Merge branch 'master' into tross/node_watcher

.cloudbuild/ci/doc-tests.yaml

@@ -1,11 +1,9 @@
 steps:
   - name: quay.io/gravitational/next:main
     id: docs-test
-    env:
-      - WITH_EXTERNAL_LINKS=true
     entrypoint: /bin/bash
     dir: /src
-    args: 
-      - -c 
-      - ln -s /workspace /src/content && yarn markdown-lint-external-links
+    args:
+      - -c
+      - ln -s /workspace /src/content && yarn markdown-lint
     timeout: 10m

.gitignore

@@ -75,3 +75,7 @@ ssh.config
 /tctl
 /teleport
 /tsh
+
+# Go workspace files
+go.work
+go.work.sum

Makefile

@@ -849,6 +849,11 @@ docker-binaries: clean
 enter:
 	make -C build.assets enter
 
+# Interactively enters a Docker container, as root (which you can build and run Teleport inside of)
+.PHONY:enter-root
+enter-root:
+	make -C build.assets enter-root
+
 # Interactively enters a Docker container (which you can build and run Teleport inside of).
 # Similar to `enter`, but uses the centos7 container.
 .PHONY:enter/centos7

api/client/webclient/webconfig.go

@@ -21,18 +21,21 @@ import "github.com/gravitational/teleport/api/constants"
 const (
 	// WebConfigAuthProviderOIDCType is OIDC provider type
 	WebConfigAuthProviderOIDCType = "oidc"
-	// WebConfigAuthProviderOIDCURL is OIDC webapi endpoint
-	WebConfigAuthProviderOIDCURL = "/v1/webapi/oidc/login/web?redirect_url=:redirect&connector_id=:providerName"
+	// WebConfigAuthProviderOIDCURL is OIDC webapi endpoint.
+	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
+	WebConfigAuthProviderOIDCURL = "/v1/webapi/oidc/login/web?connector_id=:providerName&redirect_url=:redirect"
 
 	// WebConfigAuthProviderSAMLType is SAML provider type
 	WebConfigAuthProviderSAMLType = "saml"
-	// WebConfigAuthProviderSAMLURL is SAML webapi endpoint
-	WebConfigAuthProviderSAMLURL = "/v1/webapi/saml/sso?redirect_url=:redirect&connector_id=:providerName"
+	// WebConfigAuthProviderSAMLURL is SAML webapi endpoint.
+	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
+	WebConfigAuthProviderSAMLURL = "/v1/webapi/saml/sso?connector_id=:providerName&redirect_url=:redirect"
 
 	// WebConfigAuthProviderGitHubType is GitHub provider type
 	WebConfigAuthProviderGitHubType = "github"
 	// WebConfigAuthProviderGitHubURL is GitHub webapi endpoint
-	WebConfigAuthProviderGitHubURL = "/v1/webapi/github/login/web?redirect_url=:redirect&connector_id=:providerName"
+	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
+	WebConfigAuthProviderGitHubURL = "/v1/webapi/github/login/web?connector_id=:providerName&redirect_url=:redirect"
 )
 
 // WebConfig is web application configuration served by the backend to be used in frontend apps.

api/utils/sshutils/conn.go

@@ -59,10 +59,12 @@ func ConnectProxyTransport(sconn ssh.Conn, req *DialReq, exclusive bool) (*ChCon
 
 	channel, discard, err := sconn.OpenChannel(constants.ChanTransport, nil)
 	if err != nil {
-		ssh.DiscardRequests(discard)
 		return nil, false, trace.Wrap(err)
 	}
 
+	// DiscardRequests will return when the channel or underlying connection is closed.
+	go ssh.DiscardRequests(discard)
+
 	// Send a special SSH out-of-band request called "teleport-transport"
 	// the agent on the other side will create a new TCP/IP connection to
 	// 'addr' on its network and will start proxying that connection over

