From ff714af48639fca68167c7760368be1e7f3a981b Mon Sep 17 00:00:00 2001 From: rosstimothy <39066650+rosstimothy@users.noreply.github.com> Date: Thu, 5 Mar 2026 11:31:10 -0500 Subject: [PATCH] Inject insecure mode instead of relying on global variable (#63825) Part 1 or removing InsecureDevMode - enterprise still relies on it so a few TODOs were left around for clean up later. This global is mostly leveraged in tests to permit trust when self-signed certificates are used. These tests are often spinning up multiple teleport instances and most of the time exercise trusted clusters which makes them slow. Due to the global nature of InsecureDevMode these tests cannot be run in parallel. --- e2e/aws/fixtures_test.go | 1 + e2e/aws/main_test.go | 3 - integration/appaccess/fixtures.go | 11 +-- integration/appaccess/pack.go | 2 + integration/db/fixture.go | 8 +- integration/ec2_test.go | 6 +- integration/helpers/helpers.go | 9 +- integration/helpers/instance.go | 2 + integration/integration_test.go | 86 +++++++------------ integration/kube_integration_test.go | 11 +-- integration/proxy/proxy_helpers.go | 6 +- integration/proxy/proxy_test.go | 63 +++++--------- .../proxy/proxy_tunnel_strategy_test.go | 7 +- integration/proxy/teleterm_test.go | 4 - integration/teleterm_test.go | 2 + integration/time_sync_test.go | 3 - integration/web/web_test.go | 8 +- .../controllers/resources/testlib/env.go | 12 ++- .../trusted_clusterv2_controller_test.go | 12 +-- lib/auth/auth.go | 6 +- lib/auth/authtest/authtest.go | 2 + lib/auth/init.go | 5 +- lib/auth/init_test.go | 5 +- lib/auth/trustedcluster.go | 5 +- lib/config/configuration.go | 19 ++-- lib/config/configuration_test.go | 3 - lib/integrations/awsoidc/idp_iam_config.go | 3 +- .../awsoidc/idp_iam_config_test.go | 14 ++- lib/integrations/awsoidc/idp_thumbprint.go | 5 +- .../awsoidc/idp_thumbprint_test.go | 8 +- lib/reversetunnel/agentpool.go | 19 ++-- lib/reversetunnel/rc_manager.go | 3 + lib/service/connect.go | 5 +- lib/service/db.go | 1 + lib/service/desktop.go | 1 + lib/service/kubernetes.go | 1 + lib/service/service.go | 12 ++- lib/service/service_test.go | 12 +-- lib/service/servicecfg/config.go | 3 +- lib/srv/app/connections_handler.go | 4 + lib/srv/app/session.go | 1 + lib/srv/app/transport.go | 6 +- lib/srv/mcp/server.go | 2 + lib/srv/mcp/sse.go | 3 +- lib/web/apiserver.go | 4 + lib/web/apiserver_test.go | 16 +++- lib/web/oidcidp.go | 2 +- lib/web/oidcidp_test.go | 8 +- tool/teleport/common/integration_configure.go | 8 +- tool/tsh/common/access_request_test.go | 5 +- tool/tsh/common/app_aws_test.go | 8 +- tool/tsh/common/app_azure_test.go | 3 +- tool/tsh/common/app_test.go | 2 + tool/tsh/common/db_test.go | 15 +--- tool/tsh/common/hardware_key_test.go | 8 +- tool/tsh/common/kube_test.go | 19 +--- tool/tsh/common/proxy_test.go | 56 ++++-------- tool/tsh/common/tsh_helper_test.go | 2 + tool/tsh/common/tsh_test.go | 48 ++++++----- 59 files changed, 266 insertions(+), 342 deletions(-) diff --git a/e2e/aws/fixtures_test.go b/e2e/aws/fixtures_test.go index b25efa69823..19742956755 100644 --- a/e2e/aws/fixtures_test.go +++ b/e2e/aws/fixtures_test.go @@ -202,6 +202,7 @@ func newTeleportConfig() *servicecfg.Config { tconf.PollingPeriod = 500 * time.Millisecond tconf.Testing.ClientTimeout = time.Second tconf.Testing.ShutdownTimeout = 2 * tconf.Testing.ClientTimeout + tconf.InsecureMode = true return tconf } diff --git a/e2e/aws/main_test.go b/e2e/aws/main_test.go index a7adda21475..e873addf1ac 100644 --- a/e2e/aws/main_test.go +++ b/e2e/aws/main_test.go @@ -22,7 +22,6 @@ import ( "testing" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/utils/log/logtest" ) @@ -142,7 +141,5 @@ const ( // it as an argument. Otherwise, it will run tests as normal. func TestMain(m *testing.M) { logtest.InitLogger(testing.Verbose) - // agents connect over a reverse tunnel to proxy, so we use insecure mode. - lib.SetInsecureDevMode(true) helpers.TestMainImplementation(m) } diff --git a/integration/appaccess/fixtures.go b/integration/appaccess/fixtures.go index a604be58556..553f57b2a00 100644 --- a/integration/appaccess/fixtures.go +++ b/integration/appaccess/fixtures.go @@ -37,7 +37,6 @@ import ( "github.com/gravitational/teleport" "github.com/gravitational/teleport/api/breaker" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/testauthority" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/utils" @@ -68,10 +67,6 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { log := logtest.NewLogger() - // Insecure development mode needs to be set because the web proxy uses a - // self-signed certificate during tests. - lib.SetInsecureDevMode(true) - p := &Pack{ rootAppName: "app-01", rootAppPublicAddr: "app-01.example.com", @@ -347,6 +342,9 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { p.leafCluster = helpers.NewInstance(t, leafCfg) rcConf := servicecfg.MakeDefaultConfig() + // Insecure development mode needs to be set because the web proxy uses a + // self-signed certificate during tests. + rcConf.InsecureMode = true rcConf.Logger = log rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true @@ -364,6 +362,9 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { rcConf.Clock = opts.Clock lcConf := servicecfg.MakeDefaultConfig() + // Insecure development mode needs to be set because the web proxy uses a + // self-signed certificate during tests. + lcConf.InsecureMode = true lcConf.Logger = log lcConf.DataDir = t.TempDir() lcConf.Auth.Enabled = true diff --git a/integration/appaccess/pack.go b/integration/appaccess/pack.go index 0dfd147c83d..f0f486d812f 100644 --- a/integration/appaccess/pack.go +++ b/integration/appaccess/pack.go @@ -772,6 +772,7 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions) raConf.Apps.MCPDemoServer = true raConf.CircuitBreakerConfig = breaker.NoopBreakerConfig() raConf.Apps.MonitorCloseChannel = opts.MonitorCloseChannel + raConf.InsecureMode = true raConf.Apps.Apps = append([]servicecfg.App{ { Name: p.rootAppName, @@ -941,6 +942,7 @@ func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions) laConf.Apps.Enabled = true laConf.CircuitBreakerConfig = breaker.NoopBreakerConfig() laConf.Apps.MonitorCloseChannel = opts.MonitorCloseChannel + laConf.InsecureMode = true laConf.Apps.Apps = append([]servicecfg.App{ { Name: p.leafAppName, diff --git a/integration/db/fixture.go b/integration/db/fixture.go index 0abd30748fc..8b9065f7ba7 100644 --- a/integration/db/fixture.go +++ b/integration/db/fixture.go @@ -36,7 +36,6 @@ import ( apidefaults "github.com/gravitational/teleport/api/defaults" "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/authtest" "github.com/gravitational/teleport/lib/auth/testauthority" @@ -130,6 +129,7 @@ func (pack *databaseClusterPack) StartDatabaseServices(t *testing.T, clock clock conf := servicecfg.MakeDefaultConfig() conf.DataDir = filepath.Join(t.TempDir(), pack.name) conf.SetToken("static-token-value") + conf.InsecureMode = true conf.SetAuthServerAddress(utils.NetAddr{ AddrNetwork: "tcp", @@ -256,7 +256,6 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack { // Some global setup. tracer := utils.NewTracer(utils.ThisFunction()).Start() t.Cleanup(func() { tracer.Stop() }) - lib.SetInsecureDevMode(true) log := logtest.NewLogger() // Generate keypair. @@ -297,6 +296,7 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack { // Make root cluster config. rcConf := servicecfg.MakeDefaultConfig() + rcConf.InsecureMode = true rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Auth.Clock = p.clock @@ -304,6 +304,7 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack { rcConf.Proxy.Enabled = true rcConf.Proxy.DisableWebInterface = true rcConf.Clock = p.clock + rcConf.InsecureMode = true rcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig() if opts.rootConfig != nil { opts.rootConfig(rcConf) @@ -312,12 +313,14 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack { // Make leaf cluster config. lcConf := servicecfg.MakeDefaultConfig() lcConf.DataDir = t.TempDir() + lcConf.InsecureMode = true lcConf.Auth.Enabled = true lcConf.Auth.Clock = p.clock lcConf.Auth.Preference.SetSecondFactor("off") lcConf.Proxy.Enabled = true lcConf.Proxy.DisableWebInterface = true lcConf.Clock = p.clock + lcConf.InsecureMode = true lcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig() if opts.leafConfig != nil { opts.leafConfig(lcConf) @@ -456,6 +459,7 @@ func (p *DatabasePack) startRootDatabaseAgent(t *testing.T, params databaseAgent conf.Databases.Databases = params.databases conf.Databases.ResourceMatchers = params.resourceMatchers conf.CircuitBreakerConfig = breaker.NoopBreakerConfig() + conf.InsecureMode = true server, authClient, hostUUID, err := p.Root.Cluster.StartDatabase(conf) require.NoError(t, err) diff --git a/integration/ec2_test.go b/integration/ec2_test.go index 1f9e67b1b86..846541c41ff 100644 --- a/integration/ec2_test.go +++ b/integration/ec2_test.go @@ -41,7 +41,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/utils/clientutils" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/backend" "github.com/gravitational/teleport/lib/backend/lite" cloudimds "github.com/gravitational/teleport/lib/cloud/imds" @@ -280,10 +279,6 @@ func TestIAMNodeJoin(t *testing.T) { require.NoError(t, err) require.NotEmpty(t, proxies) }, 10*time.Second, 50*time.Millisecond, "waiting for proxy to join cluster") - // InsecureDevMode needed for node to trust proxy - wasInsecureDevMode := lib.IsInsecureDevMode() - t.Cleanup(func() { lib.SetInsecureDevMode(wasInsecureDevMode) }) - lib.SetInsecureDevMode(true) // sanity check there are no nodes to start with nodes, err := authServer.GetNodes(ctx, apidefaults.Namespace) @@ -294,6 +289,7 @@ func TestIAMNodeJoin(t *testing.T) { // connecting to the proxy nodeConfig := newNodeConfig(t, tokenName, types.JoinMethodIAM) nodeConfig.ProxyServer = proxyConfig.Proxy.WebAddr + nodeConfig.InsecureMode = true nodeSvc, err := service.NewTeleport(nodeConfig) require.NoError(t, err) require.NoError(t, nodeSvc.Start()) diff --git a/integration/helpers/helpers.go b/integration/helpers/helpers.go index d38d41b8b06..5ab59afecf3 100644 --- a/integration/helpers/helpers.go +++ b/integration/helpers/helpers.go @@ -48,7 +48,6 @@ import ( apievents "github.com/gravitational/teleport/api/types/events" "github.com/gravitational/teleport/api/utils/keys" "github.com/gravitational/teleport/api/utils/retryutils" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/backend" @@ -457,11 +456,10 @@ func MakeTestServers(t *testing.T) (auth *service.TeleportProcess, proxy *servic // MakeTestDatabaseServer creates a Database Service // It receives the Proxy Address, a Token (to join the cluster) and a list of Datbases func MakeTestDatabaseServer(t *testing.T, proxyAddr utils.NetAddr, token string, resMatchers []services.ResourceMatcher, dbs ...servicecfg.Database) (db *service.TeleportProcess) { - // Proxy uses self-signed certificates in tests. - lib.SetInsecureDevMode(true) - cfg := servicecfg.MakeDefaultConfig() cfg.DebugService.Enabled = false + // Proxy uses self-signed certificates in tests. + cfg.InsecureMode = true cfg.Hostname = "localhost" cfg.DataDir = t.TempDir() cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig() @@ -495,8 +493,7 @@ func MakeTestDatabaseServer(t *testing.T, proxyAddr utils.NetAddr, token string, // It receives the Proxy Address, a Token (to join the cluster). func MakeAgentServer(t *testing.T, cfg *servicecfg.Config, proxyAddr utils.NetAddr, token string) *service.TeleportProcess { // Proxy uses self-signed certificates in tests. - lib.SetInsecureDevMode(true) - + cfg.InsecureMode = true cfg.Hostname = "localhost" cfg.DataDir = t.TempDir() cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig() diff --git a/integration/helpers/instance.go b/integration/helpers/instance.go index ffa4b2ed1b8..3ef4c75d7d1 100644 --- a/integration/helpers/instance.go +++ b/integration/helpers/instance.go @@ -902,6 +902,7 @@ func (i *TeleInstance) StartApps(configs []*servicecfg.Config) ([]*service.Telep cfg.Auth.Enabled = false cfg.Proxy.Enabled = false cfg.DebugService.Enabled = false + cfg.InsecureMode = true // Create a new Teleport process and add it to the list of nodes that // compose this "cluster". @@ -1095,6 +1096,7 @@ func (i *TeleInstance) StartNodeAndProxy(t *testing.T, name string) (sshPort, we } tconf.Auth.Enabled = false + tconf.InsecureMode = true tconf.Proxy.Enabled = true tconf.Proxy.SSHAddr.Addr = NewListenerOn(t, i.Hostname, service.ListenerProxySSH, &tconf.FileDescriptors) diff --git a/integration/integration_test.go b/integration/integration_test.go index 40d017fc951..192b8548ef0 100644 --- a/integration/integration_test.go +++ b/integration/integration_test.go @@ -77,7 +77,6 @@ import ( "github.com/gravitational/teleport/api/utils/prompt" apisshutils "github.com/gravitational/teleport/api/utils/sshutils" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/mocku2f" @@ -717,6 +716,7 @@ func (s *integrationTestSuite) newTeleportIoT(t *testing.T, logins []string) *he mainConfig := func() *servicecfg.Config { tconf := s.defaultServiceConfig() tconf.Auth.Enabled = true + tconf.InsecureMode = true tconf.Proxy.Enabled = true tconf.Proxy.DisableWebService = false @@ -742,6 +742,7 @@ func (s *integrationTestSuite) newTeleportIoT(t *testing.T, logins []string) *he tconf.Proxy.Enabled = false tconf.SSH.Enabled = true + tconf.InsecureMode = true return tconf } @@ -857,10 +858,6 @@ func testInteractiveReverseTunnel(t *testing.T, suite *integrationTestSuite) { tr := utils.NewTracer(utils.ThisFunction()).Start() defer tr.Stop() - // InsecureDevMode needed for IoT node handshake - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - teleport := suite.newTeleportIoT(t, nil) defer teleport.StopAll() @@ -1190,10 +1187,6 @@ func testCustomReverseTunnel(t *testing.T, suite *integrationTestSuite) { tr := utils.NewTracer(utils.ThisFunction()).Start() defer tr.Stop() - // InsecureDevMode needed for IoT node handshake - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - failingListener, err := net.Listen("tcp", "localhost:0") require.NoError(t, err) @@ -1202,6 +1195,7 @@ func testCustomReverseTunnel(t *testing.T, suite *integrationTestSuite) { // Create a Teleport instance with Auth/Proxy. conf := suite.defaultServiceConfig() + conf.InsecureMode = true conf.Auth.Enabled = true conf.Proxy.Enabled = true conf.Proxy.DisableWebService = false @@ -1230,6 +1224,7 @@ func testCustomReverseTunnel(t *testing.T, suite *integrationTestSuite) { nodeConf.Auth.Enabled = false nodeConf.Proxy.Enabled = false nodeConf.SSH.Enabled = true + nodeConf.InsecureMode = true t.Setenv(defaults.TunnelPublicAddrEnvar, main.Web) // verify the node is able to join the cluster @@ -1403,6 +1398,7 @@ func testIPPropagation(t *testing.T, suite *integrationTestSuite) { conf.Proxy.Enabled = false conf.Apps.Enabled = false conf.Databases.Enabled = false + conf.InsecureMode = true process, err := service.NewTeleport(conf) require.NoError(t, err) @@ -2648,10 +2644,9 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) { tconf := suite.defaultServiceConfig() tconf.SSH.Enabled = enableSSH tconf.Proxy.DisableWebService = false + tconf.InsecureMode = true return t, nil, tconf } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) require.NoError(t, main.CreateEx(makeConfig(false))) require.NoError(t, aux.CreateEx(makeConfig(true))) @@ -2973,12 +2968,10 @@ func createAndUpdateTrustedClusters(t *testing.T, suite *integrationTestSuite, t tconf.SSH.Enabled = enableSSH tconf, err := instance.GenerateConfig(t, nil, tconf) require.NoError(t, err) - + tconf.InsecureMode = true tconf.CachePolicy.Enabled = false return t, tconf } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) require.NoError(t, main.CreateWithConf(makeConfig(main, false))) require.NoError(t, aux.CreateWithConf(makeConfig(aux, true))) @@ -3097,10 +3090,9 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus tconf := suite.defaultServiceConfig() tconf.Proxy.DisableWebService = false tconf.SSH.Enabled = enableSSH + tconf.InsecureMode = true return t, nil, tconf } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) require.NoError(t, main.CreateEx(makeConfig(false))) require.NoError(t, aux.CreateEx(makeConfig(true))) @@ -3341,11 +3333,9 @@ func trustedDisabledCluster(t *testing.T, suite *integrationTestSuite, test trus require.NoError(t, err) tconf.CachePolicy.Enabled = false - + tconf.InsecureMode = true return t, tconf } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) require.NoError(t, main.CreateWithConf(makeConfig(main, false))) require.NoError(t, aux.CreateWithConf(makeConfig(aux, true))) @@ -3477,12 +3467,10 @@ func trustedClustersRoleMapChanges(t *testing.T, suite *integrationTestSuite, te tconf.SSH.Enabled = enableSSH tconf, err := instance.GenerateConfig(t, nil, tconf) require.NoError(t, err) - + tconf.InsecureMode = true tconf.CachePolicy.Enabled = false return t, tconf } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) require.NoError(t, main.CreateWithConf(makeConfig(main, false))) require.NoError(t, aux.CreateWithConf(makeConfig(aux, true))) @@ -3584,10 +3572,9 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) { tconf.Proxy.DisableWebService = false tconf.SSH.Enabled = enableSSH tconf.CachePolicy.MaxRetryPeriod = time.Millisecond * 500 + tconf.InsecureMode = true return t, nil, tconf } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) require.NoError(t, main.CreateEx(makeConfig(false))) require.NoError(t, aux.CreateEx(makeConfig(true))) @@ -3637,6 +3624,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) { tconf.Auth.Enabled = false tconf.Proxy.Enabled = false tconf.SSH.Enabled = true + tconf.InsecureMode = true return tconf } _, err = aux.StartNode(nodeConfig()) @@ -3725,10 +3713,9 @@ func testTrustedClusterAgentless(t *testing.T, suite *integrationTestSuite) { tconf := suite.defaultServiceConfig() tconf.Proxy.DisableWebService = false tconf.SSH.Enabled = enableSSH + tconf.InsecureMode = true return t, nil, tconf } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) require.NoError(t, main.CreateEx(makeConfig(false))) require.NoError(t, leaf.CreateEx(makeConfig(false))) @@ -4121,9 +4108,6 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) { tr := utils.NewTracer(utils.ThisFunction()).Start() t.Cleanup(func() { tr.Stop() }) - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) - // Create and start load balancer for proxies. frontend := *utils.MustParseAddr(net.JoinHostPort(Loopback, "0")) lb, err := utils.NewLoadBalancer(ctx, frontend) @@ -4135,7 +4119,7 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) { // Create a Teleport instance with Auth/Proxy. mainConfig := func() (*testing.T, []string, []*helpers.InstanceSecrets, *servicecfg.Config) { tconf := suite.defaultServiceConfig() - + tconf.InsecureMode = true tconf.Auth.Enabled = true tconf.Proxy.Enabled = true @@ -4198,6 +4182,7 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) { tconf.Auth.Enabled = false tconf.Proxy.Enabled = false tconf.SSH.Enabled = true + tconf.InsecureMode = true return tconf } @@ -4273,9 +4258,6 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) { tr := utils.NewTracer(utils.ThisFunction()).Start() defer tr.Stop() - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - // Create and start load balancer for proxies. frontend := *utils.MustParseAddr(net.JoinHostPort(Loopback, "0")) lb, err := utils.NewLoadBalancer(ctx, frontend) @@ -4290,7 +4272,7 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) { tconf := suite.defaultServiceConfig() tconf.Auth.Enabled = true - + tconf.InsecureMode = true tconf.Proxy.Enabled = true tconf.Proxy.TunnelPublicAddrs = []utils.NetAddr{ { @@ -4329,6 +4311,7 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) { tconf := suite.defaultServiceConfig() tconf.Hostname = "cluster-main-node" tconf.SetToken("token") + tconf.InsecureMode = true tconf.SetAuthServerAddress(utils.NetAddr{ AddrNetwork: "tcp", Addr: main.Web, @@ -5536,6 +5519,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) { clusterAux := "rotate-aux" tconf := suite.rotationConfig(false) + tconf.InsecureMode = true main := suite.newNamedTeleportInstance(t, clusterMain) aux := suite.newNamedTeleportInstance(t, clusterAux) @@ -5583,7 +5567,9 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) { require.NoError(t, err) // create auxiliary cluster and setup trust - require.NoError(t, aux.CreateEx(t, nil, suite.rotationConfig(false))) + auxConfig := suite.rotationConfig(false) + auxConfig.InsecureMode = true + require.NoError(t, aux.CreateEx(t, nil, auxConfig)) // auxiliary cluster has a role aux-devs // connect aux cluster to main cluster @@ -5608,10 +5594,6 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) { }) require.NoError(t, aux.Start()) - // try and upsert a trusted cluster - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - const skipNameValidation = false helpers.TryUpsertTrustedCluster(t, aux.Process.GetAuthServer(), trustedCluster, skipNameValidation) helpers.WaitForTunnelConnections(t, svc.GetAuthServer(), aux.Secrets.SiteName, 1) @@ -6031,10 +6013,6 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) { tr := utils.NewTracer(utils.ThisFunction()).Start() defer tr.Stop() - // InsecureDevMode needed for IoT node handshake - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - // Create and start a Teleport cluster with auth, proxy, and node. makeConfig := func() *servicecfg.Config { recConfig, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{ @@ -6043,6 +6021,7 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) { require.NoError(t, err) tconf := suite.defaultServiceConfig() + tconf.InsecureMode = true tconf.Hostname = "server-01" tconf.Auth.Enabled = true tconf.Auth.SessionRecordingConfig = recConfig @@ -6068,6 +6047,7 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) { "role": "database", "spam": "eggs", } + tconf.InsecureMode = true return tconf } @@ -7478,6 +7458,7 @@ func createTrustedClusterPair(t *testing.T, suite *integrationTestSuite, extraSe tconf.Proxy.DisableWebService = false tconf.SSH.Enabled = false tconf.CachePolicy.MaxRetryPeriod = time.Millisecond * 500 + tconf.InsecureMode = true for _, opt := range cfgOpts { opt(tconf, isRoot) @@ -7486,10 +7467,6 @@ func createTrustedClusterPair(t *testing.T, suite *integrationTestSuite, extraSe return t, nil, tconf } - oldInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(oldInsecure) - require.NoError(t, root.CreateEx(makeConfig(true))) require.NoError(t, leaf.CreateEx(makeConfig(false))) _, err = leaf.Process.GetAuthServer().UpsertRole(ctx, role) @@ -7564,12 +7541,10 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) { multiplexer.PROXYProtocolOn, multiplexer.PROXYProtocolOff, multiplexer.PROXYProtocolUnspecified, } { t.Run(fmt.Sprintf("proxy protocol mode: %v", proxyProtocolMode), func(t *testing.T) { - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) - // Create a Teleport instance with Auth/Proxy. mainConfig := suite.defaultServiceConfig() mainConfig.Auth.Enabled = true + mainConfig.InsecureMode = true mainConfig.Proxy.Enabled = true mainConfig.Proxy.DisableWebService = false @@ -7596,6 +7571,7 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) { nodeConfig := suite.defaultServiceConfig() nodeConfig.Hostname = Host nodeConfig.SetToken("token") + nodeConfig.InsecureMode = true nodeConfig.Auth.Enabled = false nodeConfig.Proxy.Enabled = false @@ -7614,12 +7590,10 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) { // Assert that gRPC-based join methods work over reverse tunnel. t.Run("gRPC join service", func(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - // Create a Teleport instance with Auth/Proxy. mainConfig := suite.defaultServiceConfig() mainConfig.Auth.Enabled = true + mainConfig.InsecureMode = true mainConfig.Proxy.Enabled = true mainConfig.Proxy.DisableWebService = false @@ -9191,14 +9165,11 @@ func testNegotiatedALPNProtocols(t *testing.T, suite *integrationTestSuite) { } func testForceListenerInTunnelMode(t *testing.T, suite *integrationTestSuite) { - // InsecureDevMode needed for IoT node handshake - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - // Create a Teleport instance with Auth/Proxy. mainConfig := func() *servicecfg.Config { tconf := suite.defaultServiceConfig() tconf.Auth.Enabled = true + tconf.InsecureMode = true tconf.Proxy.Enabled = true tconf.Proxy.DisableWebService = false @@ -9214,6 +9185,7 @@ func testForceListenerInTunnelMode(t *testing.T, suite *integrationTestSuite) { tconf := suite.defaultServiceConfig() tconf.Hostname = Host tconf.SetToken("token") + tconf.InsecureMode = true if tunnel { tconf.SetAuthServerAddress(utils.NetAddr{ diff --git a/integration/kube_integration_test.go b/integration/kube_integration_test.go index d93ce5eb8b8..554bdf258e4 100644 --- a/integration/kube_integration_test.go +++ b/integration/kube_integration_test.go @@ -74,7 +74,6 @@ import ( "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/integration/kube" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/testauthority" "github.com/gravitational/teleport/lib/client" @@ -811,13 +810,12 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) { Logger: suite.log, }) - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - + mainConf.InsecureMode = true mainConf.Proxy.Kube.Enabled = true err = main.CreateEx(t, nil, mainConf) require.NoError(t, err) + auxConf.InsecureMode = true err = aux.CreateEx(t, nil, auxConf) require.NoError(t, err) @@ -1084,9 +1082,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) { Logger: suite.log, }) - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - + mainConf.InsecureMode = true // route all the traffic to the aux cluster mainConf.Proxy.Kube.Enabled = true // ClusterOverride forces connection to be routed @@ -1095,6 +1091,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) { err = main.CreateEx(t, nil, mainConf) require.NoError(t, err) + auxConf.InsecureMode = true err = aux.CreateEx(t, nil, auxConf) require.NoError(t, err) diff --git a/integration/proxy/proxy_helpers.go b/integration/proxy/proxy_helpers.go index 892eae0537a..7ae6cc7d1c8 100644 --- a/integration/proxy/proxy_helpers.go +++ b/integration/proxy/proxy_helpers.go @@ -51,7 +51,6 @@ import ( apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/api/utils/retryutils" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/state" "github.com/gravitational/teleport/lib/client" "github.com/gravitational/teleport/lib/defaults" @@ -206,6 +205,7 @@ func (p *Suite) addNodeToLeafCluster(t *testing.T, tunnelNodeHostname string) { tconf.Auth.Enabled = false tconf.Proxy.Enabled = false tconf.SSH.Enabled = true + tconf.InsecureMode = true tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig() return tconf } @@ -329,6 +329,7 @@ func rootClusterStandardConfig(t *testing.T) func(suite *Suite) *servicecfg.Conf return func(suite *Suite) *servicecfg.Config { rc := suite.root config := servicecfg.MakeDefaultConfig() + config.InsecureMode = true config.DataDir = t.TempDir() config.Auth.Enabled = true config.Auth.Preference.SetSecondFactor("off") @@ -349,6 +350,7 @@ func leafClusterStandardConfig(t *testing.T) func(suite *Suite) *servicecfg.Conf return func(suite *Suite) *servicecfg.Config { lc := suite.leaf config := servicecfg.MakeDefaultConfig() + config.InsecureMode = true config.DataDir = t.TempDir() config.Auth.Enabled = true config.Auth.Preference.SetSecondFactor("off") @@ -661,7 +663,7 @@ func mustRegisterUsingIAMMethod(t *testing.T, proxyAddr utils.NetAddr, token str }, ProxyServer: proxyAddr, JoinMethod: types.JoinMethodIAM, - Insecure: lib.IsInsecureDevMode(), + Insecure: true, }) require.NoError(t, err, trace.DebugReport(err)) } diff --git a/integration/proxy/proxy_test.go b/integration/proxy/proxy_test.go index c8d40b5d6fd..290f1682b90 100644 --- a/integration/proxy/proxy_test.go +++ b/integration/proxy/proxy_test.go @@ -51,12 +51,10 @@ import ( dbhelpers "github.com/gravitational/teleport/integration/db" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/integration/kube" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/testauthority" libclient "github.com/gravitational/teleport/lib/client" "github.com/gravitational/teleport/lib/client/mfa" "github.com/gravitational/teleport/lib/defaults" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/service" "github.com/gravitational/teleport/lib/service/servicecfg" @@ -111,17 +109,16 @@ func TestALPNSNIProxyMultiCluster(t *testing.T) { for _, tc := range testCase { t.Run(tc.name, func(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - username := helpers.MustGetCurrentUser(t).Username suite := newSuite(t, withRootClusterConfig(rootClusterStandardConfig(t), func(config *servicecfg.Config) { config.Proxy.DisableALPNSNIListener = tc.disableALPNListenerOnRoot + config.InsecureMode = true }), withLeafClusterConfig(leafClusterStandardConfig(t), func(config *servicecfg.Config) { config.Proxy.DisableALPNSNIListener = tc.disableALPNListenerOnLeaf + config.InsecureMode = true }), withRootClusterListeners(tc.mainClusterPortSetup), withLeafClusterListeners(tc.secondClusterPortSetup), @@ -215,9 +212,6 @@ func TestALPNSNIProxyTrustedClusterNode(t *testing.T) { } for _, tc := range testCase { t.Run(tc.name, func(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - username := helpers.MustGetCurrentUser(t).Username opts := []proxySuiteOptionsFunc{ @@ -407,9 +401,6 @@ func TestALPNSNIProxyKube(t *testing.T) { // TestALPNSNIProxyKubeV2Leaf tests remove cluster kubernetes configuration where root and leaf proxies // are using V2 configuration with Multiplex proxy listener. func TestALPNSNIProxyKubeV2Leaf(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - const ( localK8SNI = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local" k8User = "alice@example.com" @@ -441,10 +432,12 @@ func TestALPNSNIProxyKubeV2Leaf(t *testing.T) { suite := newSuite(t, withRootClusterConfig(rootClusterStandardConfig(t), func(config *servicecfg.Config) { + config.InsecureMode = true config.Proxy.Kube.Enabled = true config.Version = defaults.TeleportConfigVersionV2 }), withLeafClusterConfig(leafClusterStandardConfig(t), func(config *servicecfg.Config) { + config.InsecureMode = true config.Version = defaults.TeleportConfigVersionV2 config.Proxy.Kube.Enabled = true @@ -477,9 +470,6 @@ func TestALPNSNIProxyKubeV2Leaf(t *testing.T) { // TestKubePROXYProtocol tests correct behavior of Proxy Kube listener regarding PROXY protocol usage. func TestKubePROXYProtocol(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - const ( kubeCluster = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local" k8User = "alice@example.com" @@ -566,6 +556,7 @@ func TestKubePROXYProtocol(t *testing.T) { Logger: logtest.NewLogger(), } tconf := servicecfg.MakeDefaultConfig() + tconf.InsecureMode = true tconf.Proxy.Kube.ListenAddr = *utils.MustParseAddr(helpers.NewListener(t, service.ListenerProxyKube, &cfg.Fds)) if tt.proxyListenerMode == types.ProxyListenerMode_Multiplex { cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds) @@ -702,10 +693,6 @@ func createALPNLocalKubeClient(t *testing.T, targetAddr utils.NetAddr, teleportC } func TestKubeIPPinning(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - modules.SetInsecureTestMode(true) - const ( kubeCluster = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local" k8User = "alice@example.com" @@ -739,6 +726,7 @@ func TestKubeIPPinning(t *testing.T) { suite := newSuite(t, withRootClusterConfig(rootClusterStandardConfig(t), func(config *servicecfg.Config) { + config.InsecureMode = true config.Proxy.Kube.Enabled = true config.Version = defaults.TeleportConfigVersionV3 @@ -749,6 +737,7 @@ func TestKubeIPPinning(t *testing.T) { }), withLeafClusterConfig(leafClusterStandardConfig(t), func(config *servicecfg.Config) { config.Version = defaults.TeleportConfigVersionV3 + config.InsecureMode = true config.Proxy.Kube.Enabled = true config.Kube.Enabled = true @@ -1346,9 +1335,6 @@ func TestALPNSNIProxyAppAccess(t *testing.T) { // TestALPNProxyRootLeafAuthDial tests dialing local/remote auth service based on ALPN // teleport-auth protocol and ServerName as encoded cluster name. func TestALPNProxyRootLeafAuthDial(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - username := helpers.MustGetCurrentUser(t).Username suite := newSuite(t, @@ -1400,9 +1386,6 @@ func TestALPNProxyRootLeafAuthDial(t *testing.T) { // TestALPNProxyAuthClientConnectWithUserIdentity creates and connects to the Auth service // using user identity file when teleport is configured with Multiple proxy listener mode. func TestALPNProxyAuthClientConnectWithUserIdentity(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - cfg := helpers.InstanceConfig{ ClusterName: "root.example.com", HostID: uuid.New().String(), @@ -1413,6 +1396,7 @@ func TestALPNProxyAuthClientConnectWithUserIdentity(t *testing.T) { rc := helpers.NewInstance(t, cfg) rcConf := servicecfg.MakeDefaultConfig() + rcConf.InsecureMode = true rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) @@ -1499,9 +1483,6 @@ func TestALPNProxyAuthClientConnectWithUserIdentity(t *testing.T) { // TestALPNProxyDialProxySSHWithoutInsecureMode tests dialing to the localhost with teleport-proxy-ssh // protocol without using insecure mode in order to check if establishing connection to localhost works properly. func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - privateKey, publicKey, err := testauthority.GenerateKeyPair() require.NoError(t, err) @@ -1520,6 +1501,7 @@ func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) { // Make root cluster config. rcConf := servicecfg.MakeDefaultConfig() + rcConf.InsecureMode = true rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Auth.Preference.SetSecondFactor("off") @@ -1536,8 +1518,6 @@ func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) { rc.StopAll() }) - // Disable insecure mode to make sure that dialing to localhost works. - lib.SetInsecureDevMode(false) cfg := helpers.ClientConfig{ Login: username, Cluster: rc.Secrets.SiteName, @@ -1568,9 +1548,6 @@ func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) { // TestALPNProxyHTTPProxyNoProxyDial tests if a node joining to root cluster // takes into account http_proxy and no_proxy env variables. func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - // We need to use the non-loopback address for our Teleport cluster, as the // Go HTTP library will recognize requests to the loopback address and // refuse to use the HTTP proxy, which will invalidate the test. @@ -1589,6 +1566,7 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) { rc.AddUser(username, []string{username}) rcConf := servicecfg.MakeDefaultConfig() + rcConf.InsecureMode = true rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) @@ -1597,6 +1575,7 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) { rcConf.Proxy.DisableWebInterface = true rcConf.SSH.Enabled = false rcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig() + rcConf.InsecureMode = true err = rc.CreateEx(t, nil, rcConf) require.NoError(t, err) @@ -1620,7 +1599,9 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) { // Start the node, due to no_proxy=127.0.0.1 env variable the connection established // to the proxy should not go through the http_proxy server. - _, err = rc.StartNode(makeNodeConfig("first-root-node", rcProxyAddr)) + nodeConfig := makeNodeConfig("first-root-node", rcProxyAddr) + nodeConfig.InsecureMode = true + _, err = rc.StartNode(nodeConfig) require.NoError(t, err) ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(time.Second*30)) @@ -1634,7 +1615,9 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) { // Unset the no_proxy=127.0.0.1 env variable. After that a new node // should take into account the http_proxy address and connection should go through the http_proxy. require.NoError(t, os.Unsetenv("no_proxy")) - _, err = rc.StartNode(makeNodeConfig("second-root-node", rcProxyAddr)) + nodeConfig2 := makeNodeConfig("second-root-node", rcProxyAddr) + nodeConfig2.InsecureMode = true + _, err = rc.StartNode(nodeConfig2) require.NoError(t, err) err = rc.WaitForNodeCount(ctx, "root.example.com", 2) require.NoError(t, err) @@ -1645,9 +1628,6 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) { // TestALPNProxyHTTPProxyBasicAuthDial tests if a node joining to root cluster // takes into account http_proxy with basic auth credentials in the address func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - log := logtest.NewLogger() // We need to use the non-loopback address for our Teleport cluster, as the @@ -1670,6 +1650,7 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) { rc.AddUser(username, []string{username}) rcConf := servicecfg.MakeDefaultConfig() + rcConf.InsecureMode = true rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) @@ -1679,6 +1660,7 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) { rcConf.SSH.Enabled = false rcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig() rcConf.Logger = log + rcConf.InsecureMode = true err = rc.CreateEx(t, nil, rcConf) require.NoError(t, err) @@ -1704,6 +1686,7 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) { rcProxyAddr := net.JoinHostPort(rcAddr, helpers.PortStr(t, rc.Web)) nodeCfg := makeNodeConfig("node1", rcProxyAddr) nodeCfg.Logger = log + nodeCfg.InsecureMode = true timeout := time.Second * 60 startErrC := make(chan error) @@ -1734,9 +1717,6 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) { // TestALPNSNIProxyGRPCInsecure tests ALPN protocol ProtocolProxyGRPCInsecure // by registering a node with IAM join method. func TestALPNSNIProxyGRPCInsecure(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - nodeAccount := "123456789012" nodeRoleARN := "arn:aws:iam::123456789012:role/test" nodeCredentials := credentials.NewStaticCredentialsProvider("FAKE_ID", "FAKE_KEY", "FAKE_TOKEN") @@ -1770,9 +1750,6 @@ func TestALPNSNIProxyGRPCInsecure(t *testing.T) { // TestALPNSNIProxyGRPCSecure tests ALPN protocol ProtocolProxyGRPCSecure // by creating a KubeServiceClient for pod search. func TestALPNSNIProxyGRPCSecure(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - const ( localK8SNI = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local" k8User = "alice@example.com" diff --git a/integration/proxy/proxy_tunnel_strategy_test.go b/integration/proxy/proxy_tunnel_strategy_test.go index 2d3093f9ad2..efc9b844f14 100644 --- a/integration/proxy/proxy_tunnel_strategy_test.go +++ b/integration/proxy/proxy_tunnel_strategy_test.go @@ -34,7 +34,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/authtest" "github.com/gravitational/teleport/lib/auth/testauthority" @@ -75,9 +74,7 @@ func newProxyTunnelStrategy(t *testing.T, cluster string, strategy *types.Tunnel strategy: strategy, } - lib.SetInsecureDevMode(true) t.Cleanup(func() { - lib.SetInsecureDevMode(false) p.cleanup(t) }) @@ -329,6 +326,7 @@ func (p *proxyTunnelStrategy) makeAuth(t *testing.T) { conf.Auth.SessionRecordingConfig.SetMode(types.RecordAtNodeSync) conf.Proxy.Enabled = false conf.SSH.Enabled = false + conf.InsecureMode = true require.NoError(t, auth.CreateEx(t, nil, conf)) require.NoError(t, auth.Start()) @@ -355,6 +353,7 @@ func (p *proxyTunnelStrategy) makeProxy(t *testing.T) { conf.DataDir = t.TempDir() conf.Logger = proxy.Log conf.InstanceMetadataClient = imds.NewDisabledIMDSClient() + conf.InsecureMode = true conf.Auth.Enabled = false conf.SSH.Enabled = false @@ -401,6 +400,7 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) { conf.Logger = node.Log conf.InstanceMetadataClient = imds.NewDisabledIMDSClient() conf.DebugService.Enabled = false + conf.InsecureMode = true conf.Auth.Enabled = false conf.Proxy.Enabled = false @@ -448,6 +448,7 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) { conf.DataDir = t.TempDir() conf.Logger = db.Log conf.InstanceMetadataClient = imds.NewDisabledIMDSClient() + conf.InsecureMode = true conf.Auth.Enabled = false conf.Proxy.Enabled = false diff --git a/integration/proxy/teleterm_test.go b/integration/proxy/teleterm_test.go index 1676955411f..192caacdfd8 100644 --- a/integration/proxy/teleterm_test.go +++ b/integration/proxy/teleterm_test.go @@ -45,7 +45,6 @@ import ( dbhelpers "github.com/gravitational/teleport/integration/db" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/integration/kube" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/mocku2f" @@ -393,10 +392,7 @@ func (c *mockTSHDEventsService) PromptMFA(context.Context, *api.PromptMFARequest // is enabled in those tests. User certs with pinned IPs are injected during // those tests, which is not feasible for Teleterm daemon flow. func TestTeletermKubeGateway(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) ctx := context.Background() - const ( localK8SNI = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local" k8User = "alice@example.com" diff --git a/integration/teleterm_test.go b/integration/teleterm_test.go index e04cb5efa43..db147eebbe4 100644 --- a/integration/teleterm_test.go +++ b/integration/teleterm_test.go @@ -71,9 +71,11 @@ func TestTeleterm(t *testing.T) { dbhelpers.WithListenerSetupDatabaseTest(helpers.SingleProxyPortSetup), dbhelpers.WithLeafConfig(func(config *servicecfg.Config) { config.