Client tools auto update logic for multiple platforms

api/client/webclient/webclient.go

@@ -297,6 +297,10 @@ type PingResponse struct {
 	ServerVersion string `json:"server_version"`
 	// MinClientVersion is the minimum client version required by the server.
 	MinClientVersion string `json:"min_client_version"`
+	// ToolsVersion defines the version of {tsh, tctl} for client auto-upgrade.
+	ToolsVersion string `json:"tools_version"`
+	// ToolsAutoupdate enables client autoupdate feature.
+	ToolsAutoupdate bool `json:"tools_autoupdate"`
 	// ClusterName contains the name of the Teleport cluster.
 	ClusterName string `json:"cluster_name"`
 

integrations/terraform/go.mod

@@ -180,6 +180,7 @@ require (
 	github.com/google/go-tpm-tools v0.4.4 // indirect
 	github.com/google/go-tspi v0.3.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/renameio/v2 v2.0.0 // indirect
 	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect

integrations/terraform/go.sum

@@ -1259,7 +1259,6 @@ github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
 github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
-github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=

lib/client/api.go

@@ -93,6 +93,7 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/agentconn"
+	"github.com/gravitational/teleport/tool/common/update"
 )
 
 const (
@@ -684,6 +685,31 @@ func RetryWithRelogin(ctx context.Context, tc *TeleportClient, fn func() error,
 		return trace.Wrap(err)
 	}
 
+	// The user has typed a command like `tsh ssh ...` without being logged in,
+	// if the running binary needs to be updated, update and re-exec.
+	//
+	// If needed, download the new version of {tsh, tctl} and re-exec. Make
+	// sure to exit this process with the same exit code as the child process.
+	//
+	toolsVersion, reexec, err := update.CheckRemote(ctx, tc.WebProxyAddr)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if reexec {
+		// Download the version of client tools required by the cluster.
+		err := update.Download(toolsVersion)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		// Re-execute client tools with the correct version of client tools.
+		code, err := update.Exec()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		os.Exit(code)
+	}
+
 	if opt.afterLoginHook != nil {
 		if err := opt.afterLoginHook(); err != nil {
 			return trace.Wrap(err)

tool/common/update/client.go

@@ -0,0 +1,61 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package update
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"net/http"
+	"net/url"
+	"time"
+
+	"golang.org/x/net/http/httpproxy"
+
+	apidefaults "github.com/gravitational/teleport/api/defaults"
+	tracehttp "github.com/gravitational/teleport/api/observability/tracing/http"
+	apiutils "github.com/gravitational/teleport/api/utils"
+)
+
+type downloadConfig struct {
+	// Insecure turns off TLS certificate verification when enabled.
+	Insecure bool
+	// Pool defines the set of root CAs to use when verifying server
+	// certificates.
+	Pool *x509.CertPool
+	// Timeout is a timeout for requests.
+	Timeout time.Duration
+}
+
+func newClient(cfg *downloadConfig) *http.Client {
+	rt := apiutils.NewHTTPRoundTripper(&http.Transport{
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: cfg.Insecure,
+			RootCAs:            cfg.Pool,
+		},
+		Proxy: func(req *http.Request) (*url.URL, error) {
+			return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
+		},
+		IdleConnTimeout: apidefaults.DefaultIOTimeout,
+	}, nil)
+
+	return &http.Client{
+		Transport: tracehttp.NewTransport(rt),
+		Timeout:   cfg.Timeout,
+	}
+}

tool/common/update/feature_ent.go

@@ -0,0 +1,26 @@
+//go:build webassets_ent
+// +build webassets_ent
+
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package update
+
+func init() {
+	featureFlag |= FlagEnt
+}

tool/common/update/feature_fips.go

@@ -0,0 +1,26 @@
+//go:build fips
+// +build fips
+
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package update
+
+func init() {
+	featureFlag |= FlagFips
+}

tool/common/update/integration/main.go

@@ -0,0 +1,63 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/tool/common/update"
+)
+
+var version = "development"
+
+func main() {
+	// At process startup, check if a version has already been downloaded to
+	// $TELEPORT_HOME/bin or if the user has set the TELEPORT_TOOLS_VERSION
+	// environment variable. If so, re-exec that version of {tsh, tctl}.
+	toolsVersion, reExec := update.CheckLocal()
+	if reExec {
+		// Download the version of client tools required by the cluster. This
+		// is required if the user passed in the TELEPORT_TOOLS_VERSION
+		// explicitly.
+		err := update.Download(toolsVersion)
+		if errors.Is(err, update.ErrCanceled) {
+			os.Exit(0)
+			return
+		}
+		if err != nil {
+			log.Fatalf("Failed to download version (%v): %v", toolsVersion, err)
+			return
+		}
+
+		// Re-execute client tools with the correct version of client tools.
+		code, err := update.Exec()
+		if err != nil {
+			log.Fatalf("Failed to re-exec client tool: %v", err)
+		} else {
+			os.Exit(code)
+		}
+	}
+	if len(os.Args) > 1 && os.Args[1] == "version" {
+		fmt.Printf("Teleport v%v git", version)
+	}
+}

tool/common/update/progress.go

@@ -0,0 +1,80 @@
+/*
+ * Teleport
+ * Copyright (C) 2024  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package update
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"strings"
+)
+
+var (
+	ErrCanceled = fmt.Errorf("canceled")
+)
+
+// cancelableTeeReader is a copy of TeeReader with ability to react on signal notifier
+// to cancel reading process.
+func cancelableTeeReader(r io.Reader, w io.Writer, signals ...os.Signal) io.Reader {
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, signals...)
+
+	return &teeReader{r, w, sigs}
+}
+
+type teeReader struct {
+	r    io.Reader
+	w    io.Writer
+	sigs chan os.Signal
+}
+
+func (t *teeReader) Read(p []byte) (n int, err error) {
+	select {
+	case <-t.sigs:
+		return 0, ErrCanceled
+	default:
+		n, err = t.r.Read(p)
+		if n > 0 {
+			if n, err := t.w.Write(p[:n]); err != nil {
+				return n, err
+			}
+		}
+	}
+	return
+}
+
+type progressWriter struct {
+	n     int64
+	limit int64
+}
+
+func (w *progressWriter) Write(p []byte) (int, error) {
+	w.n = w.n + int64(len(p))
+
+	n := int((w.n*100)/w.limit) / 10
+	bricks := strings.Repeat("▒", n) + strings.Repeat(" ", 10-n)
+	fmt.Printf("\rUpdate progress: [" + bricks + "] (Ctrl-C to cancel update)")
+
+	if w.n == w.limit {
+		fmt.Printf("\n")
+	}
+
+	return len(p), nil
+}