Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remote Site should check version of Auth server not Proxy server #12010

Closed
rosstimothy opened this issue Apr 15, 2022 · 0 comments · Fixed by #12130
Closed

Remote Site should check version of Auth server not Proxy server #12010

rosstimothy opened this issue Apr 15, 2022 · 0 comments · Fixed by #12130
Labels

Comments

@rosstimothy
Copy link
Contributor

When creating a remote site we check the version of the remote cluster to determine how to initialize the cache to account for different resources being emitted based on different version. However the check is only checking the version of the proxy and not auth. This can lead to issue if the auth server and proxy server in the remote cluster are not on the same version. In such a scenario it is possible that the remote site cache will indefinitely be unhealthy.

func sendVersionRequest(ctx context.Context, sconn ssh.Conn) (string, error) {
errorCh := make(chan error, 1)
versionCh := make(chan string, 1)
go func() {
ok, payload, err := sconn.SendRequest(versionRequest, true, nil)
if err != nil {
errorCh <- err
return
}
if !ok {
errorCh <- trace.BadParameter("no response to %v request", versionRequest)
return
}
versionCh <- string(payload)
}()
select {
case ver := <-versionCh:
return ver, nil
case err := <-errorCh:
return "", trace.Wrap(err)
case <-time.After(defaults.WaitCopyTimeout):
return "", trace.BadParameter("timeout waiting for version")
case <-ctx.Done():
return "", ctx.Err()
}
}

rosstimothy added a commit that referenced this issue Apr 20, 2022
The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth and proxy version in response to a version request.
To maintain backward compatability the reverse tunnel server will
fallback to using the proxy version if the response does not
contain an auth version.

Fixes #12010
rosstimothy added a commit that referenced this issue Apr 25, 2022
The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth and proxy version in response to a version request.
To maintain backward compatability the reverse tunnel server will
fallback to using the proxy version if the response does not
contain an auth version.

Fixes #12010
rosstimothy added a commit that referenced this issue Apr 26, 2022
* Create remote site cache based on remote auth version

The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth version in response to a version request.

Fixes #12010
rosstimothy added a commit that referenced this issue Apr 26, 2022
* Create remote site cache based on remote auth version

The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth version in response to a version request.

Fixes #12010

(cherry picked from commit 4f2ad1f)

# Conflicts:
#	lib/reversetunnel/srv.go
rosstimothy added a commit that referenced this issue Apr 26, 2022
* Create remote site cache based on remote auth version

The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth version in response to a version request.

Fixes #12010

(cherry picked from commit 4f2ad1f)
rosstimothy added a commit that referenced this issue Apr 26, 2022
* Create remote site cache based on remote auth version

The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth version in response to a version request.

Fixes #12010

(cherry picked from commit 4f2ad1f)
rosstimothy added a commit that referenced this issue Apr 27, 2022
* Create remote site cache based on remote auth version

The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth version in response to a version request.

Fixes #12010

(cherry picked from commit 4f2ad1f)

# Conflicts:
#	lib/reversetunnel/srv.go
rosstimothy added a commit that referenced this issue Apr 27, 2022
* Create remote site cache based on remote auth version

The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth version in response to a version request.

Fixes #12010

(cherry picked from commit 4f2ad1f)
rosstimothy added a commit that referenced this issue Apr 28, 2022
* Create remote site cache based on remote auth version

The cache policy used for a remote site is determined based on
the response from a version request. However the version response
was only returning the proxy version. If the remote site was not
running the same version for both auth and proxy, then the cache
policy chosen could be invalid.

The reverse tunnel agent now pings its auth server and reports
both the auth version in response to a version request.

Fixes #12010

(cherry picked from commit 4f2ad1f)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant