* check arguments for NULL in converse PAM converse func, trim trailing newlines in user input
* Update session/pam/pam.c
Co-authored-by: Erik Tate <[email protected]>
---------
Co-authored-by: Erik Tate <[email protected]>
* ensure PAM retval is always valid when calling pam_end, prevent deadlock in PAM.free()
* don't call PAM.free in PAM.codeToError, require explicit cleanup to avoid confusion
* unregister handler if Open fails
* always return an error from codeToError
* return an error when an absolute path isn't specified in a moderated upload, or if the path is a dir
* don't show the filename to moderators
* revert change to comment
* ensure the expected ebpf hook will handle command events
* added comments to inflight_exec_t fields
* add comments to disk counterpart
* rename valid fields to valid_unsent
* add space in comment
* handle empty truncated arguments correctly in ebpf command events
* explicitly add message to audit event when args could not be read
* address codex comment
* zero structs from ringbuffer
* set failed to read args boolean in exit_execve
* refactor command and disk eBPF programs to fix some events not getting emitted
* fixed handling of flags in disk events
* remove unused constants to appease linter
* handle failing to read filename in enter_execve correctly
* added more tests
* prevent potential panic if args_len exceed args buffer size
* handle empty args in command events correctly
* minor changes from feedback
* update comments in eBPF files
---------
Co-authored-by: Andrew LeFevre <[email protected]>
* unset XAUTHORITY env var for the networking command
When Teleport passes almost all the environment variables to the child
processes that are born of a reexec. This is an issue when XAUTHORITY is
set as it will be passed to the networking process, causing `xauth` to
use a different file than the one that the SSH session process will use.
This is because the SSH session process only inherits a small subset of
the environment variables from the parent process, and XAUTHORITY is not
one of them. This causes X11 forwarding to fail.
* add Remove method to SafeEnv
* ensure all bpf events are processed before stopping, refactor tests a bit to make the stress test much more consistent
* prevent startSession/endSession blocking during shutdown
* make lost event tracking in tests work correctly between sub-tests
* Remove accidental extra wg.Wait call
* simplify LostEventTracker
* improved log message and switched to use a time.Timer
* fix not building without bpf tag
* drop events if the buffer is full
* ensure logs for reexec processes are shown when running unit tests
* log audit session login IDs as strings
---------
Co-authored-by: Andrew LeFevre <[email protected]>
* expose logs of Teleport child processes
Configures Teleport child proceses to log with the exact same
configuration as the parent process. Logs from child processes
previously were essentially discarded.
* Fix issues around os_log; Fix log spam from child process.
* Address comments; Fix lint.
* * Only write remote command failure errors to client tty
* Don't try to write errors to unserviced os.Stderr/Stdout of child process
* Don't connect networking stderr to parent process, just use logger
* Don't log client-responsible shell errors, e.g. shell interrupt
* Mention running teleport as root for common subprocess permission errors.
* Pass io.Discard pipe to child process if a log writer is not available.
* Fix tests with nil log writer.
* Add default child logger for tests.
* Fix lint.
* default to discard writer for tests.
* Write reexec errors to os.Stdout for parent process to digest.
* Address comments.
* Clean up child pipe copy logic.
* Cleanup log config inheritance.
* Address comments.
* Revert whitespace change.
* Fix typo.
* Fix merge conflict.
---------
Co-authored-by: joerger <[email protected]>
* start the refactor away from aquasecurity/libbpfgo to use cilium/ebpf
Remove debug statements and unused code in BPF library
This commit eliminates unnecessary debug log statements from bpf_test.go and removes unused code in disk.go and network.go files within BPF library. The aim is to make codebase cleaner, enhancing readability and maintainability without losing track of functional aspects. It's part of an ongoing effort to maintain optimal code quality across the project.
Revise Dockerfile and Makefile instructions
Adjusted Dockerfile and Makefile commands to optimize build process. The changes ensure better readability and maintainability of code, especially with respect to BPF bytecode and test preparations. A clause was also added to check for the presence of clang before building BPF bytecode.
Refactor BPF code and tests
Refactored BPF source code and its corresponding tests for better readability and efficiency. This includes updating data structures like rawExecEvent, rawOpenEvent, rawConn4Event and rawConn6Event to their more meritorious versions like commandDataT, diskDataT, networkIpv4DataT and networkIpv6DataT respectively. Also, generated concise and clear bindigs for eBPF programs to replace the previous multi-arch setup. Furthermore, correspondingly adapted all related test cases arising in bpf_test.go, command.go and other files.
