* add session filter, access predicate, impersonate checks; fail fast on invalid expressions at create/update
* add list indexes to role validation error messages
* reject wildcards in search_as_roles and preview_as_roles
* validate join_sessions and require_session_join fields
* include index and tool value in mcp.tools validation error
* update commentary
* aggregate errors in ValidateRole
* aggregate errors in ValidateAccessPredicates
* validate linux_desktop_logins templates
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
* [2] Migration to the Opaque API
Contributes to #66776.
All of the changes here are mechanical conversions generated from
open2opaque rewrite -levels=yellow./.... There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more details.
"Load more" in the recordings search TUI (and --resume-token) failed with
"start_time is required" after the latest access graph update.
Follow-up pages were sent with only the batch_token, relying on the
proto comment that claimed all other filter fields are ignored
once batch_token is set. That contract is wrong: the server validates
and applies start_time/end_time and every other filter on each request,
and the access graph re-checks that the checkpoint falls
within the requested time range.
The batch token is intentionally only a cursor and does not carry the full
search state - encoding every filter into the token would let it grow to
very large sizes. So the original request must be replayed with the
batch_token set on each page. Build the request once and have the fetcher
clone it and attach the token for the initial page, resume, and load-more,
fixing both the TUI and --resume-token.
Also surface the fetch error back to the user: a failed "load more" now
opens a popup with a red header and the server message rendered as code,
instead of silently swallowing the error behind a "(retry)" label.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
Rename --from/--to to --from-utc/--to-utc on `recordings search` to
match the `recordings ls` flag naming convention. The old names are
kept as hidden aliases for backward compatibility.
For JSON and YAML output formats, automatically paginate through result
batches until up to 500 sessions are collected rather than stopping
after the first batch. When results are truncated, a --resume-token
hint is printed to stderr so the caller can continue from where the
previous run left off.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Move tctl acl command into its own directory
Create a accesslist preset file to be referenced later
in future acl commands
* Remakes the original acl_command.go file
This is so that during merging, the enterprise build doesn't break
This file will be removed once all merging is complete.
* Add FormatUserDisplay helper for CLI user identity output
* refactor: reuse terminal control sequence handling
* update FormatUserDisplay output format for clarity
* fix tests
* test: update TestFormatUserDisplay_CanonicalForms to include empty input case
Relocates client.ParseLabelSpec to lib/utils/parse. This results in
a net 5MB reduction in the weight of lib/config. This may not
have a correlation in binary size since lib/client is heavily consumed
by other packages.
```bash
$ goda cut './lib/config:all' | rg '^github.com/gravitational/teleport/lib/client\b|^ID'
github.com/gravitational/teleport/lib/client InDegree=1 Cut.PackageCount=75 Cut.AllFiles.Size=5.3MB Cut.Go.Lines=129512
```
Replace the functions in the scopes package to infer if scoped features
are enabled with a concrete struct that is injected to consumers. This
permits tests to toggle scopes features without having to specify environment
variables.
Adds the first user-facing Access Graph tctl command, listing security
detections with filters and a time window.
Talks to Access Graph through the web proxy and relies on the backend's typed
501/credential errors (see access-graph#1998) instead of a pre-emptive
features.json probe, so the CLI stays stateless.
* Convert DeleteProxy RPC from HTTP to gRPC
* Use `t.Context()`
* Add more greppable TODO
* Fix usage of deprecated rpc
* Upsert RPC
* Use wrapper message for UpsertResponse
* gofmt
* Simplify godoc
* Update response message
* Update method names on public api client
* fix tests
* Introduce UpsertProxyWithoutServer
* Edoardo comments
* separate
* Change to UpsertProxyServer RPC handler
* tctl: add YAML parity for structured output commands
* Add WriteProto Go Doc comment
* Make output format flag visible in evaluate-db-access command
* Make output format flag visible in evaluate SSH command
* remove x509 override dry-run format flag
* refactor: simplify error messages for unknown output formats
* refactor: replace printJSON with utils.WriteJSON and WriteJSONArray
Converts non-pointer protobuf generated Go types to pointers
via `open2opaque rewrite -levels=red ./...`. This contributes to
https://github.com/gravitational/teleport/issues/66776 and was done
separately to isolate per proto file migrations in the future.
* app: Consolidate app name and public_addr validation
Consolidate app `name` and `public_addr` validation to fix six issues
where Teleport rejects valid app names, accepts invalid ones, or
crashes on startup. Preserve backwards compatibility for dynamic and
heartbeat paths: clusters with mixed-case records already in the
backend keep working.
Strict write validation (admin writes + static config):
- App name, static: `IsDNS1123Label` - no dots, max 63 chars.
