tsh does not appear to respect HTTPS_PROXY

[russjones]

No description provided.

[russjones]

@stevenGravy Can you provide reproduction steps?

[stevenGravy]

@programmerq has a detailed example here https://gist.github.com/programmerq/d053ae8acde4c7e467b44a32817750ef

[evilmog]

Confirmed TELEPORT is not honouring HTTPS_PROXY, this is causing some operational problems

[zmb3]

@r0mant is there anything left to be done for HTTPS_PROXY?

[zmb3]

My understanding is that this was supposed to be fixed by #10209, but I just tried Jeff's example from above on 12.0.2 and noticed an issue.

When I don't specify the proxy port, tsh's attempts to guess the port seem to bypass the proxy handling code:

[root@680588a42d63 ~]# tsh -d login --user admin --proxy teleport --insecure
DEBU [TSH]       Web proxy port was not set. Attempting to detect port number to use. tsh/tsh.go:3543
DEBU [TSH]       Resolving default proxy port (insecure: true) tsh/resolve_default_addr.go:110
DEBU [TSH]       Trying teleport:3080... tsh/resolve_default_addr.go:98
DEBU [TSH]       Trying teleport:443... tsh/resolve_default_addr.go:98
DEBU [TSH]       Proxy address test failed error:[Get "https://teleport:3080/webapi/ping": context deadline exceeded] tsh/resolve_default_addr.go:62
DEBU [TSH]       Waiting for all in-flight proxy address tests to finish tsh/resolve_default_addr.go:136
DEBU [TSH]       Proxy address test failed error:[Get "https://teleport:443/webapi/ping": context deadline exceeded] tsh/resolve_default_addr.go:62

ERROR REPORT:
Original Error: context.deadlineExceededError context deadline exceeded
Stack Trace:
	github.com/gravitational/teleport/tool/tsh/tsh.go:3550 main.setClientWebProxyAddr
	github.com/gravitational/teleport/tool/tsh/tsh.go:3224 main.makeClientForProxy
	github.com/gravitational/teleport/tool/tsh/tsh.go:3116 main.makeClient
	github.com/gravitational/teleport/tool/tsh/tsh.go:1496 main.onLogin
	github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run
	github.com/gravitational/teleport/tool/tsh/tsh.go:480 main.main
	runtime/proc.go:250 runtime.main
	runtime/asm_arm64.s:1172 runtime.goexit
User Message: context deadline exceeded

When I do specify the port, I am able to log in via the proxy:

[root@680588a42d63 ~]# tsh -d login --user admin --proxy teleport:3080 --insecure
INFO [CLIENT]    no host login given. defaulting to root client/api.go:945
ERRO [CLIENT]    [KEY AGENT] Unable to connect to SSH agent on socket: "". client/api.go:3870
DEBU [TSH]       Pinging the proxy to fetch listening addresses for non-web ports. tsh/tsh.go:3378
DEBU [CLIENT]    not using loopback pool for remote proxy addr: teleport:3080 client/api.go:3829
DEBU             Attempting GET teleport:3080/webapi/ping webclient/webclient.go:129
DEBU [CLIENT]    Attempting to login with a new RSA private key. client/api.go:3254
Enter password for Teleport user admin:
DEBU [CLIENT]    not using loopback pool for remote proxy addr: teleport:3080 client/api.go:3829
DEBU [CLIENT]    HTTPS client init(proxyAddr=teleport:3080, insecure=true, extraHeaders=map[]) client/weblogin.go:259
WARNING: You are using insecure connection to Teleport proxy https://teleport:3080

@atburke is this the behavior you'd expect?

[evilmog]

the problem isn't clients logging in to a system, its teleport agents calling out to teleport proxy servers, we often deploy systems into client environments where the only way out is a proxy and teleport won't honour the clients proxy settings

…

On Mon, Feb 20, 2023 at 11:19 AM Zac Bergquist ***@***.***> wrote: My understanding is that this was supposed to be fixed by #10209 <#10209>, but I just tried Jeff's example from above on 12.0.2 and it's not working. ***@***.*** ~]# tsh -d login --user admin --proxy teleport --insecure DEBU [TSH] Web proxy port was not set. Attempting to detect port number to use. tsh/tsh.go:3543 DEBU [TSH] Resolving default proxy port (insecure: true) tsh/resolve_default_addr.go:110 DEBU [TSH] Trying teleport:3080... tsh/resolve_default_addr.go:98 DEBU [TSH] Trying teleport:443... tsh/resolve_default_addr.go:98 DEBU [TSH] Proxy address test failed error:[Get "https://teleport:3080/webapi/ping": context deadline exceeded] tsh/resolve_default_addr.go:62 DEBU [TSH] Waiting for all in-flight proxy address tests to finish tsh/resolve_default_addr.go:136 DEBU [TSH] Proxy address test failed error:[Get "https://teleport:443/webapi/ping": context deadline exceeded] tsh/resolve_default_addr.go:62 ERROR REPORT: Original Error: context.deadlineExceededError context deadline exceeded Stack Trace: github.com/gravitational/teleport/tool/tsh/tsh.go:3550 main.setClientWebProxyAddr github.com/gravitational/teleport/tool/tsh/tsh.go:3224 main.makeClientForProxy github.com/gravitational/teleport/tool/tsh/tsh.go:3116 main.makeClient github.com/gravitational/teleport/tool/tsh/tsh.go:1496 main.onLogin github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run github.com/gravitational/teleport/tool/tsh/tsh.go:480 main.main runtime/proc.go:250 runtime.main runtime/asm_arm64.s:1172 runtime.goexit User Message: context deadline exceeded — Reply to this email directly, view it on GitHub <#9072 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAZBQUXTI2O4XYMRFRDEZW3WYOKRNANCNFSM5ILBETZQ> . You are receiving this because you commented.Message ID: ***@***.***>

[zmb3]

This particular issue is specifically about tsh.

[evilmog]

When I cut my original ticket it was about the teleport agent and then my request was closed and merged in with this one. I have an enterprise support agreement. It has taken over a year to get this reply.

…

On Mon, Feb 20, 2023 at 1:33 PM Zac Bergquist ***@***.***> wrote: This particular issue is specifically about tsh. — Reply to this email directly, view it on GitHub <#9072 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAZBQUSSJLSDBTXNHMNPLFTWYO2ITANCNFSM5ILBETZQ> . You are receiving this because you commented.Message ID: ***@***.***>

[russjones]

@evilmog We're looking into it right now, we'll update you soon.

cc @r0mant

[atburke]

@zmb3 The port guessing issue you found is a bug. #22161 should fix it.