* Fix a resource leak in the proxy-node connection
After Dial succeeds to the node, there are a couple of error cases
where we return without closing the connection.
The happy path closes the connection in utils.ProxyConn.
defer is the simplest way to ensure it's closed with any error cases
and the extra close in the happy path does not have a negative effect
* go fmt
The scope of the certificate presented by agents to the reversetunnel
server is now tracked and stored with the remoteConn. Dial requests,
both local and via peers, are now populated with the scope the user
is logged into which the reversetunnel server uses to enforce that
dials for hosts are only honored if the target scope matches.
The ability to alter the auth server clock existed
to allow tests to inject a fake clock. While this sounds
great it introduces opportunity for data races if other
components are already consuming the existing clock. For
example:
```
==================
WARNING: DATA RACE
Write at 0x00c003014720 by goroutine 168:
github.com/gravitational/teleport/lib/auth.(*Server).SetClock()
/__w/teleport.e/teleport.e/lib/auth/auth.go:2308 +0x88
github.com/gravitational/teleport/lib/client_test.newStandaloneTeleport()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:629 +0x11ad
github.com/gravitational/teleport/lib/client_test.newStandaloneTeleport()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:621 +0x1092
github.com/gravitational/teleport/lib/client_test.TestTeleportClient_Login_local.func21()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:290 +0x14e
testing.tRunner()
/opt/go/src/testing/testing.go:1934 +0x21c
testing.(*T).Run.gowrap1()
/opt/go/src/testing/testing.go:1997 +0x44
Previous read at 0x00c003014720 by goroutine 9018:
github.com/gravitational/teleport/lib/auth.(*Server).GenerateHostCerts()
/__w/teleport.e/teleport.e/lib/auth/auth.go:5127 +0x59d
github.com/gravitational/teleport/lib/auth.GenerateIdentity()
/__w/teleport.e/teleport.e/lib/auth/init.go:1606 +0x450
github.com/gravitational/teleport/lib/service.(*TeleportProcess).reRegister()
/__w/teleport.e/teleport.e/lib/service/connect.go:450 +0x25a
github.com/gravitational/teleport/lib/service.(*TeleportProcess).rotate()
/__w/teleport.e/teleport.e/lib/service/connect.go:1160 +0xaa7
github.com/gravitational/teleport/lib/service.(*TeleportProcess).syncServiceRotationState()
/__w/teleport.e/teleport.e/lib/service/connect.go:1017 +0x20b
github.com/gravitational/teleport/lib/service.(*TeleportProcess).syncRotationState()
/__w/teleport.e/teleport.e/lib/service/connect.go:996 +0x1c9
github.com/gravitational/teleport/lib/service.(*TeleportProcess).syncRotationStateAndBroadcast()
/__w/teleport.e/teleport.e/lib/service/connect.go:962 +0x4e
github.com/gravitational/teleport/lib/service.(*TeleportProcess).syncRotationStateCycle()
/__w/teleport.e/teleport.e/lib/service/connect.go:906 +0xcb
github.com/gravitational/teleport/lib/service.(*TeleportProcess).periodicSyncRotationState()
/__w/teleport.e/teleport.e/lib/service/connect.go:870 +0x5f3
github.com/gravitational/teleport/lib/service.(*TeleportProcess).periodicSyncRotationState-fm()
<autogenerated>:1 +0x33
github.com/gravitational/teleport/lib/service.(*LocalService).Serve()
/__w/teleport.e/teleport.e/lib/service/supervisor.go:605 +0x35
github.com/gravitational/teleport/lib/service.(*LocalSupervisor).serve.func1()
/__w/teleport.e/teleport.e/lib/service/supervisor.go:328 +0x4a2
Goroutine 168 (running) created at:
testing.(*T).Run()
/opt/go/src/testing/testing.go:1997 +0x9d2
github.com/gravitational/teleport/lib/client_test.TestTeleportClient_Login_local()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:285 +0x691
testing.tRunner()
/opt/go/src/testing/testing.go:1934 +0x21c
testing.(*T).Run.gowrap1()
/opt/go/src/testing/testing.go:1997 +0x44
Goroutine 9018 (running) created at:
github.com/gravitational/teleport/lib/service.(*LocalSupervisor).serve()
/__w/teleport.e/teleport.e/lib/service/supervisor.go:317 +0x10a
github.com/gravitational/teleport/lib/service.(*LocalSupervisor).Start()
/__w/teleport.e/teleport.e/lib/service/supervisor.go:360 +0x2f6
github.com/gravitational/teleport/lib/client_test.startAndWait()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:804 +0x91
github.com/gravitational/teleport/lib/client_test.startAndWait()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:802 +0x45
github.com/gravitational/teleport/lib/client_test.newStandaloneTeleport()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:621 +0x1092
github.com/gravitational/teleport/lib/client_test.TestTeleportClient_Login_local.func21()
/__w/teleport.e/teleport.e/lib/client/api_login_test.go:290 +0x14e
testing.tRunner()
/opt/go/src/testing/testing.go:1934 +0x21c
testing.(*T).Run.gowrap1()
/opt/go/src/testing/testing.go:1997 +0x44
==================
```
The setter is also redundant - Auth already exposes a way
to be constructed with a custom clock. In order to get rid
of the races once and for all, the clock setter was removed and
all tests have been updated to plumb the clock through on
construction.
