From e39d87e7221fbd0978eb8a922e6d231fdffe06d6 Mon Sep 17 00:00:00 2001
From: Bartosz Leper <bartosz.leper@goteleport.com>
Date: Mon, 13 Jan 2025 13:36:04 +0100
Subject: [PATCH] Support SSH port forwarding options in the role editor

Allows both modern and legacy options. Bails out on malformed options
and degrades to YAML mode.
---
 .../RoleEditor/StandardEditor/Options.tsx     |  33 +-
 .../StandardEditor/standardmodel.test.ts      | 292 +++++++++++++-----
 .../StandardEditor/standardmodel.ts           | 146 ++++++++-
 .../RoleEditor/StandardEditor/withDefaults.ts |  30 +-
 .../teleport/src/services/resources/types.ts  |  11 +-
 5 files changed, 396 insertions(+), 116 deletions(-)

diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx
index cbde6cb188559..c67f01c85e396 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/Options.tsx
@@ -17,13 +17,14 @@
  */
 
 import { memo, useId } from 'react';
+import { components, OptionProps } from 'react-select';
 import styled, { useTheme } from 'styled-components';
 
 import Box from 'design/Box';
 import Input from 'design/Input';
 import LabelInput from 'design/LabelInput';
 import { RadioGroup } from 'design/RadioGroup';
-import { H4 } from 'design/Text';
+import Text, { H4 } from 'design/Text';
 import Select from 'shared/components/Select';
 
 import { SectionProps } from './sections';
@@ -33,6 +34,8 @@ import {
   OptionsModel,
   requireMFATypeOptions,
   sessionRecordingModeOptions,
+  SSHPortForwardingModeOption,
+  sshPortForwardingModeOptions,
 } from './standardmodel';
 
 /**
@@ -53,6 +56,8 @@ export const Options = memo(function Options({
   const createDBUserModeId = `${id}-create-db-user-mode`;
   const defaultSessionRecordingModeId = `${id}-default-session-recording-mode`;
   const sshSessionRecordingModeId = `${id}-ssh-session-recording-mode`;
+  const sshPortForwardingModeId = `${id}-ssh-port-forwarding-mode`;
+
   return (
     <OptionsGridContainer
       border={1}
@@ -140,6 +145,18 @@ export const Options = memo(function Options({
         onChange={m => onChange?.({ ...value, sshSessionRecordingMode: m })}
       />
 
+      <OptionLabel htmlFor={sshPortForwardingModeId}>
+        Port Forwarding Mode
+      </OptionLabel>
+      <Select
+        components={sshPortForwardingModeComponents}
+        inputId={sshPortForwardingModeId}
+        isDisabled={isProcessing}
+        options={sshPortForwardingModeOptions}
+        value={value.sshPortForwardingMode}
+        onChange={m => onChange?.({ ...value, sshPortForwardingMode: m })}
+      />
+
       <OptionsHeader separator>Database</OptionsHeader>
 
       <Box>Create Database User</Box>
@@ -195,6 +212,20 @@ export const Options = memo(function Options({
   );
 });
 
+const SSHPortForwardingModeOptionComponent = (
+  props: OptionProps<SSHPortForwardingModeOption, false>
+) => {
+  return (
+    <components.Option {...props}>
+      {props.label} <Text typography="body3">{props.data.description}</Text>
+    </components.Option>
+  );
+};
+
+const sshPortForwardingModeComponents = {
+  Option: SSHPortForwardingModeOptionComponent,
+};
+
 const OptionsGridContainer = styled(Box)`
   display: grid;
   grid-template-columns: 1fr 1fr;
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts
index 572f9b2595f0c..1d8ffeb387a1c 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts
@@ -27,15 +27,26 @@ import {
   Role,
   Rule,
   SessionRecordingMode,
+  SSHPortForwarding,
 } from 'teleport/services/resources';
 
 import {
+  createDBUserModeOptionsMap,
+  createHostUserModeOptionsMap,
   KubernetesAccess,
+  kubernetesResourceKindOptionsMap,
+  kubernetesVerbOptionsMap,
   labelsModelToLabels,
   labelsToModel,
+  portForwardingOptionsToModel,
+  requireMFATypeOptionsMap,
+  resourceKindOptionsMap,
   RoleEditorModel,
   roleEditorModelToRole,
   roleToRoleEditorModel,
+  sessionRecordingModeOptionsMap,
+  sshPortForwardingModeOptionsMap,
+  verbOptionsMap,
 } from './standardmodel';
 import { optionsWithDefaults, withDefaults } from './withDefaults';
 
