* Run the connection upgrade test with reversetunnelv2
* Use unwrapped connections to the auth in multiplex listener mode
* Clarify wording in debug log
* Add a test for ALPN used in direct and proxy mode
* Update godocs
* Change struct names for better clarity
* hack on migrating list RPC
* Fix tests
* Tidy up/fix tests
* Use `clientutils.CollectWithFallback`
* Use clearer c.APIClient rather than rely on embeding
* Cover ListTunnelConnections in cache test
* tweak logging
* update deprecation version
* Move fallback impls
* fix span ctx prop
* fix pagination bug when unmarshal bad
* USe t.Context()
* fix ctx propagation
* Update tunn conns to use range pattern - thanks luke
* fix unneeded dependency
* fix deprecation
* env: dev
use opaque API
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
* Add scope support to OpenSSH certificate generation
simplify scopes open ssh connection
Add DeviceVerified and isBot in the signer
tweak signer to be lazily referenced
revert adding login to client
Pass in targetServer to the OpenSSHCertRequest instead - use CheckAccessToSSHServer to check if scoped role has access
Respond to pr review
Changed signature of DialHost to use a struct before it gets too big
Changed requestedHostLogin to login and targetnodescope to targetserverscope
fix build
Update auth_with_roles.go
Update split_access_checker.go
Update agentless.go
Update auth.go
fix test
Update authservice.pb.go
move cert gen
alias auth proto instead and update the test error expectation
rename goproto go googleproto for better readability - address pr feedback
Update integration_test.go
test
fix build
revert merge conflict for applyTraits
Switch to using pinning package to marshal/unmarshal
* respond to PR review
* updated the need for a agents to upsert node
* revert permissions.go change for upserting node
Update auth_with_roles.go
* set gogo proto options to false for openSSHCertRequest so that we can import teleport.scoped.v1.Pin
Update authservice.pb.go
* Add node ID check in upsertNode
* fix test structure
Update auth_with_roles_test.go
* kube: URL-based local-proxy routing
* kube: drop wildcard local CA and SNI prefix
* kube: unexport kubeClusterKey
* kube: add tests for local-proxy path helpers
* kube: write error msg for old URL format
* kube: support both formats to preserve compatibility
* kube: drop misleading 'regenerate kubeconfig' error
* kube: drop in-place request mutation
* kube: fix tests for URL-based routing
* kube: drop legacy SNI fallback in local proxy
* Fix nil pointer derefence in slow auth service initialization.
* Use consistent conservative timeout to account for environment stress.
* Parallelize tests and share cluster instances to balance resource contention and test runtime.
* Allow shared clusters to be used concurrently.
* Tighten timeouts for a more reasonable test runtime.
* Remove time.Sleep in kube test.
* Address comments.
* Fix typos.
* Fix flaky tests caused by early dial failures.
* Add startSessionAndWaitForTracker to unmask session creation failures in audit tests.
* Fix test agentless server to accept more than one connection to enable readiness probe.
* Address comments.
* Address comments.
* fips: Rename IsBoringBinary to IsFIPSBuild throughout
Rename the function and method `IsBoringBinary` to `IsFIPSBuild`
throughout the code base and change references to boringcrypto to
fips140 or similar. This is part of removing boringcrypto from the
build, replacing it with Go-native FIPS140.
There are still some references to "boring":
* The PingResponse message has a field IsBoring in authservice.proto.
This cannot be changed without breaking source compatibility in api/
* The example in examples/teleport-usage has an explicit check for the
boring package to set an AWS FIPS option. This will be changed when
the actual change to Go-native FIPS is done.
* Rust references to boringsys - this is still used in Rust and will not
be changed when using Go-native FIPS.
* The actual import of boring to use it. This will be changed when using
Go-Native FIPS.
This rename is separate from the Go-native FIPS implementation so it can
be backported to keep the branches close, to avoid unnecessary
conflicts.
* fips: Add "crypto/tls/fipsonly" import for boring builds
Import the "crypto/tls/fipsonly" package when building in fips mode.
This import is also done in the Enterprise repo with some rename magic
so that the file the import is in only exists for fips builds. This was
necessary when boringcrypto was only available in a special branch of
the Go toolchain, but has not been necessary since Go 1.19 when
boringcrypto was brought into the proper toolchain.
Moving this here makes the enterprise makefile and fips build simpler.
There is no need to split this now.
The import causes TLS negotiation to reject non-FIPS140 ciphers.
---------
Co-authored-by: Cam Hutchison <camh@xdna.net>
* Refactor client idle timeout test to send/received input asynchronously to remove reliance on high throughput.
* Use exec cat to fix terminal issues in the test.
* Address comments.
* Catch and fail on session errors.
* Improve test error diagnostics by checking the session error channel during terminal waits. Tighten the test duration.
Teleport RBAC policies give built-in role certificates (proxy,
discovery, okta, node, kube...) access to the session recordings
API and audit log.
For the session recordings API, the policy enforcement completely
skips the RBAC logic and if the certificate was from a built-in role,
the client verification logic would skip RBAC entirely.
```go
func (a *ServerWithRoles) StreamSessionEvents(ctx context.Context, sessionID session.ID, startIndex int64) (chan apievents.AuditEvent, chan error) {
err := a.localServerAction()
isTeleportServer := err == nil
// StreamSessionEvents can be called internally, and when that
// happens we don't want to emit an event or check for permissions.
if isTeleportServer {
return a.alog.StreamSessionEvents(ctx, sessionID, startIndex)
}
```
From the built-in roles, only node had read access to
`types.KindSession`, but given the check above all of them had access,
including cases like `okta` where no session recording exists.
This means a user with access to a token or an agent certificate can
read, play and view every single session recording.
Historically, this bypass existed for one particular reason: when an
upload is abandoned without proper termination - this happens when the
agent is restarted while interactive sessions are alive, the agent
places the session in a temporary folder. This folder is constantly
monitored by a routine called `UploadCompleter`. This routine runs on
every teleport process and is responsible for deciding when a session
was abandoned - no active session tracker and the last written data was
24h ago and mark it completed, i.e. move it to another directory, so that
the file uploader could move it to auth server for long-term storage.
Since the session was not correctly terminated it could be the case it
misses the `session.end` or respective end event. This is not
particularly important for the recording itself since it's playable as is,
but it's critical for the session recordings list.
When a user goes to Session Recordings page or does `tctl recordings ls`,
Teleport issues a read request from the audit log to search for
`session.end`, `windows.desktop.session.end`, `db.session.end` and
`app.session.end`. If the audit log doesn't contain the events but the
agent successfully uploaded the recording, the recording won't be
included in the list and will be inaccessible from `tctl` or `tsh`.
To overcome this problem,
https://github.com/gravitational/teleport/pull/14521 introduced logic to
reconstruct the session end event from the recording itself. The logic
assumes (partially incorrect) that if the session recording holds the
session end event, the same event was already present in the audit log.
After the `UploadCompleter` successfully marked the upload as completed,
it scheduled a goroutine to stream the session and see if the session end
event exists. The goroutine had to run 2m after because it was considered
a good time for the file uploader to send the session to the auth server
and auth made it available in the long term storage. To stream it, the
agent contacted Auth Server through the same API users use to play sessions.
Because of an improper filtering and logic, any agent had access to any session.
Even without knowing the session id, given that the agent also had access to read
the audit log, it was able to search for the session end events and later access
them using the `StreamSessionEvents` API.
The main reason why it was implemented like this was because from the moment the
`UploadCompleter` marked the session as completed, auth server had no way to distinguish
between a complete session vs an incomplete session. So the logic was placed into the last
piece that still retained that information.
This PR fixes both problems. It removes RW access to audit logs,
lowering it to WO - agents can write it but can't read it, and removed
any access to StreamSessionEvents.
In order to remove the `StreamSessionEvents` logic being accessible by
the agents, this PR moves the same logic to auth server. There are 3
places where this logic must exist:
- Auth upload completer: If the cluster is operating with any sync mode
instead of async, Auth is the receiving point the the streams. If
something fails, the recording will live in auth server and not the
agent.
