ssh: stream management api (#5670)

## Summary

This implements the StreamManagement API defined at 

https://github.com/pomerium/envoy-custom/blob/main/api/extensions/filters/network/ssh/ssh.proto#L46-L60.
Policy evaluation and authorization logic is stubbed out here, and
implemented in https://github.com/pomerium/pomerium/pull/5665.

## Related issues

<!-- For example...
- #159
-->

## User Explanation

<!-- How would you explain this change to the user? If this
change doesn't create any user-facing changes, you can leave
this blank. If filled out, add the `docs` label -->

## Checklist

- [ ] reference any related issues
- [ ] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review
This commit is contained in:
Joe Kralicky 2025-07-01 13:57:19 -04:00 committed by GitHub
parent c53aca0dd8
commit b216b7a135
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
18 changed files with 4257 additions and 9 deletions

40
pkg/ssh/manager_test.go Normal file
View file

@ -0,0 +1,40 @@
package ssh_test
import (
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.uber.org/mock/gomock"
extensions_ssh "github.com/pomerium/envoy-custom/api/extensions/filters/network/ssh"
"github.com/pomerium/pomerium/config"
"github.com/pomerium/pomerium/pkg/ssh"
mock_ssh "github.com/pomerium/pomerium/pkg/ssh/mock"
)
func mustParseWeightedURLs(t *testing.T, urls ...string) []config.WeightedURL {
wu, err := config.ParseWeightedUrls(urls...)
require.NoError(t, err)
return wu
}
func TestStreamManager(t *testing.T) {
ctrl := gomock.NewController(t)
auth := mock_ssh.NewMockAuthInterface(ctrl)
m := ssh.NewStreamManager(auth)
cfg := &config.Config{Options: config.NewDefaultOptions()}
cfg.Options.Policies = []config.Policy{
{From: "ssh://host1", To: mustParseWeightedURLs(t, "ssh://dest1:22")},
{From: "ssh://host2", To: mustParseWeightedURLs(t, "ssh://dest2:22")},
}
t.Run("LookupStream", func(t *testing.T) {
assert.Nil(t, m.LookupStream(1234))
sh := m.NewStreamHandler(cfg, &extensions_ssh.DownstreamConnectEvent{StreamId: 1234})
assert.Equal(t, sh, m.LookupStream(1234))
sh.Close()
assert.Nil(t, m.LookupStream(1234))
})
}