@@ -51,26 +62,19 @@ const minimalRoleModel = (): RoleEditorModel => ({
     maxSessionTTL: '30h0m0s',
     clientIdleTimeout: '',
     disconnectExpiredCert: false,
-    requireMFAType: {
-      value: false,
-      label: 'No',
-    },
-    createHostUserMode: {
-      value: '',
-      label: 'Unspecified',
-    },
+    requireMFAType: requireMFATypeOptionsMap.get(false),
+    createHostUserMode: createHostUserModeOptionsMap.get(''),
     createDBUser: false,
-    createDBUserMode: {
-      value: '',
-      label: 'Unspecified',
-    },
+    createDBUserMode: createDBUserModeOptionsMap.get(''),
     desktopClipboard: true,
     createDesktopUser: false,
     desktopDirectorySharing: true,
-    defaultSessionRecordingMode: { value: 'best_effort', label: 'Best Effort' },
-    sshSessionRecordingMode: { value: '', label: 'Unspecified' },
+    defaultSessionRecordingMode:
+      sessionRecordingModeOptionsMap.get('best_effort'),
+    sshSessionRecordingMode: sessionRecordingModeOptionsMap.get(''),
     recordDesktopSessions: true,
     forwardAgent: false,
+    sshPortForwardingMode: sshPortForwardingModeOptionsMap.get(''),
   },
 });
 
@@ -261,6 +265,14 @@ describe.each<{ name: string; role: Role; model: RoleEditorModel }>([
             ssh: 'best_effort',
           },
           forward_agent: true,
+          ssh_port_forwarding: {
+            local: {
+              enabled: true,
+            },
+            remote: {
+              enabled: false,
+            },
+          },
         },
       },
     },
@@ -270,20 +282,43 @@ describe.each<{ name: string; role: Role; model: RoleEditorModel }>([
         maxSessionTTL: '1h15m30s',
         clientIdleTimeout: '2h30m45s',
         disconnectExpiredCert: true,
-        requireMFAType: { value: 'hardware_key', label: 'Hardware Key' },
-        createHostUserMode: { value: 'keep', label: 'Keep' },
+        requireMFAType: requireMFATypeOptionsMap.get('hardware_key'),
+        createHostUserMode: createHostUserModeOptionsMap.get('keep'),
         createDBUser: true,
-        createDBUserMode: {
-          value: 'best_effort_drop',
-          label: 'Drop (best effort)',
-        },
+        createDBUserMode: createDBUserModeOptionsMap.get('best_effort_drop'),
         desktopClipboard: false,
         createDesktopUser: true,
         desktopDirectorySharing: false,
-        defaultSessionRecordingMode: { value: 'strict', label: 'Strict' },
-        sshSessionRecordingMode: { value: 'best_effort', label: 'Best Effort' },
+        defaultSessionRecordingMode:
+          sessionRecordingModeOptionsMap.get('strict'),
+        sshSessionRecordingMode:
+          sessionRecordingModeOptionsMap.get('best_effort'),
         recordDesktopSessions: false,
         forwardAgent: true,
+        sshPortForwardingMode:
+          sshPortForwardingModeOptionsMap.get('local-only'),
+      },
+    },
+  },
+
+  {
+    name: 'Options object with legacy port forwarding',
+    role: {
+      ...minimalRole(),
+      spec: {
+        ...minimalRole().spec,
+        options: {
+          ...minimalRole().spec.options,
+          port_forwarding: true,
+        },
+      },
+    },
+    model: {
+      ...minimalRoleModel(),
+      options: {
+        ...minimalRoleModel().options,
+        sshPortForwardingMode:
+          sshPortForwardingModeOptionsMap.get('deprecated-on'),
       },
     },
   },
@@ -297,6 +332,93 @@ describe.each<{ name: string; role: Role; model: RoleEditorModel }>([
   });
 });
 