Remove counter_test from BPF and related test code
This commit removes the file counter_test.bpf.c from the enhanced recording in BPF. Following this file deletion, corresponding test functions in bpf_test.go, that were originally testing the functionality provided by counter_test.bpf.c, have been removed as well.
Refactor BPF test and improve error handling
The commit refactors the BPF test suite to run each test as a sub-test by using t.Run, easing debugging and error tracing. It also simplifies the 'executeCommand' function by removing redundant function calls related to finding executable files, and improves error handling. In 'cgroup.go', the code has been adjusted to retry on EBUSY errors when removing a cgroup, instead of ignoring them.
Update cgroup deletion process and error handling
The changes made introduce a retry mechanism when deleting a cgroup in case the cgroup is busy. This prevents a failed attempt from immediately returning an error. Additionally, error handling has been improved in the 'writePids' function to better handle 'no such process' errors.
Enhance cgroup monitoring in disk.bpf.c
The code has been updated to check if current cgroup is being monitored in the "enter_open" method of "disk.bpf.c". If the cgroup is not marked for monitoring, it will be ignored, enhancing overall cgroup management.
Improve resource handling
This commit introduces a deferred close to the sendEvents function to ensure proper resource handling of the eventBuf object.
Add rlimit package to remove resource limits
Introduced the "github.com/cilium/ebpf/rlimit" package and added a function to remove resource limits for kernels less than 5.11. This operation is necessary for kernels with a lower version because they may face issues when running applications with allocated memory limitations.
Fix a test after rebase
Refactor BPF testing setup and implement session closing
This commit updates the BPF testing structure to remove the context dependency in event generation functions, simplifying the test setup. Additionally, it adds a 'closed' field to the 'open', 'conn', and 'exec' structs alongside mutex protection. This implementation allows checking if a session is closed before any operations, correctly handling already closed sessions. Furthermore, it corrects tracepoints for handling 'openat' and 'openat2' system calls for different platforms. This refactoring effort aims to improve the robustness and readability of the BPF testing suite.
Update conditions for BPF bytecode building
This update modifies the Makefile to add a conditional check for the presence of /usr/include/bpf/bpf_helpers.h. This new requirement must be met along with the existence of /usr/include/linux/bpf.h and the installation of Clang, in order to facilitate the correct build of BPF bytecode. Consequently, this change enhances the reliability of the build process.
Add conditional for bpf_helpers.h in Makefile
This commit adds an additional check in the Makefile for the existence of /usr/include/bpf/bpf_helpers.h. This ensures that BPF bytecode only gets built when both bpf.h and bpf_helpers.h exist, and Clang is installed, improving the build process reliability.
Refactor and improve BPF bytecode generation
This commit refactors and improves the BPF bytecode generation process. It introduces distinct bytecode structures for different architectures, ensuring better compatibility and execution. The BPF test is adjusted due to its tendency to fail unpredictably, hence it's commented out to avoid unnecessary build failures. This commit also eliminates certain redundancies in `common.mk`, improving the clarity of the build process.
Comment out test code in bpf_test.go
The test code in the file bpf_test.go has been commented out. These changes are circumstantial and do not imply that the test code is obsolete or unnecessary. The use of such tests may be needed in future commits or for local development testing and debugging.
Remove libbpf dependency from Vagrantfile and update README
The Vagrantfile and README have been updated to remove the no longer needed libbpf dependency. This change simplifies the project set up by eliminating unused build steps in the Vagrantfile and correcting related instructions in the README. This results in a more streamlined, intuitive build process and reduced potential for code complexity and dependency conflicts.
Remove obsolete dependencies and related code blocks
The 'aquasecurity/libbpfgo' library referencing and the related code blocks have been removed from the test files and core modules. The corresponding setup instructions in the dockerfiles and build scripts have also been eliminated. This update simplifies the build process and overall project structure while reducing unnecessary dependency risks.
Remove aquasecurity/libbpfgo dependency
Remove restricted.bpf.c
Migrate disk events to cilium
Migrate network events to cilium
Remove restricted session
Use cilium/ebpf for BPF
* fix build issues caused by stale branch
Also updated bpf bytecode, updated github.com/cilium/ebpf to 0.19.0,
and updated bpf/README to reflect changes
* fix tests and a bit of cleanup
Also added a subtest and fixed receiving IPv6 network events and
fixed attempting to create tracepoints for syscalls that are not
present on arm64.
