* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
* Docs, utilities and protobuf definitions
* Server implementation
* Client implementation
* Tests
* Log the correct handshake error
* Use constants for stream and application error codes
* Avoid stuttering in const names
* Improve godocs and explanations
* Address test review comments
* Move the QUIC proxy peering envvar check to lib/config
* Move lib/proxy/clusterdial to lib/peer/dial
* Move peer.clientConn to lib/proxy/peer/internal
* Require QUIC peering label to be set to "yes"
* Move peer TLS verification funcs to lib/proxy/peer/internal
* Move QUICServer to lib/proxy/peer/quic
* Avoid stuttering in lib/proxy/peer/quic
* Remove useless quic.ServerConfig.CipherSuites param
* Fix log style in proxy.peer.quic
* Move duplicatePeerMsg into the function scope
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Consolidate resource watchers into a single watcher that leverages
generics. While most of the resource watchers were similar, some
resources have some one off functionality. These watchers have not
been touched, however, all that could be refactored to use the
generic watcher easily were.
* Simplify peer server TLS
* Make the peer clientConn generic
* Mock implementation of QUIC proxy peering
* Convert the peer server to slog
* QUICServer docs
* go mod tidy
* Remove authclient.Client/ClientI/NewClient aliases in lib/auth
* Remove WebSessionReq aliases in lib/auth
* Remove GithubAuthResponse aliases in lib/auth
* Remove GithubAuthRequest aliases in lib/auth
* Remove KubeCSR alias in lib/auth
* Remove KubeCSRResponse alias in lib/auth
* Remove OIDCAuthResponse alias in lib/auth
* Remove OIDCAuthRequest alias in lib/auth
* Remove ValidateOIDCAuthCallbackReq alias in lib/auth
* Remove OIDCAuthRawResponse alias in lib/auth
* Remove CreateUserTokenRequest alias in lib/auth
* Remove SAMLAuthResponse alias in lib/auth
* Remove SAMLAuthRequest alias in lib/auth
* Remove ValidateSAMLResponseReq alias in lib/auth
* Remove SAMLAuthRawResponse alias in lib/auth
* Remove ValidateTrustedClusterRequest alias in lib/auth
* Remove ValidateTrustedClusterRequestRaw alias in lib/auth
* Remove ValidateTrustedClusterResponse alias in lib/auth
* Remove ValidateTrustedClusterResponseRaw alias in lib/auth
* Remove AuthenticateUserRequest alias in lib/auth
* Remove ForwardedClientMetadata alias in lib/auth
* Remove PassCreds alias in lib/auth
* Remove OTPCreds alias in lib/auth
* Remove SessionCreds alias in lib/auth
* Remove AuthenticateSSHRequest alias in lib/auth
* Remove SSHLoginResponse alias in lib/auth
* Remove TrustedCerts alias in lib/auth
* Remove AuthoritiesToTrustedCerts alias in lib/auth
* Move auth.HostFQDN to authclient
* Move auth.WithClusterCAs, auth.DefaultClientCertPool and auth.ClientCertPool to authclient
* Switch alpn proxy to use authclient.CAGetter instead of auth.ReadProxyAccessPoint
* Use a smaller scoped interfaces in lib/proxy/peer to remove lib/auth dependency
* Move auth.TryCreateAppSessionForClientCertV15 to authclient
* Move auth.ErrNoMFADevices to authclient
* Move access point interfaces to authclient. Aliases left behind to prevent breaking builds
* remove lib/auth dependency from lib/reversetunnelclient
* fix lints
* fix license
* Bump e ref to include gravitational/teleport.e#4174
* Use authclient.Client in new tctl diag commands
* Stop using auth.UserTokenType aliases
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
Originally there was a default limit of 100 max concurrent streams, however in 2017 the GRPC team removed this default: https://github.com/grpc/grpc-go/pull/1624
With the recent HTTP/2 Rapid Reset DoS, it is now being encouraged to re-introduce a limit. The fix requires this value to be configured in fact: https://github.com/grpc/grpc-go/pull/6703
* Move gRPC error intercetpors to api/utils/grpc/interceptors.
* Use error interceptors in api client and mock server.
* Apply suggestions from CR.
* Unwrap FromGRPC errors in middleware.
* Use gRPC auth service in tests instead of external example service.
* It's gRPC!!!
* Fix unit test.
* Add error interceptor to proxy client.
* Fix merge conflict.
Closes#23230
Proxy peer clients now validate that any connections established to
a peer have the expected UUID. This prevents clients from connecting
to incorrect peers if the `peer_public_addr` is shared by multiple
proxies, or is a load balancer.
In the event that a connection is established to an incorrect peer
the connection is closed and a error is written to the logs. The
gRPC connection should be attempted multiple times and eventually
land on the correct peer. However there may be some degradation
of service until the peer connections are all properly established.
The interface smuggling within `stream.ReadWriter.Close` now checks
for `io.Closer` instead of `grpc.ClientStream` to allow clients
that need to perform additoinal closing logic besides sending a
`CloseSend` message to do so. All existing client implementations
of `stream.Source` now implement `io.Closer` so they are still
cleaned up properly.
The multiplexed ssh streams are now tied together to prevent attempts
to send a message at the same time. In addition, the client ssh
streams have been updated to only send a single `CloseSend` on which
ever protocol is terminated first.
Completes the service implementation of the transportv1.Service.
Ensures that both SSH and SSH Agent protocols are multiplexed
correctly over the gRPC stream via TestService_ProxySSH.
Part of #19812
Provides a client that can be used to connect to and interact with
the transport service in `lib/srv/transport`. The client abstracts
the fact that a gRPC stream is being used for the `net.Conn` created
by `DialCluster` and `DialHost`.
This also moves `lib/utils/grpc/stream` to `api/utils/grpc/stream`
so that the client and server can make use of the same stream
abstractions.
Part of #19812
The first step in implementing the teleport.proxy.v1.ProxyServic
as defined in RFD 100. This includes part of the service
implementation and a stream abstraction to allow transporting
payloads for frames over a gRPC stream.
The proxy peering specific implementation of the stream abstraction
was refactored into `lib/utils/grpc/stream` so that other services
can make use of it.
Part of #19812
Many of our tests (db package, I'm looking at you) generate many RSA keys. This has two main side effects; makes our tests slow and flaky as CPU usage spikes in random moments when the tests are run in parallel.
This change pre-generates RSA keys at the beginning of each test module and reuse them in randomized order to reduce the situation that one key has been used multiple times in one test.
I had to move a few files to avoid circular dependencies.
* create package to contain proxy peering code
* Refactor proxy routing logic into a reusable object
Routing logic existed within an unexported handler of ssh subsystem
requests, which prevented it from being reused by other components
within the proxy, like the webapi server. This causes significant
latency issues for web sessions because the web apiserver is required
to dial the proxy ssh server to determine how to route to the host.
Since the web apiserver and the proxy ssh server exist in the same
process this is an entirely unnecesarry step that could be avoided
if the routing and ability to established connections were shared
throughout the proxy.
A new `proxy.Router` object is introduced which contains all the
logic that used to exist in `regular.proxySubsys` for determining
how to connect to servers and clusters. All routing within the
`regular.proxySubsys` now leverages the `proxy.Router` to dial
the target.
This is step 1 in addressing #15167. Now that the `proxy.Router`
exists `web.APIServer` will be able to make use of it to avoid
dialing the same process to establish connections.
Alan Parra