Skip to content

Commit e380381

Browse files
cyrilstcyrilst
committed
add options to forget command
1 parent 67e7ffe commit e380381

File tree

6 files changed

+278
-87
lines changed

6 files changed

+278
-87
lines changed

Diff for: ‎README.asciidoc

+70
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,76 @@ Modify the SSH daemon configuration +/etc/ssh/sshd_config+ by adding:
8383
8484
ForceCommand /usr/sbin/sshproxy
8585
86+
Migrating to sshproxy 2
87+
-----------------------
88+
89+
Version 2 brings a lot of changes to sshproxy:
90+
91+
1. configuration file:
92+
- **all** configuration options can now be set outside of overrides (those are
93+
the default values) or inside an override
94+
- `users`, `groups` and `routes` options have been replaced by the overrides
95+
system:
96+
* old style:
97+
98+
routes:
99+
default:
100+
some_default_options…
101+
service1:
102+
source: [an.ip.sshd.listens.to]
103+
some_sources_options…
104+
users:
105+
- alice,bob:
106+
some_users_options…
107+
groups:
108+
- foo,bar:
109+
some_groups_options…
110+
111+
* new style:
112+
113+
some_default_options…
114+
overrides:
115+
- match:
116+
- sources: [an.ip.sshd.listens.to]
117+
some_sources_options…
118+
- match:
119+
- users: [alice,bob]
120+
some_users_options…
121+
overrides:
122+
- match:
123+
- groups: [foo,bar]
124+
some_groups_options…
125+
126+
- the `match` conditions of the overrides system can be combined. Here is an
127+
example meaning "match if (the user is in the group foo **and** in the
128+
group bar) **or** ((the user is alice **or** bob) **and** the user is
129+
connected to an.ip.sshd.listens.to)":
130+
131+
overrides:
132+
- match:
133+
- groups: [foo]
134+
groups: [bar]
135+
- users: [alice,bob]
136+
sources: [an.ip.sshd.listens.to]
137+
138+
- nodesets can now be used for the `dest` key
139+
- if `libnodeset.so` is found, it allows the use of clustershell groups where
140+
nodesets are allowed
141+
2. command line interface:
142+
- in all the tables, `Host` and `Port` columns are now merged into a single
143+
`Host:Port`
144+
- `sshproxyctl get_config` has been moved to `sshproxyctl show config`
145+
- `sshproxyctl show hosts` and `sshproxyctl show users -all` now display
146+
persist info
147+
- `sshproxyctl enable HOST [PORT]` has been moved to `sshproxyctl enable
148+
-all|-host HOST [-port PORT]`
149+
- `sshproxyctl disable HOST [PORT]` has been moved to `sshproxyctl disable
150+
-all|-host HOST [-port PORT]`
151+
- `sshproxyctl forget HOST [PORT]` has been moved to `sshproxyctl forget host
152+
-all|-host HOST [-port PORT]`
153+
- `sshproxyctl error_banner` (without any parameter) has been moved to
154+
`sshproxyctl forget error_banner`
155+
86156
Copying
87157
-------
88158

Diff for: ‎cmd/sshproxyctl/sshproxyctl.go

+136-60
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ var (
3535
// SshproxyVersion is set by Makefile
3636
SshproxyVersion = "0.0.0+noproperlybuilt"
3737
defaultConfig = "/etc/sshproxy/sshproxy.yaml"
38-
defaultHostPort = "22"
3938
)
4039

4140
func mustInitEtcdClient(configFile string) *utils.Client {
@@ -536,6 +535,13 @@ func setErrorBanner(errorBanner string, expire time.Time, configFile string) err
536535
return cli.SetErrorBanner(errorBanner, expire)
537536
}
538537

538+
func delErrorBanner(configFile string) error {
539+
cli := mustInitEtcdClient(configFile)
540+
defer cli.Close()
541+
542+
return cli.DelErrorBanner()
543+
}
544+
539545
func showErrorBanner(configFile string) {
540546
cli := mustInitEtcdClient(configFile)
541547
defer cli.Close()
@@ -654,39 +660,53 @@ The options are:
654660
return fs
655661
}
656662

