mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 12:21:31 +00:00
feat(M39): IIS WinRM proxy agent mode + front-to-back wiring
Complete the IIS target connector with dual-mode deployment: - WinRM proxy agent mode via masterzen/winrm for remote Windows servers - Base64 PFX transfer with try/finally cleanup on remote host - GUI wizard updated with 13 IIS config fields including WinRM settings - TargetDetailPage sensitive field redaction (password/secret/token/key) - OpenAPI TargetType enum updated (added Traefik, Caddy) - connectors.md fully documented with WinRM proxy config example - 38 total IIS tests (10 new WinRM tests), all passing with race detection Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
shankar0123
+1
-1
@@ -2669,7 +2669,7 @@ components:
|
||||
# ─── Targets ─────────────────────────────────────────────────────
|
||||
TargetType:
|
||||
type: string
|
||||
enum: [NGINX, Apache, HAProxy, F5, IIS]
|
||||
enum: [NGINX, Apache, HAProxy, Traefik, Caddy, IIS, F5]
|
||||
|
||||
DeploymentTarget:
|
||||
type: object
|
||||
|
||||
+1
-1
@@ -592,7 +592,7 @@ func (a *Agent) createTargetConnector(targetType string, configJSON json.RawMess
|
||||
return nil, fmt.Errorf("invalid IIS config: %w", err)
|
||||
}
|
||||
}
|
||||
return iis.New(&cfg, a.logger), nil
|
||||
return iis.New(&cfg, a.logger)
|
||||
|
||||
case "Traefik":
|
||||
var cfg traefik.Config
|
||||
|
||||
+41
-8
@@ -617,9 +617,9 @@ The IIS target connector supports two deployment modes — agent-local (recommen
|
||||
|
||||
**Agent-local (recommended):** A Windows agent runs directly on the IIS server and deploys certificates using PowerShell — `Import-PfxCertificate` to install into the certificate store and `Set-WebBinding` to bind to the IIS site. The agent handles PEM-to-PFX conversion via `go-pkcs12`, computes SHA-1 thumbprint from the certificate, and executes parameterized PowerShell scripts for injection-safe binding management. This is the preferred approach: no remote access needed, no credential management, same pull-based model as NGINX/Apache/HAProxy.
|
||||
|
||||
**Proxy agent WinRM (for agentless targets):** For Windows servers where you don't want to install an agent, a nearby Windows agent acts as a proxy and reaches the IIS box via WinRM. The proxy agent picks up the deployment job, transfers the PFX bundle over WinRM, and runs the PowerShell commands remotely. WinRM credentials are stored on the proxy agent, not on the control plane.
|
||||
**Proxy agent WinRM (for agentless targets):** For Windows servers where you don't want to install an agent, a Linux or Windows proxy agent in the same network zone connects via WinRM (Windows Remote Management) and executes PowerShell commands remotely. The PFX bundle is base64-encoded, transferred inline in the WinRM session, decoded to a temp file on the remote host, imported, and the temp file is cleaned up in a `try/finally` block. WinRM credentials are configured on the target, not on the control plane. Uses the `masterzen/winrm` Go library with support for Basic, NTLM, and Kerberos authentication.
|
||||
|
||||
Configuration:
|
||||
**Agent-local configuration:**
|
||||
```json
|
||||
{
|
||||
"hostname": "iis-server.example.com",
|
||||
@@ -628,7 +628,29 @@ Configuration:
|
||||
"port": 443,
|
||||
"sni": true,
|
||||
"ip_address": "*",
|
||||
"binding_info": "IP:443:iis-server.example.com"
|
||||
"binding_info": "www.example.com"
|
||||
}
|
||||
```
|
||||
|
||||
**WinRM proxy configuration:**
|
||||
```json
|
||||
{
|
||||
"hostname": "iis-server.example.com",
|
||||
"site_name": "Default Web Site",
|
||||
"cert_store": "WebHosting",
|
||||
"port": 443,
|
||||
"sni": true,
|
||||
"ip_address": "*",
|
||||
"mode": "winrm",
|
||||
"winrm": {
|
||||
"winrm_host": "iis-server.example.com",
|
||||
"winrm_port": 5985,
|
||||
"winrm_username": "Administrator",
|
||||
"winrm_password": "...",
|
||||
"winrm_https": false,
|
||||
"winrm_insecure": false,
|
||||
"winrm_timeout": 60
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
@@ -637,17 +659,28 @@ Configuration:
|
||||
- `site_name` (string, required): IIS website name (e.g., "Default Web Site")
|
||||
- `cert_store` (string, required): Certificate store for import (e.g., "WebHosting", "My")
|
||||
- `port` (number, default 443): HTTPS binding port
|
||||
- `sni` (boolean, default true): Enable Server Name Indication (SNI)
|
||||
- `sni` (boolean, default false): Enable Server Name Indication (SNI)
|
||||
- `ip_address` (string, default "*"): Specific IP to bind to, or "*" for all IPs
|
||||
- `binding_info` (string, optional): Custom binding string for advanced scenarios
|
||||
- `binding_info` (string, optional): Host header for SNI bindings
|
||||
- `mode` (string, default "local"): Deployment mode — `local` (agent-local PowerShell) or `winrm` (remote via WinRM)
|
||||
|
||||
**WinRM fields (required when `mode` is `winrm`):**
|
||||
- `winrm.winrm_host` (string, required): Remote Windows server hostname or IP
|
||||
- `winrm.winrm_port` (number, default 5985 HTTP / 5986 HTTPS): WinRM listener port
|
||||
- `winrm.winrm_username` (string, required): Windows account with admin privileges
|
||||
- `winrm.winrm_password` (string, required): Account password
|
||||
- `winrm.winrm_https` (boolean, default false): Use HTTPS transport
|
||||
- `winrm.winrm_insecure` (boolean, default false): Skip TLS certificate verification
