* Update Go version to v1.26.4
* Rm GO_VERSION from Makefile/Dockerfile and rely on go.mod to inform Go version. Update code to adhere to 1.26 deprecation/changes.
Signed-off-by: Chris Thach <[email protected]>
* Bump e to 54d1d0cb67b71860b943de477b3146d32ccdd74a.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
Co-authored-by: teleport-renovate[bot] <275214890+teleport-renovate[bot]@users.noreply.github.com>
Co-authored-by: Chris Thach <[email protected]>
* Apply `pnpx codemod run pnpm-v10-to-v11`
* Remove `eslint` hoisting, it's in the root package.json anyway
* `pnpm install`
* Bump Node.js to 24.15
* Bump pnpm to 11.1.1
* Update pnpm to 11.3.0
* Update `electron` to 42.2.0, `electron-builder` to 26.11.1
* Update `node-abi` to 4.31.0
* Override `yauzl` to workaround Electron not being installed on Node.js 24.16
* Update Node.js to 24.16
* Bump Playwright to 1.60.0
* start the refactor away from aquasecurity/libbpfgo to use cilium/ebpf
Remove debug statements and unused code in BPF library
This commit eliminates unnecessary debug log statements from bpf_test.go and removes unused code in disk.go and network.go files within BPF library. The aim is to make codebase cleaner, enhancing readability and maintainability without losing track of functional aspects. It's part of an ongoing effort to maintain optimal code quality across the project.
Revise Dockerfile and Makefile instructions
Adjusted Dockerfile and Makefile commands to optimize build process. The changes ensure better readability and maintainability of code, especially with respect to BPF bytecode and test preparations. A clause was also added to check for the presence of clang before building BPF bytecode.
Refactor BPF code and tests
Refactored BPF source code and its corresponding tests for better readability and efficiency. This includes updating data structures like rawExecEvent, rawOpenEvent, rawConn4Event and rawConn6Event to their more meritorious versions like commandDataT, diskDataT, networkIpv4DataT and networkIpv6DataT respectively. Also, generated concise and clear bindigs for eBPF programs to replace the previous multi-arch setup. Furthermore, correspondingly adapted all related test cases arising in bpf_test.go, command.go and other files.
Remove counter_test from BPF and related test code
This commit removes the file counter_test.bpf.c from the enhanced recording in BPF. Following this file deletion, corresponding test functions in bpf_test.go, that were originally testing the functionality provided by counter_test.bpf.c, have been removed as well.
Refactor BPF test and improve error handling
The commit refactors the BPF test suite to run each test as a sub-test by using t.Run, easing debugging and error tracing. It also simplifies the 'executeCommand' function by removing redundant function calls related to finding executable files, and improves error handling. In 'cgroup.go', the code has been adjusted to retry on EBUSY errors when removing a cgroup, instead of ignoring them.
Update cgroup deletion process and error handling
The changes made introduce a retry mechanism when deleting a cgroup in case the cgroup is busy. This prevents a failed attempt from immediately returning an error. Additionally, error handling has been improved in the 'writePids' function to better handle 'no such process' errors.
Enhance cgroup monitoring in disk.bpf.c
The code has been updated to check if current cgroup is being monitored in the "enter_open" method of "disk.bpf.c". If the cgroup is not marked for monitoring, it will be ignored, enhancing overall cgroup management.
Improve resource handling
This commit introduces a deferred close to the sendEvents function to ensure proper resource handling of the eventBuf object.
Add rlimit package to remove resource limits
Introduced the "github.com/cilium/ebpf/rlimit" package and added a function to remove resource limits for kernels less than 5.11. This operation is necessary for kernels with a lower version because they may face issues when running applications with allocated memory limitations.
Fix a test after rebase
Refactor BPF testing setup and implement session closing
This commit updates the BPF testing structure to remove the context dependency in event generation functions, simplifying the test setup. Additionally, it adds a 'closed' field to the 'open', 'conn', and 'exec' structs alongside mutex protection. This implementation allows checking if a session is closed before any operations, correctly handling already closed sessions. Furthermore, it corrects tracepoints for handling 'openat' and 'openat2' system calls for different platforms. This refactoring effort aims to improve the robustness and readability of the BPF testing suite.
Update conditions for BPF bytecode building
This update modifies the Makefile to add a conditional check for the presence of /usr/include/bpf/bpf_helpers.h. This new requirement must be met along with the existence of /usr/include/linux/bpf.h and the installation of Clang, in order to facilitate the correct build of BPF bytecode. Consequently, this change enhances the reliability of the build process.
Add conditional for bpf_helpers.h in Makefile
This commit adds an additional check in the Makefile for the existence of /usr/include/bpf/bpf_helpers.h. This ensures that BPF bytecode only gets built when both bpf.h and bpf_helpers.h exist, and Clang is installed, improving the build process reliability.
Refactor and improve BPF bytecode generation
This commit refactors and improves the BPF bytecode generation process. It introduces distinct bytecode structures for different architectures, ensuring better compatibility and execution. The BPF test is adjusted due to its tendency to fail unpredictably, hence it's commented out to avoid unnecessary build failures. This commit also eliminates certain redundancies in `common.mk`, improving the clarity of the build process.
Comment out test code in bpf_test.go
The test code in the file bpf_test.go has been commented out. These changes are circumstantial and do not imply that the test code is obsolete or unnecessary. The use of such tests may be needed in future commits or for local development testing and debugging.
