* fix: tolerate mismatched key PEM headers
Issue #43381 introduced a regression where we now fail to parse PKCS8
encoded RSA private keys within an "RSA PRIVATE KEY" PEM block in
some cases.
This format is somewhat non-standard, usually PKCS8 data should be in a
"PRIVATE KEY" PEM block. However, certain versions of OpenSSL and
possibly even Teleport in specific cases have generated private keys in
this format.
This commit updates ParsePrivateKey and ParsePublicKey to be more
tolerant of PKCS8, PKCS1, or PKIX key data no matter which PEM header is
used.
Fixes#46710
changelog: fixed regression in private key parser to handle mismatched PEM headers
* fix typo in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* key split wip
* fix piv tests
* fix terraform tests
* spelling fixes
* fix kube benchmark
* fix identity files in integrations tests
* self review
* fix typo in comment
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* speed up device login tests
* use EC keys in TestProxyAppWithIdentity
* faster tsh tests
* fix race on error value
* fix lint
* write out EC SSH keys in OpenSSH format
* fix lint
* fix keyring comparisons
* PrecomputeTestKeys in lib/client
* parallelize TestNoRelogin subtests
* use ecdsa for self-signed TLS certs
* remove redundant GetTrustedCerts
* improve latency of precomputeTestKeys
Instead of waiting for all 25 test keys before returning a single one,
tests can now make use of the first precomputed test key as soon as it's
ready.
In local testing with this change, the first key is ready after ~75ms vs
>350ms on master.
* fix test and lint
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* disable tls client resumption
* avoid redundant verification in TLSDial
* fix wrong use of InsecureSkipVerify in HTTP auth client
* avoid overwriting GetClientCertificate in api client
* Use a getter function for CAs in TunnelAuthDialer
* Use dynamic connector data for the agent's auth client
* Make getPROXYSigner dynamic
* WIP: the thing (reloadless)
* Fix TestInstanceCertReissue
* Fix TestIntegrations/RotateFoo
* get rid of the whole reload mechanism
* Update most tests to not check for reloads
* Get rid of TestDatabaseAccess/RotateTrustedCluster
The test has been unconditionally skipped for two years now.
* avoid clobbering the auth connector
* overwrite clientState in update_servers anyway
* fix integration/hsm tests
* Document ListenForNewEvent
* fix RunWithSignalChannel godoc
* simplify ListenForNewEvents
* Remove forgotten commented code
* Explain the t.Setenv trick for non-parallelism
* explain waitingForNewEvent in integration/hsm
* consolidate (un)marshalling of key PEMs
This commit consolidates various functions we have for marshalling
private and public keys to and from the PEM format, mostly by replacing
functions from lib/utils and lib/tlsca with equivalents in api/utils/keys.
The new functions also support ECDSA and Ed25519 keys, which is
necessary for the implementation of RFD136.
* speed up TestMTLSClientCAs
* fix new use in local proxy middleware
* Save the WebAuthn UserHandle in the mock Key
* Simplify passwordless tests
* fix: Forbid SSO users from logging in using passwordless
* Rename tests to TestPasswordlessProhibitedForSSO
* Use testServer.MakeTestServer to fix issue with parallel runs using the same ports.
* Add deprecation comments for test server helpers outside of tools/teleport/testenv.
* Update tool/teleport/testenv/test_server.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Disable SSH resumption
Enable LoadAllCAs
Update comments
* Prevent context.Canceled from being wrapped across transport stream
trail doesn't properly handle conversions to and from errors that
are context.Canceled which results in code paths trying to evaluate
errors.Is(err, context.Canceled) failing. The error recevied is
an interceptors.RemoteError, which wraps a trace.TraceErr, which
contains a status.Status with codes.Canceled. To work around this
until trail is updated the server half of the stream was updated
to return an io.EOF if if encouters a canceled error.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
* Make the MFA for admin actions interceptor re-prompt for MFA when a request fails due to a reusable MFA response being denied by the server.
* Allow reused MFA for get/list tokens.
* Update api/utils/grpc/interceptors/mfa.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add fake yubikey private key implementation for tests.
* Add TestHardwareKeyLogin.
* Simplify Hardware Key support test plan.
* Enable piv test package in tests.
* Add TestMarshalAndParsePrivateKey.
* Address simple comments.
* Remove *testing.T from mockSSOLogin in; Add and use better helper methods for mocking sso login.
* Refactor test to dynamically set mock attestation data; revert related changes.
* Implement granular db permissions for Postgres (RFD 151)
* docs, whitespace
* Make sure query is closed, even in case of errors along the way
* fix imports
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Verify that intercepted stream Sends wrap io.EOF
* fix: Do not wrap io.EOF intercepted by stream Sends
* Use a helper func, fix duplicate Send/Recv calls
* Fix typo
* Refactor MFA ceremony logic to avoid creating challenges when the client has no way to solve it.
* Add client-side ErrMFANotSupported for better MFA ceremony error handling.
* fix: Do not attempt relogin on trace.BadParameterError
* Special case remote errors in IsErrorResolvableWithRelogin
* Do not wrap Recv EOF errors
* Fix various tests
* Use errors.Is to check for io.EOF
#36584 allowed routing to work for public addresses, however it
used GetPublicAddr to retrieve the public address. types.Server can
have multiple public addresses though which means routing was only
ever considering the first public address defined. This updates
the routing logic to use GetPublicAddrs so they are all considered.
* Support selecting db roles.
* add active roles in tsh db ls
* add select db role ut
* add a warning when connecting to older version
* review comments
* chnage slices import
* --db-roles to --db-role
* fix ut
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
Brian Joerger