feat(bsr): expand session metadata

This commit is contained in:
irenarindos authored and Timothy Messier committed 2023-05-31 12:18:16 +00:00
1 parent 93afd24327
commit 718536783c
9 files changed
+472 -26

No files matched your search

+354 -5
View File
@@ -30,10 +30,354 @@ const (
pubKeySelfSignatureFile = "pubKeySelfSignature.sign"
)
// Scope contains information about the scope of a Boundary domain object
type Scope struct {
PublicId string
Name string // optional
Description string // optional
Type string
ParentId string // optional
PrimaryAuthMethodId string // optional
}
func (s Scope) writeMeta(ctx context.Context, c *container, domainObj string) error {
_, err := c.WriteMeta(ctx, fmt.Sprintf("%s_scope_publicId", domainObj), s.PublicId)
if err != nil {
return err
}
if s.Name != "" {
_, err = c.WriteMeta(ctx, fmt.Sprintf("%s_scope_name", domainObj), s.Name)
if err != nil {
return err
}
}
if s.Description != "" {
_, err = c.WriteMeta(ctx, fmt.Sprintf("%s_scope_description", domainObj), s.Description)
if err != nil {
return err
}
}
_, err = c.WriteMeta(ctx, fmt.Sprintf("%s_scope_type", domainObj), s.Type)
if err != nil {
return err
}
if s.ParentId != "" {
_, err = c.WriteMeta(ctx, fmt.Sprintf("%s_scope_parentId", domainObj), s.ParentId)
if err != nil {
return err
}
}
if s.PrimaryAuthMethodId != "" {
_, err = c.WriteMeta(ctx, fmt.Sprintf("%s_scope_primaryAuthMethodId", domainObj), s.PrimaryAuthMethodId)
if err != nil {
return err
}
}
return nil
}
// User contains information about user who initiated this session
type User struct {
PublicId string
Scope Scope
Name string // optional field
Description string // optional field
}
func (u User) writeMeta(ctx context.Context, c *container) error {
_, err := c.WriteMeta(ctx, "user_publicId", u.PublicId)
if err != nil {
return err
}
err = u.Scope.writeMeta(ctx, c, "user")
if err != nil {
return err
}
if u.Name != "" {
_, err = c.WriteMeta(ctx, "user_name", u.Name)
if err != nil {
return err
}
}
if u.Description != "" {
_, err = c.WriteMeta(ctx, "user_description", u.Description)
if err != nil {
return err
}
}
return nil
}
// Target contains information about the target for this session
type Target struct {
PublicId string
ProjectId string
Scope Scope
Name string // optional field
Description string // optional field
DefaultPort uint32
SessionMaxSeconds uint32
SessionConnectionLimit int32
WorkerFilter string // optional field
EgressWorkerFilter string // optional field
IngressWorkerFilter string // optional field
}
func (t Target) writeMeta(ctx context.Context, c *container) error {
_, err := c.WriteMeta(ctx, "target_publicId", t.PublicId)
if err != nil {
return err
}
err = t.Scope.writeMeta(ctx, c, "target")
if err != nil {
return err
}
_, err = c.WriteMeta(ctx, "target_projectId", t.ProjectId)
if err != nil {
return err
}
if t.Name != "" {
_, err = c.WriteMeta(ctx, "target_name", t.Name)
if err != nil {
return err
}
}
if t.Description != "" {
_, err = c.WriteMeta(ctx, "target_description", t.Description)
if err != nil {
return err
}
}
_, err = c.WriteMeta(ctx, "target_defaultPort", fmt.Sprintf("%d", t.DefaultPort))
if err != nil {
return err
}
_, err = c.WriteMeta(ctx, "target_sessionMaxSeconds", fmt.Sprintf("%d", t.SessionMaxSeconds))
if err != nil {
return err
}
_, err = c.WriteMeta(ctx, "target_sessionConnectionLimit", fmt.Sprintf("%d", t.SessionConnectionLimit))
if err != nil {
return err
}
if t.WorkerFilter != "" {
_, err = c.WriteMeta(ctx, "target_workerFilter", t.WorkerFilter)
if err != nil {
return err
}
}
if t.IngressWorkerFilter != "" {
_, err = c.WriteMeta(ctx, "target_ingressWorkerFilter", t.IngressWorkerFilter)