|
||||
- `winrm.winrm_timeout` (number, default 60): Operation timeout in seconds
|
||||
|
||||
**Security Model:**
|
||||
- PFX files are transient — generated with random passwords, deleted after import
|
||||
- PowerShell commands are parameterized (no string interpolation) to prevent injection
|
||||
- Field names are regex-validated before script execution
|
||||
- In WinRM mode, PFX data is base64-encoded and transferred inline (no SMB/file share needed), with remote temp file cleanup in `try/finally`
|
||||
- PowerShell commands use parameterized values — IIS names and cert stores are regex-validated before script execution
|
||||
- Field names are validated against `^[a-zA-Z0-9 _\-\.]+$` to prevent PowerShell injection
|
||||
- Certificate thumbprints computed via SHA-1 for IIS binding lookups
|
||||
|
||||
Location: `internal/connector/target/iis/iis.go`
|
||||
Location: `internal/connector/target/iis/iis.go`, `internal/connector/target/iis/winrm.go`
|
||||
|
||||
## Notifier Connector
|
||||
|
||||
|
||||
@@ -17,7 +17,11 @@ require (
|
||||
require (
|
||||
dario.cat/mergo v1.0.0 // indirect
|
||||
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
|
||||
github.com/ChrisTrenkamp/goxpath v0.0.0-20210404020558-97928f7e12b6 // indirect
|
||||
github.com/Microsoft/go-winio v0.6.2 // indirect
|
||||
github.com/bodgit/ntlmssp v0.0.0-20240506230425-31973bb52d9b // indirect
|
||||
github.com/bodgit/windows v1.0.1 // indirect
|
||||
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
|
||||
github.com/containerd/containerd v1.7.18 // indirect
|
||||
github.com/containerd/log v0.1.0 // indirect
|
||||
@@ -32,12 +36,23 @@ require (
|
||||
github.com/go-logr/logr v1.4.1 // indirect
|
||||
github.com/go-logr/stdr v1.2.2 // indirect
|
||||
github.com/go-ole/go-ole v1.2.6 // indirect
|
||||
github.com/gofrs/uuid v4.4.0+incompatible // indirect
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/google/jsonschema-go v0.4.2 // indirect
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
||||
github.com/hashicorp/go-uuid v1.0.3 // indirect
|
||||
github.com/jcmturner/aescts/v2 v2.0.0 // indirect
|
||||
github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
|
||||
github.com/jcmturner/gofork v1.7.6 // indirect
|
||||
github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
|
||||
github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
|
||||
github.com/jcmturner/rpc/v2 v2.0.3 // indirect
|
||||
github.com/klauspost/compress v1.17.4 // indirect
|
||||
github.com/kr/text v0.2.0 // indirect
|
||||
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
|
||||
github.com/magiconair/properties v1.8.7 // indirect
|
||||
github.com/masterzen/simplexml v0.0.0-20190410153822-31eea3082786 // indirect
|
||||
github.com/masterzen/winrm v0.0.0-20250927112105-5f8e6c707321 // indirect
|
||||
github.com/moby/docker-image-spec v1.3.1 // indirect
|
||||
github.com/moby/patternmatcher v0.6.0 // indirect
|
||||
github.com/moby/sys/sequential v0.5.0 // indirect
|
||||
@@ -55,6 +70,7 @@ require (
|
||||
github.com/shoenig/go-m1cpu v0.1.6 // indirect
|
||||
github.com/sirupsen/logrus v1.9.3 // indirect
|
||||
github.com/stretchr/testify v1.9.0 // indirect
|
||||
github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde // indirect
|
||||
github.com/tklauser/go-sysconf v0.3.12 // indirect
|
||||
github.com/tklauser/numcpus v0.6.1 // indirect
|
||||
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
||||
@@ -63,7 +79,9 @@ require (
|
||||
go.opentelemetry.io/otel v1.24.0 // indirect
|
||||
go.opentelemetry.io/otel/metric v1.24.0 // indirect
|
||||
go.opentelemetry.io/otel/trace v1.24.0 // indirect
|
||||
golang.org/x/net v0.23.0 // indirect
|
||||
golang.org/x/oauth2 v0.34.0 // indirect
|
||||
golang.org/x/sys v0.40.0 // indirect
|
||||
golang.org/x/text v0.21.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
)
|
||||
|
||||
@@ -4,8 +4,16 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9
|
||||
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
|
||||
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
|
||||
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
|
||||
github.com/ChrisTrenkamp/goxpath v0.0.0-20210404020558-97928f7e12b6 h1:w0E0fgc1YafGEh5cROhlROMWXiNoZqApk2PDN0M1+Ns=
|
||||
github.com/ChrisTrenkamp/goxpath v0.0.0-20210404020558-97928f7e12b6/go.mod h1:nuWgzSkT5PnyOd+272uUmV0dnAnAn42Mk7PiQC5VzN4=
|
||||
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
|
||||
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
|
||||
github.com/bodgit/ntlmssp v0.0.0-20240506230425-31973bb52d9b h1:baFN6AnR0SeC194X2D292IUZcHDs4JjStpqtE70fjXE=
|
||||
github.com/bodgit/ntlmssp v0.0.0-20240506230425-31973bb52d9b/go.mod h1:Ram6ngyPDmP+0t6+4T2rymv0w0BS9N8Ch5vvUJccw5o=
|
||||
github.com/bodgit/windows v1.0.1 h1:tF7K6KOluPYygXa3Z2594zxlkbKPAOvqr97etrGNIz4=
|
||||
github.com/bodgit/windows v1.0.1/go.mod h1:a6JLwrB4KrTR5hBpp8FI9/9W9jJfeQ2h4XDXU74ZCdM=
|
||||
github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
|
||||
github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
|
||||
github.com/containerd/containerd v1.7.18 h1:jqjZTQNfXGoEaZdW1WwPU0RqSn1Bm2Ay/KJPUuO8nao=
|
||||
@@ -39,6 +47,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
||||
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||
github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
|
||||
github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
