Adds a separate PEM-encoded TLS certificate on KeyRing
(AccessGraphTLSCert) used to authenticate directly to the proxy's
Access Graph API. It reuses TLSPrivateKey and is persisted alongside
the other per-proxy artifacts at
<baseDir>/keys/<proxy>/<username>-access-graph.crt.
Included wiring:
- KeyRing helpers: AccessGraphTLSCertificate,
AccessGraphTLSCertValidBefore, and AccessGraphClientTLSConfig.
AccessGraphClientTLSConfig builds a tls.Config that trusts system
CAs rather than the cluster CA, since the client is speaking
directly to the public proxy.
- FSKeyStore: read, write, and delete of the new cert file. The
write and read go through a small helper that holds the same
write/read lock on the TLS key file used by writeTLSCredential,
so the AccessGraph cert cannot drift from TLSPrivateKey under a
concurrent key rotation. Load is optional, so keyrings without
the cert still work.
- MemKeyStore.GetKeyRing propagates AccessGraphTLSCert for parity
with the FS store.
- Store.GetKeyRing parse-validates the AccessGraph cert when
present, mirroring the existing TeleportTLSCertValidBefore call
for the main TLS cert. Expired certs round-trip unchanged, matching
the main TLSCert contract ("it's the responsibility of the
TeleportClient to perform cleanup").
Note:
- The identity file format was not updated to carry an AccessGraph
TLS cert, which would be a breaking change to a long-lived,
externalizable artifact. The tctl access graph workflow mints the
cert against the proxy on demand and persists it in the client
keystore, so identity-file portability isn't needed.
Tests:
- keypaths.AccessGraphTLSCertPath path formatter.
- FSKeyStore + MemKeyStore round trip of a distinct AccessGraph cert,
minted via a new signAccessGraphCert helper that mirrors the
production identity shape (Usage=UsageAccessGraphAPIOnly plus a
WebSessionID). Plus delete behaviour for present and absent cert
files on the FS store.
- Store.GetKeyRing: absent, valid, expired, and unparseable
AccessGraph cert paths. Expired round-trips; only unparseable is
rejected.
- KeyRing AccessGraph helpers: NotFound paths and tls.Config
construction (system-CA trust, ServerName=ProxyHost, MinVersion
TLS 1.2).
This is the client-side plumbing required by the tctl access graph
commands to obtain, persist, and reuse a proxy-facing TLS cert across
runs. Server-side session lifetime decoupling will follow in a
separate change.
* Set Teleport version in SSH clients.
Signed-off-by: Chris Thach <[email protected]>
* Add more tests. Fix lint.
Signed-off-by: Chris Thach <[email protected]>
* Fix import. Fix lint exclude.
Signed-off-by: Chris Thach <[email protected]>
* Fix lint - come on!
Signed-off-by: Chris Thach <[email protected]>
* Fix race by making a defensive copy.
Signed-off-by: Chris Thach <[email protected]>
* Use ErrorIs.
Signed-off-by: Chris Thach <[email protected]>
* Deep clone client conf. Early return for err. Make consistent.
Signed-off-by: Chris Thach <[email protected]>
* Return new conf if nil. Add trace.Wrap to missing.
Signed-off-by: Chris Thach <[email protected]>
* Add IsSSHFeatureSupported. Switch from api to api_test for test pack. Make prefix exported const.
Signed-off-by: Chris Thach <[email protected]>
* Revert accidental commit.
Signed-off-by: Chris Thach <[email protected]>
* Return sentinel error for older clients or non-teleport clients to improve downstream handling.
Signed-off-by: Chris Thach <[email protected]>
* Clean up.
Co-authored-by: Chris Thach <[email protected]>
* Apply suggestions from code review
Co-authored-by: Edoardo Spadolini <[email protected]>
* Remove defensive check.
Signed-off-by: Chris Thach <[email protected]>
* Change from trace.BadParam to reg error.
