Release v0.29.0 · warp-tech/warpgate

查看原文 / View Original 编辑 / Edit

Release v0.29.0 · warp-tech/warpgate

Note: Would you kindly spend 5 minutes to give your feedback on your deployment and what you’d like to see in Warpgate? Multiple changes in this release have been proposed by users like you through this survey. 注意： 您是否愿意花 5 分钟时间反馈您的部署情况以及您希望在 Warpgate 中看到的功能？此版本中的多项更改都是由像您一样的用户通过此调查提出的。

Warning: This release contains breaking API changes, meaning that existing API clients might not work anymore. Compatible Terraform provider version: v1.2.0, Kubernetes operator: v0.4.11. 警告： 此版本包含破坏性的 API 更改，这意味着现有的 API 客户端可能无法继续工作。兼容的 Terraform 提供程序版本为 v1.2.0，Kubernetes Operator 版本为 v0.4.11。

Major new features / 主要新功能

  • Session approvals (JIT access) - #2563: You can set up targets to require an admin to approve each session before the connection is allowed, with configurable timeout and approval caching. 会话审批（JIT 访问）- #2563： 您可以设置目标，要求管理员在允许连接之前批准每个会话，并支持可配置的超时时间和审批缓存。
  • MFA enforcement policy - #2555: A global setting to require or prompt enrollment of a second factor for all users, with an option to exempt SSO users. MFA 强制策略 - #2555： 一项全局设置，要求或提示所有用户注册双重身份验证（MFA），并提供豁免 SSO 用户的选项。
  • Default credential policy setting for new users - #2557: Editable under Config → Policies, the new policy applies to all new users by default. 新用户默认凭据策略设置 - #2557： 可在“配置 → 策略”（Config → Policies）下编辑，该新策略默认应用于所有新用户。

Changes / 变更

  • Support tickets for Kubernetes access by @LarsSven in #2562. 由 @LarsSven 提交的 Kubernetes 访问支持工单 (#2562)。
  • Sessions are now split into user sessions and target sessions, so a single HTTP session lists all its target connections together in the admin UI by @Eugeny in #2499. 由 @Eugeny 提交的更改 (#2499)：会话现在拆分为用户会话和目标会话，因此单个 HTTP 会话会在管理界面中将其所有目标连接列在一起。
  • Kubernetes exec, attach, port-forward and debug container usage is now logged in the structured audit log by @huguesgr in #2558. 由 @huguesgr 提交的更改 (#2558)：Kubernetes 的 exec、attach、port-forward 和调试容器的使用情况现在会被记录在结构化审计日志中。
  • SSH host keys are now stored in the database instead of the data directory. Existing key files are imported automatically in #2570. SSH 主机密钥现在存储在数据库中，而不是数据目录中。现有的密钥文件会自动导入 (#2570)。

Security fixes / 安全修复

  • [Minor] GHSA-hrfx-fm67-gv64 - Kubernetes clients see detailed error messages: Kubernetes clients see exact reasons for certificate validation failures and possibly database errors. [次要] GHSA-hrfx-fm67-gv64 - Kubernetes 客户端可查看详细错误信息： Kubernetes 客户端现在可以看到证书验证失败的确切原因以及可能的数据库错误。
  • [Moderate] GHSA-m2h4-9m63-6vqp - Stale HTTP sessions can access a recreated account: If a user account is deleted and later recreated, existing HTTP sessions for the deleted user remain logged in. [中等] GHSA-m2h4-9m63-6vqp - 过期的 HTTP 会话可以访问重新创建的账户： 如果用户账户被删除后又重新创建，已删除用户的现有 HTTP 会话仍保持登录状态。
  • [Moderate] GHSA-pw7m-635x-pmx7 - Stale Kubernetes sessions can access a recreated account: If a user account is deleted and later recreated, existing Kubernetes sessions for the deleted user remain logged in. [中等] GHSA-pw7m-635x-pmx7 - 过期的 Kubernetes 会话可以访问重新创建的账户： 如果用户账户被删除后又重新创建，已删除用户的现有 Kubernetes 会话仍保持登录状态。
  • [Moderate] GHSA-xr7p-gw3r-m3jx - Deleting a user does not close native sessions: If a user account is deleted while having open native protocol sessions, those sessions remain active until close. [中等] GHSA-xr7p-gw3r-m3jx - 删除用户不会关闭原生会话： 如果在删除用户账户时仍有打开的原生协议会话，这些会话将保持活动状态直到关闭。

Fixes / 修复

  • Fixed #2597: The public key and SSO credential update endpoints allowed moving credentials between users. 修复 #2597：公钥和 SSO 凭据更新端点允许在用户之间移动凭据。
  • Fixed #2598: Commands and subsystems started through a pending session approval were not recorded. 修复 #2598：通过待审批会话启动的命令和子系统未被记录。
  • A malformed external_host is now parsed (best effort) or produces a config warning. 格式错误的 external_host 现在会被解析（尽力而为）或产生配置警告。
  • Admin and gateway API error responses now log the reason for the failure. 管理和网关 API 错误响应现在会记录失败原因。
  • 3xx HTTP responses are no longer logged as errors. 3xx HTTP 响应不再被记录为错误。
  • Deleting a user now closes all of their active sessions. 删除用户现在会关闭其所有活动会话。
  • Fixed #2590: A race condition when running SQLite migrations. 修复 #2590：运行 SQLite 迁移时的竞态条件。
  • Fixed #2594: TOTP secrets created in the admin UI are now generated with a CSPRNG. 修复 #2594：在管理界面中创建的 TOTP 密钥现在使用 CSPRNG（加密安全伪随机数生成器）生成。
  • SSH: When a target dies, the client is now sent a disconnect instead of being left hanging (#2520). SSH：当目标终止时，客户端现在会收到断开连接信号，而不是挂起 (#2520)。
  • Live UI updates (sessions/approvals) now work across cluster nodes. 实时 UI 更新（会话/审批）现在可以在集群节点间正常工作。
  • Fixed #2585: A malformed RDP handshake could spin a CPU core. 修复 #2585：格式错误的 RDP 握手可能导致 CPU 核心满载。
  • Internal error details (database, LDAP, TLS, upstream errors) are now hidden in HTTP responses; end users will see a correlation ID that can be cross-referenced to the server logs. 内部错误详情（数据库、LDAP、TLS、上游错误）现在在 HTTP 响应中被隐藏；最终用户将看到一个关联 ID，可用于对照服务器日志进行排查。
  • SSH: Sessions with a large amount of output could end without the client being told the channel was closed, leaving SSH hanging. SSH：输出量巨大的会话可能会在未通知客户端通道已关闭的情况下结束，导致 SSH 挂起。
  • Fixed #2536: Do not record keypresses during interactive RDP logon, add an option to disable keyboard recording completely. 修复 #2536：不在交互式 RDP 登录期间记录按键，并添加了完全禁用键盘记录的选项。
  • Keep the auto-reconnect secret out of the RDP logon log line. 将自动重连密钥从 RDP 登录日志行中移除。

Other / 其他

  • Docker images migrated from Debian bullseye to bookworm. Docker 镜像已从 Debian bullseye 迁移至 bookworm。
← 返回新闻列表 / Back to news list