208 Commits
Author SHA1 Message Date
shadowdaoandClaude Sonnet 5.5 962d708fdd Rename Go module paths to repo.anhonesthost.net/CyberCoveLLC/threshold
Rename root, api and sdk module paths (imports, go.mod, go_package,
ldflags, build scripts, buf configs) and regenerate protobuf/gateway
code with the project's pinned toolchain. Wire identifiers unchanged.
api gets a local replace for sdk; root/api/sdk require v0.1.0.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-12 10:33:41 -07:00
Chandrasekhar Gadde 81c997ab1f Improve worker logging 2026-05-11 15:24:50 +05:30
Chandrasekhar Gadde f19f776234 Merge pull request #6626 from hashicorp/ICU-18958
Memory leak fix for worker session management by immediately removing closed connections
2026-05-04 09:09:22 +05:30
Anton Averchenkov 5e6c9eecbe Clean up loop captures in tests (#6592)
* Clean up loop captures

* some more
2026-05-01 12:34:33 -04:00
Chandrasekhar Gadde 963ea30274 Memory leak fix for worker session management by immediately removing closed connections 2026-04-24 17:26:03 +05:30
Louis Ruch 09962d0521 feat(listener): Set node tls handshake timeout to 15 seconds 2026-04-20 11:42:05 -07:00
aditya2548 f8363dd06e [COMPLIANCE] Update Copyright & License Headers 2026-04-06 15:48:57 +05:30
429247f407 [COMPLIANCE] Update Copyright Headers (#6282)
* [COMPLIANCE] Update Copyright and License Headers

* chore: make gen to generate files with copyright headers

* chore: update missed copyright headers

---------

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
Co-authored-by: Justin Nguyen <justin.nguyen@hashicorp.com>
2026-01-28 11:05:07 -06:00
Abhishek Manjegowda a1718effba CE changes for ENT (#6334)
Approved
2026-01-14 19:58:51 +05:30
Sorawis Nilparuk (Bo) fe09f61a85 chore(test) fix flaky tests (#6315)
* internal/cmd/commands/server/listener_reload_test.go remove t.Parallel() comment

* internal/cmd/commands/server/worker_initial_upstreams_reload_test.go remove t.Parallel

* internal/cmd/commands/server/worker_tags_reload_test.go wait by polling worker instead of sleep

* internal/daemon/worker/routing_info.go make deep copy in LastRoutingInfoSuccess to avoid race condition

* internal/tests/cluster/parallel/orphaned_connections_test.go raise grace period time to allow test to wait for longer

* improve logging in sequential tests

* move ports around and use t.Cleanup to send shutdown signal to test server

* fix one typo

* do final assert in t.Cleanup instead of defer

* undo t.Cleanup change

* add another signal to force shutdown running servers

* add exit early and increase server start timeout

* tighten workerRPC settings on session tests

* tighten more workerRPC timing

* make gen

* add comment explaining deep copying lastRoutingInfoSuccess
2026-01-05 10:40:28 -08:00
Louis Ruch 4bae4f23f5 feat(ssh): support ssh known hosts file (#6263) 2025-11-19 16:24:20 -08:00
April-May 003007aaa3 chore(proxy): Reduce noisy error logs (#6136) 2025-10-10 08:43:40 -07:00
dependabot[bot]andJohan Brandhorst-Satzkorn 959fe3ebd3 chore(deps): bump the go group across 7 directories with 5 updates (#6035)
* chore(deps): bump the go group across 7 directories with 5 updates

