s1d3sw1ped/teleport
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Default local listeners to 127.0.0.1
CI / check-and-test (pull_request) Successful in 11s
Details

Browse Source 
Client TCP/UDP and the built-in DNS server bind loopback unless bind_address or a per-rule host (tcp://22:0.0.0.0:2222) is set. README and generated server examples no longer document :9000/:8080 as if they were localhost-only.

Closes #3
This commit is contained in:
s1d3sw1ped_bot
2026-09-01 04:10:14 +00:00
parent 283781fd47
commit c20398642d
5 changed files with 393 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/config/config_test.go
+224
View File
@@ -1,6 +1,7 @@
package config
import (
"net"
"os"
"path/filepath"
"strings"
@@ -135,6 +136,14 @@ encryption_key: a0e3dd20a761b118ca234160dd8b87230a001e332a97c9cfe3b8b9c99efaae03
if config.DNSServer.BackupServer != "8.8.8.8:53" {
t.Errorf("Expected default backup server '8.8.8.8:53', got '%s'", config.DNSServer.BackupServer)
}
if config.BindAddress != DefaultBindAddress {
t.Errorf("Expected default BindAddress %q, got %q", DefaultBindAddress, config.BindAddress)
}
if config.DNSServer.BindAddress != DefaultBindAddress {
t.Errorf("Expected default DNS BindAddress %q, got %q", DefaultBindAddress, config.DNSServer.BindAddress)
}
}
func TestDetectMode(t *testing.T) {
@@ -361,3 +370,218 @@ encryption_key: test-key
t.Errorf("Expected error message to mention 'protocol://', got: %v", err)
}
}
func TestDefaultLocalListenAddrIsLoopback(t *testing.T) {
if got := LocalListenAddr("", 9000); got != "127.0.0.1:9000" {
t.Fatalf("empty host: got %q want 127.0.0.1:9000", got)
}
if got := LocalListenAddr("127.0.0.1", 2222); got != "127.0.0.1:2222" {
t.Fatalf("loopback host: got %q", got)
}
cfg := &Config{}
tcpRule := PortRule{LocalPort: 8080, RemotePort: 80, Protocol: "tcp"}
udpRule := PortRule{LocalPort: 5353, RemotePort: 53, Protocol: "udp"}
if got := cfg.ClientListenAddr(tcpRule); got != "127.0.0.1:8080" {
t.Fatalf("default TCP listen: got %q want 127.0.0.1:8080", got)
}
if got := cfg.ClientListenAddr(udpRule); got != "127.0.0.1:5353" {
t.Fatalf("default UDP listen: got %q want 127.0.0.1:5353", got)
}
dnsCfg := DNSServerConfig{ListenPort: 5353}
if got := dnsCfg.ListenAddr(); got != "127.0.0.1:5353" {
t.Fatalf("default DNS listen: got %q want 127.0.0.1:5353", got)
}
}
func TestExplicitBindAddressOverride(t *testing.T) {
if got := LocalListenAddr("0.0.0.0", 9000); got != "0.0.0.0:9000" {
t.Fatalf("0.0.0.0 override: got %q", got)
}
cfg := &Config{BindAddress: "0.0.0.0"}
rule := PortRule{LocalPort: 2222, RemotePort: 22, Protocol: "tcp"}
if got := cfg.ClientListenAddr(rule); got != "0.0.0.0:2222" {
t.Fatalf("global bind_address 0.0.0.0: got %q", got)
}
rule.BindAddress = "10.0.0.5"
if got := cfg.ClientListenAddr(rule); got != "10.0.0.5:2222" {
t.Fatalf("per-rule host should win: got %q", got)
}
dnsCfg := DNSServerConfig{ListenPort: 5353, BindAddress: "0.0.0.0"}
if got := dnsCfg.ListenAddr(); got != "0.0.0.0:5353" {
t.Fatalf("DNS bind_address 0.0.0.0: got %q", got)
}
}
func TestLocalListenAddrBinds(t *testing.T) {
ln, err := net.Listen("tcp", LocalListenAddr("", 0))
if err != nil {
t.Fatalf("listen default: %v", err)
}
defer ln.Close()
ip := ln.Addr().(*net.TCPAddr).IP
if !ip.IsLoopback() {
t.Fatalf("default TCP bind is not loopback: %v", ip)
}
udpAddr, err := net.ResolveUDPAddr("udp", LocalListenAddr("", 0))
if err != nil {
t.Fatalf("resolve default udp: %v", err)
}
uc, err := net.ListenUDP("udp", udpAddr)
if err != nil {
t.Fatalf("listen default udp: %v", err)
}
defer uc.Close()
if !uc.LocalAddr().(*net.UDPAddr).IP.IsLoopback() {
t.Fatalf("default UDP bind is not loopback: %v", uc.LocalAddr())
}
all, err := net.Listen("tcp", LocalListenAddr("0.0.0.0", 0))
if err != nil {
t.Fatalf("listen 0.0.0.0: %v", err)
}
defer all.Close()
if !all.Addr().(*net.TCPAddr).IP.IsUnspecified() {