Signed-off-by: Chris Thach <[email protected]>
* Use strings.Cut and improve readability.
Signed-off-by: Chris Thach <[email protected]>
* Use error struct.
Signed-off-by: Chris Thach <[email protected]>
* Add test that errors if ssh.ClientConfig changes.
Signed-off-by: Chris Thach <[email protected]>
* Move to subpackage.
Signed-off-by: Chris Thach <[email protected]>
* Use static assertion instead.
Signed-off-by: Chris Thach <[email protected]>
* Return error if config is nil.
Signed-off-by: Chris Thach <[email protected]>
* Allow clients to override client version via config.
Signed-off-by: Chris Thach <[email protected]>
* Fix test because I forgot to update it.
Signed-off-by: Chris Thach <[email protected]>
* Move assert to test file.
Signed-off-by: Chris Thach <[email protected]>
* Remove error return val.
Signed-off-by: Chris Thach <[email protected]>
* Relax parser to allow for more.
Signed-off-by: Chris Thach <[email protected]>
* Fix lint.
Signed-off-by: Chris Thach <[email protected]>
* WIP take on a tracessh wrapper. Will fail CI.
Signed-off-by: Chris Thach <[email protected]>
* Add tests and polish new package.
Signed-off-by: Chris Thach <[email protected]>
* Revert changes to tracessh. Add lint config.
Signed-off-by: Chris Thach <[email protected]>
* Revert changes to use tracessh.
Signed-off-by: Chris Thach <[email protected]>
* Delete extra s.
Co-authored-by: Chris Thach <[email protected]>
* Apply suggestions from code review.
Signed-off-by: Chris Thach <[email protected]>
* Add IsEmpty helper methods.
Signed-off-by: Chris Thach <[email protected]>
* First pass of refactoring.
Signed-off-by: Chris Thach <[email protected]>
* Second pass refactor.
Signed-off-by: Chris Thach <[email protected]>
* Third pass refactor.
Signed-off-by: Chris Thach <[email protected]>
* Fix nil panic.
Signed-off-by: Chris Thach <[email protected]>
* Fix missing user value.
Signed-off-by: Chris Thach <[email protected]>
* Fix missing User value.
Signed-off-by: Chris Thach <[email protected]>
* Remove Get from name. Polish.
Signed-off-by: Chris Thach <[email protected]>
* Fix incorrect signers for clients. Make changes consistent.
Signed-off-by: Chris Thach <[email protected]>
* Allow ClientConfig to be empty in proxy config.
Signed-off-by: Chris Thach <[email protected]>
* Fix eager signers regression in generateClientConfig.
Signed-off-by: Chris Thach <[email protected]>
* Add edge case for space after prefix.
Signed-off-by: Chris Thach <[email protected]>
* Fix issues from code review.
Signed-off-by: Chris Thach <[email protected]>
* Drop suffix. Update comments.
Signed-off-by: Chris Thach <[email protected]>
* Update ClientConfig docs.
Signed-off-by: Chris Thach <[email protected]>
* Add warning about using the Teleport version.
Signed-off-by: Chris Thach <[email protected]>
* Teleport version is mandatory.
Signed-off-by: Chris Thach <[email protected]>
* Revert timeout to make Claude/Codex happy.
Signed-off-by: Chris Thach <[email protected]>
* Remove alias in places that didn't need it. Revert lib/cloud/gcp/alloydb.go.
Signed-off-by: Chris Thach <[email protected]>
* Add wrapper for tracessh.Client.
Signed-off-by: Chris Thach <[email protected]>
* Add tests for generate client config.
Signed-off-by: Chris Thach <[email protected]>
* Drop config from field name to shorten.
Signed-off-by: Chris Thach <[email protected]>
* Fix lint issues.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
Co-authored-by: Edoardo Spadolini <[email protected]>
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <[email protected]>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <[email protected]>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <[email protected]>
Co-authored-by: Nic Klaassen <[email protected]>
* Update linter to restrict using context.TODO() in Go tests.
