Modifies `auth.Middleware` to return a slice of interceptors
and uses `grpc.ChainUnaryInterceptor` and `grpc.ChainStreamInterceptor`
instead of our custom `utils.ChainUnaryServerInterceptors` and
`utils.ChainStreamServerInterceptors` equivalents.
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* fix forwarding a SSH agent in a Cygwin env
* added more comments
* use os.Getenv
* add examples to regex vars, make formatting of guid more clear
* parse strings as uints, improve error messages
* make it more clear uint32s are used for UIDs
* turns out calling "bash" isn't needed
It was required for compatibilty reasons - v13 proxy could connect to v12 agents,
which didn't support signed PROXY headers. But we don't need it in v14.
This PR adds a RBAC controll logic for Kubernetes Custom Resources.
Access to clustom resources is determined by the access level of the
namespace resource where the custom resource is defined.
This is a special case because custom resources are not defined in the
user's resources list.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* feat: Login Rule support for email.local and regexp.replace
This commit updates the `stringListMap` function to filter out values
that map to the empty string.
This is used by `email.local` and `regexp.replace` only.
The empty values were already being filtered out in
`(*TraitsTemplateExpression).Interpolate`, adding the filtering here
just makes it more convenient to call these functions in the Login Rule
parser in teleport.e where it's desirable to have the same behaviour of
`regexp.replace` filtering out values that don't match the expression.
The actual implementation and tests for the new helpers in Login Rules
is added in a buddy PR in teleport.e.
This PR also adds documentation for the new functions.
* apply docs grammar suggestions
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* adds public web addresses to self-signed cert
* skips adding ip addresses to self-signed cert
* skip error on public addresses
* lint fix
* optimize logic and log error
* Update lib/service/service.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* skip adding IP addresses to DNS SANS and log warning
* lint fix and update log message
* add public addresses into IP sans if ips
* remove comment
* lint fix
* include empty ipaddress for GeneratedSelfSignedCert calls
* removed
* update function call
* logic updates
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* handle when a IP addressed can't be parsed for self-signed cert
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* replaces unsafe.Pointer(&slice[0]) with unsafe.SliceData(slice)
* Adds utils.UnsafeSliceData
which converts the unsafe.SliceData edge case which returns a sketchy
"a non-nil pointer to an unspecified memory address" to an error.
This PR corrects the behavior of handling namespaces for Kubernetes
per-Resource RBAC.
The new behavior allows accessing the resources withing the namespace
`someNamespace` if a rule `kind: namespace, name: someNamespace` is
defined for `kubernetes_resources`.
It also allows users to see namespaces (list, get or watch requests) if
they have other resources defined for the namepsace without requiring
explicit rules for `kind:namespace, name: someNamespace`.
As an example:
```yaml
allow:
kubernetes_resources:
- kind: namespace
name: someNamespace
- kind: pod
namespace: otherNamespace
name: *
```
Reads as: the user has access to everything in namespace someNamespace
AND to pods in otherNamespace.
```
$ kubectl get ns
someNamespace
otherNamespace
```
Pods:
```
$ kubectl get pods -n someNamespace
pod1
pod2
$ kubectl get pods -n otherNamespace
pod3
pod4
```
Other resources:
```
$ kubectl get secret -n someNamespace
secret1
secret2
$ kubectl get secret -n otherNamespace
REQUEST IS DENIED
```
This change adds a service to the auth server that periodically iterates through
stored ServerInfos and updates the labels of associated SSH servers over their
inventory control stream.
If the upload completer fails due to a permissions error, emit a
warning indicating that the upload completer will not function
properly, but suppress the stack trace.
Closes#28999
* Set and distribute proxy group ID and generation
* Replace proxy tracker with a proxygroup-aware one
* Eager proxy deletion
* godocs
* restore and update tracker_test
* Mixed workload test with proxy groups
* limit connectionCount if there's fewer proxies
* package docs
* use ints for the generation
* Explicitly zero out the Atoi return value on error
* Check TELEPORT_UNSTABLE_PROXYGROUP_GEN at startup
It's now required to be empty or a valid uint64
* Pointer receivers for discoveryRequest, add docs
* track docs
* expand and document lease field names
* remove proxy deletion via gossip
* Poll the tracker
* restore TestAgentPoolConnectionCount
* Improve and deflake tracker tests
* Update track package docs
* Update cannotLease docs
Co-authored-by: Forrest <30576607+fspmarshall@users.noreply.github.com>
* docs for TryAcquire
* TODO for logging
---------
Co-authored-by: Forrest <30576607+fspmarshall@users.noreply.github.com>
This PR moves the creation of the `lock` file right before the login
call is attempted instead of creating it for any call.
This fixes a problem where we create the lock file even if no login is
required which limits the number of parallel kubectl invocations.
* Extend Teleport RBAC to suport Kubernetes Verbs
This PR extends Teleport per-Resource RBAC to support Kubernetes verbs
restriction. With this change it's possible to restrict certain actions
allowed by the underlying `kubernetes_users` and `kubernetes_resources`.
