Skip to content

Commit 9d64454

Browse files
eriktateeriktate
committed
adding KeyStoreConfig fallback if KeyStore isn't directly provided
1 parent 6c54c6b commit 9d64454

File tree

12 files changed

+63
-21
lines changed

12 files changed

+63
-21
lines changed

‎integrations/event-handler/go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ require (
3333
cloud.google.com/go/resourcemanager v1.10.6 // indirect
3434
connectrpc.com/connect v1.18.1 // indirect
3535
dario.cat/mergo v1.0.1 // indirect
36+
filippo.io/age v1.2.1 // indirect
3637
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
3738
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.0 // indirect
3839
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect

‎integrations/event-handler/go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
2+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
13
cloud.google.com/go v0.121.1 h1:S3kTQSydxmu1JfLRLpKtxRPA7rSrYPRPEUmL/PavVUw=
24
cloud.google.com/go v0.121.1/go.mod h1:nRFlrHq39MNVWu+zESP2PosMWA0ryJw8KUBZ2iZpxbw=
35
cloud.google.com/go/auth v0.16.1 h1:XrXauHMd30LhQYVRHLGvJiYeczweKQXZxsTbV9TiguU=
@@ -22,6 +24,8 @@ connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
2224
connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
2325
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
2426
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
27+
filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
28+
filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
2529
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
2630
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
2731
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=

‎integrations/terraform/go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ require (
3434
code.dny.dev/ssrf v0.2.0 // indirect
3535
connectrpc.com/connect v1.18.1 // indirect
3636
dario.cat/mergo v1.0.1 // indirect
37+
filippo.io/age v1.2.1 // indirect
3738
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
3839
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.0 // indirect
3940
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect

‎integrations/terraform/go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
2+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
13
cel.dev/expr v0.23.1 h1:K4KOtPCJQjVggkARsjG9RWXP6O4R73aHeJMa/dmCQQg=
24
cel.dev/expr v0.23.1/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
35
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
@@ -68,6 +70,8 @@ connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2pr
6870
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
6971
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
7072
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
73+
filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
74+
filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
7175
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
7276
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
7377
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=

‎lib/auth/auth.go

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ import (
120120
"github.com/gravitational/teleport/lib/observability/tracing"
121121
"github.com/gravitational/teleport/lib/release"
122122
"github.com/gravitational/teleport/lib/resourceusage"
123+
"github.com/gravitational/teleport/lib/service/servicecfg"
123124
"github.com/gravitational/teleport/lib/services"
124125
"github.com/gravitational/teleport/lib/services/local"
125126
"github.com/gravitational/teleport/lib/services/readonly"
@@ -194,9 +195,6 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
194195
if cfg.VersionStorage == nil {
195196
return nil, trace.BadParameter("version storage is not set")
196197
}
197-
if cfg.KeyStore == nil {
198-
return nil, trace.BadParameter("key store is not set")
199-
}
200198
if cfg.Trust == nil {
201199
cfg.Trust = local.NewCAService(cfg.Backend)
202200
}
@@ -218,6 +216,38 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
218216
if cfg.DynamicAccessExt == nil {
219217
cfg.DynamicAccessExt = local.NewDynamicAccessService(cfg.Backend)
220218
}
219+
if cfg.ClusterConfiguration == nil {
220+
clusterConfig, err := local.NewClusterConfigurationService(cfg.Backend)
221+
if err != nil {
222+
return nil, trace.Wrap(err)
223+
}
224+
cfg.ClusterConfiguration = recordingencryption.NewClusterConfigService(clusterConfig, cfg.RecordingEncryption)
225+
}
226+
if cfg.KeyStore == nil {
227+
keystoreOpts := &keystore.Options{
228+
HostUUID: cfg.HostUUID,
229+
ClusterName: cfg.ClusterName,
230+
AuthPreferenceGetter: cfg.ClusterConfiguration,
231+
FIPS: cfg.FIPS,
232+
}
233+
if cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {
234+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
235+
return nil, fmt.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
236+
}
237+
} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {
238+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
239+
return nil, fmt.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
240+
}
241+
} else if cfg.KeyStoreConfig.AWSKMS != nil {
242+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
243+
return nil, fmt.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
244+
}
245+
}
246+
cfg.KeyStore, err = keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)
247+
if err != nil {
248+
return nil, trace.Wrap(err)
249+
}
250+
}
221251
if cfg.RecordingEncryption == nil {
222252
localRecordingEncryption, err := local.NewRecordingEncryptionService(cfg.Backend)
223253
if err != nil {
@@ -234,13 +264,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
234264
}
235265

