feat: allow to read ssh passphrase from keyring

dialer/ssh/metadata.go

@@ -1,11 +1,13 @@
 package ssh
 
 import (
+	"fmt"
 	"os"
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
 	mdutil "github.com/go-gost/core/metadata/util"
+	"github.com/zalando/go-keyring"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -20,9 +22,10 @@ type metadata struct {
 
 func (d *sshDialer) parseMetadata(md mdata.Metadata) (err error) {
 	const (
-		handshakeTimeout = "handshakeTimeout"
-		privateKeyFile   = "privateKeyFile"
-		passphrase       = "passphrase"
+		handshakeTimeout      = "handshakeTimeout"
+		privateKeyFile        = "privateKeyFile"
+		passphrase            = "passphrase"
+		passphraseFromKeyring = "passphraseFromKeyring"
 	)
 
 	if key := mdutil.GetString(md, privateKeyFile); key != "" {
@@ -31,10 +34,19 @@ func (d *sshDialer) parseMetadata(md mdata.Metadata) (err error) {
 			return err
 		}
 
-		if pp := mdutil.GetString(md, passphrase); pp != "" {
-			d.md.signer, err = ssh.ParsePrivateKeyWithPassphrase(data, []byte(pp))
+		var pp string
+		if mdutil.GetBool(md, "passphraseFromKeyring") {
+			pp, err = keyring.Get(fmt.Sprintf("SSH %s", key), d.options.Auth.Username())
+			if err != nil {
+				return fmt.Errorf("unable to get secret(%s) from keyring: %w", key, err)
+			}
 		} else {
+			pp = mdutil.GetString(md, passphrase)
+		}
+		if pp == "" {
 			d.md.signer, err = ssh.ParsePrivateKey(data)
+		} else {
+			d.md.signer, err = ssh.ParsePrivateKeyWithPassphrase(data, []byte(pp))
 		}
 		if err != nil {
 			return err

dialer/sshd/metadata.go

@@ -1,11 +1,13 @@
 package sshd
 
 import (
+	"fmt"
 	"os"
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
 	mdutil "github.com/go-gost/core/metadata/util"
+	"github.com/zalando/go-keyring"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -31,7 +33,15 @@ func (d *sshdDialer) parseMetadata(md mdata.Metadata) (err error) {
 			return err
 		}
 
-		pp := mdutil.GetString(md, passphrase)
+		var pp string
+		if mdutil.GetBool(md, "passphraseFromKeyring") {
+			pp, err = keyring.Get(fmt.Sprintf("SSH %s", key), key)
+			if err != nil {
+				return fmt.Errorf("unable to get secret(%s) from keyring: %w", key, err)
+			}
+		} else {
+			pp = mdutil.GetString(md, passphrase)
+		}
 		if pp == "" {
 			d.md.signer, err = ssh.ParsePrivateKey(data)
 		} else {