* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* Depguard rules for the session submodule
* Move lib/auditd to session/auditd
* Move lib/loginuid to session/loginuid
* Reduce dependencies of lib/utils/envutils
* Move lib/utils/envutils to session/envutils
* Split the SSH utilities of sshutils/x11 into sshutils/x11forward
* Move lib/sshutils/x11 to session/networking/x11
* Move lib/sshutils/networking to session/networking
* Move lib/shell to session/shell
* Move lib/utils/uds to session/uds
* Move lib/utils/host to session/host
* Move lib/pam to session/pam
* Avoid lib/utils/log in session/pam
* Move lib/service/servicecfg.PAMConfig to session/pam/pamcfg.PAMConfig
* Move lib/srv/uacc to session/uacc
* Avoid importing lib/utils in session/uacc
* Move lib/selinux to session/selinux
* Avoid lib/utils and lib/utils/log in session/selinux
* make go-mod-tidy-all
* Update oss-fuzz path for session/networking/x11
* fix: optimizing api call and allow searching db users with no-wildcards for db users
* chore: addressing pr comments on renaming var and updating comments
* chore: updated based on pr comments to add more tests
* chore: refactor connct button dropdown state rendering
* chore: using t.context() directly in the test
* chore: cleaner refactor of ActionButtons logic
* chore: updated unifiedresoruces test to re-use the existing mock auth client
* chore: removing fallback as not needed for connect
* chore: remove unused api
* chore: reworked test and updated no wildcard logic
* chore: remove unused GetAllowedDatabaseUsers method
* fix: put back test that verifies correct logins are returned for a leaf cluster with access request
* fix: updated parameterpicket to account for allowOnlySuggestions when filtering
* Add privileged updater service
* Add integration tests for updater
* Review fixes
* Move privileged updater to its own module
* Fix comments
* Interpolate registry pathnames, switch errors to AccessDenied
* Improve error handling in `waitForSingleClient`
* Use stricter DACL for named pipe
* Close `conn` on context cancellation
* Move reading update meta to separate function
* `trace.LimitExceeded` -> `trace.Errorf`
* Fix test
* Ensure updater only allows HTTPS
* Use TLS server in tests
* Fix tests
* Update suggested reviewers to include owners of JIT access lists
* Replace undefined with empty array so data serialises without error
* Use consistent proto naming
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Remove unused req return value from reviewer list function
* Remove suggested reviewers logic from OSS API
* Tests and tidy up
* Refactoring
* wip
* Remove changes addresses in a separate PR
* Remove proto for reviewers
* Add godoc
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
Part 1 or removing InsecureDevMode - enterprise still relies on it
so a few TODOs were left around for clean up later. This global is
mostly leveraged in tests to permit trust when self-signed certificates
are used. These tests are often spinning up multiple teleport instances
and most of the time exercise trusted clusters which makes them slow.
Due to the global nature of InsecureDevMode these tests cannot be
run in parallel.
Removes some unnecessary code and refactors TestDebugService so
that it returns better errors and does multiple assertions instead
of bailing on the first failure.
* test: stabilize TestIntegrations/SessionRecordingModes by isolating per-subtest user/role state
Fixes#48043
`TestIntegrations/SessionRecordingModes` was flaky because the subtests
reused the same Teleport user and role while switching recording mode
between `strict` and `best_effort`. Under cache propagation
delay/staleness, one subtest could observe the previous subtest’s role
state, causing incorrect behavior (for example, `BestEffortMode` failing
with `ssh: could not start shell` as if strict mode was still active).
For local reproduction, I introduced a temporary debug cache fault to
drop role update events after initial cache population. With
`StrictMode` run before `BestEffortMode`, that reliably reproduced the
failure by forcing stale role reads in later subtests.
The fix removes shared mutable identity state from the test:
- create a unique Teleport user per mode subtest
- create a unique role per mode subtest
This makes each subtest evaluate recording mode against isolated auth
state, instead of depending on cache timing/order.
