API client connection overhaul

api/client/contextdialer.go

@@ -21,7 +21,11 @@ import (
 	"net"
 	"time"
 
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/api/utils/sshutils"
+
 	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
 )
 
 // ContextDialer represents network dialer interface that uses context
@@ -38,23 +42,37 @@ func (f ContextDialerFunc) DialContext(ctx context.Context, network, addr string
 	return f(ctx, network, addr)
 }
 
-// NewAddrDialer makes a new dialer from a list of addresses
-func NewAddrDialer(addrs []string, keepAliveInterval, dialTimeout time.Duration) (ContextDialer, error) {
-	if len(addrs) == 0 {
-		return nil, trace.BadParameter("no addreses to dial")
-	}
-	dialer := net.Dialer{
+// NewDialer makes a new dialer.
+func NewDialer(keepAliveInterval, dialTimeout time.Duration) ContextDialer {
+	return &net.Dialer{
 		Timeout:   dialTimeout,
 		KeepAlive: keepAliveInterval,
 	}
-	return ContextDialerFunc(func(ctx context.Context, network, _ string) (conn net.Conn, err error) {
-		for _, addr := range addrs {
-			conn, err = dialer.DialContext(ctx, network, addr)
-			if err == nil {
-				return conn, nil
-			}
+}
+
+// NewTunnelDialer make a new ssh tunnel dialer
+func NewTunnelDialer(ssh ssh.ClientConfig, keepAliveInterval, dialTimeout time.Duration) ContextDialer {
+	dialer := NewDialer(keepAliveInterval, dialTimeout)
+	return ContextDialerFunc(func(ctx context.Context, network, addr string) (conn net.Conn, err error) {
+		conn, err = dialer.DialContext(ctx, network, addr)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		ssh.Timeout = dialTimeout
+		sconn, err := sshutils.NewClientConnWithDeadline(conn, addr, &ssh)
+		if err != nil {
+			return nil, trace.NewAggregate(err, conn.Close())
+		}
+
+		// Build a net.Conn over the tunnel. Make this an exclusive connection:
+		// close the net.Conn as well as the channel upon close.
+		conn, _, err = sshutils.ConnectProxyTransport(sconn.Conn, &sshutils.DialReq{
+			Address: constants.RemoteAuthServer,
+		}, true)
+		if err != nil {
+			return nil, trace.NewAggregate(err, sconn.Close())
 		}
-		// not wrapping on purpose to preserve the original error
-		return nil, err
-	}), nil
+		return conn, nil
+	})
 }

api/client/credentials.go

@@ -22,16 +22,20 @@ import (
 	"io/ioutil"
 
 	"github.com/gravitational/teleport/api/constants"
+
 	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
 	"golang.org/x/net/http2"
 )
 
 // Credentials are used to authenticate to Auth.
 type Credentials interface {
 	// Dialer is used to dial a connection to Auth.
 	Dialer() (ContextDialer, error)
-	// Config returns TLS configuration used to connect to Auth.
-	Config() (*tls.Config, error)
+	// TLSConfig returns TLS configuration used to connect to Auth.
+	TLSConfig() (*tls.Config, error)
+	// SSHClientConfig returns SSH configuration used to connect to Proxy through tunnel.
+	SSHClientConfig() (*ssh.ClientConfig, error)
 }
 
 // LoadTLS is used to load credentials directly from another *tls.Config.
@@ -52,11 +56,19 @@ func (c *TLSConfigCreds) Dialer() (ContextDialer, error) {
 	return nil, trace.NotImplemented("no dialer")
 }
 
-// Config returns TLS configuration used to connect to Auth.
-func (c *TLSConfigCreds) Config() (*tls.Config, error) {
+// TLSConfig returns TLS configuration used to connect to Auth.
+func (c *TLSConfigCreds) TLSConfig() (*tls.Config, error) {
+	if c.tlsConfig == nil {
+		return nil, trace.BadParameter("tls config is nil")
+	}
 	return configure(c.tlsConfig), nil
 }
 
+// SSHClientConfig returns SSH configuration used to connect to Proxy.
+func (c *TLSConfigCreds) SSHClientConfig() (*ssh.ClientConfig, error) {
+	return nil, trace.NotImplemented("no ssh config")
+}
+
 // LoadKeyPair is used to load credentials from files on disk.
 func LoadKeyPair(certFile string, keyFile string, caFile string) *KeyPairCreds {
 	return &KeyPairCreds{
@@ -79,8 +91,8 @@ func (c *KeyPairCreds) Dialer() (ContextDialer, error) {
 	return nil, trace.NotImplemented("no dialer")
 }
 
-// Config returns TLS configuration used to connect to Auth.
-func (c *KeyPairCreds) Config() (*tls.Config, error) {
+// TLSConfig returns TLS configuration used to connect to Auth.
+func (c *KeyPairCreds) TLSConfig() (*tls.Config, error) {
 	cert, err := tls.LoadX509KeyPair(c.certFile, c.keyFile)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -102,6 +114,11 @@ func (c *KeyPairCreds) Config() (*tls.Config, error) {
 	}), nil
 }
 
+// SSHClientConfig returns SSH configuration used to connect to Proxy.
+func (c *KeyPairCreds) SSHClientConfig() (*ssh.ClientConfig, error) {
+	return nil, trace.NotImplemented("no ssh config")
+}
+
 // LoadIdentityFile is used to load credentials from an identity file on disk.
 func LoadIdentityFile(path string) *IdentityCreds {
 	return &IdentityCreds{
@@ -112,29 +129,54 @@ func LoadIdentityFile(path string) *IdentityCreds {
 // IdentityCreds are used to authenticate the client
 // with an identity file generated in the given file path.
 type IdentityCreds struct {
-	path string
+	path         string
+	identityFile *IdentityFile
 }
 
 // Dialer is used to dial a connection to Auth.
 func (c *IdentityCreds) Dialer() (ContextDialer, error) {
 	return nil, trace.NotImplemented("no dialer")
 }
 
-// Config returns TLS configuration used to connect to Auth.
-func (c *IdentityCreds) Config() (*tls.Config, error) {
-	identityFile, err := ReadIdentityFile(c.path)
-	if err != nil {
-		return nil, trace.BadParameter("identity file could not be decoded: %v", err)
+// TLSConfig returns TLS configuration used to connect to Auth.
+func (c *IdentityCreds) TLSConfig() (*tls.Config, error) {
+	if err := c.load(); err != nil {
+		return nil, trace.Wrap(err)
 	}
 
-	tlsConfig, err := identityFile.TLS()
+	tlsConfig, err := c.identityFile.TLSConfig()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	return configure(tlsConfig), nil
 }
 
+// SSHClientConfig returns SSH configuration used to connect to Proxy.
+func (c *IdentityCreds) SSHClientConfig() (*ssh.ClientConfig, error) {
+	if err := c.load(); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	sshConfig, err := c.identityFile.SSHClientConfig()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return sshConfig, nil
+}
+
+func (c *IdentityCreds) load() error {
+	if c.identityFile != nil {
+		return nil
+	}
+	var err error
+	if c.identityFile, err = ReadIdentityFile(c.path); err != nil {
+		return trace.BadParameter("identity file could not be decoded: %v", err)
+	}
+	return nil
+}
+
 func configure(c *tls.Config) *tls.Config {
 	tlsConfig := c.Clone()