Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add configuration options for allowed downstream algorithms #504

Merged
merged 3 commits into from
Dec 26, 2024
Merged

Add configuration options for allowed downstream algorithms #504

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e70c281
Add configuration options for allowed downstream algorithms
tg123 Dec 25, 2024
6a0c0be
Refactor daemon configuration to set allowed downstream algorithms
tg123 Dec 26, 2024
5600aa0
Ensure default configuration values are set consistently in newDaemon
tg123 Dec 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions cmd/sshpiperd/daemon.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,17 @@ func generateSshKey(keyfile string) error {

func newDaemon(ctx *cli.Context) (*daemon, error) {
config := &plugin.GrpcPluginConfig{}

config.Ciphers = ctx.StringSlice("allowed-downstream-ciphers-algos")
config.MACs = ctx.StringSlice("allowed-downstream-macs-algos")
config.KeyExchanges = ctx.StringSlice("allowed-downstream-keyexchange-algos")
config.PublicKeyAuthAlgorithms = ctx.StringSlice("allowed-downstream-pubkey-algos")

config.SetDefaults()

// tricky, call SetDefaults, in first call, Cipers, Macs, Kex will be nil if [] and the second call will set the default values
// this can be ignored because sshpiper.go will call SetDefaults again before use it
// however, this is to make sure that the default values are set no matter sshiper.go calls SetDefaults or not
config.SetDefaults()

keybase64 := ctx.String("server-key-data")
Expand Down
24 changes: 24 additions & 0 deletions cmd/sshpiperd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,30 @@ func main() {
Usage: "allowed proxy addresses, only connections from these ip ranges are allowed to send a proxy header based on the PROXY protocol, empty will disable the PROXY protocol support",
EnvVars: []string{"SSHPIPERD_ALLOWED_PROXY_ADDRESSES"},
},
&cli.StringSliceFlag{
Name: "allowed-downstream-keyexchange-algos",
Value: cli.NewStringSlice(),
Usage: "allowed key exchange algorithms for downstream connections, empty will allow default algorithms",
EnvVars: []string{"SSHPIPERD_ALLOWED_DOWNSTREAM_KEYEXCHANGE_ALGOS"},
},
&cli.StringSliceFlag{
Name: "allowed-downstream-ciphers-algos",
Value: cli.NewStringSlice(),
Usage: "allowed ciphers algorithms for downstream connections, empty will allow default algorithms",
EnvVars: []string{"SSHPIPERD_ALLOWED_DOWNSTREAM_CIPHERS_ALGOS"},
},
&cli.StringSliceFlag{
Name: "allowed-downstream-macs-algos",
Value: cli.NewStringSlice(),
Usage: "allowed macs algorithms for downstream connections, empty will allow default algorithms",
EnvVars: []string{"SSHPIPERD_ALLOWED_DOWNSTREAM_MACS_ALGOS"},
},
&cli.StringSliceFlag{
Name: "allowed-downstream-pubkey-algos",
Value: cli.NewStringSlice(),
Usage: "allowed public key algorithms for downstream connections, empty will allow default algorithms",
EnvVars: []string{"SSHPIPERD_ALLOWED_DOWNSTREAM_PUBKEY_ALGOS"},
},
},
Action: func(ctx *cli.Context) error {
level, err := log.ParseLevel(ctx.String("log-level"))
Expand Down
Loading