This eliminates the SigningService in favor of a free function
SignRequest, which eliminates AWS credential loading and simplifies the
AWS utils package.
In the process of doing this refactor, the AWS app handler has been
changed to use AWS SDK v2 to load its credentials as well.
* Reissue kube certs when assuming access request
* Fix and add tests
* Explain when the cert can be not found
* Replace `clearCertsFn` with `middleware` field
* Improve iterating over gateways
* Improve a comment
* Update type for targetSubresourceName on DocumentGateway
The way DocumentsService.createGatewayDocument is implemented means that
the targetSubresourceName property is always present, but it can be undefined.
* Use "local port" instead of "port" in DocumentGatewapApp
* Rewrite gateway FieldInputs to use styled components
* Update comments in protos
* useGateway: Stabilize useAsync functions of ports
* Add padding to menu label if it's first child
* Add support for required prop to Input and FieldInput
* Add UI for changing target port
* ActionButtons: Show ports of multi-port apps when VNet is not supported
Now that we have support for the target port in Connect's gateways, we
can show the ports and then open a gateway for that specific port on
click.
* Add RWMutex to gateways
* Clear app gateway cert on target port change
* Remove gateways/app.LocalProxyURL
It was used only in tests and it made sense only for web apps anyway.
* TestTCP: Close connections when test ends
* Create context with timeout in testGatewayCertRenewal
…instead of in each function that uses it.
* Add tests for changing the target port of a TCP gateway
* Parallelize app gateway tests within MFA/non-MFA groups
* Make testGatewayConnection take ctx as first arg
This will be needed in tests that check target port validation.
* Validate target port of app gateways
* Increase timeouts in app gateway tests
* Change icons from medium to small
* Use consistent spacing in AppGateway
* Add godoc for ValidateTargetPort
* Add retry with relogin to change target port
Converts most items to use servicecfg.Config.Logger instead of
servicecfg.Config.Log. The deprecated logrus logger unfortunately
cannot be removed yet as it's still used in e. Additionally all
logging within the config package was converted to use slog.
* Add UpsertTrustedClusterV2 rpc
This supersedes UpsertTrustedCluster rpc. V2 performs resource name
validation.
* Replace confusing UpsertValidationTrustedCluster name
* Use UpsertTrustedClusterV2 in tests
* Address feedback
- Remove unnecessary ping
- Update error messages
- Use skipNameValidation consts
- Validate cluster name before establishing trust
- Do not reveal cluster name in error message
- Use BadParameter instead of CompareFailed
* Use webclient.Find
* Fix test/lint
* Allow label updates
* Fix test
* Fix error handling
* Implement CreateTrustedClusterV2 and UpdateTrustedClusterV2
* Address feedback
* Minor fixes
* Move V2 RPCs to the trust service
* Update comment
* Drop V2 suffix
* Require matching revision
* Fix upsert/update revision
* Drop V2 from Create and Update APIs
* Lint: Fix typo
Closes#47156.
All of the tests suffering from issues dialing hosts, and failing
with a `failed to dial target host` error were incorrectly waiting
for nodes to become visible before establishing connections. The
main culprit for most of the failures was `waitForNodesToRegister`,
though a few tests had a very similar hand rolled variant, which
incorrectly returned when the nodes appeard in Auth. However, since
the Proxy is the one performing dialing, they should have waited
for the nodes to appear in the Proxy.
To resolve, `waitForNodesToRegister` and all hand rolled equivalents
have been removed in favor of `(TeleInstance) WaitForNodeCount` which
correctly uses the `CachingAccessPoint` of the RemoteSite instead
of `GetClient`. Additionally, `helpers.WaitForNodeCount` was updated
to validate that the node watcher used for routing in the Proxy
also contained the expected number of nodes.
* Allow passing custom prompt to YubiKey
* Handle `prompt.Touch` cancellation
* Pass `HardwareKeyPrompt` through all the layers
* Add an empty `HardwareKeyPromptConstructor` to Connect
* Remove `ParsePrivateKeyWithCustomPrompt`
* Add missing godoc
* Fix teleterm tests
* Include `cliprompt.go` only for `go:build piv && !pivtest`
* Lint and test fixes
* support key algorithms for host identities
* add signature_algorithm_suite to webapi/find
this fixes joining through the reverse tunnel port which doesn't expose
webapi/ping
* exclude alpn upgrade connections from PROXY line enforcement
When clients use multiplex mode behind a TLS-terminating load balancer (LB), Teleport circumvents this limitation by establishing a connection that is upgraded to WebSockets.
On the upgraded WebSocket connection, clients initiate a TLS handshake and send their actual requests.
