[vnet] linux support draft

lib/vnet/admin_process_linux.go

@@ -0,0 +1,127 @@
+// Teleport
+// Copyright (C) 2024 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package vnet
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/sync/errgroup"
+	"golang.zx2c4.com/wireguard/tun"
+
+	vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1"
+)
+
+type LinuxAdminProcessConfig struct {
+	ClientApplicationServiceAddr string
+	ServiceCredentialPath        string
+}
+
+// RunLinuxAdminProcess must run as root.
+func RunLinuxAdminProcess(ctx context.Context, config LinuxAdminProcessConfig) error {
+	log.InfoContext(ctx, "Running VNet admin process")
+
+	serviceCreds, err := readCredentials(config.ServiceCredentialPath)
+	if err != nil {
+		return trace.Wrap(err, "reading service IPC credentials")
+	}
+	clt, err := newClientApplicationServiceClient(ctx, serviceCreds, config.ClientApplicationServiceAddr)
+	if err != nil {
+		return trace.Wrap(err, "creating user process client")
+	}
+	defer clt.close()
+
+	tun, err := tun.CreateTUN("TeleportVNet", mtu)
+	if err != nil {
+		return trace.Wrap(err, "creating TUN device")
+	}
+	defer tun.Close()
+	tunName, err := tun.Name()
+	if err != nil {
+		return trace.Wrap(err, "getting TUN device name")
+	}
+
+	networkStackConfig, err := newNetworkStackConfig(ctx, tun, clt)
+	if err != nil {
+		return trace.Wrap(err, "creating network stack config")
+	}
+	networkStack, err := newNetworkStack(networkStackConfig)
+	if err != nil {
+		return trace.Wrap(err, "creating network stack")
+	}
+
+	if err := clt.ReportNetworkStackInfo(ctx, &vnetv1.NetworkStackInfo{
+		InterfaceName: tunName,
+		Ipv6Prefix:    networkStackConfig.ipv6Prefix.String(),
+	}); err != nil {
+		return trace.Wrap(err, "reporting network stack info to client application")
+	}
+
+	osConfigProvider, err := newRemoteOSConfigProvider(
+		clt,
+		tunName,
+		networkStackConfig.ipv6Prefix.String(),
+		networkStackConfig.dnsIPv6.String(),
+	)
+	if err != nil {
+		return trace.Wrap(err, "creating OS config provider")
+	}
+	osConfigurator := newOSConfigurator(osConfigProvider)
+
+	g, ctx := errgroup.WithContext(ctx)
+	g.Go(func() error {
+		if err := networkStack.run(ctx); err != nil {
+			return trace.Wrap(err, "running network stack")
+		}
+		return errors.New("network stack terminated")
+	})
+	g.Go(func() error {
+		if err := osConfigurator.runOSConfigurationLoop(ctx); err != nil {
+			return trace.Wrap(err, "running OS configuration loop")
+		}
+		return errors.New("OS configuration loop terminated")
+	})
+	g.Go(func() error {
+		tick := time.Tick(time.Second)
+		for {
+			select {
+			case <-tick:
+				if err := clt.Ping(ctx); err != nil {
+					return trace.Wrap(err, "failed to ping client application, it may have exited, shutting down")
+				}
+			case <-ctx.Done():
+				return ctx.Err()
+			}
+		}
+	})
+	return trace.Wrap(g.Wait(), "running VNet admin process")
+}
+
+func createTUNDevice(ctx context.Context) (tun.Device, string, error) {
+	log.DebugContext(ctx, "Creating TUN device.")
+	dev, err := tun.CreateTUN("utun", mtu)
+	if err != nil {
+		return nil, "", trace.Wrap(err, "creating TUN device")
+	}
+	name, err := dev.Name()
+	if err != nil {
+		return nil, "", trace.Wrap(err, "getting TUN device name")
+	}
+	return dev, name, nil
+}

lib/vnet/diag/routeconflict_other.go

@@ -25,6 +25,8 @@ import (
 	"github.com/gravitational/trace"
 )
 
+// TODO: linux diagnostics
+
 func (n *NetInterfaces) interfaceApp(ctx context.Context, ifaceName string) (string, error) {
 	return "", trace.NotImplemented("InterfaceApp is not implemented")
 }

lib/vnet/dns/osnameservers.go

@@ -24,36 +24,48 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/slices"
 )
 
