Sets `http.Server.IdleTimeout` and `http.Client.IdleConnTimeout`
on clients and servers which didn't have them set. A default of
360s was chosen to be on par with the default of an NLB without
being identical.
This was added as another safety measure to prevent leaking any
idle connections indefinitely as seen in #22757.
`apidefaults.DefaultDialTimeout` was also renamed to
`apidefaults.DefaultIOTimeout` to better reflect its usage.
* Use test IP addresses for auth_proxy_test.
The auth_proxy_test file now uses IP addresses from the block `TEST-NET-3`
as specified in https://www.rfc-editor.org/rfc/rfc5735#section-3. Previously,
it was using `0.0.0.0` IP addresses. This has a chance of actually hitting
locally running services depending on the test runner setup, making the tests
non-deterministic. The hope here is that this change will avoid the spurious
test failures seen in CI.
* Update lib/srv/alpnproxy/auth/auth_proxy_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Update lib/srv/alpnproxy/auth/auth_proxy_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Update lib/srv/alpnproxy/auth/auth_proxy_test.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add in comments about the 203.0.113.0/24 IP range.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add secure IP propagation from proxy to auth server when using ALPN
We're using PROXY protocol extensions called TLVs to send
signed JWT and proxy's certificate to the auth server. Auth
validates JWT using provided signing certificate and host CA
to make sure that IP information comes from our internal proxy.
* Don't GetAuthServers in AuthProxyDialerService
* Don't GetAuthServers in localSite
* Fix lib/web tests
* Connect to a single auth in transport.start
* Review comments
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Currently we use random auth server from the list but if it's unavailable (for example it was restarted but there's still entry in cache, dynamodb backend etc) we return error.
This change tries all servers (in random order) and uses first that is available.
Closes#10019
rosstimothy