gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
16.99k stars 1.71k forks source link

RDP session gets killed randomly with `[TDPClient] RuntimeError: unreachable` and `[TDPClient] websocket closed with error code: 1005` #42006

Open uedvt359 opened 1 month ago

uedvt359 commented 1 month ago

Expected behavior:

The session should not be terminated randomly. this used to work with 15.1.x, started appearing with 15.2.x and is still present in 15.3.x.

Current behavior:

After some time, between about half an hour and an hour, the RDP session gets terminated. the server logs appear to show a graceful termination, but the web client's console shows an error:

image

May 24 09:45:07 teleport.local teleport[787170]: 2024-05-24T09:45:07+02:00 INFO [WINDOWS_D] TDP input streaming finished client-ip:192.168.1.100 desktop-addr:10.0.0.1:3389 desktop-name:the-hostname pid:787170.1 rdp-addr:10.0.0.1:3389 rdpclient/client.go:380
May 24 09:45:07 teleport.local teleport[787170]: 2024-05-24T09:45:07+02:00 INFO [WINDOWS_D] RDP client exited gracefully client-ip:192.168.1.100 desktop-addr:10.0.0.1:3389 desktop-name:the-hostname pid:787170.1 rdp-addr:10.0.0.1:3389 rdpclient/client.go:351
May 24 09:45:07 teleport.local teleport[787170]: 2024-05-24T09:45:07+02:00 INFO [WINDOWS_D] Rust RDP loop finished client-ip:192.168.1.100 desktop-addr:10.0.0.1:3389 desktop-name:the-hostname pid:787170.1 rdp-addr:10.0.0.1:3389 rdpclient/client.go:354
May 24 09:45:07 teleport.local teleport[787170]: 2024-05-24T09:45:07+02:00 INFO [AUDIT]     windows.desktop.session.end cluster_name:teleport.local code:TDP01I desktop_addr:10.0.0.1:3389 teleport.dev/computer_name:THE-HOSTNAME teleport.dev/dns_host_name:the-hostname.local teleport.dev/origin:dynamic teleport.dev/os:Windows Server 2022 Standard teleport.dev/os_version:10.0 (20348) teleport.dev/ou:DC=local teleport.dev/windows_domain:local desktop_name:the-hostname ei:28642 event:windows.desktop.session.end login:myusername participants:[myusername] private_key_policy:none recorded:false session_start:2024-05-24T07:12:12.538Z session_stop:2024-05-24T07:45:07.856616839Z sid:51551012-7012-4864-861b-bbd55b933e4e time:2024-05-24T07:45:07.857Z uid:8379a56a-e9e1-4682-b961-e8390997e13d user:myusername user_kind:1 windows_desktop_service:0509a511-76aa-413e-a3d8-f91db10d16a3 windows_domain:local windows_user:myusername with_mfa:844b3b75-eaeb-47f0-8a84-257e1b256285 events/emitter.go:288

the host has been discovered through active directory; here are the resource and role:

[root@teleport ~]# tctl get windows_desktop/the-hostname
kind: windows_desktop
metadata:
  expires: "2024-05-24T09:42:25.227771Z"
  id: 238400805386977174
  labels:
    teleport.dev/computer_name: THE-HOSTNAME
    teleport.dev/dns_host_name: the-hostname.local
    teleport.dev/origin: dynamic
    teleport.dev/os: Windows Server 2022 Standard
    teleport.dev/os_version: 10.0 (20348)
    teleport.dev/ou: DC=local
    teleport.dev/windows_domain: local
  name: the-hostname
  revision: 96ff41f7-44f8-4e03-b67f-9649b8e35f34
spec:
  addr: 10.0.0.1:3389
  domain: local
  host_id: 0509a511-76aa-413e-a3d8-f91db10d16a3
  non_ad: false
version: v3

[root@teleport ~]# tctl get roles/rdp-for-the-hostname
kind: role
metadata:
  id: 5495494847852907985
  name: rdp-for-the-hostname
  revision: d10d439f-72eb-434c-a959-dfb557d8af5f
spec:
  allow:
    windows_desktop_labels:
      teleport.dev/dns_host_name: the-hostname.local
    windows_desktop_logins:
    - '{{internal.windows_logins}}'
  deny: {}
  options:
    cert_format: standard
    create_db_user: false
    create_desktop_user: false
    desktop_clipboard: true
    desktop_directory_sharing: false
    enhanced_recording:
    - command
    - network
    forward_agent: false
    idp:
      saml:
        enabled: true
    max_session_ttl: 30h0m0s
    pin_source_ip: false
    port_forwarding: true
    record_session:
      default: best_effort
      desktop: true
    require_session_mfa: true
    ssh_file_copy: true
version: v7

I tested the following versions:

Bug details:

zmb3 commented 1 month ago

Looks almost like it's flapping between two slightly different screen sizes.

uedvt359 commented 1 month ago

the RDP window is in full screen mode, so the browser shouldn't get resized. I get a bunch of these events, even before the disconnect, but haven't managed to track down why. in any case, i don't believe the resize events are related to this problem.

zmb3 commented 1 month ago

I'm not so sure. You report problems starting in 15.2 which is when resize was introduced.

ibeckermayer commented 1 month ago

@uedvt359 can you try finding a stable size, such that the screen height doesn't appear to be flipping back and forth with a 1 px difference, and see if it still reproduces?

uedvt359 commented 1 month ago

it seems that the 1px flapping is caused by alt-tabbing away while in fullscreen mode of chrome.exe --app=.... i'll see if this reproduces, but for now, i can't keep the session going long enough due to another bug (which i'll open a seperate issue about => #42349).