Privatae
231 lines
6.8 KiB
Go
231 lines
6.8 KiB
Go
package main
|
|
|
|
// switch_cli.go — the local switch (localdeny.go) from a terminal.
|
|
//
|
|
// privatae-bastion switch <host> <family> on|off
|
|
// privatae-bastion switch --list [--json]
|
|
//
|
|
// The console page has had this switch since localdeny.go was written; a
|
|
// machine with no browser and no person at it (a server the bastion guards
|
|
// for a Host on the same box) had no way to reach it. The command writes the
|
|
// same deny list through the same localDenySet, so the invariant there holds
|
|
// unchanged: "off" removes reach, "on" clears a refusal and grants nothing.
|
|
//
|
|
// MACHINE AUTHORITY, for both directions. On a machine that serves a Host it
|
|
// does not belong to the person using that Host, the switch is part of how
|
|
// the machine was set up, and the one who stands behind that is whoever
|
|
// administers the box. --list only reads, and needs no authority of its own:
|
|
// beside a system service on Linux or macOS the owner's account reads the
|
|
// machine's list through the lane (reads.go); on Windows an ordinary account
|
|
// is refused it (serviceGuard, sysservice.go), because it would read that
|
|
// account's own state rather than the machine's.
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"sort"
|
|
"strings"
|
|
)
|
|
|
|
const switchUsage = "usage: sudo -H privatae-bastion switch <host> <family> on|off\n" +
|
|
" privatae-bastion switch --list [--json]\n" +
|
|
" sudo -H privatae-bastion switch --reset (only when the list cannot be read)"
|
|
|
|
// cmdSwitch parses the arguments and runs one switch, the listing, or the
|
|
// reset of an unreadable list.
|
|
func cmdSwitch(args []string) error {
|
|
if len(args) >= 1 && args[0] == "--list" {
|
|
asJSON, err := jsonOnly(switchUsage, args[1:])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
v, err := readMachine("switches", readOpts{}, readSwitches)
|
|
if err != nil {
|
|
return laneRefusalError("switch --list", err)
|
|
}
|
|
if asJSON {
|
|
return printJSON(os.Stdout, v)
|
|
}
|
|
printSwitches(os.Stdout, v)
|
|
return nil
|
|
}
|
|
if len(args) == 1 && args[0] == "--reset" {
|
|
// The same authority as switching anything back on: a reset leaves
|
|
// nothing switched off.
|
|
if err := requireMachineAuthority("switch"); err != nil {
|
|
return err
|
|
}
|
|
kept, err := localDenyReset()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("The unreadable list is kept at %s. Nothing is switched off now; "+
|
|
"switch off again whatever you had off: switch <host> <family> off\n", kept)
|
|
return nil
|
|
}
|
|
if len(args) != 3 {
|
|
return errors.New(switchUsage)
|
|
}
|
|
var off bool
|
|
switch strings.ToLower(args[2]) {
|
|
case "off":
|
|
off = true
|
|
case "on":
|
|
off = false
|
|
default:
|
|
return fmt.Errorf("the last word is on or off, not %q\n%s", args[2], switchUsage)
|
|
}
|
|
if readsGoThroughLane() {
|
|
// The owner's account, beside the machine's bastion: the console's
|
|
// rule, through its ask socket (owneracts.go). Off takes reach away and
|
|
// needs nothing; on takes the owner's code.
|
|
req := agentAskRequest{Act: "switch", Host: args[0], Family: args[1], Off: off}
|
|
if !off {
|
|
code, ok := promptOwnerCode("Switch " + args[0] + " " + args[1] + " back on? Enter the code from your authenticator (or leave empty to cancel): ")
|
|
if !ok {
|
|
return nil
|
|
}
|
|
req.Code = code
|
|
}
|
|
done, err := actViaSock(req)
|
|
if err != nil {
|
|
return laneRefusalError("switch "+strings.Join(args, " "), err)
|
|
}
|
|
fmt.Println(done)
|
|
return nil
|
|
}
|
|
if err := requireMachineAuthority("switch"); err != nil {
|
|
return err
|
|
}
|
|
host, err := switchResolveHost(args[0])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
family := strings.TrimSpace(args[1])
|
|
if err := localDenySet(host, family, off); err != nil {
|
|
return err
|
|
}
|
|
fmt.Println(switchDoneText(host, family, off))
|
|
return nil
|
|
}
|
|
|
|
// switchResolveHost accepts a paired host's full name or a unique prefix of
|
|
// one, the way --host does everywhere else. A name no pairing matches is
|
|
// passed through unchanged so that localDenySet gives its own refusal, which
|
|
// names the problem in the same words the console page uses.
