mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 21:52:02 +08:00
Jeff Pihach
1513294b7b
* Add CreatedBy and CreatedOn fields to locks. * Move the setting of the CreatedBy and CreatedOn for locks to the server instead of the client. * Add tests for the tctl resource lock import and for the tctl lock create command. * Use clockwork for time in lock creation tests. * Make fake clock optional and use the golang 0 date. * Change CreatedOn to CreatedAt. * Allow a custom time to be passed through as a fake clock. * Actually accept a fake clock with useFakeClock. * Pass Clock through as a configuration value when initializing Teleport for the tests. * Test cleanup * Set CreatedBy and CreatedAt values in test mocks. * Fix failing test from enabling clock passthrough to auth.
104 lines
3.5 KiB
Go
104 lines
3.5 KiB
Go
/*
|
|
Copyright 2021 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package common
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/gravitational/kingpin"
|
|
"github.com/gravitational/trace"
|
|
|
|
"github.com/gravitational/teleport/api/types"
|
|
"github.com/gravitational/teleport/lib/auth"
|
|
"github.com/gravitational/teleport/lib/service/servicecfg"
|
|
)
|
|
|
|
// LockCommand implements `tctl lock` group of commands.
|
|
type LockCommand struct {
|
|
config *servicecfg.Config
|
|
mainCmd *kingpin.CmdClause
|
|
spec types.LockSpecV2
|
|
expires string
|
|
ttl time.Duration
|
|
}
|
|
|
|
// Initialize allows LockCommand to plug itself into the CLI parser.
|
|
func (c *LockCommand) Initialize(app *kingpin.Application, config *servicecfg.Config) {
|
|
c.config = config
|
|
|
|
c.mainCmd = app.Command("lock", "Create a new lock.")
|
|
c.mainCmd.Flag("user", "Name of a Teleport user to disable.").StringVar(&c.spec.Target.User)
|
|
c.mainCmd.Flag("role", "Name of a Teleport role to disable.").StringVar(&c.spec.Target.Role)
|
|
c.mainCmd.Flag("login", "Name of a local UNIX user to disable.").StringVar(&c.spec.Target.Login)
|
|
c.mainCmd.Flag("node", "UUID of a Teleport node to disable.").StringVar(&c.spec.Target.Node)
|
|
c.mainCmd.Flag("mfa-device", "UUID of a user MFA device to disable.").StringVar(&c.spec.Target.MFADevice)
|
|
c.mainCmd.Flag("windows-desktop", "Name of a Windows desktop to disable.").StringVar(&c.spec.Target.WindowsDesktop)
|
|
c.mainCmd.Flag("access-request", "UUID of an access request to disable.").StringVar(&c.spec.Target.AccessRequest)
|
|
c.mainCmd.Flag("device", "UUID of a trusted device to disable.").StringVar(&c.spec.Target.Device)
|
|
c.mainCmd.Flag("message", "Message to display to locked-out users.").StringVar(&c.spec.Message)
|
|
c.mainCmd.Flag("expires", "Time point (RFC3339) when the lock expires.").StringVar(&c.expires)
|
|
c.mainCmd.Flag("ttl", "Time duration after which the lock expires.").DurationVar(&c.ttl)
|
|
}
|
|
|
|
// TryRun attempts to run subcommands.
|
|
func (c *LockCommand) TryRun(ctx context.Context, cmd string, client auth.ClientI) (match bool, err error) {
|
|
switch cmd {
|
|
case c.mainCmd.FullCommand():
|
|
err = c.CreateLock(ctx, client)
|
|
default:
|
|
return false, nil
|
|
}
|
|
return true, trace.Wrap(err)
|
|
}
|
|
|
|
// CreateLock creates a lock for the main `tctl lock` command.
|
|
func (c *LockCommand) CreateLock(ctx context.Context, client auth.ClientI) error {
|
|
lockExpiry, err := computeLockExpiry(c.expires, c.ttl)
|
|
if err != nil {
|
|
return trace.Wrap(err)
|
|
}
|
|
c.spec.Expires = lockExpiry
|
|
|
|
lock, err := types.NewLock(uuid.New().String(), c.spec)
|
|
if err != nil {
|
|
return trace.Wrap(err)
|
|
}
|
|
if err := client.UpsertLock(ctx, lock); err != nil {
|
|
return trace.Wrap(err)
|
|
}
|
|
fmt.Printf("Created a lock with name %q.\n", lock.GetName())
|
|
return nil
|
|
}
|
|
|
|
func computeLockExpiry(expires string, ttl time.Duration) (*time.Time, error) {
|
|
if expires != "" && ttl != 0 {
|
|
return nil, trace.BadParameter("use only one of --expires and --ttl")
|
|
}
|
|
if expires != "" {
|
|
t, err := time.Parse(time.RFC3339, expires)
|
|
return &t, trace.Wrap(err)
|
|
}
|
|
if ttl != 0 {
|
|
t := time.Now().UTC().Add(ttl)
|
|
return &t, nil
|
|
}
|
|
return nil, nil
|
|
}
|