All of our supported release branches are well past Go 1.18, so
we don't need to support the old build tag syntax.
Changes made by running `go fix ./...`.
* Add the dynamodbutils and stsutils packages
* Use stsutils.NewFromConfig()
* Use stsutils.NewV1()
* Use dynamodbutils.IsFIPSEnabled()
* Add forbidigo rules
* Appease linter
* Prevent creation of invalid App for AWS OIDC Integration
When enabling AWS Access using an integration, the final address will be
a concatenation of the integration name and the proxy's public address.
The proxy must present a certificate valid for that address.
However, when the integration name has a dot, it will usually not work
with the proxy's certificate.
We know it won't work for Teleport Cloud, where the certificates only
allow for `<app>.<tenant>.teleport.sh`.
So, for Teleport Cloud enabling AWS Access is not possible.
For self-hosted, a warning is emitted.
* prevent new aws oidc integrations with invalid DNS labels
* add integration name to error message
* improve readability of validation.IsDNS1035Label call
* Add requirement to set base URL for OSS builds
Fix progress bar for darwin platform
* Show warning only before update
* Move error to teleportPackageURLs
* Move error to teleportPackageURLs
* Fix linter
* Check whether mfa is required for an app session through the correct cluster.
* Add clusterId param for isMfaRequired check in the web api.
* Fix connecting to leaf app directly with MFA.
* Add integration test.
* Add integration test.
* Remove redundant lib.SetInsecureDevMode calls when using testserver.SetupTrustedCluster.
* Reuse new test helpers.
* Focus fix down for apps.
This eliminates the SigningService in favor of a free function
SignRequest, which eliminates AWS credential loading and simplifies the
AWS utils package.
In the process of doing this refactor, the AWS app handler has been
changed to use AWS SDK v2 to load its credentials as well.
* Add templates for client tools auto-update download url
* Change to base url setting by env
MakeURL moved to common function to be general for both, agent and client tools
* Add godoc for common function and constant for default package
* Use flags and version arguments instead of revision
* Move base url env to shared constant
* kube: properly return the reason for connection disruption
There are several cases where connection monitor can terminate an
ongoing connection. Iddle timeout, certificate expiring among others are
some reasons for the connection to be terminated.
For Kubernetes access, the underlying error is never propagated back to
the client so they don't receive the reason for the exec session being
terminated.
This PR fixes that by adding an hook to write the client error response
into the connection error channel for clients to be aware.
Part of https://github.com/gravitational/teleport/issues/18496
* handle review comments
* handle review comments
* Fix auto-update re-exec arguments modified by aliases
* Make arguments to be required to set
* Restore progress bar show before request
* Improve integration tests to execute with `tsh` and `tctl`
Added a full-cycle integration test to verify client tools
auto-updates within a test cluster by modifying AutoUpdateConfig
and AutoUpdateVersion resources. The test executes the login
command using alias configurations to ensure no recursive
re-execution occurs.
The updater binary used in integration tests has been replaced
with the `Run` logic of tctl and tsh.
* Set generated test password by env variable instead of constant value
* Restore priority of env check over remote check
In case of double re-execution case we should stop second one to prevent loop re-execution
Drop localDir set during compilation
Updates https://github.com/gravitational/teleport/issues/49509.
Most of the places namespaces were already configurable were had
been forcing the default namespace. This extends that by removing
the ability to pass in a custom namesapce and hardcodes the
default namespace at the inner most call site to reduce the surface
area of namespaces.
With the removal of the --namespace flag from the base tsh command,
kubernetes subcommands have also been updated to use --namespaces
in addition to --kube-namespace. The former should be preferred,
while the later exists solely for backward compatibility.
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
* Reissue kube certs when assuming access request
* Fix and add tests
* Explain when the cert can be not found
* Replace `clearCertsFn` with `middleware` field
* Improve iterating over gateways
* Improve a comment
* Update type for targetSubresourceName on DocumentGateway
The way DocumentsService.createGatewayDocument is implemented means that
the targetSubresourceName property is always present, but it can be undefined.
* Use "local port" instead of "port" in DocumentGatewapApp
* Rewrite gateway FieldInputs to use styled components
* Update comments in protos
* useGateway: Stabilize useAsync functions of ports
* Add padding to menu label if it's first child
* Add support for required prop to Input and FieldInput
* Add UI for changing target port
* ActionButtons: Show ports of multi-port apps when VNet is not supported
Now that we have support for the target port in Connect's gateways, we
can show the ports and then open a gateway for that specific port on
click.
* Add RWMutex to gateways
* Clear app gateway cert on target port change
* Remove gateways/app.LocalProxyURL
It was used only in tests and it made sense only for web apps anyway.
* TestTCP: Close connections when test ends
* Create context with timeout in testGatewayCertRenewal
…instead of in each function that uses it.
* Add tests for changing the target port of a TCP gateway
* Parallelize app gateway tests within MFA/non-MFA groups
* Make testGatewayConnection take ctx as first arg
This will be needed in tests that check target port validation.
* Validate target port of app gateways
* Increase timeouts in app gateway tests
* Change icons from medium to small
* Use consistent spacing in AppGateway
* Add godoc for ValidateTargetPort
* Add retry with relogin to change target port
* Remove all direct logrus usage from teleport module
The only remaining use of logrus is from integrations, which is
unfortunately imported by teleport.e, and prevents logrus from
being moved to an indirect dependency. The logrus formatter and
initialization of the logrus logger will remain in place until
integrations is using slog. To prevent any accidental inclusions
of logrus within the teleport module the depguard rules have been
updated to prohibit importing logrus. The rules also include
prohibit a few common log packages that tools like gopls might
automatically import.
