internalcaddyssh

type Actor struct {
	// The set of matchers consulted to know whether the Actor should act on a session
	MatcherSetsRaw RawActorMatcherSet `json:"match,omitempty" caddy:"namespace=ssh.actor_matchers"`

	// The actor that shall act on the matched session.
	// "act": {
	// 		"action": "<actor name>"
	// 		... actor config
	// }
	ActorRaw json.RawMessage `json:"act,omitempty" caddy:"namespace=ssh.actors inline_key=action"`

	// Whether the session shoul be closed upon execution of the actor
	Final bool `json:"final,omitempty"`
	// contains filtered or unexported fields
}

type ActorList []Actor

type ActorMatcher interface {
	ShouldAct(session.ActorMatchingContext) bool
}

type ActorMatcherSet []ActorMatcher

type ActorMatcherSets []ActorMatcherSet

type ConfigList []Configurator

type ConfigMatcher interface {
	ShouldConfigure(session.ConnConfigMatchingContext) bool
}

type ConfigMatcherSet []ConfigMatcher

type ConfigMatcherSets []ConfigMatcherSet

type Configurator struct {
	// The set of matchers consulted to know whether the Actor should act on a session
	MatcherSetsRaw RawConfigMatcherSet `json:"match,omitempty" caddy:"namespace=ssh.config_matchers"`

	// The config provider that shall configure the server for the matched session.
	// "config": {
	// 		"loader": "<actor name>"
	// 		... config loader config
	// }
	ConfiguratorRaw json.RawMessage `json:"config,omitempty" caddy:"namespace=ssh.config.loaders inline_key=loader"`
	// contains filtered or unexported fields
}

type MatchConfigLocalIP struct {
	// The IPs or CIDR ranges to match.
	Ranges []string `json:"ranges,omitempty"`
	// contains filtered or unexported fields
}

type MatchConfigNot struct {
	MatcherSetsRaw []caddy.ModuleMap  `json:"-" caddy:"namespace=ssh.config_matchers"`
	MatcherSets    []ConfigMatcherSet `json:"-"`
}

type MatchConfigRemoteIP struct {
	// The IPs or CIDR ranges to match.
	Ranges []string `json:"ranges,omitempty"`
	// contains filtered or unexported fields
}

type MatchCriticalOption map[string][]string

type MatchExtension map[string][]string

type MatchGroup struct {
	Groups []string `json:"groups,omitempty"`
	// contains filtered or unexported fields
}

type MatchNot struct {
	MatcherSetsRaw []caddy.ModuleMap `json:"-" caddy:"namespace=ssh.actor_matchers"`
	MatcherSets    []ActorMatcherSet `json:"-"`
}

type MatchRemoteIP struct {
	// The IPs or CIDR ranges to match.
	Ranges []string `json:"ranges,omitempty"`
	// contains filtered or unexported fields
}

type MatchUser struct {
	Users []string `json:"users,omitempty"`
	// contains filtered or unexported fields
}

type ProvidedConfig struct {
	// The session signers to be loaded. The field takes the form:
	// "signer": {
	// 		"module": "<signer module name>"
	// 		... signer module config
	// }
	// If empty, the default module is "fallback", which will load existing keys, or generates and stores them if non-existent.
	SignerRaw json.RawMessage `json:"signer,omitempty"  caddy:"namespace=ssh.signers inline_key=module"`

	// The allowed key exchanges algorithms. If unspecified then a
	// default set of algorithms is used.
	// WARNING: don't set it to anyting (not even empty array) unless you know the risks!
	KeyExchanges []string `json:"key_exchanges,omitempty"`

	// The allowed cipher algorithms. If unspecified then a sensible
	// default is used.
	// WARNING: don't set it to anyting (not even empty array) unless you know the risks!
	Ciphers []string `json:"ciphers,omitempty"`

	// The allowed MAC algorithms. If unspecified then a sensible default
	// is used.
	// WARNING: don't set it to anyting (not even empty array) unless you know the risks!
	MACs []string `json:"ma_cs,omitempty"`

