Skip to content

Commit e9ec376

Browse files
eriktateeriktate
committed
adding encryption for sync recording modes
1 parent e2f11a4 commit e9ec376

File tree

27 files changed

+719
-83
lines changed

27 files changed

+719
-83
lines changed

‎integrations/event-handler/go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ require (
3333
cloud.google.com/go/resourcemanager v1.10.6 // indirect
3434
connectrpc.com/connect v1.18.1 // indirect
3535
dario.cat/mergo v1.0.1 // indirect
36+
filippo.io/age v1.2.1 // indirect
3637
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
3738
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.0 // indirect
3839
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect

‎integrations/event-handler/go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
2+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
13
cloud.google.com/go v0.121.1 h1:S3kTQSydxmu1JfLRLpKtxRPA7rSrYPRPEUmL/PavVUw=
24
cloud.google.com/go v0.121.1/go.mod h1:nRFlrHq39MNVWu+zESP2PosMWA0ryJw8KUBZ2iZpxbw=
35
cloud.google.com/go/auth v0.16.1 h1:XrXauHMd30LhQYVRHLGvJiYeczweKQXZxsTbV9TiguU=
@@ -22,6 +24,8 @@ connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
2224
connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
2325
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
2426
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
27+
filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
28+
filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
2529
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
2630
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
2731
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=

‎integrations/terraform-mwi/go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ require (
3737
code.dny.dev/ssrf v0.2.0 // indirect
3838
connectrpc.com/connect v1.18.1 // indirect
3939
dario.cat/mergo v1.0.1 // indirect
40+
filippo.io/age v1.2.1 // indirect
4041
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
4142
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.0 // indirect
4243
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect

‎integrations/terraform-mwi/go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
2+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
13
cel.dev/expr v0.23.1 h1:K4KOtPCJQjVggkARsjG9RWXP6O4R73aHeJMa/dmCQQg=
24
cel.dev/expr v0.23.1/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
35
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
@@ -43,6 +45,8 @@ connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
4345
connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
4446
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
4547
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
48+
filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
49+
filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
4650
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
4751
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
4852
github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=

‎integrations/terraform/go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ require (
3434
code.dny.dev/ssrf v0.2.0 // indirect
3535
connectrpc.com/connect v1.18.1 // indirect
3636
dario.cat/mergo v1.0.1 // indirect
37+
filippo.io/age v1.2.1 // indirect
3738
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
3839
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.0 // indirect
3940
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect

‎integrations/terraform/go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
2+
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
13
cel.dev/expr v0.23.1 h1:K4KOtPCJQjVggkARsjG9RWXP6O4R73aHeJMa/dmCQQg=
24
cel.dev/expr v0.23.1/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
35
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
@@ -68,6 +70,8 @@ connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2pr
6870
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
6971
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
7072
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
73+
filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
74+
filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
7175
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
7276
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
7377
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=

‎lib/auth/auth.go

Lines changed: 55 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ import (
9191
"github.com/gravitational/teleport/lib/auth/keystore"
9292
"github.com/gravitational/teleport/lib/auth/machineid/workloadidentityv1"
9393
"github.com/gravitational/teleport/lib/auth/okta"
94+
"github.com/gravitational/teleport/lib/auth/recordingencryption"
9495
"github.com/gravitational/teleport/lib/auth/userloginstate"
9596
wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
9697
wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
@@ -222,6 +223,57 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
222223
}
223224
cfg.ClusterConfiguration = clusterConfig
224225
}
226+
if cfg.KeyStore == nil {
227+
keystoreOpts := &keystore.Options{
228+
HostUUID: cfg.HostUUID,
229+
ClusterName: cfg.ClusterName,
230+
AuthPreferenceGetter: cfg.ClusterConfiguration,
231+
FIPS: cfg.FIPS,
232+
}
233+
if cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {
234+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
235+
return nil, fmt.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
236+
}
237+
} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {
238+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
239+
return nil, fmt.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
240+
}
241+
} else if cfg.KeyStoreConfig.AWSKMS != nil {
242+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
243+
return nil, fmt.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
244+
}
245+
}
246+
cfg.KeyStore, err = keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)
247+
if err != nil {
248+
return nil, trace.Wrap(err)
249+
}
250+
}
251+
if cfg.RecordingEncryption == nil {
252+
localRecordingEncryption, err := local.NewRecordingEncryptionService(cfg.Backend)
253+
if err != nil {
254+
return nil, trace.Wrap(err)
255+
}
256+
257+
recordingEncryptionManager, err := recordingencryption.NewManager(recordingencryption.ManagerConfig{
258+
Backend: localRecordingEncryption,
259+
ClusterConfig: cfg.ClusterConfiguration,
260+
KeyStore: cfg.KeyStore,
261+
Logger: cfg.Logger,
262+
LockConfig: backend.RunWhileLockedConfig{
263+
LockConfiguration: backend.LockConfiguration{
264+
Backend: cfg.Backend,
265+
TTL: time.Second * 30,
266+
LockNameComponents: []string{"recording_encryption"},
267+
},
268+
},
269+
})
270+
if err != nil {
271+
return nil, trace.Wrap(err)
272+
}
273+
274+
cfg.RecordingEncryption = recordingEncryptionManager
275+
cfg.ClusterConfiguration = recordingEncryptionManager
276+
}
225277
if cfg.AutoUpdateService == nil {
226278
cfg.AutoUpdateService, err = local.NewAutoUpdateService(cfg.Backend)
227279
if err != nil {
@@ -465,30 +517,6 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
465517