|
|
func switchResolveHost(key string) (string, error) {
|
|
key = strings.TrimSpace(key)
|
|
if key == "" {
|
|
return "", errors.New("no host named\n" + switchUsage)
|
|
}
|
|
cfgs, err := loadPairings()
|
|
if err != nil {
|
|
return key, nil
|
|
}
|
|
c, err := findPairing(cfgs, key)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if c == nil {
|
|
return key, nil
|
|
}
|
|
return c.HostName, nil
|
|
}
|
|
|
|
// switchRow is one family of one paired host: off (refused here) or on.
|
|
type switchRow struct {
|
|
Host string `json:"host"`
|
|
Family string `json:"family"`
|
|
Off bool `json:"off"`
|
|
Since string `json:"since,omitempty"`
|
|
}
|
|
|
|
// switchesRead is the local switch as it stands. Unreadable: the list cannot
|
|
// be read, so the gate refuses everything (localDenied) and every row is off.
|
|
type switchesRead struct {
|
|
Switches []switchRow `json:"switches"`
|
|
Unreadable string `json:"unreadable,omitempty"`
|
|
// StateDir is the bastion state that was read, named when nothing is
|
|
// paired in it: an ordinary account's own state is not the machine's.
|
|
StateDir string `json:"state_dir,omitempty"`
|
|
}
|
|
|
|
func readSwitches(readOpts) (switchesRead, error) {
|
|
v := switchesRead{Switches: []switchRow{}}
|
|
cfgs, err := loadPairings()
|
|
if err != nil {
|
|
return v, err
|
|
}
|
|
if len(cfgs) == 0 {
|
|
v.StateDir, _ = configDirPath()
|
|
return v, nil
|
|
}
|
|
localDenyMu.Lock()
|
|
f, readErr := localDenyLoad()
|
|
localDenyMu.Unlock()
|
|
if readErr != nil {
|
|
v.Unreadable = localDenyUnreadableText(readErr)
|
|
}
|
|
names := hostNames(cfgs)
|
|
sort.Strings(names)
|
|
fams := localSwitchFamilies()
|
|
for _, host := range names {
|
|
off := map[string]bool{}
|
|
if readErr == nil {
|
|
for _, fam := range f.Off[host] {
|
|
off[fam] = true
|
|
}
|
|
}
|
|
for _, fam := range fams {
|
|
r := switchRow{Host: host, Family: fam, Off: readErr != nil || off[fam]}
|
|
if readErr == nil && off[fam] {
|
|
r.Since = f.At[host+"/"+fam]
|
|
}
|
|
v.Switches = append(v.Switches, r)
|
|
}
|
|
}
|
|
return v, nil
|
|
}
|
|
|
|
// switchList is the listing of this process's own state, in words.
|
|
func switchList(w io.Writer) error {
|
|
v, err := readSwitches(readOpts{})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
printSwitches(w, v)
|
|
return nil
|
|
}
|
|
|
|
// printSwitches prints one line per paired host and family:
|
|
//
|
|
// <host> <family> on|off [since <time>]
|
|
//
|
|
// Plain columns so a setup script can read it as well as a person.
|
|
func printSwitches(w io.Writer, v switchesRead) {
|
|
if len(v.Switches) == 0 {
|
|
// Name the state that was read: an ordinary account's own is not
|
|
// the machine's, so "nothing is paired with this machine" could be
|
|
// untrue.
|
|
fmt.Fprintf(w, "no host is paired in the bastion state at %s\n", v.StateDir)
|
|
return
|
|
}
|
|
if v.Unreadable != "" {
|
|
// The gate refuses everything while the list cannot be read
|
|
// (localDenied), so every line says off, and the warning says why.
|
|
fmt.Fprintf(w, "warning: %s\n", v.Unreadable)
|
|
}
|
|
for _, r := range v.Switches {
|
|
line := r.Host + " " + r.Family + " on"
|
|
if r.Off {
|
|
line = r.Host + " " + r.Family + " off"
|
|
if r.Since != "" {
|
|
line += " since " + r.Since
|
|
}
|
|
}
|
|
fmt.Fprintln(w, line)
|
|
}
|
|
}
|