	// NoClientAuth is true if clients are allowed to connect without
	// authenticating.
	NoClientAuth bool `json:"no_client_auth,omitempty"`

	// MaxAuthTries specifies the maximum number of authentication attempts
	// permitted per connection. If set to a negative number, the number of
	// attempts are unlimited. If set to zero, the number of attempts are limited
	// to 6.
	MaxAuthTries int `json:"max_auth_tries,omitempty"`

	// This holds the authentication suite for the various flows
	Authentication *authentication.Config `json:"authentication,omitempty"`

	// ServerVersion is the version identification string to announce in
	// the public handshake.
	// If empty, a reasonable default is used.
	// Note that RFC 4253 section 4.2 requires that this string start with
	// "SSH-2.0-".
	ServerVersion string `json:"server_version,omitempty"`
	// contains filtered or unexported fields
}

type RawActorMatcherSet []caddy.ModuleMap

type RawConfigMatcherSet []caddy.ModuleMap

type SSH struct {
	// GracePeriod is the duration a server should wait for open connections to close during shutdown
	// before closing them forcefully
	GracePeriod caddy.Duration `json:"grace_period,omitempty"`

	// The set of ssh servers keyed by custom names
	Servers map[string]*Server `json:"servers,omitempty"`
	// contains filtered or unexported fields
}

type Server struct {
	// Socket addresses to which to bind listeners. Accepts
	// [network addresses](/docs/conventions#network-addresses)
	// that may include port ranges. Listener addresses must
	// be unique; they cannot be repeated across all defined
	// servers. TCP is the only acceptable network (for now, perhaps).
	Address string `json:"address,omitempty"`

	// The configuration of local-forward permission module. The config structure is:
	// "localforward": {
	// 		"forward": "<module name>"
	// 		... config
	// }
	// defaults to: { "forward": "deny" }
	LocalForwardRaw json.RawMessage `json:"localforward,omitempty" caddy:"namespace=ssh.ask.localforward inline_key=forward"`

	// The configuration of reverse-forward permission module. The config structure is:
	// "reverseforward": {
	// 		"forward": "<module name>"
	// 		... config
	// }
	// defaults to: { "reverseforward": "deny" }
	ReverseForwardRaw json.RawMessage `json:"reverseforward,omitempty" caddy:"namespace=ssh.ask.reverseforward inline_key=forward"`

	// The configuration of PTY permission module. The config structure is:
	// "pty": {
	// 		"pty": "<module name>"
	// 		... config
	// }
	// defaults to: { "forward": "deny" }
	PtyAskRaw json.RawMessage `json:"pty,omitempty" caddy:"namespace=ssh.ask.pty inline_key=pty"`

	// connection timeout when no activity, none if empty
	IdleTimeout caddy.Duration `json:"idle_timeout,omitempty"`
	// absolute connection timeout, none if empty
	MaxTimeout caddy.Duration `json:"max_timeout,omitempty"`

	// The configuration of the authorizer module. The config structure is:
	// "authorize": {
	// 		"authorizer": "<module name>"
	// 		... config
	// }
	// default to: { "authorizer": "public" }.
	AuthorizeRaw json.RawMessage `json:"authorize,omitempty" caddy:"namespace=ssh.session.authorizers inline_key=authorizer"`

	// The list of defined subsystems in a json structure keyed by the arbitrary name of the subsystem.
	// TODO: The current implementation is naive and can be expanded to follow the Authorzation and Actors model
	SubsystemRaw caddy.ModuleMap `json:"subsystems,omitempty" caddy:"namespace=ssh.subsystem"`

	// List of configurators that could configure the server per matchers and config providers
	Config ConfigList `json:"configs,omitempty"`

	// The actors that can act on a session per the matching criteria
	Actors ActorList `json:"actors,omitempty"`
	// contains filtered or unexported fields
}

type ServerConfigurator interface {
	ServerConfigCallback(session.Context) *gossh.ServerConfig
}

type SignerAdder interface {
	AddHostKey(key gossh.Signer)
}

type SignerConfigurator interface {
	Configure(session.Context, SignerAdder)
}