* Refactor logger initialization
Consolidates configuring of global loggers to a single function.
This is mainly to facilitate configuring the logger for
teleport scp, but will also allow us to remove the copy of logger
initialization that currently exists in integrations/lib/logger.
* fix: document ValidateFields
* fix: remove copied yaml tags
* fix: update file path comment
Converts most items to use servicecfg.Config.Logger instead of
servicecfg.Config.Log. The deprecated logrus logger unfortunately
cannot be removed yet as it's still used in e. Additionally all
logging within the config package was converted to use slog.
* Restore CSRF Token for SSO flows
This is a partial revert of #50358.
We need to keep the CSRF token in the SSO flows for now, as it is
used to ensure that the flow is completed by the same actor who
initiated the sign-on.
* Make the purpose of the lib/httplib/csrf package clear
This package is only used to protect against login CSRF with SSO flows.
Teleport's web API is protected from CSRF by nature of using a bearer
token, and does not require this package. This particular pacakge is
only necessary for SSO because the user is not yet logged in when the
SSO flow begins, so they don't have a bearer token.
* Remove the remaining bits of unneeded CSRF code
Additionally expand upon the godocs for our various middlewares
so that it's clear which ones provide CSRF protection.
* Add UpsertTrustedClusterV2 rpc
This supersedes UpsertTrustedCluster rpc. V2 performs resource name
validation.
* Replace confusing UpsertValidationTrustedCluster name
* Use UpsertTrustedClusterV2 in tests
* Address feedback
- Remove unnecessary ping
- Update error messages
- Use skipNameValidation consts
- Validate cluster name before establishing trust
- Do not reveal cluster name in error message
- Use BadParameter instead of CompareFailed
* Use webclient.Find
* Fix test/lint
* Allow label updates
* Fix test
* Fix error handling
* Implement CreateTrustedClusterV2 and UpdateTrustedClusterV2
* Address feedback
* Minor fixes
* Move V2 RPCs to the trust service
* Update comment
* Drop V2 suffix
* Require matching revision
* Fix upsert/update revision
* Drop V2 from Create and Update APIs
* Lint: Fix typo
Host resolution performed because labels, fuzzy search, or predicate
expressions were supplied to commands that establish connections to
a single host has historically been performed client side in tsh.
While that works in most cases, it can prevent correctly
resolving hosts in some situations, i.e. when there are ambiguous
hosts and tsh is unaware that the cluster routing strategy is set
to ROUTE_TO_MOST_RECENT.
To improve the experience, a new ResolveSSHTarget was added to
Auth to allow host resolution to be performed server side. The
resolution works in a similar manner to, and was inspired by
GetSSHTargets. In the event that the new RPC is not implemented,
because the client is newer than Auth, tsh has also been updated
to pull the cluster networking config and address any host
ambiguity if allowed.
As a result tsh scp and tsh proxy ssh should be much more
tolerant to, and still permit access in situations where
ambiguous hosts are present for some amount of time. Prior to
this the only way to connect in these situations was to find
the UUID of the correct target instance and try again after
seeing an ambiguous host error.
* Reorganize tctl commands to have commands not required auth client
* Replace auth client with lazy loading approach
* Fix linter warning
* Replace camel case in import alias
Replace logrus to use slog
* Rename close function
* Refactor plugin commands to use interface of auth client and plugin client
Code review changes
* Refactor workload identity commands
* Add access to global config for the commands
* Add test checking all tctl commands match process
* Fix golangci-lint warnings
This applies the same measures as https://github.com/gravitational/teleport/pull/49850
applied to various other flaky integration tests to ensure that
nodes are routable before attempting user connections to them.
Additionally, the debug service is disabled by default for all of
the various ways a TeleInstance can be created. This prevents test
failures on macOS due to unix socket name length.
Closes https://github.com/gravitational/teleport/issues/16310.
Closes#47156.
All of the tests suffering from issues dialing hosts, and failing
with a `failed to dial target host` error were incorrectly waiting
for nodes to become visible before establishing connections. The
main culprit for most of the failures was `waitForNodesToRegister`,
though a few tests had a very similar hand rolled variant, which
incorrectly returned when the nodes appeard in Auth. However, since
the Proxy is the one performing dialing, they should have waited
for the nodes to appear in the Proxy.
To resolve, `waitForNodesToRegister` and all hand rolled equivalents
have been removed in favor of `(TeleInstance) WaitForNodeCount` which
correctly uses the `CachingAccessPoint` of the RemoteSite instead
of `GetClient`. Additionally, `helpers.WaitForNodeCount` was updated
to validate that the node watcher used for routing in the Proxy
also contained the expected number of nodes.
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add monitoring of the servers time drifting
* Refactor monitor to use inventory stream
* Add command for inventory control stream for time reconciliation
* Reuse ping/pong logic for time reconciliation
* Add integration test to check if global notification is created
* Limits notification length, renaming
* Return system clock instead of time difference
Add parallel requests to ping the nodes
Fix issue with locking inventory store while making ping request
* Refactor to make time reconciliation part of the inventory control stream
* Fix tests
* Rewrite tests
Return inventory store iterator
* Naming adjustments
* Fix test
* Drop timeReconciliation in order to use direct handler functions
* Make time reconciliation with variable duration
* Replace with duration type in proto
Add test cleanup for possible goroutine leak
Add comment about half request duration
* Format notification message
* Add UpstreamInventoryPong.SystemClock check
Andrew Burke