Remove libbpf dependency from Vagrantfile and update README
The Vagrantfile and README have been updated to remove the no longer needed libbpf dependency. This change simplifies the project set up by eliminating unused build steps in the Vagrantfile and correcting related instructions in the README. This results in a more streamlined, intuitive build process and reduced potential for code complexity and dependency conflicts.
Remove obsolete dependencies and related code blocks
The 'aquasecurity/libbpfgo' library referencing and the related code blocks have been removed from the test files and core modules. The corresponding setup instructions in the dockerfiles and build scripts have also been eliminated. This update simplifies the build process and overall project structure while reducing unnecessary dependency risks.
Remove aquasecurity/libbpfgo dependency
Remove restricted.bpf.c
Migrate disk events to cilium
Migrate network events to cilium
Remove restricted session
Use cilium/ebpf for BPF
* fix build issues caused by stale branch
Also updated bpf bytecode, updated github.com/cilium/ebpf to 0.19.0,
and updated bpf/README to reflect changes
* fix tests and a bit of cleanup
Also added a subtest and fixed receiving IPv6 network events and
fixed attempting to create tracepoints for syscalls that are not
present on arm64.
* repurpose buffer size configs to set event channel buffer size
* add new GHA job to check that generated eBPF files are up to date
* fix lost event promethus counters and address feedback
* address feedback
* use only unsafe instead of CGO to convert C strings
* rename common_data_t comm -> command
* convert strings in bpf programs from char arrays to u8 or uint8 arrays so we can convert them to Go strings without the use of the unsafe package
---------
Co-authored-by: Jakub Nyckowski <[email protected]>
Co-authored-by: Tim Ross <[email protected]>
* chore: Bump Go to 1.25.2 ⬆️
Signed-off-by: Chris Thach <[email protected]>
* fix: Bump to Go 1.25.3. Revert handling of breaking changes.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* Add rust toolchain file
* Determine rust version by checking the top level toolchain file. Remove overrides.
* Remove explicit overrides and target installation from workflows.
* Remove from macOS build docs any language about installing specific rust toolchains or setting overrides. We're relying on the toolchain file and rustup to quietly install and use the toolchain(s) specified by the toolchain file.
* Always re-install wasm-bindgen if the currently installed version is out-of-date
* e submodule invokes the 'rustup-set-version' target, but it is not needed now that we have the toolchain file. Leave this target in for now so that we don't break the build. We can clean it up later.
* Remove target that install wasm toolchain. It is no longer necessary.
* Fix awk expression that extracts rust version from the toolchain file.
* Fix comment and remove explicit rust toolchain install from lint workflow
* We still need to ensure that rustfmt and clippy are installed on machine that runs rust lint.
* Get a Teleport build working without wasm-pack
* * seed docker images with wasm-opt, and wasm-bindgen-cli
* Replace potentially confusing 'CARGO_TARGET_wasm' variable.
* Replace oneoff .gitignore with a corresponding entry in the top level .gitignore.
* Replace 'printf' used to create package.json file with a cleaner multiline string.
* Remove unnecessary 'NEED_VERSION'
* Use awk to find wasm-bindgen version without using 'cargo' since it doesn't seem to be available on ARM64 runners
* Move 'WASM_BINDGEN_VERSION' definition out of versions.mk
* Pass '--locked' flag to wasm-opt install
* chore: Bump Go to 1.25.1
Update all Go modules to use Go 1.25.1.
* Use stable synctest API introduced in Go 1.25
All existing tests that used synctest have had their build
constraints removed and have been updated to use synctest.Test
instead of synctest.Run. There are still tests in teleport.e that
needs to be updated before we can remove GOEXPERIMENT=synctest
and retire the synctest build tag.
* Remove coverage from go test invocations
This is a temporary workaround to https://github.com/golang/go/issues/75031.
When the buildboxes have Go 1.25 installed globally this should no
longer be an issue and coverage can be restored.
* Lazily unmount cgroups
Adds the MNT_DETACH flag to the cgroups unmount call to workaround
issues stemming from a behavior chagne in Go 1.25 to support
automatically setting GOMAXPROCS. In doing so the Go runtime
interacts with cgroups to determine what limits should be applied
which interferes with our ability to clean up.
Fixes https://github.com/gravitational/teleport/issues/58879.
* Fix syntest bug with waitgroups
```
=== Failed
=== FAIL: lib/srv/discovery TestDiscoveryServerEKS (unknown)
fatal error: sync: WaitGroup.Add called from multiple synctest bubbles
```
The failure stems from a bug in Go 1.25 and is a result of loading
aws configs which internally use a sync.WaitGroup. This can be worked
around in the short term by mocking out the aws.Config since the test
is configured to use a mock eks client anyway. Other tests may still
run into this issue until Go 1.25.2 - though our relatively small number
of synctest usage at this point may limit our exposure to said bug.
* chore: Bump Go to 1.24.7
Signed-off-by: Chris Thach <[email protected]>
* refactor: remove toolchain directive
Signed-off-by: Chris Thach <[email protected]>
* fix: revert aws go.mod
Signed-off-by: Chris Thach <[email protected]>
* chore: update Go version to 1.24.7 for terraform-mwi
Signed-off-by: Chris Thach <[email protected]>
* fix: Go lint issues
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* Add shasum for pnpm in packageManager field
The shasum was generated by executing `corepack use [email protected]`.
* Make corepack use updated keys
* Export keys where needed instead of saving to $GITHUB_ENV
* Add COREPACK_INTEGRITY_KEYS to Dockerfiles and build.ps1
teleport-renovate[bot]