This changes the periodic job that deletes terminated sessions to delete
the those sessions in batches. Prior to this, a single SQL DELETE
command was used to delete all qualifying terminated sessions. In
systems under heavy load, the statement could timeout leading to a
situation where no qualifying terminated sessions were ever being
deleted.
This replaces the start_time, end_time, and previous_end_time columns on
the session_state table with a time range column that records when the
state was active. This allowed for dropping several constraints on the
session_state table that were used to ensure that states for a session
did not overlap. Instead this can be ensured with a single exclusion
constraint. By reducing the number of constraints, it improves the
performance for a number of queries involved with session state. Most
notably when resolving delete cascades of resources related to sessions,
such as targets, where as part of the delete transaction large numbers
of sessions get canceled. Similarly, when sessions get deleted, and the
corresponding session_state rows are deleted, these constraints all must
be checked during the transaction.
The domain layer continues to expose StartTime and EndTime fields on
session.State. However it drops PreviousEndTime, which was never used by
anything calling the domain layer.
See:
https://www.postgresql.org/docs/current/ddl-constraints.html#DDL-CONSTRAINTS-EXCLUSIONhttps://www.postgresql.org/docs/current/rangetypes.html
* refact: to use go-dbw CreateItems, DeleteItems
Latest version of go-dbw updated the signature of
CreateItems(...) and DeleteItems(...) on a happy
note this latest version of go-dbw actually does
batch inserts and updates for this functions.
* all: regenerate protos with new protoc-gen-go version
Several session.Repository methods need to encrypt or decrypt fields
when persisting or retrieving a Session. These encrypt/decrypt
operations where being performed while within a database transaction.
The first step in the encrypt/decrypt operation is to retrieve the
kms.Wrapper. While the wrappers get cached in memory, the retrieval
still results in a database query to check that the kms collection
version has not changed. This query happens with a separate db.Reader,
and therefore uses a separate database connection from the transaction
being used by the session.Repository.
If the controllers are configured with a relatively low
`max_open_connections`, and be under sufficient load interactive with
sessions, the controller can consume all of the available database
connections, and get stuck with open transactions while waiting for a
database connection to execute the kms related queries. This can be see
by checking pg_stat_activity and seeing transactions stuck in `idle in
transaction` with a wait_event of ClientRead.
This commit changes all of the Repository methods the perform any
encryption or decryption operations, including the retrieval of the
kms.Wrapper, outside of a database transaction. An alternative approach
would be to unsure that the kms.Wrapper retrieval happens within the
same database transaction. However, it seems preferable to avoid doing
these relatively expensive operations within a transaction when it is
not necessary.
As part of this fix, it also eliminates some logic that is no longer
needed. During previous would with KMS wrapping, the method of how
sessions were encrypted was changed, and some logic to lazily re-encrypt
sessions was introduced. However, given that terminated sessions are
deleted, and the KMS changes was introduced several versions ago
(0.13.0), this lazy re-encrypt logic should no longer be necessary.
Refs: edd323b73a
See:
https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-ACTIVITY-VIEWhttps://www.postgresql.org/docs/current/runtime-config-client.html#GUC-IDLE-IN-TRANSACTION-SESSION-TIMEOUThttps://developer.hashicorp.com/boundary/docs/configuration/controller#max_open_connections
When closing orphaned connections and checking if a session is not
active, the repository was opening a transaction, but then calling the
original reader instead of using the reader/writer from the transaction.
This would result in a transaction being opend, then a separate
transaction being used to run the query, and finally the original
transaction would commit without any statements being executed.
Co-authored-by: Sorawis Nilparuk (Bo) <sorawis.nilparuk@hashicorp.com>
* Adding explicit MPL license for sub-package.
This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.
* Adding explicit MPL license for sub-package
This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.
* Updating the license from MPL to Business Source License
Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.
* Update copyright file headers to BUS-1.1
* Rerun make gen
This will pick up the last of the license changes
* Revert "Rerun make gen"
This reverts commit dbe0968bffd92745d8663c6940debae098395a6b.
* Remove copywrite from generation script
The current version of copywrite is not sophisticated enough
to only apply the copywrite changes to certain subdirectories,
so to avoid accidentally relicensing our api and sdk modules,
we will stop running the copywrite script until such time
that it can do the right thing.
* License protobuf API as MPL
The protobuf API files are used to generate the SDK,
since we want the SDK to be MPL, the protobuf files
must also be MPL. This extends to all protobuf files
whose sources end up in the SDK directory, including:
- internal/proto/controller/api
- internal/proto/controller/custom_options
- internal/proto/plugin
It also includes the generated service directory in
internal/gen/controller/api/services, since they are
generated from the protobuf sources used for the SDK.
