mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-25 10:40:02 +08:00
Tiago Silva
709c27dc3c
* Add UploadHandler replay-object storage for beam traffic replay
Introduce two methods on events.UploadHandler for the beam traffic replay
artifact:
- UploadReplayObject(ctx, sessionID, name, r) writes a named artifact
object (the manifest, or a numbered "index.N"/"blob.N" part) for a beam.
- StreamReplayObjectRange(ctx, sessionID, name, offset, length) returns a
ranged reader over one, so the replay service can page the index and
fetch individual payload/attachment byte ranges without downloading whole
objects.
Implement both on the S3, filesessions, and in-memory backends; GCS and Azure
return trace.NotImplemented (beams are only supported in teleport cloud
for now), and the external-audit-storage wrapper delegates to its inner
handler.
Object names are validated by ValidateReplayObjectName against a strict
allowlist (manifest | index.N | blob.N) before being joined into a storage
key/path. The name ultimately derives from a client-supplied PayloadRef sent
over the wire, so this prevents a forged name with path-traversal segments
(e.g. "../<other-session>.summary.json") from escaping the beam's object
namespace and reading arbitrary bucket/disk objects.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* address feedback
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>