|
||||
github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
|
||||
github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
|
||||
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
|
||||
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
|
||||
github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
|
||||
@@ -52,8 +62,27 @@ github.com/google/jsonschema-go v0.4.2 h1:tmrUohrwoLZZS/P3x7ex0WAVknEkBZM46iALbc
|
||||
github.com/google/jsonschema-go v0.4.2/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
|
||||
github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
|
||||
github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
|
||||
github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
|
||||
github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
|
||||
github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
|
||||
github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
|
||||
github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
|
||||
github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
|
||||
github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
|
||||
github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
|
||||
github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
|
||||
github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
|
||||
github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
|
||||
github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
|
||||
github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
|
||||
github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
|
||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
|
||||
@@ -68,6 +97,10 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ
|
||||
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
|
||||
github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
|
||||
github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
|
||||
github.com/masterzen/simplexml v0.0.0-20190410153822-31eea3082786 h1:2ZKn+w/BJeL43sCxI2jhPLRv73oVVOjEKZjKkflyqxg=
|
||||
github.com/masterzen/simplexml v0.0.0-20190410153822-31eea3082786/go.mod h1:kCEbxUJlNDEBNbdQMkPSp6yaKcRXVI6f4ddk8Riv4bc=
|
||||
github.com/masterzen/winrm v0.0.0-20250927112105-5f8e6c707321 h1:AKIJL2PfBX2uie0Mn5pxtG1+zut3hAVMZbRfoXecFzI=
|
||||
github.com/masterzen/winrm v0.0.0-20250927112105-5f8e6c707321/go.mod h1:JajVhkiG2bYSNYYPYuWG7WZHr42CTjMTcCjfInRNCqc=
|
||||
github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
|
||||
github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
|
||||
github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
|
||||
@@ -111,14 +144,18 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS
|
||||
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
|
||||
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
|
||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
|
||||
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
|
||||
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||
github.com/testcontainers/testcontainers-go v0.35.0 h1:uADsZpTKFAtp8SLK+hMwSaa+X+JiERHtd4sQAFmXeMo=
|
||||
github.com/testcontainers/testcontainers-go v0.35.0/go.mod h1:oEVBj5zrfJTrgjwONs1SsRbnBtH9OKl+IGl3UMcr2B4=
|
||||
github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde h1:AMNpJRc7P+GTwVbl8DkK2I9I8BBUzNiHuH/tlxrpan0=
|
||||
github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde/go.mod h1:MvrEmduDUz4ST5pGZ7CABCnOU5f3ZiOAZzT6b1A6nX8=
|
||||
github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
|
||||
github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
|
||||
github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
|
||||
@@ -127,6 +164,7 @@ github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zI
|
||||
github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
|
||||
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
|
||||
github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
|
||||
@@ -148,14 +186,22 @@ go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v8
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
|
||||
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
|
||||
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
|
||||
golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
|
||||
golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
|
||||
@@ -163,22 +209,33 @@ golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwE
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
|
||||
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||
golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
|
||||
golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
|
||||
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
|
||||
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
|
||||
@@ -187,6 +244,7 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
|
||||
golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
@@ -205,6 +263,7 @@ google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHh
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
|
||||
@@ -5,6 +5,7 @@ import (
|
||||
"crypto/rand"
|
||||
"crypto/sha1"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
@@ -21,7 +22,9 @@ import (
|
||||
)
|
||||
|
||||
// Config represents the IIS deployment target configuration.
|
||||
// This configuration is for Windows agents that manage IIS servers.
