* Include expiration time in `LoggedInUser`
This will allow the profile watcher to detect when the user relogged.
* Display expiration time in UI
* Add `ClearStaleClusterClients` RPC
* Implement `ClearStaleClusterClients`
* Clear stale clients when profile changes
* Improve session expiration component
* Move refresh button back to top
* `ClearCachedStaleClientsForRoot` -> `ClearStaleCachedClientsForRoot`
* `unchanged` -> `stale`
* Make "closing stale clients" a subtest
* Add `clientcache` test
* Remove `getProfile` error wrapping
* Improve comment
* Convert story to controls
* Added support for `tsh logout --proxy` to work without `--user` when one identity exists
* Fix lint
* Refactor
* Refactor
* Refactor and update log messages
Updates test targets to output json and junit files. These files
will be forwarded to a durable storage location in the future to
be consumed for analytical purposes.
* Add signaling for supported tunnel types to relay tunnel
* Enable relay tunnel client for kubernetes_service
* Add kube_server to the relay cache
* Add passive forwarder for kubernetes access through the relay
* Add wildcard SNI suffix to kube service SANs if a relay is configured
* Add SNI-dispatching grpc transport for the relay transport server
* Enable kubernetes forwarding in the relay service
* Advertise support for kube tunnels in the relay
* Add tests
When looking for README.md files to update under
`examples/aws/terraform`, skip any that do not have a `README.md` file
instead of exiting with an error. A new example directory has been added
and it does not have a README.md file and it is causing the update to
fail for the other directories.
Several of the test cases failed with unexpected EOF errors because
the gRPC handler was terminating too early.
The `connection successfully established without agent forwarding`
test case used the following series of events to validate ssh frames
are forwarded correctly.
1) client sends message to server
2) server echoes the data back and immediately terminates the stream
3) client reads a message and validates the data was echoed
4) client tries to read again and gets an EOF error
5) client closes connection
The flakiness was a result of step 2. The server handler exiting
immediately after sending the echo back to the client could result
in the message never being received by the client. To make the test
more reliable the test was updated to the following.
1) client sends message to server
2) server echoes the data back
3) client reads a message and validates the data was echoed
4) client resends the message to the server
5) server receives the second message and terminates the stream
6) client tries to read again and gets an EOF error
7) client closes connection
This guarantees that the server stream handler will be alive after
the echoed data is sent and the client has had a chance to process it.
The `connection successfully established with agent forwarding` test
case was flaking for similar reasons. The gRPC handler spawned a
goroutine to consume and forward agent frames but the handler did not
wait for this goroutine to finish before returning. Depending on the
timing of the test the handler could return prior to all agent frames
being processed which terminated the gRPC stream and resulted in
unexpected EOF errors at the client.
To remedy this logic in the handler was inverted such that processing
the messasges from the gRPC stream is done in a loop in the main goroutine
of the handler. Processing of agent frames is now done in a background
goroutine spawned via an errgroup.Group. The main loop of the handler
blocks waiting for the errgroup.Group to conclude prior to exiting to
ensure all messages are exhausted before exiting.
Fixes https://github.com/gravitational/teleport/issues/32799.
This change allows tsh to treat corrupted private keys as though
they were not present (and trigger relogin flows) It also attempts
to prevent said corruption in the first place.
Fix flakiness in `TestSessionRecordingModes/BestEffort`
`TestSessionRecordingModes/BestEffort` test was extremely flaky because
although the session was already terminated, the `session.leave` and
`session.end` events were never received.
Upon session termination, interactive sessions wait for the terminal
to be closed and also wait for the recorder to leave the session.
https://github.com/gravitational/teleport/blob/4247f2e4a2fe2d430e268c9f5476d83c3d0a6456/lib/srv/sess.go#L1509-L1516
`defaults.WaitCopyTimeout` is equal to 5s.
Due to an incorrect condition, the terminal acquired the lock before
waiting for all parties to leave and then waited on the `sync.WaitGroup`.
This caused the lock to be held indefinitely, as other goroutines also
needed the same mutex, preventing the session writer from closing properly.
Depending on the order of occurence, if the incorrect condition was
acquired before all parties leave the session, it would result in a
deadlock causing the session events to never be emitted within 5
seconds.
Fixes https://github.com/gravitational/teleport/issues/57332
Signed-off-by: Tiago Silva <[email protected]>
* Add env zero guide for the Terraform provider
This adds a guide for using Teleport's Terraform provider to join
using the new `env0` join method.