- App name, dynamic: `IsDNS1123Subdomain` - dots OK for AWS-OIDC,
max 253 chars.
- `public_addr`: `IsDNS1123Subdomain` - dots OK (it is a hostname),
max 253 chars.
All three k8s validators also enforce lowercase. RFC 1123 itself
does not -- lowercase is a Teleport convention for interop with
Kubernetes object names.
`ValidateApp` is the single write-time validator, called from
`CreateApp`, `UpdateApp`, `UpsertApplicationServer`, the inventory
control stream, and app service startup. Heartbeats run
`NormalizeAppServerForHeartbeat` first, which lowercases both
`name` and `public_addr` and strips URL schemes and ports, so
heartbeats from older agents end up stored lowercase.
Link: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/
* app: Apply review feedback
Address review nits from the PR:
- Use t.Context() in new tests; add t.Cleanup for client Close.
- Drop double Close() in inventory controller tests.
- Use proto getters in identitycenter to avoid panic on nil Spec.
- Replace multi-hyphen regex with strings.ReplaceAll loop.
- Collapse mockRolesAnywhereClient.profiles into pages.
- Retitle and flesh out the CHANGELOG entry.
- Revert accidental enterprise submodule bump.
* app: Apply review feedback
Use proto getters for the remaining `acct.Spec.*` accesses in
`IdentityCenterAccountToAppServer` so the function stays nil-safe end to
end. Fix grammar in the app name doc bullet ("as is a duplicate name" ->
"as are duplicate names").
* app: Preserve Identity Center launch URL
Identity Center accounts surface in the unified-resource cache as
synthetic AppServers and never traverse `ValidateApp` /
`ValidateAppServer`, so the DNS-1123 normalization the previous
commits introduced in `IdentityCenterAccountToAppServer` had no write
path to satisfy. Keep the raw StartUrl in both `URI` and
`PublicAddr`: the web Launch button builds the SSO launch href as
`${publicAddr}&role_name=...`, so stripping scheme, path, port, or
case breaks every Identity Center app launch.
Drop the matching lowercase on `metadata.Name` for the same reason,
and restore the delete handler in `processEventsAndUpdateCurrent` to
its pre-PR shape (rebuild a `KindAppServer` header from the IC
account event, no lowercase).
Rewrite `TestIdentityCenterAccountToAppServer` to assert StartUrl
passes through verbatim; remove the `ValidateApp` round-trip
assertion, which was checking a path the synthetic AppServer never
takes in real callers.
* app: Apply review feedback
* app: Apply review feedback
Tighten the "Stricter application validation" CHANGELOG entry to
focus on the three backwards-incompatible cases: static-config
DNS label, unrecoverable public_addr, and duplicate names within
one agent's teleport.yaml. Expand the write-path list to include
the Terraform provider, Kubernetes operator, and direct API
calls. Note that multi-agent same-name heartbeats remain
supported for load balancing.
* app: Allow underscores in dynamic app names
Swap IsDNS1123Subdomain for IsDNS1123SubdomainWithUnderscore in
ValidateApp, the required_apps loop, and ValidateAppServer. The
strict variant rejected snake_case names that Teleport Cloud and
self-hosted clusters both accept today, breaking the Terraform
provider tests as the canary.
Static yaml (lib/service/servicecfg/app.go) remains strict, since
the rule there is a deliberate breaking change. public_addr also
stays strict, since it is the actual hostname used for routing.
Document the new rule and the strict-TLS-client caveat in the
"Application name" section of connecting-apps.mdx.
* fips: Switch to Go-native FIPS140 builds from boring crypto
Switch to using Go-native FIPS140 builds, using the GOFIPS140 build
environment variable, from the old boringcrypto FIPS140 build. The
latter is no longer supported now that Go supports FIPS140 builds
natively.
FIPS140 is enabled across the build when FIPS=1 is passed to `make` when
building. The main package of the binaries import the `lib/fipscheck`
package to ensure that a binary is not switched into or out of FIPS140
mode at launch time using the GODEBUG environment variable.
FIPS140 builds of OSS Teleport are not a supported configuration,
however the base of the Enterprise edition is the OSS repository, so
most of the changes are in this repository. Building OSS Teleport in
FIPS140 mode may not be complete.
* fips: Stop using fips buildbox
Stop using the fips buildbox for fips release builds, and just use the
normal centos7 buildbox. The fips buildbox sets
`GOEXPERIMENT=boringcrypto` which should no longer be set when building
with Go-native FIPS140. The fips buildbox is otherwise identical to the
non-fips buildbox.
