Sets `http.Server.IdleTimeout` and `http.Client.IdleConnTimeout`
on clients and servers which didn't have them set. A default of
360s was chosen to be on par with the default of an NLB without
being identical.
This was added as another safety measure to prevent leaking any
idle connections indefinitely as seen in #22757.
`apidefaults.DefaultDialTimeout` was also renamed to
`apidefaults.DefaultIOTimeout` to better reflect its usage.
* Use test IP addresses for auth_proxy_test.
The auth_proxy_test file now uses IP addresses from the block `TEST-NET-3`
as specified in https://www.rfc-editor.org/rfc/rfc5735#section-3. Previously,
it was using `0.0.0.0` IP addresses. This has a chance of actually hitting
locally running services depending on the test runner setup, making the tests
non-deterministic. The hope here is that this change will avoid the spurious
test failures seen in CI.
* Update lib/srv/alpnproxy/auth/auth_proxy_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Update lib/srv/alpnproxy/auth/auth_proxy_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Update lib/srv/alpnproxy/auth/auth_proxy_test.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add in comments about the 203.0.113.0/24 IP range.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Use `ctx` rather than `context.TODO()` where available
* Further propagation of context
* Use `context.Background()` instead of `context.TODO()` where appropriate in tests
* Further remove `context.TODO` from tests
* Appease linter on parameter order
Proxy already has a `gRPC` server when using the `teleport-proxy-grpc` ALPN protocol. Still, that server does not impose mTLS auth since it's used by nodes when joining the cluster with dynamic joining methods.
Since we require that the user identity is available in the handler, this PR introduces a new gRPC server that imposes mTLS under the ALPN protocol `teleport-proxy-gprc-mtls`.
Part of #20324
Related to #19573
* Add a new db engine
* Add tests for new engine
* Update tsh db subcommands
* Refactor error message and suggestions for unsupported tsh commands
* Add dynamodb to test plan
* Add AWS external ID to db config and update protos
* Add secure IP propagation from proxy to auth server when using ALPN
We're using PROXY protocol extensions called TLVs to send
signed JWT and proxy's certificate to the auth server. Auth
validates JWT using provided signing certificate and host CA
to make sure that IP information comes from our internal proxy.
* Add mutex for certs in local proxy
* Update lib/srv/alpnproxy/local_proxy.go
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Update lib/srv/alpnproxy/local_proxy.go
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Update lib/srv/alpnproxy/local_proxy.go
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Move cert checking out of middleware into local proxy
* Configure a logger for local proxy
* Fixup imports
* Add tests for local proxy
* test for data race
* test for cert checking
* Update integration test for local proxy
* Mark err assert fns as helpers
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
Due to a bug in Chrome, secure websockets in Teleport work intermittently on
the Chrome browser when using HTTP/2. Prioritizing HTTP/1.1 fixes this issue,
though the reasons for this are not 100% clear. When or if
https://bugs.chromium.org/p/chromium/issues/detail?id=1379017 is resolved, we
should be able to revert this. When https://github.com/golang/go/issues/49918
is implemented, we may be able to revert this if enabling HTTP/2 websockets
fixes the issue on our end.
* Add local proxy middleware for db cert checking
* Use tls conversion util instead of inline
* Add middleware to local proxy config
* Add middleware configuration in tsh
* Use route to database check and set defaults func
* Dont trigger normal db login flow if using local proxy tunnel
* Split out adding client creds into helper func for testing
* Add integration test for local proxy tunnel db cert middleware
* Add unit test for local proxy middleware
* Update comment
* Make middleware on new conn block
* godoc
* Make any cert check error trigger cert renewal in local proxy middleware
* Move dbcertchecker into lib/client
* Remove unneeded mutex in local proxy and unused func in lib/utils
* Make local proxy middleware integration test more robust
* Print message before mfa prompt in proxy tunnel
* Add before prompt option to test
* Remove unneeded comment
* Change local proxy messages to be more clear
* Pass local proxy opts by reference
* Pass certs in opts instead of cert/key file path
This is so we can check if the error is recoverable while preparing
local proxy options. A tunneled local proxy can ignore the error because
it does not rely on cert files - it can just renew its certs if
necessary.
* Move db route checking back to tsh
* Fix lint err
* Fix typo and print the hint to same writer as the mfa prompt
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
STeve (Xin) Huang