* Update versions based on expected release
* Address review feedback
* Add `ClusterLifecycleManager`
* Register handlers for adding, removing and logging out from cluster
* Provide `rootCluster` in `useWorkspaceContext`
The handlers in the profile watcher will proceed with updating the cluster store, even if the renderer handlers returned errors.
This check protects us from a runtime error if the renderer fails to remove the workspace.
* Improve docs
* Move processing queue to listener
* Make `will-` operations always interrupt main process actions
* Improve error messages
* Do not remove managing cluster when **only** logging out
The app updater displays all clusters, not just those the user is logged into.
* Revert "Provide `rootCluster` in `useWorkspaceContext`"
This reverts commit cf76d2ba27.
* Rename `logoutWithCleanup` to `cleanUpBeforeLogout`
* Do not pass `AbortSignal` to `this.mainProcessClient.syncRootClusters`
* Lint
* Fix types issues
* Do not stack watcher notifications
This change allows the agent dialer to use cached
results for hostCheckerFunc. In the case of a transient
grpc network failure, this allows the reverse tunnel
to be re-established before the grpc timeout takes place.
Test plan:
- [ ] Spawn two Linux VMs, one for auth/proxy and one for node.
Simulate network change by toggling one of two interfaces on the node,
measure time for the reverse tunnel to be functional again.
In local testing with 5 runs this on average brings the recovery time
to 2m39s from 3m45s.
Changelog: Improve reverse tunnel dialing recovery from default route changes by 1min on average.
* Port `gitlab` join method to new join service
This ports the `gitlab` join method to the new join service.
The `gitlab` package was moved to `lib/join/` with minimal changes,
token verification was moved into `lib/join/gitlab` so it could be
reused between both legacy and new endpoints, and a small adapter was
added to provide backwards compatibility.
See also: [RFD 27e](https://github.com/gravitational/teleport.e/blob/master/rfd/0027e-auth-assigned-uuids.md)
* Fix imports
* Add gitlab to whitelist, reorder entries alphabetically
* Rename checkAndSetDefaults() to validate()
* Generalize PrepareToReceiveSessionID.
* Initialize session ID in the connection context and update it from node current-session-id request.
* Add [email protected] request and ensure new session ID is correctly set in proxy recording mode during the channel request.
* Replace PrepareToReceiveSessionID with simpler in-place logic.
* Don't emit session events or tracker when proxy forwarding to a Teleport Node.
* Fix missing session tracker for outdated Teleport Node.
* Remove extra major version grace period.
* Update integration test.
* Cleanup current session ID handling and fix failing tests.
* Fix tests.
* Address comments.
* Restructure currentSessionID handling.
* Set newSessionID in test server context.
* Fix integration test.
* Fix AuditOn integration test.
* Address comment on channel close.
* Track session on forwarding node.
* Fix web shutdown.
* Fix nil pointer dereference in test.
* Fix test flake.
* Fix nil pointer in test.
* Fix test flake.
* Update lib/srv/ctx.go
Co-authored-by: rosstimothy <[email protected]>
* Forwarding Node accepts client connection after receiving preparing session ID from node. This way, the forwarder can reject client connections if there is an issue preparing the session ID (impossible join sessions).
* Remove check for session.data event which may not be emitted in time for the test.
* Address comments.
---------
Co-authored-by: rosstimothy <[email protected]>
* Unify behavior of the uploaders
- Changes the behavior of uploaders to allow uploading pending
summaries. It also makes all uploaders consistently fail to overwrite
existing recordings and final summaries.
- Upgrades the gofakes3 library to support the If-None-Match headers.
- Copies the MemBuffer utility from the enterprise code.
* Fix a deadlock in gcsessions.Handler
The deadlock occurred when the upload passed a certain number of parts,
in which case the errors channel buffer got saturated and the object
deletion goroutines started piling up, ultimately leading to locking the
main loop that iterated through the object slice when the semaphore
channel got its buffer filled up too.
This deadlock prevented running the GCS uploader integration tests.
* review
* Another review round
- Move the pending session downloading to the caller
- Add a missing MemBuffer test
- Tweaks to the memory uploader (required by the Enterprise change)
* Build fix
* review
* Fix lint and integration tests
* Delete the pending summaries when uploading final, use versioning on s3
* Some comments
* license
Grzegorz Zdunek