* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
When creating a reverse proxy the ErrorLog was being created
with the writer returned from logrus.WriterLevel. This writer
uses an io.Pipe and a goroutine to get any log messages written
from a standard log.Logger to our custom formated logrus.Entry.
The ErrorLog only ever omits output in a few very rare (hopefully)
error cases, which means we were creating an extra goroutine per
reverse proxy which in most cases would never be used to produce
any added output. Additionally, now that we are starting to support
log/slog, any output from a log.Logger will now be formatted via
our registered default slog handler. Meaning that we can still
get the benefits of producing output from the ErrorLog in the
desired format without the penalty incurred by using logrus.WriterLevel.
Partially addresses #36541.
* Copy pasta revert back to previous app redirection logic
Reverted parts of:
https://github.com/gravitational/teleport/pull/17592
Kept json field renames
* Remove unused fields (were renamed while back)
* Refactor previous implementation
- Create unique cookie for each state token created
- Preserve path and queries
* Split handlers
* Fix tests and lint
* Address CR
* Add backwards compatability
* Emit errs with invalid vals and attempt to delete session
* Update test
* Address CRs
* Fix lint
Prior to this commit, if a request through Teleport requires an upgrade
using Websockets, the request would fail because the Teleport
`http.ResponseWriter`wrapper used to catch the response status code
didn't implement the `http.Hijacker` interface.
This commit makes the `http.ResponseWriter` to implement the
`http.Hijacker` interface and being able to fullfil all required
processes in order to upgrade from HTTP to Websockets.
Fixes#36065Fixes#11712
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* adds ironrdp client and has it connect, alongside rdp-rs
* Integrates IronRDP client into the TDP png-response system. Instead of sending back chunks of the screen, its sends the full screen every time, and this is my running hypothesis for the current sticking point: a "Maximum call stack size exceeded" from the tdp client in the react app
* Changes arrayBufferToBase64 to use reduce, which fixes the "Maximum call stack size exceeded" bug
* removes convert_bgra_to_rgba which isn't needed with the bitmaps being produced by IronRDP
* Adds support for updating only a specific image region
* removes mistaken read_rdp_output_inner call from connect_rdp_inner
* Adds support for mouse input. I believe this code has race conditions for client.write_frame though this requires more research.
* Patches things up with the new IronRDP structure
Requires some modifications to IronRDP, see the corresponding commit hash
for IronRDP in lib/srv/desktop/rdp/rdpclient/Cargo.toml.
Started getting call stack overflows when manual testing again, but I'm
going to ignore those for now and focus on the version of this architecture
that passes the remoteFX encoded messages over TDP.
* Adds RemoteFX Frame to the backend
* Proof of concept for integrating a wasm module into the frontend
Building the wasm module still needs to be done manually, this was
just to get to a point where tools are configured and it can be successfully
called in both dev and prod modes.
Required that I comment out "default-src 'self'" in the CSP, this will
need to be figured out later.
We're also using a package called vite-plugin-wasm-pack whereas ironrdp
uses vite-plugin-wasm. I'm not sure why, I'm going to look into this and
swap out to vite-plugin-wasm if possible.
* Swaps out vite-plugin-wasm-pack for vite-plugin-wasm and adds build-wasm script to the teleport package.json.
vite-plugin-wasm-pack looks relatively unmaintained in comparison
to vite-plugin-wasm-pack.
build-wasm script is needed to build the wasm binary before calling vite [build]
* Adds backend structure for RPC PoC
Untested as of yet and it isn't pretty, but this more or less imitates the
RPC approach we have for directory sharing.
* hack solution which calls everything 'static. THIS IS VERY UNSAFE, WE SHOULD DO SOMETHING ELSE
* Gets the full display working end to end
with a particular commit of IronRDP. Unfortunately this commit is now
well out of date, and IronRDP had some bugs that were preventing RemoteFX
frames from being sent back.
