- Add a generalized client store made up of a key, profile, and trusted certs store. Each sub store can support different backends (~/.tsh, identity_file, in-memory).
- Replace custom identity file handling with in-memory client store.
- Fix issues with trusted certs handling.
* Add mutex for certs in local proxy
* Update lib/srv/alpnproxy/local_proxy.go
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Update lib/srv/alpnproxy/local_proxy.go
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Update lib/srv/alpnproxy/local_proxy.go
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Move cert checking out of middleware into local proxy
* Configure a logger for local proxy
* Fixup imports
* Add tests for local proxy
* test for data race
* test for cert checking
* Update integration test for local proxy
* Mark err assert fns as helpers
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Add local proxy middleware for db cert checking
* Use tls conversion util instead of inline
* Add middleware to local proxy config
* Add middleware configuration in tsh
* Use route to database check and set defaults func
* Dont trigger normal db login flow if using local proxy tunnel
* Split out adding client creds into helper func for testing
* Add integration test for local proxy tunnel db cert middleware
* Add unit test for local proxy middleware
* Update comment
* Make middleware on new conn block
* godoc
* Make any cert check error trigger cert renewal in local proxy middleware
* Move dbcertchecker into lib/client
* Remove unneeded mutex in local proxy and unused func in lib/utils
* Make local proxy middleware integration test more robust
* Print message before mfa prompt in proxy tunnel
* Add before prompt option to test
* Remove unneeded comment
* Change local proxy messages to be more clear
* Pass local proxy opts by reference
* Pass certs in opts instead of cert/key file path
This is so we can check if the error is recoverable while preparing
local proxy options. A tunneled local proxy can ignore the error because
it does not rely on cert files - it can just renew its certs if
necessary.
* Move db route checking back to tsh
* Fix lint err
* Fix typo and print the hint to same writer as the mfa prompt
Gavin Frazar