Supported verbs:
- `get`
- `create`
- `update`
- `patch`
- `delete`
- `list`
- `watch`
- `deletecollection`
Fixes#27095
* address timr's comments
* assign wildcard to verbs for role <7
* address marco's reviews
* tsh: Implement puttyconfig command to add saved PuTTY sessions to Windows registry
* Addressed comments from code review
* Add support for leaf clusters
* Refactoring from code review
Also moved registry/hostname functions into external packages
* Address more feedback from code review
* Rebase following tsh/common changes
* Fix up putty_config_windows
* Reorder command
* Remove surplus comment
* Use a separate list instead of overloading the 'extra' key
* Address Tim's code review comments
* Address some of Zac's comments
* Refactor formatLocalCommandString to use text/template
* Refactor non-Windows logic into puttyhosts
* Fix subcommand name
* Fix test structure
* Add some more hostnames test cases
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Fix up
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Generalize Kubernetes Resource RBAC
This PR generalizes the work introduced by #19613 to other resources
existent in the Kubernetes API.
It allows restricting access to different Kubernetes resources using a
single `kubernetes_group`.
`kubernetes_resource.kind` supports `*` and the following resources:
* Deployments
* Statefulset
* Secrets
* Configmap
* DaemonSet
* Job
* CronJob
* Namespace
* Services
* Nodes
* ReplicaSets
* Roles
* RoleBindings
* ClusterRoles
* ClusterRoleBindings
* PersistentVolumes
* PersistentVolumeClaims
* Ingress
* Certificates
* ServiceAccounts
Part of #20811
* address zac's feedback
The t.Log() function calls have been removed from most tests. This is to keep our test logs cleaner and more focused on error messages. Logging every detail in tests makes it harder to spot actual errors and relevant information.
This PR replaces the usage of `gravitational/oxy.Forwarder` in our codebase with `httputil.ReverseProxy`.
`httputil.ReverseProxy` is part of Go's standard library and thus it is
maintained by the Go team. Converting everything to use the std lib
allows us to drop our `oxy` fork.
There are some operational changes between the two versions:
1. `httputil.ReverseProxy` handles WebSockets upgrades internally and
reuses the `Transport` provided for the initial request. Thus, it does
not require any special dialer or rewriter mechanisms for WebSockets only.
2. `httputil.ReverseProxy` calls the `ErrorHandler` with the request
after it was rewritten and after roundtrip was called. This was a
problem because our `web.transport` deletes Teleport associated
cookies and when the request failed, the request received by the
`ErrorHandler` missed the cookies to generate a new session. This was
fixed by cloning the request at `web.transport` round tripper.
3. `httputil.ReverseProxy` uses std's `log.Logger`. `logrus` exposes a
method `Writer` that allows it to be used with standard lib logger.
The API is similar to what our `oxy` fork has available.
Fixes#27412
* Teleport Proxy Behind ALB support for IP Pinning
* move X-Forwarded-For handling to a middleware
* fix where middleware should be nil
* minor refactor based on review comments
* remove TODO and use contains
* use_x_forwarded_for -> trust_x_forwarded_for
* add NoopHTTPMiddleware
* InstallScripts: pin teleport version using ServerVersion
When Automatic Upgrades are enabled and the current installation is an
enterprise build, it will install teleport using:
- stable/cloud repo channel (yum, apt)
- pin the version to the one present at:
https://updates.releases.teleport.dev/v1/stable/cloud/version
* improve comments
* Add option to allow for host users not to be deleted
This adds a new role option called create_host_users_mode which allows
for it to be configured to not delete users when a session ends. The
old `create_host_user` option will be deprecated with this.
If the deprecated option is set, the new mode option will default to
dropping users as is the current behavior.
* add generated protos
* use combined output for commands, dont set CreateHostUser
* fix tests
* ci fixes
* add godocs to HostUserMode constants, fix tests
* remain -> keep
* Use an enum instead of a string
* fix merge errors
* Add tests & resolve comments
* Resolve issues
* fmt
* ai: add embeddings basic support
- add Embeddings service and its local implementation
- add Embedding type and proto message
- add nodeEmbeddingCollector tracking nodes
- add NodeEmbeddingWatcher watching for events adn sending them to the
collector
- add the Embedder interface and its openai implementation
* ai: adapt embeddings to the vector index
* fixup! ai: adapt embeddings to the vector index
* fixup! fixup! ai: adapt embeddings to the vector index
* Update lib/service/service.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* address feedback pt.1
* address feedback pt.2: store protobuf message in backend
* address feedback pt.3: have GetEmbeddings return a stream
* Update lib/services/embeddings.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* address feedback pt.4: extract embedding logic out of Embeddings service
* fixup! address feedback pt.4: extract embedding logic out of Embeddings service
* address feedback pt.5: simpler error handling when embedding fails
* fix tests pt.1
* fix tests pt.2
* fix tests pt.3
* [Assist] Replace embedding watcher (#27953)
Change the way how the embeddings are calculated. Instead of creating a watcher in Auth, we will process all nodes every hour and process embeddings if any embeddings are missing or any node has been updated.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
This PR introduces a new role version - `v7` - to support other
Kubernetes resources such as `Deployments`, `Statefulsets`... while
keeping compatibility with previous role versions.