* Full display working end to end with the updated IronRDP
* updates init_wasm_log to enable logging in the console
* updates hardcoded io_channel_id and user_channel_id
* Uses specific IronRDP sub-crates (i.e. ironrdp-session, ironrdp-tokio, etc.) rather than relying on whatever is re-exported from the ironrdp sub-crate itself
* Gets FastPathFrameResponse up to speed and the PoC is now working
* deletes all the rpc stuff which it turns out we don't need
* more cleanup including consolidating the FastPathFrame message between wasm and js, adding some comments
* Updates the documentation string for top level Client in lib.rs
* Removes hardcoded rdp server address, screen size, and username
* Swaps to online IronRDP repo
* Updates the TDP RFD with new messages
renaming them to be precise.
* remove hardcoded ip
* creates asRustBackedSlice
* removing some old todos
* Add cleanup for wasm-pack build artifacts to make clean
* Fix wasm in production builds (#27428)
* Converts the default Content-Security-Policy representation to a map
which makes it easier to programmatically add-to/overwrite the defaults
for special cases.
Also adds tests for the various custom CSPs.
* Alphabetize CSP directives for ease of testing/debugging in the future
* makes maps more easily composable
* removes commented code, and topLevelAwait() which was causing production builds to break
* Adds 'wasm-unsafe-eval' to the script-src section of the Content-Security-Policy
when a desktop session's url is detected.
The app already enforces no caching via the Cache-Control, Pragma, and
Expires headers (SetNoCacheHeaders), which means that any time the app
is requested in a new tab, the browser will always request a new index.html
which can be sent back with a new Content-Security-Policy header.
Since the only way to get to a desktop session is to either
click a link in the app which opens a new tab, or to open a new tab and
navigate to the url manually (this differs from most components, which can
be navigated to without a page reload using React Router), we can reliably
check each index.html request for a characteristic desktop session url path,
and only include the 'wasm-unsafe-eval' directive when strictly necessary
(in the spirit of the principle of least privilege).
* Removes vite-plugin-top-level-await from package.json
* moves regex to global so that it only need be compiled once
* CR fixes
updates Cargo.lock
removes commented feature flag
removes -framework SystemConfiguration
fixes makefile comment
* unsafe.SliceData
* fixes phrasing
* changes to docstring
* changes handle_tdp_fast_path_response to handle_tdp_rdp_response_pdu
so that its name is in line with its definition in RFD 0037 and
adds a more descriptive docstring.
* small fixes to comments
* preallocate RDPFastPathPDU Encode buffer
* updating comments
* Adds a detailed discussion of the Go/Rust Interface to the README (#29762)
* Aligns the codebase with the Go/Rust interface principles in the README (#29764)
* Move client functionality into Client (#29765)
* Adds the RDP Channel IDs TDP message (#27514)
* Refactoring `rdpclient` (#29766)
* Ironrdp recording playback (#28228)
* httplib.SetIndexContentSecurityPolicyWithWasm for recordings as well as desktop sessions so that the ironrdp wasm client can be used for recording playback
* Adds desktopplayback path to websocket proxy definitions so that it can be used with the dev server
* adds tdp.TypeRDPFastPathPDU as a tdp message to be recorded
* With this commit, recordings can be played back with the FastPathProcessor
Refactors tdp Client and subclass PlayerClient
such that now the classes are always constructed the same way,
and the internal representation of the screen size (the FastPathProcessor)
is either:
1. Created upon the call to Client.connect(spec) when spec is !undefined.
This is the case when the Client is being used for a desktop session.
2. Created when a client screen spec is received from the server. This is
the case when PlayerClient is being used for playback.
* Switches from sending the width/height via ur parameter string
to sending it via the client screen spec tdp message.
* changes tdpCli* to client* and adds a canvas* to the canvas related functions
* Static tokio (#30066)
* Beginnings of RdpdrBackend integration (#32814)
* Adds handling for the EstablishContextCall (#32971)
* Adds support for `ListReadersCall` and `ListReadersReturn` (#33004)
* Adds support for `GetStatusChangeCall`/`GetStatusChangeReturn` (#33056)
* Adds support for ConnectCall and ConnectReturn (#33136)
* Better error handling (#32925)
This change removes couple of unwrap that could cause panics on the Rust side and prevents panics from invalid cgo handle on the Go side.