236266
cfg.RecordingEncryption = recordingEncryptionManager
237-
}
238-
if cfg.ClusterConfiguration == nil {
239-
clusterConfig, err := local.NewClusterConfigurationService(cfg.Backend)
240-
if err != nil {
241-
return nil, trace.Wrap(err)
242-
}
243-
cfg.ClusterConfiguration = recordingencryption.NewClusterConfigService(clusterConfig, cfg.RecordingEncryption)
267+
cfg.ClusterConfiguration = recordingencryption.NewClusterConfigService(cfg.ClusterConfiguration, recordingEncryptionManager)
244268
}
245269
if cfg.AutoUpdateService == nil {
246270
cfg.AutoUpdateService, err = local.NewAutoUpdateService(cfg.Backend)

‎lib/auth/init.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ import (
6363
"github.com/gravitational/teleport/lib/cryptosuites"
6464
"github.com/gravitational/teleport/lib/events"
6565
"github.com/gravitational/teleport/lib/modules"
66+
"github.com/gravitational/teleport/lib/service/servicecfg"
6667
"github.com/gravitational/teleport/lib/services"
6768
"github.com/gravitational/teleport/lib/services/local"
6869
"github.com/gravitational/teleport/lib/srv/db/common/databaseobjectimportrule"
@@ -104,6 +105,10 @@ type InitConfig struct {
104105
// Authority is key generator that we use
105106
Authority sshca.Authority
106107

108+
// KeyStoreConfig is the config for the KeyStore which handles private CA
109+
// keys that may be held in an HSM.
110+
KeyStoreConfig servicecfg.KeystoreConfig
111+
107112
// KeyStore which handles private CA keys and encryption keys that may be
108113
// held in an HSM.
109114
KeyStore *keystore.Manager

‎lib/backend/buffer.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ package backend
2020

2121
import (
2222
"context"
23+
"errors"
2324
"fmt"
2425
"log/slog"
2526
"sort"
@@ -240,13 +241,15 @@ func RemoveRedundantPrefixes(prefixes []Key) []Key {
240241
return prefixes[:j+1]
241242
}
242243

244+
var ErrBufferClosed = errors.New("cannot register watcher, buffer is closed")
245+
243246
// NewWatcher adds a new watcher to the events buffer
244247
func (c *CircularBuffer) NewWatcher(ctx context.Context, watch Watch) (Watcher, error) {
245248
c.Lock()
246249
defer c.Unlock()
247250

248251
if c.closed {
249-
return nil, trace.Errorf("cannot register watcher, buffer is closed")
252+
return nil, trace.Wrap(ErrBufferClosed)
250253
}
251254

252255
if watch.QueueSize == 0 {

‎lib/events/filesessions/fileasync_chaos_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ func TestChaosUpload(t *testing.T) {
122122
go uploader.Serve(ctx)
123123
defer uploader.Close()
124124

125-
fileStreamer, err := NewStreamer(scanDir)
125+
fileStreamer, err := NewStreamer(scanDir, nil)
126126
require.NoError(t, err)
127127

128128
parallelStreams := 20

‎lib/events/filesessions/fileasync_test.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ func TestUploadOK(t *testing.T) {
4747
// wait until uploader blocks on the clock
4848
p.clock.BlockUntil(1)
4949

50-
fileStreamer, err := NewStreamer(p.scanDir)
50+
fileStreamer, err := NewStreamer(p.scanDir, nil)
5151
require.NoError(t, err)
5252

5353
inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
@@ -85,7 +85,7 @@ func TestUploadParallel(t *testing.T) {
8585
sessions := make(map[string][]apievents.AuditEvent)
8686

