683cc2fd4a
Cleanup and minor refactor make readability easier
2024-05-12 09:14:12 -04:00
d4f86ac26d
Cleanup
2024-05-10 16:16:18 -04:00
df3ef06169
Support ingress rule matching for bastion mode
2024-05-10 16:07:03 -04:00
b9898a9fbe
TUN-8331: Add unit testing for AccessJWTValidator middleware
2024-04-11 12:25:24 -07:00
b5be8a6fa4
feat: auto tls sni
...
Signed-off-by: Steven Kreitzer <skre@skre.me>
2024-04-02 14:56:44 -07:00
b723a1a426
Merge pull request #1130 from crrodriguez/checkInPingGroupBugs
...
fix checkInPingGroup bugs
2024-04-02 10:24:51 -05:00
76badfa01b
TUN-8236: Add write timeout to quic and tcp connections
...
## Summary
To prevent bad eyeballs and severs to be able to exhaust the quic
control flows we are adding the possibility of having a timeout
for a write operation to be acknowledged. This will prevent hanging
connections from exhausting the quic control flows, creating a DDoS.
2024-02-15 17:54:52 +00:00
9c1f5c33a8
TUN-8158: Bring back commit e653741885 and fixes infinite loop on linux when the socket is closed
2024-01-22 13:46:33 +00:00
2c38487a54
Revert "TUN-8158: Add logging to confirm when ICMP reply is returned to the edge"
...
This reverts commit e653741885
2024-01-19 19:37:28 +00:00
e653741885
TUN-8158: Add logging to confirm when ICMP reply is returned to the edge
2024-01-16 15:56:24 +00:00
fbe357b1e6
fix checkInPingGroup bugs
...
- Must check for the *effective* GID.
- Must allow range from 0 to 4294967294 in current kernels.
2023-12-24 14:04:55 -03:00
f2c4fdb0ae
Fix nil pointer dereference segfault when passing "null" config json to cloudflared tunnel ingress validate ( #1070 )
2023-12-14 16:29:40 +00:00
fc0ecf4185
TUN-7776: Remove warp-routing flag from cloudflared
2023-09-18 10:02:56 +01:00
b500e556bf
TUN-7590: Remove usages of ioutil
2023-07-17 19:08:38 +00:00
729890d847
TUN-6011: Remove docker networks from ICMP Proxy test
2023-06-27 17:33:18 +01:00
925ec100d6
TUN-7463: Add default ingress rule if no ingress rules are provided when updating the configuration
2023-06-12 15:11:42 +01:00
5d0bb25572
TUN-7354: Don't warn for empty ingress rules when using --token
2023-04-10 22:12:40 +00:00
be64362fdb
TUN-7124: Add intercept ingress rule for management requests
2023-03-21 11:42:25 -07:00
1742379ba4
TUN-7271: Return 503 status code when no ingress rules configured
2023-03-13 09:25:34 +00:00
53fb50960d
TUN-7272: Fix cloudflared returning non supported status service which breaks configuration migration
2023-03-10 10:42:37 +00:00
7b8b3f73e7
TUN-7259: Add warning for missing ingress rules
...
Providing no ingress rules in the configuration file or via the CLI will now provide a warning and return 502 for all incoming HTTP requests.
2023-03-10 01:49:54 +00:00
93f8f6b55c
TUN-7245: Add bastion flag to origin service check
2023-03-09 17:09:21 +00:00
ae46af9236
TUN-7065: Remove classic tunnel creation
2023-02-06 18:19:22 +00:00
62dcb8a1d1
Revert "TUN-7065: Remove classic tunnel creation"
...
This reverts commit c24f275981
2023-02-01 14:01:59 +00:00
c24f275981
TUN-7065: Remove classic tunnel creation
2023-01-31 22:35:28 +00:00
887e486a63
TUN-7057: Remove dependency github.com/gorilla/mux
2022-12-24 21:05:51 -07:00
e3d35570e6
CUSTESC-23757: Fix a bug where a wildcard ingress rule would match an host without starting with a dot
2022-11-25 17:00:59 +00:00
85b44695f0
TUN-6941: Reduce log level to debug when failing to proxy ICMP reply
2022-11-14 11:22:38 +00:00
6a1dad0ce2
ZTC-234: macOS tests
2022-11-11 19:43:26 +00:00
2baea15387
ZTC-234: Replace ICMP funnels when ingress connection changes
...