if err != nil {
return err
}
}
if t.EgressWorkerFilter != "" {
_, err = c.WriteMeta(ctx, "target_egressWorkerFilter", t.EgressWorkerFilter)
if err != nil {
return err
}
}
return nil
}
// StaticHostCatalog contains information about the static host catalog for this session
type StaticHostCatalog struct {
PublicId string
ProjectId string
Name string // optional field
Description string // optional field
}
func (h StaticHostCatalog) writeMeta(ctx context.Context, c *container) error {
_, err := c.WriteMeta(ctx, "staticHostCatalog_publicId", h.PublicId)
if err != nil {
return err
}
_, err = c.WriteMeta(ctx, "staticHostCatalog_projectId", h.ProjectId)
if err != nil {
return err
}
if h.Name != "" {
_, err = c.WriteMeta(ctx, "staticHostCatalog_name", h.Name)
if err != nil {
return err
}
}
if h.Description != "" {
_, err = c.WriteMeta(ctx, "staticHostCatalog_description", h.Description)
if err != nil {
return err
}
}
return nil
}
// StaticHost contains information about the static host for this session
type StaticHost struct {
PublicId string
Catalog StaticHostCatalog
Name string // optional field
Description string // optional field
Address string
}
func (h StaticHost) writeMeta(ctx context.Context, c *container) error {
_, err := c.WriteMeta(ctx, "staticHost_publicId", h.PublicId)
if err != nil {
return err
}
err = h.Catalog.writeMeta(ctx, c)
if err != nil {
return err
}
if h.Name != "" {
_, err = c.WriteMeta(ctx, "staticHost_name", h.Name)
if err != nil {
return err
}
}
if h.Description != "" {
_, err = c.WriteMeta(ctx, "staticHost_description", h.Description)
if err != nil {
return err
}
}
_, err = c.WriteMeta(ctx, "staticHost_address", h.Address)
if err != nil {
return err
}
return nil
}
// DynamicHostCatalog contains information about the dynamic host catalog for this session
type DynamicHostCatalog struct {
PublicId string
ProjectId string
Name string // optional field
Description string // optional field
PluginId string
Attributes string
}
func (h DynamicHostCatalog) writeMeta(ctx context.Context, c *container) error {
_, err := c.WriteMeta(ctx, "dynamicHostCatalog_publicId", h.PublicId)
if err != nil {
return err
}
_, err = c.WriteMeta(ctx, "dynamicHostCatalog_projectId", h.ProjectId)
if err != nil {
return err
}
if h.Name != "" {
_, err = c.WriteMeta(ctx, "dynamicHostCatalog_name", h.Name)
if err != nil {
return err
}
}
if h.Description != "" {
_, err = c.WriteMeta(ctx, "dynamicHostCatalog_description", h.Description)
if err != nil {
return err
}
}
_, err = c.WriteMeta(ctx, "dynamicHostCatalog_pluginId", h.PluginId)
if err != nil {
return err
}
_, err = c.WriteMeta(ctx, "dynamicHostCatalog_attributes", h.Attributes)
if err != nil {
return err
}
return nil
}
// DynamicHost contains information about the dynamic host for this session
type DynamicHost struct {
PublicId string
Catalog DynamicHostCatalog
Name string // optional field
Description string // optional field
ExternalId string
}
func (h DynamicHost) writeMeta(ctx context.Context, c *container) error {
_, err := c.WriteMeta(ctx, "dynamicHost_publicId", h.PublicId)
if err != nil {
return err
}
err = h.Catalog.writeMeta(ctx, c)
if err != nil {
return err
}
if h.Name != "" {
_, err = c.WriteMeta(ctx, "dynamicHost_name", h.Name)
if err != nil {
return err
}
}
if h.Description != "" {
_, err = c.WriteMeta(ctx, "dynamicHost_description", h.Description)
if err != nil {
return err
}
}
_, err = c.WriteMeta(ctx, "dynamicHost_externalId", h.ExternalId)
if err != nil {
return err
}
return nil
}
// SessionMeta contains metadata about a session in a BSR.