+test.each<{
+  name: string;
+  portForwarding?: SSHPortForwarding;
+  legacyPortForwarding?: boolean;
+  expected: ReturnType<typeof portForwardingOptionsToModel>;
+}>([
+  { name: 'unspecified', expected: { model: '', requiresReset: false } },
+  {
+    name: 'none',
+    portForwarding: { local: { enabled: false }, remote: { enabled: false } },
+    expected: { model: 'none', requiresReset: false },
+  },
+  {
+    name: 'local-only',
+    portForwarding: { local: { enabled: true }, remote: { enabled: false } },
+    expected: { model: 'local-only', requiresReset: false },
+  },
+  {
+    name: 'remote-only',
+    portForwarding: { local: { enabled: false }, remote: { enabled: true } },
+    expected: { model: 'remote-only', requiresReset: false },
+  },
+  {
+    name: ' local-and-remote',
+    portForwarding: { local: { enabled: true }, remote: { enabled: true } },
+    expected: { model: 'local-and-remote', requiresReset: false },
+  },
+  {
+    name: 'deprecated-on',
+    legacyPortForwarding: true,
+    expected: { model: 'deprecated-on', requiresReset: false },
+  },
+  {
+    name: 'deprecated-off',
+    legacyPortForwarding: false,
+    expected: { model: 'deprecated-off', requiresReset: false },
+  },
+  {
+    name: 'local-and-remote (overriding deprecated even if specified)',
+    portForwarding: { local: { enabled: true }, remote: { enabled: true } },
+    legacyPortForwarding: false,
+    expected: { model: 'local-and-remote', requiresReset: false },
+  },
+  {
+    name: 'an empty port forwarding object',
+    portForwarding: {},
+    expected: { model: '', requiresReset: true },
+  },
+  {
+    name: 'empty local and remote objects',
+    portForwarding: { local: {}, remote: {} },
+    expected: { model: '', requiresReset: true },
+  },
+  {
+    name: 'unknown fields',
+    portForwarding: {
+      local: { enabled: true },
+      remote: { enabled: true },
+      foo: 'bar',
+    } as SSHPortForwarding,
+    expected: { model: 'local-and-remote', requiresReset: true },
+  },
+  {
+    name: 'unknown fields in local',
+    portForwarding: {
+      local: { enabled: true, foo: 'bar' },
+      remote: { enabled: false },
+    } as SSHPortForwarding,
+    expected: { model: 'local-only', requiresReset: true },
+  },
+  {
+    name: 'unknown fields in remote',
+    portForwarding: {
+      local: { enabled: false },
+      remote: { enabled: false, foo: 'bar' },
+    } as SSHPortForwarding,
+    expected: { model: 'none', requiresReset: true },
+  },
+])(
+  'portForwardingOptionsToModel(): $name',
+  ({ portForwarding, legacyPortForwarding, expected }) => {
+    expect(
+      portForwardingOptionsToModel(portForwarding, legacyPortForwarding)
+    ).toEqual(expected);
+  }
+);
+
 describe('roleToRoleEditorModel', () => {
   const minRole = minimalRole();
   const roleModelWithReset: RoleEditorModel = {
@@ -421,7 +543,7 @@ describe('roleToRoleEditorModel', () => {
             ...newKubeClusterResourceAccess(),
             resources: [
               expect.objectContaining({
-                verbs: [{ value: 'get', label: 'get' }],
+                verbs: [kubernetesVerbOptionsMap.get('get')],
               }),
             ],
           },
@@ -538,7 +660,7 @@ describe('roleToRoleEditorModel', () => {
         ...roleModelWithReset,
         options: {
           ...roleModelWithReset.options,
-          requireMFAType: { value: false, label: 'No' },
+          requireMFAType: requireMFATypeOptionsMap.get(false),
         },
       },
     },
@@ -559,7 +681,7 @@ describe('roleToRoleEditorModel', () => {
         ...roleModelWithReset,
         options: {
           ...roleModelWithReset.options,
-          createHostUserMode: { value: '', label: 'Unspecified' },
+          createHostUserMode: createHostUserModeOptionsMap.get(''),
         },
       },
     },
@@ -580,7 +702,7 @@ describe('roleToRoleEditorModel', () => {
         ...roleModelWithReset,
         options: {
           ...roleModelWithReset.options,
-          createDBUserMode: { value: '', label: 'Unspecified' },
+          createDBUserMode: createDBUserModeOptionsMap.get(''),
         },
       },
     },
@@ -600,7 +722,7 @@ describe('roleToRoleEditorModel', () => {
         ...roleModelWithReset,
         options: {
           ...roleModelWithReset.options,
-          defaultSessionRecordingMode: { value: '', label: 'Unspecified' },
+          defaultSessionRecordingMode: sessionRecordingModeOptionsMap.get(''),
         },
       },
     },
@@ -620,9 +742,23 @@ describe('roleToRoleEditorModel', () => {
         ...roleModelWithReset,
         options: {
           ...roleModelWithReset.options,
-          sshSessionRecordingMode: { value: '', label: 'Unspecified' },
+          sshSessionRecordingMode: sessionRecordingModeOptionsMap.get(''),
+        },
+      },
+    },
+
+    {
+      name: 'unsupported value in spec.options.ssh_port_forwarding',
+      role: {
+        ...minRole,
+        spec: {
+          ...minRole.spec,
+          options: optionsWithDefaults({
+            ssh_port_forwarding: {},
+          }),
         },
       },
+      model: roleModelWithReset,
     },
   ])(
     'requires reset because of $name',
@@ -734,17 +870,17 @@ describe('roleToRoleEditorModel', () => {
           resources: [
             {
               id: expect.any(String),
-              kind: { value: 'pod', label: 'Pod' },
+              kind: kubernetesResourceKindOptionsMap.get('pod'),
               name: 'some-pod',
               namespace: '*',
               verbs: [
-                { label: 'get', value: 'get' },
-                { label: 'update', value: 'update' },
+                kubernetesVerbOptionsMap.get('get'),
+                kubernetesVerbOptionsMap.get('update'),
               ],
             },
             {
               id: expect.any(String),
-              kind: { value: 'kube_node', label: 'Node' },
+              kind: kubernetesResourceKindOptionsMap.get('kube_node'),
               name: 'some-node',
               namespace: '',
               verbs: [],
@@ -781,46 +917,43 @@ describe('roleToRoleEditorModel', () => {
       ],
     } as RoleEditorModel);
   });
-});
 