|
||||
// Supports two modes:
|
||||
// - "local" (default): runs PowerShell locally on a Windows agent
|
||||
// - "winrm": connects to a remote Windows server via WinRM (proxy agent pattern)
|
||||
type Config struct {
|
||||
Hostname string `json:"hostname"` // Target hostname or IP
|
||||
SiteName string `json:"site_name"` // IIS site name (e.g., "Default Web Site")
|
||||
@@ -30,6 +33,10 @@ type Config struct {
|
||||
Port int `json:"port"` // HTTPS port (default 443)
|
||||
SNI bool `json:"sni"` // Enable Server Name Indication
|
||||
IPAddress string `json:"ip_address"` // Bind to specific IP (default "*")
|
||||
Mode string `json:"mode"` // "local" (default) or "winrm"
|
||||
|
||||
// WinRM settings (only used when Mode is "winrm")
|
||||
WinRM WinRMConfig `json:"winrm"`
|
||||
}
|
||||
|
||||
// PowerShellExecutor abstracts PowerShell command execution for testability.
|
||||
@@ -69,13 +76,33 @@ type Connector struct {
|
||||
}
|
||||
|
||||
// New creates a new IIS target connector with the given configuration and logger.
|
||||
// Uses the real PowerShell executor for production deployments.
|
||||
func New(config *Config, logger *slog.Logger) *Connector {
|
||||
// In "local" mode (default), uses the real PowerShell executor.
|
||||
// In "winrm" mode, creates a WinRM client for remote execution.
|
||||
func New(config *Config, logger *slog.Logger) (*Connector, error) {
|
||||
mode := config.Mode
|
||||
if mode == "" {
|
||||
mode = "local"
|
||||
}
|
||||
|
||||
var executor PowerShellExecutor
|
||||
switch mode {
|
||||
case "local":
|
||||
executor = &realExecutor{}
|
||||
case "winrm":
|
||||
winrmExec, err := newWinRMExecutor(&config.WinRM)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to initialize WinRM executor: %w", err)
|
||||
}
|
||||
executor = winrmExec
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported IIS connector mode %q (must be 'local' or 'winrm')", mode)
|
||||
}
|
||||
|
||||
return &Connector{
|
||||
config: config,
|
||||
logger: logger,
|
||||
executor: &realExecutor{},
|
||||
}
|
||||
executor: executor,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// NewWithExecutor creates a new IIS target connector with an injected executor.
|
||||
@@ -157,15 +184,26 @@ func (c *Connector) ValidateConfig(ctx context.Context, rawConfig json.RawMessag
|
||||
}
|
||||
}
|
||||
|
||||
// Apply mode default
|
||||
if cfg.Mode == "" {
|
||||
cfg.Mode = "local"
|
||||
}
|
||||
if cfg.Mode != "local" && cfg.Mode != "winrm" {
|
||||
return fmt.Errorf("unsupported mode %q (must be 'local' or 'winrm')", cfg.Mode)
|
||||
}
|
||||
|
||||
c.logger.Info("validating IIS configuration",
|
||||
"site_name", cfg.SiteName,
|
||||
"cert_store", cfg.CertStore,
|
||||
"hostname", cfg.Hostname,
|
||||
"port", cfg.Port)
|
||||
"port", cfg.Port,
|
||||
"mode", cfg.Mode)
|
||||
|
||||
// Verify PowerShell is available
|
||||
if _, err := exec.LookPath("powershell.exe"); err != nil {
|
||||
return fmt.Errorf("powershell.exe not found in PATH: %w", err)
|
||||
// Verify PowerShell is available (only in local mode — WinRM handles this remotely)
|
||||
if cfg.Mode == "local" {
|
||||
if _, err := exec.LookPath("powershell.exe"); err != nil {
|
||||
return fmt.Errorf("powershell.exe not found in PATH: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Verify IIS site exists
|
||||
@@ -240,33 +278,9 @@ func (c *Connector) DeployCertificate(ctx context.Context, request target.Deploy
|
||||
}, fmt.Errorf("%s", errMsg)
|
||||
}
|
||||
|
||||
// Step 2: Write PFX to temp file
|
||||
tmpFile, err := os.CreateTemp("", "certctl-*.pfx")
|
||||
if err != nil {
|
||||
errMsg := fmt.Sprintf("failed to create temp PFX file: %v", err)
|
||||
c.logger.Error("deployment failed", "error", err)
|
||||
return &target.DeploymentResult{
|
||||
Success: false,
|
||||
Message: errMsg,
|
||||
DeployedAt: time.Now(),
|
||||
}, fmt.Errorf("%s", errMsg)
|
||||
}
|
||||
pfxPath := tmpFile.Name()
|
||||
defer os.Remove(pfxPath) // Always clean up temp PFX
|
||||
|
||||
if _, err := tmpFile.Write(pfxData); err != nil {
|
||||
tmpFile.Close()
|
||||
errMsg := fmt.Sprintf("failed to write temp PFX file: %v", err)
|
||||
c.logger.Error("deployment failed", "error", err)
|
||||
return &target.DeploymentResult{
|
||||
Success: false,
|
||||
Message: errMsg,
|
||||
DeployedAt: time.Now(),