type SessionMeta struct {
Id string
Protocol Protocol
User *User
Target *Target
// StaticHost and DynamicHost are mutually exclusive
StaticHost *StaticHost
DynamicHost *DynamicHost
}
func (s SessionMeta) writeMeta(ctx context.Context, c *container) error {
_, err := c.WriteMeta(ctx, "id", s.Id)
if err != nil {
return err
}
_, err = c.WriteMeta(ctx, "protocol", s.Protocol.ToText())
if err != nil {
return err
}
err = s.User.writeMeta(ctx, c)
if err != nil {
return err
}
err = s.Target.writeMeta(ctx, c)
if err != nil {
return err
}
if !is.Nil(s.StaticHost) {
err = s.StaticHost.writeMeta(ctx, c)
if err != nil {
return err
}
}
if !is.Nil(s.DynamicHost) {
err = s.DynamicHost.writeMeta(ctx, c)
if err != nil {
return err
}
}
return nil
}
// Session is the top level container in a bsr that contains the files for
@@ -54,6 +398,14 @@ func NewSession(ctx context.Context, meta *SessionMeta, f storage.FS, keys *kms.
return nil, fmt.Errorf("%s: missing session meta: %w", op, ErrInvalidParameter)
case meta.Id == "":
return nil, fmt.Errorf("%s: missing session id: %w", op, ErrInvalidParameter)
case is.Nil(meta.StaticHost) && is.Nil(meta.DynamicHost):
return nil, fmt.Errorf("%s: missing session host information: %w", op, ErrInvalidParameter)
case !is.Nil(meta.StaticHost) && !is.Nil(meta.DynamicHost):
return nil, fmt.Errorf("%s: meta cannot contain both static and dynamic host information: %w", op, ErrInvalidParameter)
case is.Nil(meta.User):
return nil, fmt.Errorf("%s: missing session user: %w", op, ErrInvalidParameter)
case is.Nil(meta.Target):
return nil, fmt.Errorf("%s: missing session target: %w", op, ErrInvalidParameter)
case is.Nil(f):
return nil, fmt.Errorf("%s: missing storage fs: %w", op, ErrInvalidParameter)
case is.Nil(keys):
@@ -78,14 +430,11 @@ func NewSession(ctx context.Context, meta *SessionMeta, f storage.FS, keys *kms.
return nil, errors.Join(err, fmt.Errorf("%s: %w", op, ErrBsrKeyPersistenceFailure))
}
_, err = nc.WriteMeta(ctx, "id", meta.Id)
if err != nil {
return nil, err
}
_, err = nc.WriteMeta(ctx, "protocol", meta.Protocol.ToText())
err = meta.writeMeta(ctx, nc)
if err != nil {
return nil, err
}
return &Session{
container: nc,
multiplexed: opts.withSupportsMultiplex,
+22 -18
View File
@@ -234,7 +234,8 @@ func TestBsr(t *testing.T) {
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: tc.id, Protocol: ssh.Protocol}, tc.c, tc.keys, tc.opts...)
sessionMeta := bsr.TestSessionMeta(tc.id, ssh.Protocol)
s, err := bsr.NewSession(ctx, sessionMeta, tc.c, tc.keys, tc.opts...)
require.NoError(t, err)
require.NotNil(t, s)
@@ -385,28 +386,28 @@ func TestNewSessionErrors(t *testing.T) {
},
{
"empty-session-id",
&bsr.SessionMeta{Id: ""},
bsr.TestSessionMeta("", ssh.Protocol),
&fstest.MemFS{},
keys,
errors.New("bsr.NewSession: missing session id: invalid parameter"),
},
{
"nil-fs",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
nil,
keys,
errors.New("bsr.NewSession: missing storage fs: invalid parameter"),
},
{
"nil-keys",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
&fstest.MemFS{},
nil,
errors.New("bsr.NewSession: missing kms keys: invalid parameter"),
},
{
"missing-bsr-signature",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
&fstest.MemFS{},
&kms.Keys{
PubKey: keys.PubKey,
@@ -418,7 +419,7 @@ func TestNewSessionErrors(t *testing.T) {
},
{
"missing-pub-signature",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
&fstest.MemFS{},
&kms.Keys{
PubKey: keys.PubKey,
@@ -430,7 +431,7 @@ func TestNewSessionErrors(t *testing.T) {
},
{
"missing-pub-key",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
&fstest.MemFS{},
&kms.Keys{
WrappedBsrKey: keys.WrappedBsrKey,
@@ -442,7 +443,7 @@ func TestNewSessionErrors(t *testing.T) {
},
{