However, when `proxy_protocol: on` is enabled, the proxy line validation is re-applied to the upgraded connection, causing the request to fail. This occurs because the LB only included the proxy line in the initial WebSocket request, which was consumed. After the upgrade, the connection is routed to the ALPN router, and if it reaches the Kubernetes Proxy, it tries to enforce the presence of the PROXY line.
Since the PROXY line was not present, the request failed.
This PR excludes websocket upgraded connections from PROXY line validation.
* rephrase error message and rename function
* simplify code by unwrapping till net.Conn
* Fix wrong context usage for reissuing expired certificate for tsh proxy kube.
* Rename context to closeContext
* Add test for request context expiration.
* Add missing context in tests.
* Remove flakiness from the test.
* Add generic app proxy implementation.
* Incorporate forwarding proxy in generic app proxy.
* Utilize cert checker middleware for http local proxies.
* Use generalized local proxy app for aws.
* Use generalized local proxy app for azure.
* Use generalized local proxy app for gcp.
* Refactor, simplify, and unify app logic logic for app, proxy app, and
cloud commands.
* * Load existing app certs before reissuing new certs for proxy app
commands
* Fix the same intended functionality for tsh proxy db
* Fix hardware key test for tsh app login.
* Remove unused code.
* Fix merge conflict.
* Address Gavin's comments.
* Restore RetryWithRelogin for app commands by making missing profile status a retryable error; cache profile status in appInfo.
* Address Tim's comments.
* Remove read lock.
* Add tests to CertChecker and LocalCertGenerator.
* Fix lint.
The shell package requires cgo and by importing it in lib/client,
which all client tools have in their dependency tree, it prevents
them from building without GCO_ENBALED=1.
Updates https://github.com/gravitational/teleport/issues/43112.
* Add support for per-session MFA in databases by using the cert returned from `onExpiredCert`
* Remove test helpers that are not needed anymore
* Add integration tests requiring per-session MFA to be supported
* Make `Application` in `MFA is required to access Application "abc"` lowercase
* Refactor `DBCertChecker` to fit Connect needs and remove `dbMiddleware`
* Remove unnecessary condition in a test
* Convert positional arguments to `dbGatewayCertRenewalParams`
* Do not nest the function to issue a db cert
* Remove mongodb check from `reissueDBCert` in tshd
* Revert "Do not nest the function to issue a db cert"
This reverts commit c3a9bf2cf3.
* Revert "Refactor `DBCertChecker` to fit Connect needs and remove `dbMiddleware`"
This reverts commit e01861071e.
* [vnet] app proxying
* Make uri.AppendLeafCluster noop if name is empty
This makes it easier to converting profileName + leafName combos into
URIs.
* Make sure daemon.Service.NewClusterClient sets MFAPromptConstructor
* auth -> authclient
* remove unnecessary changes in teleport storage
* plumb clock and test cert refreshes
* s/zeebo/testify
* fix tcp echo handler
* only login to one cluster at a time
* add godoc comments in clientcache
* test cert expiry, serialize clock advances
* add comments on relogin mutex
* typo fix
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Refactor joining code into lib/auth/join
auth.Register and auth.RegisterParams were moved into the new package
to prevent clients(tbot) from depending on lib/auth. For the moment
only iam joining has been moved into the new package. All other
join methods have been left behind in their lib/auth/join_foo.go
file and will be addressed in future PRs if need be. This removes
lib/auth entirely from tbot and reduces its binary size by ~10-20MB.
* fix: disabling second factor auth in tests
* fix license
* Move imds related code into their own packages
Separating imds from cloud vm, kubernetes, etc. prevents the
dependency tree expanding to include extra cloud related things
for callers that only require an imds client.
* Move cloud constructors for types.KubeCluster out of lib/services
lib/services is meant to be a relatively dependency free package
that provides basic interfaces and functions for dealing with
types. NewKubeClusterFromGCPGKE, NewKubeClusterFromAWSEKS, NewKubeClusterFromAzureAKS
caused a slew of cloud related dependencies to be imported in
lib/services which increases binary sizes of client tools.
They have all been moved into lib/srv/discovery/common since
they were only consumed by other code in lib/srv/discovery.
* Decouple servicecfg and lib/auth/keystore
This was the last remaining way for lib/cloud/gcp to slip
into client tools that aren't importing lib/auth directly.
