mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 21:52:02 +08:00
rosstimothyandEdoardo Spadolini
7a7f982ed9
The new subcommand is meant to be a replacement for tbot proxy ssh which does the ssh proxying entirely within tbot to reduce resource consumption. The old mechanism spawned a tsh process to perform the proxying which leads to increased CPU and memory consumption - which can be quite problematic when used as an OpenSSH ProxyCommand for an ansible playbook. The new command also deviates in behavior from tsh proxy ssh in that, for the moment, it requires users to explicitly dictate whether tls routing, alpn connection upgrades instead of guessing by making a call to webapi/ping. This again turns out to be quite resource intensive when tbot is used as an OpenSSH ProxyCommand for an ansible playbook. In the future tbot can look this information up out of band and store it in the proper location so that tbot ssh-proxy-command can consume it directly without users needing to provide it. The behavior as is provides a path toward the future while also allowing users to gain the performance improvements now. Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
97 lines
2.5 KiB
Go
97 lines
2.5 KiB
Go
/*
|
|
* Teleport
|
|
* Copyright (C) 2023 Gravitational, Inc.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
package utils
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"os"
|
|
|
|
"github.com/gravitational/trace"
|
|
)
|
|
|
|
// CombinedStdio reads from standard input and writes to standard output.
|
|
// Closing a CombinedStdio does nothing, successfully.
|
|
type CombinedStdio struct{}
|
|
|
|
// Read reads from [os.Stdin].
|
|
func (CombinedStdio) Read(p []byte) (int, error) {
|
|
return os.Stdin.Read(p)
|
|
}
|
|
|
|
// Write writes to [os.Stdout].
|
|
func (CombinedStdio) Write(p []byte) (int, error) {
|
|
return os.Stdout.Write(p)
|
|
}
|
|
|
|
// ReadFrom copies data from [os.Stdout] to the provided [io.Reader].
|
|
func (CombinedStdio) ReadFrom(r io.Reader) (n int64, err error) {
|
|
return os.Stdout.ReadFrom(r)
|
|
}
|
|
|
|
// WriteTo copies data from [os.Stdin] to the provided [io.Writer].
|
|
func (CombinedStdio) WriteTo(w io.Writer) (n int64, err error) {
|
|
return os.Stdin.WriteTo(w)
|
|
}
|
|
|
|
func (CombinedStdio) Close() error {
|
|
return nil
|
|
}
|
|
|
|
// ProxyConn launches a double-copy loop that proxies traffic between the
|
|
// provided client and server connections.
|
|
//
|
|
// Exits when one or both copies stop, or when the context is canceled, and
|
|
// closes both connections.
|
|
func ProxyConn(ctx context.Context, client, server io.ReadWriteCloser) error {
|
|
errCh := make(chan error, 2)
|
|
|
|
defer server.Close()
|
|
defer client.Close()
|
|
|
|
go func() {
|
|
defer server.Close()
|
|
defer client.Close()
|
|
_, err := io.Copy(server, client)
|
|
errCh <- err
|
|
}()
|
|
|
|
go func() {
|
|
defer server.Close()
|
|
defer client.Close()
|
|
_, err := io.Copy(client, server)
|
|
errCh <- err
|
|
}()
|
|
|
|
var errors []error
|
|
for i := 0; i < 2; i++ {
|
|
select {
|
|
case err := <-errCh:
|
|
if err != nil && !IsOKNetworkError(err) {
|
|
errors = append(errors, err)
|
|
}
|
|
case <-ctx.Done():
|
|
// Cause(ctx) returns ctx.Err() if no cause is provided.
|
|
return trace.Wrap(context.Cause(ctx))
|
|
}
|
|
}
|
|
|
|
return trace.NewAggregate(errors...)
|
|
}
|