* fix: Proxy closing listener with 0 connections left
A bug was introduced in `0.15.0` where sessions with max connection counts were closed when the connections left hit 0. This issue was highlighted by a user: https://github.com/hashicorp/boundary/issues/4364. What was happening was when we have zero connections left the proxy code was closing the listener which closed its connections
To fix this:
- `boundary connect -target-id=xx -host-id=xx` command with no connections left will now wait for all connections to be closed and before exiting the session just like it did in `0.14.3`
- As soon as there are no more connections left, the listener will close to stop accepting new connections
- Fix issue where the websocket connection was throwing closing errors during the session teardown.
* Decrease number of flags shown for daemon/search
* Update changelog
---------
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update changelog with UI notes
* Update CHANGELOG.md
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update CHANGELOG.md
Moved changes description to UI in to the `policies` section
* fix indentation
* Update CHANGELOG.md
* correct left indentation
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Add generic read/update/delete commands
This adds three generic commands that use the resource prefix to
determine the subcommand to run and pass through args over to that
subcommand. Since this occurs very early on and to avoid loading
essentially every internal resource package, I moved subtype definitions
to globals.
This replaces #3967
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* De-duplicate Subtype code (#4031)
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* Add generic read/update/delete commands
This adds three generic commands that use the resource prefix to
determine the subcommand to run and pass through args over to that
subcommand. Since this occurs very early on and to avoid loading
essentially every internal resource package, I moved subtype definitions
to globals.
* Update main.go
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update changelog and remove another deprecated command
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* fix: monitorUpstreamConnectionState CPU consumption
`monitorUpstreamConnectionState()` is a goroutine that listens for GRPC client connection changes using GRPC's `WaitForStateChange` method. `monitorUpstreamConnectionState()` was consuming the a lot of CPU. It was continuously running and not actually waiting for state changes. The `state` for `monitorUpstreamConnectionState()` was not getting correctly updated which caused the loop to continuously run instead of waiting for new state changes.
Update GRPC `WaitForStateChange` method to use the same `state` that gets updated.
When the boundary client establishes a connection to the websocket used
to communicate with a worker, it was configured with a max websocket
message size of 32KiB. This was the default behavior for v1.8.7 of
nhooyr/websocket. However, there are cases where the worker can send
messages to the client that are larger than 32KiB. When this happens the
client returns an error and terminates the connection.
Notably this seems to only currently impact sessions made to SSH
Targets, although it could theoretically impact any target type
depending on the details of how the worker performs the writing of the
messages. The issue can be reproduced by attempting to scp a large
enough file from an SSH Target to the client. In this case the
connection gets terminated and results in a partial transfer of the
file.
This message size limit appears to be unnecessary, and the default
behavior is changing in v1.8.8 of nhooyr/websocket to make the message
size unlimited. Since this version is not yet released, this commit
switches the dependency to a fork with a version that is v1.8.7 plus the
patch to disable the limit. Once v1.8.8 is release this dependency can
be set back.
See:
https://github.com/nhooyr/websocket/pull/254https://github.com/nhooyr/websocket/pull/256
With a suitably slow system -- say, if you're waiting on a Windows
Terminal to output text inside a virtual machine -- the expected order
of things can be thrown off. One specific way this can happen is that
the worker can attempt to dial and have its dial fail because of the
slowness causing the dial context to time out. If, because of the
slowness, we also haven't released the log gate yet, then the event with
the failure information will be queued, along with the context that was
used.
Unfortunately, in some of these error cases, the context that was used
was the dial context instead of the system base context. In many other
places in the function it was the system base context so this is just a
mismatch, probably from code written at different times.
Normally this wouldn't be a problem as we'd fall back to the underlying
logger, but when we release the log gate, things happen differently:
it's a synchronous function and on error it causes us to abandon
system startup entirely.
This commit fixes the issue with using the incorrect context. It's an
open question whether we should change the behavior around errors when
replaying queued events, falling back to the underlying logger instead
of erroring.
* chore: Fix comment typo
* test(e2e): Update to use new credential library type
* test(e2e): Update to use new field name
* test(bats): Remove tests that use deprecated subcommand
* chore: Update to 0.14.0
* test(credentiallibraries): Update to use new credential library type
* doc: Add deprecation notices for 0.14.0
* fixup! doc: Add deprecation notices for 0.14.0
* feat (auth/ldap): add Repo support for max page size and deref aliases (#3670)
* chore: update cap/ldap dependency
This latest version of cap/ldap adds support for MaxPageSize and
DerefAliases
* feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto
* feat (api/authmethods): add new ldap fields.
Add support for maximum_page_size and dereference_aliases
* feat (auth/ldap): schema changes to support new LDAP attributes
* feat (auth/ldap): add Repo support for max page size and deref aliases
* feat (handlers/ldap): add support for new fields (#3674)
Added API support for new ldap fields: MaximumPageSize and
DereferenceAliases
* chore: add CHANGELOG entry for new api auth ldap fields
Todd
Michael Milton
Elim Tsiagbey
Johan Brandhorst-Satzkorn
Devon AndersonandJohan Brandhorst-Satzkorn
Louis Ruch
Jim
Hugo
irenarindos
Michael Li
daniandDanielle Miu
Sepehr