```
goda tree "reach(github.com/gravitational/teleport/tool/tctl...:all, cloud.google.com/go/compute/apiv1)"
├ github.com/gravitational/teleport/tool/tctl
└ github.com/gravitational/teleport/tool/tctl/common
├ github.com/gravitational/teleport/lib/config
├ github.com/gravitational/teleport/lib/pam
└ github.com/gravitational/teleport/lib/service/servicecfg
└ github.com/gravitational/teleport/lib/auth/keystore
└ github.com/gravitational/teleport/lib/cloud
└ github.com/gravitational/teleport/lib/cloud/gcp
└ cloud.google.com/go/compute/apiv1
└ github.com/gravitational/teleport/lib/service/servicecfg ~
├ github.com/gravitational/teleport/lib/service/servicecfg ~
├ github.com/gravitational/teleport/tool/tctl/common/accessmonitoring
└ github.com/gravitational/teleport/lib/service/servicecfg ~
├ github.com/gravitational/teleport/tool/tctl/common/loginrule
└ github.com/gravitational/teleport/lib/service/servicecfg ~
├ github.com/gravitational/teleport/tool/tctl/sso/configure
├ github.com/gravitational/teleport/lib/service/servicecfg ~
└ github.com/gravitational/teleport/tool/tctl/sso/tester
└ github.com/gravitational/teleport/lib/service/servicecfg ~
└ github.com/gravitational/teleport/tool/tctl/sso/tester ~
```
* fix lints
* tidy integrations/event-handler
* fix license
* fix: only populate cloud clients if aws kms configured
* Remove authclient.Client/ClientI/NewClient aliases in lib/auth
* Remove WebSessionReq aliases in lib/auth
* Remove GithubAuthResponse aliases in lib/auth
* Remove GithubAuthRequest aliases in lib/auth
* Remove KubeCSR alias in lib/auth
* Remove KubeCSRResponse alias in lib/auth
* Remove OIDCAuthResponse alias in lib/auth
* Remove OIDCAuthRequest alias in lib/auth
* Remove ValidateOIDCAuthCallbackReq alias in lib/auth
* Remove OIDCAuthRawResponse alias in lib/auth
* Remove CreateUserTokenRequest alias in lib/auth
* Remove SAMLAuthResponse alias in lib/auth
* Remove SAMLAuthRequest alias in lib/auth
* Remove ValidateSAMLResponseReq alias in lib/auth
* Remove SAMLAuthRawResponse alias in lib/auth
* Remove ValidateTrustedClusterRequest alias in lib/auth
* Remove ValidateTrustedClusterRequestRaw alias in lib/auth
* Remove ValidateTrustedClusterResponse alias in lib/auth
* Remove ValidateTrustedClusterResponseRaw alias in lib/auth
* Remove AuthenticateUserRequest alias in lib/auth
* Remove ForwardedClientMetadata alias in lib/auth
* Remove PassCreds alias in lib/auth
* Remove OTPCreds alias in lib/auth
* Remove SessionCreds alias in lib/auth
* Remove AuthenticateSSHRequest alias in lib/auth
* Remove SSHLoginResponse alias in lib/auth
* Remove TrustedCerts alias in lib/auth
* Remove AuthoritiesToTrustedCerts alias in lib/auth
* Move auth.HostFQDN to authclient
* Move auth.WithClusterCAs, auth.DefaultClientCertPool and auth.ClientCertPool to authclient
* Switch alpn proxy to use authclient.CAGetter instead of auth.ReadProxyAccessPoint
* Use a smaller scoped interfaces in lib/proxy/peer to remove lib/auth dependency
* Move auth.TryCreateAppSessionForClientCertV15 to authclient
* Move auth.ErrNoMFADevices to authclient
* Move access point interfaces to authclient. Aliases left behind to prevent breaking builds
* remove lib/auth dependency from lib/reversetunnelclient
* fix lints
* fix license
* Bump e ref to include gravitational/teleport.e#4174
* Use authclient.Client in new tctl diag commands
* Stop using auth.UserTokenType aliases
Creates a new lib/auth/state package that now contains all items
related to process identity and local storage. Since these things
are consumed by client tools isolating them in their own package
will allow tools to trim the dependency tree by shedding lib/auth
for a smaller package. No functional changes have been added in
addition to moving code around. There are aliases to the old
types left around to prevent breaking builds. They will be removed
in a follow up when teleport.e is updated to consume the new package.
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* Wire context.Context into `auth/register.go`
* Thread `context.Context` through `auth.Register` and add tracing
* Unwrap error before recording it in the span
* Keep track of whether the user has a real password set
* lint
* Some comments
* Fix TestCreateResources
* Fix e/ link
* Review
* Review
* Review
* Use early return on error in DeletePassword
* Fix the broken teleterm test
* Use dbcmd.WithPrintFormat only for preview of teleterm gateway command
* Update comments for GatewayCLICommand message
* Mark check funcs as helpers, verify args length first
* Use `Daemon.ResolveClusterURI` instead of `Storage.ResolveCluster` to set a cluster in the cache
* Fix tests in `daemon_test.go`
* Add regression test
This test fails on master but not on this branch. It's largely based
on existing MFA tests that we have in integration/proxy/teleterm_test.go.
