Skip to content

[v13] Reuse tunnel resolvers instead of creating one per connection attempt #37723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rosstimothy merged 1 commit into from
Feb 5, 2024
Merged

[v13] Reuse tunnel resolvers instead of creating one per connection attempt #37723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 6 additions & 16 deletions lib/auth/authclient/authclient.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ import (

"github.com/gravitational/teleport/api/breaker"
apiclient "github.com/gravitational/teleport/api/client"
"github.com/gravitational/teleport/api/client/webclient"
"github.com/gravitational/teleport/lib/auth"
"github.com/gravitational/teleport/lib/reversetunnelclient"
"github.com/gravitational/teleport/lib/utils"
Expand All @@ -49,6 +48,11 @@ type Config struct {
CircuitBreakerConfig breaker.Config
// DialTimeout determines how long to wait for dialing to succeed before aborting.
DialTimeout time.Duration
// Insecure turns off TLS certificate verification when enabled.
Insecure bool
// Resolver is used to identify the reverse tunnel address when connecting via
// the proxy.
Resolver reversetunnelclient.Resolver
}

// Connect creates a valid client connection to the auth service. It may
Expand Down Expand Up @@ -108,25 +112,11 @@ func connectViaProxyTunnel(ctx context.Context, cfg *Config) (auth.ClientI, erro
// If direct dial failed, we may have a proxy address in
// cfg.AuthServers. Try connecting to the reverse tunnel
// endpoint and make a client over that.
//
// TODO(nic): this logic should be implemented once and reused in IoT
// nodes.
resolver := reversetunnelclient.WebClientResolver(&webclient.Config{
Context: ctx,
ProxyAddr: cfg.AuthServers[0].String(),
Insecure: cfg.TLS.InsecureSkipVerify,
Timeout: cfg.DialTimeout,
})

resolver, err := reversetunnelclient.CachingResolver(ctx, resolver, nil /* clock */)
if err != nil {
return nil, trace.Wrap(err)
}

// reversetunnelclient.TunnelAuthDialer will take care of creating a net.Conn
// within an SSH tunnel.
dialer, err := reversetunnelclient.NewTunnelAuthDialer(reversetunnelclient.TunnelAuthDialerConfig{
Resolver: resolver,
Resolver: cfg.Resolver,
ClientConfig: cfg.SSH,
Log: cfg.Log,
InsecureSkipTLSVerify: cfg.TLS.InsecureSkipVerify,
Expand Down
21 changes: 4 additions & 17 deletions lib/service/connect.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,6 @@ import (
"github.com/gravitational/teleport"
apiclient "github.com/gravitational/teleport/api/client"
"github.com/gravitational/teleport/api/client/proto"
"github.com/gravitational/teleport/api/client/webclient"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/api/utils/retryutils"
"github.com/gravitational/teleport/lib"
Expand Down Expand Up @@ -1222,7 +1221,7 @@ func (process *TeleportProcess) newClient(identity *auth.Identity) (*auth.Client
logger.Debug("Attempting to discover reverse tunnel address.")
logger.Debug("Attempting to connect to Auth Server through tunnel.")

tunnelClient, err := process.newClientThroughTunnel(authServers[0].String(), tlsConfig, sshClientConfig)
tunnelClient, err := process.newClientThroughTunnel(tlsConfig, sshClientConfig)
if err != nil {
process.log.Errorf("Node failed to establish connection to Teleport Proxy. We have tried the following endpoints:")
process.log.Errorf("- connecting to auth server directly: %v", directErr)
Expand All @@ -1248,7 +1247,7 @@ func (process *TeleportProcess) newClient(identity *auth.Identity) (*auth.Client
logger := process.log.WithField("proxy-server", proxyServer.String())
logger.Debug("Attempting to connect to Auth Server through tunnel.")

tunnelClient, err := process.newClientThroughTunnel(proxyServer.String(), tlsConfig, sshClientConfig)
tunnelClient, err := process.newClientThroughTunnel(tlsConfig, sshClientConfig)
if err != nil {
return nil, trace.Errorf("Failed to connect to Proxy Server through tunnel: %v", err)
}
Expand All @@ -1267,21 +1266,9 @@ func (process *TeleportProcess) newClient(identity *auth.Identity) (*auth.Client
return nil, trace.NotImplemented("could not find connection strategy for config version %s", process.Config.Version)
}

func (process *TeleportProcess) newClientThroughTunnel(addr string, tlsConfig *tls.Config, sshConfig *ssh.ClientConfig) (*auth.Client, error) {
resolver := reversetunnelclient.WebClientResolver(&webclient.Config{
Context: process.ExitContext(),
ProxyAddr: addr,
Insecure: lib.IsInsecureDevMode(),
Timeout: process.Config.Testing.ClientTimeout,
})

resolver, err := reversetunnelclient.CachingResolver(process.ExitContext(), resolver, process.Clock)
if err != nil {
return nil, trace.Wrap(err)
}

func (process *TeleportProcess) newClientThroughTunnel(tlsConfig *tls.Config, sshConfig *ssh.ClientConfig) (*auth.Client, error) {
dialer, err := reversetunnelclient.NewTunnelAuthDialer(reversetunnelclient.TunnelAuthDialerConfig{
Resolver: resolver,
Resolver: process.resolver,
ClientConfig: sshConfig,
Log: process.log,
InsecureSkipTLSVerify: lib.IsInsecureDevMode(),
Expand Down
26 changes: 26 additions & 0 deletions lib/service/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ import (
"github.com/gravitational/teleport"
"github.com/gravitational/teleport/api/client"
"github.com/gravitational/teleport/api/client/proto"
"github.com/gravitational/teleport/api/client/webclient"
"github.com/gravitational/teleport/api/constants"
apidefaults "github.com/gravitational/teleport/api/defaults"
kubeproto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
Expand Down Expand Up @@ -411,6 +412,10 @@ type TeleportProcess struct {

