Merge branch 'main' into plugin-hostcatalogs

CHANGELOG.md

@@ -4,6 +4,12 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ## Next
 
+### Bug Fixes
+
+* targets: Fix panic when using `boundary targets authorize-session`
+  ([issue](https://github.com/hashicorp/boundary/issues/1488),
+  [PR](https://github.com/hashicorp/boundary/pull/1496)).
+
 ## 0.5.1 (2021/08/16)
 
 ### New and Improved

internal/cmd/commands/connect/connect.go

@@ -501,7 +501,7 @@ func (c *Command) Run(args []string) (retCode int) {
 		// The only way a user will be able to connect to the session is by
 		// connecting directly to the port and address we report to them here.
 		sessInfo := SessionInfo{
-			Protocol:        "tcp",
+			Protocol:        c.sessionAuthzData.GetType(),
 			Address:         c.listenerAddr.IP.String(),
 			Port:            c.listenerAddr.Port,
 			Expiration:      c.expiration,

internal/servers/controller/handlers/targets/target_service.go

@@ -1098,6 +1098,13 @@ HostSourceIterationLoop:
 				CredentialStoreId: l.GetStoreId(),
 				Type:              credential.SubtypeFromId(l.GetPublicId()).String(),
 			},
+			CredentialSource: &pb.CredentialSource{
+				Id:                l.GetPublicId(),
+				Name:              l.GetName(),
+				Description:       l.GetDescription(),
+				CredentialStoreId: l.GetStoreId(),
+				Type:              credential.SubtypeFromId(l.GetPublicId()).String(),
+			},
 			Secret: &pb.SessionSecret{
 				Raw:     base64.StdEncoding.EncodeToString(jSecret),
 				Decoded: sSecret,

internal/servers/controller/handlers/targets/target_service_test.go

@@ -2545,11 +2545,11 @@ func TestAuthorizeSession(t *testing.T) {
 	}})
 	require.NoError(t, err)
 
-	_, err = s.AddTargetCredentialLibraries(ctx,
-		&pbs.AddTargetCredentialLibrariesRequest{
-			Id:                              tar.GetPublicId(),
-			ApplicationCredentialLibraryIds: []string{clsResp.GetItem().GetId()},
-			Version:                         apiTar.GetItem().GetVersion(),
+	_, err = s.AddTargetCredentialSources(ctx,
+		&pbs.AddTargetCredentialSourcesRequest{
+			Id:                             tar.GetPublicId(),
+			ApplicationCredentialSourceIds: []string{clsResp.GetItem().GetId()},
+			Version:                        apiTar.GetItem().GetVersion(),
 		})
 	require.NoError(t, err)
 
@@ -2596,6 +2596,13 @@ func TestAuthorizeSession(t *testing.T) {
 				CredentialStoreId: store.GetPublicId(),
 				Type:              vault.Subtype.String(),
 			},
+			CredentialSource: &pb.CredentialSource{
+				Id:                clsResp.GetItem().GetId(),
+				Name:              clsResp.GetItem().GetName().GetValue(),
+				Description:       clsResp.GetItem().GetDescription().GetValue(),
+				CredentialStoreId: store.GetPublicId(),
+				Type:              vault.Subtype.String(),
+			},
 		}},
 		// TODO: validate the contents of the authorization token is what is expected
 	}

internal/servers/worker/handler.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
 
 	"github.com/hashicorp/boundary/globals"
@@ -75,7 +76,6 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 		tofuToken := si.LookupSessionResponse.GetTofuToken()
 		version := si.LookupSessionResponse.GetVersion()
 		endpoint := si.LookupSessionResponse.GetEndpoint()
-		// userId := si.LookupSessionResponse.GetAuthorization()
 		sessStatus := si.Status
 		si.RUnlock()
 
@@ -163,10 +163,18 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 			return
 		}
 
-		// Verify the subprotocol has a supported proxy before calling AuthorizeConnection
-		handleProxyFn, err := proxyHandlers.GetHandler(conn.Subprotocol())
+		// Verify the protocol has a supported proxy before calling AuthorizeConnection
+		endpointUrl, err := url.Parse(endpoint)
 		if err != nil {
-			event.WriteError(ctx, op, err, event.WithInfoMsg("worker received request for unsupported protocol %s", conn.Subprotocol()))
+			event.WriteError(ctx, op, err, event.WithInfoMsg("worker failed to parse target endpoint", "endpoint", endpoint))
+			if err = conn.Close(websocket.StatusProtocolError, "unsupported-protocol"); err != nil {
+				event.WriteError(ctx, op, err, event.WithInfoMsg("error closing client connection"))
+			}
+			return
+		}
+		handleProxyFn, err := proxyHandlers.GetHandler(endpointUrl.Scheme)
+		if err != nil {
+			event.WriteError(ctx, op, err, event.WithInfoMsg("worker received request for unsupported protocol", "protocol", endpointUrl.Scheme))
 			if err = conn.Close(websocket.StatusProtocolError, "unsupported-protocol"); err != nil {
 				event.WriteError(ctx, op, err, event.WithInfoMsg("error closing client connection"))
 			}

internal/servers/worker/proxy/tcp/tcp.go

@@ -7,7 +7,6 @@ import (
 	"net/url"
 	"sync"
 
-	"github.com/hashicorp/boundary/globals"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 	"github.com/hashicorp/boundary/internal/observability/event"
 	"github.com/hashicorp/boundary/internal/servers/worker/proxy"
@@ -16,7 +15,7 @@ import (
 )
 
 func init() {
-	err := proxy.RegisterHandler(globals.TcpProxyV1, handleTcpProxyV1)
+	err := proxy.RegisterHandler("tcp", handleTcpProxyV1)
 	if err != nil {
 		panic(err)
 	}