Fix tunnel address for TLS routing if public tunnel address is present #8961
Conversation
smallinsky
force-pushed
the
smallinsky/fix_tls_routing_reverse_tunnel_address
branch
6 times, most recently
from
474e5de
to
48c1b9a
Compare
smallinsky
force-pushed
the
smallinsky/fix_tls_routing_reverse_tunnel_address
branch
from
48c1b9a
to
1758f14
Compare
api/client/webclient/webclient.go
Outdated
|
|
||
| // Got proxy address without a port like: proxy.example.com | ||
| // If proxyAddr doesn't contain any port it means that HTTPS port should be used. | ||
| return net.JoinHostPort(host, "443"), nil |
There was a problem hiding this comment.
Why 443? Isn't default proxy port 3080?
There was a problem hiding this comment.
This code is invoked only if Find web API call succeed.
if proxyAddr format doesn't contain port number it means that the default https port was used in Find API call:
endpoint := fmt.Sprintf("https://%s/webapi/find", proxyAddr)
req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
https://github.com/gravitational/teleport/blob/master/api/client/webclient/webclient.go#L95
There was a problem hiding this comment.
Hmm I see. This is a little confusing, let's at least expand the comment to explain. Also, do we have a constant for 443?
There was a problem hiding this comment.
Extended the comment.
Also, do we have a constant for 443?
there is gravitational/teleport.StandardHTTPSPort const but importinggravitational/teleportin teleport/api` pkg is not possible thus I move this const to api defaults.
api/client/webclient/webclient.go
Outdated
|
|
||
| // Got proxy address without a port like: proxy.example.com | ||
| // If proxyAddr doesn't contain any port it means that HTTPS port should be used. | ||
| return net.JoinHostPort(host, "443"), nil |
There was a problem hiding this comment.
Hmm I see. This is a little confusing, let's at least expand the comment to explain. Also, do we have a constant for 443?
smallinsky
force-pushed
the
smallinsky/fix_tls_routing_reverse_tunnel_address
branch
2 times, most recently
from
2f83086
to
ac3ec8a
Compare
smallinsky
force-pushed
the
smallinsky/fix_tls_routing_reverse_tunnel_address
branch
from
ac3ec8a
to
cb73e58
Compare
smallinsky
deleted the
smallinsky/fix_tls_routing_reverse_tunnel_address
branch
Issue: #8952
What
Fix destination reverse tunnel address in case if proxy support TLS Routing.
This PR change the
tunnelAddrlogic and onlypublic_proxy_addrandwebProxyaddresses are used as tunnel address if proxy support TLS Routing.