mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 23:31:08 +08:00
rosstimothy
514bfc7ac6
* Ensure invalid tunnel agent connections get closed Connections from reverse tunnel agents were being marked as invalid by the proxy under certain conditions but would ultimately never be closed. This could lead to scenarios where the agent thought things were fine but the proxy considered that agent unhealthy and unroutable. Pruning of invalid connections used to occur when a proxy tried to retrieve a connection for that tunnel. This also further muddied the point in time at which the proxy could close a connection as it never explicitly stopped tracking the connection and closed it at the same time. To remedy this, connections are explicitly closed by the proxy and removed from the mapping to stop tracking immediately. In order to prevent a connection that is servicing an active connection from being closed the proxy now tracks which connections have sessions. Closing does not occur when there are any active sessions to prevent them from being force terminated. When the proxy receives a heartbeat from an agent it now restores the connection to a valid state. In the event that too many heart beats have been missed for an agent, the proxy will now terminate the connection, again only if it is not serving any sessions. Fixes #15911
108 lines
3.4 KiB
Go
108 lines
3.4 KiB
Go
/*
|
|
Copyright 2021 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package sshutils
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
|
|
"github.com/gravitational/trace"
|
|
"golang.org/x/crypto/ssh"
|
|
|
|
"github.com/gravitational/teleport/api/constants"
|
|
"github.com/gravitational/teleport/api/types"
|
|
)
|
|
|
|
// ConnectProxyTransport opens a channel over the remote tunnel and connects
|
|
// to the requested host.
|
|
//
|
|
// Returns the net.Conn wrapper over an SSH channel, whether the provided ssh.Conn
|
|
// should be considered invalid due to errors opening or sending a request to the
|
|
// channel while setting up the ChConn, and any error that occurs.
|
|
func ConnectProxyTransport(sconn ssh.Conn, req *DialReq, exclusive bool) (conn *ChConn, invalid bool, err error) {
|
|
if err := req.CheckAndSetDefaults(); err != nil {
|
|
return nil, false, trace.Wrap(err)
|
|
}
|
|
|
|
payload, err := json.Marshal(req)
|
|
if err != nil {
|
|
return nil, false, trace.Wrap(err)
|
|
}
|
|
|
|
channel, discard, err := sconn.OpenChannel(constants.ChanTransport, nil)
|
|
if err != nil {
|
|
return nil, true, trace.Wrap(err)
|
|
}
|
|
|
|
// DiscardRequests will return when the channel or underlying connection is closed.
|
|
go ssh.DiscardRequests(discard)
|
|
|
|
// Send a special SSH out-of-band request called "teleport-transport"
|
|
// the agent on the other side will create a new TCP/IP connection to
|
|
// 'addr' on its network and will start proxying that connection over
|
|
// this SSH channel.
|
|
ok, err := channel.SendRequest(constants.ChanTransportDialReq, true, payload)
|
|
if err != nil {
|
|
return nil, true, trace.NewAggregate(trace.Wrap(err), channel.Close())
|
|
}
|
|
if !ok {
|
|
defer channel.Close()
|
|
|
|
// Pull the error message from the tunnel client (remote cluster)
|
|
// passed to us via stderr.
|
|
errMessageBytes, _ := io.ReadAll(channel.Stderr())
|
|
errMessage := string(bytes.TrimSpace(errMessageBytes))
|
|
if len(errMessage) == 0 {
|
|
errMessage = fmt.Sprintf("failed connecting to %v [%v]", req.Address, req.ServerID)
|
|
}
|
|
return nil, false, trace.Errorf(errMessage)
|
|
}
|
|
|
|
if exclusive {
|
|
return NewExclusiveChConn(sconn, channel), false, nil
|
|
}
|
|
return NewChConn(sconn, channel), false, nil
|
|
}
|
|
|
|
// DialReq is a request for the address to connect to. Supports special
|
|
// non-resolvable addresses and search names if connection over a tunnel.
|
|
type DialReq struct {
|
|
// Address is the target host to make a connection to.
|
|
Address string `json:"address,omitempty"`
|
|
|
|
// ServerID is the hostUUID.clusterName of the node. ServerID is used when
|
|
// dialing through a tunnel to SSH and application nodes.
|
|
ServerID string `json:"server_id,omitempty"`
|
|
|
|
// ConnType is the type of connection requested, either node or application.
|
|
ConnType types.TunnelType `json:"conn_type"`
|
|
}
|
|
|
|
// CheckAndSetDefaults verifies all the values are valid.
|
|
func (d *DialReq) CheckAndSetDefaults() error {
|
|
if d.ConnType == "" {
|
|
d.ConnType = types.NodeTunnel
|
|
}
|
|
|
|
if d.Address == "" && d.ServerID == "" {
|
|
return trace.BadParameter("serverID or address required")
|
|
}
|
|
return nil
|
|
}
|