mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 14:05:34 +08:00
103 lines
3.6 KiB
Go
103 lines
3.6 KiB
Go
/*
|
|
Copyright 2020 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package client
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"time"
|
|
|
|
"github.com/gravitational/teleport/api/client/webclient"
|
|
"github.com/gravitational/teleport/api/constants"
|
|
"github.com/gravitational/teleport/api/utils/sshutils"
|
|
|
|
"github.com/gravitational/trace"
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
// ContextDialer represents network dialer interface that uses context
|
|
type ContextDialer interface {
|
|
// DialContext is a function that dials the specified address
|
|
DialContext(ctx context.Context, network, addr string) (net.Conn, error)
|
|
}
|
|
|
|
// ContextDialerFunc is a function wrapper that implements the ContextDialer interface.
|
|
type ContextDialerFunc func(ctx context.Context, network, addr string) (net.Conn, error)
|
|
|
|
// DialContext is a function that dials to the specified address
|
|
func (f ContextDialerFunc) DialContext(ctx context.Context, network, addr string) (net.Conn, error) {
|
|
return f(ctx, network, addr)
|
|
}
|
|
|
|
// NewDirectDialer makes a new dialer to connect directly to an Auth server.
|
|
func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
|
|
return &net.Dialer{
|
|
Timeout: dialTimeout,
|
|
KeepAlive: keepAlivePeriod,
|
|
}
|
|
}
|
|
|
|
// NewProxyDialer makes a dialer to connect to an Auth server through the SSH reverse tunnel on the proxy.
|
|
// The dialer will ping the web client to discover the tunnel proxy address on each dial.
|
|
func NewProxyDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration, discoveryAddr string, insecure bool) ContextDialer {
|
|
dialer := newTunnelDialer(ssh, keepAlivePeriod, dialTimeout)
|
|
return ContextDialerFunc(func(ctx context.Context, network, _ string) (conn net.Conn, err error) {
|
|
// Ping web proxy to retrieve tunnel proxy address.
|
|
pr, err := webclient.Find(ctx, discoveryAddr, insecure, nil)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
|
|
if pr.Proxy.SSH.TunnelPublicAddr == "" {
|
|
return nil, trace.BadParameter("reverse tunnel address not discoverable, 'tunnel_public_addr' is not set")
|
|
}
|
|
|
|
conn, err = dialer.DialContext(ctx, network, pr.Proxy.SSH.TunnelPublicAddr)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
return conn, nil
|
|
})
|
|
}
|
|
|
|
// newTunnelDialer makes a dialer to connect to an Auth server through the SSH reverse tunnel on the proxy.
|
|
func newTunnelDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
|
|
dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
|
|
return ContextDialerFunc(func(ctx context.Context, network, addr string) (conn net.Conn, err error) {
|
|
conn, err = dialer.DialContext(ctx, network, addr)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
|
|
ssh.Timeout = dialTimeout
|
|
sconn, err := sshutils.NewClientConnWithDeadline(conn, addr, &ssh)
|
|
if err != nil {
|
|
return nil, trace.NewAggregate(err, conn.Close())
|
|
}
|
|
|
|
// Build a net.Conn over the tunnel. Make this an exclusive connection:
|
|
// close the net.Conn as well as the channel upon close.
|
|
conn, _, err = sshutils.ConnectProxyTransport(sconn.Conn, &sshutils.DialReq{
|
|
Address: constants.RemoteAuthServer,
|
|
}, true)
|
|
if err != nil {
|
|
return nil, trace.NewAggregate(err, sconn.Close())
|
|
}
|
|
return conn, nil
|
|
})
|
|
}
|