F #2152: Restrict SSH agent forwarding (#4611)

Signed-off-by: Petr Ospalý <pospaly@opennebula.io>

src/mad/sh/scripts_common.sh

@@ -45,9 +45,11 @@ RBD=${RBD:-rbd}
 READLINK=${READLINK:-readlink}
 RM=${RM:-rm}
 CP=${CP:-cp}
-SCP=${SCP:-scp -o ForwardAgent=yes}
+SCP=${SCP:-scp}
+SCP_FWD=${SCP_FWD:-scp -o ForwardAgent=yes}
 SED=${SED:-sed}
-SSH=${SSH:-ssh -o ForwardAgent=yes}
+SSH=${SSH:-ssh}
+SSH_FWD=${SSH_FWD:-ssh -o ForwardAgent=yes}
 SUDO=${SUDO:-sudo -n}
 SYNC=${SYNC:-sync}
 TAR=${TAR:-tar}
@@ -361,6 +363,26 @@ function mkfs_command {
     fi
 }
 
+# This function will accept command as an argument for which it will override
+# the env. variables SSH and SCP with their agent forwarding alternative
+ssh_forward()
+{
+    _ssh_cmd_saved="$SSH"
+    _scp_cmd_saved="$SCP"
+
+    SSH="$SSH_FWD"
+    SCP="$SCP_FWD"
+
+    "$@"
+
+    _ssh_forward_result=$?
+
+    SSH="$_ssh_cmd_saved"
+    SCP="$_scp_cmd_saved"
+
+    return $_ssh_forward_result
+}
+
 #This function executes $2 at $1 host and report error $3 but does not exit
 function ssh_exec_and_log_no_error
 {

src/tm_mad/ceph/premigrate

@@ -76,7 +76,7 @@ $TAR -C $DST_PATH_DIRNAME --sparse -cf - $DST_PATH_BASENAME | $SSH $DST_HOST '$T
 EOF
 )
 
-ssh_exec_and_log "$SRC_HOST" "$TAR_SSH" "Error copying disk directory to target host"
+ssh_forward ssh_exec_and_log "$SRC_HOST" "$TAR_SSH" "Error copying disk directory to target host"
 
 migrate_other "$@"
 

src/tm_mad/ssh/clone

@@ -80,10 +80,10 @@ ORIGINAL_SIZE="${XPATH_ELEMENTS[j++]}"
 # Copy files to the remote host
 #-------------------------------------------------------------------------------
 log "Cloning $SRC in $DST_PATH"
-exec_and_log "$SCP -r $SRC $DST" "Error copying $SRC to $DST"
+ssh_forward exec_and_log "$SCP -r $SRC $DST" "Error copying $SRC to $DST"
 
 if [ -d "${SRC_PATH_SNAP}" ]; then
-    exec_and_log "$SCP -r $SRC_HOST:${SRC_PATH_SNAP} $DST_HOST:${DST_PATH_SNAP}" \
+    ssh_forward exec_and_log "$SCP -r $SRC_HOST:${SRC_PATH_SNAP} $DST_HOST:${DST_PATH_SNAP}" \
         "Error copying $SRC to $DST"
 fi
 

src/tm_mad/ssh/cpds

@@ -119,6 +119,6 @@ EOF
 fi
 
 log "Moving $SRC to datastore as $DST"
-exec_and_log "$SCP -r $SRC $DST" "Error copying $SRC to $DST"
+ssh_forward exec_and_log "$SCP -r $SRC $DST" "Error copying $SRC to $DST"
 
 exit 0

src/tm_mad/ssh/mv

@@ -95,6 +95,6 @@ rm -rf $SRC_PATH
 EOF
 )
 
-ssh_exec_and_log "$SRC_HOST" "$TAR_SSH" "Error copying disk directory to target host"
+ssh_forward ssh_exec_and_log "$SRC_HOST" "$TAR_SSH" "Error copying disk directory to target host"
 
 exit 0

src/tm_mad/ssh/mvds

@@ -49,7 +49,7 @@ DST_SNAP="${DST}.snap"
 #-------------------------------------------------------------------------------
 
 log "Moving $SRC to datastore as $DST"
-exec_and_log "$SCP -r $SRC $DST" "Error copying $SRC to $DST"
+ssh_forward exec_and_log "$SCP -r $SRC $DST" "Error copying $SRC to $DST"
 
 if $SSH $SRC_HOST ls ${SRC_PATH_SNAP} >/dev/null 2>&1; then
     exec_and_log "rsync -r --delete ${SRC_HOST}:${SRC_PATH_SNAP}/ ${DST_SNAP}"