We added this function to mitigate slow user.Current() calls in
Windows Active Directory environments. Go 1.24 ships with an optimized
verison of user.Current, rendering this utility unnecessary.
Closes#41922
* key split wip
* fix piv tests
* fix terraform tests
* spelling fixes
* fix kube benchmark
* fix identity files in integrations tests
* self review
* fix typo in comment
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* speed up device login tests
* use EC keys in TestProxyAppWithIdentity
* faster tsh tests
* fix race on error value
* fix lint
* write out EC SSH keys in OpenSSH format
* fix lint
* fix keyring comparisons
* PrecomputeTestKeys in lib/client
* parallelize TestNoRelogin subtests
* use ecdsa for self-signed TLS certs
* remove redundant GetTrustedCerts
* improve latency of precomputeTestKeys
Instead of waiting for all 25 test keys before returning a single one,
tests can now make use of the first precomputed test key as soon as it's
ready.
In local testing with this change, the first key is ready after ~75ms vs
>350ms on master.
* fix test and lint
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
A new SSHDialTimeout field is added to the ClusterNetworkingConfiguration
to allow cluster admins to override the default dial timeout of 30s.
The dial timeout is made available in /webapi/ping, stored in the tsh
profile, and cached on disk like other similar cluster settings so
that tsh ssh can consume the relevant information without requiring
an additional round trip to the cluster. At the moment, there is no
support for an unlimited dial timeout, as that would cause
complexity with backwards compatibility.
When unmarshaling the profile YAML, it's possible for the unmarshal
to complete without error while not populating the profile struct,
which leads to a panic.
Fix the nil pointer dereference by unmarshaling into a Profile
instead of a *Profile, and further improve the error message
when this happens.
Fixes#38188
In #24156 we removed a lot of unnecessary calls to user.Current,
which can take a long time in Active Directory environments.
This commit removes a few other uses of user.Current where we were
doing a full user lookup only to find the user's home directory,
which is usually more readily available via the environment.
* ALPN connect test improvements
* fix typos
* remove extra period
* simplify error check
* fix func name typo
* add a few comments to clarify things
* fix lint
* Save private key policy in profile.
* Fix tsh status/logout with yubikey unplugged; fix cluster alert on tsh status with hardware_key_touch.
* Set private key policy from ping response.
* Skip cluster alerts on tsh status.
- Add a generalized client store made up of a key, profile, and trusted certs store. Each sub store can support different backends (~/.tsh, identity_file, in-memory).
- Replace custom identity file handling with in-memory client store.
- Fix issues with trusted certs handling.
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
Primary Changes:
- Remove reliance on Private Key PEM:
- Update native and keygen packages to return PrivateKey instead of PEM key
- Add new PrivateKey interface which implements crypto.Signer
- Replace PEM encoded private key usage where possible
- Replace calls to tls.(Load)X509KeyPair with keys.(Load)X509KeyPair in
client packages
Minor Changes:
- Remove unused agent.AddedKey return from LoadKey
- Simplify sshutils and removed unused code paths
- Add ecdsa and ed25519 key support
Adds Application certificate path to profile
Prior to this patch, the API Profile type had no way of exposing the
path to an application certificate. While this could be constructed
manually using the `keypaths` package, this was fragile and easy to miss
should the profile layout ever change.
This patch adds `GetAppCertPath()` to the API profile, providing a
centralised and integrated method for finding application
certificates.
Brian Joerger