It also sends error message from IronRDP to UI and cleans up a little final sequence of closing various goroutines in case of error or sessions end.
* Adds support for `HCardAndDispositionCall` with `ScardIoCtlCode::BeginTransaction` (#33192)
* `TransmitCall` and `TransmitReturn` (#33282)
* `StatusCall` and `StatusReturn` (#33284)
* `ReleaseContext` and refactor `handle_scard_call` (#33434)
* IronRDP clipboard sharing (#33335)
This change adds clipboard sharing to our IronRDP migration using ironrdp_cliprdr crate with out TDP-based backend (reused from rdp-rs times)
* Adds EndTransaction, Disconnect, Cancel, and IsValidContext (#33612)
* Adds support for `GetDeviceTypeId` (#33613)
* Adds support for `ReadCacheW` (#33618)
* `WriteCacheW` (#33620)
* Smartcard Login (#33712)
* `GetReaderIcon` (#33779)
* Update to IronRDP latest commit
* Removes a bunch of old deprecated code (including `rdp-rs`) (#33786)
* Pipes in `SharedDirectoryAnnounce` (#33911)
* Use tokio-boring for TLS upgrade (#33900)
This change switches TLS upgrade in our new RDP approach to tokio-boring in FIPS-compliant builds.
It also adds runtime check for FIPS mode.
Tested locally in custom Docker image.
* Update sspi (#34558)
* Break up rdpdr.rs, add support for the first directory sharing pdus (#34009)
* Adds support for `SharedDirectoryCreateRequest` and `SharedDirectoryCreateResponse`. (#34011)
* `SharedDirectoryDeleteRequest` and `SharedDirectoryDeleteResponse` (#34051)
* remove leftover code
* Server drive query information request (#34082)
* Rdp client refactor (#34122)
* Add handling for `DeviceCloseRequest` (#34139)
* Updates to `IronRDP` latest (#34744)
* Updates to IronRDP latest with a slightly different API
* remove defunct comment
* `ServerDriveQueryDirectoryRequest` and `SharedDirectoryListRequest/Response` (#34746)
* `ServerDriveQueryVolumeInformationRequest` and `ClientDriveQueryVolumeInformationResponse` (#34871)
* `DeviceControlRequest` (#34898)
* `Read` (#34914)
* `Write` (#34919)
* `SetInformation` (#35092)
* `LockControl` (#35146)
* Stack pr feedback and other cleanup (#35306)
* Adds desktop access websocket pattern to vite config
* Updates IronRDP to latest, removes manual context strings in favor of automatically generated (by this latest IronRDP commit) (#35392)
* Small line fixes, comment removal, changing license to AGPL
* Update Go/Rust interface section of README (#35590)
* Ironrdp manual docs (#35455)
* Remove unnecessary whitespace
* Refactor navigation paths in Active Directory documentation for clarity
Replaced textual descriptions with formatted paths using `>` symbols for better readability.
Having been subject to going through many such tutorials myself, I find this to be a more
user-friendly way of presenting the information. It's very common to need to go back and
forth between the documentation and the group policy manager, and having these paths in a
format that can catch the eye quickly is a big help. This also appears to be common practice
e.g.
- https://softwarekeep.com/help-center/how-to-enable-remote-desktop-on-windows
- https://www.helpwire.app/blog/remote-desktop-group-policy/
* Add instructions for enabling RemoteFX
* Add an optional step to the end of each GPO update subsection
This lets us point users to subsections individually without worrying
about reminding them that they need to run a `gpupdate /force` each
time (because its already right there in the subsection).
* lowercase "open"
* Updates configuration script to enable RemoteFX (#35461)
* Restructure Cargo workspace (#35591)
* Update `IronRDP` to latest, fix key log leak (#35707)
Updates IronRDP to latest with the changes necessary to keep up with the changes in https://github.com/Devolutions/IronRDP/pull/328. We select the `"rustls"` feature explicitly now, this is in line with our implicit choice of it as [the default](https://github.com/Devolutions/IronRDP/pull/325/files#diff-1f64036f3e460819b2b1e954803b7f266feca0e2787ca0614ae1253323944f59L19) before these latest changes.
