tshd-initiated communication for Connect

lib/srv/alpnproxy/local_proxy.go

@@ -34,6 +34,10 @@ import (
 	"github.com/gravitational/teleport/lib/utils/aws"
 )
 
+// OnNewConnectionFunc is a callback triggered when a new downstream connection is
+// accepted by the local proxy.
+type OnNewConnectionFunc func(lp *LocalProxy, conn net.Conn)
+
 // LocalProxy allows upgrading incoming connection to TLS where custom TLS values are set SNI ALPN and
 // updated connection is forwarded to remote ALPN SNI teleport proxy service.
 type LocalProxy struct {
@@ -71,6 +75,11 @@ type LocalProxyConfig struct {
 	Certs []tls.Certificate
 	// AWSCredentials are AWS Credentials used by LocalProxy for request's signature verification.
 	AWSCredentials *credentials.Credentials
+	// OnNewConnection is a callback triggered when a new downstream connection
+	// is accepted by the local proxy.
+	//
+	// Note that the callback blocks handling of the connection.
+	OnNewConnection OnNewConnectionFunc
 }
 
 // CheckAndSetDefaults verifies the constraints for LocalProxyConfig.
@@ -128,6 +137,11 @@ func (l *LocalProxy) Start(ctx context.Context) error {
 			log.WithError(err).Errorf("Failed to accept client connection.")
 			return trace.Wrap(err)
 		}
+
+		if l.cfg.OnNewConnection != nil {
+			l.cfg.OnNewConnection(l, conn)
+		}
+
 		go func() {
 			if err := l.handleDownstreamConnection(ctx, conn, l.cfg.SNI); err != nil {
 				if utils.IsOKNetworkError(err) {

lib/teleterm/api/proto/v1/service.proto

@@ -91,6 +91,9 @@ service TerminalService {
   rpc LoginPasswordless(stream LoginPasswordlessRequest) returns (stream LoginPasswordlessResponse);
   // ClusterLogin logs out a user from cluster
   rpc Logout(LogoutRequest) returns (EmptyResponse);
+
+  // TODO: Add comment.
+  rpc ClusterEvents(ClusterEventsRequest) returns (stream ClusterEvent);
 }
 
 // RemoveClusterRequest describes RemoveClusterRequest
@@ -287,4 +290,21 @@ message GetAuthSettingsRequest {
   string cluster_uri = 1;
 }
 
+message ClusterEventsRequest {}
+
+message ClusterEvent {
+  string cluster_uri = 1;
+  oneof event {
+    CertExpired cert_expired = 2;
+    NewGatewayConnectionAccepted new_gateway_connection_accepted = 3;
+  }
+}
+
+message CertExpired {}
+
+message NewGatewayConnectionAccepted {
+  string gateway_uri = 1;
+  string target_uri = 2;
+}
+
 message EmptyResponse {}