* Add scope support to OpenSSH certificate generation
simplify scopes open ssh connection
Add DeviceVerified and isBot in the signer
tweak signer to be lazily referenced
revert adding login to client
Pass in targetServer to the OpenSSHCertRequest instead - use CheckAccessToSSHServer to check if scoped role has access
Respond to pr review
Changed signature of DialHost to use a struct before it gets too big
Changed requestedHostLogin to login and targetnodescope to targetserverscope
fix build
Update auth_with_roles.go
Update split_access_checker.go
Update agentless.go
Update auth.go
fix test
Update authservice.pb.go
move cert gen
alias auth proto instead and update the test error expectation
rename goproto go googleproto for better readability - address pr feedback
Update integration_test.go
test
fix build
revert merge conflict for applyTraits
Switch to using pinning package to marshal/unmarshal
* respond to PR review
* updated the need for a agents to upsert node
* revert permissions.go change for upserting node
Update auth_with_roles.go
* set gogo proto options to false for openSSHCertRequest so that we can import teleport.scoped.v1.Pin
Update authservice.pb.go
* Add node ID check in upsertNode
* fix test structure
Update auth_with_roles_test.go
* Add `beam-user`, `beam-admin`, and `beam` roles
Migrates the beam roles from the cloud tenant controller, adds descriptions, and
marks `beam` as a "system" role so it does not show in the role selector.
Fixes https://github.com/gravitational/beams/issues/137
* Make `host_cert` permissions more restrictive
* Disable beams roles in OSS
* Extract beams login into a constant
* Fix stray quote
* Further lock down the host cert permissions
* Fix role preset tests
* Using `host_cert.role` in expressions doesn't work
* feat(tctl): credential management for Access Graph
Adds the `tool/tctl/common/accessgraph` package with the credential
helpers shared by the upcoming experimental Access Graph tctl
subcommands. Helpers only — no subcommand wiring lands here.
Surface:
- `resolveAccessGraphCredentials`: looks up the keyring by the
profile's `Name` / `Cluster` / `Username` and bundles it with the
proxy address.
- `ensureAccessGraphCert`: fast-paths on a valid cached cert,
otherwise checks the precondition and re-issues via
`GenerateUserCerts(Usage=AccessGraphAPI)`.
- `validateAccessGraphCert{,Expiration,PrivateKey}`,
`checkAccessGraphSupported`, `issueAccessGraphCert`,
`issueAndStoreAccessGraphCert`.
Splitting the helpers from the command tree lets this code merge
ahead of #65949 (vendored Access Graph REST client), which is still
in review.
* fix: tighten TTL and share tctl config resolution
Address #66270 review feedback:
- Split the AG persistence floor (accessGraphMinPersistTTL = 5m)
from the validity buffer (accessGraphCertExpiryBuffer = 2m).
- Add a separate auth-host credential resolver that skips disk
persistence by returning clientStore = nil.
- Widen tctlcfg.ApplyConfig to return ResolvedConfig{Auth,
ClientStore, Profile} so the upstream AG dispatcher reuses the
same profile / identity-file / auth-host detection as every other
tctl command.
* fix: resolve proxy address from auth Ping
Identity-file mode with `--auth-server=<host>:3025` was wrongly using
that auth address as the AG proxy address. Always backfill
`creds.proxyAddr` from `ping.GetProxyPublicAddr()` on the issue path;
non-`tsh login` resolvers leave it empty. Ping fetch consolidated to
a single call site so `checkAccessGraphSupported` becomes a pure
function over the response.
* fix: set proxy-url from ping when not already set
* fix: exercise private funcs and policy check
* fix: lint error kebab vs snake case
* refactor: drop auth-host flow for tctl ag
Issuing an Access Graph cert on the auth host requires picking an
cluster user to mint the certificate for. Though this is a `valid`
operation in terms of permissions, it's a bit of a footgun so at least
for now we are dropping support for it and replacing it with a more
detailed error message.