t.Fatalf("explicit 0.0.0.0 bind is not unspecified: %v", all.Addr())
}
}
func TestPortRuleBindHostFormat(t *testing.T) {
tests := []struct {
name string
config string
expected PortRule
}{
{
name: "client with loopback bind",
config: `
instance_id: test
remote_address: localhost:8080
ports:
- tcp://22:127.0.0.1:2222
encryption_key: a0e3dd20a761b118ca234160dd8b87230a001e332a97c9cfe3b8b9c99efaae03
`,
expected: PortRule{LocalPort: 2222, RemotePort: 22, Protocol: "tcp", BindAddress: "127.0.0.1"},
},
{
name: "client with all-interfaces bind",
config: `
instance_id: test
remote_address: localhost:8080
ports:
- tcp://22:0.0.0.0:2222
encryption_key: a0e3dd20a761b118ca234160dd8b87230a001e332a97c9cfe3b8b9c99efaae03
`,
expected: PortRule{LocalPort: 2222, RemotePort: 22, Protocol: "tcp", BindAddress: "0.0.0.0"},
},
{
name: "client two-part still defaults bind via config",
config: `
instance_id: test
remote_address: localhost:8080
ports:
- tcp://80:8080
encryption_key: a0e3dd20a761b118ca234160dd8b87230a001e332a97c9cfe3b8b9c99efaae03
`,
expected: PortRule{LocalPort: 8080, RemotePort: 80, Protocol: "tcp", BindAddress: ""},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
tempDir := t.TempDir()
configFile := filepath.Join(tempDir, "test-config.yaml")
if err := os.WriteFile(configFile, []byte(tt.config), 0644); err != nil {
t.Fatalf("write config: %v", err)
}
cfg, err := LoadConfig(configFile)
if err != nil {
t.Fatalf("load: %v", err)
}
if len(cfg.Ports) != 1 {
t.Fatalf("expected 1 port, got %d", len(cfg.Ports))
}
port := cfg.Ports[0]
if port.LocalPort != tt.expected.LocalPort || port.RemotePort != tt.expected.RemotePort ||
port.Protocol != tt.expected.Protocol || port.BindAddress != tt.expected.BindAddress {
t.Errorf("got %+v want %+v", port, tt.expected)
}
})
}
}
func TestLoadConfigGlobalBindAddress(t *testing.T) {
tempDir := t.TempDir()
configFile := filepath.Join(tempDir, "cfg.yaml")
content := `
instance_id: test
remote_address: localhost:8080
bind_address: 0.0.0.0
ports:
- tcp://80:8080
encryption_key: a0e3dd20a761b118ca234160dd8b87230a001e332a97c9cfe3b8b9c99efaae03
dns_server:
enabled: true
listen_port: 5353
bind_address: 0.0.0.0
backup_server: 8.8.8.8:53
`
if err := os.WriteFile(configFile, []byte(content), 0644); err != nil {
t.Fatal(err)
}
cfg, err := LoadConfig(configFile)
if err != nil {
t.Fatalf("load: %v", err)
}
if cfg.BindAddress != "0.0.0.0" {
t.Fatalf("BindAddress got %q", cfg.BindAddress)
}
if cfg.DNSServer.BindAddress != "0.0.0.0" {
t.Fatalf("DNS BindAddress got %q", cfg.DNSServer.BindAddress)
}
if got := cfg.ClientListenAddr(cfg.Ports[0]); got != "0.0.0.0:8080" {
t.Fatalf("client listen got %q", got)
}
if got := cfg.DNSServer.ListenAddr(); got != "0.0.0.0:5353" {
t.Fatalf("dns listen got %q", got)
}
}
func TestGenerateExampleConfigUsesLoopback(t *testing.T) {
tempDir := t.TempDir()
serverFile := filepath.Join(tempDir, "server.yaml")
if err := GenerateExampleConfig(serverFile); err != nil {
t.Fatal(err)
}
data, err := os.ReadFile(serverFile)
if err != nil {
t.Fatal(err)
}
body := string(data)
if strings.Contains(body, "listen_address: :8080") || strings.Contains(body, "listen_address: :9000") {
t.Fatalf("generated server config still documents all-interfaces listen: %s", body)
}
if !strings.Contains(body, "127.0.0.1:8080") {
t.Fatalf("generated server config missing loopback listen_address: %s", body)
}
clientFile := filepath.Join(tempDir, "client.yaml")
if err := GenerateExampleConfig(clientFile); err != nil {
t.Fatal(err)
}
cfg, err := LoadConfig(clientFile)
if err != nil {
t.Fatalf("reload generated client: %v", err)
}
if cfg.BindAddress != DefaultBindAddress {
t.Fatalf("generated client bind_address %q", cfg.BindAddress)
}
if got := cfg.ClientListenAddr(cfg.Ports[0]); !strings.HasPrefix(got, "127.0.0.1:") {
t.Fatalf("generated client local listen %q", got)
}
}