* feat(certs): thread beam_id through identity certificates
Carries the beam identifier from a delegation session's BeamIDLabel into
issued SSH/TLS certificates and back out via the cert extensions/ASN.1 OID,
exposes it on tlsca/sshca Identity and the decision PDP identities, propagates
it through scoped cert reissue (auth_with_roles), and surfaces it on event
UserMetadata for attribution.
* handle missing event cases
* prevent overriding beams_id cert extension with roles cert extensions
* handle code review comment
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
* Depguard rules for the session submodule
* Move lib/auditd to session/auditd
* Move lib/loginuid to session/loginuid
* Reduce dependencies of lib/utils/envutils
* Move lib/utils/envutils to session/envutils
* Split the SSH utilities of sshutils/x11 into sshutils/x11forward
* Move lib/sshutils/x11 to session/networking/x11
* Move lib/sshutils/networking to session/networking
* Move lib/shell to session/shell
* Move lib/utils/uds to session/uds
* Move lib/utils/host to session/host
* Move lib/pam to session/pam
* Avoid lib/utils/log in session/pam
* Move lib/service/servicecfg.PAMConfig to session/pam/pamcfg.PAMConfig
* Move lib/srv/uacc to session/uacc
* Avoid importing lib/utils in session/uacc
* Move lib/selinux to session/selinux
* Avoid lib/utils and lib/utils/log in session/selinux
* make go-mod-tidy-all
* Update oss-fuzz path for session/networking/x11
* ensure logs for reexec processes are shown when running unit tests
* log audit session login IDs as strings
---------
Co-authored-by: Andrew LeFevre <andrewlefevre@goteleport.com>
This consolidates all references to BoringCrypto and FIPS-140-2 to
a single section of the docs, using more generic FIPS terminology
elsewhere. As a result, we only need to change one place when we
update our FIPS module in the future.
In addition, mention the specific versions of BoringCrypto and
associated CMVP certificate numbers.
* expose logs of Teleport child processes
Configures Teleport child proceses to log with the exact same
configuration as the parent process. Logs from child processes
previously were essentially discarded.
* Fix issues around os_log; Fix log spam from child process.
* Address comments; Fix lint.
* * Only write remote command failure errors to client tty
* Don't try to write errors to unserviced os.Stderr/Stdout of child process
* Don't connect networking stderr to parent process, just use logger
* Don't log client-responsible shell errors, e.g. shell interrupt
* Mention running teleport as root for common subprocess permission errors.
* Pass io.Discard pipe to child process if a log writer is not available.
* Fix tests with nil log writer.
* Add default child logger for tests.
* Fix lint.
* default to discard writer for tests.
* Write reexec errors to os.Stdout for parent process to digest.
* Address comments.
* Clean up child pipe copy logic.
* Cleanup log config inheritance.
* Address comments.
* Revert whitespace change.
* Fix typo.
* Fix merge conflict.
---------
Co-authored-by: joerger <bjoerger@goteleport.com>
* Extend timeout and respect context for child process continue signal.
* Address comments.
* Only wait for child signal when BPF and PAM are enabled.
* Clean up WaitForChild logic; Fix issue caused by forwarding server returning error from GetPAM method.
* Address comments.
* Fix aggregating wait and close error.
* Remove _ for ctx parameter.
* fix: prevent `crypto/ssh` to block on dialing
`crypto/ssh` dialing doesn't support timeouts or context cancellation
propagation by default. Although `ssh.ClientConfig` has a field
`Timeout`, this field is only used when establishing a new TCP
connection but it's never used for ssh handshake.
This means that if the target server never replies and no intermediary
closes the connection, the connecton will be kept alive forever causing
Teleport dialer to deadlock and never recover.
Although teleport `ssh` package has `NewClientConnWithDeadline`, not all
every Teleport implementation of `net.Conn` supports read deadlines,
which means we can have cases where the system also deadlocks when using
`NewClientConnWithDeadline` and a timeout.
This PR tries to solve it by closing the underlying connection when the
minimum time between the context's deadline, the timeout and if none set
30s.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestion from @espadolini
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix code
* rename methods to correctly describe the behavior
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle code review comment
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Client: add session channel request extra data to replace env vars.
* Server Changes:
- Set session params on server side from request, with env var fallback for backwards compatibility.
- Remove CreateOrJoinSession.
- Separate JoinSession from OpenSession; Remove session ID from connection context as it is now purely controlled by the session.
- Ensure participant mode is always set for joining.
* Replace NewSessionWithParams method.
* Update comments.
* Move session params to server context.
* Add ModeratedSessionID to session params to replace TELEPORT_MODERATED_SESSION_ID env var.
* Fix nil reference.
* Fix tests.
* Only send session params to Teleport servers.
* Add WebProxyAddr to session params.
* Cleanup.
* Add tests.
* Fix test.
* Address comments.
* Add NewSessionWithParams.
* Fix tests.
* Update comment.
* Update api/observability/tracing/ssh/client.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix forwarding server missing Teleport ssh version.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix usage of node server ID and proxy host UUID in the forwarding server.
* Make GetInfo and TargetMetadata consistent between the forwarding and regular server.
* Rename TargetMetadata to EventMetadata and only use it for events' ServerMetadata.
* Remove unused method.
* Resolves comments on test.
* Remove unused fields.
* Update lib/srv/ctx.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update integration/integration_test.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Refactor server session ID logic; Separate join and open session flows.
* Remove unused client node session ID.
* Fix backwards compatibility.
* Fix tests and lint.
* Update deprecation TODO.
* Fix failing test caused by delayed association with join session.
* fix session ID for git events
---------
Co-authored-by: STeve (Xin) Huang <huangin52@gmail.com>
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
* GitHub proxy part 6: proxing Git using SSH transport
* better command parsing and update suite
* refactor
* revert unnecearrty files
* address review comments
* ut fix
* revert localsite_test.go
* change special suffix to teleport-github-org for routing
* fix routing ut
* minor typo edit
* fix ut after sshca change
* add UT to sshutils
* minor review comments
* fix api ut because of special suffix change
* GitServerReadOnlyClient
* downgrade error to warning
* run go mod tidy. not sure why it's needed
* rename mock.go to mock_test.go
Tiago Silva