// SSHD is used to execute commands to update or validate OpenSSH config.
SSHD openssh.SSHD

// resolver is used to identify the reverse tunnel address when connecting via
// the proxy.
resolver reversetunnelclient.Resolver
}

type keyPairKey struct {
Expand Down Expand Up @@ -968,6 +973,27 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
}
}

var resolverAddr utils.NetAddr
if cfg.Version == defaults.TeleportConfigVersionV3 && !cfg.ProxyServer.IsEmpty() {
resolverAddr = cfg.ProxyServer
} else {
resolverAddr = cfg.AuthServerAddresses()[0]
}

process.resolver, err = reversetunnelclient.CachingResolver(
process.ExitContext(),
reversetunnelclient.WebClientResolver(&webclient.Config{
Context: process.ExitContext(),
ProxyAddr: resolverAddr.String(),
Insecure: lib.IsInsecureDevMode(),
Timeout: process.Config.Testing.ClientTimeout,
}),
process.Clock,
)
if err != nil {
return nil, trace.Wrap(err)
}

upgraderKind := os.Getenv("TELEPORT_EXT_UPGRADER")
upgraderVersion := automaticupgrades.GetUpgraderVersion(process.GracefulExitContext())

Expand Down
1 change: 1 addition & 0 deletions lib/tbot/renew.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,7 @@ func (b *Bot) AuthenticatedUserClientFromIdentity(ctx context.Context, id *ident
SSH: sshConfig,
AuthServers: []utils.NetAddr{*authAddr},
Log: b.log,
Resolver: b.resolver,
}

c, err := authclient.Connect(ctx, authClientConfig)
Expand Down
13 changes: 13 additions & 0 deletions lib/tbot/tbot.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ import (
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/lib/auth"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/reversetunnelclient"
"github.com/gravitational/teleport/lib/tbot/config"
"github.com/gravitational/teleport/lib/tbot/identity"
"github.com/gravitational/teleport/lib/utils"
Expand All @@ -47,6 +48,7 @@ type Bot struct {
log logrus.FieldLogger
reloadChan chan struct{}
modules modules.Modules
resolver reversetunnelclient.Resolver

// These are protected by getter/setters with mutex locks
mu sync.Mutex
Expand Down Expand Up @@ -342,6 +344,17 @@ func (b *Bot) initialize(ctx context.Context) (func() error, error) {

var authClient auth.ClientI

b.resolver, err = reversetunnelclient.CachingResolver(
ctx,
reversetunnelclient.WebClientResolver(&webclient.Config{
Context: ctx,
ProxyAddr: b.cfg.AuthServer,
}),
nil /* clock */)
if err != nil {
return unlock, trace.Wrap(err)
}

fetchNewIdentity := true
// First, attempt to load an identity from storage.
ident, err := identity.LoadIdentity(dest, identity.BotKinds()...)
Expand Down
19 changes: 18 additions & 1 deletion tool/tctl/common/tctl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ import (

"github.com/gravitational/teleport"
"github.com/gravitational/teleport/api/breaker"
"github.com/gravitational/teleport/api/client/webclient"
"github.com/gravitational/teleport/api/constants"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/lib/auth"
Expand All @@ -40,6 +41,7 @@ import (
"github.com/gravitational/teleport/lib/config"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/reversetunnelclient"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/utils"
"github.com/gravitational/teleport/tool/common"
Expand Down Expand Up @@ -194,6 +196,19 @@ func TryRun(commands []CLICommand, args []string) error {

ctx := context.Background()

clientConfig.Resolver, err = reversetunnelclient.CachingResolver(
ctx,
reversetunnelclient.WebClientResolver(&webclient.Config{
Context: ctx,
ProxyAddr: clientConfig.AuthServers[0].String(),
Insecure: clientConfig.Insecure,
Timeout: clientConfig.DialTimeout,
}),
nil /* clock */)
if err != nil {
return trace.Wrap(err)
}

client, err := authclient.Connect(ctx, clientConfig)
if err != nil {
if utils.IsUntrustedCertErr(err) {
Expand Down Expand Up @@ -388,7 +403,9 @@ func LoadConfigFromProfile(ccf *GlobalCLIFlags, cfg *servicecfg.Config) (*authcl
return nil, trace.BadParameter("your credentials are for cluster %q, please run `tsh login %q` to log in to the root cluster", profile.Cluster, rootCluster)
}

authConfig := &authclient.Config{}
authConfig := &authclient.Config{
Insecure: ccf.Insecure,
}
authConfig.TLS, err = key.TeleportClientTLSConfig(cfg.CipherSuites, []string{rootCluster})
if err != nil {
return nil, trace.Wrap(err)
Expand Down