Validation:
- with the temporary cache fault enabled, the old test shape reproduced the failure while the isolated user/role version passed
- after removing the temporary fault, `go test ./integration -run 'TestIntegrations/SessionRecordingModes' -count=50` passes with the final code
* stop loading test keys into local SSH agent
* Display early debug logging for autoupdate tools in tsh
* Avoid reporting success on exec failure
* Use a shared lock in GetToolsConfig
* Return the selected tool from Updater.CheckLocal if available and ready
* Reexecute locally available client tools immediately
* Add a test for the fast reexec path
* fix expected, actual order in require
Before these can be consumed in OSS, the enterprise modules need to be
able to both override the global modules and update the configs so that
tests and builds do not break during the transition.
Contributes to https://github.com/gravitational/teleport/issues/62799.
* feat: Extend `AWSRole` struct w/ `RequiresRequest`
- Differentiate between already-granted vs. requestable AWSRoles when
including requestable resources in `clusterUnifiedResourcesGet`
req
* feat: Implement Resource Constraints support for Proxy, Auth
* fixup: Fix tests
* test: Add tests for resourceaccessid-related helpers
* fixup: Address code review feedback
* test: Update identity/events tests for new `ResourceAccessID` fields
* fixup: Expand/improve godocs/comments for sentinel ResourceID handling
* fixup: Address code review feedback
* feat: Conv ResourceID->ResourceAccessID at cert decoding
- Convert ResourceIDs present on certs to ResourceAccessIDs at decoding
time, rather than at each callsite. Update tests/usages of tlsca/sshca
Identities to reflect this.
In TestKube/Join, we previously used os.Pipe[1] to create stdin for the
test. However, os.File instances are implicitly closed when garbage
collected via a runtime finalizer inserted in newFile[2].
Under CPU-constrained conditions, the garbage collector can run
mid-test and detect that participantStdinW is no longer referenced.
This triggers the finalizer, which closes the writer file descriptor,
causing the reader to receive io.EOF.
Since Kubernetes terminates exec sessions when stdin closes, the EOF
can arrive before the client receives the server payload, causing the
test to fail intermittently.
Replacing os.Pipe with io.Pipe resolves this issue, as io.Pipe does
not use file descriptors and is not subject to finalizer-based cleanup.
[1] https://github.com/golang/go/blob/1b291b70dff51732415da5b68debe323704d8e8d/src/os/pipe_unix.go#L27
[2] https://github.com/golang/go/blob/1b291b70dff51732415da5b68debe323704d8e8d/src/os/file_unix.go#L224
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* [cfg] expose auth reconnect retry parameters in configuration
The new YAML config is as follows:
```
reconnect_backoff:
max_period: "90s"
min_period: "9s" # When unset max_period / 10
step: "18s" # When unset max_period / 5
```
Note that currently this only exposes the existing linear backoff, but
the naming here is generic enough that we could consider other policies if needed.
Changelog: Added a new global configuration section `reconnect_backoff` allowing users to configure the backoff behaviour for instances attempting auth connections.
* better naming
* fix ratios for defaults
* fix default config test
* clarify instance type
* Initialize default Username/HostLogin only in tsh
* Move `Username()` from `api.go` to `tsh.go`
* Remove wrong `Profile.SiteName` default
* Remove resetting `SiteName`
Not sure why it was needed. Perhaps to clear the default that we just removed? But even if add the default back and remove this fix, everything works.
* Gracefully handle missing SSH/TLS certs
* Remove unused `TeleportClient.LoadKeyForClusterWithReissue`
* Revert "Move `Username()` from `api.go` to `tsh.go`"
This reverts commit f7ff0ff6d1.
* Revert "Initialize default Username/HostLogin only in tsh"
This reverts commit ed38babf5e.
* When any of SSH/TLS cert is missing, return partial profile
* Only log non-nil errors
* Revert "Remove wrong `Profile.SiteName` default"
* Revert "Remove resetting `SiteName`"
This reverts commit f54ab3f22a.