api/utils/sshutils/conn_test.go

@@ -0,0 +1,170 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sshutils
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+
+type server struct {
+	listener net.Listener
+	config   *ssh.ServerConfig
+	handler  func(*ssh.ServerConn)
+
+	cSigner ssh.Signer
+	hSigner ssh.Signer
+}
+
+func (s *server) Run(errC chan error) {
+	for {
+		conn, err := s.listener.Accept()
+		if err != nil {
+			errC <- err
+			return
+		}
+
+		go func() {
+			sconn, _, _, err := ssh.NewServerConn(conn, s.config)
+			if err != nil {
+				errC <- err
+				return
+			}
+			s.handler(sconn)
+		}()
+	}
+}
+
+func (s *server) Stop() error {
+	return s.listener.Close()
+}
+
+func generateSigner(t *testing.T) ssh.Signer {
+	private, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	block := &pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(private),
+	}
+
+	privatePEM := pem.EncodeToMemory(block)
+	signer, err := ssh.ParsePrivateKey(privatePEM)
+	require.NoError(t, err)
+
+	return signer
+}
+
+func (s *server) GetClient(t *testing.T) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request) {
+	conn, err := net.Dial("tcp", s.listener.Addr().String())
+	require.NoError(t, err)
+
+	sconn, nc, r, err := ssh.NewClientConn(conn, "", &ssh.ClientConfig{
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(s.cSigner)},
+		HostKeyCallback: ssh.FixedHostKey(s.hSigner.PublicKey()),
+	})
+	require.NoError(t, err)
+
+	return sconn, nc, r
+}
+
+func newServer(t *testing.T, handler func(*ssh.ServerConn)) *server {
+	listener, err := net.Listen("tcp", "localhost:0")
+	require.NoError(t, err)
+
+	cSigner := generateSigner(t)
+	hSigner := generateSigner(t)
+
+	config := &ssh.ServerConfig{
+		NoClientAuth: true,
+	}
+	config.AddHostKey(hSigner)
+
+	return &server{
+		listener: listener,
+		config:   config,
+		handler:  handler,
+		cSigner:  cSigner,
+		hSigner:  hSigner,
+	}
+}
+
+// TestTransportError ensures ConnectProxyTransport does not block forever
+// when an error occurs while opening the transport channel.
+func TestTransportError(t *testing.T) {
+	handlerErrC := make(chan error, 1)
+	serverErrC := make(chan error, 1)
+
+	server := newServer(t, func(sconn *ssh.ServerConn) {
+		_, _, err := ConnectProxyTransport(sconn, &DialReq{
+			Address: "test", ServerID: "test",
+		}, false)
+		handlerErrC <- err
+	})
+
+	go server.Run(serverErrC)
+	t.Cleanup(func() { require.NoError(t, server.Stop()) })
+
+	sconn1, nc, _ := server.GetClient(t)
+	t.Cleanup(func() { require.Error(t, sconn1.Close()) })
+
+	channel := <-nc
+	require.Equal(t, channel.ChannelType(), constants.ChanTransport)
+
+	sconn1.Close()
+	err := timeoutErrC(t, handlerErrC, time.Second*5)
+	require.Error(t, err)
+
+	sconn2, nc, _ := server.GetClient(t)
+	t.Cleanup(func() { require.NoError(t, sconn2.Close()) })
+
+	channel = <-nc
+	require.Equal(t, channel.ChannelType(), constants.ChanTransport)
+
+	err = channel.Reject(ssh.ConnectionFailed, "test reject")
+	require.NoError(t, err)
+
+	err = timeoutErrC(t, handlerErrC, time.Second*5)
+	require.Error(t, err)
+
+	select {
+	case err = <-serverErrC:
+		require.FailNow(t, err.Error())
+	default:
+	}
+}
+
+func timeoutErrC(t *testing.T, errC <-chan error, d time.Duration) error {
+	timeout := time.NewTimer(d)
+	select {
+	case err := <-errC:
+		return err
+	case <-timeout.C:
+		require.FailNow(t, "failed to receive on err channel in time")
+	}
+
+	return nil
+}

assets/aws/Makefile

@@ -14,7 +14,7 @@ AWS_REGION ?= us-west-2
 # This must be a _released_ version of Teleport, i.e. one which has binaries
 # available for download on https://gravitational.com/teleport/download
 # Unreleased versions will fail to build.
-TELEPORT_VERSION ?= 9.0.4
+TELEPORT_VERSION ?= 9.1.0
 
 # Teleport UID is the UID of a non-privileged 'teleport' user
 TELEPORT_UID ?= 1007

build.assets/Makefile

@@ -316,6 +316,14 @@ enter: buildbox
 	docker run $(DOCKERFLAGS) -ti $(NOROOT) \
 		-e HOME=$(SRCDIR)/build.assets -w $(SRCDIR) $(BUILDBOX) /bin/bash
 
+#
+# Starts a root shell inside the build container
+#
+.PHONY:enter-root
+enter-root: buildbox
+	docker run $(DOCKERFLAGS) -ti \
+		-e HOME=$(SRCDIR)/build.assets -w $(SRCDIR) $(BUILDBOX) /bin/bash
+
 #
 # Starts shell inside the centos7 container
 #
@@ -415,7 +423,7 @@ docsbox:
 .PHONY:test-docs
 test-docs: docsbox
 	docker run --platform=linux/amd64 -i $(NOROOT) -v $$(pwd)/..:/src/content $(DOCSBOX) \
-		/bin/sh -c "yarn markdown-lint"
+		/bin/sh -c "yarn markdown-lint-external-links"
 
 #
 # Print the Go version used to build Teleport.