* fips: Switch to Go-native FIPS140 builds from boring crypto
Switch to using Go-native FIPS140 builds, using the GOFIPS140 build
environment variable, from the old boringcrypto FIPS140 build. The
latter is no longer supported now that Go supports FIPS140 builds
natively.
FIPS140 is enabled across the build when FIPS=1 is passed to `make` when
building. The main package of the binaries import the `lib/fipscheck`
package to ensure that a binary is not switched into or out of FIPS140
mode at launch time using the GODEBUG environment variable.
FIPS140 builds of OSS Teleport are not a supported configuration,
however the base of the Enterprise edition is the OSS repository, so
most of the changes are in this repository. Building OSS Teleport in
FIPS140 mode may not be complete.
* fips: Stop using fips buildbox
Stop using the fips buildbox for fips release builds, and just use the
normal centos7 buildbox. The fips buildbox sets
`GOEXPERIMENT=boringcrypto` which should no longer be set when building
with Go-native FIPS140. The fips buildbox is otherwise identical to the
non-fips buildbox.
Add ActivityCenter and SessionSummaries to the shared entitlement list and Web UI default entitlement map.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* fips: Rename IsBoringBinary to IsFIPSBuild throughout
Rename the function and method `IsBoringBinary` to `IsFIPSBuild`
throughout the code base and change references to boringcrypto to
fips140 or similar. This is part of removing boringcrypto from the
build, replacing it with Go-native FIPS140.
There are still some references to "boring":
* The PingResponse message has a field IsBoring in authservice.proto.
This cannot be changed without breaking source compatibility in api/
* The example in examples/teleport-usage has an explicit check for the
boring package to set an AWS FIPS option. This will be changed when
the actual change to Go-native FIPS is done.
* Rust references to boringsys - this is still used in Rust and will not
be changed when using Go-native FIPS.
* The actual import of boring to use it. This will be changed when using
Go-Native FIPS.
This rename is separate from the Go-native FIPS implementation so it can
be backported to keep the branches close, to avoid unnecessary
conflicts.
* fips: Add "crypto/tls/fipsonly" import for boring builds
Import the "crypto/tls/fipsonly" package when building in fips mode.
This import is also done in the Enterprise repo with some rename magic
so that the file the import is in only exists for fips builds. This was
necessary when boringcrypto was only available in a special branch of
the Go toolchain, but has not been necessary since Go 1.19 when
boringcrypto was brought into the proper toolchain.
Moving this here makes the enterprise makefile and fips build simpler.
There is no need to split this now.
The import causes TLS negotiation to reject non-FIPS140 ciphers.
---------
Co-authored-by: Cam Hutchison <camh@xdna.net>
* Update suggested reviewers to include owners of JIT access lists
* Replace undefined with empty array so data serialises without error
* Use consistent proto naming
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Remove unused req return value from reviewer list function
* Remove suggested reviewers logic from OSS API
* Tests and tidy up
* Refactoring
* wip
* Remove changes addresses in a separate PR
* Remove proto for reviewers
* Add godoc
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
This commits deperecates GetLocks, which should be replaced by a paginated counterpart:
ListLocks.
This commit also migrates call sites in OSS which are potentially unbounded.
Towards: gravitational/teleport.e/issues/6759
Changelog: Add paginated API ListLocks, deprecate GetLocks
* Add support for Bedrock models to the session summarizer
- Add protocol buffers
- Add validation
- Add dependency on Bedrock SDK
- Move GenerateTestSession to the OSS code
* Tidy up the go.mod file
* Enable/disable Bedrock on the auth server level
* Add bedrockruntime to e_imports, rerun mod-tidy-all
* Add a comment to GetModules()
* Revert e/ change
* Add Client IP Restriction entitlement
* Add Client IP Restriction entitlement
* Add new entitlement to pb Features
* Fix tests
* Fix entitlements.ts using `CloudIPRestrictions`
The new package is meant to house a test friendly implementation
of modules.Modules. Due to the pervasive and global nature of
modules, this package also contains a copy of of
modules.SetTestModules. In a perfect world this function wouldn't
be needed and modules would be injected where required, however,
that would take considerable effort. The existing test modules
are temporarily left in place until the enterprise tests can be
updated to use modulestest.