466518
limiter := limiter.NewConnectionsLimiter(defaults.LimiterMaxConcurrentSignatures)
467519

468-
keystoreOpts := &keystore.Options{
469-
HostUUID: cfg.HostUUID,
470-
ClusterName: cfg.ClusterName,
471-
AuthPreferenceGetter: cfg.ClusterConfiguration,
472-
FIPS: cfg.FIPS,
473-
}
474-
if cfg.KeyStoreConfig.PKCS11 != (servicecfg.PKCS11Config{}) {
475-
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
476-
return nil, fmt.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
477-
}
478-
} else if cfg.KeyStoreConfig.GCPKMS != (servicecfg.GCPKMSConfig{}) {
479-
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
480-
return nil, fmt.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
481-
}
482-
} else if cfg.KeyStoreConfig.AWSKMS != nil {
483-
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
484-
return nil, fmt.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
485-
}
486-
}
487-
keyStore, err := keystore.NewManager(context.Background(), &cfg.KeyStoreConfig, keystoreOpts)
488-
if err != nil {
489-
return nil, trace.Wrap(err)
490-
}
491-
492520
if cfg.KubeWaitingContainers == nil {
493521
cfg.KubeWaitingContainers, err = local.NewKubeWaitingContainerService(cfg.Backend)
494522
if err != nil {
@@ -566,6 +594,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
566594
HealthCheckConfig: cfg.HealthCheckConfig,
567595
BackendInfoService: cfg.BackendInfo,
568596
VnetConfigService: cfg.VnetConfigService,
597+
RecordingEncryptionManager: cfg.RecordingEncryption,
569598
}
570599

571600
as := Server{
@@ -582,7 +611,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
582611
Unstable: local.NewUnstableService(cfg.Backend, cfg.AssertionReplayService),
583612
Services: services,
584613
Cache: services,
585-
keyStore: keyStore,
614+
keyStore: cfg.KeyStore,
586615
traceClient: cfg.TraceClient,
587616
fips: cfg.FIPS,
588617
loadAllCAs: cfg.LoadAllCAs,
@@ -805,6 +834,7 @@ type Services struct {
805834
services.HealthCheckConfig
806835
services.BackendInfoService
807836
services.VnetConfigService
837+
RecordingEncryptionManager
808838
}
809839

810840
// GetWebSession returns existing web session described by req.

‎lib/auth/helpers.go

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,10 @@ import (
4343
"github.com/gravitational/teleport/api/types"
4444
apiutils "github.com/gravitational/teleport/api/utils"
4545
"github.com/gravitational/teleport/api/utils/keys"
46+
"github.com/gravitational/teleport/entitlements"
4647
"github.com/gravitational/teleport/lib/auth/accesspoint"
4748
"github.com/gravitational/teleport/lib/auth/authclient"
49+
"github.com/gravitational/teleport/lib/auth/keystore"
4850
"github.com/gravitational/teleport/lib/auth/state"
4951
authority "github.com/gravitational/teleport/lib/auth/testauthority"
5052
"github.com/gravitational/teleport/lib/authz"
@@ -56,6 +58,7 @@ import (
5658
"github.com/gravitational/teleport/lib/events"
5759
"github.com/gravitational/teleport/lib/events/eventstest"
5860
"github.com/gravitational/teleport/lib/limiter"
61+
"github.com/gravitational/teleport/lib/modules"
5962
"github.com/gravitational/teleport/lib/service/servicecfg"
6063
"github.com/gravitational/teleport/lib/services"
6164
"github.com/gravitational/teleport/lib/services/local"
@@ -292,6 +295,39 @@ func NewTestAuthServer(cfg TestAuthServerConfig) (*TestAuthServer, error) {
292295
return nil, trace.Wrap(err)
293296
}
294297

