GitHub proxy part 6: proxing Git using SSH transport #49980

greedy52 · 2024-12-10T02:43:41Z

GitHub proxy MVP #48762

will stack another PR for tsh git ssh/config/clone commands on top of this

lib/cryptosuites/suites.go

espadolini

Are you sure that hooking into lib/srv/forward.Server to essentially add a completely separate mode gated by a flag (or like three different and potentially conflicting flags) is easier than writing something new that's going to be structurally guaranteed to work as intended just for the purpose of forwarding the ssh git protocol?

lib/auth/authclient/clt.go

lib/proxy/router.go

lib/srv/forward/sshserver.go

lib/reversetunnel/remotesite.go

lib/srv/authhandlers.go

lib/srv/git/git.go

lib/srv/git/github.go

greedy52 · 2024-12-16T14:17:58Z

Are you sure that hooking into lib/srv/forward.Server to essentially add a completely separate mode gated by a flag (or like three different and potentially conflicting flags) is easier than writing something new that's going to be structurally guaranteed to work as intended just for the purpose of forwarding the ssh git protocol?

will do 👍

greedy52 · 2024-12-20T18:06:26Z

i am splitting out some parts of this PR to separate ones like

GitHub proxy: git command recorder #50505

public-teleport-github-review-bot · 2025-01-02T14:19:44Z

@greedy52 - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

greedy52 · 2025-01-07T17:02:11Z

@espadolini PTAL

…/48762_ssh

greedy52 · 2025-01-10T16:01:43Z

@espadolini @Tener could you take another look? thanks!

api/client/client.go

rosstimothy · 2025-01-13T14:36:37Z

api/types/server.go

@@ -626,6 +626,9 @@ func (s *ServerV2) githubCheckAndSetDefaults() error {
 		return trace.Wrap(err, "invalid GitHub organization name")
 	}

+	// Set SSH host port for connection and "fake" hostname for routing. These
+	// values are hard-coded and cannot be customized.
+	s.Spec.Addr = "github.com:22"


Does this have to happen in CASD?

I could move it to backend create but I would prefer it here as it should not have other values.

lib/auth/authclient/clt.go

lib/proxy/router.go

lib/srv/git/forward.go

lib/sshutils/reply.go

lib/sshutils/exec.go

lib/sshutils/reply.go

lib/srv/git/forward.go

greedy52 · 2025-01-14T18:21:55Z

@r0mant may i get an admin approval for the large size and an excludeflake?

flaky test detector failed on lib/srv/regular due to timeout:

✓  lib/srv/git (4.288s) (coverage: 62.9% of statements)
✓  lib/sshutils (3.388s) (coverage: 7.7% of statements)
✓  lib/proxy (7.197s) (coverage: 28.8% of statements)
✓  lib/srv (7.295s) (coverage: 2.3% of statements)
✓  lib/services (14.516s) (coverage: 3.0% of statements)
✖  lib/srv/regular (10m0.411s) (-test.shuffle 1736869325460463256)

There is no change to that package besides adding a new param to reverse tunnel server to three existing tests.

r0mant · 2025-01-14T18:58:46Z

/excludeflake *

r0mant

Bot.

…/48762_ssh

* GitHub proxy part 6: proxing Git using SSH transport * better command parsing and update suite * refactor * revert unnecearrty files * address review comments * ut fix * revert localsite_test.go * change special suffix to teleport-github-org for routing * fix routing ut * minor typo edit * fix ut after sshca change * add UT to sshutils * minor review comments * fix api ut because of special suffix change * GitServerReadOnlyClient * downgrade error to warning * run go mod tidy. not sure why it's needed * rename mock.go to mock_test.go