- Upload API in Auth: When clusters operate in async mode, agents'
fileuploader uses the auth grpc API to upload the events. Since auth
receives event by event, we can easily analyse if the session already
has a session end event and fill it if necessary
- Encrypted recordings upload: If the cluster operates with encrypted
recordings enabled, agents upload the data to the encrypted recordings
gRPC service. Before this fix, if the session was incomplete we didn't
even try to build the session end event and the session was hidden.
This PR exposes the completer logic in auth server and each one of the 3
cases mentioned call that auth's server function for consistency and
predictability.
Fixes https://github.com/gravitational/teleport-private/issues/2363
This PR fixes https://github.com/gravitational/teleport/issues/60861
accidentally.
* unset XAUTHORITY env var for the networking command
When Teleport passes almost all the environment variables to the child
processes that are born of a reexec. This is an issue when XAUTHORITY is
set as it will be passed to the networking process, causing `xauth` to
use a different file than the one that the SSH session process will use.
This is because the SSH session process only inherits a small subset of
the environment variables from the parent process, and XAUTHORITY is not
one of them. This causes X11 forwarding to fail.
* add Remove method to SafeEnv
This is a pass on replacing modulestest.SetTestModules with supplying modules
where already possible. Some additional uses of modules.GetModules were also
replaced with localized modules injection to permit the removal of
modulestest.SetTestModules in tests. Most of the changes here are mechanical,
the one notable change is in TestSSHCommands. The test was not passing locally
because the shell (fish) builtin echo behaves differently. The easiest way
to produce expected output was to change the command invocation to use
/bin/echo to bypass any shell builtins for consistent behavior.
Inject modules into tool tests
Inject modules into integration tests
Inject modules into join server
Remove superflous enterprise modules in TestAuthenticationConfig_Parse_deviceTrustPB
Inject modules into signature algorithm config tests
Inject modules into TestGithubConnectorCRUDEventsEmitted
Inject modules into TestGetHierarchyForUser
Inject modules into kube proxy tests
Inject modules into controller tests
make fix-imports
add integration/app/fixture as test package
* Split the approver map away from FileTransferRequest
* Move or copy files in session/reexec/sftputils and session/reexec/reexecsftp
* Split up copied files and clean up the new session packages
* Use custom types for SFTP audit log events
* Clean up imports and run sftp in RunAndExit
* Finish renaming types and functions
* Streamline reexec in main and tests
* Add test with the legacy SFTP event implementation
* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* Depguard rules for the session submodule
* Move lib/auditd to session/auditd
* Move lib/loginuid to session/loginuid
* Reduce dependencies of lib/utils/envutils
* Move lib/utils/envutils to session/envutils
* Split the SSH utilities of sshutils/x11 into sshutils/x11forward
* Move lib/sshutils/x11 to session/networking/x11
* Move lib/sshutils/networking to session/networking
* Move lib/shell to session/shell
* Move lib/utils/uds to session/uds
* Move lib/utils/host to session/host
* Move lib/pam to session/pam
* Avoid lib/utils/log in session/pam
* Move lib/service/servicecfg.PAMConfig to session/pam/pamcfg.PAMConfig
* Move lib/srv/uacc to session/uacc
* Avoid importing lib/utils in session/uacc
* Move lib/selinux to session/selinux
* Avoid lib/utils and lib/utils/log in session/selinux
* make go-mod-tidy-all
* Update oss-fuzz path for session/networking/x11
* fix: optimizing api call and allow searching db users with no-wildcards for db users
* chore: addressing pr comments on renaming var and updating comments
* chore: updated based on pr comments to add more tests
* chore: refactor connct button dropdown state rendering
* chore: using t.context() directly in the test
* chore: cleaner refactor of ActionButtons logic
* chore: updated unifiedresoruces test to re-use the existing mock auth client
* chore: removing fallback as not needed for connect
* chore: remove unused api
* chore: reworked test and updated no wildcard logic
* chore: remove unused GetAllowedDatabaseUsers method
* fix: put back test that verifies correct logins are returned for a leaf cluster with access request
