* add metadata
* newline
* cleanup status error
* refactor status error
* fix print
* order
* fix test on linux
* Truncate time to ms
* add host param to request
* jitter locally
* rename host to id
* rename func var
* Client auto updates integration for tctl/tsh
* Add version validation
Fix recursive version check for darwin platform
Fix cleanup for multi-package support
* Fix identifying tools removal from home directory
* Replace ToolsMode with ToolsAutoUpdate
* Reuse insecure flag for tests
* Fix CheckRemote with login
* Fix windows administrative access requirement
Update must be able to be canceled, re-execute with latest version or last updated
Show progress bar before request is made
* Fix update cancellation for login action
Address review comments
* Add signal handler with stack context cancellation
* Use copy instead of hard link for windows
Fix progress bar if we can't receive size of package
* Replace with list in order to support manual cancel
* Download archive package to temp directory
* Decrease timeout for client tools proxy call
* Update client autoupdate proto structure
* Replace with reserved
* Fix unit tests
* Add more info in proto
* Rename proto to be aligned RFD namings
* Replace enum type for ToolsMode to string
* Expose client tools auto update for find endpoint
* Group auto update settings in find response
Log error instead returning error
Add tests auto update settings in find endpoint
Add check for not implemented error
* Add more test cases
A new SSHDialTimeout field is added to the ClusterNetworkingConfiguration
to allow cluster admins to override the default dial timeout of 30s.
The dial timeout is made available in /webapi/ping, stored in the tsh
profile, and cached on disk like other similar cluster settings so
that tsh ssh can consume the relevant information without requiring
an additional round trip to the cluster. At the moment, there is no
support for an unlimited dial timeout, as that would cause
complexity with backwards compatibility.
* webclient.Ping: Return err on unsuccessful response
* Log mangled response, add test case
* Point towards possible causes of errors
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
---------
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
* Proxy TAG requests through Auth
* Integrate Access Graph feature and optimize services
This commit entails the integration of the Access Graph feature into the existing service configuration. This feature is manifested through an 'IsEnabled' method that checks the state of the access graph. Additionally, the auth service logic now includes a flag for enabling access graph. The services have been further optimized with adjustments geared towards improving performance and readability of the code.
* Move TAG enabled flag from proxy to user setting/auth context
* Swap a pointer to AccessGraph config with a value.
* Add 'TestNewAccessGraph' function to 'useracl_test.go' file.
The function 'TestNewAccessGraph' has been added to run tests checking the configuration of Access Graph. Furthermore, a small change is made for the 'KindAccessGraph' comment in 'constants.go' to provide more accurate information.
* Implement Access Graph feature across various files
The Access Graph feature has been incorporated in 'module.go', 'authservice.proto', 'auth.go', and 'plugin.go' files. A method 'EnableAccessGraph' is also introduced in 'module.go' to allow the usage of this feature. Descriptions of Access Graph have been adjusted across files to explicitly state the feature's enablement.
* Fix tests
* Remove unused access graph feature code
This commit removes all references and uses of the access graph feature from the codebase. It also updates corresponding tests to reflect this removal. It also adds EnableAccessGraph() method to testing module to fix test compilation.
* TAG initial implementation
This change introduces the initial Teleport integration with TAG. The implementation introduces:
* new `access_graph` section in `teleport.yaml` file that holds the access graph configuration
* new `access_graph` RBAC kind, that controls who has access to TAG feature
* the new access graph RBAC kind is added to the ACL REST endpoint, so WebUI know if TAG is enabled and the user has access to it.
* Remove `UseAuth` and improve comments in `AccessGraph`
This commit removes the `UseAuth` field from the `AccessGraph` configuration. At the same time, the comments for each field in `AccessGraph` have been made more consistent and descriptive, providing clear declaration of each field's purpose. The comments in `WatchEvents` in `grpcserver.go` have also been updated for clarity.
* Use `cloud/stable` when Automatic Upgrades is on.
Teleport provides scripts to install teleport agents/services.
Those scripts use YUM/DEB repositories when possible.
Each repo has multiple channels:
- stable/v11
- stable/v12
- cloud/stable
We want to ensure that if the cluster is running in the cloud and
automatic upgrades is on (auth service was started with
TELEPORT_AUTOMATIC_UPGRADES=yes teleport ...), then the installation
script must offer the `cloud/stable` channel.
This PR changes the following scripts:
- Discover Install Node
- Discover Install Database Service
- Install App script
- EC2 default-installer and EC2 default-agentless-installer
* add helm chart knobs to enable auto updater
* use let instead of const and remove default export
* add HA to helm chart
* always return .automatic_upgrades in web ping response
* rename cloud/stable to stable/cloud
* fix ts test
A new `api/client/proxy/Client` has been added to interact with
the SSH and gRPC servers that the Proxy serves on its SSH port.
The client will first try connecting to the gRPC server and if
that fails it will fall back to the SSH server.
Much of the SSH functionality mimics the existing behavior of the
`ProxyClient` in `lib/client`. This is the first part of phasing
out that client in favor of the new client. There will be a follow
up PR that migrates `lib/client` to make use of the new client instead.
Part of #19812
Sets `http.Server.IdleTimeout` and `http.Client.IdleConnTimeout`
on clients and servers which didn't have them set. A default of
360s was chosen to be on par with the default of an NLB without
being identical.
