gravitational/teleport-plugins

Improve error message when plugins receive an unknown event

tigrato opened this issue · 0 comments

Current behavior:

When a Teleport plugin receives an unknown event from the Auth Server it prints a horrifying message and crashes:
*trace.BadParameterError failed to parse event, session record is corrupted

Teleport transfers audit events using a Protobuf oneof message wrapper.

When the Auth Server is running with a newer version than the plugins and it has new event types that the older plugins version doesn't support, the event is unmarshaled as nil and we return an error.

When the plugin's package loads the Auth events to send them to the upstream service, it receives an unsupported event - protobuf Event returns nil, and the unknown event payload is stored under XXX_unrecognized as raw bytes.

Expected behavior:

Teleport Plugins should print a better message to the user specifying that an incompatible event was received from Auth server and an upgrade of the plugin handler to the same version as the auth server must happen.

We can check the XXX_unrecognized and return a different message saying that the plugins must be upgraded to work correctly. It should also mention that during the downtime no events are lost and once the plugin's code is updated, it continues from the last processed event.

Auth Server: v11.3.5
Plugins: v10.3.2