* chore: add missing space in auth host error
* Use hardware key service when providing an explicit identity file
* lib/tbot: Add `identity/piv-agent` service
* Rename `identity/piv-agent` to `identity/key-agent`
* Allow overriding the hardware key agent with TELEPORT_KEY_AGENT_DIR
* Hardcode knownKey to return true
* Set `RouteToCluster` properly
* Increase timeout for CI
* Report bot failures to help debug CI failure
* Validate destination
* Fix config tests
* Handle the error from `PIVSlotKeyFromProto`
* Fix file permissions and ACLs for multi-user systems
* Prevent accidentally blowing away an important directory if misconfigured
* Respect `TELEPORT_KEY_AGENT_DIR` in `flattenIdentity`
* Fix broken test
* Add session event to enhanced summaries for desktop + other recording type events
* Add more comments to proto
* Fix proto numbers
* Handle deprecation in recording TUI
* Apply overrides to Windows certificates
* Add lib/subca.CalculateOverrideResult.ToClientOverrideDetailsProto
* Propagate CA override details to audit
* kube: URL-based local-proxy routing
* kube: drop wildcard local CA and SNI prefix
* kube: unexport kubeClusterKey
* kube: add tests for local-proxy path helpers
* kube: write error msg for old URL format
* kube: support both formats to preserve compatibility
* kube: drop misleading 'regenerate kubeconfig' error
* kube: drop in-place request mutation
* kube: fix tests for URL-based routing
* kube: drop legacy SNI fallback in local proxy
This commit enhances the CLI reference documentation by automatically
displaying valid enum values in the "Default" column of flag tables,
eliminating the need to manually list these values in flag descriptions.
It also adds a CI step to verify that CLI reference docs stay in sync
with source code changes.
The core implementation uses reflection to extract enum values from
kingpin flags and formats them as "(valid: `value1`, `value2`, ...)".
All CLI source files have been updated to remove duplicate enum value
lists from flag help text, as these are now automatically rendered.
A new 'cli-docs-up-to-date' Makefile target and corresponding GitHub
Actions workflow job ensure that any changes to CLI flags are reflected
in the generated documentation.
Example output:
Before: |`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'|
After: |`--format`|`yaml` (valid: `yaml`, `json`, `text`)|Output format.|
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* feat: added vnet support for database
* feat: handling some edge cases with db key
* minor improvements and tests
* feat: improve database certificate reissuance and enhance error handling in notifications
* splitting out teleport connect changes to separate pr
* refactor for DRY
* feat: added enforcement to get db-user from wire protocol for supported group of dbs
* added tests
* feat: added vnet filter logic to filter on vnet dns hash from status
* chore: removed db username as not supporting it now
* chore: added protocol validation
* chore: updating on pr comments
* chore: streamline fqdn resoluiont for db and better logging on db name conflict
* chore: simplify db resolution logic by handling multiple matches
* Add test helper for authenticating user
* Add `CreateDelegationSession` RPC
* Add `tsh delegation create-session` command
* Apply login state before checking resource access
* Set max TTL on delegation sessions
* Make `TestBuildCreateDelegationSessionRequest` table-driven
* Prevent sub-delegation for now
* Pass `allowReuse = false` when performing MFA ceremony
* Fix test error message assertion
* Honor the `DisallowReissue` flag
* Use `ttl` variable instead of calling `GetTtl`
Expose SSH, Kubernetes, and database-specific resource property filters on
`tctl recordings search`, and map them into the session search
ResourceProperties oneof.
Reject mixed resource property variants in a single search request, since the
API accepts only one ResourceProperties variant at a time.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* use `DurationVar` for `--last` flag
* use `omitzero` on `Expiry` to actually omit zero time
* `tctl discover nodes`: add Azure VM support
* add `--cloud` filter flag
* add `t.Parallel()` to tests
* fips: Rename IsBoringBinary to IsFIPSBuild throughout
Rename the function and method `IsBoringBinary` to `IsFIPSBuild`
throughout the code base and change references to boringcrypto to
fips140 or similar. This is part of removing boringcrypto from the
build, replacing it with Go-native FIPS140.
There are still some references to "boring":
* The PingResponse message has a field IsBoring in authservice.proto.
This cannot be changed without breaking source compatibility in api/
* The example in examples/teleport-usage has an explicit check for the
boring package to set an AWS FIPS option. This will be changed when
the actual change to Go-native FIPS is done.
* Rust references to boringsys - this is still used in Rust and will not
be changed when using Go-native FIPS.
* The actual import of boring to use it. This will be changed when using
Go-Native FIPS.
This rename is separate from the Go-native FIPS implementation so it can
be backported to keep the branches close, to avoid unnecessary
conflicts.
* fips: Add "crypto/tls/fipsonly" import for boring builds
Import the "crypto/tls/fipsonly" package when building in fips mode.
This import is also done in the Enterprise repo with some rename magic
so that the file the import is in only exists for fips builds. This was
necessary when boringcrypto was only available in a special branch of
the Go toolchain, but has not been necessary since Go 1.19 when
boringcrypto was brought into the proper toolchain.
Moving this here makes the enterprise makefile and fips build simpler.
There is no need to split this now.
The import causes TLS negotiation to reject non-FIPS140 ciphers.
---------
Co-authored-by: Cam Hutchison <camh@xdna.net>
nixpig