Orchard Controller: implement an SSH server that acts as a jump host (#179)

* proxy.Connections(): require io.ReadWriteCloser instead of net.Conn

* Orchard Controller: implement an SSH server that acts as a jump host

* Issue a warning if the name used will be invalid in the future

* Further restrict uppercase characters in names in the future

The rationale is similar to https://github.com/kubernetes/kubernetes/issues/71140.

We won't want to munge the user's input and introduce subtle bugs doing
lowercase comparisons.

internal/command/controller/init.go

@@ -12,7 +12,10 @@ import (
 	"fmt"
 	"github.com/cirruslabs/orchard/internal/controller"
 	"github.com/cirruslabs/orchard/internal/netconstants"
+	"golang.org/x/crypto/ed25519"
+	"golang.org/x/crypto/ssh"
 	"math/big"
+	"os"
 	"time"
 )
 
@@ -20,25 +23,80 @@ var ErrInitFailed = errors.New("controller initialization failed")
 
 var controllerCertPath string
 var controllerKeyPath string
+var sshHostKeyPath string
 
-func FindControllerCertificate(dataDir *controller.DataDir) (controllerCert tls.Certificate, err error) {
+func FindControllerCertificate(dataDir *controller.DataDir) (tls.Certificate, error) {
+	// Prefer user-specified certificate and key
 	if controllerCertPath != "" || controllerKeyPath != "" {
-		// if external certificate is specified, use it
-		if err = checkBothCertAndKeyAreSpecified(); err != nil {
-			return controllerCert, err
+		if err := checkBothCertAndKeyAreSpecified(); err != nil {
+			return tls.Certificate{}, err
 		}
+
 		return tls.LoadX509KeyPair(controllerCertPath, controllerKeyPath)
-	} else if !dataDir.ControllerCertificateExists() {
-		// otherwise, generate a self-signed certificate if it's not already present
-		controllerCert, err = GenerateSelfSignedControllerCertificate()
-		if err != nil {
-			return controllerCert, err
-		}
-		if err = dataDir.SetControllerCertificate(controllerCert); err != nil {
-			return controllerCert, err
-		}
 	}
-	return
+
+	// Fall back to loading the certificate from the Orchard data directory
+	controllerCert, err := dataDir.ControllerCertificate()
+	if err == nil {
+		return controllerCert, nil
+	}
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return tls.Certificate{}, err
+	}
+
+	// Fall back to generating a new certificate
+	controllerCert, err = GenerateSelfSignedControllerCertificate()
+	if err != nil {
+		return controllerCert, err
+	}
+	if err = dataDir.SetControllerCertificate(controllerCert); err != nil {
+		return controllerCert, err
+	}
+
+	return controllerCert, nil
+}
+
+func FindSSHHostKey(dataDir *controller.DataDir) (ssh.Signer, error) {
+	// Prefer user-specified host key
+	if sshHostKeyPath != "" {
+		hostKeyBytes, err := os.ReadFile(sshHostKeyPath)
+		if err != nil {
+			return nil, err
+		}
+
+		signer, err := ssh.ParsePrivateKey(hostKeyBytes)
+		if err != nil {
+			return nil, err
+		}
+
+		return signer, nil
+	}
+
+	// Fall back to loading the host key from the Orchard data directory
+	signer, err := dataDir.SSHHostKey()
+	if err == nil {
+		return signer, err
+	}
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return nil, err
+	}
+
+	// Fall back to generating a new host key
+	_, privateKey, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := dataDir.SetSSHHostKey(privateKey); err != nil {
+		return nil, err
+	}
+
+	signer, err = ssh.NewSignerFromKey(privateKey)
+	if err != nil {
+		return nil, err
+	}
+
+	return signer, nil
 }
 
 func checkBothCertAndKeyAreSpecified() error {

internal/command/controller/run.go

@@ -17,6 +17,7 @@ var ErrRunFailed = errors.New("failed to run controller")
 var BootstrapAdminAccountName = "bootstrap-admin"
 
 var address string
+var addressSSH string
 var debug bool
 
 func newRunCommand() *cobra.Command {
@@ -31,7 +32,10 @@ func newRunCommand() *cobra.Command {
 		port = strconv.FormatInt(netconstants.DefaultControllerPort, 10)
 	}
 
-	cmd.PersistentFlags().StringVarP(&address, "listen", "l", fmt.Sprintf(":%s", port), "address to listen on")
+	cmd.PersistentFlags().StringVarP(&address, "listen", "l", fmt.Sprintf(":%s", port),
+		"address to listen on")
+	cmd.PersistentFlags().StringVar(&addressSSH, "listen-ssh", "",
+		"address for the built-in SSH server to listen on (e.g. \":6122\")")
 	cmd.PersistentFlags().BoolVar(&debug, "debug", false, "enable debug logging")
 
 	// flags for auto-init if necessary
@@ -42,6 +46,8 @@ func newRunCommand() *cobra.Command {
 	cmd.PersistentFlags().StringVar(&controllerKeyPath, "controller-key", "",
 		"use the controller certificate key from the specified path instead of the auto-generated one"+
 			" (requires --controller-cert)")
+	cmd.PersistentFlags().StringVar(&sshHostKeyPath, "ssh-host-key", "",
+		"use the SSH private host key from the specified path instead of the auto-generated one")
 
 	return cmd
 }
@@ -74,20 +80,12 @@ func runController(cmd *cobra.Command, args []string) (err error) {
 		return err
 	}
 
-	var controllerCert tls.Certificate
-	if dataDir.ControllerCertificateExists() {
-		controllerCert, err = dataDir.ControllerCertificate()
-		if err != nil {
-			return err
-		}
-	} else {
-		controllerCert, err = FindControllerCertificate(dataDir)
-		if err != nil {
-			return err
-		}
+	controllerCert, err := FindControllerCertificate(dataDir)
+	if err != nil {
+		return err
 	}
 
-	controllerInstance, err := controller.New(
+	controllerOpts := []controller.Option{
 		controller.WithListenAddr(address),
 		controller.WithDataDir(dataDir),
 		controller.WithLogger(logger),
@@ -97,7 +95,18 @@ func runController(cmd *cobra.Command, args []string) (err error) {
 				controllerCert,
 			},
 		}),
-	)
+	}
+
+	if addressSSH != "" {
+		signer, err := FindSSHHostKey(dataDir)
+		if err != nil {
+			return err
+		}
+
+		controllerOpts = append(controllerOpts, controller.WithSSHServer(addressSSH, signer))
+	}
+
+	controllerInstance, err := controller.New(controllerOpts...)
 	if err != nil {
 		return err
 	}