* GitHub Proxy part 1: github integration resource (#48999) * github integration resource * fix lib/web * revert withSecrets * use static credentials * address review comments * fix ut * GitHub Proxy part 2: git_server resource, service, and RBAC (#49393) * git_server resource and role.allow.github_permissions * implicit RO on KindGitServer * review comments * fix ut * make -C integrations/operator crd * fix ut again * make crds-up-to-date and make -C integrations/terraform docs * GitHub proxy part 1.5: integration in web ui (#49561) * GitHub proxy part 1.5: integration in web ui * fix lint * GitHub Proxy part 3.5: caching PluginStaticCredentials (#49472) * GitHub Proxy part 3.5: caching PluginStaticCredentials * fix lint * GitHub proxy part 2.5: git_server cache (#49564) * GitHub proxy part 2.5: git_server cache * revert event * fix getAll * review comments * GitHub Proxy part 3: gen github user cert and export CA (#49396) * GitHub Proxy part 3: gen github user cert and export CA * address pr comment * minor refactor * use cache * fix build and cache * GitHub proxy part 4: `tsh git ls` with unified resource (#49596) * GitHub proxy part 4: tsh git ls * fix ut * update username note * fix * GitHub proxy part 5: OAuth flow to retrieve GitHub identity (#49849) * GitHub proxy part 5: OAuth flow to retrieve GitHub identity * review comments round1 * review comments round 2 and update tsh git list * make -C integrations/operator crd * make -C integrations/terraform docs * fix flaky test * GitHub proxy part 6.5: tsh git ssh/clone/config (#50044) * GitHub proxy part 6.5: tsh git ssh/clone/config * review comments * fix test * fix ut for lookpath * fix logger and update dependency version * go mod tidy for integrations * GitHub proxy part 7: audit events (#49923) * GitHub proxy part 7: audit events * make Git Command consistent * fix typo * GitHub proxy: git command recorder (#50505) * GitHub proxy: recording git command * address review * review comments * allow flags after repository for git-upload-pack * GitHub proxy part 6: proxing Git using SSH transport (#49980) * GitHub proxy part 6: proxing Git using SSH transport * better command parsing and update suite * refactor * revert unnecearrty files * address review comments * ut fix * revert localsite_test.go * change special suffix to teleport-github-org for routing * fix routing ut * minor typo edit * fix ut after sshca change * add UT to sshutils * minor review comments * fix api ut because of special suffix change * GitServerReadOnlyClient * downgrade error to warning * run go mod tidy. not sure why it's needed * rename mock.go to mock_test.go * GitHub Proxy: complete audit event flow and add an enterprise guard (#51049) * fix lint and remove accidently checked-in binary * Fix flaky git.TestForwardServer test (#51112)

* GitHub proxy part 6: proxing Git using SSH transport * better command parsing and update suite * refactor * revert unnecearrty files * address review comments * ut fix * revert localsite_test.go * change special suffix to teleport-github-org for routing * fix routing ut * minor typo edit * fix ut after sshca change * add UT to sshutils * minor review comments * fix api ut because of special suffix change * GitServerReadOnlyClient * downgrade error to warning * run go mod tidy. not sure why it's needed * rename mock.go to mock_test.go

greedy52 mentioned this pull request Dec 10, 2024

GitHub proxy MVP #48762

Closed

9 tasks

Base automatically changed from STeve/48762_github_oauth_flow to master December 10, 2024 17:50

greedy52 changed the base branch from master to STeve/48762_audit_log December 11, 2024 02:53

greedy52 changed the base branch from STeve/48762_audit_log to master December 11, 2024 02:53

greedy52 force-pushed the STeve/48762_ssh branch from 73db1b8 to 1cd0ec1 Compare December 11, 2024 03:00

greedy52 mentioned this pull request Dec 11, 2024

GitHub proxy part 6.5: tsh git ssh/clone/config #50044

Merged

greedy52 force-pushed the STeve/48762_ssh branch 2 times, most recently from a5cb9a6 to 97bbddf Compare December 12, 2024 01:33

greedy52 requested review from espadolini and r0mant December 12, 2024 01:59

greedy52 marked this pull request as ready for review December 12, 2024 01:59

github-actions bot requested review from flyinghermit and rosstimothy December 12, 2024 01:59