* fix: updated parameterpicket to account for allowOnlySuggestions when filtering
* Add privileged updater service
* Add integration tests for updater
* Review fixes
* Move privileged updater to its own module
* Fix comments
* Interpolate registry pathnames, switch errors to AccessDenied
* Improve error handling in `waitForSingleClient`
* Use stricter DACL for named pipe
* Close `conn` on context cancellation
* Move reading update meta to separate function
* `trace.LimitExceeded` -> `trace.Errorf`
* Fix test
* Ensure updater only allows HTTPS
* Use TLS server in tests
* Fix tests
* Update suggested reviewers to include owners of JIT access lists
* Replace undefined with empty array so data serialises without error
* Use consistent proto naming
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Remove unused req return value from reviewer list function
* Remove suggested reviewers logic from OSS API
* Tests and tidy up
* Refactoring
* wip
* Remove changes addresses in a separate PR
* Remove proto for reviewers
* Add godoc
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
Part 1 or removing InsecureDevMode - enterprise still relies on it
so a few TODOs were left around for clean up later. This global is
mostly leveraged in tests to permit trust when self-signed certificates
are used. These tests are often spinning up multiple teleport instances
and most of the time exercise trusted clusters which makes them slow.
Due to the global nature of InsecureDevMode these tests cannot be
run in parallel.
Removes some unnecessary code and refactors TestDebugService so
that it returns better errors and does multiple assertions instead
of bailing on the first failure.
* test: stabilize TestIntegrations/SessionRecordingModes by isolating per-subtest user/role state
Fixes#48043
`TestIntegrations/SessionRecordingModes` was flaky because the subtests
reused the same Teleport user and role while switching recording mode
between `strict` and `best_effort`. Under cache propagation
delay/staleness, one subtest could observe the previous subtest’s role
state, causing incorrect behavior (for example, `BestEffortMode` failing
with `ssh: could not start shell` as if strict mode was still active).
For local reproduction, I introduced a temporary debug cache fault to
drop role update events after initial cache population. With
`StrictMode` run before `BestEffortMode`, that reliably reproduced the
failure by forcing stale role reads in later subtests.
The fix removes shared mutable identity state from the test:
- create a unique Teleport user per mode subtest
- create a unique role per mode subtest
This makes each subtest evaluate recording mode against isolated auth
state, instead of depending on cache timing/order.
Validation:
- with the temporary cache fault enabled, the old test shape reproduced the failure while the isolated user/role version passed
- after removing the temporary fault, `go test ./integration -run 'TestIntegrations/SessionRecordingModes' -count=50` passes with the final code
* stop loading test keys into local SSH agent
* Display early debug logging for autoupdate tools in tsh
* Avoid reporting success on exec failure
* Use a shared lock in GetToolsConfig
* Return the selected tool from Updater.CheckLocal if available and ready
* Reexecute locally available client tools immediately
* Add a test for the fast reexec path
* fix expected, actual order in require
Before these can be consumed in OSS, the enterprise modules need to be
able to both override the global modules and update the configs so that
tests and builds do not break during the transition.
Contributes to https://github.com/gravitational/teleport/issues/62799.
* feat: Extend `AWSRole` struct w/ `RequiresRequest`
- Differentiate between already-granted vs. requestable AWSRoles when
including requestable resources in `clusterUnifiedResourcesGet`
req
* feat: Implement Resource Constraints support for Proxy, Auth
* fixup: Fix tests
* test: Add tests for resourceaccessid-related helpers
* fixup: Address code review feedback
* test: Update identity/events tests for new `ResourceAccessID` fields
* fixup: Expand/improve godocs/comments for sentinel ResourceID handling
* fixup: Address code review feedback
* feat: Conv ResourceID->ResourceAccessID at cert decoding
- Convert ResourceIDs present on certs to ResourceAccessIDs at decoding
time, rather than at each callsite. Update tests/usages of tlsca/sshca
Identities to reflect this.
Edoardo Spadolini