* disable tls client resumption
* avoid redundant verification in TLSDial
* fix wrong use of InsecureSkipVerify in HTTP auth client
* avoid overwriting GetClientCertificate in api client
* Use a getter function for CAs in TunnelAuthDialer
* Use dynamic connector data for the agent's auth client
* Make getPROXYSigner dynamic
* WIP: the thing (reloadless)
* Fix TestInstanceCertReissue
* Fix TestIntegrations/RotateFoo
* get rid of the whole reload mechanism
* Update most tests to not check for reloads
* Get rid of TestDatabaseAccess/RotateTrustedCluster
The test has been unconditionally skipped for two years now.
* avoid clobbering the auth connector
* overwrite clientState in update_servers anyway
* fix integration/hsm tests
* Document ListenForNewEvent
* fix RunWithSignalChannel godoc
* simplify ListenForNewEvents
* Remove forgotten commented code
* Explain the t.Setenv trick for non-parallelism
* explain waitingForNewEvent in integration/hsm
* Add full IP pinning enforcement
We're adding IP pinning check to `authorizer.Authorize` which is used for every call,
so now all communications with teleport should enforce IP pinning.
Also making sure we always provide login IP for user certificate creation
and correct client IP propagation everywhere.
* Add integration test for App IP pinning.
* Fix wording
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Wrap error
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Add godocs
* Clone TLS config
* Improve proxyHeaderSigner usage
* Wider use proxyHeaderDialer and remove adhoc writing of singed header
* Add helper function TLSDial
* Use proxyHeader dialer in authConnect
* Simplify tlsConfig manipulation
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Remove redundant channels processing in TLSDial
* Reduce nesting
* Update generated protobufs
* Remove ignoring of bad IP on signed PROXY header generation
* Provide logger to CheckIPPinning function
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
By specifying `device_attestation_cas` in `teleport.yaml`, admins can
restrict U2F device manufacturers. For example, specifying the yubico
attestation CA
(https://developers.yubico.com/U2F/yubico-u2f-ca-certs.txt), you can
restrict users to only yubikeys.
Example error when using the yubico CA and trying to register a Google
Titan key:
```
$ tsh mfa add --type u2f --name test && tsh mfa rm test
Tap any *registered* security key
Tap your *new* security key
ERROR: rpc error: code = InvalidArgument desc = U2F device attestation certificate is signed by "CN=Security Key,O=Google", but this cluster only accepts certificates from ["CN=Yubico U2F Root CA Serial 457200631"]; make sure you're using a U2F device from a trusted manufacturer
```
rosstimothy