 // OSUpstreamNameserverSource provides the list of upstream DNS nameservers
 // configured in the OS. The VNet DNS resolver will forward unhandles queries to
 // these nameservers.
 type OSUpstreamNameserverSource struct {
-	ttlCache *utils.FnCache
+	ttlCache  *utils.FnCache
+	localAddr netip.Addr
 }
 
 // NewOSUpstreamNameserverSource returns a new *OSUpstreamNameserverSource.
-func NewOSUpstreamNameserverSource() (*OSUpstreamNameserverSource, error) {
+func NewOSUpstreamNameserverSource(localAddr netip.Addr) (*OSUpstreamNameserverSource, error) {
 	ttlCache, err := utils.NewFnCache(utils.FnCacheConfig{
 		TTL: 10 * time.Second,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return &OSUpstreamNameserverSource{
-		ttlCache: ttlCache,
+		ttlCache:  ttlCache,
+		localAddr: localAddr,
 	}, nil
 }
 
 // UpstreamNameservers returns a cached view of the host OS's current default
 // nameservers.
 func (s *OSUpstreamNameserverSource) UpstreamNameservers(ctx context.Context) ([]string, error) {
-	return utils.FnCacheGet(ctx, s.ttlCache, 0, loadUpstreamNameservers)
+	return utils.FnCacheGet(ctx, s.ttlCache, 0, s.loadUpstreamNameservers)
 }
 
-func loadUpstreamNameservers(ctx context.Context) ([]string, error) {
-	return platformLoadUpstreamNameservers(ctx)
+func (s *OSUpstreamNameserverSource) loadUpstreamNameservers(ctx context.Context) ([]string, error) {
+	allNameservers, err := platformLoadUpstreamNameservers(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return slices.FilterMapUnique(allNameservers, func(addr netip.Addr) (string, bool) {
+		if addr.Compare(s.localAddr) == 0 {
+			return "", false
+		}
+		return withDNSPort(addr), true
+	}), nil
 }
 
 func withDNSPort(addr netip.Addr) string {

lib/vnet/dns/osnameservers_other.go

@@ -14,12 +14,13 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-//go:build !darwin && !windows
+//go:build !darwin && !windows && !linux
 
 package dns
 
 import (
 	"context"
+	"net/netip"
 	"runtime"
 
 	"github.com/gravitational/trace"
@@ -33,6 +34,6 @@ var (
 	_ = withDNSPort
 )
 
-func platformLoadUpstreamNameservers(ctx context.Context) ([]string, error) {
+func platformLoadUpstreamNameservers(ctx context.Context) ([]netip.Addr, error) {
 	return nil, trace.Wrap(vnetNotImplemented)
 }

lib/vnet/dns/osnameservers_darwin.go → lib/vnet/dns/osnameservers_unix.go

@@ -14,6 +14,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+//go:build linux || darwin
+
 package dns
 
 import (
@@ -22,29 +24,40 @@ import (
 	"log/slog"
 	"net/netip"
 	"os"
+	"runtime"
 	"strings"
 
 	"github.com/gravitational/trace"
 )
 
-const (
-	confFilePath = "/etc/resolv.conf"
-)
-
 // platformLoadUpstreamNameservers reads the OS DNS nameservers found in
 // /etc/resolv.conf. The comments in that file make it clear it is not actually
 // consulted for DNS hostname resolution, but MacOS seems to keep it up to date
 // with the current default nameservers as configured for the OS, and it is the
 // easiest place to read them. Eventually we should probably use a better
 // method, but for now this works.
-func platformLoadUpstreamNameservers(ctx context.Context) ([]string, error) {
+func platformLoadUpstreamNameservers(ctx context.Context) ([]netip.Addr, error) {
+	// TODO: this is very hacky and just happens to work on the EC2 I've been
+	// testing on, figure out a good way to find upstream nameservers on Linux
+	// or a better way of resolving queries VNet can't handle (names in custom
+	// DNS zones that don't match a teleport app may resolve to some other
+	// company internal app outside of VNet/Teleport).
+	var confFilePath string
+	switch runtime.GOOS {
+	case "darwin":
+		confFilePath = "/etc/resolv.conf"
+	case "linux":
+		confFilePath = "/run/systemd/resolve/resolv.conf"
+	default:
+		return nil, trace.NotImplemented("unsupported os %s", runtime.GOOS)
+	}
 	f, err := os.Open(confFilePath)
 	if err != nil {
 		return nil, trace.Wrap(err, "opening %s", confFilePath)
 	}
 	defer f.Close()
 