Also creates a custom debug for `ScardBackend` so as to not leak `key_der` in the logs.
* Don't leak pin in the logs
* Updates CI to fix broken checks and builds caused by WASM introduction (#35401)
* removes SystemConfiguration framework (not sure why it was there).
* Updates cspell
* fixes TestSetRedirectPageContentSecurityPolicy
* Updates e ref to a currently-draft-PR ref.
* Fix per session mfa (#35902)
* Updating e-ref to tip of `master`
* dependency-review: Ignore cargo dependencies with invalid license specifications
* Updates OSS build-macos.yaml to support wasm-pack
---------
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
Co-authored-by: Mike Jensen <mike.jensen@goteleport.com>
* Fix duplicate entry for `X-Forwarded-For` header
PR #27761 replaced `oxy.Forwarder` with `httputil.ReverseProxy`.
The new forwarder based on `httputil.ReverseProxy` is appending the
`X-Forwarder-For` header values instead of replacing them.
This PR fixes that behavior and forces the XFF header to be a single
value.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/httplib/reverseproxy/rewriter_test.go
Co-authored-by: Reed Loden <reed@goteleport.com>
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Reed Loden <reed@goteleport.com>
* Refactors httpheaders.go to use a map[string][]string instead of a
map[string]string. This allows us to more easily stack multiple values
for the same csp directive.
* adds dedup
* uses utils.Deduplicate
* caches result of getIndexContentSecurityPolicy to improve performance
* Adds caching for SetAppLaunchContentSecurityPolicy
* moves caching to before combineCSPMaps so that we actually get significant improvements
* adds caching to SetRedirectPageContentSecurityPolicy
* make caches goroutine safe
* use an RWMutex because there are many more reads than writes
* Update lib/httplib/httpheaders.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
GKE Autopilot clusters deny impersonating `system:masters` kubernetes
group due to security reasons ( https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-security#built-in-security ).
Since it is the only product that enforces this and most administrators impersonate `system:masters`, this limitation has created too many difficulties in being understood.
First because the error is not clear enough and second because it doesn't explain what's the real problem and what part of the Teleport fails.
This PR tries to solve the problem by changing the original error message to a more user-friendly, one that better explains the problem and its origin.
Example of response body that is rewritten:
> Error from server (Forbidden): groups "system:masters" is forbidden:
> User "<user>" cannot impersonate resource "groups" in API group "" at the cluster
> scope: GKE Warden authz [denied by user-impersonation-limitation]: impersonating
> system identities are not allowed
The rewritten response body will look like:
> Error from server (Forbidden): "GKE Autopilot denied the request because it impersonates the "system:masters" group.
> Your Teleport Roles [role1,role2] have given access to the "system:masters" group for the cluster "<cluster>".
> For additional information and resolution, please visit https://goteleport.com/docs/kubernetes-access/troubleshooting/#unable-to-connect-to-gke-autopilot-clustersFixes#28506
This PR replaces the usage of `gravitational/oxy.Forwarder` in our codebase with `httputil.ReverseProxy`.
`httputil.ReverseProxy` is part of Go's standard library and thus it is
maintained by the Go team. Converting everything to use the std lib
allows us to drop our `oxy` fork.
There are some operational changes between the two versions:
1. `httputil.ReverseProxy` handles WebSockets upgrades internally and
reuses the `Transport` provided for the initial request. Thus, it does
not require any special dialer or rewriter mechanisms for WebSockets only.
2. `httputil.ReverseProxy` calls the `ErrorHandler` with the request
after it was rewritten and after roundtrip was called. This was a
problem because our `web.transport` deletes Teleport associated
cookies and when the request failed, the request received by the
`ErrorHandler` missed the cookies to generate a new session. This was
fixed by cloning the request at `web.transport` round tripper.
3. `httputil.ReverseProxy` uses std's `log.Logger`. `logrus` exposes a
method `Writer` that allows it to be used with standard lib logger.
The API is similar to what our `oxy` fork has available.