github-actions bot added the size/lg label Dec 12, 2024

espadolini reviewed Dec 12, 2024

View reviewed changes

lib/cryptosuites/suites.go Outdated Show resolved Hide resolved

espadolini reviewed Dec 12, 2024

View reviewed changes

greedy52 added 2 commits December 17, 2024 12:18

GitHub proxy part 6: proxing Git using SSH transport

214f1ef

better command parsing and update suite

624a8ec

greedy52 mentioned this pull request Dec 20, 2024

GitHub proxy: git command recorder #50505

Merged

refactor

2345ca3

greedy52 force-pushed the STeve/48762_ssh branch from 97bbddf to 2345ca3 Compare January 2, 2025 14:19

greedy52 requested a review from espadolini January 2, 2025 14:19

revert unnecearrty files

7048508

greedy52 requested review from Tener and GavinFrazar and removed request for flyinghermit January 2, 2025 15:09

fix routing ut

58ca650

greedy52 force-pushed the STeve/48762_ssh branch from b05b384 to 58ca650 Compare January 10, 2025 14:26

greedy52 added 3 commits January 10, 2025 10:42

minor typo edit

b35b0af

Merge branch 'master' of github.com:gravitational/teleport into STeve…

ec56f21

…/48762_ssh

fix ut after sshca change

6ce6408

Tener approved these changes Jan 13, 2025

View reviewed changes

rosstimothy reviewed Jan 13, 2025

View reviewed changes

greedy52 added 3 commits January 13, 2025 13:10

add UT to sshutils

ebbb435

minor review comments

b0f2b0e

fix api ut because of special suffix change

0ce45f7

greedy52 requested a review from rosstimothy January 13, 2025 20:17

GitServerReadOnlyClient

f37804c

espadolini approved these changes Jan 14, 2025

View reviewed changes

lib/sshutils/reply.go Outdated Show resolved Hide resolved

lib/srv/git/forward.go Outdated Show resolved Hide resolved

downgrade error to warning

91b250e

r0mant approved these changes Jan 14, 2025

View reviewed changes

public-teleport-github-review-bot bot removed the request for review from GavinFrazar January 14, 2025 20:11

greedy52 added 3 commits January 14, 2025 15:14

Merge branch 'master' of github.com:gravitational/teleport into STeve…

ae50b6f

…/48762_ssh

run go mod tidy. not sure why it's needed

6a72c23

rename mock.go to mock_test.go

5aa2576

greedy52 added this pull request to the merge queue Jan 14, 2025

Merged via the queue into master with commit f0abbce Jan 14, 2025
44 checks passed

greedy52 deleted the STeve/48762_ssh branch January 14, 2025 22:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub proxy part 6: proxing Git using SSH transport #49980

GitHub proxy part 6: proxing Git using SSH transport #49980

greedy52 commented Dec 10, 2024

espadolini left a comment

greedy52 commented Dec 16, 2024 •

edited

Loading

greedy52 commented Dec 20, 2024

public-teleport-github-review-bot bot commented Jan 2, 2025

greedy52 commented Jan 7, 2025

greedy52 commented Jan 10, 2025

rosstimothy Jan 13, 2025

greedy52 Jan 13, 2025

greedy52 commented Jan 14, 2025 •

edited

Loading

r0mant commented Jan 14, 2025

r0mant left a comment

GitHub proxy part 6: proxing Git using SSH transport #49980

GitHub proxy part 6: proxing Git using SSH transport #49980

Conversation

greedy52 commented Dec 10, 2024

espadolini left a comment

Choose a reason for hiding this comment

greedy52 commented Dec 16, 2024 • edited Loading

greedy52 commented Dec 20, 2024

public-teleport-github-review-bot bot commented Jan 2, 2025

greedy52 commented Jan 7, 2025

greedy52 commented Jan 10, 2025

rosstimothy Jan 13, 2025

Choose a reason for hiding this comment

greedy52 Jan 13, 2025

Choose a reason for hiding this comment

greedy52 commented Jan 14, 2025 • edited Loading

r0mant commented Jan 14, 2025

r0mant left a comment

Choose a reason for hiding this comment

greedy52 commented Dec 16, 2024 •

edited

Loading

greedy52 commented Jan 14, 2025 •

edited

Loading