-	var nameservers []string
+	var nameservers []netip.Addr
 	scanner := bufio.NewScanner(f)
 	for scanner.Scan() {
 		line := scanner.Text()
@@ -63,7 +76,7 @@ func platformLoadUpstreamNameservers(ctx context.Context) ([]string, error) {
 			continue
 		}
 
-		nameservers = append(nameservers, withDNSPort(ip))
+		nameservers = append(nameservers, ip)
 	}
 
 	slog.DebugContext(ctx, "Loaded host upstream nameservers.", "nameservers", nameservers, "config_file", confFilePath)

lib/vnet/dns/osnameservers_windows.go

@@ -30,15 +30,15 @@ import (
 // platformLoadUpstreamNameservers attempts to find the default DNS nameservers
 // that VNet should forward unmatched queries to. To do this, it finds the
 // nameservers configured for each interface and sorts by the interface metric.
-func platformLoadUpstreamNameservers(ctx context.Context) ([]string, error) {
+func platformLoadUpstreamNameservers(ctx context.Context) ([]netip.Addr, error) {
 	interfaces, err := winipcfg.GetIPInterfaceTable(windows.AF_INET)
 	if err != nil {
 		return nil, trace.Wrap(err, "looking up local network interfaces")
 	}
 	sort.Slice(interfaces, func(i, j int) bool {
 		return interfaces[i].Metric < interfaces[j].Metric
 	})
-	var nameservers []string
+	var nameservers []netip.Addr
 	for _, iface := range interfaces {
 		ifaceNameservers, err := iface.InterfaceLUID.DNS()
 		if err != nil {
@@ -48,7 +48,7 @@ func platformLoadUpstreamNameservers(ctx context.Context) ([]string, error) {
 			if ignoreUpstreamNameserver(ifaceNameserver) {
 				continue
 			}
-			nameservers = append(nameservers, withDNSPort(ifaceNameserver))
+			nameservers = append(nameservers, ifaceNameserver)
 		}
 	}
 	slog.DebugContext(ctx, "Loaded host upstream nameservers", "nameservers", nameservers)

lib/vnet/escalate_linux.go

@@ -0,0 +1,32 @@
+package vnet
+
+import (
+	"context"
+	"os"
+	"os/exec"
+
+	"github.com/gravitational/trace"
+)
+
+func execAdminProcess(ctx context.Context, cfg LinuxAdminProcessConfig) error {
+	executableName, err := os.Executable()
+	if err != nil {
+		return trace.Wrap(err, "getting executable path")
+	}
+
+	// TODO: find a proper way to start the service without just running sudo
+	// and hoping there's no password requirement...
+	//
+	// Also need to figure out how we want to set up a service that runs as root
+	// that can be started from Connect, maybe some systemd service but that
+	// doesn't solve how we allow the service to be started.
+	cmd := exec.CommandContext(ctx, "sudo", executableName, "-d",
+		"vnet-service",
+		"--addr", cfg.ClientApplicationServiceAddr,
+		"--cred-path", cfg.ServiceCredentialPath,
+	)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	log.DebugContext(ctx, "Escalating to root with sudo")
+	return trace.Wrap(cmd.Run(), "escalating to root with sudo")
+}

lib/vnet/network_stack.go

@@ -21,6 +21,7 @@ import (
 	"errors"
 	"log/slog"
 	"net"
+	"net/netip"
 	"os"
 	"sync"
 
@@ -242,7 +243,11 @@ func newNetworkStack(cfg *networkStackConfig) (*networkStack, error) {
 	if cfg.dnsIPv6 != (tcpip.Address{}) {
 		upstreamNameserverSource := cfg.upstreamNameserverSource
 		if upstreamNameserverSource == nil {
-			upstreamNameserverSource, err = dns.NewOSUpstreamNameserverSource()
+			localAddr, ok := netip.AddrFromSlice(cfg.dnsIPv6.AsSlice())
+			if !ok {
+				return nil, trace.Errorf("failed to config tcpip.Addr to netip.Addr: %s", cfg.dnsIPv6.String())
+			}
+			upstreamNameserverSource, err = dns.NewOSUpstreamNameserverSource(localAddr)
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}