|
||||
}, fmt.Errorf("%s", errMsg)
|
||||
}
|
||||
tmpFile.Close()
|
||||
|
||||
// Step 3: Compute thumbprint (SHA-1 of DER-encoded cert — matches Windows certutil)
|
||||
// Step 2+3: Compute thumbprint and import PFX
|
||||
// In local mode: write PFX to temp file, import via file path
|
||||
// In WinRM mode: base64-encode PFX, decode on remote side to temp file, import, clean up
|
||||
thumbprint, err := computeThumbprint(request.CertPEM)
|
||||
if err != nil {
|
||||
errMsg := fmt.Sprintf("failed to compute certificate thumbprint: %v", err)
|
||||
@@ -281,11 +295,57 @@ func (c *Connector) DeployCertificate(ctx context.Context, request target.Deploy
|
||||
c.logger.Debug("certificate thumbprint computed", "thumbprint", thumbprint)
|
||||
|
||||
// Step 4: Import PFX to Windows certificate store
|
||||
importScript := fmt.Sprintf(
|
||||
`$password = ConvertTo-SecureString -String '%s' -AsPlainText -Force; `+
|
||||
`Import-PfxCertificate -FilePath '%s' -CertStoreLocation 'Cert:\LocalMachine\%s' -Password $password`,
|
||||
pfxPassword, pfxPath, c.config.CertStore,
|
||||
)
|
||||
var importScript string
|
||||
mode := c.config.Mode
|
||||
if mode == "" {
|
||||
mode = "local"
|
||||
}
|
||||
|
||||
if mode == "winrm" {
|
||||
// WinRM mode: base64-encode PFX, decode on remote, import, cleanup
|
||||
pfxBase64 := base64.StdEncoding.EncodeToString(pfxData)
|
||||
importScript = fmt.Sprintf(
|
||||
`$pfxPath = [System.IO.Path]::GetTempFileName() + '.pfx'; `+
|
||||
`[System.IO.File]::WriteAllBytes($pfxPath, [System.Convert]::FromBase64String('%s')); `+
|
||||
`try { `+
|
||||
`$password = ConvertTo-SecureString -String '%s' -AsPlainText -Force; `+
|
||||
`Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation 'Cert:\LocalMachine\%s' -Password $password `+
|
||||
`} finally { Remove-Item -Path $pfxPath -Force -ErrorAction SilentlyContinue }`,
|
||||
pfxBase64, pfxPassword, c.config.CertStore,
|
||||
)
|
||||
} else {
|
||||
// Local mode: write PFX to local temp file
|
||||
tmpFile, fileErr := os.CreateTemp("", "certctl-*.pfx")
|
||||
if fileErr != nil {
|
||||
errMsg := fmt.Sprintf("failed to create temp PFX file: %v", fileErr)
|
||||
c.logger.Error("deployment failed", "error", fileErr)
|
||||
return &target.DeploymentResult{
|
||||
Success: false,
|
||||
Message: errMsg,
|
||||
DeployedAt: time.Now(),
|
||||
}, fmt.Errorf("%s", errMsg)
|
||||
}
|
||||
pfxPath := tmpFile.Name()
|
||||
defer os.Remove(pfxPath) // Always clean up temp PFX
|
||||
|
||||
if _, writeErr := tmpFile.Write(pfxData); writeErr != nil {
|
||||
tmpFile.Close()
|
||||
errMsg := fmt.Sprintf("failed to write temp PFX file: %v", writeErr)
|
||||
c.logger.Error("deployment failed", "error", writeErr)
|
||||
return &target.DeploymentResult{
|
||||
Success: false,
|
||||
Message: errMsg,
|
||||
DeployedAt: time.Now(),
|
||||
}, fmt.Errorf("%s", errMsg)
|
||||
}
|
||||
tmpFile.Close()
|
||||
|
||||
importScript = fmt.Sprintf(
|
||||
`$password = ConvertTo-SecureString -String '%s' -AsPlainText -Force; `+
|
||||
`Import-PfxCertificate -FilePath '%s' -CertStoreLocation 'Cert:\LocalMachine\%s' -Password $password`,
|
||||
pfxPassword, pfxPath, c.config.CertStore,
|
||||
)
|
||||
}
|
||||
|
||||
output, err := c.executor.Execute(ctx, importScript)
|
||||
if err != nil {
|
||||
|
||||
@@ -843,3 +843,216 @@ func TestGenerateRandomPassword(t *testing.T) {
|
||||
t.Error("two generated passwords should be different")
|
||||
}
|
||||
}
|
||||
|
||||
// --- WinRM mode tests ---
|
||||
|
||||
func TestIISConnector_ValidateConfig_WinRMMode(t *testing.T) {
|
||||
executor := newMockExecutor()
|
||||
executor.responses["Get-Website"] = mockResponse{output: "Default Web Site\n", err: nil}
|
||||
executor.responses["Test-Path"] = mockResponse{output: "True\n", err: nil}
|
||||
|
||||
cfg := Config{
|
||||
SiteName: "Default Web Site",
|
||||
CertStore: "My",
|
||||
Mode: "winrm",
|
||||
WinRM: WinRMConfig{
|
||||
Host: "iis-server.example.com",
|
||||
Port: 5985,
|
||||
Username: "Administrator",
|
||||
Password: "P@ssw0rd",
|
||||
},
|
||||
}
|
||||
|
||||
// WinRM mode should NOT check for powershell.exe locally
|
||||
connector := NewWithExecutor(&cfg, testLogger(), executor)
|
||||
rawConfig, _ := json.Marshal(cfg)
|
||||
|
||||
err := connector.ValidateConfig(context.Background(), rawConfig)
|
||||
if err != nil {