* repurpose buffer size configs to set event channel buffer size
* add new GHA job to check that generated eBPF files are up to date
* fix lost event promethus counters and address feedback
* address feedback
* use only unsafe instead of CGO to convert C strings
* rename common_data_t comm -> command
* convert strings in bpf programs from char arrays to u8 or uint8 arrays so we can convert them to Go strings without the use of the unsafe package
---------
Co-authored-by: Jakub Nyckowski <[email protected]>
Co-authored-by: Tim Ross <[email protected]>
Ensure that Teleport is running under the correct
SELinux context when --enable-selinux is passed,
set the SELinux exec label later so the
checkhomedir child process will inherit the
parent's SELinux domain.
* fix: make sure Fields map is not nil
* move new test to existing file, allocate map for struct up front
* make linter happy
---------
Co-authored-by: Erik Jankovic <[email protected]>
* emit an audit event with file transfer statistics when an SFTP session is completed
* remove unused SFTP event codes, don't embed os.File
* send oneof events to parent process to make event unmarshaling easier to reason about
* protect tracked files with mutex
* ensure 'db.session.result', 'desktop.recording' and 'static_host_user.*' events can be converted from EventFields
* add TrimToMaxSize methods for all audit events and make it a required method
* ensure callers of TrimToMaxSize check the size of the returned event
---------
Co-authored-by: Andrew LeFevre <Andrew LeFevre>
* add the kind in a resource YAML example for the SSO client redirect docs
* Update docs/pages/admin-guides/access-controls/sso.mdx
Co-authored-by: Zac Bergquist <[email protected]>
---------
Co-authored-by: Andrew LeFevre <Andrew LeFevre>
Co-authored-by: Zac Bergquist <[email protected]>
* don't allow empty database names or user names for Postgres connections
* adopt postgres behavior when the database name is empty
---------
Co-authored-by: Andrew LeFevre <Andrew LeFevre>
* fix regression that denied access to launch some Apps
* Fix test, and wrap new URL with its own try catch block
* improve URL parsing fail error message
---------
Co-authored-by: Andrew LeFevre <Andrew LeFevre>
Co-authored-by: Lisa Kim <[email protected]>
* use httputil Rewrite instead of Director
Director will remove HTTP headers if they are
deemed to be hop-by-hop headers which could result
in a security vulnerability. Use httputil Rewrite
instead to ensure that HTTP headers added by our
reverse proxy are not unintentionally removed.
* ensure removed forwarded headers are added back
* use a separate request object in TestHeaderRewriter
---------
Co-authored-by: Andrew LeFevre <Andrew LeFevre>
* add a note in the docs about an SSRF between root and leaf Proxies and how to prevent it
* Update docs/pages/management/admin/trustedclusters.mdx
Co-authored-by: Paul Gottschling <[email protected]>
---------
Co-authored-by: Paul Gottschling <[email protected]>
* prevent SSH session id reuse
If a user sets `TELEPORT_SESSION` to a session ID
that isn't running, the sent session ID is ignored
and a new one is used to prevent the user
controlling the value. When parsing a session ID
the parsed result is used to ensure all session
IDs will have the same format.
`CreateSessionTracker` is updated to create
instead of upsert to ensure `SessionTracker`
resources cannot be overwritten by accident.
Clients often need to know the current session ID,
and before when they were in control of it that
wasn't an issue. To fix this servers will send the
current session ID in a SSH channel request on the
channel the SSH session was created on. This
should be fully backwards compatible, as when an
unknown SSH request type is received clients will
just ignore it/reply with false.
* add test for wrappedSSHConn
* rebase with master
* only retrieve logs on a specific error
* fix cache test again and a linter issue
* only look for ephemeral container name when waiting for the container to start
* address feedback
* add support for other merge strategies
* handle case
* reorganize gomod
* address feedback
* fix missing patchtype
* propagate errors
* Update lib/kube/proxy/sess.go
Co-authored-by: Tiago Silva <[email protected]>
* add hint of exec process into session tracker
* address feedback
* optionally filter listed waiting conts server-side
* add TODO to test against tsh kubectl
* Revert "optionally filter listed waiting conts server-side"
This reverts commit 9a33868363e427f52bba8d95ead2bfc0d939e6e7.