Bumps the go group with 4 updates in the / directory: [github.com/coder/websocket](https://github.com/coder/websocket), [github.com/docker/docker](https://github.com/docker/docker), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) and [mvdan.cc/gofumpt](https://github.com/mvdan/gofumpt).
Bumps the go group with 2 updates in the /api directory: [github.com/coder/websocket](https://github.com/coder/websocket) and [github.com/hashicorp/boundary/sdk](https://github.com/hashicorp/boundary).
Bumps the go group with 1 update in the /plugins/boundary/mains/aws directory: [github.com/hashicorp/boundary/sdk](https://github.com/hashicorp/boundary).
Bumps the go group with 1 update in the /plugins/boundary/mains/azure directory: [github.com/hashicorp/boundary/sdk](https://github.com/hashicorp/boundary).
Bumps the go group with 1 update in the /plugins/boundary/mains/gcp directory: [github.com/hashicorp/boundary/sdk](https://github.com/hashicorp/boundary).
Bumps the go group with 1 update in the /plugins/boundary/mains/minio directory: [github.com/hashicorp/boundary/sdk](https://github.com/hashicorp/boundary).
Bumps the go group with 1 update in the /sdk directory: [github.com/coder/websocket](https://github.com/coder/websocket).

Updates `github.com/coder/websocket` from 1.8.13 to 1.8.14
- [Release notes](https://github.com/coder/websocket/releases)
- [Commits](https://github.com/coder/websocket/compare/v1.8.13...v1.8.14)

Updates `github.com/docker/docker` from 28.3.3+incompatible to 28.4.0+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.3.3...v28.4.0)

Updates `github.com/prometheus/client_golang` from 1.23.0 to 1.23.2
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2)

Updates `mvdan.cc/gofumpt` from 0.8.0 to 0.9.0
- [Release notes](https://github.com/mvdan/gofumpt/releases)
- [Changelog](https://github.com/mvdan/gofumpt/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mvdan/gofumpt/compare/v0.8.0...v0.9.0)

Updates `github.com/coder/websocket` from 1.8.13 to 1.8.14
- [Release notes](https://github.com/coder/websocket/releases)
- [Commits](https://github.com/coder/websocket/compare/v1.8.13...v1.8.14)

Updates `github.com/hashicorp/boundary/sdk` from 0.0.54 to 0.0.55
- [Release notes](https://github.com/hashicorp/boundary/releases)
- [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/boundary/compare/api/v0.0.54...api/v0.0.55)

Updates `github.com/hashicorp/boundary/sdk` from 0.0.54 to 0.0.55
- [Release notes](https://github.com/hashicorp/boundary/releases)
- [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/boundary/compare/api/v0.0.54...api/v0.0.55)

Updates `github.com/hashicorp/boundary/sdk` from 0.0.54 to 0.0.55
- [Release notes](https://github.com/hashicorp/boundary/releases)
- [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/boundary/compare/api/v0.0.54...api/v0.0.55)

Updates `github.com/hashicorp/boundary/sdk` from 0.0.54 to 0.0.55
- [Release notes](https://github.com/hashicorp/boundary/releases)
- [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/boundary/compare/api/v0.0.54...api/v0.0.55)

Updates `github.com/hashicorp/boundary/sdk` from 0.0.54 to 0.0.55
- [Release notes](https://github.com/hashicorp/boundary/releases)
- [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/boundary/compare/api/v0.0.54...api/v0.0.55)

Updates `github.com/coder/websocket` from 1.8.13 to 1.8.14
- [Release notes](https://github.com/coder/websocket/releases)
- [Commits](https://github.com/coder/websocket/compare/v1.8.13...v1.8.14)

---
updated-dependencies:
- dependency-name: github.com/coder/websocket
  dependency-version: 1.8.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/docker/docker
  dependency-version: 28.4.0+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: mvdan.cc/gofumpt
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/coder/websocket
  dependency-version: 1.8.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/hashicorp/boundary/sdk
  dependency-version: 0.0.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/hashicorp/boundary/sdk
  dependency-version: 0.0.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/hashicorp/boundary/sdk
  dependency-version: 0.0.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/hashicorp/boundary/sdk
  dependency-version: 0.0.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/hashicorp/boundary/sdk
  dependency-version: 0.0.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/coder/websocket
  dependency-version: 1.8.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>

