOpts...)
|
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.Forbidden(err))
|
2019-11-20 19:51:25 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
identityCertificate = certChainToPEM(certChain)
|
|
|
|
}
|
|
|
|
|
|
|
|
JSONStatus(w, &SSHSignResponse{
|
|
|
|
Certificate: SSHCertificate{cert},
|
|
|
|
AddUserCertificate: addUserCertificate,
|
|
|
|
IdentityCertificate: identityCertificate,
|
|
|
|
}, http.StatusCreated)
|
2019-07-24 01:46:43 +00:00
|
|
|
}
|
2019-09-25 02:12:13 +00:00
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
// SSHRoots is an HTTP handler that returns the SSH public keys for user and host
|
2019-09-26 20:22:07 +00:00
|
|
|
// certificates.
|
2019-10-09 01:35:28 +00:00
|
|
|
func (h *caHandler) SSHRoots(w http.ResponseWriter, r *http.Request) {
|
|
|
|
keys, err := h.Authority.GetSSHRoots()
|
2019-10-09 01:09:41 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.InternalServerError(err))
|
2019-10-09 01:09:41 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(keys.HostKeys) == 0 && len(keys.UserKeys) == 0 {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.NotFound(errors.New("no keys found")))
|
2019-10-09 01:09:41 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
resp := new(SSHRootsResponse)
|
2019-10-09 01:09:41 +00:00
|
|
|
for _, k := range keys.HostKeys {
|
|
|
|
resp.HostKeys = append(resp.HostKeys, SSHPublicKey{PublicKey: k})
|
|
|
|
}
|
|
|
|
for _, k := range keys.UserKeys {
|
|
|
|
resp.UserKeys = append(resp.UserKeys, SSHPublicKey{PublicKey: k})
|
|
|
|
}
|
|
|
|
|
|
|
|
JSON(w, resp)
|
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
// SSHFederation is an HTTP handler that returns the federated SSH public keys
|
|
|
|
// for user and host certificates.
|
|
|
|
func (h *caHandler) SSHFederation(w http.ResponseWriter, r *http.Request) {
|
|
|
|
keys, err := h.Authority.GetSSHFederation()
|
2019-09-25 02:12:13 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.InternalServerError(err))
|
2019-09-25 02:12:13 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-10-09 01:09:41 +00:00
|
|
|
if len(keys.HostKeys) == 0 && len(keys.UserKeys) == 0 {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.NotFound(errors.New("no keys found")))
|
2019-10-09 01:09:41 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-10-09 01:35:28 +00:00
|
|
|
resp := new(SSHRootsResponse)
|
2019-10-09 01:09:41 +00:00
|
|
|
for _, k := range keys.HostKeys {
|
|
|
|
resp.HostKeys = append(resp.HostKeys, SSHPublicKey{PublicKey: k})
|
2019-09-25 02:12:13 +00:00
|
|
|
}
|
2019-10-09 01:09:41 +00:00
|
|
|
for _, k := range keys.UserKeys {
|
|
|
|
resp.UserKeys = append(resp.UserKeys, SSHPublicKey{PublicKey: k})
|
2019-09-25 02:12:13 +00:00
|
|
|
}
|
|
|
|
|
2019-10-09 01:09:41 +00:00
|
|
|
JSON(w, resp)
|
2019-09-25 02:12:13 +00:00
|
|
|
}
|
2019-10-04 02:03:38 +00:00
|
|
|
|
|
|
|
// SSHConfig is an HTTP handler that returns rendered templates for ssh clients
|
|
|
|
// and servers.
