* Device Trust: add `required-human` mode
* Add `device_trust.mode=required-human` to the test plan
* Add `IsBot` methods to TLS and SSH identities
* Fix `required-human` mode on roles
* Rename mode to `required-for-humans` for clarity
* Undo premature changes to device trust guides
* Default `deviceVerificationPassed` false to avoid accidents when adding new modes
* Handle `BotName` and `BotInstanceID` in `lib/auth/authtest`
* Fix stray reference in test
* Fix reference to `config.DestinationMemory`
* Handle empty device trust mode
The new package is meant to house a test friendly implementation
of modules.Modules. Due to the pervasive and global nature of
modules, this package also contains a copy of of
modules.SetTestModules. In a perfect world this function wouldn't
be needed and modules would be injected where required, however,
that would take considerable effort. The existing test modules
are temporarily left in place until the enterprise tests can be
updated to use modulestest.
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
The device trust web flow can result in a web browser launching
Teleport Connect (which launches tsh, which in turn launches
powershell).
Some antivirus solutions flag cases where a powershell process is
a descendent of a web browser process. In order to avoid being
blocked by the antivirus software, we want to read system information
directly instead of via powershell.
* Check if device is trusted
* Move `TrustedDeviceRequirement` enum to a separate file and generate TS definitions for it
Generating TS definitions for the entire legacy/types/types.proto would result in 50K lines of generated code, and the bundle size would increase by ~20% (around 1 MB).
* Extract function to calculate device trust requirement that can be used both by the server and the client
Important: it now uses `GetEnforcementMode` instead of `GetEffectiveMode`. The check for OSS module is performed on the server-side anyway.
* Check what is device trust requirement based on cluster config and user roles
* Show device trust status in UI
* Remove `types.` prefix
* Improve godocs
* Bring back `getRoles func() ([]types.Role, error)`
* Simplify `TestHasDeviceTrustExtensions`
* Clean up and improve `TestCalculateTrustedDeviceRequirement`
* Move `CalculateTrustedDeviceRequirement` and tests to a separate file
* Add colors to shield icons
* Declare variables where they are used
* Extract a component to display device trust status for better readability
* Correctly reference `lib/client.ProfileStatus.Extensions`
* Set group limit to 8
* Make `switch` exhaustive
* Regenerate protos
* `make fix-license`
* remove lib/client dependency on lib/devicetrust/authn
* add cgo depguard
* fix typo
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Device Trust support for split SSH and TLS keys
* chalResp -> tpmChallenge
* clarify comment on sha256 import
* use input struct, crypto.Signer instead of keys.PrivateKey
* use trace errors in challenge package
* [devicetrust] fix: handle server errors in bi-directional streams
Fix an edge case in the devicetrust gRPC bi-directional stream handler where the stream could terminate with an error after the last client `Recv` call but before the next `Send` call.
Previously, this scenario caused the `Send` method to return an `io.EOF` error, which indicated that the connection was terminated but did not reveal any errors returned by the server.
This update ensures that the client continues to consume the stream until an error is returned, allowing for proper error handling and more robust stream management.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add license headers
* drop helper and local skip io.EOF errors
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
This PR adds the ability to watch for events for `*devicepb.Device` objects.
Backend storage representation of `devicepb.Device` is achieved using an internal representation that lives in `e/lib/devicetrust/storage` and whose logic is internal to the package.
To be able to expose the unmarshal logic necessary for events to work, this PR exposes a registration hook that `e/lib/devicetrust/storage` function must call during initialization to register the unmarshal function.
Part of https://github.com/gravitational/access-graph/issues/637
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Include BuildCommunity in built type checks
This commit will add two new methods to the modules interface,
IsEnterprise and IsOSS. This is to help alieviate any pain around the
code base that used to look specifically for BuildOSS. Now that we have
two "oss types" (oss and community), we can use these methods to do
enterprise/oss checks, rather than specifically looking at the build
type. This also will allow any future build types to not affect these
checks again in the future.
* Update e
* Read DMI files concurrently
* Refactor DMI logic into its own method
* Collect device data concurrently on Linux
* Drop the mutex on DMIInfoFromFS, simplify
* Close streams on errors
* Rename fake_windows_device.go to fake_tpm_device.go
* Test enroll/authn ceremonies against Linux
* Allow Linux devices to enroll and authenticate
* Implement Linux TPM methods
* Attempt attestation without the event log on failures
* Rename others.go to device_others.go
* Move various functions to tpm_common.go
* Read device collected data on Linux
* Add the mode param to native.CollectDeviceData
* Add the mode param to collectDeviceData
* Run escalated `tsh device dmi-info`
* Write cached DMI info
* Read cached DMI info
* Avoid asset tags with spaces on them
* nit: Use deviceStateFolderName without a dot on Linux
* Test various data collection scenarios
* Fix macOS/Windows typo
* Dupe device_windows.go
* Split functions between generic and OS-specific
* Add the tpmDevice abstraction
* Add "No Asset Information" to the list of skipped tags
* Appease linter, reintroduce windows build tag
* Move gRPC error intercetpors to api/utils/grpc/interceptors.
* Use error interceptors in api client and mock server.
* Apply suggestions from CR.
* Unwrap FromGRPC errors in middleware.
* Use gRPC auth service in tests instead of external example service.
* It's gRPC!!!
* Fix unit test.
* Add error interceptor to proxy client.
* Fix merge conflict.
Alan Parra