* Format files with latest gofumpt

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
2025-09-08 15:17:46 -04:00
Irena RindosandDanielle Miu eaf31ef17a feat(rdp): perform basic settings exchange and test the proxy fn (#1657)
-----------
Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>
2025-09-02 15:14:09 -04:00
Hugo 2316fecbd6 Remove nhooyr.io/websocket from Boundary (#5992) 2025-08-20 16:28:07 +01:00
Hugo a65d5d8573 feat: Normalize fields across various Boundary components (#5599)
Normalizes various IP/Address/Host fields across Boundary resources/components to comply with IPv6 specifications.
2025-05-13 16:55:28 +01:00
Irena Rindos 84c626a459 chore: remove code for 0.12 backwards compatibility in protocol support (#5622) 2025-03-24 11:55:32 -04:00
Damian Debkowski 5bd142ddb4 fix(worker): set session.CloseCallTimeout to non-zero value (#5510) 2025-02-04 13:47:32 -08:00
Elim Tsiagbey c5cc20c649 fix(worker): add GCP plugin support on the worker (#5484)
Enable worker to run GCP plugin
2025-01-28 09:35:14 -05:00
Johan Brandhorst-SatzkornandDamian Debkowski ec0a3f964b Worker status refactor (#5417)
* oss: feat(proto): statistics rpc added to server coordination service

* oss: feat(session): add update statistics status service

* oss: feat(handlers): add Statistics method to worker service server

* oss: feat(worker): add statistics ticking

* oss: internal/proto: define the new RoutingInfo RPC

* oss: internal/server: repository changes for RoutingInfo RPC

* oss: internal/daemon: add RoutingInfo handler to worker service

The new RoutingInfo RPC is used to get information from the worker
that is used to make routing decisions on the controller. It also
handles the initial request from the worker.

* oss: feat(db): server_worker_session_info table

* oss: feat(proto): session info rpc for server coordination service

* oss: feat(server): worker session info request data type

* oss: feat(worker): session info ticker

* oss: feat(handler): server coordination handler for session info

* oss: feat(session): utilize session info request time for session cleanup

* oss: proto: fix some gotags comments

Some of these fields were missing comments, while others had
incorrectly formatted comments.

* oss: worker: send connection status to server

This is required for the correct tracking of orphaned connections

* oss: internal/daemon/worker: add function to wait for Statistics RPC

* oss: internal/daemon/worker: add routing info RPC

The new RoutingInfo RPC replaces part of the Status RPC,
namely the part which is used by the controller and worker
to perform decisions around the establishment of new sessions
and new worker connections.

* oss: internal/daemon/worker: remove unnecessary error check

* oss: internal/daemon/worker: lock access to config and upstreams

The new confLock protects access to the conf value and to the
addressReceivers slice.

* oss: worker: replace Status RPC with RoutingInfo

* oss: worker: deprecate the Status RPC and related types

The Status RPC and related messages have been replaced
by the RoutingInfo/SessionInfo/Statistics RPCs. The controller
will continue to support the Status RPC until two new minor
versions have been released.

* oss: internal/event: add default deny for new worker RPCs

* oss: internal/daemon/worker: allow RPC interval to be set

The new SessionInfo/RoutingInfo/Statistics RPCs run at
long intervals, which make some of our cluster tests take
a long time to complete. This allows their interval to be
configured in tests.

* oss: all: use TestWorkerRPCInterval in slow tests

This should speed up these tests significantly.

* oss: internal/tests/cluster: reset sys eventer in test

---------

Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
2025-01-09 10:26:37 -08:00
846c849589 Worker Domain Refactor (#5338)
* feat(server): Refactor LookupWorkerByName to be a test method

* feat(server): Split worker tags table

* refact(worker): Export api and config tags

* refact(server): Return worker id from UpsertWorkerStatus

* refact(server): Create ListWorkerStorageBucketUpdates domain function

* refact(server): Use dedicated HCPb-worker list func

* refact(server): Create ConnectionRoute domain function

* refact(handlers): Move worker selection logic to internal/server package

This commit moves all the logic to select a worker to handle a session
to the internal/server package. Most functions were moved to this
package with no changes, however, there are a couple of notable
exceptions:

- Given that we don't use GRPC errors in repos, all errors were adjusted
  to use the internal/errors package instead.
- StorageBucketFilterCredIdFn is now used to prevent the internal/server
  package from importing internal/storage/plugin, which would cause a
  dep cycle. Callers of SelectSessionWorkers must implement this func
  which is responsible for returning a storage bucket's worker filter as
  well as its associated credential id.
- authorizeSessionWithWorkerFilter now receives an
  internal/server.(*Repository) object when called. This is transparent
  to SelectSessionWorkers callers as it is handled internally.