-it('creates a rule model', () => {
-  expect(
-    roleToRoleEditorModel({
-      ...minimalRole(),
-      spec: {
-        ...minimalRole().spec,
-        allow: {
-          rules: [
-            {
-              resources: [ResourceKind.User, ResourceKind.DatabaseService],
-              verbs: ['read', 'list'],
-            },
-            { resources: [ResourceKind.Lock], verbs: ['create'] },
+  it('creates a rule model', () => {
+    expect(
+      roleToRoleEditorModel({
+        ...minimalRole(),
+        spec: {
+          ...minimalRole().spec,
+          allow: {
+            rules: [
+              {
+                resources: [ResourceKind.User, ResourceKind.DatabaseService],
+                verbs: ['read', 'list'],
+              },
+              { resources: [ResourceKind.Lock], verbs: ['create'] },
+            ],
+          },
+        },
+      })
+    ).toEqual({
+      ...minimalRoleModel(),
+      rules: [
+        {
+          id: expect.any(String),
+          resources: [
+            resourceKindOptionsMap.get(ResourceKind.User),
+            resourceKindOptionsMap.get(ResourceKind.DatabaseService),
           ],
+          verbs: [verbOptionsMap.get('read'), verbOptionsMap.get('list')],
         },
-      },
-    })
-  ).toEqual({
-    ...minimalRoleModel(),
-    rules: [
-      {
-        id: expect.any(String),
-        resources: [
-          { label: 'user', value: 'user' },
-          { label: 'db_service', value: 'db_service' },
-        ],
-        verbs: [
-          { label: 'read', value: 'read' },
-          { label: 'list', value: 'list' },
-        ],
-      },
-      {
-        id: expect.any(String),
-        resources: [{ label: 'lock', value: 'lock' }],
-        verbs: [{ label: 'create', value: 'create' }],
-      },
-    ],
-  } as RoleEditorModel);
+        {
+          id: expect.any(String),
+          resources: [resourceKindOptionsMap.get(ResourceKind.Lock)],
+          verbs: [verbOptionsMap.get('create')],
+        },
+      ],
+    } as RoleEditorModel);
+  });
 });
 
