The `http.Client.Transport` created in `newWebClient` wraps a
chain of `http.RoundTripper` over an underlying `http.Transport`.
Since we cannot guarantee that each `http.RoundTipper` has a
`CloseIdleConnections` method the usage of
`defer clt.CloseIdleConnections()` does not guarantee that the http
connections created during Find/Ping/etc are closed.
To prevent leaking connections implementations of `http.RoundTripper`
have added a `CloseIdleConnections` method added that forwards the
request on to the wrapped interface. The `otelhttp.Transport` does
not implement this method either so care has been taken to wrap it
in a `http.RoundTripper` which will call the root transport in
`enforceCloseIdleConnections`. An upstream issue has been filed
with otelhttp: https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3543
to get the method added to their `Transport` implementation.
This wasn't noticed prior to upgrading to go1.20 becuase prior to
[this](https://github.com/golang/go/commit/4e7e7ae1406c70d9cc0809ec11105a55a60a0b70)
commit the `ReadHeaderTimeout` set on the Proxy web api http.Server
would cause the connection to appear idle and get terminated by the
server.
`TestWebClientClosesIdleConnections` was added to capture the leak
in connections as reported in #22757 and prevent any regressions.
* Skip building webassets in CI
Building webassets is not always needed and many of our CI build just builds them and ends up not using them after.
This PR skips building the webassets for all pipelines where they are not needed. This should save us some time and $$.
* Make some changes to trigger CI
* Create the missing directory
* Change the application access auth flow to use a CORS POST request
* Remove auth state cookie
* Close the response body in tests
* Change the CSP to allow cross origin requests to the application
* Change the cookies to lax mode
* Update lib/web/app/handler_test.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Fix the proxy URL in tests
* Update webassets ref
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Move logic out of RoundTrip and into ServeHTTP as a middleware before handing off to oxy forwarder
* Move AWS signing service code into lib/utils/aws/signing.go
* use app server close context for audit event emitting
* add go doc comments.
* refactor request rewriting to make the copy in a more robust way.
* pass status code as uint32 rather than casting in audit emitter
* clone request instead of making a new request, and rewrite url to force https
* update header handling
* Set oxy forwarder to PassHostHeader=false to ensure the host header is
the URL being sought.
* Remove code that deleted forwarding headers previously, we should keep
those (X-Forwarded-*).
* Audit log the AWS Host sought rather than the incoming request Host
header (prior behavior maintained, we just rewrite the request
differently using Clone).
* Remove obsolete header copying helper func
This is a slightly more restrictive response header which will result in protecting the origin if the request is downgraded to http.
Although no http listeners exist within the service, this should be a safe and slightly more secure default for us to use.
Our need for customizing our security response headers primarily exists with the Content-Security-Policy. Other headers can be applied more broadly to provide safe defaults across our service.
This commit changes httpheaders.go to allow for the CSP to be applied separate from the other headers. Then the changes to httplib.go's handlers help make sure these headers are set generally (which we were already partially doing for caching directives).
Other changes were primarily making sure these tools are configured or used. Or a removal of previous settings as this function is now being handled more centrally.
* Forward traces from the web UI
Adds a `/webapi/traces` endpoint to the proxy web handler
to allow receiving traces from the UI so that they can
be forwarded to the configured exporter in the proxy_service.
To accomodate traces coming in via websockets the tracing
handler is updated to pull tracing context first from the
standard headers and fallback to retrieving it from a query
parameter as web sockets from the UI cannot alter headers.
Additionally update `web.Terminal` to propagate the tracing
context properly and instruments some of the functions
to ensure spans from the UI are properly correlated to spans
on the backend.
* feat: set cluster connector name on first user signin
* perf: move is passwordless enabled before get users
* fix: move logic to correct handler
* test: test setting default passwordless connector name for cloud (positive case)
* test: add negative test cases
* refactor: flatten nested code
* fix: remove return in case auth preference was not set
* fix: run logic only in cloud
* docs: typo
* fix: run when passwordless
* test: move trySettingConnectorNameToPasswordless as separete method
* docs: add safety comments
* test: rephrase safety comment
* refactor: remove space between call and error check
* fix: remove unnessesery error log from trySettingConnectorNameToPasswordless
* refactor: pass context, rename session context
* docs: add description to trySettingConnectorNameToPasswordless
* test: add descriptive assertion text
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* refactor: simplify error handilng
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* fix: check for non default setting
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: correct RPID
* refactor: simplify user creation
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* docs: fix typo
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: reorder name filed in the test cases struct
* test: better names for test cases
* refactor: generate token instead of hardcoding arbitrary value
* test: remove user agent header
* fix: check for empty password
* docs: add passwordless check description
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: add "first cloud sign-in does not change custom connector"
* test: use correct number of users in "first cloud sign-in does not change custom connector"
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: remove is cloud check from test helpers, instead use config
* refactor: store is_passwordless_registration in variable
* test: first cloud sign-in with password does not change connector
* refactor: change isPasswordlessRegistration name
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Tracing handlers consume a large amount of memory over time, which
makes using one per route suboptimal (See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/2413).
