Chris Thach
5481586a57
VNet SSH will dial direct with user cert before falling back to legacy per-session MFA cert ( #66584 )
...
* Cherry-pick in-band MFA support changes for VNet that do no depend on x/crypto/ssh.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Use cached client.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Migrate to mfav2 after rebase.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
2026-05-29 23:43:16 +00:00
306b6a9db0
Set Teleport version in SSH clients ( #65004 )
...
* Set Teleport version in SSH clients.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add more tests. Fix lint.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix import. Fix lint exclude.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix lint - come on!
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix race by making a defensive copy.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Use ErrorIs.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Deep clone client conf. Early return for err. Make consistent.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Return new conf if nil. Add trace.Wrap to missing.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add IsSSHFeatureSupported. Switch from api to api_test for test pack. Make prefix exported const.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Revert accidental commit.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Return sentinel error for older clients or non-teleport clients to improve downstream handling.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Clean up.
Co-authored-by: Chris Thach <chris.thach@protonmail.com >
* Apply suggestions from code review
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@gmail.com >
* Remove defensive check.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Change from trace.BadParam to reg error.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Use strings.Cut and improve readability.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Use error struct.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add test that errors if ssh.ClientConfig changes.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Move to subpackage.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Use static assertion instead.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Return error if config is nil.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Allow clients to override client version via config.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix test because I forgot to update it.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Move assert to test file.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Remove error return val.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Relax parser to allow for more.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix lint.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* WIP take on a tracessh wrapper. Will fail CI.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add tests and polish new package.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Revert changes to tracessh. Add lint config.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Revert changes to use tracessh.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Delete extra s.
Co-authored-by: Chris Thach <chris.thach@protonmail.com >
* Apply suggestions from code review.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add IsEmpty helper methods.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* First pass of refactoring.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Second pass refactor.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Third pass refactor.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix nil panic.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix missing user value.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix missing User value.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Remove Get from name. Polish.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix incorrect signers for clients. Make changes consistent.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Allow ClientConfig to be empty in proxy config.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix eager signers regression in generateClientConfig.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add edge case for space after prefix.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix issues from code review.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Drop suffix. Update comments.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Update ClientConfig docs.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add warning about using the Teleport version.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Teleport version is mandatory.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Revert timeout to make Claude/Codex happy.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Remove alias in places that didn't need it. Revert lib/cloud/gcp/alloydb.go.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add wrapper for tracessh.Client.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Add tests for generate client config.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Drop config from field name to shorten.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
* Fix lint issues.
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com >
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@gmail.com >
2026-04-07 18:06:00 +00:00
Tiago Silva and Edoardo Spadolini
2ae3a21a51
fix: prevent crypto/ssh to block on dialing ( #59967 )
...
* fix: prevent `crypto/ssh` to block on dialing
`crypto/ssh` dialing doesn't support timeouts or context cancellation
propagation by default. Although `ssh.ClientConfig` has a field
`Timeout`, this field is only used when establishing a new TCP
connection but it's never used for ssh handshake.
This means that if the target server never replies and no intermediary
closes the connection, the connecton will be kept alive forever causing
Teleport dialer to deadlock and never recover.
Although teleport `ssh` package has `NewClientConnWithDeadline`, not all
every Teleport implementation of `net.Conn` supports read deadlines,
which means we can have cases where the system also deadlocks when using
`NewClientConnWithDeadline` and a timeout.
This PR tries to solve it by closing the underlying connection when the
minimum time between the context's deadline, the timeout and if none set
30s.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com >
* Apply suggestion from @espadolini
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com >
* fix code
* rename methods to correctly describe the behavior
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com >
* handle code review comment
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com >
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com >
2025-10-10 14:00:39 +00:00
Nic Klaassen
2fbfab7b03
[vnet] feat: support proxy recording mode with VNet SSH ( #55788 )
...
* [vnet] feat: support proxy recording mode with VNet SSH
* enforce setSessionKey called at most once
* add comments
* minor edit
2025-06-20 16:07:29 +00:00
Nic Klaassen
1a9d4fc349
[vnet] fix: support <hostname>.<leaf-cluster> for VNet SSH ( #55688 )
2025-06-13 16:26:36 +00:00
Nic Klaassen
4fb2fedf04
[vnet] feat: forward SSH connections to target ( #55156 )
2025-05-31 16:24:04 +00:00
Nic Klaassen
1ef6c32791
[vnet] feat: accept incoming SSH connections ( #55155 )
2025-05-31 15:04:23 +00:00
Nic Klaassen
b420b4f1cc
[vnet] feat: TCP dial to SSH targets ( #55087 )
...
* [vnet] feat: TCP dial to SSH targets
* address tim's comments
* fix teleterm UserTLSCert impl
* check that tlsCert.Certificate is not empty
2025-05-31 01:55:19 +00:00
Chris Thach