657-
func newEnableParser() *flag.FlagSet {
663+
func newEnableParser(allFlag *bool, hostString *string, portString *string) *flag.FlagSet {
658664
fs := flag.NewFlagSet("enable", flag.ExitOnError)
665+
fs.BoolVar(allFlag, "all", false, "enable all hosts present in config")
666+
fs.StringVar(hostString, "host", "", "hostname to enable (can be a nodeset)")
667+
fs.StringVar(portString, "port", "", "port to enable (can be a nodeset)")
659668
fs.Usage = func() {
660-
fmt.Fprintf(flag.CommandLine.Output(), `Usage: %s enable HOST [PORT]
669+
fmt.Fprintf(flag.CommandLine.Output(), `Usage: %s enable -all|-host HOST [-port PORT]
661670
662-
Enable a previously disabled host in etcd. The default port is %s. Host and port
663-
can be nodesets.
664-
`, os.Args[0], defaultHostPort)
671+
Enable a previously disabled host in etcd.
672+
`, os.Args[0])
673+
fs.PrintDefaults()
665674
os.Exit(2)
666675
}
667676
return fs
668677
}
669678

670-
func newForgetParser() *flag.FlagSet {
679+
func newForgetParser(allFlag *bool, hostString *string, portString *string) *flag.FlagSet {
671680
fs := flag.NewFlagSet("forget", flag.ExitOnError)
681+
fs.BoolVar(allFlag, "all", false, "forget all hosts present in config")
682+
fs.StringVar(hostString, "host", "", "hostname to forget (can be a nodeset)")
683+
fs.StringVar(portString, "port", "", "port to forget (can be a nodeset)")
672684
fs.Usage = func() {
673-
fmt.Fprintf(flag.CommandLine.Output(), `Usage: %s forget HOST [PORT]
685+
fmt.Fprintf(flag.CommandLine.Output(), `Usage: %s forget COMMAND [OPTIONS]
674686
675-
Forget a host in etcd. The default port is %s. Remember that if this host is
676-
used, it will appear back in the list. Host and port can be nodesets.
677-
`, os.Args[0], defaultHostPort)
687+
The cammands are:
688+
host -all|-host HOST [-port PORT] forget a host in etcd
689+
error_banner forget the error_banner in etcd
690+
691+
The options are:
692+
`, os.Args[0])
693+
fs.PrintDefaults()
678694
os.Exit(2)
679695
}
680696
return fs
681697
}
682698

683-
func newDisableParser() *flag.FlagSet {
699+
func newDisableParser(allFlag *bool, hostString *string, portString *string) *flag.FlagSet {
684700
fs := flag.NewFlagSet("disable", flag.ExitOnError)
701+
fs.BoolVar(allFlag, "all", false, "disable all hosts present in config")
702+
fs.StringVar(hostString, "host", "", "hostname to disable (can be a nodeset)")
703+
fs.StringVar(portString, "port", "", "port to disable (can be a nodeset)")
685704
fs.Usage = func() {
686-
fmt.Fprintf(flag.CommandLine.Output(), `Usage: %s disable HOST [PORT]
705+
fmt.Fprintf(flag.CommandLine.Output(), `Usage: %s disable -all|-host HOST [-port PORT]
687706
688-
Disable a host in etcd. The default port is %s. Host and port can be nodesets.
689-
`, os.Args[0], defaultHostPort)
707+
Disable a host in etcd.
708+
`, os.Args[0])
709+
fs.PrintDefaults()
690710
os.Exit(2)
691711
}
692712
return fs
@@ -708,53 +728,73 @@ The options are:
708728
return fs
709729
}
710730

711-
func getHostPortFromCommandLine(args []string) ([]string, []string, error) {
731+
func getHostPortFromCommandLine(allFlag bool, hostsNodeset string, portsNodeset string, configFile string) ([]string, error) {
712732
_, nodesetDlclose, nodesetExpand := nodesets.InitExpander()
713733
defer nodesetDlclose()
714-
hostsNodeset, portsNodeset := "", defaultHostPort
715-
switch len(args) {
716-
case 2:
717-
hostsNodeset, portsNodeset = args[0], args[1]
718-
case 1:
719-
hostsNodeset = args[0]
720-
default:
721-
return []string{}, []string{}, fmt.Errorf("wrong number of arguments")
722-
}
723734