Fixes#27412
* Teleport Proxy Behind ALB support for IP Pinning
* move X-Forwarded-For handling to a middleware
* fix where middleware should be nil
* minor refactor based on review comments
* remove TODO and use contains
* use_x_forwarded_for -> trust_x_forwarded_for
* add NoopHTTPMiddleware
* Converts the default Content-Security-Policy representation to a map
which makes it easier to programmatically add-to/overwrite the defaults
for special cases.
Also adds tests for the various custom CSPs.
* Alphabetize CSP directives for ease of testing/debugging in the future
* makes maps more easily composable
* making string concatenation more efficient
* code review tweaks
* plain require.Contains
* Respect route exactness in TopNav
* Allow submitting CSRF token via form
* Skip "safe" methods in CSRF checks
* Export getXCSRFToken
* Add WithAuth2
* Passthrough "name" of FieldInput
Allows it to be used in an actual form
* icomoon: add hashtag icon
* Add GetAvailablePluginTypes to PluginService proto
* Expose ProxyPublicAddr
For use in Enterprise web Plugin
* Run prettier
* Factor out app.MetaRedirect
* Rename: WithAuth2 -> WithAuthCookieAndCSRF
* Run GCI
* Renegerate protos
The `http.Client.Transport` created in `newWebClient` wraps a
chain of `http.RoundTripper` over an underlying `http.Transport`.
Since we cannot guarantee that each `http.RoundTipper` has a
`CloseIdleConnections` method the usage of
`defer clt.CloseIdleConnections()` does not guarantee that the http
connections created during Find/Ping/etc are closed.
To prevent leaking connections implementations of `http.RoundTripper`
have added a `CloseIdleConnections` method added that forwards the
request on to the wrapped interface. The `otelhttp.Transport` does
not implement this method either so care has been taken to wrap it
in a `http.RoundTripper` which will call the root transport in
`enforceCloseIdleConnections`. An upstream issue has been filed
with otelhttp: https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3543
to get the method added to their `Transport` implementation.
This wasn't noticed prior to upgrading to go1.20 becuase prior to
[this](https://github.com/golang/go/commit/4e7e7ae1406c70d9cc0809ec11105a55a60a0b70)
commit the `ReadHeaderTimeout` set on the Proxy web api http.Server
would cause the connection to appear idle and get terminated by the
server.
`TestWebClientClosesIdleConnections` was added to capture the leak
in connections as reported in #22757 and prevent any regressions.
* Skip building webassets in CI
Building webassets is not always needed and many of our CI build just builds them and ends up not using them after.
This PR skips building the webassets for all pipelines where they are not needed. This should save us some time and $$.
* Make some changes to trigger CI
* Create the missing directory
* Change the application access auth flow to use a CORS POST request
* Remove auth state cookie
* Close the response body in tests
* Change the CSP to allow cross origin requests to the application
* Change the cookies to lax mode
* Update lib/web/app/handler_test.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Fix the proxy URL in tests
* Update webassets ref
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Move logic out of RoundTrip and into ServeHTTP as a middleware before handing off to oxy forwarder
* Move AWS signing service code into lib/utils/aws/signing.go
* use app server close context for audit event emitting
* add go doc comments.
* refactor request rewriting to make the copy in a more robust way.
* pass status code as uint32 rather than casting in audit emitter
* clone request instead of making a new request, and rewrite url to force https
* update header handling
* Set oxy forwarder to PassHostHeader=false to ensure the host header is
the URL being sought.
* Remove code that deleted forwarding headers previously, we should keep
those (X-Forwarded-*).
* Audit log the AWS Host sought rather than the incoming request Host
header (prior behavior maintained, we just rewrite the request
differently using Clone).
* Remove obsolete header copying helper func
This is a slightly more restrictive response header which will result in protecting the origin if the request is downgraded to http.
Although no http listeners exist within the service, this should be a safe and slightly more secure default for us to use.
Our need for customizing our security response headers primarily exists with the Content-Security-Policy. Other headers can be applied more broadly to provide safe defaults across our service.
This commit changes httpheaders.go to allow for the CSP to be applied separate from the other headers. Then the changes to httplib.go's handlers help make sure these headers are set generally (which we were already partially doing for caching directives).
Other changes were primarily making sure these tools are configured or used. Or a removal of previous settings as this function is now being handled more centrally.