"missing-wrapped-bsr-key",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
&fstest.MemFS{},
&kms.Keys{
PubKey: keys.PubKey,
@@ -454,7 +455,7 @@ func TestNewSessionErrors(t *testing.T) {
},
{
"missing-wrapped-priv-key",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
&fstest.MemFS{},
&kms.Keys{
PubKey: keys.PubKey,
@@ -466,7 +467,7 @@ func TestNewSessionErrors(t *testing.T) {
},
{
"fs-new-error",
&bsr.SessionMeta{Id: "session"},
bsr.TestSessionMeta("session", ssh.Protocol),
fstest.NewMemFS(fstest.WithNewFunc(func(_ context.Context, _ string) (storage.Container, error) {
return nil, errors.New("fs new error")
})),
@@ -499,7 +500,7 @@ func TestNewConnectionErrors(t *testing.T) {
{
"nil-meta",
func() *bsr.Session {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys)
s, err := bsr.NewSession(ctx, bsr.TestSessionMeta("session", ssh.Protocol), &fstest.MemFS{}, keys)
require.NoError(t, err)
return s
}(),
@@ -509,7 +510,7 @@ func TestNewConnectionErrors(t *testing.T) {
{
"empty-connection-id",
func() *bsr.Session {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys)
s, err := bsr.NewSession(ctx, bsr.TestSessionMeta("session", ssh.Protocol), &fstest.MemFS{}, keys)
require.NoError(t, err)
return s
}(),
@@ -533,6 +534,7 @@ func TestNewChannelErrors(t *testing.T) {
keys, err := kms.CreateKeys(ctx, kms.TestWrapper(t), "session")
require.NoError(t, err)
sessionMeta := bsr.TestSessionMeta("session", ssh.Protocol)
cases := []struct {
name string
connection *bsr.Connection
@@ -542,7 +544,7 @@ func TestNewChannelErrors(t *testing.T) {
{
"nil-meta",
func() *bsr.Connection {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
s, err := bsr.NewSession(ctx, sessionMeta, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
require.NoError(t, err)
c, err := s.NewConnection(ctx, &bsr.ConnectionMeta{Id: "connection"})
@@ -555,7 +557,7 @@ func TestNewChannelErrors(t *testing.T) {
{
"empty-connection-id",
func() *bsr.Connection {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
s, err := bsr.NewSession(ctx, sessionMeta, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
require.NoError(t, err)
c, err := s.NewConnection(ctx, &bsr.ConnectionMeta{Id: "connection"})
@@ -568,7 +570,7 @@ func TestNewChannelErrors(t *testing.T) {
{
"not-multiplexed",
func() *bsr.Connection {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(false))
s, err := bsr.NewSession(ctx, sessionMeta, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(false))
require.NoError(t, err)
c, err := s.NewConnection(ctx, &bsr.ConnectionMeta{Id: "connection"})
@@ -581,7 +583,7 @@ func TestNewChannelErrors(t *testing.T) {
{
"not-multiplexed-default",
func() *bsr.Connection {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys)
s, err := bsr.NewSession(ctx, sessionMeta, &fstest.MemFS{}, keys)
require.NoError(t, err)
c, err := s.NewConnection(ctx, &bsr.ConnectionMeta{Id: "connection"})
@@ -608,6 +610,7 @@ func TestChannelNewMessagesWriterErrors(t *testing.T) {
keys, err := kms.CreateKeys(ctx, kms.TestWrapper(t), "session")
require.NoError(t, err)
sessionMeta := bsr.TestSessionMeta("session", ssh.Protocol)
cases := []struct {
name string
channel *bsr.Channel
@@ -617,7 +620,7 @@ func TestChannelNewMessagesWriterErrors(t *testing.T) {
{
"invalid-dir",
func() *bsr.Channel {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
s, err := bsr.NewSession(ctx, sessionMeta, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
require.NoError(t, err)
c, err := s.NewConnection(ctx, &bsr.ConnectionMeta{Id: "connection"})
@@ -647,6 +650,7 @@ func TestChannelNewRequestsWriterErrors(t *testing.T) {
keys, err := kms.CreateKeys(ctx, kms.TestWrapper(t), "session")
require.NoError(t, err)
