Merged
Conversation
nklaassen
added
no-changelog
github-actions
Bot
requested review from
kimlisa,
mmcallister,
ptgott,
r0mant,
ravicious and
zmb3
Contributor
|
Amplify deployment status
|
zmb3
approved these changes
Jul 9, 2025
ravicious
approved these changes
Jul 9, 2025
| following mitigations for DNS rebinding attacks: | ||
| - upgrade these APIs to HTTPS or another protocol | ||
| - enforce a Host header allowlist at the HTTP server | ||
| - block browser access to HTTP websites |
Member
There was a problem hiding this comment.
Just checking if you meant "HTTP APIs" here instead of "HTTP websites"?
Contributor
Author
There was a problem hiding this comment.
the concern is the user navigating to an HTTP website in the browser, and JS on that website then hitting an HTTP API over VNet, so I think it's correct to mention blocking access to HTTP websites in the browser
Member
There was a problem hiding this comment.
Oh, I see. I assumed it talks about somehow blocking access to HTTP websites that the user owns, since the previous two points are related to modifying resources owned by the user too.
public-teleport-github-review-bot
Bot
removed request for
kimlisa,
mmcallister,
ptgott and
r0mant
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
nklaassen
added a commit
that referenced
this pull request
Jul 9, 2025
Backport #56601 to branch/v18
nklaassen
added a commit
that referenced
this pull request
Jul 9, 2025
Backport #56601 to branch/v17
nklaassen
added a commit
that referenced
this pull request
Jul 9, 2025
Backport #56601 to branch/v18
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Jul 10, 2025
Backport #56601 to branch/v17
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Jul 10, 2025
Backport #56601 to branch/v18
marcoandredinis
pushed a commit
that referenced
this pull request
Jul 10, 2025
* [docs] add VNet warnings * Apply suggestions from code review Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> * fix typo --------- Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Jul 22, 2025
* [v18][vnet] feat: TCP dial to SSH targets Backport #55087 to branch/v18 * [v18][vnet] feat: accept incoming SSH connections Backport #55155 to branch/v18 * [v18][vnet] feat: forward SSH connections to target Backport #55156 to branch/v18 * [v18][vnet] feat: write VNet SSH keys to TELEPORT_HOME Backport #55228 to branch/v18 * [v18][vnet] feat: write OpenSSH-compatible config file for VNet SSH Backport #55239 to branch/v18 * [v18][vnet] fix: support <hostname>.<leaf-cluster> for VNet SSH Backport #55688 to branch/v18 * [v18][vnet] feat: add "Connect with VNet" button to SSH servers Backport #55623 to branch/v18 * fix test in backport * [v18][vnet] feat: support VNet SSH when cluster name does not match proxy public addr Backport #55655 to branch/v18 * [v18][vnet] feat: add SSH configuration diagnostic Backport #55594 to branch/v18 Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> * [v18][vnet] feat: show SSH status in VNet slider Backport #55755 to branch/v18 Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> * [v18][vnet] feat: support proxy recording mode with VNet SSH Backport #55788 to branch/v18 * [v18][vnet] feat: support diag checks on windows Backport #55856 to branch/v18 * [v18] fix: data race in vnet.TestSSH Backport #55980 to branch/v18 * [v18][vnet] feat: mention SSH on VNet info page Backport #55973 to branch/v18 * [v18][vnet] feat: serve DNS on IPv4 Backport #55539 to branch/v18 * [v18][vnet] fix: close proxied channel only after data and requests are complete Backport #56020 to branch/v18 * [v18][vnet] feat: automatic SSH client configuration Backport #55923 to branch/v18 * VNet diag notification: Do not show button to open report if there's no workspace selected (#56067) * VNet diag report: Don't show button in notification if there's no workspace * Replace deprecated MutableRefObject with RefObject * Make openReport not depend on value of rootClusterUri Otherwise the effect that uses setInterval re-runs whenever the user switches to another workspace. * [v18][vnet] feat: automatic SSH client configuration in Connect Backport #55924 to branch/v18 Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com> * [v18][vnet] fix: avoid empty host matchers in generated SSH config Backport #56103 to branch/v18 * [v18][docs] VNet SSH Backport #56147 to branch/v18 * [v18][docs] add VNet warnings Backport #56601 to branch/v18 * [v18][vnet] feat: SSH usage reporting Backport #56537 to branch/v18 * [v18][vnet] fix: mask default IP route on windows Backport #56957 to branch/v18 --------- Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds warnings against:
The VNet RFD mentioned that users should be warned about both of these, but I never added the warnings to the docs.
Fixes https://github.com/gravitational/teleport-private/issues/2033