This was added as another safety measure to prevent leaking any
idle connections indefinitely as seen in #22757.
`apidefaults.DefaultDialTimeout` was also renamed to
`apidefaults.DefaultIOTimeout` to better reflect its usage.
The `http.Client.Transport` created in `newWebClient` wraps a
chain of `http.RoundTripper` over an underlying `http.Transport`.
Since we cannot guarantee that each `http.RoundTipper` has a
`CloseIdleConnections` method the usage of
`defer clt.CloseIdleConnections()` does not guarantee that the http
connections created during Find/Ping/etc are closed.
To prevent leaking connections implementations of `http.RoundTripper`
have added a `CloseIdleConnections` method added that forwards the
request on to the wrapped interface. The `otelhttp.Transport` does
not implement this method either so care has been taken to wrap it
in a `http.RoundTripper` which will call the root transport in
`enforceCloseIdleConnections`. An upstream issue has been filed
with otelhttp: https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3543
to get the method added to their `Transport` implementation.
This wasn't noticed prior to upgrading to go1.20 becuase prior to
[this](https://github.com/golang/go/commit/4e7e7ae1406c70d9cc0809ec11105a55a60a0b70)
commit the `ReadHeaderTimeout` set on the Proxy web api http.Server
would cause the connection to appear idle and get terminated by the
server.
`TestWebClientClosesIdleConnections` was added to capture the leak
in connections as reported in #22757 and prevent any regressions.
Before this commit, the `tsh` HTTP requests that had the extra headers
were those that did not use `roundtrip`.
This commit leverages `http.RoundTripper.RoundTrip` to ensure that all
requests have the the extra headers.
AttemptDeviceLogin, which is the main entry point for device authentication, now
checks the Ping response and skips the attempt entirely if device trust is
disabled.
The main objective is to avoid a needless roundtrip if the feature is disabled,
as one should only pay for what is in use.
There's actual little consequence in attempting the roundtrip, apart from the
added latency on logins, so I've gone with a negative flag ("Disabled" instead
of "Enabled"). The negative is less harmful if, for some reason, it's wrongly
absent (say, because of some future Ping code branch).
gravitational/teleport.e#514
By only providing the tunnel address from the `reversetunnel.Resolver`
callers would still need to lookup the proxy listener mode to determine
how to dial the address. This results in sending a request to
`/webapi/find` once by the resolver to get the tunnel address and then
a second request to `/webapi/find` by users of the `Resolver` to determine
the proxy listener mode. Propagating the listener mode along with the
tunnel address by the `Resolver` ensures only one `/webapi/find` call
is needed.
This is especially impactful because the `reversetunnel.TunnelAuthDialer`
which is used by the auth http client would do this everytime the
`http.Client` connection pool was empty. When the `http.Client` needed
to dial the auth server it was incurring the additional roundtrip to the
proxy.
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
* Add spans to TeleportClient/ProxyClient/NodeSession
* Improve dialer tracing
* Alter default http client span name to include path
* propagate tracing options in NewClientConn
* Respect timeout in `(directDial).DialTimeout`
* Add a Timeout to the api/client/webclient calls
* Respect timeout in (proxyDial).DialTimeout
* Applied suggestion
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Leverage otelhttp to generate spans for http clients and http handlers.
Additionally add spans for grpc clients and servers by using the
otelgrpc interceptors. This is step one in implementation of RFD 65.
Until further work is done, the spans generated will be a no-op
until the tracing provider is initialized.
Implement passwordless cluster settings, as described by RFD 52: Passwordless
[1]. See https://github.com/gravitational/teleport/pull/11716 for recent RFD
changes.
Add the "passwordless" connector and allows cluster admins to configure it as
the cluster default.
teleport.yaml:
```yaml
auth_service:
authentication:
type: local
second_factor: on
webauthn:
rp_id: example.com
passwordless: true # enables/disables passwordless
connector_name: passwordless # sets passwordless as the default
```
`tsh` obeys the connector name if present. User overrides are possible via `tsh
--auth=local` or `tsh --auth=passwordless`. The `tsh --pwdless` flag is now
removed, as discussed in recent RFD changes.
Web API `/ping` and `/ping/{connector}` endpoints are changed to support
"passwordless" and to provide other necessary information.
#9160
[1] https://github.com/gravitational/teleport/blob/master/rfd/0052-passwordless.md#cluster-settings
* Add passwordless toggle to AuthPreferenceSpecV2 proto
* Update generate protos
* Add AuthPreference fields and validation
* Reserve system connector names
* Distinguish between type=local and local connector
* Add passwordless option to teleport.yaml
* Do /ping and /ping/{connector} changes
* Make tsh respect the passwordless connector, remove --pwdless
* Include the possible connector values if supplied value is invalid.
* Update messaging for auth flag.
* Return error message from failed ping response.
* Collect the connector names in the existing loops.
This change updates NO_PROXY handling to allow blocking specific host:port combinations, rather than just the host. It also adds a special case for downgrading requests to plain HTTP when --insecure is true and the request goes through a plain HTTP proxy at localhost (i.e. HTTP_PROXY=http://localhost).
Stephen Levine