Add Support for Oracle protocol

[smallinsky]

What

Add Oracle Protocol Integration

Changes:

• RFD
• tsh local proxy listener on TLS port with local self signed certs where oracle client uses a wallet with local proxy certs.
• tctl auth sign --format=oracle command detects if Orapki binary is avable in user env in order to create Oracle wallet. Otherwise a user need manual steps to convert teleport certs to oracle wallet format.

UX:

• tctl example:

   $ tctl  auth sign --format=oracle --host=localhost --out=certs/server --ttl=2190h
   To enable mutual TLS on your Oracle server, add the following settings to oracle sqlnet.ora configuration file:
   WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY = /path/to/oracleWalletDir)))
   SSL_CLIENT_AUTHENTICATION = TRUE
   SQLNET.AUTHENTICATION_SERVICES = (TCPS)
   To enable mutual TLS on your Oracle server, add the following TCPS entreis to its listener.ora configuration file:
   LISTENER =
     (DESCRIPTION_LIST =
       (DESCRIPTION =
         (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
       )
     )
   WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY = /path/to/oracleWalletDir)))
   SSL_CLIENT_AUTHENTICATION = TRUE
  

• tsh proxy db:

  $ tsh proxy db oracle  --db-user=alice --db-name=XE --tunnel
      Started authenticated tunnel for the Oracle database "oracle" in cluster "ice-berg.dev" on 127.0.0.1:51584.
      To avoid port randomization, you can choose the listening port using the --port flag.
      Use the following command to connect to the Oracle database server using CLI:
        $ sql -L jdbc:oracle:thin:@tcps://localhost:51584/XE?TNS_ADMIN=/Users/marek/.tsh/keys/ice-berg.dev/marek-db/ice-berg.dev/oracle-wallet
      or using following Oracle JDBC connection string in order to connect with other GUI/CLI clients:
        jdbc:oracle:thin:@tcps://localhost:51584/XE?TNS_ADMIN=/Users/marek/.tsh/keys/ice-berg.dev/marek-db/ice-berg.dev/oracle-wallet
  

Testing:

1. checkout e related changes: smallinsky/oracle_protocol_v3 https://github.com/gravitational/teleport.e/pull/1011
2. build Teleprot Enterprise
3. Setup local Oracle Database https://github.com/smallinsky/infra/tree/main/oracle
   • cd infra/oracle
   • make make sure that you are current logged into teleport cluster with a user that has a permission to issue DB certs.

Next Steps:

• Add support for audit logs
• Align Teleport Connect

[smallinsky]

/gcbrun

[gabrielcorado]

Overall LGTM. While testing, I run into a few issues:

• This doesn’t happen for every error, but if Teleport DB service can reach the database but cannot connect to it due to misconfigured certificates or half setup is done (e.g., not setting up the server wallet). Then, it doesn't log any error message on the server side, only on the client:

  Error Message = IO Error: Read error 'CLOSED', connect lapse 162 ms., Authentication lapse 0 ms.

• Couldn't connect to my database with the following error:

  2023-03-22T21:16:18-03:00 [DB:SERVIC] ERRO Oracle connection error db:oracle error:[
  ERROR REPORT:
  Original Error: x509.HostnameError x509: certificate relies on legacy Common Name field,                 use SANs instead
  Stack Trace:
          github.com/gravitational/teleport/e/lib/db/oracle/protocol/conn.go:44     github.com/gravitational/teleport/e/lib/db/oracle/protocol.NewServerConn
          github.com/gravitational/teleport/e/lib/db/oracle/engine.go:107 github.com/gravitational/teleport/e/lib/db/oracle.(*Engine).connectToOracleDB
          github.com/gravitational/teleport/e/lib/db/oracle/engine.go:85 github.com/gravitational/teleport/e/lib/db/oracle.(*Engine).HandleConnection
          github.com/gravitational/teleport/lib/srv/db/server.go:936 github.com/gravitational/teleport/lib/srv/db.(*Server).handleConnection
          github.com/gravitational/teleport/lib/srv/db/server.go:846 github.com/gravitational/teleport/lib/srv/db.(*Server).HandleConnection
          github.com/gravitational/teleport/lib/reversetunnel/transport.go:295 github.com/gravitational/teleport/lib/reversetunnel.(*transport).start
          github.com/gravitational/teleport/lib/reversetunnel/agent.go:587 github.com/gravitational/teleport/lib/reversetunnel.(*agent).handleDrainChannels.func2
          runtime/asm_arm64.s:1172 runtime.goexit
  User Message: x509: certificate relies on legacy Common Name field, use SANs instead]     id:ff55f687-44f6-4077-a35c-d22b69e2c952 oracle/engine.go:63

  I'm using same setup as your repo (I only had to make small changes due to my docker being unable to write to volumes).

Also, great work on providing the repo with the database setup, that helped a lot on testing it.

[greedy52]

first pass. will try it out and do another pass

[greedy52]

LGTM. Tested both sql binary and jdbc (through SQuireLSQL predefined Oracle Thin Driver).

I think the oracle local configs and local TLS listener will break Teleport Connect, so we may want to fix that or track that in a separate ticket.

[greedy52]

nit

Suggested change

	Orapki binary was not found. Please create oracle wallet file manually by running following commands on the Oracle server:
	Orapki binary was not found. Please create Oracle wallet file manually by running the following commands on the Oracle server:

[greedy52]

For kube, I need specific DNS names per cluster so it has to be a separate file. But I am wondering if maybe we can just do one shared local CA per user keys/one.example.com/foo-localca.pem for aws/azure/gcp and oracle. Not a big deal either way.

[gabrielcorado]

LGTM. I tested using a different setup and everything worked as expected.

[r0mant]

Bot.