[branch/v8] Backport #10665 (#11063)

* Add unknown event instead of error on audit log read (#10665)

* update gomod

* fix backport

api/types/events/events.proto

@@ -1588,6 +1588,22 @@ message CertificateCreate {
     Identity Identity = 3 [ (gogoproto.jsontag) = "identity" ];
 }
 
+// Unknown is a fallback event used when we don't recognize an event from the backend.
+message Unknown {
+    // Metadata is a common event metadata.
+    Metadata Metadata = 1
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // UnknownType is the event type extracted from the unknown event.
+    string UnknownType = 2 [ (gogoproto.jsontag) = "unknown_event" ];
+
+    // UnknownCode is the event code extracted from the unknown event.
+    string UnknownCode = 3 [ (gogoproto.jsontag) = "unknown_code,omitempty" ];
+
+    // Data is the serialized JSON data of the unknown event.
+    string Data = 4 [ (gogoproto.jsontag) = "data" ];
+}
+
 // OneOf is a union of one of audit events submitted to the auth service
 message OneOf {
     // Event is one of the audit events
@@ -1655,6 +1671,7 @@ message OneOf {
         events.AccessRequestDelete AccessRequestDelete = 66;
         events.SessionConnect SessionConnect = 67;
         events.CertificateCreate CertificateCreate = 68;
+        events.Unknown Unknown = 80;
     }
 }
 

api/types/events/oneof.go

@@ -17,9 +17,11 @@ limitations under the License.
 package events
 
 import (
+	"encoding/json"
 	"reflect"
 
 	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
 )
 
 // MustToOneOf converts audit event to OneOf
@@ -290,7 +292,23 @@ func ToOneOf(in AuditEvent) (*OneOf, error) {
 			CertificateCreate: e,
 		}
 	default:
-		return nil, trace.BadParameter("event type %T is not supported", in)
+		log.Errorf("Attempted to convert dynamic event of unknown type \"%v\" into protobuf event.", in.GetType())
+		unknown := &Unknown{}
+		unknown.Type = UnknownEvent
+		unknown.Code = UnknownCode
+		unknown.Time = in.GetTime()
+		unknown.ClusterName = in.GetClusterName()
+		unknown.UnknownType = in.GetType()
+		unknown.UnknownCode = in.GetCode()
+		data, err := json.Marshal(in)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		unknown.Data = string(data)
+		out.Event = &OneOf_Unknown{
+			Unknown: unknown,
+		}
 	}
 	return &out, nil
 }

api/types/events/unknown.go

@@ -0,0 +1,25 @@
+/*
+Copyright 2021 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package events
+
+const (
+	// UnknownEvent is any event received that isn't recognized as any other event type.
+	UnknownEvent = "unknown"
+
+	// UnknownCode is used when an event of unknown type is encountered.
+	UnknownCode = "TCC00E"
+)

lib/events/api.go

@@ -446,6 +446,9 @@ const (
 
 	// CertificateTypeUser is the CertificateType for certificate events pertaining to user certificates.
 	CertificateTypeUser = "user"
+
+	// UnknownEvent is any event received that isn't recognized as any other event type.
+	UnknownEvent = apievents.UnknownEvent
 )
 
 const (

lib/events/codes.go

@@ -16,6 +16,8 @@ limitations under the License.
 
 package events
 
+import apievents "github.com/gravitational/teleport/api/types/events"
+
 // Event describes an audit log event.
 type Event struct {
 	// Name is the event name.
@@ -466,4 +468,7 @@ const (
 
 	// CertificateCreateCode is the certificate issuance event code.
 	CertificateCreateCode = "TC000I"
+
+	// UnknownCode is used when an event of unknown type is encountered.
+	UnknownCode = apievents.UnknownCode
 )

lib/events/dynamic.go

@@ -22,6 +22,7 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
 
 	"encoding/json"
 )
@@ -458,8 +459,25 @@ func FromEventFields(fields EventFields) (apievents.AuditEvent, error) {
 			return nil, trace.Wrap(err)
 		}
 		return &e, nil
+	case UnknownEvent:
+		var e events.CertificateCreate
+		if err := utils.FastUnmarshal(data, &e); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &e, nil
 	default:
-		return nil, trace.BadParameter("unknown event type: %q", eventType)
+		log.Errorf("Attempted to convert dynamic event of unknown type \"%v\" into protobuf event.", eventType)
+		unknown := &events.Unknown{}
+		if err := utils.FastUnmarshal(data, unknown); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		unknown.Type = UnknownEvent
+		unknown.Code = UnknownCode
+		unknown.UnknownType = eventType
+		unknown.UnknownCode = fields.GetString(EventCode)
+		unknown.Data = string(data)
+		return unknown, nil
 	}
 }