Fixes https://github.com/gravitational/teleport/issues/60055 and
https://github.com/gravitational/teleport/issues/53267.
Errors emitted when access is denied or hosts are missing from
the inventory have been updated to be clearer to end users.
The current error when connecting to a host that does not exist
```bash
$ tsh ssh tim@fake-host
ERROR: failed connecting to host fake-host:0: failed to receive cluster details response
failed to dial target host
direct dialing to nodes not found in inventory is not supported
```
has been updated to remove ancillary details that have zero meaning to anyone
other than a Teleport developer and better clarify the host does not exist.
```
$ tsh ssh tim@fake-host
ERROR: failed connecting to host fake-host: target host fake-host is offline or does not exist
```
The access denied error
```
$ tsh ssh tim@server01 uptime
ERROR: access denied to tim connecting to server01:0
```
has had a relatively minor and possibly unnoticed
change to omit the port from the dial target.
```
$ tsh ssh tim@server01 uptime
ERROR: access denied to tim connecting to server01
```
fix: use net.SplitHostPort instead of strings.Cut
This begins the process of cleaning up legacy terminology
in lib/reversetunnel. The RemoteSite interface has been
renamed Cluster to better reflect that it represents a
Teleport cluster, either the root or leaf. The FakeRemoteSite
has been renamed to FakeCluster, and all other mock and fake
Cluster implementations have been renamed to use consitent
terminology as well. All variables holding a reference to
a cluster that were named site or had some reference to a site
have also been changed to cluster or an equivalent which
mentions cluster instead of site.
An alias to RemoteSite has been left behind so that enterprise
code can still consume it. It will be removed when the e ref
is bumped at a later time when it is no longer referenced.
Updates #19164.
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
* Extract reusable function for establishing connections to Windows Desktop Service
* Add `ProxyWindowsDesktopSession` proto
* Implement `ProxyWindowsDesktopSession`
* Enable fetching desktops and desktop services in remote proxy cache
* Implement dialing windows desktop
* Implement client
* Use `utils.ShuffleVisit`
* Improve stream cancellation handling
* Leave a TODO about ListWindowsDesktops
* Do not return empty data slice
* Provide non-nil src and dest addresses to `streamutils.NewConn()`
* Do not emit an empty message to indicate a successful connection
* Fix test
* Simplify code
* Require that the first message is only a dial request and the subsequent ones are only data
* Add explicit `stop()` check
* Hold cluster name and desktop name in a struct for the map key
* Do not return early on non-connection problem errors
* Handle io.EOF error specifically in BidiStreamingClient.Send instead of in `tlsConn.HandshakeContext`
* Post merge fixes
* Add correct principal for agentless nodes on leaf clusters
* Add host.cluster principle to initial principle list
* Add test to ensure principal is added correctly for agentless nodes
* Update lib/proxy/router.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Deduplicate principals before dialing
* Update lib/proxy/router_test.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add comment explaining principal for leaf cluster nodes
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* GitHub proxy part 6: proxing Git using SSH transport
* better command parsing and update suite
* refactor
* revert unnecearrty files
* address review comments
* ut fix
* revert localsite_test.go
* change special suffix to teleport-github-org for routing
* fix routing ut
* minor typo edit
* fix ut after sshca change
* add UT to sshutils
* minor review comments
* fix api ut because of special suffix change
* GitServerReadOnlyClient
* downgrade error to warning
* run go mod tidy. not sure why it's needed
* rename mock.go to mock_test.go
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
We suggest that a UUID is used for agentless nodes metadata.name
field, but we do not enforce it. This causes several edge cases
and slightly weird UX in places that expect the name to be a UUID.
Most notably, this presents dialing problems for the web ui as
described in https://github.com/gravitational/teleport/issues/50914.
To allowing dialing to function in all cases for these servers,
routing has been updated to permit matches on metadata.name, however,
the match is given a lower score then a match on a UUID. This should
permit dialing, though, it may still result in ambiguity.