* Forward traces from the web UI
Adds a `/webapi/traces` endpoint to the proxy web handler
to allow receiving traces from the UI so that they can
be forwarded to the configured exporter in the proxy_service.
To accomodate traces coming in via websockets the tracing
handler is updated to pull tracing context first from the
standard headers and fallback to retrieving it from a query
parameter as web sockets from the UI cannot alter headers.
Additionally update `web.Terminal` to propagate the tracing
context properly and instruments some of the functions
to ensure spans from the UI are properly correlated to spans
on the backend.
* feat: set cluster connector name on first user signin
* perf: move is passwordless enabled before get users
* fix: move logic to correct handler
* test: test setting default passwordless connector name for cloud (positive case)
* test: add negative test cases
* refactor: flatten nested code
* fix: remove return in case auth preference was not set
* fix: run logic only in cloud
* docs: typo
* fix: run when passwordless
* test: move trySettingConnectorNameToPasswordless as separete method
* docs: add safety comments
* test: rephrase safety comment
* refactor: remove space between call and error check
* fix: remove unnessesery error log from trySettingConnectorNameToPasswordless
* refactor: pass context, rename session context
* docs: add description to trySettingConnectorNameToPasswordless
* test: add descriptive assertion text
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* refactor: simplify error handilng
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* fix: check for non default setting
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: correct RPID
* refactor: simplify user creation
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* docs: fix typo
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: reorder name filed in the test cases struct
* test: better names for test cases
* refactor: generate token instead of hardcoding arbitrary value
* test: remove user agent header
* fix: check for empty password
* docs: add passwordless check description
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: add "first cloud sign-in does not change custom connector"
* test: use correct number of users in "first cloud sign-in does not change custom connector"
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* test: remove is cloud check from test helpers, instead use config
* refactor: store is_passwordless_registration in variable
* test: first cloud sign-in with password does not change connector
* refactor: change isPasswordlessRegistration name
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Tracing handlers consume a large amount of memory over time, which
makes using one per route suboptimal (See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/2413).
Wrapping all `http.Server` handlers with a tracing handler provides
the same tracing abilities for a fraction of the memory usage. A new
span formatter is added which allows servers to still contain the
request span in the span name.
* Add an installer script resource type and HTTP endpoint
* Add default installer scripts
* Resolve comments
- run `shfmt` over the installer script
- add MustNewInstaller
- move default installer logic to GetInstaller
- only include PublicProxyAddr in server.Config
* Resolve comments
- move from auth_with_roles -> auth/grpcserver
- document `MustNewInstallerV1`
* Add CSRF mitigations
This commit includes two fixes:
1. Enforce an application/json Content-Type server-side.
2. When checking the bearer token, verify that the user
associated with the token matches the user associated
with the cookie.
* Fix TEL-Q122-13: Access Requests Denial Of Service Via Request Reason (#125) (#127)
* Ignore input when data flow is off in TermManager
When data flow is disabled in TermManager (at the beginning or when TermManager.Off was called) we should ignore all input we receive (currently we buffer it)
* Agent forwarding socket security fix.
Co-authored-by: Lisa Kim <lisa@goteleport.com>
Co-authored-by: Joel <jwejdenstal@icloud.com>
Co-authored-by: Przemko Robakowski <przemko@przemko-robakowski.pl>
Leverage otelhttp to generate spans for http clients and http handlers.
Additionally add spans for grpc clients and servers by using the
otelgrpc interceptors. This is step one in implementation of RFD 65.
Until further work is done, the spans generated will be a no-op
until the tracing provider is initialized.
* Use forked httprouter with RawPath fix: gravitational/httprouter
* Enable UseRawPath everywhere.
* Test: allow MFA devices with `/` in names to be deleted
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Make k8s errors responses decode-able by kubectl
`kubectl` expects a k8s `Status` object in error responses.
Intercept generic handler errors and forwarder errors, and wrap them in
a `Status` object.
This commit introduces GRPC API for streaming sessions.
It adds structured events and sync streaming
that avoids storing events on disk.
You can find design in rfd/0002-streaming.md RFD.
Lisa Kim