* Set `SiteName` when adding cluster
* Improve comments
* Add test
* Fix test
* Add myself to TODO
* Add test for logging out with missing SSH cert
* Lint
The test was reliant on entering \a as input to a
session which signaled to sleep for 1s before writing
the data. This made the test undeterministic because
the 1s delays might not have been long enough for the
second party to have joined and start consuming the
session data.
This changes the test to validate that the appropriate
number of parties are in the session before proceeding
to the next step of the test. All \a have been removed
from terminal input as we now know for certain that the
session contains the appropriate parties before any
input is entered.
Closes https://github.com/gravitational/teleport/issues/25982.
Closes https://github.com/gravitational/teleport/issues/13699.
Several integration tests make use of the function to
know that a session was created, a SessionTracker was
created in the backend, and to retrieve the session id.
The function polled the backend for session trackers
until the context deadline set in individual tests
was exceeded. In an effort to reduce flakiness and
make the API easier for callers the helper has been
rewritten. It now leverages a require.Eventually
internally, has a hardcoded limit of 30s instead of
allowing each test to define their own, and validates
the number of expected participants in a session.
Closes https://github.com/gravitational/teleport/issues/17224.
Closes https://github.com/gravitational/teleport/issues/36959.
The test was reliant on all the output of a session being
replicated to all parties before a 5s timer closed the session.
To make the test more resiliant it was rewritten such that
it validates the expected output from one of the parties output,
then exits the session, then when all parties have been closed,
it examines the entire output of the other parties to validate
their output.
Fixes https://github.com/gravitational/teleport/issues/55044
The tests establish trust between two clusters, connect via SSH
to a host in the leaf, tear down trust, reestablish trust, and
then attempt another SSH connection. The flakiness stemmed from
tearing down and and reestablishing trust too quickly without
first properly verifying that the leaf cluster disappeared from
the root before reestablishing trust. While the test did make
use of `helpers.WaitForClusters`, it is satisfied if tunnels
for clusters were healthy within the last 10s. But this could
be true of a stale cluster that was not yet cleaned up. To
remedy this the test was updated to first wait for the reverse
tunnel for the leaf cluster to be completely gone before
reestablishing trust and proceeding.
Closes https://github.com/gravitational/teleport/issues/60836.
Closes https://github.com/gravitational/teleport/issues/48823.
The changes here are meant to reduce resources consumed by
integration tests and eliminate the footgun of connecting to
a host before its been populated in the appropriate caches.
`(integrationTestSuite) defaultServiceConfig` now disables more services
by default. Host user creation, the Web UI and Web Service, and the
Database Proxy are all now turned off by default. The tests that require
them can opt into turning them on.
`(TeleInstance) Start` now blocks until the processes SSH server is present
in caches before returning. Most tests were already calling this manually
after Start, however, not all of them were. This is frequently forgotten
in new tests and causes flakes if client connections are attempted as
soon as Start returns. There are still cases where calling WaitForNodeCount
directly applies - tests that spin up additional nodes or tests that create
nodes in a leaf cluster.
The datadir in this test consists of TempDir
and typically suffix which exceeds the
BSD socket limits causing the test to fail on MacOS.
This commit disables the debug service in the failing tests,
for testing the debug service specifically it should be
enabled in the test itself.
This test previously passed in CI, relying
on slower machines and fails locally on both
Mac and in buildbox on macbook pro m3 with:
```
cluster site-A is offline
```
Adding the wait resolves the issue.
* Include expiration time in `LoggedInUser`
This will allow the profile watcher to detect when the user relogged.
* Display expiration time in UI
* Add `ClearStaleClusterClients` RPC
* Implement `ClearStaleClusterClients`
* Clear stale clients when profile changes
* Improve session expiration component
* Move refresh button back to top
* `ClearCachedStaleClientsForRoot` -> `ClearStaleCachedClientsForRoot`
* `unchanged` -> `stale`
* Make "closing stale clients" a subtest
* Add `clientcache` test
* Remove `getProfile` error wrapping
* Improve comment
* Convert story to controls
STeve (Xin) Huang