|
||||
t.Fatalf("ValidateConfig failed in WinRM mode: %v", err)
|
||||
}
|
||||
|
||||
// Verify PowerShell commands were executed via the executor (not locally)
|
||||
if len(executor.commands) < 2 {
|
||||
t.Fatalf("expected at least 2 executor commands, got %d", len(executor.commands))
|
||||
}
|
||||
}
|
||||
|
||||
func TestIISConnector_ValidateConfig_InvalidMode(t *testing.T) {
|
||||
connector := NewWithExecutor(&Config{}, testLogger(), newMockExecutor())
|
||||
cfg := Config{
|
||||
SiteName: "Default Web Site",
|
||||
CertStore: "My",
|
||||
Mode: "invalid",
|
||||
}
|
||||
rawConfig, _ := json.Marshal(cfg)
|
||||
|
||||
err := connector.ValidateConfig(context.Background(), rawConfig)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for invalid mode")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "unsupported mode") {
|
||||
t.Errorf("expected 'unsupported mode' in error, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIISConnector_DeployCertificate_WinRMMode(t *testing.T) {
|
||||
executor := newMockExecutor()
|
||||
executor.defaultOutput = "OK"
|
||||
|
||||
cfg := Config{
|
||||
Hostname: "iis-server.example.com",
|
||||
SiteName: "Default Web Site",
|
||||
CertStore: "My",
|
||||
Port: 443,
|
||||
IPAddress: "*",
|
||||
Mode: "winrm",
|
||||
}
|
||||
|
||||
connector := NewWithExecutor(&cfg, testLogger(), executor)
|
||||
certPEM, keyPEM, _, err := generateTestCertAndKey()
|
||||
if err != nil {
|
||||
t.Fatalf("failed to generate test cert: %v", err)
|
||||
}
|
||||
|
||||
result, err := connector.DeployCertificate(context.Background(), target.DeploymentRequest{
|
||||
CertPEM: certPEM,
|
||||
KeyPEM: keyPEM,
|
||||
ChainPEM: "",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("DeployCertificate in WinRM mode failed: %v", err)
|
||||
}
|
||||
if !result.Success {
|
||||
t.Fatalf("expected success, got: %s", result.Message)
|
||||
}
|
||||
|
||||
// Verify the import script used base64 encoding (WinRM mode)
|
||||
foundBase64Import := false
|
||||
for _, cmd := range executor.commands {
|
||||
if strings.Contains(cmd, "FromBase64String") && strings.Contains(cmd, "Import-PfxCertificate") {
|
||||
foundBase64Import = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !foundBase64Import {
|
||||
t.Error("WinRM mode should use base64-encoded PFX transfer, but no FromBase64String found in commands")
|
||||
}
|
||||
|
||||
// Verify remote temp file cleanup is in the script
|
||||
foundCleanup := false
|
||||
for _, cmd := range executor.commands {
|
||||
if strings.Contains(cmd, "Remove-Item") && strings.Contains(cmd, "finally") {
|
||||
foundCleanup = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !foundCleanup {
|
||||
t.Error("WinRM mode should include remote temp file cleanup (try/finally Remove-Item)")
|
||||
}
|
||||
}
|
||||
|
||||
func TestIISConnector_New_WinRMMode_MissingHost(t *testing.T) {
|
||||
cfg := Config{
|
||||
Mode: "winrm",
|
||||
WinRM: WinRMConfig{
|
||||
Username: "admin",
|
||||
Password: "pass",
|
||||
},
|
||||
}
|
||||
_, err := New(&cfg, testLogger())
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing WinRM host")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "winrm_host is required") {
|
||||
t.Errorf("expected 'winrm_host is required' error, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIISConnector_New_WinRMMode_MissingUsername(t *testing.T) {
|
||||
cfg := Config{
|
||||
Mode: "winrm",
|
||||
WinRM: WinRMConfig{
|
||||
Host: "server.example.com",
|
||||
Password: "pass",
|
||||
},
|
||||
}
|
||||
_, err := New(&cfg, testLogger())
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing WinRM username")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "winrm_username is required") {
|
||||
t.Errorf("expected 'winrm_username is required' error, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIISConnector_New_WinRMMode_MissingPassword(t *testing.T) {
|
||||
cfg := Config{
|
||||
Mode: "winrm",
|
||||
WinRM: WinRMConfig{
|
||||
Host: "server.example.com",
|
||||
Username: "admin",
|
||||
},
|
||||
}
|
||||
_, err := New(&cfg, testLogger())
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing WinRM password")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "winrm_password is required") {
|
||||
t.Errorf("expected 'winrm_password is required' error, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIISConnector_New_InvalidMode(t *testing.T) {
