Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v9] Ensure h2 has precedence over http/1.1 #12749

Merged
merged 1 commit into from
May 19, 2022
Merged

[v9] Ensure h2 has precedence over http/1.1 #12749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions lib/service/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3417,13 +3417,13 @@ func (process *TeleportProcess) setupProxyTLSConfig(conn *Connector, tsrv revers
tlsConfig = m.TLSConfig()
utils.SetupTLSConfig(tlsConfig, cfg.CipherSuites)

// If ACME protocol was enabled add all known TLS Routing protocols.
// Go 1.17 introduced strict ALPN https://golang.org/doc/go1.17#ALPN If a client protocol is not recognized
// the TLS handshake will fail.
supportedProtocols := alpncommon.ProtocolsToString(alpncommon.SupportedProtocols)
tlsConfig.NextProtos = apiutils.Deduplicate(append(tlsConfig.NextProtos, supportedProtocols...))
tlsConfig.NextProtos = apiutils.Deduplicate(append(tlsConfig.NextProtos, acme.ALPNProto))
}

// Go 1.17 introduced strict ALPN https://golang.org/doc/go1.17#ALPN If a client protocol is not recognized
// the TLS handshake will fail.
tlsConfig.NextProtos = apiutils.Deduplicate(append(tlsConfig.NextProtos, alpncommon.ProtocolsToString(alpncommon.SupportedProtocols)...))

for _, pair := range process.Config.Proxy.KeyPairs {
process.Config.Log.Infof("Loading TLS certificate %v and key %v.", pair.Certificate, pair.PrivateKey)

Expand Down
16 changes: 14 additions & 2 deletions lib/service/service_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,6 +487,7 @@ func TestSetupProxyTLSConfig(t *testing.T) {
name: "ACME enabled, teleport ALPN protocols should be appended",
acmeEnabled: true,
wantNextProtos: []string{
// Ensure h2 has precedence over http/1.1.
"h2",
"http/1.1",
"acme-tls/1",
Expand All @@ -503,8 +504,19 @@ func TestSetupProxyTLSConfig(t *testing.T) {
{
name: "ACME disabled",
acmeEnabled: false,
// If server NextProtos list is empty server allows for connection with any protocol.
wantNextProtos: nil,
wantNextProtos: []string{
// Ensure h2 has precedence over http/1.1.
"h2",
"http/1.1",
"teleport-postgres",
"teleport-mysql",
"teleport-mongodb",
"teleport-redis",
"teleport-sqlserver",
"teleport-proxy-ssh",
"teleport-reversetunnel",
"teleport-auth@",
},
},
}

Expand Down
6 changes: 2 additions & 4 deletions lib/srv/alpnproxy/common/protocols.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ package common

import (
"github.com/gravitational/trace"
"golang.org/x/crypto/acme"

"github.com/gravitational/teleport/lib/defaults"
)
Expand Down Expand Up @@ -71,16 +70,15 @@ const (

// SupportedProtocols is the list of supported ALPN protocols.
var SupportedProtocols = []Protocol{
acme.ALPNProto,
ProtocolHTTP2,
ProtocolHTTP,
ProtocolPostgres,
ProtocolMySQL,
ProtocolMongoDB,
ProtocolRedisDB,
ProtocolSQLServer,
ProtocolProxySSH,
ProtocolReverseTunnel,
ProtocolHTTP,
ProtocolHTTP2,
ProtocolAuth,
}

Expand Down