* support `where` RBAC on application session recordings
application session recordings are backed by AppSessionChunk events, but
those events were never wired into the session recording RBAC path, so
`where` clauses on `kind: session` rules could not match them.
Fixes https://github.com/gravitational/teleport/issues/67775
Signed-off-by: Tiago Silva <[email protected]>
* fix unit test
* handle feedback
---------
Signed-off-by: Tiago Silva <[email protected]>
* app access: improve handling of overlapping public addrs
This change improves Teleport's handling of multiple apps with the
same public address by selecting apps based on both the app name
and its public address (rather than the public address alone).
This selection happens both at the proxy (in order to select an
app_service), and at the app service (in order to select the right
app from the set of apps the agent serves).
The change is backwards compatible, if the app name is not provided
then the selection happens based on public address alone, matching
the prior behavior.
It's worth noting that Teleport has always encoded the app name
in certificates for the CLI-based (tsh apps login) flow, but the
web UI's browser flow has not been including the app's name until
now. As a result, users will need to update auth, proxy, and app
agents to get the full set of fixes.
Note: there's still one pre-existing issue that remains unsolved.
We should address this separately. When a user navigates directly
to an app's FQDN in the browser without first having a valid session,
then addr-based resolution is the only option available. As of now,
this check is not RBAC-aware, and can select an app that the user
doesn't have access to. (There is no authz bypass, the user will get
an access denied error, but we should make this deterministic).
Fixes#67462
* Make FQDN-only resolution RBAC-aware
This covers the web UI case where a user navigates directly to an
app's FQDN without a valid Teleport session or without first clicking
launch in the Teleport UI.
Prior to this change, we'd select an app with a matching FQDN at
random. This selection wasn't RBAC-aware, so we could end up picking
an app the user doesn't have access to, guaranteeing they see an
access denied error.
* Add a leaf cluster integration test
* Update lib/auth/grpcserver_test.go
Co-authored-by: Michael <[email protected]>
---------
Co-authored-by: Michael <[email protected]>
This is a pass on replacing modulestest.SetTestModules with supplying modules
where already possible. Some additional uses of modules.GetModules were also
replaced with localized modules injection to permit the removal of
modulestest.SetTestModules in tests. Most of the changes here are mechanical,
the one notable change is in TestSSHCommands. The test was not passing locally
because the shell (fish) builtin echo behaves differently. The easiest way
to produce expected output was to change the command invocation to use
/bin/echo to bypass any shell builtins for consistent behavior.
Inject modules into tool tests
Inject modules into integration tests
Inject modules into join server
Remove superflous enterprise modules in TestAuthenticationConfig_Parse_deviceTrustPB
Inject modules into signature algorithm config tests
Inject modules into TestGithubConnectorCRUDEventsEmitted
Inject modules into TestGetHierarchyForUser
Inject modules into kube proxy tests
Inject modules into controller tests
make fix-imports
add integration/app/fixture as test package
* test(appaccess): ensure applications are served by the started agent
* Update integration/appaccess/pack.go
Co-authored-by: rosstimothy <[email protected]>
---------
Co-authored-by: rosstimothy <[email protected]>
* Teleport MCP demo server
* replace guide tool with session tool, and switch to resource label
* add new flag to teleport configure
* replace teleport_session_id with mcp_transport_type
The new package is meant to house a test friendly implementation
of modules.Modules. Due to the pervasive and global nature of
modules, this package also contains a copy of of
modules.SetTestModules. In a perfect world this function wouldn't
be needed and modules would be injected where required, however,
that would take considerable effort. The existing test modules
are temporarily left in place until the enterprise tests can be
updated to use modulestest.
* Update type for targetSubresourceName on DocumentGateway
The way DocumentsService.createGatewayDocument is implemented means that
the targetSubresourceName property is always present, but it can be undefined.
* Use "local port" instead of "port" in DocumentGatewapApp
* Rewrite gateway FieldInputs to use styled components
* Update comments in protos
* useGateway: Stabilize useAsync functions of ports
* Add padding to menu label if it's first child
* Add support for required prop to Input and FieldInput
* Add UI for changing target port
* ActionButtons: Show ports of multi-port apps when VNet is not supported
Now that we have support for the target port in Connect's gateways, we
can show the ports and then open a gateway for that specific port on
click.
* Add RWMutex to gateways
* Clear app gateway cert on target port change
* Remove gateways/app.LocalProxyURL
It was used only in tests and it made sense only for web apps anyway.
* TestTCP: Close connections when test ends
* Create context with timeout in testGatewayCertRenewal
…instead of in each function that uses it.
* Add tests for changing the target port of a TCP gateway
* Parallelize app gateway tests within MFA/non-MFA groups
* Make testGatewayConnection take ctx as first arg
This will be needed in tests that check target port validation.
