The appaccess TestTCP* tests are highly reliant on time. This has been
reduced (but not eliminated) by using a fakeClock and a channel for
signaling monitor triggered connection closures.
* Ensure that TrackingReadConn and TrackingReader conform to io.Reader
Implementations of io.Reader should return io.EOF directly when the end of
the stream is reached, because callers will compare the error using ==.
* Update lib/srv/monitor_test.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Use require.Equal for conn_test.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
This fixes a bug where desktop sessions that are closed by the user
leak the connection monitor goroutine, forcing it to continuously
check for idle connections, while failing to close them because
they were already closed.
Prior to this change, desktop access only respected locks
on users or roles. This introduces a desktop as a lock target,
preventing new connections and terminating existing connections
to a locked desktop.
Note: when a lock is created, connection attempts will fail
with the generic "websocket connection failed" error.
This will be addressed with #8584.
Updates #8742
When disconnecting a client due to an expired certificate, the monitor
was emitting the disconnection event before forcing the client to
disconnect. This led to races in tests that wait on the disconnection
event, where tests would:
1. wait for the disconnection event before proceeding
2. receive the disconnection event
3. take action based on the disconnection event, assuming that the
client was disconnected, when there is no guarantee that the
disconnection has actually happened yet.
This patch re-orders the disconnection and event broadcast, such that
the disconnection happens first, meaning that if a watcher receives
the disconnection event, then the disconnection has already been
attempted.
* Add RBAC for Windows desktop access
This commit adds RBAC checks for Windows Desktops as described in
RFD 33 and RFD 34:
- add Windows desktop logins & labels to role definition
- introduce new file config for host labels based on a regexp match
- auth server API performs access checking for Windows desktop resources
- add RDP client callback to authorize the user
- support user/role locks
- respect the client idle timeout setting
Note: in cases where an connection is terminated to to RBAC, the web UI
currently displays "websocket connection failed" because the connection
is closed from the server. We'll need to follow up with a nice error
message for the client side to improve the UX here.
Other changes:
* Remove OSS RBAC migration marked for deletion
* Stop creating a default admin role
* add wildcard desktop access to the preset access role
Updates #7761
* Adds the idle_timeout_message to the auth_service config file block
* Plumbs the value through to the session monitor
* Writes the message to stderr when a session times out due to inactivity
* Adds some machinery to the test helpers to configure appropriate tests
See-Also: #6091
* Update logrus package to fix data races
* Introduce a logger that uses the test context to log the messages so they are output if a test fails for improved trouble-shooting.
* Revert introduction of test logger - simply leave logger configuration at debug level outputting to stderr during tests.
* Run integration test for e as well
* Use make with a cap and append to only copy the relevant roles.
* Address review comments
* Update integration test suite to use test-local logger that would only output logs iff a specific test has failed - no logs from other test cases will be output.
* Revert changes to InitLoggerForTests API
* Create a new logger instance when applying defaults or merging with file service configuration
* Introduce a local logger interface to be able to test file configuration merge.
* Fix kube integration tests w.r.t log
* Move goroutine profile dump into a separate func to handle parameters consistently for all invocations
This commit introduces GRPC API for streaming sessions.
It adds structured events and sync streaming
that avoids storing events on disk.
You can find design in rfd/0002-streaming.md RFD.
This is the lowest-level transport we have after SSH session is
established. Any data going either direction indicates some activity.
Note: we also track writes from server to client as activity. If a user
starts a script that prints something every minute and steps away, the
session should keep going as long as `client_idle_timeout > 1m`.
This also fixes things like large SCP transfers.
Looks like impersonated users do not get 'system:authenticated'
as a default. This leads to kubectl to fail for some restricted users,
who don't have 'system:discovery' like permissions added to the roles.
This commit always injects the group if not present in the request.
See https://github.com/kubernetes/kubernetes/issues/43227 for a similar
solution
This commit implements disconnects of kubernetes
clients with expired certificates and terminates
idle sessions, according to 'disconnect_expired_cert'
and 'client_idle_timeout' existing settings making
the behavior consistent with SSH sessions.
Isaiah Becker-Mayer