The module validation rejects auth preferences that have second
factor disabled without the environment variable override. Doing
this in the storage layer means that in order to disable second
factor the environment variable needs to be set on _all_ teleport
processes not just Auth. This can result in caches of downstream
agents from becoming healthy until the manual override is applied.
The intent is to prevent modifying an the auth preference to disable
second factor, which when moved to the RPC layer, has the same
affect without the possibility of caches performing extra validation.
Some parts of Teleport required this env var to be set to "true"
while other parts required a value of "yes" - this made it
impossible to pass all of the checks.
Use ParseBool instead to be more generous in what values are allowed.
When migrating the S3 events handler to use aws-sdk-go-v2 applying
the FIPS settings and custom endpoint were inadvertently dropped.
This restores the functionality, while also adding tests to ensure
that they are always respected going forward.
A similar test was added to the dynamodb events handler as well to
prevent any regressions with FIPS settings there.
- Recursively check for accesslist membership
- Allow adding/removing/listing included access lists in acl commands
- Add a recursive test
- Use dynamic access lists structure from RFD
- Resolve proto changes
- Exclude 'list' members from Access List memberCount
- Calc Access List member count with members of type 'list' excluded,
return seperately to front end
- Update examples/integrations
- Update crd docs
- Update tf docs
- Perform calculation of inherited roles/traits to AccessList service in
order to utilize cache and minimize number of requests.
- Grant Okta integration RO for Access Lists
- Update AccessListMember-* events
- Include count for inherited grants
- Include MembershipKind of affected member(s)
- Emit inherited grants / members' MembershipKind for AccessListMember-*
events
- Update notified owners for Access Requests
- Ensure dynamic owners are notified for Access Requests
- Ensure dynamic owners are notified via Slack integration
- Optionally pass an AbortSignal to `fetchAccessLists` in Web UI
- Replace usages of `services.IsAccessListOwner/IsAccessListMember` with
equivelant funcs from `Hierarchy`
- Remove final references to AccessListMembershipChecker
- Don't allow ACL deletion when member/owner in other lists
- Guard Access List deletion behind membership/ownership checks for List
- Expose Hierarchy func to recursively get all members
- Tidy UserLoginStateGenerator logic involving ACL Membership/Ownership
Co-authored-by: Maxim Dietz <maxim.dietz@goteleport.com>
* Add proto.
* Add decoding logic for SecondFactorType.
* Update auth preference methods to use and prefer SecondFactors.
* Add fileconf and warning logs.
* Fix tests.
* Address comments.
* Address comments.
* Validate SecondFactor; Disallow SecondFactor and SecondFactors to both be set.
* Address comments.
* Treat second factor SSO as SecondFactor=on; Prevent local user lockout when SSO is the only enabled MFA method; Ensure SecondFactors=[] is disallowed.
* Upate terraform schema, docs, crds.
* Address comments.
* Address comments.
* Fix lint, fix test.
v16 removed the ability to disable second factor authentication,
however, a bypass was left around to allow users to transition.
Starting in v17, the bypass will no longer work and all clusters
_must_ be configured with 2FA.
* Update AccessList Entitlement Enforcement to handle infinite limit
The AccessList service was not correctly handling a zero-value limit
(i.e. an infinite limit) when checking to see if creating an
AccessList would breach the cluster Access List entitlement.
This patch:
* Adds a centralized implementation of a limit check, so that we
only have to get the calculation right once.
* Tests for same
* Updates the AccessList limit check to use the new limit check
* Adds table-driven tests to exercise the limit check in various
scenarios, replacing several almost identical tests.
* Review feedback
* Include BuildCommunity in built type checks
This commit will add two new methods to the modules interface,
IsEnterprise and IsOSS. This is to help alieviate any pain around the
code base that used to look specifically for BuildOSS. Now that we have
two "oss types" (oss and community), we can use these methods to do
enterprise/oss checks, rather than specifically looking at the build
type. This also will allow any future build types to not affect these
checks again in the future.
* Update e
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add fake yubikey private key implementation for tests.
* Add TestHardwareKeyLogin.
* Simplify Hardware Key support test plan.
* Enable piv test package in tests.
* Add TestMarshalAndParsePrivateKey.
* Address simple comments.
* Remove *testing.T from mockSSOLogin in; Add and use better helper methods for mocking sso login.
* Refactor test to dynamically set mock attestation data; revert related changes.
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
Tiago Silva