Signed-off-by: Chris Thach <[email protected]>
* Revert changes to testlib package.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* Fix data race in e2e AWS tests
* replace pgx.Conn with pgxpool.Pool, which is safe for concurrent usage
* remove redundant mutex
* Format retry wait duration as a readable string
* Update healthcheck logger component
To disambiguate from normal user connections, the health checker will
use a new logger component: "db:health".
* Skip granting teleport-auto-user to Redshift admin
This is not necessary for Redshift and the syntax is not correct either,
because Redshift grants must use "GRANT ROLE" instead of "GRANT".
This removes a superfluous log message about bad grant syntax.
* Run proxy and local proxy tests sequentially
This potentially fixes test flakiness.
The Redshift deactivation and deletion SQL scripts both check
stv_sessions for active user connections, which can cause failures when
a parallel test is still running.
* Log on test cleanup failure
This consolidates all references to BoringCrypto and FIPS-140-2 to
a single section of the docs, using more generic FIPS terminology
elsewhere. As a result, we only need to change one place when we
update our FIPS module in the future.
In addition, mention the specific versions of BoringCrypto and
associated CMVP certificate numbers.
The scope of the certificate presented by agents to the reversetunnel
server is now tracked and stored with the remoteConn. Dial requests,
both local and via peers, are now populated with the scope the user
is logged into which the reversetunnel server uses to enforce that
dials for hosts are only honored if the target scope matches.
With this change rangeInternal will preserve the last used pageSize which prevents issues with excess allocations when every page contains items too large for a successful list call.
Towards: #61839
Changelog: Fixes client side pagination utilities to preserve page size between list calls which previously led to high memory consumption on the server side leading to crashes.
It is possible that the default page size will still exceed grpc
limits when user objects are large enough. This change will
use the auto page size adjustment in this case to attempt to recover
gracefully.
Fixes: #60933
* Added support for `tsh logout --proxy` to work without `--user` when one identity exists
* Fix lint
* Refactor
* Refactor
* Refactor and update log messages
This change allows tsh to treat corrupted private keys as though
they were not present (and trigger relogin flows) It also attempts
to prevent said corruption in the first place.
* [clientutils] Add CollectWithFallback helper
This helper is useful when migrating from non-paginated
to paginated resource getters. Internally it will use
auto page sizing for a given page getter and fall back
to unary getter when the remote does not support the new
RPC.
* Update api/utils/clientutils/resources_test.go
Co-authored-by: Chris Thach <[email protected]>
* Update api/utils/clientutils/resources_test.go
Co-authored-by: Chris Thach <[email protected]>
* Update api/utils/clientutils/resources_test.go
Co-authored-by: Chris Thach <[email protected]>
---------
Co-authored-by: Chris Thach <[email protected]>
Plugins had their own backoff utils when they were a separate repo,
but now that they're in Teleport's repo we can reuse existing retry
utils.