* Validate target port of app gateways
* Increase timeouts in app gateway tests
* Change icons from medium to small
* Use consistent spacing in AppGateway
* Add godoc for ValidateTargetPort
* Add retry with relogin to change target port
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* feat(events): add event indexer based on time
* chore(events): code review changes
* chore: typos
* Apply suggestions from code review
Co-authored-by: Alan Parra <[email protected]>
* chore: code review changes
* test(integration): ignore index field on audit events
---------
Co-authored-by: Alan Parra <[email protected]>
The Cf-Access-Token header seems to be a infrequently used header that can
easily increase the size of the header by `len(roles) + len(traits)`, which
can cause problems. Users are able to add this in on their own if they need
it using header rewriting, so we'll remove this.
This PR replaces the usage of `gravitational/oxy.Forwarder` in our codebase with `httputil.ReverseProxy`.
`httputil.ReverseProxy` is part of Go's standard library and thus it is
maintained by the Go team. Converting everything to use the std lib
allows us to drop our `oxy` fork.
There are some operational changes between the two versions:
1. `httputil.ReverseProxy` handles WebSockets upgrades internally and
reuses the `Transport` provided for the initial request. Thus, it does
not require any special dialer or rewriter mechanisms for WebSockets only.
2. `httputil.ReverseProxy` calls the `ErrorHandler` with the request
after it was rewritten and after roundtrip was called. This was a
problem because our `web.transport` deletes Teleport associated
cookies and when the request failed, the request received by the
`ErrorHandler` missed the cookies to generate a new session. This was
fixed by cloning the request at `web.transport` round tripper.
3. `httputil.ReverseProxy` uses std's `log.Logger`. `logrus` exposes a
method `Writer` that allows it to be used with standard lib logger.
The API is similar to what our `oxy` fork has available.
Fixes#27412
* Add full IP pinning enforcement
We're adding IP pinning check to `authorizer.Authorize` which is used for every call,
so now all communications with teleport should enforce IP pinning.
Also making sure we always provide login IP for user certificate creation
and correct client IP propagation everywhere.
* Add integration test for App IP pinning.
* Fix wording
Co-authored-by: Tiago Silva <[email protected]>
* Wrap error
Co-authored-by: Tiago Silva <[email protected]>
* Add godocs
* Clone TLS config
* Improve proxyHeaderSigner usage
* Wider use proxyHeaderDialer and remove adhoc writing of singed header
* Add helper function TLSDial
* Use proxyHeader dialer in authConnect
* Simplify tlsConfig manipulation
Co-authored-by: Przemko Robakowski <[email protected]>
* Remove redundant channels processing in TLSDial
* Reduce nesting
* Update generated protobufs
* Remove ignoring of bad IP on signed PROXY header generation
* Provide logger to CheckIPPinning function
---------
Co-authored-by: Tiago Silva <[email protected]>
Co-authored-by: Przemko Robakowski <[email protected]>
* Move configuration from lib/service to lib/service/servicecfg
The new servicecfg package will hold only configuration for services.
This will allow other packages (like tctl and tsh) to depend on
servicecfg without pulling in all of lib/service (which has a number
of platform-specific details).
This is the first step towards being able to build tctl for Windows.
* Move PAM and BPF config into servicecfg
This breaks a compile-time dependency on BPF/PAM for tctl.
* Add x-teleport-api-error to reserved headers
* Update app tests for rewritten headers
* Add test case for x-teleport-api-error
* Fix test for XForwardedSsl since it was effectively untested before
* Refactor leaf test to parse the response from dumper app
* Update docs reference reserved headers
The "tets bundling" introduced in TesAppAccess() made TestAppInvalidateAppSessionsOnLogout test very unstable as other tests are modifying the state of the whole suit.
Removing the test from the bundle seems to fix it.
The TestTCPCertExpiration test may have a race condition where the connection
made to the test application immediately after the cert expiry may succeed.
Due to the wonky nature of using the fake clock in this test, I'm introducing
a requires.Eventually here to hopefully mitigate this race.
The CertificateTTL causes problems after the introduction of the fake clock
into the appaccess tests due to the fake clock not being propagated properly
throughout the Teleport stack. Increasing the TTL should make this test much
less flaky.
The appaccess TestTCP* tests are highly reliant on time. This has been
reduced (but not eliminated) by using a fakeClock and a channel for
signaling monitor triggered connection closures.
Application access connection monitoring has been introduced so that, when a
lock is created, application access connections will be interrupted until the
lock has been cleared. This includes web sockets and TCP applications.
Application sessions were previously only logged when launching an application
session via the UI, and not from the `tsh app login` command. This has been
corrected. The AppName and AppURI are now passed in as part of the gRPC
request to the auth server, which is then used to emit the audit event.
Tiago Silva