724-
hosts, err := nodesetExpand(hostsNodeset)
735+
configDests, err := utils.LoadAllDestsFromConfig(configFile)
725736
if err != nil {
726-
return []string{}, []string{}, fmt.Errorf("%s", err)
737+
return []string{}, fmt.Errorf("%s", err)
727738
}
728-
ports, err := nodesetExpand(portsNodeset)
729-
if err != nil {
730-
return []string{}, []string{}, fmt.Errorf("%s", err)
739+
740+
if allFlag && portsNodeset == "" {
741+
return configDests, nil
742+
}
743+
744+
var hosts []string
745+
if allFlag {
746+
for _, configDest := range configDests {
747+
host, _, err := utils.SplitHostPort(configDest)
748+
if err != nil {
749+
return []string{}, fmt.Errorf("%s", err)
750+
}
751+
hosts = append(hosts, host)
752+
}
753+
} else {
754+
hosts, err = nodesetExpand(hostsNodeset)
755+
if err != nil {
756+
return []string{}, fmt.Errorf("%s", err)
757+
}
758+
}
759+
760+
var ports []string
761+
if portsNodeset == "" {
762+
for _, configDest := range configDests {
763+
_, port, err := utils.SplitHostPort(configDest)
764+
if err != nil {
765+
return []string{}, fmt.Errorf("%s", err)
766+
}
767+
ports = append(ports, port)
768+
}
769+
} else {
770+
ports, err = nodesetExpand(portsNodeset)
771+
if err != nil {
772+
return []string{}, fmt.Errorf("%s", err)
773+
}
731774
}
775+
776+
var hostPorts []string
732777
for _, port := range ports {
733778
if iport, err := strconv.Atoi(port); err != nil {
734-
return []string{}, []string{}, fmt.Errorf("port \"%s\" must be an integer", port)
779+
return []string{}, fmt.Errorf("port \"%s\" must be an integer", port)
735780
} else if iport < 0 || iport > 65535 {
736-
return []string{}, []string{}, fmt.Errorf("port \"%s\" must be in the 0-65535 range", port)
781+
return []string{}, fmt.Errorf("port \"%s\" must be in the 0-65535 range", port)
737782
}
738783
for _, host := range hosts {
739784
if _, _, err := net.SplitHostPort(host + ":" + port); err != nil {
740-
return []string{}, []string{}, fmt.Errorf("%s", err)
785+
return []string{}, fmt.Errorf("%s", err)
741786
}
787+
hostPorts = append(hostPorts, host+":"+port)
742788
}
743789
}
744-
return hosts, ports, nil
790+
return hostPorts, nil
745791
}
746792

747793
func getErrorBannerFromCommandLine(args []string) (string, error) {
748-
errorBanner := ""
749-
switch len(args) {
750-
case 0:
751-
errorBanner = ""
752-
case 1:
753-
errorBanner = args[0]
754-
default:
755-
return "", fmt.Errorf("wrong number of arguments")
794+
if len(args) == 1 {
795+
return args[0], nil
756796
}
757-
return errorBanner, nil
797+
return "", fmt.Errorf("wrong number of arguments")
758798
}
759799

760800
func byteToHuman(b int, passthrough bool) string {
@@ -831,14 +871,16 @@ func main() {
831871
var userString string
832872
var groupsString string
833873
var sourceString string
874+
var hostString string
875+
var portString string
834876

835877
parsers := map[string]*flag.FlagSet{
836878
"help": newHelpParser(),
837879
"version": newVersionParser(),
838880
"show": newShowParser(&csvFlag, &jsonFlag, &allFlag, &userString, &groupsString, &sourceString),
839-
"enable": newEnableParser(),
840-
"forget": newForgetParser(),
841-
"disable": newDisableParser(),
881+
"enable": newEnableParser(&allFlag, &hostString, &portString),
882+
"forget": newForgetParser(&allFlag, &hostString, &portString),
883+
"disable": newDisableParser(&allFlag, &hostString, &portString),
842884
"error_banner": newErrorBannerParser(&expire),
843885
}
844886

