mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Julia Ogris
9021c526c2
* app: Add connection limiter support to app service The app service is the only Teleport service without rate limiter support. Every other service (SSH, Auth, Proxy, Database, Kube, Windows Desktop) already has a `limiter.Config` field populated from `connection_limits` in the file config. Wire the limiter through the same path: add `Limiter` to `AppsConfig`, include it in the `limiters` slice in `configuration.go`, and pass it into `ConnectionsHandlerConfig`. Apply the limiter in `handleConnection` - the shared entry point for all app protocols - rather than in the HTTP middleware chain. This ensures HTTP, TCP, and MCP connections all honour `connection_limits`. Follow the database service pattern: call `RegisterRequestAndConnection` with the client IP before protocol dispatch, and release the slot when the connection closes. Skip limiting when the client IP cannot be extracted (e.g. `net.Pipe` connections used by integration app proxying) rather than rejecting the connection. For HTTP, transfer the release into the cleanup function that runs after the connection is served. For TCP and MCP, release on handler return via defer. Create the limiter unconditionally even when no `connection_limits` are configured (the default), to stay consistent with how every other Teleport service handles it. Move `go c.expireSessions()` to after all fallible initialization to avoid leaking the goroutine on error. Add a v19 breaking-change entry to the changelog and update the config reference to list Application alongside the other services. * Address review feedback * app: Address review feedback on limiter PR Clarify that the 15,000 connection cap is per `app_service` instance in the changelog entry. Replace the two-variable `release`/`releaseOnReturn` pattern in `handleConnection` with a single `var release func()`. Nil the variable when transferring ownership to the cleanup function so the deferred release becomes a no-op. Remove the unused error return from `newHTTPServer` - no code path returns an error. Replace the two unit tests that only exercised `lib/limiter` in isolation with four tests that verify `handleConnection` correctly wires the limiter: max connections, release-then-reconnect, rate limiting, and net.Pipe skip behaviour. Fix YAML indentation in the instance-wide config reference from 4-space to the standard 2-space. * app: Clarify connection limit scope in changelog Spell out all three dimensions of the 15K default: per client IP, per `app_service` instance, aggregated across all apps on that instance. * app: Use real limit in PipeSkipsLimiter test Configure `MaxConnections: 1` and pre-fill the limiter so a normal connection would be rejected. This verifies that net.Pipe connections actually bypass the limiter rather than passing vacuously because `MaxConnections: 0` disables limiting entirely. * Fix go lint error * app: Wire limiter config to proxy-side integration app handler The proxy-side `IntegrationAppHandler` creates a `ConnectionsHandler` for integration apps (cloud apps like AWS console) that run directly on the proxy without a separate app service. Wire `cfg.Apps.Limiter` through to this callsite so it enforces the same per-IP connection limits as the regular app service handler. * app: Rename `held` to `release` in limiter tests Match the variable name used in the production code and in the `RegisterRequestAndConnection` godoc example. * Address review feedback
Teleport Docs
Teleport docs are built using Docusaurus. Please see the README in the docs-website repo for details on how to make and test changes to Teleport docs.