This PR adds the following validations:
- `v6`, `v5`, `v4`: `kubernetes_resources` can only include `kind: pod`
resources
- `v7`: `kubernetes_resources` can include wildcards or other
resourceces (to be introduced by #26244.
It also adds a role version downgrade (v13 clients connecting to v14
auth server) where we downgrade the role's version and remove unsuported
kubernetes_resources from the resource list.
Part of #20811
This commit adds the new function `labels_matching` to the label
expression syntax. It accepts a Teleport-style glob or regular
expression, and returns the aggregate of all values for keys matching
that expression.
Since it is now more likely for users to want to compare two slices,
I've also added the `contains_any` and `contains_all` functions to
complement the existing `contains` function.
This commit also adds the `email.local` function that is already
available in role templates and should be useful.
Some examples are included in the new test cases.
* feat: support authenticating with AWS IAM for MongoDB Atlas
* chore(lint): fix errors
* test(tsh): add missing database field
* refactor(mongodb): check for error on each authenticator branch
* refactor(mongodb): update log messages and atlas check
* refactor(auth): use IsRoleARN helper instead of IsARN
* chore(db): remove unused line
* chore(mongodb): split authenticator func
* refactor(db): rename get atlas token function
* tests(db): reuse already existent auth property
* chore(mongodb): add docs reference
* refactor(db): support role chaining
* feat(types): "require" iam role for atlas users
* refactor(db): use external id only on the first session
* refactor(services): add new database matcher for regular users and aws
* chore(db): rename functions to be more assertive
* chore(types): fix lint
* test(db): remove duplicated test
The test being removed here is covered by `TestMongoDBAtlas`
(lib/srv/db/auth_test.go).
Okta Import Rules will now use Teleport style regexes as opposed to raw
regexp. This will maintain parity with the way the rest of Teleport handles
matching.
`lib/utils/typical` is a new library for building predicate parsers
based on the examples set by `lib/utils/parse` and `e/lib/loginrule`.
The commit updates `lib/utils/parse` to use the `typical` library to
implement the two parsers defined here.
This removes a lot of code in `ast.go` that was written for each
specific function to do type checking and deal with subexpressions. This
is all handled by the `typical` library now. My hope is that this will
make it much easier to add new functions in the future and to share them
with other parsers.
* feat: library for building predicate parsers
Took some things I learned while building Login Rules and implemented a
library that can be used to quickly implement new and improved predicate
parsers.
Copied from the package comment:
typical (TYPed predICAte Library) is a library for building better
predicate expression parsers faster. It is built on top of
[predicate](github.com/gravitational/predicate).
typical helps you (and forces you) to separate parse and evaluation into
two distinct stages so that parsing can be cached and evaluation can be
fast. Expressions can also be parsed to check their syntax without
needing to evaluate them with some specific input.
Functions can be defined by providing implementations accepting and returning
values of ordinary types, the library handles the details that enable any
function argument to be a subexpression that evaluates to the correct type.
By default, typical provides strong type checking at parse time without any
reflection during evaluation. If you define a function that evaluates to
type any, you are opting in to evaluation-time type checking everywhere that
function is called, but types will still be checked for all other parts of
the expression. If you define a function that accepts an interface type it
will be called via reflection during evaluation, but interface satisfaction
is still checked at parse time.
* fix typo in error message
Co-authored-by: Tim Buckley <tim@goteleport.com>
---------
Co-authored-by: Tim Buckley <tim@goteleport.com>
* Add a no-op syslog impl for Windows
* Break tctl's dependency on lib/srv
tctl's auth client depends on the lib/reversetunnel package in order
to dial the auth server via reverse tunnel. This package in turn
depends on lib/srv/forward and lib/srv, which is a bunch of
Linux-specific code for Teleport services (re-exec, etc).
By extracting the client side code for dialing via reverse tunnels
into its own package, we can now build tctl for Windows with the
following incantation:
CGO_ENABLED=1 GOOS=windows GOARCH=amd64 CC=x86_64-w64-mingw32-gcc go build -o tctl.exe ./tool/tctl
This commit updates all `err == io.EOF` comparisons to use
`errors.Is(err, io.EOF)`. This is necessary when the error may have been
wrapped and fixes at least one current breakage (in `tsh request ls`).
`golang.org/x/tools/refactor/eg` was very handy for this, I used the
following template:
```go
package teleport
import (
"errors"
"io"
)
func before(err error) bool { return err == io.EOF }
func after(err error) bool { return errors.Is(err, io.EOF) }
```
* check for correct kube listen address in starting message
* fix for ssh proxy and usage of String function
* remove consolef output and simplify output
* remove consolef output
* Remove consolef from services for startup
* fix imports
* remove all consolef usage
* * Use Stderr during headless login to fix rsync compatibility
* Improve error messages when attempting to login without a terminal
* Skip MOTD acknowledement when logging in without a terminal (headless,
sso)
* When attempting re-login without a terminal, make a debug log and
return the original error
* Return access denied error on unexpected handshake failures in tsh
proxy ssh
* Fix TestProxySSH test and add it to the flaky test detector testsToSkip
list.