@@ -866,7 +908,7 @@ func main() {
866908
p := parsers[cmd]
867909
p.Parse(args)
868910
if p.NArg() == 0 {
869-
fmt.Fprintf(os.Stderr, "ERROR: missing 'hosts' or 'connections'\n\n")
911+
fmt.Fprintf(os.Stderr, "ERROR: missing 'hosts', 'connections', 'users', 'groups', 'error_banner' or 'config'\n\n")
870912
p.Usage()
871913
}
872914
subcmd := p.Arg(0)
@@ -893,41 +935,75 @@ func main() {
893935
case "enable":
894936
p := parsers[cmd]
895937
p.Parse(args)
896-
hosts, ports, err := getHostPortFromCommandLine(p.Args())
938+
if !allFlag && hostString == "" {
939+
fmt.Fprintf(os.Stderr, "ERROR: missing '-all' or '-host'\n\n")
940+
p.Usage()
941+
}
942+
hostPorts, err := getHostPortFromCommandLine(allFlag, hostString, portString, *configFile)
897943
if err != nil {
898944
fmt.Fprintf(os.Stderr, "ERROR: %s\n\n", err)
899945
p.Usage()
900946
}
901-
for _, host := range hosts {
902-
for _, port := range ports {
903-
enableHost(host, port, *configFile)
947+
for _, hostPort := range hostPorts {
948+
host, port, err := utils.SplitHostPort(hostPort)
949+
if err != nil {
950+
fmt.Fprintf(os.Stderr, "ERROR: %s\n\n", err)
951+
p.Usage()
904952
}
953+
enableHost(host, port, *configFile)
905954
}
906955
case "forget":
907956
p := parsers[cmd]
908957
p.Parse(args)
909-
hosts, ports, err := getHostPortFromCommandLine(p.Args())
910-
if err != nil {
911-
fmt.Fprintf(os.Stderr, "ERROR: %s\n\n", err)
958+
if p.NArg() == 0 {
959+
fmt.Fprintf(os.Stderr, "ERROR: missing 'host' or 'error_banner'\n\n")
912960
p.Usage()
913961
}
914-
for _, host := range hosts {
915-
for _, port := range ports {
962+
subcmd := p.Arg(0)
963+
// parse flags after subcommand
964+
args = p.Args()[1:]
965+
p.Parse(args)
966+
switch subcmd {
967+
case "host":
968+
if !allFlag && hostString == "" {
969+
fmt.Fprintf(os.Stderr, "ERROR: missing '-all' or '-host'\n\n")
970+
p.Usage()
971+
}
972+
hostPorts, err := getHostPortFromCommandLine(allFlag, hostString, portString, *configFile)
973+
if err != nil {
974+
fmt.Fprintf(os.Stderr, "ERROR: %s\n\n", err)
975+
p.Usage()
976+
}
977+
for _, hostPort := range hostPorts {
978+
host, port, err := utils.SplitHostPort(hostPort)
979+
if err != nil {
980+
fmt.Fprintf(os.Stderr, "ERROR: %s\n\n", err)
981+
p.Usage()
982+
}
916983
forgetHost(host, port, *configFile)
917984
}
985+
case "error_banner":
986+
delErrorBanner(*configFile)
918987
}
919988
case "disable":
920989
p := parsers[cmd]
921990
p.Parse(args)
922-
hosts, ports, err := getHostPortFromCommandLine(p.Args())
991+
if !allFlag && hostString == "" {
992+
fmt.Fprintf(os.Stderr, "ERROR: missing '-all' or '-host'\n\n")
993+
p.Usage()
994+
}
995+
hostPorts, err := getHostPortFromCommandLine(allFlag, hostString, portString, *configFile)
923996
if err != nil {
924997
fmt.Fprintf(os.Stderr, "ERROR: %s\n\n", err)
925998
p.Usage()
926999
}
927-
for _, host := range hosts {
928-
for _, port := range ports {
929-
disableHost(host, port, *configFile)
1000+
for _, hostPort := range hostPorts {
1001+
host, port, err := utils.SplitHostPort(hostPort)
1002+
if err != nil {
1003+
fmt.Fprintf(os.Stderr, "ERROR: %s\n\n", err)
1004+
p.Usage()
9301005
}
1006+
disableHost(host, port, *configFile)
9311007
}
9321008
case "error_banner":
9331009
p := parsers[cmd]

0 commit comments

Comments
 (0)