Closes#47102
* Proto changes
* Types changes
* Configuration changes
* Cloud client, `go.mod`
* Add method to fetch AlloyDB token
* Engine changes
* `make -C integrations/operator crd`
* lint fix
* `make -C integrations/terraform docs`
* change GCPCloudSQL comment in proto
* Update lib/srv/db/postgres/alloydb.go
Co-authored-by: Marco Dinis <[email protected]>
* Update lib/srv/db/common/auth.go
Co-authored-by: Marco Dinis <[email protected]>
* address review comments
* lint fix
* Rename `is_alloy_db` to `is_alloydb`
* Clarify comments for AlloyDB database fields in DatabaseGCP struct
* Nudge user towards proper permissions
* Update lib/srv/db/postgres/alloydb.go
Co-authored-by: rosstimothy <[email protected]>
* remove todo in favor of longer comment
* reduce indentation
* suggest custom IAM role with minimal required scope
* Major implementation update:
- new URI format `alloydb://<connection uri>`
- removed some configuration fields; added `gcp.alloydb.endpoint` instead
- added connection URI resolution against configured endpoint type
- made query cancellation and health checks aware of AlloyDB needs
- unified query cancellation logic to use the `connector` type
* Revert description changes for flags; these are redundant for AlloyDB
* Enhance error handling in ParseAlloyDBConnectionURI function and add comprehensive test cases for invalid URIs
* split `endpoint` into `endpoint_type` and `endpoint_override`
* Remove indentation from custom error messages
* Log resolved database address
* fix serialization test
* explain the logic in `getGCPType`
* use string instead of enum for endpoint type
* add missing cast
---------
Co-authored-by: Marco Dinis <[email protected]>
Co-authored-by: rosstimothy <[email protected]>
Setting this env var allows overwriting the max
size of a grpc message the client can recieve (default is 4MB).
Towards: https://github.com/gravitational/teleport.e/issues/6759
changelog: Add TELEPORT_UNSTABLE_GRPC_RECV_SIZE env var which can be set to overwrite client side max grpc message size.
This converts hand rolled collections of resources via ListFoo
RPCs in tctl and the cache to make use of clientutils.Resources.
The main driver for the change is consistency and simplifcation.
Having a single place that pagination logic exists should help
reduce the chances of any pagination bugs in the future. The helper
also reduces the amount of code needed at a call site to aggregate
resources.
The guts of clientutils.IterateResources have been moved to
clientutils.Resources which returns an iter.Seq2[T, error] instead
of the callback based approach. This makes the api simpler and allows
making use of the itertools/stream helpers. Additionally, the page
size used within clientutils.Resources was made to dynamically adjust
based on receiving any errors indicating that the max message size was
exceeding.
* go mod tidy all
* replace golang.org/x/exp/rand with math/rand/v2
* make go-generate
* revert github.com/go-webauthn/webauthn to v0.11.2
* update region regex
* revert github.com/ClickHouse/clickhouse-go/v2 v2.37.2
---------
Co-authored-by: Tim Ross <[email protected]>
* [vnet] feat: add SSH configuration diagnostic
This commit adds a VNet diagnostic that reports whether the default user
OpenSSH config file (`~/.ssh/config`) includes VNet's generated SSH
config file.
* fix lint
* fix license
* Render paths as code, use TextSelectCopy for snippet
* add code stying for path
* add ssh report to diag story
* handle ~/.ssh/config not existing
* handle unescaped windows path separators and single quotes
* fix typo in comment
* Diag report story: Include error when sshConfigAttempt is set to "error"
* read ~/.ssh/config as part of the diag instead of abusing cat
* fix lint
---------
Co-authored-by: Rafał Cieślak <[email protected]>
* Refactor connection sharing logic to allow reconnection logic.
* Refactor signature method into organized parts; Move signPromptMu further down the callstack to allow better concurrent access; Add attestMu to prevent certificate corruption.
* Handle PIV reconnection within doWithSharedConn.
* Add test; Fix issues.
* Add debug log.
* Clean up locks.
* Only prompt PIN on retry; Clean up prompt logic.
* Add todo for upstream PR.
* Prevent PIV operations that don't support concurrency from being run concurrently; add test.
* - Revert connection sharing refactors.
- Add exclusiveOperationMu mutex and test.
* Address comments; Move touch prompt into abandonableSign for clearer synchronous logic.
* Restore cancel cause behavior.
* Address signature concurrency comments.
* Fix signature channel.
* * Have hardware key agent validate known keys instead of always validating by the PIV slot cert.
* Refactor cert check logic with a custom error.
* Add test.
* Update rfd.
* Fix lint.
* Address comments.
* Require knownKeyFn to be provided.
* Require fallbackService to be provided to agent service.
* Address comments.
STeve (Xin) Huang