GitHub proxy part 6: proxing Git using SSH transport #49980

greedy52 · 2024-12-10T02:43:41Z

GitHub proxy #48762

will stack another PR for tsh git ssh/config/clone commands on top of this

espadolini · 2024-12-12T14:57:48Z

lib/cryptosuites/suites.go

 		// GitHubProxyCASSH uses same algorithms as UserCASSH.
 		GitHubProxyCASSH: RSA2048,
+		// GitClient uses same algorithms as UserCASSH.
+		GitClient: RSA2048,


Is there a reason why we're not defaulting to P256 or Ed25519 here? The comment for the legacy suite states "new features should always use the new algorithms".

espadolini

Are you sure that hooking into lib/srv/forward.Server to essentially add a completely separate mode gated by a flag (or like three different and potentially conflicting flags) is easier than writing something new that's going to be structurally guaranteed to work as intended just for the purpose of forwarding the ssh git protocol?

espadolini · 2024-12-12T15:05:47Z

lib/auth/authclient/clt.go

+	// GitServerGetter defines a service to get Git servers.
+	services.GitServerGetter


If ClientI already has a way to get a gitserver.Client which has GetGitServer and ListGitServers, why do we need to extend ClientI with methods at the top level?

espadolini · 2024-12-12T15:11:40Z

lib/proxy/router.go

@@ -285,6 +286,11 @@ func (r *Router) DialHost(ctx context.Context, clientSrcAddr, clientDstAddr net.
 					return nil, trace.Wrap(err)
 				}
 			}
+		} else if target.GetGitHub() != nil {


Don't we have a subkind to check here? Let's try to safeguard ourselves against a regular ssh server getting a non-nil but empty github section due to serialization and deserialization mistakes.

espadolini · 2024-12-12T15:12:27Z

lib/proxy/router.go

@@ -418,6 +435,9 @@ func (r remoteSite) GetClusterNetworkingConfig(ctx context.Context) (types.Clust
 // getServer attempts to locate a node matching the provided host and port in
 // the provided site.
 func getServer(ctx context.Context, host, port string, site site) (types.Server, error) {
+	if org, ok := types.GetGitHubOrgFromNodeAddr(host); ok {


What happens if a regular SSH server has a hostname that matches the pattern we've decided to reserve for github orgs?

espadolini · 2024-12-12T15:30:02Z

lib/srv/forward/sshserver.go

@@ -79,6 +80,8 @@ import (
 //		return nil, trace.Wrap(err)
 //	}
 type Server struct {
+	component string


What is a "component"? Please add a godoc for this.

espadolini · 2024-12-12T15:30:38Z

lib/srv/forward/sshserver.go

+	if s.component == teleport.ComponentForwardingGit && s.targetServer != nil {
+		return s.targetServer
+	}


What happens if targetServer is nil but the component is set to ComponentForwardingGit?

espadolini · 2024-12-12T15:59:54Z

lib/reversetunnel/remotesite.go

+	// gitServerWatcher provides the Git server set for the remote site
+	gitServerWatcher *services.GenericWatcher[types.Server, readonly.Server]


Agentless SSH across clusters relies on the root cluster generating the credentials that must be trusted by the destination. Seeing as how the destination is github, and the credentials must be in a plugincredential in the root, what's the point of interacting with git servers in a leaf cluster?

The resource watcher will also constantly spew errors and reset if the underlying event stream can't be initialized because the leaf auth server doesn't know about the existence of git_server.

espadolini · 2024-12-12T16:05:18Z

lib/srv/authhandlers.go

@@ -233,6 +234,7 @@ func (h *AuthHandlers) CreateIdentityContext(sconn *ssh.ServerConn) (IdentityCon
 		}
 		identity.PreviousIdentityExpires = asTime
 	}
+	identity.GitHubUserID = certificate.Extensions[teleport.CertExtensionGitHubUserID]


If we have traits and roles and the only server that's going to interact with the github user ID is in our control (because it's a MITM server in the proxy) why do we need to bake anything in the SSH certificate of the user? Doing so also prevents us from having different user IDs for different orgs, for example.