 test('labelsToModel', () => {
@@ -872,17 +1005,17 @@ describe('roleEditorModelToRole', () => {
             resources: [
               {
                 id: 'dummy-id-1',
-                kind: { value: 'pod', label: 'Pod' },
+                kind: kubernetesResourceKindOptionsMap.get('pod'),
                 name: 'some-pod',
                 namespace: '*',
                 verbs: [
-                  { label: 'get', value: 'get' },
-                  { label: 'update', value: 'update' },
+                  kubernetesVerbOptionsMap.get('get'),
+                  kubernetesVerbOptionsMap.get('update'),
                 ],
               },
               {
                 id: 'dummy-id-2',
-                kind: { value: 'kube_node', label: 'Node' },
+                kind: kubernetesResourceKindOptionsMap.get('kube_node'),
                 name: 'some-node',
                 namespace: '',
                 verbs: [],
@@ -925,18 +1058,15 @@ describe('roleEditorModelToRole', () => {
           {
             id: 'dummy-id-1',
             resources: [
-              { label: 'user', value: ResourceKind.User },
-              { label: 'db_service', value: ResourceKind.DatabaseService },
-            ],
-            verbs: [
-              { label: 'read', value: 'read' },
-              { label: 'list', value: 'list' },
+              resourceKindOptionsMap.get(ResourceKind.User),
+              resourceKindOptionsMap.get(ResourceKind.DatabaseService),
             ],
+            verbs: [verbOptionsMap.get('read'), verbOptionsMap.get('list')],
           },
           {
             id: 'dummy-id-2',
-            resources: [{ label: 'lock', value: ResourceKind.Lock }],
-            verbs: [{ label: 'create', value: 'create' }],
+            resources: [resourceKindOptionsMap.get(ResourceKind.Lock)],
+            verbs: [verbOptionsMap.get('create')],
           },
         ],
       })
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts
index e15d20963ef75..4aa46945feb21 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts
@@ -36,6 +36,7 @@ import {
   RoleOptions,
   Rule,
   SessionRecordingMode,
+  SSHPortForwarding,
   Verb,
 } from 'teleport/services/resources/types';
 
@@ -166,7 +167,7 @@ export const kubernetesResourceKindOptions: KubernetesResourceKindOption[] = [
 const optionsToMap = <K, V>(opts: Option<K, V>[]) =>
   new Map(opts.map(o => [o.value, o]));
 
-const kubernetesResourceKindOptionsMap = optionsToMap(
+export const kubernetesResourceKindOptionsMap = optionsToMap(
   kubernetesResourceKindOptions
 );
 
@@ -200,7 +201,7 @@ export const kubernetesVerbOptions: KubernetesVerbOption[] = [
     .toSorted((a, b) => a.localeCompare(b))
     .map(stringToOption),
 ];
-const kubernetesVerbOptionsMap = optionsToMap(kubernetesVerbOptions);
+export const kubernetesVerbOptionsMap = optionsToMap(kubernetesVerbOptions);
 
 export type ResourceKindOption = Option<ResourceKind, string>;
 export const resourceKindOptions: ResourceKindOption[] = Object.values(
@@ -226,7 +227,7 @@ export const verbOptions: VerbOption[] = (
     'use',
   ] as const
 ).map(stringToOption);
-const verbOptionsMap = optionsToMap(verbOptions);
+export const verbOptionsMap = optionsToMap(verbOptions);
 
