* Update type for targetSubresourceName on DocumentGateway
The way DocumentsService.createGatewayDocument is implemented means that
the targetSubresourceName property is always present, but it can be undefined.
* Use "local port" instead of "port" in DocumentGatewapApp
* Rewrite gateway FieldInputs to use styled components
* Update comments in protos
* useGateway: Stabilize useAsync functions of ports
* Add padding to menu label if it's first child
* Add support for required prop to Input and FieldInput
* Add UI for changing target port
* ActionButtons: Show ports of multi-port apps when VNet is not supported
Now that we have support for the target port in Connect's gateways, we
can show the ports and then open a gateway for that specific port on
click.
* Add RWMutex to gateways
* Clear app gateway cert on target port change
* Remove gateways/app.LocalProxyURL
It was used only in tests and it made sense only for web apps anyway.
* TestTCP: Close connections when test ends
* Create context with timeout in testGatewayCertRenewal
…instead of in each function that uses it.
* Add tests for changing the target port of a TCP gateway
* Parallelize app gateway tests within MFA/non-MFA groups
* Make testGatewayConnection take ctx as first arg
This will be needed in tests that check target port validation.
* Validate target port of app gateways
* Increase timeouts in app gateway tests
* Change icons from medium to small
* Use consistent spacing in AppGateway
* Add godoc for ValidateTargetPort
* Add retry with relogin to change target port
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* feat(events): add event indexer based on time
* chore(events): code review changes
* chore: typos
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* chore: code review changes
* test(integration): ignore index field on audit events
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
The Cf-Access-Token header seems to be a infrequently used header that can
easily increase the size of the header by `len(roles) + len(traits)`, which
can cause problems. Users are able to add this in on their own if they need
it using header rewriting, so we'll remove this.
This PR replaces the usage of `gravitational/oxy.Forwarder` in our codebase with `httputil.ReverseProxy`.
`httputil.ReverseProxy` is part of Go's standard library and thus it is
maintained by the Go team. Converting everything to use the std lib
allows us to drop our `oxy` fork.
There are some operational changes between the two versions:
1. `httputil.ReverseProxy` handles WebSockets upgrades internally and
reuses the `Transport` provided for the initial request. Thus, it does
not require any special dialer or rewriter mechanisms for WebSockets only.
2. `httputil.ReverseProxy` calls the `ErrorHandler` with the request
after it was rewritten and after roundtrip was called. This was a
problem because our `web.transport` deletes Teleport associated
cookies and when the request failed, the request received by the
`ErrorHandler` missed the cookies to generate a new session. This was
fixed by cloning the request at `web.transport` round tripper.
3. `httputil.ReverseProxy` uses std's `log.Logger`. `logrus` exposes a
method `Writer` that allows it to be used with standard lib logger.
The API is similar to what our `oxy` fork has available.
Fixes#27412
* Add full IP pinning enforcement
We're adding IP pinning check to `authorizer.Authorize` which is used for every call,
so now all communications with teleport should enforce IP pinning.
Also making sure we always provide login IP for user certificate creation
and correct client IP propagation everywhere.
* Add integration test for App IP pinning.
* Fix wording
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Wrap error
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Add godocs
* Clone TLS config
* Improve proxyHeaderSigner usage
* Wider use proxyHeaderDialer and remove adhoc writing of singed header
* Add helper function TLSDial
* Use proxyHeader dialer in authConnect
* Simplify tlsConfig manipulation
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Remove redundant channels processing in TLSDial
* Reduce nesting
* Update generated protobufs
* Remove ignoring of bad IP on signed PROXY header generation
* Provide logger to CheckIPPinning function
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Move configuration from lib/service to lib/service/servicecfg
The new servicecfg package will hold only configuration for services.
This will allow other packages (like tctl and tsh) to depend on
servicecfg without pulling in all of lib/service (which has a number
of platform-specific details).
This is the first step towards being able to build tctl for Windows.
* Move PAM and BPF config into servicecfg
This breaks a compile-time dependency on BPF/PAM for tctl.
* Add x-teleport-api-error to reserved headers
* Update app tests for rewritten headers
* Add test case for x-teleport-api-error
* Fix test for XForwardedSsl since it was effectively untested before
* Refactor leaf test to parse the response from dumper app
* Update docs reference reserved headers
The "tets bundling" introduced in TesAppAccess() made TestAppInvalidateAppSessionsOnLogout test very unstable as other tests are modifying the state of the whole suit.
Removing the test from the bundle seems to fix it.
The TestTCPCertExpiration test may have a race condition where the connection
made to the test application immediately after the cert expiry may succeed.
Due to the wonky nature of using the fake clock in this test, I'm introducing
a requires.Eventually here to hopefully mitigate this race.
The CertificateTTL causes problems after the introduction of the fake clock
into the appaccess tests due to the fake clock not being propagated properly
throughout the Teleport stack. Increasing the TTL should make this test much
less flaky.
The appaccess TestTCP* tests are highly reliant on time. This has been
reduced (but not eliminated) by using a fakeClock and a channel for
signaling monitor triggered connection closures.
Application access connection monitoring has been introduced so that, when a
lock is created, application access connections will be interrupted until the
lock has been cleared. This includes web sockets and TCP applications.
Application sessions were previously only logged when launching an application
session via the UI, and not from the `tsh app login` command. This has been
corrected. The AppName and AppURI are now passed in as part of the gRPC
request to the auth server, which is then used to emit the audit event.
Rafał Cieślak