Origintunneld has been observed to continue sending reply packets to the first incoming connection it received, even if a newer connection is observed to be sending the requests.
OTD uses the funnel library from cloudflared, which is why the changes are here.
In theory, cloudflared has the same type of bug where a ping session switching between quic connections will continue sending replies to the first connection. This bug has not been tested or confirmed though, but this PR will fix if it exists.
2022-11-11 19:43:26 +00:00
a1d88a6cdd
TUN-6927: Refactor validate access configuration to allow empty audTags only
2022-11-09 12:28:58 +00:00
515ad7cbee
TUN-6917: Bump go to 1.19.3
2022-11-07 09:19:19 -08:00
dde83d5a7c
TUN-6898: Refactor addPortIfMissing
2022-10-28 15:48:10 +01:00
e14238224d
TUN-6898: Fix bug handling IPv6 based ingresses with missing port
2022-10-28 12:47:59 +01:00
c3c050aa79
TUN-6867: Clear spans right after they are serialized to avoid returning duplicate spans
2022-10-19 16:20:40 +01:00
b1de2a74fa
TUN-6876: Fix flaky TestTraceICMPRouterEcho by taking account request span can return before reply
2022-10-19 15:01:24 +01:00
e9d07e35c7
TUN-6861: Trace ICMP on Windows
2022-10-18 09:57:19 +01:00
2d5234e021
TUN-6858: Trace ICMP reply
2022-10-18 09:51:57 +01:00
b6bd8c1f5e
TUN-6604: Trace icmp echo request on Linux and Darwin
2022-10-17 20:01:05 +01:00
495f9fb8bd
TUN-6856: Refactor to lay foundation for tracing ICMP
...
Remove send and return methods from Funnel interface. Users of Funnel can provide their own send and return methods without wrapper to comply with the interface.
Move packet router to ingress package to avoid circular dependency
2022-10-17 19:48:35 +01:00
61007dd2dd
TUN-6860: Send access configuration keys to the edge
2022-10-16 17:10:09 +00:00
cbf8c71fab
TUN-6716: Document limitation of Windows ICMP proxy
2022-09-29 14:51:53 +01:00
870193c064
TUN-6811: Ping group range should be parsed as int32
2022-09-29 12:59:38 +01:00
fdddd86380
TUN-6715: Provide suggestion to add cloudflared to ping_group_range if it failed to open ICMP socket
2022-09-28 17:30:13 +01:00
b3e26420c0
TUN-6801: Add punycode alternatives for ingress rules
2022-09-26 17:59:45 +00:00
be0305ec58
TUN-6741: ICMP proxy tries to listen on specific IPv4 & IPv6 when possible
...
If it cannot determine the correct interface IP, it will fallback to all interfaces.
This commit also introduces the icmpv4-src and icmpv6-src flags
2022-09-26 11:37:08 +01:00
3449ea35f2
TUN-6791: Calculate ICMPv6 checksum
2022-09-22 15:18:53 +00:00
7f487c2651
TUN-6775: Add middleware.Handler verification to ProxyHTTP
...
ProxyHTTP now processes middleware Handler before executing the request.
A chain of handlers is now executed and appropriate response status
codes are sent.
2022-09-22 15:11:59 +01:00
9bb7628fbc
TUN-6772: Add a JWT Validator as an ingress verifier
...
This adds a new verifier interface that can be attached to ingress.Rule.
This would act as a middleware layer that gets executed at the start of
proxy.ProxyHTTP.
A jwt validator implementation for this verifier is also provided. The
validator downloads the public key from the access teams endpoint and
uses it to verify the JWT sent to cloudflared with the audtag (clientID)
information provided in the config.
2022-09-22 14:44:03 +01:00
eb36716ba4
TUN-6774: Validate OriginRequest.Access to add Ingress.Middleware
...
We take advantage of the JWTValidator middleware and attach it to an
ingress rule based on Access configurations. We attach the Validator
directly to the ingress rules because we want to take advantage of
caching and token revert/handling that comes with go-oidc.
2022-09-22 14:44:03 +01:00
Shayon Mukherjee
Devin Carr
Steven Kreitzer
chungthuang
João "Pisco" Fernandes
chungthuang
Cristian Rodríguez
Sam Cook
João Oliveirinha
Sudarsan Reddy
Joel May