* feat(server): Add FilteredWithFeatures fn and new server options

* refact(server): create new list and lookup worker queries

* test(server): Add WorkerList unit tests

* feat(server): Implement WorkerList randomness using crypto/rand pkg

* chore(db): add index to server_worker table

* refact(server): prefix test method with Test

* refact(server): rename Downstreamers interface to Graph

* chore(server): unexport and rename method

* chore: add doc string to WorkerAddress (#5420)

---------

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
Co-authored-by: irenarindos <irena.rindos@gmail.com>
2025-01-08 15:18:03 +00:00
Damian Debkowski 868d7b8a2d test(daemon): remove tests with multihop (#5397) 2024-12-30 12:21:52 -08:00
Damian Debkowski 98bb4c8c31 test(cluster): split tests between parallel and sequential packages (#5390) 2024-12-20 13:53:37 -08:00
Johan Brandhorst-Satzkorn 1b6b22ef4f internal/daemon/worker: improve runtime and reduce noise (#5387)
TestRotationTicking would previously wait for 5 rotations, which is
pretty slow considering each rotation takes 20 seconds. Reduce
the number to 3, and use require instead of assert to remove
noise during flaky test runs.

This doesn't fix the flakiness of this test, but it should reduce the log spam.
2024-12-20 12:02:22 -08:00
Johan Brandhorst-Satzkorn 20f11ab01b Revert "internal/daemon: speed up multi-worker tests (#5370)" (#5386)
Unfortunately, this started causing the enterprise tests to break in
an unexpected way. Reverting to spend some more time testing the changes.
2024-12-19 09:29:48 -08:00
Johan Brandhorst-Satzkorn 862a30c389 internal/daemon: speed up multi-worker tests (#5370)
Instead of sleeping, we can poll for the desired state. Also,
run shutdowns in parallel.
2024-12-17 09:18:27 -08:00
daniandDamian Debkowski 62c41191ff [fix] allow IPv6 controllers, workers, and targets (#5221)
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
2024-11-01 13:27:40 -04:00
Hugo ee9f9fb4a1 feat(worker): Support running AWS host plugin 2024-09-30 21:24:18 +01:00
Ryan Derr de141e34a9 Worker Connection Failure Add Controller Target (#5109)
* ICU-11692 Add Upstream Controller Addrs When Throwing Controller Connection Failure

* Reference Consistant Load Variable For Client Connection
2024-09-30 11:51:55 -07:00
Johan Brandhorst-Satzkorn 41de35f2b1 internal/daemon/controller+worker: propagate downstream timeout (#5083)
Propagate the downstream worker timeout into the
downstream receiver and downstream ticker
so we have a configurable consistent timeout
value to use for worker to worker interactions.

Also change the atomic.Pointer to an atomic.Int64
for consistency with other values.
2024-09-11 12:19:11 -04:00
Jeff Mitchell 66af7dba98 Allow reloading some server timings (#5071)
Allows changing grace period and a few other things timing-related via
HUP instead of just a restart.