 /** Model for the server resource access section. */
 export type ServerAccess = ResourceAccessBase<'node'> & {
@@ -281,6 +282,7 @@ export type OptionsModel = {
   sshSessionRecordingMode: SessionRecordingModeOption;
   recordDesktopSessions: boolean;
   forwardAgent: boolean;
+  sshPortForwardingMode: SSHPortForwardingModeOption;
 };
 
 type RequireMFATypeOption = Option<RequireMFAType>;
@@ -294,7 +296,7 @@ export const requireMFATypeOptions: RequireMFATypeOption[] = [
     label: 'Hardware Key (touch and PIN)',
   },
 ];
-const requireMFATypeOptionsMap = optionsToMap(requireMFATypeOptions);
+export const requireMFATypeOptionsMap = optionsToMap(requireMFATypeOptions);
 
 type CreateHostUserModeOption = Option<CreateHostUserMode>;
 export const createHostUserModeOptions: CreateHostUserModeOption[] = [
@@ -303,7 +305,9 @@ export const createHostUserModeOptions: CreateHostUserModeOption[] = [
   { value: 'keep', label: 'Keep' },
   { value: 'insecure-drop', label: 'Drop (insecure)' },
 ];
-const createHostUserModeOptionsMap = optionsToMap(createHostUserModeOptions);
+export const createHostUserModeOptionsMap = optionsToMap(
+  createHostUserModeOptions
+);
 
 type CreateDBUserModeOption = Option<CreateDBUserMode>;
 export const createDBUserModeOptions: CreateDBUserModeOption[] = [
@@ -312,7 +316,7 @@ export const createDBUserModeOptions: CreateDBUserModeOption[] = [
   { value: 'keep', label: 'Keep' },
   { value: 'best_effort_drop', label: 'Drop (best effort)' },
 ];
-const createDBUserModeOptionsMap = optionsToMap(createDBUserModeOptions);
+export const createDBUserModeOptionsMap = optionsToMap(createDBUserModeOptions);
 
 type SessionRecordingModeOption = Option<SessionRecordingMode>;
 export const sessionRecordingModeOptions: SessionRecordingModeOption[] = [
@@ -320,10 +324,43 @@ export const sessionRecordingModeOptions: SessionRecordingModeOption[] = [
   { value: 'best_effort', label: 'Best Effort' },
   { value: 'strict', label: 'Strict' },
 ];
-const sessionRecordingModeOptionsMap = optionsToMap(
+export const sessionRecordingModeOptionsMap = optionsToMap(
   sessionRecordingModeOptions
 );
 
+export type SSHPortForwardingMode =
+  | ''
+  | 'none'
+  | 'local-only'
+  | 'remote-only'
+  | 'local-and-remote'
+  | 'deprecated-on'
+  | 'deprecated-off';
+export type SSHPortForwardingModeOption = Option<SSHPortForwardingMode> & {
+  description?: string;
+};
+export const sshPortForwardingModeOptions: SSHPortForwardingModeOption[] = [
+  { value: '', label: 'Unspecified' },
+  { value: 'none', label: 'None' },
+  { value: 'local-only', label: 'Local only' },
+  { value: 'remote-only', label: 'Remote only' },
+  { value: 'local-and-remote', label: 'Local and remote' },
+  {
+    value: 'deprecated-off',
+    label: 'Off (deprecated)',
+    description:
+      'Changes the implicit default behavior for other roles assigned to a user from "allow all" to "deny all"',
+  },
+  {
+    value: 'deprecated-on',
+    label: 'On (deprecated)',
+    description: 'Overrides all other roles applied to a user',
+  },
+];
+export const sshPortForwardingModeOptionsMap = optionsToMap(
+  sshPortForwardingModeOptions
+);
+
 const roleVersion = 'v7';
 
 /**
@@ -695,6 +732,8 @@ function optionsToModel(options: RoleOptions): {
     desktop_directory_sharing,
     record_session,
     forward_agent,
+    port_forwarding,
+    ssh_port_forwarding,
 
     // These options must keep their default values, as we don't support them
     // in the standard editor.
@@ -702,7 +741,6 @@ function optionsToModel(options: RoleOptions): {
     enhanced_recording,
     idp,
     pin_source_ip,
-    ssh_port_forwarding,
     ssh_file_copy,
 