|
||||
cfg := Config{Mode: "ssh"}
|
||||
_, err := New(&cfg, testLogger())
|
||||
if err == nil {
|
||||
t.Fatal("expected error for invalid mode")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "unsupported IIS connector mode") {
|
||||
t.Errorf("expected 'unsupported IIS connector mode' error, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIISConnector_New_DefaultLocalMode(t *testing.T) {
|
||||
cfg := Config{} // No mode specified — should default to local
|
||||
connector, err := New(&cfg, testLogger())
|
||||
if err != nil {
|
||||
t.Fatalf("New() with default mode failed: %v", err)
|
||||
}
|
||||
if connector == nil {
|
||||
t.Fatal("expected non-nil connector")
|
||||
}
|
||||
}
|
||||
|
||||
func TestWinRMConfig_DefaultPorts(t *testing.T) {
|
||||
// HTTP default: 5985
|
||||
cfg := &WinRMConfig{
|
||||
Host: "server.example.com",
|
||||
Username: "admin",
|
||||
Password: "pass",
|
||||
}
|
||||
exec, err := newWinRMExecutor(cfg)
|
||||
if err != nil {
|
||||
t.Fatalf("newWinRMExecutor failed: %v", err)
|
||||
}
|
||||
if exec == nil {
|
||||
t.Fatal("expected non-nil executor")
|
||||
}
|
||||
|
||||
// HTTPS default: 5986
|
||||
cfgHTTPS := &WinRMConfig{
|
||||
Host: "server.example.com",
|
||||
Username: "admin",
|
||||
Password: "pass",
|
||||
UseHTTPS: true,
|
||||
Insecure: true,
|
||||
}
|
||||
execHTTPS, err := newWinRMExecutor(cfgHTTPS)
|
||||
if err != nil {
|
||||
t.Fatalf("newWinRMExecutor (HTTPS) failed: %v", err)
|
||||
}
|
||||
if execHTTPS == nil {
|
||||
t.Fatal("expected non-nil HTTPS executor")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
package iis
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/masterzen/winrm"
|
||||
)
|
||||
|
||||
// WinRMConfig holds WinRM connection settings for remote IIS management.
|
||||
// Used when Mode is "winrm" — the proxy agent connects to a remote Windows
|
||||
// server over WinRM and executes PowerShell commands remotely.
|
||||
type WinRMConfig struct {
|
||||
Host string `json:"winrm_host"` // WinRM target hostname or IP (required)
|
||||
Port int `json:"winrm_port"` // WinRM port (default 5985 for HTTP, 5986 for HTTPS)
|
||||
Username string `json:"winrm_username"` // Windows user (e.g., "Administrator")
|
||||
Password string `json:"winrm_password"` // Windows password
|
||||
UseHTTPS bool `json:"winrm_https"` // Use HTTPS (port 5986) instead of HTTP (port 5985)
|
||||
Insecure bool `json:"winrm_insecure"` // Skip TLS certificate verification (for self-signed certs)
|
||||
Timeout int `json:"winrm_timeout"` // Operation timeout in seconds (default 60)
|
||||
}
|
||||
|
||||
// winrmExecutor implements PowerShellExecutor by running PowerShell commands
|
||||
// on a remote Windows server via WinRM. This enables the proxy agent pattern:
|
||||
// a Linux agent in the same network zone manages Windows IIS servers remotely.
|
||||
type winrmExecutor struct {
|
||||
client *winrm.Client
|
||||
}
|
||||
|
||||
// newWinRMExecutor creates a WinRM client and returns a PowerShellExecutor.
|
||||
func newWinRMExecutor(cfg *WinRMConfig) (*winrmExecutor, error) {
|
||||
if cfg.Host == "" {
|
||||
return nil, fmt.Errorf("winrm_host is required for WinRM mode")
|
||||
}
|
||||
if cfg.Username == "" {
|
||||
return nil, fmt.Errorf("winrm_username is required for WinRM mode")
|
||||
}
|
||||
if cfg.Password == "" {
|
||||
return nil, fmt.Errorf("winrm_password is required for WinRM mode")
|
||||
}
|
||||
|
||||
port := cfg.Port
|
||||
if port == 0 {
|
||||
if cfg.UseHTTPS {
|
||||
port = 5986
|
||||
} else {
|
||||
port = 5985
|
||||
}
|
||||
}
|
||||
|
||||
timeout := time.Duration(cfg.Timeout) * time.Second
|
||||
if cfg.Timeout == 0 {
|
||||
timeout = 60 * time.Second
|
||||
}
|
||||
|
||||
endpoint := winrm.NewEndpoint(
|
||||
cfg.Host,
|
||||
port,
|
||||
cfg.UseHTTPS,
|
||||
cfg.Insecure,
|
||||
nil, // CA cert
|
||||
nil, // Client cert
|
||||
nil, // Client key
|
||||
timeout,
|
||||
)
|
||||
|
||||
client, err := winrm.NewClient(endpoint, cfg.Username, cfg.Password)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create WinRM client: %w", err)
|
||||
}
|
||||
|
||||
return &winrmExecutor{client: client}, nil
|
||||
}
|
||||
|
||||
// Execute runs a PowerShell script on the remote Windows server via WinRM.
