* remove lib/client dependency on lib/devicetrust/authn
* add cgo depguard
* fix typo
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Device Trust support for split SSH and TLS keys
* chalResp -> tpmChallenge
* clarify comment on sha256 import
* use input struct, crypto.Signer instead of keys.PrivateKey
* use trace errors in challenge package
* [devicetrust] fix: handle server errors in bi-directional streams
Fix an edge case in the devicetrust gRPC bi-directional stream handler where the stream could terminate with an error after the last client `Recv` call but before the next `Send` call.
Previously, this scenario caused the `Send` method to return an `io.EOF` error, which indicated that the connection was terminated but did not reveal any errors returned by the server.
This update ensures that the client continues to consume the stream until an error is returned, allowing for proper error handling and more robust stream management.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add license headers
* drop helper and local skip io.EOF errors
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Close streams on errors
* Rename fake_windows_device.go to fake_tpm_device.go
* Test enroll/authn ceremonies against Linux
* Allow Linux devices to enroll and authenticate
* Implement Linux TPM methods
* Attempt attestation without the event log on failures
* Rename others.go to device_others.go
* Move various functions to tpm_common.go
* Read device collected data on Linux
* Add the mode param to native.CollectDeviceData
* Add the mode param to collectDeviceData
* Run escalated `tsh device dmi-info`
* Write cached DMI info
* Read cached DMI info
* Avoid asset tags with spaces on them
* nit: Use deviceStateFolderName without a dot on Linux
* Test various data collection scenarios
* Fix macOS/Windows typo
* Start fleshing out UAC elevation
* Use `runas` and ShellExecuteW to open a child process with elevated privileges
* Add tsh command to re-execute
* Add method to be called in the elevated child process
* Ugly, but working, credential activation in UAC dialogued child
* Add TODO
* Add some further notes/explanation on windows.ShellExecute
* Change error message to match function name
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Improve comment
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Use `trace.BadParameter` instead of `Errorf`
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Use `tpm-activate-credential` instead of `activate-credential`
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Remove spurious newline
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Move towards more production ready elevated process
* Add stubs for darwin/other
* Use path in state dir for cred activation results
* Fix stub return values
* Fix test missing context.Context pass
* Add additional message when cred activation completes
* Use ShellExecuteExW to get handle to process to wait on
* Improve comment in windowsexec
* Minor stylistic changes from review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Minor adjustments to error handling and logging
* Use `windows` over `syscall`
* Leverage `mkwinsyscall`'s error handling
* Missing param in test
* Always show error, not just when `-d` is provided
* Remove unnecessary trace.Wrap(err)
* Restore cf.Debug check
* Explicitly ignore return values from `FPrintln`
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Simplify code
* Add null check to `info.hProcess`
* Minor format changes from review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Start of Windows support for authentication
* Finish clientside implementation of TPM device auth
* Rename getOSType -> getDeviceOSType everywhere
* More efficient byte trimming suggested by Zac
* Use `filepath.Join` rather than `path.Join`
* Add test for device auth
* Improve comments
* Log TPM closure errors
* Rename Auth -> Authn for clarity
* GoDoc for FakeDevice iface
* Use UserConfigDir rather than UserHomeDir
Implement the client-side device authentication ceremony.
Device authentication requires a previously registered and enrolled device. In
exchange for solving a challenge, the ceremony allows the user to augment their
certificates with device extensions, which are necessary to clear device-aware
authentication.
Wiring to `tsh` to be done in a follow-up PR.
gravitational/teleport.e#514