|
|
|
|
func (h *caHandler) SSHConfig(w http.ResponseWriter, r *http.Request) {
|
|
|
|
var body SSHConfigRequest
|
|
|
|
if err := ReadJSON(r.Body, &body); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(errors.Wrap(err, "error reading request body")))
|
2019-10-04 02:03:38 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
if err := body.Validate(); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(err))
|
2019-10-04 02:03:38 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-10-05 00:08:42 +00:00
|
|
|
ts, err := h.Authority.GetSSHConfig(body.Type, body.Data)
|
2019-10-04 02:03:38 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.InternalServerError(err))
|
2019-10-04 02:03:38 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
var config SSHConfigResponse
|
|
|
|
switch body.Type {
|
|
|
|
case provisioner.SSHUserCert:
|
|
|
|
config.UserTemplates = ts
|
|
|
|
case provisioner.SSHHostCert:
|
2019-10-12 02:26:09 +00:00
|
|
|
config.HostTemplates = ts
|
2019-10-04 02:03:38 +00:00
|
|
|
default:
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.InternalServerError(errors.New("it should hot get here")))
|
2019-10-04 02:03:38 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
JSON(w, config)
|
|
|
|
}
|
2019-10-10 20:08:57 +00:00
|
|
|
|
|
|
|
// SSHCheckHost is the HTTP handler that returns if a hosts certificate exists or not.
|
|
|
|
func (h *caHandler) SSHCheckHost(w http.ResponseWriter, r *http.Request) {
|
|
|
|
var body SSHCheckPrincipalRequest
|
|
|
|
if err := ReadJSON(r.Body, &body); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.Wrap(http.StatusBadRequest, err, "error reading request body"))
|
2019-10-10 20:08:57 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
if err := body.Validate(); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(err))
|
2019-10-10 20:08:57 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-12-10 07:14:56 +00:00
|
|
|
exists, err := h.Authority.CheckSSHHost(r.Context(), body.Principal, body.Token)
|
2019-10-10 20:08:57 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.InternalServerError(err))
|
2019-10-10 20:08:57 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
JSON(w, &SSHCheckPrincipalResponse{
|
|
|
|
Exists: exists,
|
|
|
|
})
|
|
|
|
}
|
2019-10-25 20:47:49 +00:00
|
|
|
|
|
|
|
// SSHGetHosts is the HTTP handler that returns a list of valid ssh hosts.
|
|
|
|
func (h *caHandler) SSHGetHosts(w http.ResponseWriter, r *http.Request) {
|
2019-11-20 20:59:48 +00:00
|
|
|
var cert *x509.Certificate
|
|
|
|
if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
|
|
|
|
cert = r.TLS.PeerCertificates[0]
|
2019-11-20 19:32:27 +00:00
|
|
|
}
|
|
|
|
|
2019-11-20 20:59:48 +00:00
|
|
|
hosts, err := h.Authority.GetSSHHosts(cert)
|
2019-10-25 20:47:49 +00:00
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.InternalServerError(err))
|
2019-10-25 20:47:49 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
JSON(w, &SSHGetHostsResponse{
|
|
|
|
Hosts: hosts,
|
|
|
|
})
|
|
|
|
}
|
2019-11-15 02:24:58 +00:00
|
|
|
|
|
|
|
// SSHBastion provides returns the bastion configured if any.
|
|
|
|
func (h *caHandler) SSHBastion(w http.ResponseWriter, r *http.Request) {
|
|
|
|
var body SSHBastionRequest
|
|
|
|
if err := ReadJSON(r.Body, &body); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(errors.Wrap(err, "error reading request body")))
|
2019-11-15 02:24:58 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
if err := body.Validate(); err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.BadRequest(err))
|
2019-11-15 02:24:58 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
bastion, err := h.Authority.GetSSHBastion(body.User, body.Hostname)
|
|
|
|
if err != nil {
|
2019-12-16 07:54:25 +00:00
|
|
|
WriteError(w, errs.InternalServerError(err))
|
2019-11-15 02:24:58 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
JSON(w, &SSHBastionResponse{
|
|
|
|
Hostname: body.Hostname,
|
|
|
|
Bastion: bastion,
|
|
|
|
})
|
|
|
|
}
|