|
||||
// The script is wrapped in powershell.exe invocation on the remote side.
|
||||
func (e *winrmExecutor) Execute(ctx context.Context, script string) (string, error) {
|
||||
// RunPSWithContext returns (stdout, stderr, exitCode, error)
|
||||
stdout, stderr, exitCode, err := e.client.RunPSWithContext(ctx, script)
|
||||
if err != nil {
|
||||
return stdout + stderr, fmt.Errorf("WinRM command failed: %w", err)
|
||||
}
|
||||
if exitCode != 0 {
|
||||
return stdout + stderr, fmt.Errorf("PowerShell exited with code %d: %s", exitCode, stdout+stderr)
|
||||
}
|
||||
|
||||
return stdout, nil
|
||||
}
|
||||
@@ -164,11 +164,16 @@ export default function TargetDetailPage() {
|
||||
<h3 className="text-sm font-semibold text-ink-muted mb-4">Configuration</h3>
|
||||
{target.config && Object.keys(target.config).length > 0 ? (
|
||||
<div className="space-y-0">
|
||||
{Object.entries(target.config).map(([key, val]) => (
|
||||
<InfoRow key={key} label={key.replace(/_/g, ' ')} value={
|
||||
<span className="font-mono text-xs truncate max-w-xs inline-block">{String(val)}</span>
|
||||
} />
|
||||
))}
|
||||
{Object.entries(target.config).map(([key, val]) => {
|
||||
const sensitiveKeys = ['password', 'secret', 'token', 'key', 'winrm_password'];
|
||||
const isSensitive = sensitiveKeys.some(s => key.toLowerCase().includes(s));
|
||||
const displayVal = isSensitive && val ? '********' : String(val);
|
||||
return (
|
||||
<InfoRow key={key} label={key.replace(/_/g, ' ')} value={
|
||||
<span className="font-mono text-xs truncate max-w-xs inline-block">{displayVal}</span>
|
||||
} />
|
||||
);
|
||||
})}
|
||||
</div>
|
||||
) : (
|
||||
<div className="text-sm text-ink-faint py-4 text-center">No configuration data</div>
|
||||
|
||||
@@ -27,7 +27,7 @@ const TARGET_TYPES = [
|
||||
{ value: 'traefik', label: 'Traefik', description: 'File provider deployment — writes cert/key to watched directory, auto-reload' },
|
||||
{ value: 'caddy', label: 'Caddy', description: 'Admin API hot-reload or file-based deployment with configurable mode' },
|
||||
{ value: 'f5_bigip', label: 'F5 BIG-IP', description: 'iControl REST via proxy agent (V3 implementation)' },
|
||||
{ value: 'iis', label: 'IIS', description: 'Windows IIS via agent-local PowerShell or proxy WinRM (V3 implementation)' },
|
||||
{ value: 'iis', label: 'IIS', description: 'Windows IIS via agent-local PowerShell or remote WinRM proxy agent' },
|
||||
];
|
||||
|
||||
const CONFIG_FIELDS: Record<string, { key: string; label: string; placeholder: string; required?: boolean }[]> = {
|
||||
@@ -67,9 +67,18 @@ const CONFIG_FIELDS: Record<string, { key: string; label: string; placeholder: s
|
||||
],
|
||||
iis: [
|
||||
{ key: 'site_name', label: 'IIS Site Name', placeholder: 'Default Web Site', required: true },
|
||||
{ key: 'binding_ip', label: 'Binding IP', placeholder: '*' },
|
||||
{ key: 'binding_port', label: 'Binding Port', placeholder: '443' },
|
||||
{ key: 'cert_store', label: 'Certificate Store', placeholder: 'My' },
|
||||
{ key: 'cert_store', label: 'Certificate Store', placeholder: 'My', required: true },
|
||||
{ key: 'port', label: 'HTTPS Port', placeholder: '443' },
|
||||
{ key: 'ip_address', label: 'Binding IP', placeholder: '*' },
|
||||
{ key: 'binding_info', label: 'Host Header (SNI)', placeholder: 'www.example.com' },
|
||||
{ key: 'sni', label: 'Enable SNI', placeholder: 'true or false' },
|
||||
{ key: 'mode', label: 'Deployment Mode', placeholder: 'local (default) or winrm' },
|
||||
{ key: 'winrm.winrm_host', label: 'WinRM Host (remote mode)', placeholder: 'iis-server.example.com' },
|
||||
{ key: 'winrm.winrm_port', label: 'WinRM Port', placeholder: '5985 (HTTP) or 5986 (HTTPS)' },
|
||||
{ key: 'winrm.winrm_username', label: 'WinRM Username', placeholder: 'Administrator' },
|
||||
{ key: 'winrm.winrm_password', label: 'WinRM Password', placeholder: '(sensitive)' },
|
||||
{ key: 'winrm.winrm_https', label: 'WinRM Use HTTPS', placeholder: 'true or false' },
|
||||
{ key: 'winrm.winrm_insecure', label: 'WinRM Skip TLS Verify', placeholder: 'false' },
|
||||
],
|
||||
};
|
||||
|
||||
|
||||
Reference in New Issue
Block a user