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Cast logged URIs to strings
* Remove unnecessary client.Close()
addToCache is called only if c.clients[clusterURI] returns nil.
Get calls getFromCache and returns early if there's a client in the cache
already.
* Disable client cache in teleterm local proxy integration tests
* Enable automatic upgrade server by default
This commit means the proxy now serves automatic upgrade channels by
default. The default channel is "default" and its version is the
teleport proxy binary version.
This commit also fixes a bug with the automatic update version server
returning `teleport.Version` instead of `"v"+teleport.Version` when the
version was too high. This was not a critical issue because agents are
supposed to tolerate versions not prefixed with 'v'.
* lint
* thread safety
* Update lib/automaticupgrades/channel.go
* Update lib/config/configuration.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* fix tests and lint
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
This legacy connection mechanism uses SSH to connect to the Proxy
and tunnel the Auth connection. It was replaced by the
(TeleportClient) ConnectToCluster which uses gRPC to reduce latency
when connecting to the cluster.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Add middleware for app gateways
* Accommodate for app gateways in integration tests
The previous version of tests depended on receiving helpers.TeleInstance
from higher up. It was then used to generate valid and expired user certs,
as well as to get client.TeleportClient.
proxy.Suite (Kube tests) and dbhelpers.DatabasePack (db tests) expose
helpers.TeleInstance so it wasn't a problem. However, appaccess.Pack,
which we're going to use for app access tests, does not expose it.
To work around that, we introduce two new fields to gatewayCertRenewalParams,
tc (which accepts client.TeleportClient) and generateAndSetupUserCreds.
These two fields get rid of the dependency on helpers.TeleInstance.
* Add integration tests for app gateways
* Improve error handling in gateway/kube_test.go
* Make gatewaytest.mustGenCertSignedWithCA public
It will be needed to generate and then return cert without saving it to
a file.
* Move AddMetadataToRetryableError to where it's actually needed
Cluster.reissueDBCerts is called in two scenarios:
* During the request to create a db gateway: this request is made by
the Electron app, so we need to add metadata to let the app know that
this error can be resolved by relogin.
* When someone attempts to use the proxy but the user cert has expired:
this happens outside of the Electron app request-response cycle and
thus adding metadata is unnecessary.
* Make gatewaytest.MustGenCACert public, accept CA for MustGenAndSaveCert
This will make writing tests where we need to supply either Cert or KeyPath
and CertPath a little bit easier.
* Kube gateways: Store cert in memory instead of on disk
* Add ctx to testGatewayCertRenewal
If a gateway requires MFA, daemon.Service.CreateGateway can potentially
block forever. To work around this, we want the tests to pass a context
around so that we can set a timeout on the context in MFA tests.
* Convert test function args into structs
This will make it easier to pass webauthnLogin for tests that need MFA.
* Refactor handling of mock tshd events service addr
* Add tests for MFA
* Do not save kube key in local agent
Connect issues a new cert for every gateway anyway.
* Check kube certs after issue in teleterm gateways
This makes sure that Connect does the same checks as tsh.
* reissueDBCerts → reissueGatewayCerts
* Pass mfaPrompt from daemon to GatewayCreator
This also fixes a problem where the mfaPrompt passed from GatewayCreator
was not the expected one. daemon.Service.ResolveClusterURI attaches
MFAPromptConstructor on clusterClient. However, GatewayCreator does not
call daemon.Service.ResolveClusterURI, it calls
clusters.Storage.ResolveCluster which does not attach the proper prompt
constructor.
* Refactor GetPromptReasonSessionMFA into WithPromptReasonSessionMFA
* Verify that PromptMFA on tshdEventsService gets called during MFA ceremony
* reissueKubeCert: Get rid of unused mfaRequired var
* Use fake storage in gateway CRUD tests
Now that daemon.Service.CreateGateway needs a TeleportClient, we have
to use a fake storage that's able to provide it.
* Fix synchronization between webauthnLogin and PromptMFA
* Use sync/atomic for function call counts
* Use default upgrade channel
This commit:
- initializes default upgrade channels based on the server features
- makes all integrations use the upgrade channels instead of hitting
hardcoded s3 bucket
- makes the version channel return its own version if the target
version is too high
- makes the NoVersion handler properly: returned as an error. This way
soneone relying on the version getter doesn't have to check
- moves the version kube-agent-updater lib in main teleport libs
- add tests for noVersion channels
* Update lib/web/join_tokens.go
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* address marco's feedback
* address marco's feedback pt.2
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* Reorganize process config test fields
* Move PollingPeriod back from Testing field
* Fix comment text
Co-authored-by: Nic Klaassen <nic@goteleport.com>
---------
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Brian Joerger