* Fix TestConnectorSelection flakiness by refactoring connector selection
Fixes#62895
Extracted connector selection logic into a separate `selectConnector()`
method that can be tested without performing network connections. This
eliminates the flakiness caused by DNS resolution and context
cancellation races in the original test.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* Use t.Context() inline instead of context.Background()
* Add parameter names to function type signatures for clarity
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
The endpoints package couples database health checkers together.
This refactor is to register health checkers instead of endpoint resolvers,
to decouple the database health checkers from each other.
This PR extends `session` rule RBAC to support access to the user that started the session roles and traits. It also extends ability to restrict and filter recordings for a user that doesn't have view access to the underlying resource via `can_view` function.
As part of a granular permission model, some customers want to restrict access to session recordings to users that belong to session creator's team or share the same/some roles with him.
This PR starts to store the user traits and roles when the session end event is emitted. These values are static over time and won't change even if the same user receives different roles or traits in the future.
It also reconstructs the resource based on session.end's labels, name and hostname. These values are also static and won't change over time. The resource is used to evaluate the function `can_view` result - this function evaluates if the user requesting the session recording has access to the underlying resource.
Base role:
```yaml
kind: role
metadata:
name: your-role-name
spec:
allow:
rules:
- resources:
- session
verbs:
- list
- create
- read
where: your_condition_here
version: v7
```
`where: contains(session.participants, user.metadata.name)`
`where: contains(user.spec.traits["group"], "prod")`
`where: contains_any(user.spec.traits["team"], session.user_traits["team"])`
`where: contains_all(user.spec.traits["team"], session.user_traits["team"])`
`where: contains(user.spec.traits["team"], session.server_labels["team"])`
`where: contains(user.spec.traits["team"], session.kubernetes_labels["team"])`
`where: contains(user.spec.traits["team"], session.desktop_labels["team"])`
`where: contains(user.spec.traits["team"], session.db_labels["team"])`
`where: can_view() && contains(user.spec.traits["team"], "admin")`
Fixes#35616Fixes#13482Fixes#23039
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
* Refactor auth.Middleware to reduce dependencies on lib/auth
The base functionality of auth.Middleware has been moved to
authz.Middleware to allow decoupling lib/auth from more packages.
Most of the contents of auth.Middleware were better suited for
authz and did not depend on any auth specifics. The auth.Middleware
was not removed entirely, it still has some usefulness to the
auth servers. It now relies on the authz.Middleware to perform
the base functionality.
* fix: add docs to Middleware
* Add SID support for PKINIT
* lint fix: snake case
* fix license
* update terraform
* `make derive`
* revert ignoring invalid dbs
* Bubble up SID lookup error in case auth fails
* expand warning message
* use `ParseCertificatePEM` from `tlsutils`
* add the domain and service account to logger
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* split database CA into server/client CAs
* update migration logging
* include auth component in migrations
* debug log when skipping db client ca migration
* update tctl auth sign for cockroachdb
* update tctl auth sign for oracle
* set ExtKeyUsage for DB certs
* clientAuth for DB Client CA
* serverAuth for DB Server CA
* inject filter for pre-v14.3.1 clients
* inject a filter instead of dropping events in grpcserver
* add DatabaseClientCA type
* debug log when skipping filter injection
* update CA filter injection version check func name and doc
* Add bot field to certificates and various usage events
This adds a new certificate extension field, `teleport-bot`, to
certificates issued to Machine ID bot users that can definitively
identify certificates as having been issued to a bot user.
Additionally, this uses the new `Bot` identity flag to mark certain
usage events as originating from bot users. As such, it includes a
protobuf update from Cloud [1], which pulled in some small additional
(mostly comment) changes.
[1] https://github.com/gravitational/cloud/pull/7060
* Small bot flag plumbing fixes
* Convert bot flag to BotName and UserKind enum
This makes a few changes to the bot tagging approach:
* The bot name is embedded in the cert rather than just true/false
* UserKind is included in events rather than just a bot flag, to
allow for an unspecified value for older client nodes.
* Add a quick unit test for bot cert extensions
* Fix outdated grpc
* Include bot flag on initial certs
* Log a warning and override user kind for usage records if they differ
* Fix several unit tests; add a bot metadata test case
* Fix unit tests with UserKind zero value
* Rename SSH cert extension to use standard format
Renames the `teleport-bot` extension to `bot-name@goteleport.com`,
to better follow SSH cert extension naming conventions.
* Attempt to improve unspecified userkind aggregating logic
* Added Fuzz Seeds for services/fuzz_test.go
* Fuzzing improvements for `lib/srv/db` fuzzing
This ensures that all fuzzing under `lib/srv/db` has the following:
* Good seeds that provide basic levels of coverage
* Enabled in OSS-Fuzz
* Fuzzing improvements for `lib/sshutils`
This improves the fuzzing in `lib/sshutils/sftp/parse_test.go` and `lib/sshutils/x11/display_test.go`.
Seeds were added and additional local fuzzing was done. In addition these functions are now enabled in `oss-fuzz`.
* split recording session events and emitting audit events
This is a refactor of how audit events and session events are handled.
Previously, all events were emitted using the same interface,
api/types/events.Emitter. This lead to event-related code getting to be
very confusing, as it was often unclear whether a given event was being
recorded as a session event and emitted as an audit event, or only one
of the two. Naturally, a few bugs arose due to this.
To simplify event handling, a separate interface for recording session
events has been created. A api/types/events.Recorder should now only be
used to record session events, and an Emitter should now only be used to
emit audit events. Instead of using a confusing TeeWriter that would
transparently (and confusingly, given its name) hold a few event types
that only belonged in session recordings, callers can now explicitly
record and/or emit an event when necessary.
* ensure e build won't break
* feat(db): add support for sqlserver rds proxy
* chore(gomod): go mod tidy
* chore(gomod): go mod tidy
* chore(sqlserver): move params keys to constants
* feat: fix and improve kinit sqlserver
* test(kinit): use a temp dir for writing ccache files
* chore(services): update validation error message
* chore(kinit): improve field description
* refactor(kinit): use CA from certificate generation
* refactor(kinit): remove unused function
* chore(kinit): remove leftover file
The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
Refactor `services.AccessMFAParams` and the accompanying `MFAParams` methods so
they may be extended to carry additional data (eg, information required to
perform device trust checks).
This PR refactors existing code without adding any new functionality, so it may
be backported to older branches to alleviate eventual conflicts. Follow up
changes will take advantage of it to add support for device trust.
Related to gravitational/teleport.e#514.
Replace role/authPref RequireSessionMFA (bool) with RequireMFAType
(string).
- Add new RequireMFAType constant values with custom boolean marshalling.
- Add RequireMFAType to role and auth preference and deprecate
RequireSessionMFA.
- Add session-mfa override login when hardware_key_touch is enforced.
- Add protobuf enum for RequireMFAType.
- Add support for proto enums in protoc-gen-crd and update Kubernetes
Operator manifests.
Making all of our integration tests run in entirely parallel requires
a large engineering effort to enforce test isolation and remove all race
conditions between tests.
A lower-effort alternative may be to split apart the various test suites
into their own Go packages, and test those packages in parallel, even if
the tests inside are still executed serially. Auditing the test suites
for races on system-level resources (e.g. files, ports) is much easier
than chasing down every p[ossible race in the testing system.
This patch acts as a trial run, breaking a fairly well-defined and
self-contained test suite out into its own package. Note that the goal of
this change is not necessarily to shave minutes off the build (although
that would be nice), but to act as an illustration of how other, less
well-formed test suites might be broken apart.
See-Also: #12421
See-Also: #14408
