* Use serverUID for scp target
Revert unneeded hostname change
Remove comment
Get name
* Change name to serverId
* Fix lint errors
* Add comment
* Fix comment and signature format
Abstracts out authenticateRequestWithCluster so that the WithClusterAuth
logic can be used in siteSessionStreamGet without making siteSessionStreamGet
a ClusterHandler, which is expected to return JSON.
* Prevent race from causing remote clients from being closed
`web.SessionContext` was susceptible to races retrieving `auth.ClientI`
for remote sites. The mutex on the remote client cache was not held for
the duration of the `GetUserClient` which meant two simultaneous requests
could find no client existed in the cache, create one and then add it to
the cache. When the second client is added to the cache it would close the
first client created, which results in the `use of closed network connection`
error displaying on the web UI as described in #17173.
To remedy this the portion of `GetUserClient` that retrieves the remote client
is now protected by a `singleflight.Group`. This ensures that races on creating
a client no longer happen.
`web.SessionContext` was slightly refactored to make it easier to test, to
remove some unnecessary operations, and to provide `context.Context` to `GetUserClient`.
Additionally, all `web.SessionContext` variables which were named `ctx` in `lib/web`
have been renamed to avoid confusion as that often refers to a `context.Context`.
Fixes#17173
When we download, we write the file contents with the
`http.ResponseWriter` which is also used to write our
replies, so it was also writing our success replies.
fixes https://github.com/gravitational/teleport/issues/14557
The web api cannot leverage the NodeWatcher because it needs to
have each request for nodes go through RBAC checks per user. Rolling
back to creating an auth client per user and retrieving nodes
directly from the auth.ClientI.
* Prevent proxy from loading entire node set into memory more than once
When establishing a new session to a node, the proxy would load the
entire node set into memory in an attempt to find the matching host. For
smaller clusters this may not be that problematic. But on larger clusters,
loading >40k nodes into memory from the cache can be quite expensive.
This problem is compounded by the fact that it happened**per** session,
which could potentially cause the proxy to consume all available memory
and be OOM killed.
A new `NodeWatcher` is introduced which will maintain an in memory list
of all nodes per process. The watcher leverages the existing resource
watcher system and stores all nodes as types.Server, to eliminate the
cost incurred by unmarshalling the nodes from the cache. The `NodeWatcher`
provides a way to retrieve a filtered list of nodes in order to reduce the number
of copies made to only the matches.
* Transferred user endpoints/handlers from e
* Transferred and refactored endpoints/handlers for roles, trusted clusters, and github cn from e
* Export ok() func so e can use
* Silence rbac auth connector access denials on first check failure
* Update e-ref
* Add -p flag to scp
* Add support for preserving access/modification times on files/directories when copying files between hosts.
* lib/sshutils/scp: add time statting for directories
* Add directory handling for scp
* Rewrite scp tests with testify
* Address review comments
Without setting `ClientAddr` in `TeleportClient`, the proxy will log
itself (`localhost`, the web service) as the remote address of SCP
client.
Plumb the remote address of the original HTTP request to log the actual
user IP (the machine running browser with web interface open).
Fixes#2958
Michael