espadolini · 2024-12-12T16:11:01Z

lib/srv/git/git.go

+//
+// Sample command: git-upload-pack 'my-org/my-repo.git'
+func parseSSHCommand(command string) (*sshCommand, error) {
+	gitService, path, ok := strings.Cut(strings.TrimSpace(command), " ")


Please use a real shell command lexer instead of writing something that appears to work but might accidentally let an attacker bypass auditing or authorization.

espadolini · 2024-12-12T16:12:17Z

lib/srv/git/github.go

+	"SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s",
+	"SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ",
+	"SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM",
+	"SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU",


https://api.github.com/meta only lists three keys, I think that one of these four is the DSA key that's no longer used and was never supported by x/crypto/ssh anyway. Can we get rid of that?

espadolini · 2024-12-12T16:14:51Z

lib/srv/git/github.go

+	userExpires := c.IdentityExpires.Sub(c.Clock.Now())
+	if userExpires > defaultGitHubUserCertTTL {
+		return defaultGitHubUserCertTTL
+	}
+	return userExpires


Suggested change

userExpires := c.IdentityExpires.Sub(c.Clock.Now())

if userExpires > defaultGitHubUserCertTTL {

return defaultGitHubUserCertTTL

}

return userExpires

userTTL := c.IdentityExpires.Sub(c.Clock.Now())

return min(userTTL, defaultGitHubUserCertTTL)

greedy52 · 2024-12-16T14:17:58Z

Are you sure that hooking into lib/srv/forward.Server to essentially add a completely separate mode gated by a flag (or like three different and potentially conflicting flags) is easier than writing something new that's going to be structurally guaranteed to work as intended just for the purpose of forwarding the ssh git protocol?

will do 👍

greedy52 · 2024-12-20T18:06:26Z

i am splitting out some parts of this PR to separate ones like

GitHub proxy: git command recorder #50505

greedy52 mentioned this pull request Dec 10, 2024

GitHub proxy #48762

Open

14 tasks

Base automatically changed from STeve/48762_github_oauth_flow to master December 10, 2024 17:50

greedy52 changed the base branch from master to STeve/48762_audit_log December 11, 2024 02:53

greedy52 changed the base branch from STeve/48762_audit_log to master December 11, 2024 02:53

GitHub proxy part 6: proxing Git using SSH transport

1cd0ec1

greedy52 force-pushed the STeve/48762_ssh branch from 73db1b8 to 1cd0ec1 Compare December 11, 2024 03:00

greedy52 mentioned this pull request Dec 11, 2024

GitHub proxy part 6.5: tsh git ssh/clone/config #50044

Open

greedy52 force-pushed the STeve/48762_ssh branch from a887119 to a5cb9a6 Compare December 11, 2024 21:37

fix ut

97bbddf

greedy52 force-pushed the STeve/48762_ssh branch from a5cb9a6 to 97bbddf Compare December 12, 2024 01:33

greedy52 requested review from espadolini and r0mant December 12, 2024 01:59

greedy52 marked this pull request as ready for review December 12, 2024 01:59

github-actions bot requested review from flyinghermit and rosstimothy December 12, 2024 01:59

github-actions bot added the size/lg label Dec 12, 2024

espadolini reviewed Dec 12, 2024

View reviewed changes

greedy52 mentioned this pull request Dec 20, 2024

GitHub proxy: git command recorder #50505

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub proxy part 6: proxing Git using SSH transport #49980

GitHub proxy part 6: proxing Git using SSH transport #49980

greedy52 commented Dec 10, 2024

espadolini Dec 12, 2024

espadolini left a comment

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

espadolini Dec 12, 2024

greedy52 commented Dec 16, 2024 •

edited

Loading

greedy52 commented Dec 20, 2024

		// GitServerGetter defines a service to get Git servers.
		services.GitServerGetter

		// gitServerWatcher provides the Git server set for the remote site
		gitServerWatcher *services.GenericWatcher[types.Server, readonly.Server]

GitHub proxy part 6: proxing Git using SSH transport #49980

Are you sure you want to change the base?

GitHub proxy part 6: proxing Git using SSH transport #49980

Conversation

greedy52 commented Dec 10, 2024

Choose a reason for hiding this comment

espadolini left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

greedy52 commented Dec 16, 2024 • edited Loading

greedy52 commented Dec 20, 2024

greedy52 commented Dec 16, 2024 •

edited

Loading