Closes#50914.
Host resolution performed because labels, fuzzy search, or predicate
expressions were supplied to commands that establish connections to
a single host has historically been performed client side in tsh.
While that works in most cases, it can prevent correctly
resolving hosts in some situations, i.e. when there are ambiguous
hosts and tsh is unaware that the cluster routing strategy is set
to ROUTE_TO_MOST_RECENT.
To improve the experience, a new ResolveSSHTarget was added to
Auth to allow host resolution to be performed server side. The
resolution works in a similar manner to, and was inspired by
GetSSHTargets. In the event that the new RPC is not implemented,
because the client is newer than Auth, tsh has also been updated
to pull the cluster networking config and address any host
ambiguity if allowed.
As a result tsh scp and tsh proxy ssh should be much more
tolerant to, and still permit access in situations where
ambiguous hosts are present for some amount of time. Prior to
this the only way to connect in these situations was to find
the UUID of the correct target instance and try again after
seeing an ambiguous host error.
* Docs, utilities and protobuf definitions
* Server implementation
* Client implementation
* Tests
* Log the correct handshake error
* Use constants for stream and application error codes
* Avoid stuttering in const names
* Improve godocs and explanations
* Address test review comments
* Move the QUIC proxy peering envvar check to lib/config
* Move lib/proxy/clusterdial to lib/peer/dial
* Move peer.clientConn to lib/proxy/peer/internal
* Require QUIC peering label to be set to "yes"
* Move peer TLS verification funcs to lib/proxy/peer/internal
* Move QUICServer to lib/proxy/peer/quic
* Avoid stuttering in lib/proxy/peer/quic
* Remove useless quic.ServerConfig.CipherSuites param
* Fix log style in proxy.peer.quic
* Move duplicatePeerMsg into the function scope
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Consolidate resource watchers into a single watcher that leverages
generics. While most of the resource watchers were similar, some
resources have some one off functionality. These watchers have not
been touched, however, all that could be refactored to use the
generic watcher easily were.
* Simplify peer server TLS
* Make the peer clientConn generic
* Mock implementation of QUIC proxy peering
* Convert the peer server to slog
* QUICServer docs
* go mod tidy
* Remove authclient.Client/ClientI/NewClient aliases in lib/auth
* Remove WebSessionReq aliases in lib/auth
* Remove GithubAuthResponse aliases in lib/auth
* Remove GithubAuthRequest aliases in lib/auth
* Remove KubeCSR alias in lib/auth
* Remove KubeCSRResponse alias in lib/auth
* Remove OIDCAuthResponse alias in lib/auth
* Remove OIDCAuthRequest alias in lib/auth
* Remove ValidateOIDCAuthCallbackReq alias in lib/auth
* Remove OIDCAuthRawResponse alias in lib/auth
* Remove CreateUserTokenRequest alias in lib/auth
* Remove SAMLAuthResponse alias in lib/auth
* Remove SAMLAuthRequest alias in lib/auth
* Remove ValidateSAMLResponseReq alias in lib/auth
* Remove SAMLAuthRawResponse alias in lib/auth
* Remove ValidateTrustedClusterRequest alias in lib/auth
* Remove ValidateTrustedClusterRequestRaw alias in lib/auth
* Remove ValidateTrustedClusterResponse alias in lib/auth
* Remove ValidateTrustedClusterResponseRaw alias in lib/auth
* Remove AuthenticateUserRequest alias in lib/auth
* Remove ForwardedClientMetadata alias in lib/auth
* Remove PassCreds alias in lib/auth
* Remove OTPCreds alias in lib/auth
* Remove SessionCreds alias in lib/auth
* Remove AuthenticateSSHRequest alias in lib/auth
* Remove SSHLoginResponse alias in lib/auth
* Remove TrustedCerts alias in lib/auth
* Remove AuthoritiesToTrustedCerts alias in lib/auth
* Move auth.HostFQDN to authclient
* Move auth.WithClusterCAs, auth.DefaultClientCertPool and auth.ClientCertPool to authclient
* Switch alpn proxy to use authclient.CAGetter instead of auth.ReadProxyAccessPoint
* Use a smaller scoped interfaces in lib/proxy/peer to remove lib/auth dependency
* Move auth.TryCreateAppSessionForClientCertV15 to authclient
* Move auth.ErrNoMFADevices to authclient
* Move access point interfaces to authclient. Aliases left behind to prevent breaking builds
* remove lib/auth dependency from lib/reversetunnelclient
* fix lints
* fix license
* Bump e ref to include gravitational/teleport.e#4174
* Use authclient.Client in new tctl diag commands
* Stop using auth.UserTokenType aliases
Forrest