Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(v6) Fix --insecure-no-tls flag #5922

Merged
merged 1 commit into from
Mar 10, 2021
Merged

(v6) Fix --insecure-no-tls flag #5922

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 48 additions & 2 deletions integration/integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ import (
"io"
"io/ioutil"
"net"
"net/http"
"net/http/httptest"
"net/url"
"os"
Expand Down Expand Up @@ -61,10 +62,11 @@ import (
"github.com/gravitational/teleport/lib/utils"
"github.com/gravitational/teleport/lib/utils/testlog"

"github.com/gravitational/trace"
"github.com/pborman/uuid"
log "github.com/sirupsen/logrus"
"github.com/stretchr/testify/require"
"gopkg.in/check.v1"

"github.com/gravitational/trace"
)

const (
Expand Down Expand Up @@ -5148,3 +5150,47 @@ func canTestBPF() error {
func dumpGoroutineProfile() {
pprof.Lookup("goroutine").WriteTo(os.Stderr, 2)
}

// TestWebProxyInsecure makes sure that proxy endpoint works when TLS is disabled.
func TestWebProxyInsecure(t *testing.T) {
startPort := utils.PortStartingNumber + (4 * AllocatePortsNum) + 1
ports, err := utils.GetFreeTCPPorts(AllocatePortsNum, startPort)
require.NoError(t, err)

privateKey, publicKey, err := testauthority.New().GenerateKeyPair("")
require.NoError(t, err)

rc := NewInstance(InstanceConfig{
ClusterName: "example.com",
HostID: uuid.New(),
NodeName: Host,
Ports: ports.PopIntSlice(6),
Priv: privateKey,
Pub: publicKey,
log: testlog.FailureOnly(t),
})

rcConf := service.MakeDefaultConfig()
rcConf.DataDir = t.TempDir()
rcConf.Auth.Enabled = true
rcConf.Auth.Preference.SetSecondFactor("off")
rcConf.Proxy.Enabled = true
rcConf.Proxy.DisableWebInterface = true
// DisableTLS flag should turn off TLS termination and multiplexing.
rcConf.Proxy.DisableTLS = true

err = rc.CreateEx(nil, rcConf)
require.NoError(t, err)

err = rc.Start()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wish the test could be reduced to this:

proxyConfig := newDefaultConfiguration()
// DisableTLS flag should turn off TLS termination and multiplexing.
proxyConfig.Proxy.DisableTLS = true

proxy := newTeleportInstance()
proxy.Start()
t.Cleanup(proxy.StopAll)

// Web proxy endpoint should just respond with 200 when called over http://,
// content doesn't matter.
resp, err := http.Get(fmt.Sprintf("http://%v", net.JoinHostPort(Loopback, rc.GetPortWeb())))
require.NoError(t, err)
require.NoError(t, resp.Body.Close())

require.NoError(t, err)
t.Cleanup(func() {
rc.StopAll()
})

// Web proxy endpoint should just respond with 200 when called over http://,
// content doesn't matter.
resp, err := http.Get(fmt.Sprintf("http://%v", net.JoinHostPort(Loopback, rc.GetPortWeb())))
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
}
5 changes: 3 additions & 2 deletions lib/service/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2237,7 +2237,7 @@ func (process *TeleportProcess) setupProxyListeners() (*proxyListeners, error) {
}

if !cfg.Proxy.MySQLAddr.IsEmpty() {
process.log.Debug("Setup Proxy: MySQL proxy address: %v.", cfg.Proxy.MySQLAddr.Addr)
process.log.Debugf("Setup Proxy: MySQL proxy address: %v.", cfg.Proxy.MySQLAddr.Addr)
listener, err := process.importOrCreateListener(listenerProxyMySQL, cfg.Proxy.MySQLAddr.Addr)
if err != nil {
return nil, trace.Wrap(err)
Expand Down Expand Up @@ -2318,7 +2318,7 @@ func (process *TeleportProcess) setupProxyListeners() (*proxyListeners, error) {
// Unless database proxy is explicitly disabled (which is currently
// only done by tests and not exposed via file config), the web
// listener is multiplexing both web and db client connections.
if !cfg.Proxy.DisableDatabaseProxy {
if !cfg.Proxy.DisableDatabaseProxy && !cfg.Proxy.DisableTLS {
process.log.Debug("Setup Proxy: Multiplexing web and database proxy on the same port.")
listeners.mux, err = multiplexer.New(multiplexer.Config{
EnableProxyProtocol: cfg.Proxy.EnableProxyProtocol,
Expand All @@ -2337,6 +2337,7 @@ func (process *TeleportProcess) setupProxyListeners() (*proxyListeners, error) {
listeners.db = listeners.mux.DB()
go listeners.mux.Serve()
} else {
process.log.Debug("Setup Proxy: TLS is disabled, multiplexing is off.")
listeners.web = listener
}
}
Expand Down