     ...unsupported
@@ -726,6 +764,10 @@ function optionsToModel(options: RoleOptions): {
     sessionRecordingModeOptionsMap.get(defaultRecordingMode);
   const sshSessionRecordingModeOption =
     sessionRecordingModeOptionsMap.get(sshRecordingMode);
+  const {
+    model: sshPortForwardingMode,
+    requiresReset: sshPortForwardingModeRequiresReset,
+  } = portForwardingOptionsToModel(ssh_port_forwarding, port_forwarding);
 
   const defaultOpts = defaultOptions();
 
@@ -751,6 +793,9 @@ function optionsToModel(options: RoleOptions): {
         sshSessionRecordingModeOption ?? sessionRecordingModeOptionsMap.get(''),
       recordDesktopSessions,
       forwardAgent: forward_agent,
+      sshPortForwardingMode: sshPortForwardingModeOptionsMap.get(
+        sshPortForwardingMode
+      ),
     },
 
     requiresReset:
@@ -758,7 +803,6 @@ function optionsToModel(options: RoleOptions): {
       !equalsDeep(enhanced_recording, defaultOpts.enhanced_recording) ||
       !equalsDeep(idp, defaultOpts.idp) ||
       pin_source_ip !== defaultOpts.pin_source_ip ||
-      !equalsDeep(ssh_port_forwarding, defaultOpts.ssh_port_forwarding) ||
       ssh_file_copy !== defaultOpts.ssh_file_copy ||
       requireMFATypeOption === undefined ||
       createHostUserModeOption === undefined ||
@@ -766,10 +810,50 @@ function optionsToModel(options: RoleOptions): {
       !isEmpty(unsupported) ||
       !isEmpty(unsupportedRecordingOptions) ||
       defaultSessionRecordingModeOption === undefined ||
-      sshSessionRecordingModeOption === undefined,
+      sshSessionRecordingModeOption === undefined ||
+      sshPortForwardingModeRequiresReset,
   };
 }
 
+export function portForwardingOptionsToModel(
+  sshPortForwarding?: SSHPortForwarding,
+  legacyPortForwarding?: boolean
+): { model: SSHPortForwardingMode; requiresReset: boolean } {
+  if (sshPortForwarding) {
+    const { local, remote, ...rest } = sshPortForwarding;
+    if (!local || !remote) {
+      return { model: '', requiresReset: true };
+    }
+
+    const { enabled: localEnabled, ...localRest } = sshPortForwarding.local;
+    const { enabled: remoteEnabled, ...remoteRest } = sshPortForwarding.remote;
+    if (localEnabled === undefined || remoteEnabled === undefined) {
+      return { model: '', requiresReset: true };
+    }
+
+    const requiresReset =
+      !isEmpty(rest) || !isEmpty(localRest) || !isEmpty(remoteRest);
+
+    if (!localEnabled && !remoteEnabled) {
+      return { model: 'none', requiresReset };
+    }
+    if (localEnabled && !remoteEnabled) {
+      return { model: 'local-only', requiresReset };
+    }
+    if (!localEnabled && remoteEnabled) {
+      return { model: 'remote-only', requiresReset };
+    }
+    return { model: 'local-and-remote', requiresReset };
+  }
+  if (legacyPortForwarding !== undefined) {
+    return {
+      model: legacyPortForwarding ? 'deprecated-on' : 'deprecated-off',
+      requiresReset: false,
+    };
+  }
+  return { model: '', requiresReset: false };
+}
+
 function isEmpty(obj: object) {
   return Object.keys(obj).length === 0;
 }
@@ -877,7 +961,7 @@ export function labelsModelToLabels(uiLabels: UILabel[]): Labels {
 }
 
 function optionsModelToRoleOptions(model: OptionsModel): RoleOptions {
-  return {
+  const options = {
     ...defaultOptions(),
 
