diff --git a/components/ws-proxy/cmd/run.go b/components/ws-proxy/cmd/run.go index 5602cc98119249..dd479947ddaaec 100644 --- a/components/ws-proxy/cmd/run.go +++ b/components/ws-proxy/cmd/run.go @@ -13,8 +13,8 @@ import ( "time" "github.com/bombsimon/logrusr/v2" + "github.com/gitpod-io/golang-crypto/ssh" "github.com/spf13/cobra" - "golang.org/x/crypto/ssh" "google.golang.org/grpc" "google.golang.org/grpc/credentials" "google.golang.org/grpc/credentials/insecure" diff --git a/components/ws-proxy/go.mod b/components/ws-proxy/go.mod index 21170b102ddc93..587d77c4ca2e6b 100644 --- a/components/ws-proxy/go.mod +++ b/components/ws-proxy/go.mod @@ -8,6 +8,7 @@ require ( github.com/gitpod-io/gitpod/registry-facade/api v0.0.0-00010101000000-000000000000 github.com/gitpod-io/gitpod/supervisor/api v0.0.0-00010101000000-000000000000 github.com/gitpod-io/gitpod/ws-manager/api v0.0.0-00010101000000-000000000000 + github.com/gitpod-io/golang-crypto v0.0.0-20220616163018-a0e3d8407552 github.com/go-ozzo/ozzo-validation v3.6.0+incompatible github.com/google/go-cmp v0.5.7 github.com/gorilla/handlers v1.5.1 @@ -20,6 +21,7 @@ require ( golang.org/x/net v0.0.0-20211209124913-491a49abca63 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 google.golang.org/grpc v1.45.0 + google.golang.org/protobuf v1.28.0 k8s.io/api v0.23.5 k8s.io/apimachinery v0.23.5 k8s.io/client-go v0.23.5 @@ -72,7 +74,6 @@ require ( gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2 // indirect - google.golang.org/protobuf v1.28.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/segmentio/analytics-go.v3 v3.1.0 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect diff --git a/components/ws-proxy/go.sum b/components/ws-proxy/go.sum index 79f587b3895261..4d2c0ea6b40ce2 100644 --- a/components/ws-proxy/go.sum +++ b/components/ws-proxy/go.sum @@ -145,6 +145,8 @@ github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5 github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg= github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= +github.com/gitpod-io/golang-crypto v0.0.0-20220616163018-a0e3d8407552 h1:11beloYl4JFQZAj6VfJwZcPtrBqulK5Wzrs624m8qHI= +github.com/gitpod-io/golang-crypto v0.0.0-20220616163018-a0e3d8407552/go.mod h1:tJgr4p01k+N5SV9KHeHLPsEYMCEpc0dTSNGPif2ZWac= github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= diff --git a/components/ws-proxy/pkg/proxy/proxy.go b/components/ws-proxy/pkg/proxy/proxy.go index ee792686e160fb..3056c306a0a971 100644 --- a/components/ws-proxy/pkg/proxy/proxy.go +++ b/components/ws-proxy/pkg/proxy/proxy.go @@ -10,9 +10,9 @@ import ( "os" "path/filepath" + "github.com/gitpod-io/golang-crypto/ssh" "github.com/gorilla/mux" "github.com/klauspost/cpuid/v2" - "golang.org/x/crypto/ssh" "github.com/gitpod-io/gitpod/common-go/log" ) diff --git a/components/ws-proxy/pkg/proxy/routes.go b/components/ws-proxy/pkg/proxy/routes.go index d7f085758e0bc7..a19ea48505a1b7 100644 --- a/components/ws-proxy/pkg/proxy/routes.go +++ b/components/ws-proxy/pkg/proxy/routes.go @@ -20,10 +20,10 @@ import ( "strings" "time" + "github.com/gitpod-io/golang-crypto/ssh" "github.com/gorilla/handlers" "github.com/gorilla/mux" "github.com/sirupsen/logrus" - "golang.org/x/crypto/ssh" "golang.org/x/xerrors" "github.com/gitpod-io/gitpod/common-go/log" diff --git a/components/ws-proxy/pkg/proxy/routes_test.go b/components/ws-proxy/pkg/proxy/routes_test.go index 1621af562d57c4..90dfe3acace4e5 100644 --- a/components/ws-proxy/pkg/proxy/routes_test.go +++ b/components/ws-proxy/pkg/proxy/routes_test.go @@ -21,9 +21,9 @@ import ( "testing" "time" + "github.com/gitpod-io/golang-crypto/ssh" "github.com/google/go-cmp/cmp" "github.com/sirupsen/logrus" - "golang.org/x/crypto/ssh" "github.com/gitpod-io/gitpod/common-go/log" "github.com/gitpod-io/gitpod/common-go/util" diff --git a/components/ws-proxy/pkg/sshproxy/forward.go b/components/ws-proxy/pkg/sshproxy/forward.go index 7f301dd6a44018..4ab156763d6592 100644 --- a/components/ws-proxy/pkg/sshproxy/forward.go +++ b/components/ws-proxy/pkg/sshproxy/forward.go @@ -10,7 +10,7 @@ import ( "time" "github.com/gitpod-io/gitpod/common-go/log" - "golang.org/x/crypto/ssh" + "github.com/gitpod-io/golang-crypto/ssh" "golang.org/x/net/context" ) diff --git a/components/ws-proxy/pkg/sshproxy/server.go b/components/ws-proxy/pkg/sshproxy/server.go index 4cf17cf2de5505..c0da02e3b3e14c 100644 --- a/components/ws-proxy/pkg/sshproxy/server.go +++ b/components/ws-proxy/pkg/sshproxy/server.go @@ -17,8 +17,8 @@ import ( supervisor "github.com/gitpod-io/gitpod/supervisor/api" tracker "github.com/gitpod-io/gitpod/ws-proxy/pkg/analytics" p "github.com/gitpod-io/gitpod/ws-proxy/pkg/proxy" + "github.com/gitpod-io/golang-crypto/ssh" "github.com/prometheus/client_golang/prometheus" - "golang.org/x/crypto/ssh" "golang.org/x/xerrors" "google.golang.org/grpc" "google.golang.org/grpc/credentials/insecure" @@ -106,6 +106,27 @@ func New(signers []ssh.Signer, workspaceInfoProvider p.WorkspaceInfoProvider, he server.sshConfig = &ssh.ServerConfig{ ServerVersion: "SSH-2.0-GITPOD-GATEWAY", + NoClientAuth: true, + NoClientAuthCallback: func(conn ssh.ConnMetadata) (*ssh.Permissions, error) { + args := strings.Split(conn.User(), "#") + workspaceId := args[0] + wsInfo, err := server.GetWorkspaceInfo(workspaceId) + if err != nil { + return nil, err + } + defer func() { + server.TrackSSHConnection(wsInfo, "auth", err) + }() + // workspaceId#ownerToken + if len(args) != 2 || wsInfo.Auth.OwnerToken != args[1] { + return nil, ErrAuthFailed + } + return &ssh.Permissions{ + Extensions: map[string]string{ + "workspaceId": workspaceId, + }, + }, nil + }, PasswordCallback: func(conn ssh.ConnMetadata, password []byte) (perm *ssh.Permissions, err error) { workspaceId, ownerToken := conn.User(), string(password) wsInfo, err := server.GetWorkspaceInfo(workspaceId) diff --git a/install/installer/go.mod b/install/installer/go.mod index 4a5b12d11136d3..b9cbf4378eade4 100644 --- a/install/installer/go.mod +++ b/install/installer/go.mod @@ -100,6 +100,7 @@ require ( github.com/fvbommel/sortorder v1.0.1 // indirect github.com/gitpod-io/gitpod/content-service v0.0.0-00010101000000-000000000000 // indirect github.com/gitpod-io/gitpod/registry-facade v0.0.0-00010101000000-000000000000 // indirect + github.com/gitpod-io/golang-crypto v0.0.0-20220616163018-a0e3d8407552 // indirect github.com/go-errors/errors v1.0.1 // indirect github.com/go-logr/logr v1.2.3 // indirect github.com/go-openapi/jsonpointer v0.19.5 // indirect diff --git a/install/installer/go.sum b/install/installer/go.sum index 1db4f3bec7c455..23481c619c436a 100644 --- a/install/installer/go.sum +++ b/install/installer/go.sum @@ -548,6 +548,8 @@ github.com/garyburd/redigo v1.6.0 h1:0VruCpn7yAIIu7pWVClQC8wxCJEcG3nyzpMSHKi1PQc github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg= github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= +github.com/gitpod-io/golang-crypto v0.0.0-20220616163018-a0e3d8407552 h1:11beloYl4JFQZAj6VfJwZcPtrBqulK5Wzrs624m8qHI= +github.com/gitpod-io/golang-crypto v0.0.0-20220616163018-a0e3d8407552/go.mod h1:tJgr4p01k+N5SV9KHeHLPsEYMCEpc0dTSNGPif2ZWac= github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0= github.com/go-check/check v0.0.0-20180628173108-788fd7840127/go.mod h1:9ES+weclKsC9YodN5RgxqK/VD9HM9JsCSh7rNhMZE98= github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=