sessionMeta := bsr.TestSessionMeta("session", ssh.Protocol)
cases := []struct {
name string
channel *bsr.Channel
@@ -656,7 +660,7 @@ func TestChannelNewRequestsWriterErrors(t *testing.T) {
{
"invalid-dir",
func() *bsr.Channel {
s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: "session"}, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
s, err := bsr.NewSession(ctx, sessionMeta, &fstest.MemFS{}, keys, bsr.WithSupportsMultiplex(true))
require.NoError(t, err)
c, err := s.NewConnection(ctx, &bsr.ConnectionMeta{Id: "connection"})
@@ -3,5 +3,5 @@
.* wrappedPrivKey
.* pubKeyBsrSignature.sign
.* pubKeySelfSignature.sign
a7b7dc4a1c6032980f84d22afb71d59ccdf498db37f2e855a83d8854bdc297db session.meta
f93719b1e64afea871f7a50f19ffb0cd16fa91b4ce09520685a07ea74c9a1972 session.meta
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 session.summary
@@ -1,3 +1,17 @@
id: session_123456789
protocol: SSH
user_publicId: user123
user_scope_publicId: global
user_scope_type: global
target_publicId: target123
target_scope_publicId: global
target_scope_type: global
target_projectId: proj123
target_defaultPort: 0
target_sessionMaxSeconds: 0
target_sessionConnectionLimit: 0
staticHost_publicId: host123
staticHostCatalog_publicId: staticcat123
staticHostCatalog_projectId: proj123
staticHost_address: 127.0.0.1
connection: conn_1.connection
@@ -1,2 +1,16 @@
id: session_123456789
protocol: SSH
user_publicId: user123
user_scope_publicId: global
user_scope_type: global
target_publicId: target123
target_scope_publicId: global
target_scope_type: global
target_projectId: proj123
target_defaultPort: 0
target_sessionMaxSeconds: 0
target_sessionConnectionLimit: 0
staticHost_publicId: host123
staticHostCatalog_publicId: staticcat123
staticHostCatalog_projectId: proj123
staticHost_address: 127.0.0.1
@@ -3,5 +3,5 @@
.* wrappedPrivKey
.* pubKeyBsrSignature.sign
.* pubKeySelfSignature.sign
a7b7dc4a1c6032980f84d22afb71d59ccdf498db37f2e855a83d8854bdc297db session.meta
f93719b1e64afea871f7a50f19ffb0cd16fa91b4ce09520685a07ea74c9a1972 session.meta
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 session.summary
@@ -1,3 +1,17 @@
id: session_123456789
protocol: SSH
connection: conn_1.connection
user_publicId: user123
user_scope_publicId: global
user_scope_type: global
target_publicId: target123
target_scope_publicId: global
target_scope_type: global
target_projectId: proj123
target_defaultPort: 0
target_sessionMaxSeconds: 0
target_sessionConnectionLimit: 0
staticHost_publicId: host123
staticHostCatalog_publicId: staticcat123
staticHostCatalog_projectId: proj123
staticHost_address: 127.0.0.1
connection: conn_1.connection
@@ -1,2 +1,16 @@
id: session_123456789
protocol: SSH
user_publicId: user123
user_scope_publicId: global
user_scope_type: global
target_publicId: target123
target_scope_publicId: global
target_scope_type: global
target_projectId: proj123
target_defaultPort: 0
target_sessionMaxSeconds: 0
target_sessionConnectionLimit: 0
staticHost_publicId: host123
staticHostCatalog_publicId: staticcat123
staticHostCatalog_projectId: proj123
staticHost_address: 127.0.0.1
+37
View File
@@ -0,0 +1,37 @@
// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0
package bsr
func TestSessionMeta(s string, p Protocol) *SessionMeta {
scope := Scope{
PublicId: "global",
Type: "global",
}
staticCatalog := StaticHostCatalog{
PublicId: "staticcat123",
ProjectId: "proj123",
}
sessionMeta := &SessionMeta{
Id: s,
Protocol: p,
User: &User{
PublicId: "user123",
Scope: scope,
},
StaticHost: &StaticHost{
PublicId: "host123",
Catalog: staticCatalog,
Address: "127.0.0.1",
},
Target: &Target{
PublicId: "target123",
ProjectId: "proj123",
Scope: scope,
DefaultPort: 0,
SessionMaxSeconds: 0,
SessionConnectionLimit: 0,
},
}
return sessionMeta
}