Tested manually via config changes and HUP.
2024-09-04 15:40:44 -04:00
Johan Brandhorst-Satzkorn 96688b36d5 internal/daemon: simplify time update tests (#5041)
Using time.After makes the intent clearer
2024-08-27 11:00:04 -07:00
Hugo abb2d50494 fix(worker): Use 16-bit int parsing for TCP port 2024-08-21 13:55:58 +01:00
Sorawis Nilparuk (Bo) 350ac90a57 implement configurable getDownstreamWorker timeout (#5007)
* implement configurable getDownstreamWorker timeout

* add parsing test

* typos

* fix tests

* fix worker tests

* 0 is a valid value
2024-08-13 14:27:39 -07:00
Jim 28b465e4b8 refact: to use go-dbw CreateItems, DeleteItems (#4974)
* refact: to use go-dbw CreateItems, DeleteItems

Latest version of go-dbw updated the signature of
CreateItems(...) and DeleteItems(...) on a happy
note this latest version of go-dbw actually does
batch inserts and updates for this functions.

* all: regenerate protos with new protoc-gen-go version
2024-08-01 11:18:53 -04:00
Elim TsiagbeyandDamian Debkowski 670a43ca22 feat(worker): set storage bucket states for worker status
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
2024-07-17 14:23:11 -04:00
Irena Rindos b54608b9f2 worker auth: use new previous pkix field (#4894)
* worker auth: use new previous pkix field
2024-06-14 13:20:50 -04:00
Michael LiandElim Tsiagbey ca1196cdc9 test(worker): Address flake in TestMonitorUpstreamConnectionState (#4668)
* test(worker): Address flake

* test(worker): refactor `TestMonitorUpstreamConnectionState` tests

* test(worker): remove assertion for grpc shutdown state

---------

Co-authored-by: Elim Tsiagbey <elim.tsiagbey@hashicorp.com>
2024-04-19 10:38:03 -04:00
dani 1a77e4da86 Boundary Plugin MinIO (#4621)
feat(storage): Add storage support for MinIO via new built-in plugin
2024-04-12 11:28:40 -04:00
Elim Tsiagbey a23c57e7c6 feat: add storageEventListener nil check
Only shutdown the storageEventListener if the storageEventListener is not nil
2024-04-05 17:27:20 -04:00
Elim Tsiagbey 3f94c900f0 feat: Add worker event listener
- add worker event listener
- add worker event handler
- start event listener when a worker starts
2024-04-05 16:46:22 -04:00
Elim Tsiagbey 8506ed3e2c feat: Report Local Storage State Status
- add `LocalStorageState` to worker status reports
- update worker service handler to process `LocalStorageState`. If is empty for workers older workers, we set the `LocalStorageState` to `unknown`
- update field mask paths to support `LocalStorageState`
2024-04-05 16:46:06 -04:00
Damian Debkowski aea473c77b feat: new worker config for minimumAvailableCapacity 2024-04-05 16:45:52 -04:00
Jeff Mitchell 7e214026af Fix issue with workers connecting in high latency conditions (#4535)
At some point we migrated to grpc ConnectParams to control how often
retries were happening. One value that we didn't set was the
MinConnectTimeout. It turns out that if you don't set this, it won't use
the default; instead if will actually use a value of zero, which gRPC
internally ups to something that seems to be around 25ms to meet a
minimum threshold. This is not documented in the function comments.

This commit simply sets the value of MinConnectTimeout to the unexported
gRPC default.
2024-03-15 15:31:07 -04:00
Jeff Mitchell 9408b2b299 Add some more fixes caught by race detector (#4488) 2024-03-07 14:46:10 -05:00
Jeff MitchellandDamian Debkowski 014a5a7aae Vet/race fixes (#4421)
This addresses all found vet/race fixes in community edition.

---------

Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
2024-02-21 16:32:26 -05:00
Jeff MitchellandDamian Debkowski 35cef97bd4 Linter fixes PR 3 (#4415)
* Linter fixes

* fix(bsr): update test to register TEST protocol once

---------

Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
2024-02-16 08:30:16 -05:00
Jeff Mitchell 25bce9e8ff Fix linter warnings 2024-02-13 15:50:11 -05:00
Jeff Mitchell 483f13226e Adjust tofu token check 2024-02-06 15:04:02 -05:00
Jeff Mitchell 8e71caa2e3 Address some review feedback 2024-01-26 18:24:27 -05:00