* Fix flaky tests caused by early dial failures.
* Add startSessionAndWaitForTracker to unmask session creation failures in audit tests.
* Fix test agentless server to accept more than one connection to enable readiness probe.
* Address comments.
* Address comments.
Several integration tests make use of the function to
know that a session was created, a SessionTracker was
created in the backend, and to retrieve the session id.
The function polled the backend for session trackers
until the context deadline set in individual tests
was exceeded. In an effort to reduce flakiness and
make the API easier for callers the helper has been
rewritten. It now leverages a require.Eventually
internally, has a hardcoded limit of 30s instead of
allowing each test to define their own, and validates
the number of expected participants in a session.
Closes https://github.com/gravitational/teleport/issues/17224.
Closes https://github.com/gravitational/teleport/issues/36959.
The datadir in this test consists of TempDir
and typically suffix which exceeds the
BSD socket limits causing the test to fail on MacOS.
This commit disables the debug service in the failing tests,
for testing the debug service specifically it should be
enabled in the test itself.
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
* Move lib/srv/mock to lib/srv/mock_test.go
* remove testify from lib/srv/db/redis
* remove lib/auth/test package
* Move lib/utils/testhelpers.go to lib/utils/testutils
* duplicate auto upgrades server mock
* remove testing from fake podman server
* remove lib/fixtures/plugin.go
* remove test assertions from lib/fixtures
* remove depguard exceptions that no longer apply
* fix: comments
Converts most items to use servicecfg.Config.Logger instead of
servicecfg.Config.Log. The deprecated logrus logger unfortunately
cannot be removed yet as it's still used in e. Additionally all
logging within the config package was converted to use slog.
This change fixes a bug where remote port forwarding would fail if
the local login the user is SSHing with doesn't match the local user
running the node.
The shell package requires cgo and by importing it in lib/client,
which all client tools have in their dependency tree, it prevents
them from building without GCO_ENBALED=1.
Updates https://github.com/gravitational/teleport/issues/43112.
Label based connections that do not provide a command and open a
shell for the first match were only performing a portion of the logic
that non label based interactive sessions were. Instead of connecting
directly to a host and opening a session, `tc.runShellOrCommandOnSingleNode`
is called to achieve the same behavior as non label based connections.
In addition to fixing #23261 this should also add support for `-N` in
the same scenario.
* Prevent tunneling if the os login doesn't exist
A user.Lookup was added to srv.RunForward to prevent dialing
and forwarding any data if the os login is not found. The check
alone only terminates the direct-tcpip ssh channel and not the
underlying ssh connection.
In order for the parent process to determine if the ssh connection
should be terminated it needs to know why the child exited. That was
not possible by looking at the exit code and any data written to
standard error of the child process was forwarded to standard error
on the parent; which was used to simply log the error and move on.
To pass more detailed errors to the parent, the child process spawned
by srv.RunForward now json marshals the trace.Error to standard
error which is then decoded by the parent process. If the parent
detects the error was due to a missing user it terminates the ssh
connection.
tsh ssh -N was also modified to terminate if the command context
of tsh OR the ssh connection to the node is closes. Prior, it
only terminated if the user cancelled the process by blocking on
ctx.Done(). While this was necessary to end session if the os
login does not exit, it also forces tsh to exit if the node
goes offline.
Note: This does not include any propagation of error messages to the user,
so there won't be any indication from tsh about why the connection was closed.
The session also will not be terminated until the first attempt to forward data and
NOT when the session is created due to the way -N is implemented.
Fixes#217
* Prevent unauthorized access to kube clusters by upserting kube_servers
This PR changes the behavior of the kubernetes_service when validating access
to kubernetes clusters. Previously, the kubernetes_service would use the first
kubernetes cluster it found in the Auth server backend to validate access. This was
problematic because if the first kubernetes cluster was upserted with a
the same name as a kubernetes cluster the user was trying to access but
with different labels, the user would be able to access the cluster even
though they shouldn't be able to.
This PR changes the behavior of the kubernetes_service to use the
in memory kubernetes cluster representation used for heartbeats
instead of relying on the information received from the auth server. This would
block the user from accessing the cluster if the cluster was upserted
with a different set of labels since the kubernetes_service would not
have the updated labels in memory and would deny access.
Fixes#469
---------
Co-authored-by: Tim Ross <[email protected]>
Co-authored-by: Tiago Silva <[email protected]>
Following on from #13658, this patch removes more (but unfortunately not
all) usages of the deprecated, list-based port-allocation scheme.
This patch:
1. Updates the integration test `TeleInstance` fixture to use injected
listeners rather than static ports when creating a new proxy node in
a cluster,
2. Updates tests affected by (1) to pre-allocate and inject listeners,
including handling caching the listener FDs between proxy restarts
3. Removed unnecessary port allocations when creating LoadBalancer
fixtures, and
4. Moved the remaining list-base port allocation functions out of helpers
and back into integrations and made private. These functions should
never be used by more than one test package concurrently or there is a
very high chance of a port collision. Rather than just write that rule
down in the comments, I have contained the deprecated code into the
affected package made the compiler enforce the rule for us.
See-Also: #12421
See-Also: #13658
See-Also: #14408
* Add context.Context to session.Service interface
Updates GetSessions, GetSession, CreateSession, UpdateSesion, and
DeleteSession to take a context.Context. All call paths are updated
to properly pass along a real context instead of relying on a
to eliminate context.TODOs.
Ports used by the unit tests have been allocated by pulling them out of a list, with no guarantee that the port is not actually in use. This central allocation point also means that tests cannot be split into separate packages to be run in parallel, as the ports allocated between the various packages will be allocated multiple times and end up intermittently clashing.
There is also no guarantee, even when the tests are run serially, that the ports will not clash with services already running on the machine.
This patch (largely) replaces the use of this centralised port allocation with pre-created listeners injected into the test via the file descriptor import mechanism use by Teleport to pass open ports to child processes.
There are still some cases where the old port allocation system is still in use. I felt this was already getting beyond the bounds of sensibly reviewable, so I have left those for a further PR after this.
See-Also: #12421
See-Also: #14408
As a prelude to breaking individual integration test suites out into
their own packages (in order to make them more amenable to running
in parallel), this patch extracts the common test fixtures and places
them in a common `helpers` package.
This will allow the integration test package to share common
infrastructure and vocabulary once they are split out.
Prior to this change, TCP forwarding over SSH could only be disallowed
by user-based rules, rather than by individual target nodes.
This change adds:
* the`port_forwarding` key to the yaml SSH config block, with a boolean value
* Plumbing to pipe the resulting config value through to the SSH server
* A predicate check in the SSH server to [dis]allow port forwarding based on the setting.
This change also:
* adds a common way for integration tests to await the establishment of an SSH session
* refactors several integration tests to use this new method rather than manually waiting
* adds some marshaling code to move errors from spawned goroutines back into the
main test routine in verifySessionJoin()
See-Also: Issue #6783
Brian Joerger