298+
hostUUID := uuid.New().String()
299+
clusterConfig, err := local.NewClusterConfigurationService(srv.Backend)
300+
if err != nil {
301+
return nil, trace.Wrap(err)
302+
}
303+
// create keystore
304+
keystoreOpts := &keystore.Options{
305+
HostUUID: hostUUID,
306+
ClusterName: clusterName,
307+
AuthPreferenceGetter: clusterConfig,
308+
FIPS: cfg.FIPS,
309+
}
310+
311+
switch {
312+
case cfg.KeystoreConfig.PKCS11 != servicecfg.PKCS11Config{}:
313+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
314+
return nil, trace.Errorf("PKCS11 HSM support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
315+
}
316+
case cfg.KeystoreConfig.GCPKMS != servicecfg.GCPKMSConfig{}:
317+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
318+
return nil, trace.Errorf("GCP KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
319+
}
320+
case cfg.KeystoreConfig.AWSKMS != nil:
321+
if !modules.GetModules().Features().GetEntitlement(entitlements.HSM).Enabled {
322+
return nil, trace.Errorf("AWS KMS support requires a license with the HSM feature enabled: %w", ErrRequiresEnterprise)
323+
}
324+
}
325+
326+
keyStore, err := keystore.NewManager(ctx, &cfg.KeystoreConfig, keystoreOpts)
327+
if err != nil {
328+
return nil, trace.Wrap(err)
329+
}
330+
295331
srv.AuthServer, err = NewServer(&InitConfig{
296332
DataDir: cfg.Dir,
297333
Backend: srv.Backend,
@@ -309,7 +345,8 @@ func NewTestAuthServer(cfg TestAuthServerConfig) (*TestAuthServer, error) {
309345
HostUUID: uuid.New().String(),
310346
AccessLists: accessLists,
311347
FIPS: cfg.FIPS,
312-
KeyStoreConfig: cfg.KeystoreConfig,
348+
KeyStore: keyStore,
349+
ClusterConfiguration: clusterConfig,
313350
},
314351
WithClock(cfg.Clock),
315352
)

‎lib/auth/init.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ import (
5757
"github.com/gravitational/teleport/lib/auth/keystore"
5858
"github.com/gravitational/teleport/lib/auth/machineid/machineidv1"
5959
"github.com/gravitational/teleport/lib/auth/migration"
60+
"github.com/gravitational/teleport/lib/auth/recordingencryption"
6061
"github.com/gravitational/teleport/lib/auth/state"
6162
"github.com/gravitational/teleport/lib/backend"
6263
"github.com/gravitational/teleport/lib/cryptosuites"
@@ -85,6 +86,13 @@ type VersionStorage interface {
8586
DeleteTeleportVersion(ctx context.Context) error
8687
}
8788

89+
// RecordingEncryptionManager wraps a RecordingEncryption backend service with higher level
90+
// operations.
91+
type RecordingEncryptionManager interface {
92+
services.RecordingEncryption
93+
recordingencryption.DecryptionKeyFinder
94+
}
95+
8896
// InitConfig is auth server init config
8997
type InitConfig struct {
9098
// Backend is auth backend to use
@@ -100,6 +108,10 @@ type InitConfig struct {
100108
// keys that may be held in an HSM.
101109
KeyStoreConfig servicecfg.KeystoreConfig
102110

111+
// KeyStore which handles private CA keys and encryption keys that may be
112+
// held in an HSM.
113+
KeyStore *keystore.Manager
114+
103115
// HostUUID is a UUID of this host
104116
HostUUID string
105117

@@ -367,6 +379,9 @@ type InitConfig struct {
367379
// BackendInfo is a service of backend information.
368380
BackendInfo services.BackendInfoService
369381

382+
// RecordingEncryption manages state for encrypted session recording.
383+
RecordingEncryption RecordingEncryptionManager
384+
370385
// SkipVersionCheck skips version check during major version upgrade/downgrade.
371386
SkipVersionCheck bool
372387

0 commit comments

Comments
 (0)