* Add TTL field to integration/helpers.UserCredsRequest
This will let us create expired user certs by providing a negative TTL.
* Reissue gateway cert if middleware detects it expired
* Add integration test for gateway cert renewal
Many of our tests (db package, I'm looking at you) generate many RSA keys. This has two main side effects; makes our tests slow and flaky as CPU usage spikes in random moments when the tests are run in parallel.
This change pre-generates RSA keys at the beginning of each test module and reuse them in randomized order to reduce the situation that one key has been used multiple times in one test.
I had to move a few files to avoid circular dependencies.
* Log gateway.Close errors during test cleanups
Unless gateway.Close is called on a gateway that was already closed, it
shouldn't return an error.
However, when working on handling expired certs in Connect I ran into a
buggy test where that error from gateway.Close provided a crucial clue
in fixing the bug. But because initially it was simply ignored, it took
me a while to figure out what was going on.
That's why this commit adds logging around those errors.
2 out of those 3 places are helper functions which get used in a variety
of tests, hence why they call t.Cleanup. The other place does call
gateway.Close eventually but we still use t.Cleanup in case the
execution doesn't get to that point.
* Automatically add useful fields to gateway loggers
It's useful to see what resource the gateway is targeting and what is
the URI of the gateway.
Previously the field with URI was hardcoded in cluster_gateways.go or
added only when cfg.Log was nil, meaning that we weren't able to benefit
from it in places such as gateway_test.go.
This commit makes it so that the `resource` and `gateway` fields are
added to any logger that is passed through gateway.Config.
* Remove copylocks warning from Gateway.NewWithLocalPort
gateway.Gateway holds a mutex in one of its fields. NewWithLocalPort
accepted gateway by value so vet was issuing a warning about copying a
lock.
NewWithLocalPort doesn't actually use the copied lock. But it makes
sense to get rid of the warning anyway.
* Make ReissueDBCerts accept tlsca.RouteToDatabase as arg
ReissueDBCerts used to accept a full-blown types.Database object just to
read a couple of fields from it. In the context of Connect, such object
is obtainable only by making a request to the cluster.
However, in the upcoming PR we want to be able to reissue the cert
without having to perform an unnecessary request to the cluster.
gateway.Gateway already holds all data we need to reissue the cert, so
let's make ReissueDBCerts accept tlsca.RouteToDatabase instead of
types.Database to avoid making that extra request.
* Add Gateway.ReloadCert
In the upcoming PR, after we reissue the db cert, we need to be able to
update the cert used by the running alpn.LocalProxy. This commit exposes
exactly that functionality.
Also, this commit adds RWMutex to Gateway to avoid a situation where
multiple goroutines attempt to reload the cert. This shouldn't happen
under normal circumstances but better safe than sorry.
RWMutex is also used for any field on Gateway that has a setter.
* Add basic implementation of LocalProxyMiddleware
* Add OnExpiredCert callback to gateway.Config
This callback will let the layer above gateway.Gateway handle a
situation in which the cert used by the gateway has expired but there's
a client that tries to make a connection through the gateway.
gateway.Gateway doesn't have the ability to reissue the cert by itself,
hence why we need to accept a callback from above.
Primary Changes:
- Remove reliance on Private Key PEM:
- Update native and keygen packages to return PrivateKey instead of PEM key
- Add new PrivateKey interface which implements crypto.Signer
- Replace PEM encoded private key usage where possible
- Replace calls to tls.(Load)X509KeyPair with keys.(Load)X509KeyPair in
client packages
Minor Changes:
- Remove unused agent.AddedKey return from LoadKey
- Simplify sshutils and removed unused code paths
- Add ecdsa and ed25519 key support
* Make it possible to test gateway opening/closing in Connect
Open() and Close() used to not return any error and Open() used to start
the gateway in a goroutine, making it rather hard to write tests for it.
This commit makes it so that Open() and Close() return errors and Open()
blocks.
Adjustments have been made to other places in lib/teleterm to account
for that missing goroutine and returned errors.
* Close httptest server in alpnproxy/local_proxy_test.go
While writing tests for the gateways, I was relying heavily on tests for
the local proxy. I noticed that it starts the server but doesn't close it
so I added an appropriate call to the cleanup function.
* Rename Gateway.Open to Gateway.Serve
* clusters.CreateGateway: Trim spaces when building a CLI command
If cliCommand.Env is empty, the returned command has an empty space at
the front.
* Do not pass TargetSubresourceName when fetching certs for gateway
Since we want to be able to freely specify the db name after the gateway
creation, let's not pass the db name when creating the gateway to show
the intent more clearly.
* Make CLICommand a method on Gateway rather than a field
* Extract getting cluster by resource URI to Storage
Teleport now will try to extract MySQL server version from initial handshake package instead of sending `8.0.0-Teleport` every time. This string can be overridden by new configuration option `mysql.server_version`. On DB service start Teleport will also try to fetch the current version from MySQL/MariaDB instance. After that the server version will be updated on every successful connection to keep it up to date.
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Extract dbcmd.go into a new package under lib/client/db/dbcmd
* Use dbcmd to generate CliCommand for gateways
* Return relative db command from tsh daemon
* Add WithTolarateMissingCLIClient func to dbcmd
Rafał Cieślak