[v9] Add validation for hostname read from EC2

lib/service/service.go

@@ -795,9 +795,14 @@ func NewTeleport(cfg *Config, opts ...NewTeleportOption) (*TeleportProcess, erro
 	if imClient.IsAvailable(supervisor.ExitContext()) {
 		ec2Hostname, err := imClient.GetTagValue(supervisor.ExitContext(), types.EC2HostnameTag)
 		if err == nil {
-			if ec2Hostname != "" {
+			ec2Hostname = strings.ReplaceAll(ec2Hostname, " ", "_")
+			if utils.IsValidHostname(ec2Hostname) {
 				cfg.Log.Infof("Found %q tag in EC2 instance. Using %q as hostname.", types.EC2HostnameTag, ec2Hostname)
 				cfg.Hostname = ec2Hostname
+
+				// ec2Hostname exists but is not a valid hostname.
+			} else if ec2Hostname != "" {
+				cfg.Log.Infof("Found %q tag in EC2 instance, but %q is not a valid hostname.", types.EC2HostnameTag, ec2Hostname)
 			}
 		} else if !trace.IsNotFound(err) {
 			cfg.Log.Errorf("Unexpected error while looking for EC2 hostname: %v", err)

lib/utils/utils.go

@@ -39,6 +39,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/modules"
+	"k8s.io/apimachinery/pkg/util/validation"
 
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
@@ -313,6 +314,16 @@ func SplitHostPort(hostname string) (string, string, error) {
 	return host, port, nil
 }
 
+// IsValidHostname checks if a string represents a valid hostname.
+func IsValidHostname(hostname string) bool {
+	for _, label := range strings.Split(hostname, ".") {
+		if len(validation.IsDNS1035Label(label)) > 0 {
+			return false
+		}
+	}
+	return true
+}
+
 // ReadPath reads file contents
 func ReadPath(path string) ([]byte, error) {
 	if path == "" {

lib/utils/utils_test.go

@@ -296,6 +296,56 @@ func TestGlobToRegexp(t *testing.T) {
 	}
 }
 
+func TestIsValidHostname(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		hostname string
+		assert   require.BoolAssertionFunc
+	}{
+		{
+			name:     "normal hostname",
+			hostname: "some-host-1.example.com",
+			assert:   require.True,
+		},
+		{
+			name:     "one component",
+			hostname: "example",
+			assert:   require.True,
+		},
+		{
+			name:     "empty",
+			hostname: "",
+			assert:   require.False,
+		},
+		{
+			name:     "invalid characters",
+			hostname: "some spaces.example.com",
+			assert:   require.False,
+		},
+		{
+			name:     "empty label",
+			hostname: "somewhere..example.com",
+			assert:   require.False,
+		},
+		{
+			name:     "label too long",
+			hostname: strings.Repeat("x", 64) + ".example.com",
+			assert:   require.False,
+		},
+		{
+			name:     "hostname too long",
+			hostname: strings.Repeat("x.", 256) + ".example.com",
+			assert:   require.False,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			tc.assert(t, IsValidHostname(tc.hostname))
+		})
+	}
+}
+
 // TestReplaceRegexp tests regexp-style replacement of values
 func TestReplaceRegexp(t *testing.T) {
 	t.Parallel()