Wrapping all `http.Server` handlers with a tracing handler provides
the same tracing abilities for a fraction of the memory usage. A new
span formatter is added which allows servers to still contain the
request span in the span name.
* Add an installer script resource type and HTTP endpoint
* Add default installer scripts
* Resolve comments
- run `shfmt` over the installer script
- add MustNewInstaller
- move default installer logic to GetInstaller
- only include PublicProxyAddr in server.Config
* Resolve comments
- move from auth_with_roles -> auth/grpcserver
- document `MustNewInstallerV1`
* Add CSRF mitigations
This commit includes two fixes:
1. Enforce an application/json Content-Type server-side.
2. When checking the bearer token, verify that the user
associated with the token matches the user associated
with the cookie.
* Fix TEL-Q122-13: Access Requests Denial Of Service Via Request Reason (#125) (#127)
* Ignore input when data flow is off in TermManager
When data flow is disabled in TermManager (at the beginning or when TermManager.Off was called) we should ignore all input we receive (currently we buffer it)
* Agent forwarding socket security fix.
Co-authored-by: Lisa Kim <lisa@goteleport.com>
Co-authored-by: Joel <jwejdenstal@icloud.com>
Co-authored-by: Przemko Robakowski <przemko@przemko-robakowski.pl>
Leverage otelhttp to generate spans for http clients and http handlers.
Additionally add spans for grpc clients and servers by using the
otelgrpc interceptors. This is step one in implementation of RFD 65.
Until further work is done, the spans generated will be a no-op
until the tracing provider is initialized.
* Use forked httprouter with RawPath fix: gravitational/httprouter
* Enable UseRawPath everywhere.
* Test: allow MFA devices with `/` in names to be deleted
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Make k8s errors responses decode-able by kubectl
`kubectl` expects a k8s `Status` object in error responses.
Intercept generic handler errors and forwarder errors, and wrap them in
a `Status` object.
This commit introduces GRPC API for streaming sessions.
It adds structured events and sync streaming
that avoids storing events on disk.
You can find design in rfd/0002-streaming.md RFD.
All changes should be noop, except for
`integration/integration_test.go`.
The integration test was ignoring `recordingMode` test case parameter
and always used `RecordAtNode`. When switching to `recordingMode`, test
cases with `RecordAtProxy` fail with a confusing error about missing
user agent. Filed https://github.com/gravitational/teleport/issues/3606
to track that separately and unblock enabling `structcheck` linter.
This issue updates #1986.
This is intial, experimental implementation that will
be updated with tests and edge cases prior to production 2.7.0 release.
Teleport proxy adds support for Kubernetes API protocol.
Auth server uses Kubernetes API to receive certificates
issued by Kubernetes CA.
Proxy intercepts and forwards API requests to the Kubernetes
API server and captures live session traffic, making
recordings available in the audit log.
Tsh login now updates kubeconfig configuration to use
Teleport as a proxy server.
This commit implements #1860
During the the rotation procedure issuing TLS and SSH
certificate authorities are re-generated and all internal
components of the cluster re-register to get new
credentials.
The rotation procedure is based on a distributed
state machine algorithm - certificate authorities have
explicit rotation state and all parts of the cluster sync
local state machines by following transitions between phases.
Operator can launch CA rotation in auto or manual modes.
In manual mode operator moves cluster bewtween rotation states
and watches the states of the components to sync.
In auto mode state transitions are happening automatically
on a specified schedule.
The design documentation is embedded in the code:
lib/auth/rotate.go
Reverse tunnels are now first class citizens of teleport.
There's no longer static configuration for reverse tunnel agents
in the config. Instead, admins can add and remove reverse tunnels
using tctl reversetunnel (hidden) commands.
* tctl reversetunnel ls
lists reverse tunnels
* tctl reversetunnel upsert a.example.com 10.0.0.4:2023,10.0.0.5:2033 --ttl=10m
updates or inserts reverse tunnel for 10 minutes
* tctl reversetunnel del a.example.com
deletes a reverse tunnel
Teleport proxies watch changes in the reverse tunnels on the backend and
spin up / spin down reverse tunnels according to these changes.
rosstimothy