8787
for i := 0; i < 5; i++ {
88-
fileStreamer, err := NewStreamer(p.scanDir)
88+
fileStreamer, err := NewStreamer(p.scanDir, nil)
8989
require.NoError(t, err)
9090

9191
sessionEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
@@ -382,7 +382,7 @@ func TestUploadBackoff(t *testing.T) {
382382
// wait until uploader blocks on the clock before creating the stream
383383
p.clock.BlockUntil(1)
384384

385-
fileStreamer, err := NewStreamer(p.scanDir)
385+
fileStreamer, err := NewStreamer(p.scanDir, nil)
386386
require.NoError(t, err)
387387

388388
inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 4096})
@@ -589,7 +589,7 @@ func runResume(t *testing.T, testCase resumeTestCase) {
589589

590590
defer uploader.Close()
591591

592-
fileStreamer, err := NewStreamer(scanDir)
592+
fileStreamer, err := NewStreamer(scanDir, nil)
593593
require.NoError(t, err)
594594

595595
inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})

‎lib/events/stream_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,7 @@ func TestEncryptedRecordingIO(t *testing.T) {
237237
streamer, err := events.NewProtoStreamer(events.ProtoStreamerConfig{
238238
Uploader: uploader,
239239

240-
EncryptedIO: encryptedIO,
240+
Encrypter: encryptedIO,
241241
})
242242
require.NoError(t, err)
243243

@@ -329,7 +329,7 @@ func (f *fakeEncrypter) Close() error {
329329
return f.inner.Close()
330330
}
331331

332-
func (f *fakeEncryptedIO) WithEncryption(writer io.WriteCloser) (io.WriteCloser, error) {
332+
func (f *fakeEncryptedIO) WithEncryption(ctx context.Context, writer io.WriteCloser) (io.WriteCloser, error) {
333333
hexWriter := hex.NewEncoder(writer)
334334
return &fakeEncrypter{
335335
inner: writer,

‎lib/service/service.go

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2110,7 +2110,6 @@ func (process *TeleportProcess) initAuthService() error {
21102110

21112111
recordingEncryptionManager, err := recordingencryption.NewManager(recordingencryption.ManagerConfig{
21122112
Backend: localRecordingEncryption,
2113-
Cache: localRecordingEncryption,
21142113
KeyStore: keyStore,
21152114
Logger: logger,
21162115
})
@@ -2660,7 +2659,7 @@ func (process *TeleportProcess) initAuthService() error {
26602659
})
26612660

26622661
recordingEncryptionWatchCfg := recordingencryption.WatchConfig{
2663-
Events: authServer,
2662+
Events: authServer.Services,
26642663
Resolver: authServer,
26652664
ClusterConfig: authServer,
26662665
LockConfig: &backend.RunWhileLockedConfig{
@@ -2786,7 +2785,6 @@ func (process *TeleportProcess) newAccessCacheForServices(cfg accesspoint.Config
27862785
cfg.PluginStaticCredentials = services.PluginStaticCredentials
27872786
cfg.GitServers = services.GitServers
27882787
cfg.HealthCheckConfig = services.HealthCheckConfig
2789-
cfg.RecordingEncryption = services.RecordingEncryptionManager
27902788

27912789
return accesspoint.NewCache(cfg)
27922790
}

‎lib/services/local/recording_encryption.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ func (s *RecordingEncryptionService) CreateRecordingEncryption(ctx context.Conte
6767
encryption.Metadata = &headerv1.Metadata{}
6868
}
6969
encryption.Metadata.Name = types.MetaNameRecordingEncryption
70+
encryption.Kind = types.KindRecordingEncryption
7071
created, err := s.encryption.CreateResource(ctx, encryption)
7172
return created, trace.Wrap(err)
7273
}
@@ -77,6 +78,7 @@ func (s *RecordingEncryptionService) UpdateRecordingEncryption(ctx context.Conte
7778
encryption.Metadata = &headerv1.Metadata{}
7879
}
7980
encryption.Metadata.Name = types.MetaNameRecordingEncryption
81+
encryption.Kind = types.KindRecordingEncryption
8082
updated, err := s.encryption.ConditionalUpdateResource(ctx, encryption)
8183
return updated, trace.Wrap(err)
8284
}

0 commit comments

Comments
 (0)