forward

Documentation

Index

• type Server
  • func New(c ServerConfig) (*Server, error)
  • func (s *Server) AdvertiseAddr() string
  • func (s *Server) Close() error
  • func (s *Server) Component() string
  • func (s *Server) Context() context.Context
  • func (s *Server) Dial() (net.Conn, error)
  • func (s *Server) GetAccessPoint() srv.AccessPoint
  • func (s Server) GetBPF() bpf.BPF
  • func (s *Server) GetClock() clockwork.Clock
  • func (s *Server) GetCreateHostUser() bool
  • func (s *Server) GetDataDir() string
  • func (s *Server) GetHostUsers() srv.HostUsers
  • func (s *Server) GetInfo() types.Server
  • func (s *Server) GetLockWatcher() *services.LockWatcher
  • func (s *Server) GetNamespace() string
  • func (s *Server) GetPAM() (*pam.Config, error)
  • func (s Server) GetRestrictedSessionManager() restricted.Manager
  • func (s *Server) GetUtmpPath() (string, string)
  • func (s *Server) HostUUID() string
  • func (s *Server) ID() string
  • func (s *Server) PermitUserEnvironment() bool
  • func (s *Server) Serve()
  • func (s *Server) TargetMetadata() apievents.ServerMetadata
  • func (s *Server) UseTunnel() bool
• type ServerConfig
  • func (s *ServerConfig) CheckDefaults() error

Types

type Server

type Server struct {

	// StreamEmitter points to the auth service and emits audit events
	events.StreamEmitter
	// contains filtered or unexported fields
}

Server is a forwarding server. Server is used to create a single in-memory SSH server that will forward connections to a remote server. It's used along with the recording proxy to allow Teleport to record sessions with OpenSSH nodes at the proxy level.

To create a forwarding server and serve a single SSH connection on it:

serverConfig := forward.ServerConfig{
   ...
}
remoteServer, err := forward.New(serverConfig)
if err != nil {
	return nil, trace.Wrap(err)
}
go remoteServer.Serve()

conn, err := remoteServer.Dial()
if err != nil {
	return nil, trace.Wrap(err)
}

func New

func New(c ServerConfig) (*Server, error)

New creates a new unstarted Server.

func (*Server) AdvertiseAddr

func (s *Server) AdvertiseAddr() string

AdvertiseAddr is the address of the remote host this forwarding server is connected to.

func (*Server) Close

func (s *Server) Close() error

Close will close all underlying connections that the forwarding server holds.

func (*Server) Component

func (s *Server) Component() string

Component is the type of node this server is.

func (*Server) Context

func (s *Server) Context() context.Context

Context returns parent context, used to signal that parent server has been closed

func (*Server) Dial

func (s *Server) Dial() (net.Conn, error)

Dial returns the client connection created by pipeAddrConn.

func (*Server) GetAccessPoint

func (s *Server) GetAccessPoint() srv.AccessPoint

GetAccessPoint returns a srv.AccessPoint for this cluster.

func (Server) GetBPF

func (s Server) GetBPF() bpf.BPF

GetBPF returns the BPF service used by enhanced session recording. BPF for the forwarding server makes no sense (it has to run on the actual node), so return a NOP implementation.

func (*Server) GetClock

func (s *Server) GetClock() clockwork.Clock

GetClock returns server clock implementation

func (*Server) GetCreateHostUser

func (s *Server) GetCreateHostUser() bool

GetCreateHostUser determines whether users should be created on the host automatically

func (*Server) GetDataDir

func (s *Server) GetDataDir() string

GetDataDir returns server local storage

func (*Server) GetHostUsers

func (s *Server) GetHostUsers() srv.HostUsers

GetHostUser returns the HostUsers instance being used to manage host user provisioning, unimplemented for the forwarder server.

func (*Server) GetInfo

func (s *Server) GetInfo() types.Server

GetInfo returns a services.Server that represents this server.

func (*Server) GetLockWatcher

func (s *Server) GetLockWatcher() *services.LockWatcher

GetLockWatcher gets the server's lock watcher.

func (*Server) GetNamespace

func (s *Server) GetNamespace() string

GetNamespace returns the namespace the forwarding server resides in.

func (*Server) GetPAM

func (s *Server) GetPAM() (*pam.Config, error)

GetPAM returns the PAM configuration for a server. Because the forwarding server runs in-memory, it does not support PAM.

func (Server) GetRestrictedSessionManager

func (s Server) GetRestrictedSessionManager() restricted.Manager

GetRestrictedSessionManager returns a NOP manager since for a forwarding server it makes no sense (it has to run on the actual node).

func (*Server) GetUtmpPath

func (s *Server) GetUtmpPath() (string, string)

GetUtmpPath returns the optional override of the utmp and wtmp path. These values are never set for the forwarding server because utmp and wtmp are updated by the target server and not the forwarding server.

func (*Server) HostUUID

func (s *Server) HostUUID() string

HostUUID is the UUID of the underlying proxy that the forwarding server is running in.

func (*Server) ID

func (s *Server) ID() string

ID returns the ID of the proxy that creates the in-memory forwarding server.

func (*Server) PermitUserEnvironment

func (s *Server) PermitUserEnvironment() bool

PermitUserEnvironment is always false because it's up the the remote host to decide if the user environment will be read or not.

func (*Server) Serve

func (s *Server) Serve()

func (*Server) TargetMetadata

func (s *Server) TargetMetadata() apievents.ServerMetadata

TargetMetadata returns metadata about the forwarding target.

func (*Server) UseTunnel

func (s *Server) UseTunnel() bool

UseTunnel used to determine if this node has connected to this cluster using reverse tunnel.

type ServerConfig

type ServerConfig struct {
	AuthClient      auth.ClientI
	UserAgent       teleagent.Agent
	TargetConn      net.Conn
	SrcAddr         net.Addr
	DstAddr         net.Addr
	HostCertificate ssh.Signer

	// UseTunnel indicates of this server is connected over a reverse tunnel.
	UseTunnel bool

	// Address is the name of the host certificate.
	Address string

	// Ciphers is a list of ciphers that the server supports. If omitted,
	// the defaults will be used.
	Ciphers []string

	// KEXAlgorithms is a list of key exchange (KEX) algorithms that the
	// server supports. If omitted, the defaults will be used.
	KEXAlgorithms []string

	// MACAlgorithms is a list of message authentication codes (MAC) that
	// the server supports. If omitted the defaults will be used.
	MACAlgorithms []string

	// DataDir is a local data directory used for local server storage
	DataDir string

	// Clock is an optoinal clock to override default real time clock
	Clock clockwork.Clock

	// FIPS mode means Teleport started in a FedRAMP/FIPS 140-2 compliant
	// configuration.
	FIPS bool

	// HostUUID is the UUID of the underlying proxy that the forwarding server
	// is running in.
	HostUUID string

	// Emitter is audit events emitter
	Emitter events.StreamEmitter

	// ParentContext is a parent context, used to signal global
	// closure
	ParentContext context.Context

	// LockWatcher is a lock watcher.
	LockWatcher *services.LockWatcher

	// TracerProvider is used to create tracers capable
	// of starting spans.
	TracerProvider oteltrace.TracerProvider

	TargetID, TargetAddr, TargetHostname string
}

ServerConfig is the configuration needed to create an instance of a Server.

func (*ServerConfig) CheckDefaults

func (s *ServerConfig) CheckDefaults() error

CheckDefaults makes sure all required parameters are passed in.