     // Note: technically, coercing the optional fields to undefined is not
@@ -901,6 +985,46 @@ function optionsModelToRoleOptions(model: OptionsModel): RoleOptions {
     },
     forward_agent: model.forwardAgent,
   };
+
+  switch (model.sshPortForwardingMode.value) {
+    case 'none':
+      options.ssh_port_forwarding = {
+        local: { enabled: false },
+        remote: { enabled: false },
+      };
+      break;
+
+    case 'local-only':
+      options.ssh_port_forwarding = {
+        local: { enabled: true },
+        remote: { enabled: false },
+      };
+      break;
+
+    case 'remote-only':
+      options.ssh_port_forwarding = {
+        local: { enabled: false },
+        remote: { enabled: true },
+      };
+      break;
+
+    case 'local-and-remote':
+      options.ssh_port_forwarding = {
+        local: { enabled: true },
+        remote: { enabled: true },
+      };
+      break;
+
+    case 'deprecated-off':
+      options.port_forwarding = false;
+      break;
+
+    case 'deprecated-on':
+      options.port_forwarding = true;
+      break;
+  }
+
+  return options;
 }
 
 function optionsToStrings<T = string>(opts: readonly Option<T>[]): T[] {
diff --git a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/withDefaults.ts b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/withDefaults.ts
index 84c99474e6afb..d99800812f6f2 100644
--- a/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/withDefaults.ts
+++ b/web/packages/teleport/src/Roles/RoleEditor/StandardEditor/withDefaults.ts
@@ -24,7 +24,10 @@ export type DeepPartial<T> = {
 
 /**
  * Returns a "completed" model, emulating what `RoleV6.CheckAndSetDefaults`
- * does on the server side. These two functions must be kept in sync.
+ * does on the server side. These two functions must be kept in sync. Don't add
+ * arbitrary defaults here unless they are returned the same way from the
+ * server side, or the role editor will silently modify these fields on every
+ * role it opens and saves without user intervention.
  */
 export const withDefaults = (role: DeepPartial<Role>): Role => ({
   kind: 'role',
@@ -70,15 +73,6 @@ export const optionsWithDefaults = (
       },
     },
 
-    ssh_port_forwarding: {
-      local: {
-        ...defaults.ssh_port_forwarding.local,
-      },
-      remote: {
-        ...defaults.ssh_port_forwarding.remote,
-      },
-    },
-
     record_session: {
       ...defaults.record_session,
       ...options?.record_session,
@@ -86,6 +80,14 @@ export const optionsWithDefaults = (
   };
 };
 
+/**
+ * Default options, exactly as returned by the server side for the empty
+ * options object. This invariant must be held at all times, since this object
+ * is used to resolve partial responses. Don't add arbitrary defaults here
+ * unless they are returned the same way from the server side, or the role
+ * editor will silently modify these options on every role it opens and saves
+ * without user intervention.
+ */
 export const defaultOptions = (): RoleOptions => ({
   cert_format: 'standard',
   create_db_user: false,
@@ -101,14 +103,6 @@ export const defaultOptions = (): RoleOptions => ({
   },
   max_session_ttl: '30h0m0s',
   pin_source_ip: false,
-  ssh_port_forwarding: {
-    local: {
-      enabled: false,
-    },
-    remote: {
-      enabled: false,
-    },
-  },
   record_session: {
     default: 'best_effort',
     desktop: true,
diff --git a/web/packages/teleport/src/services/resources/types.ts b/web/packages/teleport/src/services/resources/types.ts
index a4634798897cb..363f366b5745e 100644
--- a/web/packages/teleport/src/services/resources/types.ts
+++ b/web/packages/teleport/src/services/resources/types.ts
@@ -351,7 +351,8 @@ export type RoleOptions = {
   };
   max_session_ttl: string;
   pin_source_ip: boolean;
-  ssh_port_forwarding: SSHPortForwarding;
+  ssh_port_forwarding?: SSHPortForwarding;
+  port_forwarding?: boolean;
   record_session: {
     default: SessionRecordingMode;
     ssh?: SessionRecordingMode;
@@ -366,11 +367,11 @@ export type RoleOptions = {
 };
 
 export type SSHPortForwarding = {
-  local: {
-    enabled: boolean;
+  local?: {
+    enabled?: boolean;
   };
-  remote: {
-    enabled: boolean;
+  remote?: {
+    enabled?: boolean;
   };
 };