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) + config.InsecureMode = true }), dbhelpers.WithRootConfig(func(config *servicecfg.Config) { config.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) + config.InsecureMode = true }), ) pack.WaitForLeaf(t) diff --git a/integration/time_sync_test.go b/integration/time_sync_test.go index 32e713e94f2..ca7e4544f50 100644 --- a/integration/time_sync_test.go +++ b/integration/time_sync_test.go @@ -28,15 +28,12 @@ import ( "github.com/gravitational/teleport/api/utils/retryutils" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/service/servicecfg" ) // TestTimeReconciliation launches two instances with clock differences in system clock, // to verify that global notification is created about time drifting. func TestTimeReconciliation(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) helpers.SetTestTimeouts(2 * time.Second) ctx := t.Context() diff --git a/integration/web/web_test.go b/integration/web/web_test.go index af3a1d1f057..c8f00f1785d 100644 --- a/integration/web/web_test.go +++ b/integration/web/web_test.go @@ -36,7 +36,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/integration/helpers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/mocku2f" wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes" @@ -89,6 +88,7 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) { testserver.WithTestApp("root-app-mfa", rootAppMFAServer.URL), testserver.WithConfig(func(cfg *servicecfg.Config) { cfg.SSH.Enabled = false + cfg.InsecureMode = true cfg.Auth.Preference = &types.AuthPreferenceV2{ Metadata: types.Metadata{ Labels: map[string]string{types.OriginLabel: types.OriginConfigFile}, @@ -125,6 +125,7 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) { testserver.WithTestApp("leaf-app-mfa", leafAppMFAServer.URL), testserver.WithConfig(func(cfg *servicecfg.Config) { cfg.SSH.Enabled = false + cfg.InsecureMode = true }), ) require.NoError(t, err) @@ -291,11 +292,6 @@ func RegisterPasswordlessDeviceForUser(t *testing.T, server *service.TeleportPro } func SetupTrustedCluster(ctx context.Context, t *testing.T, rootServer, leafServer *service.TeleportProcess, additionalRoleMappings ...types.RoleMapping) { - // Use insecure mode so that the trusted cluster can establish trust over reverse tunnel. - isInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(isInsecure) }) - rootProxyAddr, err := rootServer.ProxyWebAddr() require.NoError(t, err) rootProxyTunnelAddr, err := rootServer.ProxyTunnelAddr() diff --git a/integrations/operator/controllers/resources/testlib/env.go b/integrations/operator/controllers/resources/testlib/env.go index fd56b314673..d87994f8a2f 100644 --- a/integrations/operator/controllers/resources/testlib/env.go +++ b/integrations/operator/controllers/resources/testlib/env.go @@ -79,7 +79,7 @@ func ValidRandomResourceName(prefix string) string { return prefix + string(b) } -func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string) { +func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.TeleInstance, string) { modulestest.SetTestModules(t, modulestest.Modules{ TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{ @@ -104,6 +104,7 @@ func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string) rcConf.Proxy.DisableWebInterface = true rcConf.SSH.Enabled = true rcConf.Version = "v2" + rcConf.InsecureMode = insecureMode roleName := ValidRandomResourceName("role-") unrestricted := []string{"list", "create", "read", "update", "delete"} @@ -184,6 +185,7 @@ type TestSetup struct { TeleportServer *helpers.TeleInstance ResourceName string Context context.Context + InsecureMode bool } // StartKubernetesOperator creates and start a new operator @@ -253,7 +255,7 @@ func setupTeleportClient(t *testing.T, setup *TestSetup) { // Start a Teleport server for the test and set up a client connected to // that server. - teleportServer, operatorName := defaultTeleportServiceConfig(t) + teleportServer, operatorName := defaultTeleportServiceConfig(t, setup.InsecureMode) setup.TeleportServer = teleportServer require.NoError(t, teleportServer.Start()) setup.TeleportClient = clientForTeleport(t, teleportServer, operatorName) @@ -277,6 +279,12 @@ func WithTeleportClient(clt *client.Client) TestOption { } } +func WithInsecureMode() TestOption { + return func(setup *TestSetup) { + setup.InsecureMode = true + } +} + func StepByStep(setup *TestSetup) { setup.stepByStepReconciliation = true } diff --git a/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go b/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go index 5214e8100ff..ac395c311d0 100644 --- a/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go +++ b/integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go @@ -40,7 +40,6 @@ import ( "github.com/gravitational/teleport/integrations/operator/controllers/resources" "github.com/gravitational/teleport/integrations/operator/controllers/resources/secretlookup" "github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/utils/log/logtest" ) @@ -168,14 +167,13 @@ func (r *trustedClusterV2TestingPrimitives) setupTest(t *testing.T, clusterName r.remoteCluster = remoteCluster rcConf := servicecfg.MakeDefaultConfig() + rcConf.InsecureMode = true rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Proxy.Enabled = true rcConf.Proxy.DisableWebInterface = true rcConf.Version = "v2" - - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) + rcConf.InsecureMode = true require.NoError(t, remoteCluster.CreateEx(t, nil, rcConf)) require.NoError(t, remoteCluster.Start()) @@ -191,6 +189,7 @@ func TestTrustedClusterV2Creation(t *testing.T) { resources.NewTrustedClusterV2Reconciler, test, testlib.WithResourceName(remoteClusterName), + testlib.WithInsecureMode(), ) } @@ -203,6 +202,7 @@ func TestTrustedClusterV2Deletion(t *testing.T) { resources.NewTrustedClusterV2Reconciler, test, testlib.WithResourceName(remoteClusterName), + testlib.WithInsecureMode(), ) } @@ -215,6 +215,7 @@ func TestTrustedClusterV2DeletionDrift(t *testing.T) { resources.NewTrustedClusterV2Reconciler, test, testlib.WithResourceName(remoteClusterName), + testlib.WithInsecureMode(), ) } @@ -227,6 +228,7 @@ func TestTrustedClusterUpdate(t *testing.T) { resources.NewTrustedClusterV2Reconciler, test, testlib.WithResourceName(remoteClusterName), + testlib.WithInsecureMode(), ) } @@ -234,7 +236,7 @@ func TestTrustedClusterV2SecretLookup(t *testing.T) { test := &trustedClusterV2TestingPrimitives{} const remoteClusterName = "remote.example.com" test.setupTest(t, remoteClusterName) - setup := testlib.SetupFakeKubeTestEnv(t) + setup := testlib.SetupFakeKubeTestEnv(t, testlib.WithInsecureMode()) test.Init(setup) ctx := t.Context() require.NoError(t, test.SetupTeleportFixtures(ctx)) diff --git a/lib/auth/auth.go b/lib/auth/auth.go index f6c41dec219..69a3ce223f7 100644 --- a/lib/auth/auth.go +++ b/lib/auth/auth.go @@ -754,6 +754,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (as *Server, err error) { sessionSummarizerProvider: cfg.SessionSummarizerProvider, recordingMetadataProvider: cfg.RecordingMetadataProvider, awsOrganizationsClientGetter: cfg.AWSOrganizationsClientGetter, + insecureMode: cfg.InsecureMode, } as.inventory = inventory.NewController(as, services, inventory.WithAuthServerID(cfg.HostUUID), @@ -1231,8 +1232,9 @@ type Server struct { clock clockwork.Clock bk backend.Backend - closeCtx context.Context - cancelFunc context.CancelFunc + insecureMode bool + closeCtx context.Context + cancelFunc context.CancelFunc fakePasswordHash []byte fakeRecoveryCodeHash []byte diff --git a/lib/auth/authtest/authtest.go b/lib/auth/authtest/authtest.go index b227146c4ea..7ce1ec6763e 100644 --- a/lib/auth/authtest/authtest.go +++ b/lib/auth/authtest/authtest.go @@ -117,6 +117,7 @@ type AuthServerConfig struct { FIPS bool // KeystoreConfig is configuration for the CA keystore. KeystoreConfig servicecfg.KeystoreConfig + InsecureMode bool } // CheckAndSetDefaults checks and sets defaults @@ -380,6 +381,7 @@ func NewAuthServer(cfg AuthServerConfig) (*AuthServer, error) { AWSOrganizationsClientGetter: cfg.AWSOrganizationsClientGetter, FakePasswordHash: []byte(FakePasswordHash), FakeRecoveryCodeHash: []byte(FakeRecoveryCodeHash), + InsecureMode: cfg.InsecureMode, }, // Reduce auth.Server bcrypt costs when testing. WithBcryptCost(bcrypt.MinCost), diff --git a/lib/auth/init.go b/lib/auth/init.go index ff042736db1..849e9e1caa3 100644 --- a/lib/auth/init.go +++ b/lib/auth/init.go @@ -103,6 +103,9 @@ type RecordingEncryptionManager interface { // InitConfig is auth server init config type InitConfig struct { + // InsecureMode defines whether insecure connections are allowed. + InsecureMode bool + // Backend is auth backend to use Backend backend.Backend @@ -700,7 +703,7 @@ func initCluster(ctx context.Context, cfg InitConfig, asrv *Server) error { return trace.Wrap(err) } - if lib.IsInsecureDevMode() { + if lib.IsInsecureDevMode() || cfg.InsecureMode { const warningMessage = "Starting teleport in insecure mode. This is " + "dangerous! Sensitive information will be logged to console and " + "certificates will not be verified. Proceed with caution!" diff --git a/lib/auth/init_test.go b/lib/auth/init_test.go index 5b07811ab41..7584b7845f3 100644 --- a/lib/auth/init_test.go +++ b/lib/auth/init_test.go @@ -59,7 +59,6 @@ import ( "github.com/gravitational/teleport/api/types/vnet" apisshutils "github.com/gravitational/teleport/api/utils/sshutils" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authcatest" "github.com/gravitational/teleport/lib/auth/authtest" @@ -2352,9 +2351,6 @@ func TestInitCreatesCertsIfMissing(t *testing.T) { } func TestTeleportProcessAuthVersionUpgradeCheck(t *testing.T) { - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - tests := []struct { name string initialVersion string @@ -2435,6 +2431,7 @@ func TestTeleportProcessAuthVersionUpgradeCheck(t *testing.T) { ctx := t.Context() authCfg := setupConfig(t) + authCfg.InsecureMode = true service, err := local.NewBackendInfoService(authCfg.Backend) require.NoError(t, err) diff --git a/lib/auth/trustedcluster.go b/lib/auth/trustedcluster.go index 5297b027d51..068711ecc1b 100644 --- a/lib/auth/trustedcluster.go +++ b/lib/auth/trustedcluster.go @@ -685,7 +685,8 @@ func (a *Server) sendValidateRequestToProxy(ctx context.Context, host string, va roundtrip.SanitizerEnabled(true), } - if lib.IsInsecureDevMode() { + // TODO(tross): remove lib.IsInsecureDevMode after everything is converted. + if lib.IsInsecureDevMode() || a.insecureMode { a.logger.WarnContext(ctx, "The setting insecureSkipVerify is used to communicate with proxy. Make sure you intend to run Teleport in insecure mode!") // Get the default transport, this allows picking up proxy from the @@ -743,7 +744,7 @@ func (a *Server) validateTrustedClusterName(ctx context.Context, trustedCluster resp, err := webclient.Find(&webclient.Config{ Context: ctx, ProxyAddr: trustedCluster.GetProxyAddress(), - Insecure: lib.IsInsecureDevMode(), + Insecure: a.insecureMode, }) if err != nil { return trace.Wrap(err) diff --git a/lib/config/configuration.go b/lib/config/configuration.go index 08f876ec180..fc35636547d 100644 --- a/lib/config/configuration.go +++ b/lib/config/configuration.go @@ -2504,9 +2504,6 @@ func applyConfigVersion(fc *FileConfig, cfg *servicecfg.Config) { // Configure merges command line arguments with what's in a configuration file // with CLI commands taking precedence func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags bool) error { - // pass the value of --insecure flag to the runtime - lib.SetInsecureDevMode(clf.InsecureMode) - // load /etc/teleport.yaml and apply its values: fileConf, err := ReadConfigFile(clf.ConfigFile) if err != nil { @@ -2919,14 +2916,18 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo cfg.Auth.AgentRolloutControllerSyncPeriod = period } + // TODO(tross): Remove when enterprise is consuming from the config + lib.SetInsecureDevMode(clf.InsecureMode) + // pass the value of --insecure flag to the runtime + if clf.InsecureMode { + cfg.InsecureMode = true + } + return nil } // ConfigureOpenSSH initializes a config from the commandline flags passed func ConfigureOpenSSH(clf *CommandLineFlags, cfg *servicecfg.Config) error { - // pass the value of --insecure flag to the runtime - lib.SetInsecureDevMode(clf.InsecureMode) - // Apply command line --debug flag to override logger severity. level := slog.LevelError if clf.Debug { @@ -2990,6 +2991,12 @@ func ConfigureOpenSSH(clf *CommandLineFlags, cfg *servicecfg.Config) error { cfg.SetAuthServerAddresses(nil) cfg.ProxyServer = *proxyServer + // TODO(tross): Remove when enterprise is consuming from the config + lib.SetInsecureDevMode(clf.InsecureMode) + // pass the value of --insecure flag to the runtime + if clf.InsecureMode { + cfg.InsecureMode = true + } return nil } diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go index e4eb4d359a4..9bcd0e76c3b 100644 --- a/lib/config/configuration_test.go +++ b/lib/config/configuration_test.go @@ -44,7 +44,6 @@ import ( "github.com/gravitational/teleport/api/types/installers" apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/api/utils/keys" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/backend" "github.com/gravitational/teleport/lib/backend/lite" "github.com/gravitational/teleport/lib/cryptosuites" @@ -219,8 +218,6 @@ func TestSampleConfig(t *testing.T) { require.Equal(t, testCase.expectProxyWebAddr, fc.Proxy.WebAddr) require.ElementsMatch(t, testCase.expectProxyPublicAddrs, fc.Proxy.PublicAddr) require.ElementsMatch(t, testCase.expectProxyKeyPairs, fc.Proxy.KeyPairs) - - require.False(t, lib.IsInsecureDevMode()) }) } } diff --git a/lib/integrations/awsoidc/idp_iam_config.go b/lib/integrations/awsoidc/idp_iam_config.go index 01d5ce516a2..8797179c386 100644 --- a/lib/integrations/awsoidc/idp_iam_config.go +++ b/lib/integrations/awsoidc/idp_iam_config.go @@ -46,6 +46,7 @@ const ( // IdPIAMConfigureRequest represents a request to configure AWS OIDC integration. type IdPIAMConfigureRequest struct { + Insecure bool // Cluster is the Teleport Cluster. // Used for tagging the created Roles/IdP. Cluster string @@ -264,7 +265,7 @@ func createOIDCIdPAction(ctx context.Context, clt IdPIAMConfigureClient, req IdP thumbprint = req.fakeThumbprint } else { var err error - thumbprint, err = ThumbprintIdP(ctx, req.ProxyPublicAddress) + thumbprint, err = ThumbprintIdP(ctx, req.ProxyPublicAddress, req.Insecure) if err != nil { return nil, trace.Wrap(err) } diff --git a/lib/integrations/awsoidc/idp_iam_config_test.go b/lib/integrations/awsoidc/idp_iam_config_test.go index 774f2927b98..9ab35f4477f 100644 --- a/lib/integrations/awsoidc/idp_iam_config_test.go +++ b/lib/integrations/awsoidc/idp_iam_config_test.go @@ -34,7 +34,6 @@ import ( "github.com/gravitational/trace" "github.com/stretchr/testify/require" - "github.com/gravitational/teleport/lib" awslib "github.com/gravitational/teleport/lib/cloud/aws" "github.com/gravitational/teleport/lib/cloud/aws/tags" "github.com/gravitational/teleport/lib/utils/testutils/golden" @@ -43,6 +42,7 @@ import ( func TestIdPIAMConfigReqDefaults(t *testing.T) { baseIdPIAMConfigReq := func() IdPIAMConfigureRequest { return IdPIAMConfigureRequest{ + Insecure: true, Cluster: "mycluster", IntegrationName: "myintegration", IntegrationRole: "integrationrole", @@ -74,6 +74,7 @@ func TestIdPIAMConfigReqDefaults(t *testing.T) { "teleport.dev/integration": "myintegration", "teleport.dev/origin": "integration_awsoidc", }, + Insecure: true, IntegrationPolicyPreset: PolicyPresetUnspecified, AutoConfirm: true, }, @@ -171,10 +172,6 @@ func TestConfigureIdPIAM(t *testing.T) { require.NoError(t, err) tlsServerIssuer := tlsServerURL.Host - // TLS Server starts with self-signed certificates. - - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) baseIdPIAMConfigReqWithTLServer := func() IdPIAMConfigureRequest { return IdPIAMConfigureRequest{ @@ -298,7 +295,9 @@ func TestConfigureIdPIAM(t *testing.T) { existingIDPUrl: tt.mockExistingIdPUrl, } - err := ConfigureIdPIAM(ctx, &clt, tt.req()) + req := tt.req() + req.Insecure = true + err := ConfigureIdPIAM(ctx, &clt, req) tt.errCheck(t, err) if tt.externalStateCheck != nil { @@ -311,8 +310,6 @@ func TestConfigureIdPIAM(t *testing.T) { func TestConfigureIdPIAMWithPresetPolicy(t *testing.T) { ctx := context.Background() tlsServer := httptest.NewTLSServer(nil) - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) const mockAccountID string = "123456789012" baseIdPIAMConfigReqWithTLServer := func() IdPIAMConfigureRequest { return IdPIAMConfigureRequest{ @@ -321,6 +318,7 @@ func TestConfigureIdPIAMWithPresetPolicy(t *testing.T) { IntegrationRole: "integrationrole", ProxyPublicAddress: tlsServer.URL, AutoConfirm: true, + Insecure: true, } } diff --git a/lib/integrations/awsoidc/idp_thumbprint.go b/lib/integrations/awsoidc/idp_thumbprint.go index 80f0886d9a9..81737fd6939 100644 --- a/lib/integrations/awsoidc/idp_thumbprint.go +++ b/lib/integrations/awsoidc/idp_thumbprint.go @@ -27,7 +27,6 @@ import ( "github.com/gravitational/trace" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/utils/oidc" ) @@ -36,7 +35,7 @@ import ( // https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html // Returns the thumbprint of the top intermediate CA that signed the TLS cert used to serve HTTPS requests. // In case of a self signed certificate, then it returns the thumbprint of the TLS cert itself. -func ThumbprintIdP(ctx context.Context, publicAddress string) (string, error) { +func ThumbprintIdP(ctx context.Context, publicAddress string, insecureMode bool) (string, error) { issuer, err := oidc.IssuerFromPublicAddress(publicAddress, "") if err != nil { return "", trace.Wrap(err) @@ -54,7 +53,7 @@ func ThumbprintIdP(ctx context.Context, publicAddress string) (string, error) { d := tls.Dialer{ Config: &tls.Config{ - InsecureSkipVerify: lib.IsInsecureDevMode(), + InsecureSkipVerify: insecureMode, }, } conn, err := d.DialContext(ctx, "tcp", addrURL.Host) diff --git a/lib/integrations/awsoidc/idp_thumbprint_test.go b/lib/integrations/awsoidc/idp_thumbprint_test.go index 14fc814688b..4a1b6cb148a 100644 --- a/lib/integrations/awsoidc/idp_thumbprint_test.go +++ b/lib/integrations/awsoidc/idp_thumbprint_test.go @@ -26,8 +26,6 @@ import ( "testing" "github.com/stretchr/testify/require" - - "github.com/gravitational/teleport/lib" ) func TestThumbprint(t *testing.T) { @@ -35,11 +33,7 @@ func TestThumbprint(t *testing.T) { tlsServer := httptest.NewTLSServer(nil) - // Proxy starts with self-signed certificates. - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - - thumbprint, err := ThumbprintIdP(ctx, tlsServer.URL) + thumbprint, err := ThumbprintIdP(ctx, tlsServer.URL, true) require.NoError(t, err) serverCertificateSHA1 := sha1.Sum(tlsServer.Certificate().Raw) diff --git a/lib/reversetunnel/agentpool.go b/lib/reversetunnel/agentpool.go index 78b94beae26..83f3d497bff 100644 --- a/lib/reversetunnel/agentpool.go +++ b/lib/reversetunnel/agentpool.go @@ -43,7 +43,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/utils/retryutils" "github.com/gravitational/teleport/api/utils/sshutils" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/reversetunnel/track" @@ -144,6 +143,8 @@ type AgentPoolConfig struct { PROXYSigner multiplexer.PROXYHeaderSigner // StaleConnTimeoutDisabled is true if connection timeouts are disabled. StaleConnTimeoutDisabled bool + // InsecureMode defines whether insecure connections are allowed. + InsecureMode bool } // CheckAndSetDefaults checks and sets defaults. @@ -209,7 +210,7 @@ func NewAgentPool(ctx context.Context, config AgentPoolConfig) (*AgentPool, erro "target_cluster", config.Cluster, "local_cluster", config.LocalCluster, ), - runtimeConfig: newAgentPoolRuntimeConfig(), + runtimeConfig: newAgentPoolRuntimeConfig(config.InsecureMode), } pool.runtimeConfig.isRemoteCluster = pool.IsRemoteCluster @@ -474,7 +475,7 @@ func (p *AgentPool) newAgent(ctx context.Context, tracker *track.Tracker, lease p.logger.DebugContext(ctx, "Failed to update remote config", "error", err) } - options := []proxy.DialerOptionFunc{proxy.WithInsecureSkipTLSVerify(lib.IsInsecureDevMode())} + options := []proxy.DialerOptionFunc{proxy.WithInsecureSkipTLSVerify(p.InsecureMode)} if p.runtimeConfig.useALPNRouting() { options = append(options, proxy.WithALPNDialer(p.runtimeConfig.alpnDialerConfig(p.getClusterCAs))) } @@ -656,6 +657,7 @@ type agentPoolRuntimeConfig struct { // tlsRoutingConnUpgradeRequired indicates that ALPN connection upgrades // are required for making TLS routing requests. tlsRoutingConnUpgradeRequired bool + insecureMode bool // remoteTLSRoutingEnabled caches a remote clusters tls routing setting. This helps prevent // proxy endpoint stagnation where an even numbers of proxies are hidden behind a round robin @@ -671,7 +673,7 @@ type agentPoolRuntimeConfig struct { clock clockwork.Clock } -func newAgentPoolRuntimeConfig() *agentPoolRuntimeConfig { +func newAgentPoolRuntimeConfig(insecureMode bool) *agentPoolRuntimeConfig { return &agentPoolRuntimeConfig{ tunnelStrategyType: types.AgentMesh, connectionCount: defaultAgentConnectionCount, @@ -679,6 +681,7 @@ func newAgentPoolRuntimeConfig() *agentPoolRuntimeConfig { keepAliveInterval: defaults.KeepAliveInterval(), keepAliveCount: defaults.KeepAliveCountMax, clock: clockwork.NewRealClock(), + insecureMode: insecureMode, } } @@ -729,7 +732,7 @@ func (c *agentPoolRuntimeConfig) alpnDialerConfig(getClusterCAs client.GetCluste return client.ALPNDialerConfig{ TLSConfig: &tls.Config{ NextProtos: alpncommon.ProtocolsToString(protocols), - InsecureSkipVerify: lib.IsInsecureDevMode(), + InsecureSkipVerify: c.insecureMode, }, KeepAlivePeriod: c.keepAliveInterval, ALPNConnUpgradeRequired: c.tlsRoutingConnUpgradeRequired, @@ -773,7 +776,7 @@ func (c *agentPoolRuntimeConfig) updateRemote(ctx context.Context, addr *utils.N ping, err := webclient.Find(&webclient.Config{ Context: ctx, ProxyAddr: addr.Addr, - Insecure: lib.IsInsecureDevMode(), + Insecure: c.insecureMode, }) if err != nil { // If TLS Routing is disabled the address is the proxy reverse tunnel @@ -801,7 +804,7 @@ func (c *agentPoolRuntimeConfig) updateRemote(ctx context.Context, addr *utils.N c.remoteTLSRoutingEnabled = tlsRoutingEnabled if c.remoteTLSRoutingEnabled { - c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, lib.IsInsecureDevMode()) + c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, c.insecureMode) slog.DebugContext(ctx, "ALPN upgrade required for remote cluster", "remote_addr", addr.Addr, "conn_upgrade_required", c.tlsRoutingConnUpgradeRequired, @@ -837,7 +840,7 @@ func (c *agentPoolRuntimeConfig) update(ctx context.Context, netConfig types.Clu if c.proxyListenerMode == types.ProxyListenerMode_Multiplex && oldProxyListenerMode != c.proxyListenerMode { addr, _, err := resolver(ctx) if err == nil { - c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, lib.IsInsecureDevMode()) + c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, c.insecureMode) } else { slog.WarnContext(ctx, "Failed to resolve addr", "error", err) } diff --git a/lib/reversetunnel/rc_manager.go b/lib/reversetunnel/rc_manager.go index 07bb68ed585..3aaf0eacba5 100644 --- a/lib/reversetunnel/rc_manager.go +++ b/lib/reversetunnel/rc_manager.go @@ -81,6 +81,8 @@ type RemoteClusterTunnelManagerConfig struct { KubeDialAddr utils.NetAddr // FIPS indicates if Teleport was started in FIPS mode. FIPS bool + // InsecureMode defines whether insecure connections are allowed. + InsecureMode bool // Logger is the logger Logger *slog.Logger // LocalAuthAddresses is a list of auth servers to use when dialing back to @@ -360,6 +362,7 @@ func (w *RemoteClusterTunnelManager) Sync(ctx context.Context) error { func realNewAgentPool(ctx context.Context, cfg RemoteClusterTunnelManagerConfig, cluster, addr string) (*AgentPool, error) { pool, err := NewAgentPool(ctx, AgentPoolConfig{ + InsecureMode: cfg.InsecureMode, // Configs for our cluster. Client: cfg.AuthClient, AccessPoint: cfg.AccessPoint, diff --git a/lib/service/connect.go b/lib/service/connect.go index e3e292589ae..08e34c34f20 100644 --- a/lib/service/connect.go +++ b/lib/service/connect.go @@ -48,7 +48,6 @@ import ( apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/api/utils/keys" "github.com/gravitational/teleport/api/utils/retryutils" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/state" @@ -759,7 +758,7 @@ func (process *TeleportProcess) makeJoinParams( // requests before closing CircuitBreakerConfig: breaker.NoopBreakerConfig(), FIPS: process.Config.FIPS, - Insecure: lib.IsInsecureDevMode(), + Insecure: process.Config.InsecureMode, } if joinParams.JoinMethod == types.JoinMethodAzure { joinParams.AzureParams = joinclient.AzureParams{ @@ -1488,7 +1487,7 @@ func (process *TeleportProcess) newClientThroughTunnel(tlsConfig *tls.Config, ss Resolver: process.resolver, ClientConfig: sshConfig, Log: process.logger, - InsecureSkipTLSVerify: lib.IsInsecureDevMode(), + InsecureSkipTLSVerify: process.Config.InsecureMode, GetClusterCAs: func(context.Context) (*x509.CertPool, error) { return getClusterCAs() }, diff --git a/lib/service/db.go b/lib/service/db.go index a5c1c312642..f85d448fc93 100644 --- a/lib/service/db.go +++ b/lib/service/db.go @@ -184,6 +184,7 @@ func (process *TeleportProcess) initDatabaseService() (retErr error) { agentPool, err := reversetunnel.NewAgentPool( process.ExitContext(), reversetunnel.AgentPoolConfig{ + InsecureMode: process.Config.InsecureMode, Component: teleport.ComponentDatabase, HostUUID: conn.HostID(), Resolver: tunnelAddrResolver, diff --git a/lib/service/desktop.go b/lib/service/desktop.go index 344fe8d9b77..b82361933a8 100644 --- a/lib/service/desktop.go +++ b/lib/service/desktop.go @@ -118,6 +118,7 @@ func (process *TeleportProcess) initWindowsDesktopServiceRegistered(logger *slog agentPool, err = reversetunnel.NewAgentPool( process.ExitContext(), reversetunnel.AgentPoolConfig{ + InsecureMode: process.Config.InsecureMode, Component: teleport.ComponentWindowsDesktop, HostUUID: conn.HostID(), Resolver: conn.TunnelProxyResolver(), diff --git a/lib/service/kubernetes.go b/lib/service/kubernetes.go index f868d344a78..4ca9b4a8446 100644 --- a/lib/service/kubernetes.go +++ b/lib/service/kubernetes.go @@ -132,6 +132,7 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn agentPool, err = reversetunnel.NewAgentPool( process.ExitContext(), reversetunnel.AgentPoolConfig{ + InsecureMode: process.Config.InsecureMode, Component: teleport.ComponentKube, HostUUID: conn.HostID(), Resolver: conn.TunnelProxyResolver(), diff --git a/lib/service/service.go b/lib/service/service.go index 60e1a11be80..8a00d16d21c 100644 --- a/lib/service/service.go +++ b/lib/service/service.go @@ -86,7 +86,6 @@ import ( "github.com/gravitational/teleport/api/utils/retryutils" apisshutils "github.com/gravitational/teleport/api/utils/sshutils" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/agentless" "github.com/gravitational/teleport/lib/auditd" "github.com/gravitational/teleport/lib/auth" @@ -1366,7 +1365,7 @@ func NewTeleport(cfg *servicecfg.Config) (_ *TeleportProcess, err error) { reversetunnelclient.WebClientResolver(&webclient.Config{ Context: process.ExitContext(), ProxyAddr: resolverAddr.String(), - Insecure: lib.IsInsecureDevMode(), + Insecure: cfg.InsecureMode, Timeout: process.Config.Testing.ClientTimeout, }), process.Clock, @@ -2477,6 +2476,7 @@ func (process *TeleportProcess) initAuthService() error { RunWhileLockedRetryInterval: cfg.Testing.RunWhileLockedRetryInterval, SessionSummarizerProvider: sessionSummarizerProvider, RecordingMetadataProvider: recordingMetadataProvider, + InsecureMode: cfg.InsecureMode, }, func(as *auth.Server) error { if !process.Config.CachePolicy.Enabled { return nil @@ -3694,6 +3694,7 @@ func (process *TeleportProcess) initSSH() error { agentPool, err = reversetunnel.NewAgentPool( process.ExitContext(), reversetunnel.AgentPoolConfig{ + InsecureMode: process.Config.InsecureMode, Component: teleport.ComponentNode, HostUUID: conn.HostID(), Resolver: conn.TunnelProxyResolver(), @@ -5412,6 +5413,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error { } connectionsHandler, err := app.NewConnectionsHandler(process.GracefulExitContext(), &app.ConnectionsHandlerConfig{ + InsecureMode: process.Config.InsecureMode, Clock: process.Clock, DataDir: cfg.DataDir, Emitter: asyncEmitter, @@ -5474,6 +5476,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error { ProxyGroupID: cfg.Proxy.ProxyGroupID, CipherSuites: cfg.CipherSuites, FIPS: cfg.FIPS, + InsecureMode: cfg.InsecureMode, AccessPoint: accessPoint, Emitter: asyncEmitter, PluginRegistry: process.PluginRegistry, @@ -5730,7 +5733,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error { sshGRPCTLSConfig := serverTLSConfig.Clone() sshGRPCTLSConfig.NextProtos = []string{string(alpncommon.ProtocolHTTP2), string(alpncommon.ProtocolProxySSHGRPC)} sshGRPCTLSConfig.ClientAuth = tls.RequireAndVerifyClientCert - if lib.IsInsecureDevMode() { + if cfg.InsecureMode { sshGRPCTLSConfig.InsecureSkipVerify = true sshGRPCTLSConfig.ClientAuth = tls.RequireAnyClientCert } @@ -5849,6 +5852,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error { // Create and register reverse tunnel AgentPool. rcWatcher, err = reversetunnel.NewRemoteClusterTunnelManager(reversetunnel.RemoteClusterTunnelManagerConfig{ + InsecureMode: process.Config.InsecureMode, HostUUID: conn.HostID(), AuthClient: conn.Client, AccessPoint: accessPoint, @@ -6813,6 +6817,7 @@ func (process *TeleportProcess) initApps() { } connectionsHandler, err := app.NewConnectionsHandler(process.ExitContext(), &app.ConnectionsHandlerConfig{ + InsecureMode: process.Config.InsecureMode, Clock: process.Config.Clock, DataDir: process.Config.DataDir, AuthClient: conn.Client, @@ -6867,6 +6872,7 @@ func (process *TeleportProcess) initApps() { agentPool, err := reversetunnel.NewAgentPool( process.ExitContext(), reversetunnel.AgentPoolConfig{ + InsecureMode: process.Config.InsecureMode, Component: teleport.ComponentApp, HostUUID: conn.HostID(), Resolver: tunnelAddrResolver, diff --git a/lib/service/service_test.go b/lib/service/service_test.go index 076d9b7a596..07372104121 100644 --- a/lib/service/service_test.go +++ b/lib/service/service_test.go @@ -58,7 +58,6 @@ import ( autoupdate "github.com/gravitational/teleport/api/types/autoupdate" apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/authtest" "github.com/gravitational/teleport/lib/backend" @@ -1158,9 +1157,6 @@ func expectedSSHPrincipals(hostID, hostName, clusterName string) []string { func TestTeleportProcessAuthVersionCheck(t *testing.T) { t.Parallel() - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - listenAddr := utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"} token := "join-token" @@ -1178,6 +1174,7 @@ func TestTeleportProcessAuthVersionCheck(t *testing.T) { require.NoError(t, err) authCfg := servicecfg.MakeDefaultConfig() + authCfg.InsecureMode = true authCfg.SetAuthServerAddress(listenAddr) authCfg.DataDir = makeTempDir(t) authCfg.Auth.Enabled = true @@ -1200,6 +1197,7 @@ func TestTeleportProcessAuthVersionCheck(t *testing.T) { // Create Node process, pointing at the auth server's local port authListenAddr := authProc.Config.AuthServerAddresses()[0] nodeCfg := servicecfg.MakeDefaultConfig() + nodeCfg.InsecureMode = true nodeCfg.SetAuthServerAddress(authListenAddr) nodeCfg.DataDir = makeTempDir(t) nodeCfg.SetToken(token) @@ -2231,11 +2229,7 @@ func makeTempDir(t *testing.T) string { // the instance has malformed system roles using pre-constructed data directories // generated by an older teleport version that permitted token mix-and-match. func TestInstanceCertReissue(t *testing.T) { - t.Setenv("_insecuredevmode_no_parallel", "1") // panic if the test is or will become parallel t.Setenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK", "1") - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - var eg errgroup.Group defer func() { require.NoError(t, eg.Wait()) }() @@ -2251,6 +2245,7 @@ func TestInstanceCertReissue(t *testing.T) { require.NoError(t, basicDirCopy("testdata/agent", agentDir)) authCfg := servicecfg.MakeDefaultConfig() + authCfg.InsecureMode = true authCfg.Version = defaults.TeleportConfigVersionV3 authCfg.DataDir = authDir authCfg.Auth.Enabled = true @@ -2299,6 +2294,7 @@ func TestInstanceCertReissue(t *testing.T) { require.ElementsMatch(t, []string{string(types.RoleAuth), string(types.RoleProxy), string(types.RoleNode)}, authIdentity.SystemRoles) agentCfg := servicecfg.MakeDefaultConfig() + agentCfg.InsecureMode = true agentCfg.Version = defaults.TeleportConfigVersionV3 agentCfg.DataDir = agentDir agentCfg.ProxyServer = utils.NetAddr{ diff --git a/lib/service/servicecfg/config.go b/lib/service/servicecfg/config.go index a3b68aa7418..4fbd59ec822 100644 --- a/lib/service/servicecfg/config.go +++ b/lib/service/servicecfg/config.go @@ -277,7 +277,8 @@ type Config struct { // DatabaseREPLRegistry is used to retrieve datatabase REPL given the // protocol. DatabaseREPLRegistry dbrepl.REPLRegistry - + // InsecureMode defines whether insecure connections are allowed. + InsecureMode bool // token is either the token needed to join the auth server, or a path pointing to a file // that contains the token // diff --git a/lib/srv/app/connections_handler.go b/lib/srv/app/connections_handler.go index ad21e52539a..aa9b8b1efd7 100644 --- a/lib/srv/app/connections_handler.go +++ b/lib/srv/app/connections_handler.go @@ -121,6 +121,9 @@ type ConnectionsHandlerConfig struct { // MCPDemoServer enables the "Teleport Demo" MCP server. MCPDemoServer bool + + // InsecureMode defines whether insecure connections are allowed. + InsecureMode bool } // CheckAndSetDefaults validates the config values and sets defaults. @@ -297,6 +300,7 @@ func NewConnectionsHandler(closeContext context.Context, cfg *ConnectionsHandler EnableDemoServer: c.cfg.MCPDemoServer, CipherSuites: c.cfg.CipherSuites, AuthClient: c.cfg.AuthClient, + InsecureMode: c.cfg.InsecureMode, }) if err != nil { return nil, trace.Wrap(err) diff --git a/lib/srv/app/session.go b/lib/srv/app/session.go index 1e30b9cbf34..395ddfeba81 100644 --- a/lib/srv/app/session.go +++ b/lib/srv/app/session.go @@ -161,6 +161,7 @@ func (c *ConnectionsHandler) withJWTTokenForwarder(ctx context.Context, sess *se traits: traits, log: c.log, hostID: c.cfg.HostID, + insecureMode: c.cfg.InsecureMode, }) if err != nil { return trace.Wrap(err) diff --git a/lib/srv/app/transport.go b/lib/srv/app/transport.go index 9c97fae2854..54859fc0039 100644 --- a/lib/srv/app/transport.go +++ b/lib/srv/app/transport.go @@ -36,7 +36,6 @@ import ( "github.com/gravitational/teleport" "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/types/wrappers" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/srv/app/common" @@ -52,7 +51,8 @@ type transportConfig struct { traits wrappers.Traits log *slog.Logger // hostID is purely for troubleshooting purposes (put in the error messages) - hostID string + hostID string + insecureMode bool } // Check validates configuration. @@ -284,7 +284,7 @@ func configureTLS(c *transportConfig) (*tls.Config, error) { // Don't verify the server's certificate if Teleport was started with // the --insecure flag, or 'insecure_skip_verify' was specifically requested in // the application config. - tlsConfig.InsecureSkipVerify = (lib.IsInsecureDevMode() || c.app.GetInsecureSkipVerify()) + tlsConfig.InsecureSkipVerify = (c.insecureMode || c.app.GetInsecureSkipVerify()) return tlsConfig, nil } diff --git a/lib/srv/mcp/server.go b/lib/srv/mcp/server.go index ae4d21798c1..08d6eccd64e 100644 --- a/lib/srv/mcp/server.go +++ b/lib/srv/mcp/server.go @@ -70,6 +70,8 @@ type ServerConfig struct { // CipherSuites is the list of TLS cipher suites that have been configured // for this process. CipherSuites []uint16 + // InsecureMode defines whether insecure connections are allowed. + InsecureMode bool clock clockwork.Clock } diff --git a/lib/srv/mcp/sse.go b/lib/srv/mcp/sse.go index 1f9c294d518..39f60668ecc 100644 --- a/lib/srv/mcp/sse.go +++ b/lib/srv/mcp/sse.go @@ -28,7 +28,6 @@ import ( "github.com/gravitational/trace" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/utils" logutils "github.com/gravitational/teleport/lib/utils/log" @@ -136,7 +135,7 @@ func (s *Server) makeBasicHTTPTransport(app types.Application) (http.RoundTrippe // from the target server. tr.ResponseHeaderTimeout = time.Minute tr.TLSClientConfig = utils.TLSConfig(s.cfg.CipherSuites) - tr.TLSClientConfig.InsecureSkipVerify = lib.IsInsecureDevMode() || app.GetInsecureSkipVerify() + tr.TLSClientConfig.InsecureSkipVerify = s.cfg.InsecureMode || app.GetInsecureSkipVerify() return tr, nil } diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go index cfd64ccfa5d..22697bb4598 100644 --- a/lib/web/apiserver.go +++ b/lib/web/apiserver.go @@ -240,6 +240,10 @@ type Config struct { // FIPS mode means Teleport started in a FedRAMP/FIPS compliant // configuration. FIPS bool + + // InsecureMode defines whether insecure connections are allowed. + InsecureMode bool + // Modules define the build type, entitlements and licensed features. Modules modules.Modules diff --git a/lib/web/apiserver_test.go b/lib/web/apiserver_test.go index 84835eec613..e4bd6d838b3 100644 --- a/lib/web/apiserver_test.go +++ b/lib/web/apiserver_test.go @@ -98,7 +98,6 @@ import ( "github.com/gravitational/teleport/api/utils/keys" apisshutils "github.com/gravitational/teleport/api/utils/sshutils" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/agentless" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" @@ -8319,6 +8318,7 @@ type WebPackOptions struct { proxyOptions []proxyOption enableAuthCache bool modules *modulestest.Modules + insecureMode bool } type webPackOptions func(*WebPackOptions) @@ -8341,6 +8341,12 @@ func withModules(m *modulestest.Modules) webPackOptions { } } +func withInsecureMode() webPackOptions { + return func(cfg *WebPackOptions) { + cfg.insecureMode = true + } +} + func newWebPack(t *testing.T, numProxies int, opts ...webPackOptions) *webPack { options := &WebPackOptions{} @@ -8365,6 +8371,7 @@ func newWebPack(t *testing.T, numProxies int, opts ...webPackOptions) *webPack { Clock: clock, AuditLog: events.NewDiscardAuditLog(), CacheEnabled: options.enableAuthCache, + InsecureMode: options.insecureMode, }, }) require.NoError(t, err) @@ -8479,7 +8486,7 @@ func newWebPack(t *testing.T, numProxies int, opts ...webPackOptions) *webPack { var proxies []*testProxy for p := range numProxies { proxyID := fmt.Sprintf("proxy%v", p) - proxies = append(proxies, createProxy(ctx, t, proxyID, node, server.TLS, hostSigners, clock, options.modules, options.proxyOptions...)) + proxies = append(proxies, createProxy(ctx, t, proxyID, node, server.TLS, hostSigners, clock, options.modules, options.insecureMode, options.proxyOptions...)) } // Wait for proxies to fully register before starting the test. @@ -8535,7 +8542,7 @@ func withKubeProxy() proxyOption { } func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regular.Server, authServer *authtest.TLSServer, - hostSigners []ssh.Signer, clock *clockwork.FakeClock, m *modulestest.Modules, opts ...proxyOption, + hostSigners []ssh.Signer, clock *clockwork.FakeClock, m *modulestest.Modules, insecureMode bool, opts ...proxyOption, ) *testProxy { t.Helper() cfg := proxyConfig{} @@ -8713,7 +8720,7 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula tlscfg, err := authServer.Identity.TLSConfig(utils.DefaultCipherSuites()) require.NoError(t, err) tlscfg.ClientAuth = tls.RequireAndVerifyClientCert - if lib.IsInsecureDevMode() { + if insecureMode { tlscfg.InsecureSkipVerify = true tlscfg.ClientAuth = tls.RequireAnyClientCert } @@ -8848,6 +8855,7 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula DatabaseREPLRegistry: &mockDatabaseREPLRegistry{repl: map[string]dbrepl.REPLNewFunc{}}, Modules: m, ClusterFeatures: *m.TestFeatures.ToProto(), + InsecureMode: insecureMode, }, SetClock(clock)) require.NoError(t, err) diff --git a/lib/web/oidcidp.go b/lib/web/oidcidp.go index 094df1dc01b..0268559b6dd 100644 --- a/lib/web/oidcidp.go +++ b/lib/web/oidcidp.go @@ -57,5 +57,5 @@ func (h *Handler) jwksOIDC(_ http.ResponseWriter, r *http.Request, _ httprouter. // Returns the thumbprint of the top intermediate CA that signed the TLS cert used to serve HTTPS requests. // In case of a self signed certificate, then it returns the thumbprint of the TLS cert itself. func (h *Handler) thumbprint(_ http.ResponseWriter, r *http.Request, _ httprouter.Params) (any, error) { - return awsoidc.ThumbprintIdP(r.Context(), h.PublicProxyAddr()) + return awsoidc.ThumbprintIdP(r.Context(), h.PublicProxyAddr(), h.cfg.InsecureMode) } diff --git a/lib/web/oidcidp_test.go b/lib/web/oidcidp_test.go index 8197240b0c1..027ccafd6da 100644 --- a/lib/web/oidcidp_test.go +++ b/lib/web/oidcidp_test.go @@ -27,8 +27,6 @@ import ( "testing" "github.com/stretchr/testify/require" - - "github.com/gravitational/teleport/lib" ) // TestOIDCIdPPublicEndpoints ensures the public endpoints for the AWS OIDC integration are available. @@ -87,11 +85,7 @@ func TestOIDCIdPPublicEndpoints(t *testing.T) { func TestThumbprint(t *testing.T) { ctx := context.Background() - // Proxy starts with self-signed certificates. - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - - env := newWebPack(t, 1) + env := newWebPack(t, 1, withInsecureMode()) proxy := env.proxies[0] // Request OpenID Configuration public endpoint. diff --git a/tool/teleport/common/integration_configure.go b/tool/teleport/common/integration_configure.go index 323cbc68cc7..c61a1494119 100644 --- a/tool/teleport/common/integration_configure.go +++ b/tool/teleport/common/integration_configure.go @@ -33,7 +33,6 @@ import ( "github.com/gravitational/trace" ecatypes "github.com/gravitational/teleport/api/types/externalauditstorage" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/config" "github.com/gravitational/teleport/lib/integrations/awsoidc" "github.com/gravitational/teleport/lib/integrations/awsra" @@ -126,9 +125,6 @@ func onIntegrationConfEKSIAM(ctx context.Context, params config.IntegrationConfE } func onIntegrationConfAWSOIDCIdP(ctx context.Context, clf config.CommandLineFlags) error { - // pass the value of --insecure flag to the runtime - lib.SetInsecureDevMode(clf.InsecureMode) - // Ensure we print output to the user. LogLevel at this point was set to Error. utils.InitLogger(utils.LoggingForDaemon, slog.LevelInfo) @@ -144,6 +140,7 @@ func onIntegrationConfAWSOIDCIdP(ctx context.Context, clf config.CommandLineFlag ProxyPublicAddress: clf.IntegrationConfAWSOIDCIdPArguments.ProxyPublicURL, IntegrationPolicyPreset: awsoidc.PolicyPreset(clf.IntegrationConfAWSOIDCIdPArguments.PolicyPreset), AutoConfirm: clf.IntegrationConfAWSOIDCIdPArguments.AutoConfirm, + Insecure: clf.InsecureMode, } return trace.Wrap(awsoidc.ConfigureIdPIAM(ctx, iamClient, confReq)) } @@ -294,9 +291,6 @@ func onIntegrationConfSAMLIdPGCPWorkforce(ctx context.Context, params samlidpcon } func onIntegrationConfAWSRATrustAnchor(ctx context.Context, clf config.CommandLineFlags) error { - // pass the value of --insecure flag to the runtime - lib.SetInsecureDevMode(clf.InsecureMode) - // Ensure we print output to the user. LogLevel at this point was set to Error. utils.InitLogger(utils.LoggingForDaemon, slog.LevelInfo) diff --git a/tool/tsh/common/access_request_test.go b/tool/tsh/common/access_request_test.go index 2eadcf72749..b205eccc5a5 100644 --- a/tool/tsh/common/access_request_test.go +++ b/tool/tsh/common/access_request_test.go @@ -30,7 +30,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/asciitable" "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" @@ -48,8 +47,6 @@ func TestAccessRequestSearch(t *testing.T) { }, }, ) - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) ctx := context.Background() const ( rootClusterName = "root-cluster" @@ -59,6 +56,7 @@ func TestAccessRequestSearch(t *testing.T) { ) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.ClusterName.SetClusterName(rootClusterName) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Kube.Enabled = true @@ -69,6 +67,7 @@ func TestAccessRequestSearch(t *testing.T) { withLeafCluster(), withLeafConfigFunc( func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.ClusterName.SetClusterName(leafClusterName) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Kube.Enabled = true diff --git a/tool/tsh/common/app_aws_test.go b/tool/tsh/common/app_aws_test.go index 5cf0e9416ad..79b1921f1bc 100644 --- a/tool/tsh/common/app_aws_test.go +++ b/tool/tsh/common/app_aws_test.go @@ -35,7 +35,6 @@ import ( "github.com/gravitational/teleport/api/constants" "github.com/gravitational/teleport/api/types" apiutils "github.com/gravitational/teleport/api/utils" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth/mocku2f" "github.com/gravitational/teleport/lib/integrations/awsra/createsession" "github.com/gravitational/teleport/lib/service" @@ -448,6 +447,7 @@ func TestAWSConsoleLogins(t *testing.T) { testserver.WithClusterName("root"), testserver.WithBootstrap(connector, user, rootAWSRole), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Apps.Enabled = true cfg.Apps.Apps = []servicecfg.App{ @@ -477,6 +477,7 @@ func TestAWSConsoleLogins(t *testing.T) { testserver.WithClusterName("leaf"), testserver.WithBootstrap(leafAWSRole), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Apps.Enabled = true cfg.Apps.Apps = []servicecfg.App{ @@ -552,11 +553,6 @@ func makeUserWithAWSRole(t *testing.T) (types.User, types.Role) { } func SetupTrustedCluster(ctx context.Context, t *testing.T, rootServer, leafServer *service.TeleportProcess, additionalRoleMappings ...types.RoleMapping) { - // Use insecure mode so that the trusted cluster can establish trust over reverse tunnel. - isInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(isInsecure) }) - rootProxyAddr, err := rootServer.ProxyWebAddr() require.NoError(t, err) rootProxyTunnelAddr, err := rootServer.ProxyTunnelAddr() diff --git a/tool/tsh/common/app_azure_test.go b/tool/tsh/common/app_azure_test.go index 0bd59e92870..53a29ace4c3 100644 --- a/tool/tsh/common/app_azure_test.go +++ b/tool/tsh/common/app_azure_test.go @@ -34,7 +34,6 @@ import ( "github.com/stretchr/testify/require" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/client" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" @@ -43,7 +42,6 @@ import ( ) func TestAzure(t *testing.T) { - lib.SetInsecureDevMode(true) tmpHomePath := t.TempDir() connector := mockConnector(t) @@ -54,6 +52,7 @@ func TestAzure(t *testing.T) { testserver.WithClusterName("localhost"), testserver.WithBootstrap(connector, user, azureRole), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Apps.Enabled = true cfg.Apps.Apps = []servicecfg.App{ diff --git a/tool/tsh/common/app_test.go b/tool/tsh/common/app_test.go index 43a922decbd..ab158184c0e 100644 --- a/tool/tsh/common/app_test.go +++ b/tool/tsh/common/app_test.go @@ -114,6 +114,7 @@ func TestAppCommands(t *testing.T) { testserver.WithTestApp("rootapp", rootApp.URL), testserver.WithConfig(func(cfg *servicecfg.Config) { cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) + cfg.InsecureMode = true }), } rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...) @@ -141,6 +142,7 @@ func TestAppCommands(t *testing.T) { testserver.WithTestApp("leafapp", leafApp.URL), testserver.WithConfig(func(cfg *servicecfg.Config) { cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) + cfg.InsecureMode = true }), } leafServer, err := testserver.NewTeleportProcess(t.TempDir(), leafServerOpts...) diff --git a/tool/tsh/common/db_test.go b/tool/tsh/common/db_test.go index 3fbc94e2185..8bbc2e4f646 100644 --- a/tool/tsh/common/db_test.go +++ b/tool/tsh/common/db_test.go @@ -43,7 +43,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/utils/keys" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/client" "github.com/gravitational/teleport/lib/cryptosuites" "github.com/gravitational/teleport/lib/defaults" @@ -102,16 +101,6 @@ func TestTshDB(t *testing.T) { defaults.ResyncInterval = oldResyncInterval }) - // Proxy uses self-signed certificates in tests. - originalValue := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - // To detect tests that run in parallel incorrectly, call t.Setenv with a - // dummy env var - that function detects tests with parallel ancestors - // and panics, preventing improper use of this helper. - t.Setenv("WithInsecureDevMode", "1") - t.Cleanup(func() { - lib.SetInsecureDevMode(originalValue) - }) t.Run("Login", testDatabaseLogin) t.Run("List", testListDatabase) t.Run("DatabaseSelection", testDatabaseSelection) @@ -161,6 +150,7 @@ func testDatabaseLogin(t *testing.T) { alice.SetRoles([]string{"dev-access", "autouser", "access-requestor"}) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.BootstrapResources = append( cfg.Auth.BootstrapResources, autoUserRole, @@ -708,6 +698,7 @@ func testListDatabase(t *testing.T) { fullName := "root-postgres-rds-us-west-1-123456789012" s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Databases.Enabled = true @@ -731,6 +722,7 @@ func testListDatabase(t *testing.T) { withLeafCluster(), withLeafConfigFunc(func(cfg *servicecfg.Config) { cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond + cfg.InsecureMode = true cfg.SSH.Enabled = false cfg.Databases.Enabled = true cfg.Databases.Databases = []servicecfg.Database{{ @@ -1601,6 +1593,7 @@ func testDatabaseSelection(t *testing.T) { s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { cfg.Auth.BootstrapResources = append(cfg.Auth.BootstrapResources, alice) + cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Databases.Enabled = true cfg.SSH.Enabled = false diff --git a/tool/tsh/common/hardware_key_test.go b/tool/tsh/common/hardware_key_test.go index 21016c78727..b56c422c59b 100644 --- a/tool/tsh/common/hardware_key_test.go +++ b/tool/tsh/common/hardware_key_test.go @@ -45,7 +45,6 @@ import ( "github.com/gravitational/teleport/api/utils/keys" apisshutils "github.com/gravitational/teleport/api/utils/sshutils" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/mocku2f" @@ -560,12 +559,6 @@ func TestHardwareKeyApp(t *testing.T) { defaults.ResyncInterval = oldResyncInterval }) - isInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - t.Cleanup(func() { - lib.SetInsecureDevMode(isInsecure) - }) - accessUser, err := types.NewUser("access") require.NoError(t, err) accessUser.SetRoles([]string{"access"}) @@ -580,6 +573,7 @@ func TestHardwareKeyApp(t *testing.T) { testserver.WithClusterName("root"), testserver.WithConfig(func(cfg *servicecfg.Config) { cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) + cfg.InsecureMode = true cfg.Apps = servicecfg.AppsConfig{ Enabled: true, Apps: []servicecfg.App{{ diff --git a/tool/tsh/common/kube_test.go b/tool/tsh/common/kube_test.go index 3256bd9e0af..e721bdf47cc 100644 --- a/tool/tsh/common/kube_test.go +++ b/tool/tsh/common/kube_test.go @@ -47,7 +47,6 @@ import ( apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/api/utils/keypaths" "github.com/gravitational/teleport/entitlements" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/asciitable" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/kube/kubeconfig" @@ -61,9 +60,6 @@ import ( ) func TestKube(t *testing.T) { - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) - pack := setupKubeTestPack(t, true) t.Run("list kube", pack.testListKube) t.Run("proxy kube", pack.testProxyKube) @@ -71,9 +67,6 @@ func TestKube(t *testing.T) { } func TestKubeLogin(t *testing.T) { - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) - testKubeLogin := func(t *testing.T, kubeCluster string, expectedAddr string) { // Set default kubeconfig to a non-exist file to avoid loading other things. t.Setenv("KUBECONFIG", filepath.Join(os.Getenv(types.HomeEnvVar), uuid.NewString())) @@ -147,6 +140,7 @@ func setupKubeTestPack(t *testing.T, withMultiplexMode bool) *kubeTestPack { if withMultiplexMode { cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) } + cfg.InsecureMode = true cfg.Kube.Enabled = true cfg.Kube.ListenAddr = utils.MustParseAddr(localListenerAddr()) cfg.Kube.KubeconfigPath = newKubeConfigFile(t, rootKubeCluster1, rootKubeCluster2) @@ -161,6 +155,7 @@ func setupKubeTestPack(t *testing.T, withMultiplexMode bool) *kubeTestPack { if withMultiplexMode { cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) } + cfg.InsecureMode = true cfg.Kube.Enabled = true cfg.Kube.ListenAddr = utils.MustParseAddr(localListenerAddr()) cfg.Kube.KubeconfigPath = newKubeConfigFile(t, leafKubeCluster) @@ -335,15 +330,6 @@ func TestKubeSelection(t *testing.T) { }, }, ) - originalValue := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - // To detect tests that run in parallel incorrectly, call t.Setenv with a - // dummy env var - that function detects tests with parallel ancestors - // and panics, preventing improper use of this helper. - t.Setenv("WithInsecureDevMode", "1") - t.Cleanup(func() { - lib.SetInsecureDevMode(originalValue) - }) oldResyncInterval := defaults.ResyncInterval defaults.ResyncInterval = 100 * time.Millisecond @@ -380,6 +366,7 @@ func TestKubeSelection(t *testing.T) { t.Cleanup(cancel) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true // reconfig the user to use the new role instead of the default ones // User is the second bootstrap resource. user, ok := cfg.Auth.BootstrapResources[1].(types.User) diff --git a/tool/tsh/common/proxy_test.go b/tool/tsh/common/proxy_test.go index 424d7c30ef6..f75986bde0f 100644 --- a/tool/tsh/common/proxy_test.go +++ b/tool/tsh/common/proxy_test.go @@ -55,7 +55,6 @@ import ( apievents "github.com/gravitational/teleport/api/types/events" "github.com/gravitational/teleport/api/utils/keys" "github.com/gravitational/teleport/api/utils/retryutils" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/mocku2f" @@ -81,10 +80,6 @@ func TestSSH(t *testing.T) { t.Skip("the current platform doesn't support adding CAs to the system pool") } - t.Setenv("_TELEPORT_TEST_NO_PARALLEL", "1") - defer lib.SetInsecureDevMode(lib.IsInsecureDevMode()) - lib.SetInsecureDevMode(false) - d := t.TempDir() webCertPath := filepath.Join(d, "cert.pem") webKeyPath := filepath.Join(d, "key.pem") @@ -107,9 +102,6 @@ func TestSSH(t *testing.T) { }), ) - // just in case someone changes newTestSuite - require.False(t, lib.IsInsecureDevMode()) - tests := []struct { name string fn func(t *testing.T, s *suite) @@ -625,13 +617,12 @@ func TestProxySSHJumpHost(t *testing.T) { testserver.WithBootstrap(connector, accessUser), testserver.WithHostname("node01"), testserver.WithClusterName("root"), - testserver.WithAuthConfig( - func(cfg *servicecfg.AuthConfig) { - cfg.NetworkingConfig.SetProxyListenerMode(rootListenerMode) - // Load all CAs on login so that leaf CA is trusted by clients. - cfg.LoadAllCAs = true - }, - ), + testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Auth.NetworkingConfig.SetProxyListenerMode(rootListenerMode) + // Load all CAs on login so that leaf CA is trusted by clients. + cfg.Auth.LoadAllCAs = true + cfg.InsecureMode = true + }), } rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...) require.NoError(t, err) @@ -644,11 +635,10 @@ func TestProxySSHJumpHost(t *testing.T) { testserver.WithBootstrap(accessUser), testserver.WithHostname("node02"), testserver.WithClusterName("leaf"), - testserver.WithAuthConfig( - func(cfg *servicecfg.AuthConfig) { - cfg.NetworkingConfig.SetProxyListenerMode(leafListenerMode) - }, - ), + testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Auth.NetworkingConfig.SetProxyListenerMode(leafListenerMode) + cfg.InsecureMode = true + }), } leafServer, err := testserver.NewTeleportProcess(t.TempDir(), leafServerOpts...) require.NoError(t, err) @@ -711,9 +701,6 @@ func TestTSHProxyTemplate(t *testing.T) { t.Skip("Skipping test, no ssh binary found.") } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - tshPath, err := os.Executable() require.NoError(t, err) @@ -754,9 +741,6 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) { t.Skip("Skipping no external SSH binary found.") } - lib.SetInsecureDevMode(true) - defer lib.SetInsecureDevMode(false) - tests := []struct { name string opts []testSuiteOptionFunc @@ -765,6 +749,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) { name: "node recording mode with TLS routing enabled", opts: []testSuiteOptionFunc{ withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtNodeSync) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) }), @@ -774,6 +759,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) { name: "proxy recording mode with TLS routing enabled", opts: []testSuiteOptionFunc{ withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtProxySync) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) }), @@ -785,6 +771,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) { name: "proxy recording mode with TLS routing enabled legacy", opts: []testSuiteOptionFunc{ withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtProxySync) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Auth.Preference.SetSignatureAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_LEGACY) @@ -795,6 +782,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) { name: "node recording mode with TLS routing disabled", opts: []testSuiteOptionFunc{ withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtNodeSync) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Separate) }), @@ -804,6 +792,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) { name: "proxy recording mode with TLS routing disabled", opts: []testSuiteOptionFunc{ withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtProxySync) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Separate) }), @@ -895,20 +884,16 @@ func TestEnvVarCommand(t *testing.T) { // TestList verifies "tsh ls" functionality func TestList(t *testing.T) { - isInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - t.Cleanup(func() { - lib.SetInsecureDevMode(isInsecure) - }) - s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { cfg.Version = defaults.TeleportConfigVersionV2 + cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) }), withLeafCluster(), withLeafConfigFunc(func(cfg *servicecfg.Config) { cfg.Version = defaults.TeleportConfigVersionV2 + cfg.InsecureMode = true }), ) rootNodeAddress, err := s.root.NodeSSHAddr() @@ -1468,8 +1453,6 @@ func TestCheckProxyAWSFormatCompatibility(t *testing.T) { // correctly given a Machine ID-style identity with a valid RouteToApp. func TestProxyAppWithIdentity(t *testing.T) { disableAgent(t) - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) ctx := context.Background() const ( @@ -1485,6 +1468,7 @@ func TestProxyAppWithIdentity(t *testing.T) { testserver.WithClusterName(clusterName), testserver.WithTestApp(appName, appServer.URL), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) }), } @@ -1607,9 +1591,6 @@ func TestProxyAppWithIdentity(t *testing.T) { func TestProxyAppMultiPort(t *testing.T) { disableAgent(t) - // Necessary for self-signed certs to be considered valid. - lib.SetInsecureDevMode(true) - t.Cleanup(func() { lib.SetInsecureDevMode(false) }) ctx := context.Background() const ( @@ -1633,6 +1614,7 @@ func TestProxyAppMultiPort(t *testing.T) { testserver.WithBootstrap(connector, user), testserver.WithClusterName(clusterName), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) cfg.Apps = servicecfg.AppsConfig{ Enabled: true, diff --git a/tool/tsh/common/tsh_helper_test.go b/tool/tsh/common/tsh_helper_test.go index 0a4247d97cb..ab0561b02cf 100644 --- a/tool/tsh/common/tsh_helper_test.go +++ b/tool/tsh/common/tsh_helper_test.go @@ -97,6 +97,7 @@ func (s *suite) setupRootCluster(t *testing.T, options testSuiteOptions) { } cfg := servicecfg.MakeDefaultConfig() + cfg.InsecureMode = true cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig() cfg.Logger = logtest.NewLogger() err := config.ApplyFileConfig(fileConfig, cfg) @@ -196,6 +197,7 @@ func (s *suite) setupLeafCluster(t *testing.T, options testSuiteOptions) { } cfg := servicecfg.MakeDefaultConfig() + cfg.InsecureMode = true cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig() cfg.Logger = logtest.NewLogger() err := config.ApplyFileConfig(fileConfig, cfg) diff --git a/tool/tsh/common/tsh_test.go b/tool/tsh/common/tsh_test.go index 6e6fdeeacb7..aac1920dc3b 100644 --- a/tool/tsh/common/tsh_test.go +++ b/tool/tsh/common/tsh_test.go @@ -75,7 +75,6 @@ import ( "github.com/gravitational/teleport/api/utils/prompt" "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/kube" - "github.com/gravitational/teleport/lib" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/mocku2f" @@ -1259,12 +1258,6 @@ func TestSSHOnMultipleNodes(t *testing.T) { ctx := t.Context() - isInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - t.Cleanup(func() { - lib.SetInsecureDevMode(isInsecure) - }) - origin := func(cluster string) string { return fmt.Sprintf("https://%s", cluster) } @@ -1313,7 +1306,12 @@ func TestSSHOnMultipleNodes(t *testing.T) { require.NoError(t, err) device.SetPasswordless() - rootAuth, rootProxy := makeTestServers(t, withBootstrap(connector, alice, bob, noAccessRole, sshLoginRole, perSessionMFARole)) + rootAuth, rootProxy := makeTestServers(t, + withBootstrap(connector, alice, bob, noAccessRole, sshLoginRole, perSessionMFARole), + withConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true + }), + ) rootAuthAddr, err := rootAuth.AuthAddr() require.NoError(t, err) @@ -1346,7 +1344,13 @@ func TestSSHOnMultipleNodes(t *testing.T) { }) require.NoError(t, err) - leafAuth, leafProxy := makeTestServers(t, withClusterName(t, "leafcluster"), withBootstrap(connector, alice, sshLoginRole, perSessionMFARole)) + leafAuth, leafProxy := makeTestServers(t, + withClusterName(t, "leafcluster"), + withBootstrap(connector, alice, sshLoginRole, perSessionMFARole), + withConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true + }), + ) tryCreateTrustedCluster(t, leafAuth.GetAuthServer(), trustedCluster) leafAuthAddr, err := leafAuth.AuthAddr() @@ -2434,12 +2438,6 @@ func TestAccessRequestOnLeaf(t *testing.T) { ctx, cancel := context.WithCancel(context.Background()) defer cancel() - isInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - t.Cleanup(func() { - lib.SetInsecureDevMode(isInsecure) - }) - requester, err := types.NewRole("requester", types.RoleSpecV6{ Allow: types.RoleConditions{ Request: &types.AccessRequestConditions{ @@ -2457,6 +2455,9 @@ func TestAccessRequestOnLeaf(t *testing.T) { rootAuth, rootProxy := makeTestServers(t, withBootstrap(requester, connector, alice), + withConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true + }), ) rootAuthServer := rootAuth.GetAuthServer() @@ -2481,7 +2482,12 @@ func TestAccessRequestOnLeaf(t *testing.T) { }) require.NoError(t, err) - leafAuth, _ := makeTestServers(t, withClusterName(t, "leafcluster")) + leafAuth, _ := makeTestServers(t, + withClusterName(t, "leafcluster"), + withConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true + }), + ) tryCreateTrustedCluster(t, leafAuth.GetAuthServer(), trustedCluster) err = Run(ctx, []string{ @@ -5940,13 +5946,6 @@ func TestMakeProfileInfo_NoInternalLogins(t *testing.T) { } func TestBenchmarkPostgres(t *testing.T) { - // Set insecure mode to allow db agent to establish reverse tunnel. - isInsecure := lib.IsInsecureDevMode() - lib.SetInsecureDevMode(true) - t.Cleanup(func() { - lib.SetInsecureDevMode(isInsecure) - }) - // Canceling the context right after the test ensures the local proxy // started by the benchmark command is closed and the remaining connections // (if any) are dropped. @@ -5965,6 +5964,7 @@ func TestBenchmarkPostgres(t *testing.T) { testserver.WithBootstrap(connector, alice), testserver.WithConfig(func(cfg *servicecfg.Config) { cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) + cfg.InsecureMode = true cfg.Databases.Enabled = true cfg.Databases.Databases = []servicecfg.Database{ { @@ -6451,6 +6451,7 @@ func TestListingResourcesAcrossClusters(t *testing.T) { testserver.WithDebugApp(), testserver.WithConfig(func(cfg *servicecfg.Config) { // Enable DB + cfg.InsecureMode = true cfg.Databases.Enabled = true cfg.Databases.Databases = []servicecfg.Database{ { @@ -6474,6 +6475,7 @@ func TestListingResourcesAcrossClusters(t *testing.T) { testserver.WithClusterName("leaf"), testserver.WithDebugApp(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.InsecureMode = true // Enable DB cfg.Databases.Enabled = true cfg.Databases.Databases = []servicecfg.Database{