mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-31 20:39:37 +08:00
rosstimothy
e4e7f538ce
* create package to contain proxy peering code * Refactor proxy routing logic into a reusable object Routing logic existed within an unexported handler of ssh subsystem requests, which prevented it from being reused by other components within the proxy, like the webapi server. This causes significant latency issues for web sessions because the web apiserver is required to dial the proxy ssh server to determine how to route to the host. Since the web apiserver and the proxy ssh server exist in the same process this is an entirely unnecesarry step that could be avoided if the routing and ability to established connections were shared throughout the proxy. A new `proxy.Router` object is introduced which contains all the logic that used to exist in `regular.proxySubsys` for determining how to connect to servers and clusters. All routing within the `regular.proxySubsys` now leverages the `proxy.Router` to dial the target. This is step 1 in addressing #15167. Now that the `proxy.Router` exists `web.APIServer` will be able to make use of it to avoid dialing the same process to establish connections.
60 lines
2.1 KiB
Go
60 lines
2.1 KiB
Go
// Copyright 2022 Gravitational, Inc
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package peer
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/gravitational/teleport/api/client/proto"
|
|
"github.com/gravitational/teleport/api/types"
|
|
)
|
|
|
|
// TestServerTLS ensures that only trusted certificates with the proxy role
|
|
// are accepted by the server.
|
|
func TestServerTLS(t *testing.T) {
|
|
ca1 := newSelfSignedCA(t)
|
|
ca2 := newSelfSignedCA(t)
|
|
|
|
// trusted certificates with proxy roles.
|
|
client1 := setupClient(t, ca1, ca1, types.RoleProxy)
|
|
_, serverDef1 := setupServer(t, "s1", ca1, ca1, types.RoleProxy)
|
|
err := client1.updateConnections([]types.Server{serverDef1})
|
|
require.NoError(t, err)
|
|
stream, _, err := client1.dial([]string{"s1"}, &proto.DialRequest{})
|
|
require.NoError(t, err)
|
|
require.NotNil(t, stream)
|
|
stream.CloseSend()
|
|
|
|
// trusted certificates with incorrect server role.
|
|
client2 := setupClient(t, ca1, ca1, types.RoleNode)
|
|
_, serverDef2 := setupServer(t, "s2", ca1, ca1, types.RoleProxy)
|
|
err = client2.updateConnections([]types.Server{serverDef2})
|
|
require.NoError(t, err) // connection succeeds but is in transient failure state
|
|
_, _, err = client2.dial([]string{"s2"}, &proto.DialRequest{})
|
|
require.Error(t, err)
|
|
|
|
// certificates with correct role from different CAs
|
|
client3 := setupClient(t, ca1, ca2, types.RoleProxy)
|
|
_, serverDef3 := setupServer(t, "s3", ca2, ca1, types.RoleProxy)
|
|
err = client3.updateConnections([]types.Server{serverDef3})
|
|
require.NoError(t, err)
|
|
stream, _, err = client3.dial([]string{"s3"}, &proto.DialRequest{})
|
|
require.NoError(t, err)
|
|
require.NotNil(t, stream)
|
|
stream.CloseSend()
|
|
}
|