* fix failing integration test, undo accidental dep update
---------
Co-authored-by: Tiago Silva <[email protected]>
* extend role 'join_sessions' so MFA can be required at the role level when joining sessions
* add test cases
* update operator CRDs
* remove change to 'join_sessions', instead require MFA if any roles require it
* add comment
* address feedback
* add additional test cases
* add authhandler test
* fix role from test case not getting used in test
* add kubernetes waiting container backend service and API
* remove other resource type
* add unit test
* fix after rebasing
* address feedback
* remove KubeWaitingContainerRequest
* check for nil in validation func
* remove UnwrapResource153
* fix test
* address feedback
* address linter issues
* fix cache watch kind test
* ensure moderated file transfers only preform allowed operations
* fix sess test
* wip integration test
* integration test working
* tweak some error messages and test cases
* allow setstat for uploads
* address nits from code review
* expand paths when necessary when creating file transfer request
* improve UX of errors in web UI
* deny request when an invalid user tries to transfer files
* don't allow open requests, they aren't done by the webui
* address feedback
* use a buffered reader when reading the file request, address a few nits
* emit audit events when SFTP or SCP commands are blocked
* include user name in SCP web audit message
* use 'an' instead of 'a'
* make SCP audit message use consistent language, fix type check error
* fix unused var
* fix leaf SSH sessions not getting recorded
* add integration test
* address feedback, overhaul integration test
* make each test case use fresh clusters to fix failing case
* address feedback
* Apply suggestions from code review
Co-authored-by: rosstimothy <[email protected]>
* fix integration test failures
---------
Co-authored-by: rosstimothy <[email protected]>
* re-add agentless node manual installation docs
* fix linter issues
* Add missing closing paren
Co-authored-by: Paul Gottschling <[email protected]>
* use tabs in manual install guide
* removed more ScopedBlocks I missed
* add note about upgrading to v14
* add redirect and notes linking the two guides to one another
* addressed feedback
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <[email protected]>
* fix links
---------
Co-authored-by: Paul Gottschling <[email protected]>
* return an error when attempting to join a session of an OpenSSH node
* remove item from test plan and note to docs
* add test coverage to integration test
* fix integration test
* fixed linter issue
* fix forwarding a SSH agent in a Cygwin env
* added more comments
* use os.Getenv
* add examples to regex vars, make formatting of guid more clear
* parse strings as uints, improve error messages
* make it more clear uint32s are used for UIDs
* turns out calling "bash" isn't needed
* add option to force re-authentication for OIDC connectors
* expose max_age directly
* update comment for MaxAge, regen operator manifests to make linter happy
* make max_age nullable
* make max_age a duration
* use google.protobuf.Duration
* Revert "use google.protobuf.Duration"
This reverts commit e6c3b7deaf9ffebb33492e3b6e575289e3ad1c37.
* make it more clear that max age is a full duration
* document how MaxAge duration is represented
* rebuild operator manifests
* crdgen: handle OIDCConnectorSpecV3.MaxAge as a special case
* move logic into separate function
* update testdata
* removed unnecessary files from testdata
* update testdata after merging master
* split recording session events and emitting audit events
This is a refactor of how audit events and session events are handled.
Previously, all events were emitted using the same interface,
api/types/events.Emitter. This lead to event-related code getting to be
very confusing, as it was often unclear whether a given event was being
recorded as a session event and emitted as an audit event, or only one
of the two. Naturally, a few bugs arose due to this.
To simplify event handling, a separate interface for recording session
events has been created. A api/types/events.Recorder should now only be
used to record session events, and an Emitter should now only be used to
emit audit events. Instead of using a confusing TeeWriter that would
transparently (and confusingly, given its name) hold a few event types
that only belonged in session recordings, callers can now explicitly
record and/or emit an event when necessary.
* ensure e build won't break
"github.com/gogo/protobuf/proto.Clone" has multiple bugs that cause
panics, so create a wrapper function that uses a thoroughly tested
cloning function from "google.golang.org/protobuf".
* fix connecting to agentless leaf nodes
Pass user and role information to Auth server signing OpenSSH cert
so avoid user/role lookup errors if the target node is on a leaf
cluster. Also use role and trait information from the current
connection rather than the backend to support role impersonation.
* make protobuf changes backwards-compatible
Previously when handling an SSH agent forward request from a SSH
connection to a registered SSH node, the forwarding SSH server would
open a SSH channel for the SSH agent but never close it. tsh wasn't
affected by this and would exit cleanly when the SSH session was closed.
OpenSSH ssh would hang waiting for the open SSH agent channel to close,
which would never happen.
After finding now 2 very similar bugs today related to trying to pull
connection information out of SSH certificates instead of just passing
it directly, opt to pass the information directly to prevent future bugs.
Andrew LeFevre