* Change website license file name
This makes the naming scheme consistent with the rest
of the repository.
* Add note on licensing to README
* Set copywrite license to BUSL
* Revert "Add note on licensing to README"
This reverts commit 4d865a91a7a4f11605f0dc4609355d7e3c3cfffe.
---------
Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
This adds a new Job type that is for generic session state monitoring. Monitoring sessions does not include any information about specific connections.
* refactor (kms): add GetWrapperer for RewrapFn parameter
* tests (kms): add MockWrapper and MockGetWrapperer
Make it a bit easier to write unhappy path tests which depend on
a Wrapper or GetWrapperer
* Key Rotation/Destruction (#2477)
* fix: Correct kms.CreateKeys comment
This method does not return anything.
* feat(kms): Add new ListKeys method
The new ListKeys method wraps the underlying KMS wrapper,
returning all the keys in the scope specified.
* feat(scopes): Add new scope actions for key management
Adds list-keys, rotate-keys and revoke-keys actions for scopes.
* feat(scopes): Add ListKeys API endpoint
This new endpoint lists all keys in a scope
* feat(api): Add ListKeys to Scopes client
This has to be a custom function because it is a custom action
and doesn't map well to any of the existing templates, or
generalises well in a way that would make it reasonable
to create a new template.
* feat(cli): Add new scopes list-keys command
* add RotateKeys function to the kms repository
* Add Rotate Keys Endpoint to Scopes Api (#2360)
* add rotate keys endpoint
* add tests for RotateKeys endpoint
* remove that one comment I forgot about
* addressing more PR comments
* Add Rotate Keys CLI Command (#2395)
* add cli command and client
* add bats tests
* fix some info text and pr comments
* write a new rotate keys description
* Add Missing DEK Foreign Keys (#2408)
* add missing fks
* mark key as nullable in gorm
* update tests to use a new wrapper with a real key_id
* fix formatting in test and add keys for auth_token test
* replace key values
* revert postgres_40_01_test.go
* style: reformat sql for readability
* refactor: change type of key_id columns to kms_private_id
* Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431)
* fix(db): Correct types of data key version referencers
* fix(oplog): Fix missing error handling
* feat(oplog): Store key_id and scope_id with oplog entries
This migration truncates all existing oplog entries, as
migrating existing data would have been complex and
likely unnecessary.
* Update view references
* Always delete oplog entries when dropping keys
* Fix rebase issues
* Fix sql tests
* Add schema for new kms destruction jobs (#2479)
* feat: Add schema for new kms destruction jobs
The schema lets us manage destruction jobs per-table
while providing a guarantee that only one run is running
at a time.
* Apply suggestions from code review
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Fix table reference and tests
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* update domain, api, and cli to all include key versions in outputs (#2472)
* update domain, api, and cli to all include key versions in outputs
* fix go sum
* add migration to fix immutable error
* fix final test issue as well as make gen issue
* rebase and fix
* address johan pr comments
* make gen, didn't realize comments were included
* update migrations based on new migration 55 file 03
* Move migrations to 56
* feat: Add key version rewrapping function registry (#2478)
The new RegisterTableRewrapFn can be used by a domain
to register a callback to use when rewrapping data in a
specific table name.
* feat(kms): Add scopeId to RewrapFn (#2539)
This makes it much easier for rewrap functions to look up
the correct wrapper and limit the number of rows searched.
* Update Root Cert Proto Definition (#2542)
* update root cert proto definition to properly identify public_key as the table primary key
* add the test fix as well
* Rewrap Functions for Encrypted Tables (#2532)
* add oidc rewrap
* add argon2 config rewrap
* add auth token rewrapping
* add worker auth cert rewrapping
* check the err
* add username password credential rewrapping
* add ssh private key credential rewrapping
* add vault client certificate rewrap function
* add host catalog secret rewrap function
* cleanup a little
* add host vault token rewrap function
* add session credential rewrap function
* add session rewrap function
* add worker auth rewrap function
* update test to include full assert gamut
* add session rewrap function TEST
* bring all tests up to current standards, make more readable, and include full assert gamut
* rework all rewrap functions to utilize scope id
* update comments, queries, sql refs, etc, in response to PR comments
* forgot a comment
* remove hmac updates and fix a couple comments again
* Rewrapping Registered Tables Test (#2555)
* add the registered table test as well as the two missing rewrap functions
* address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test
* Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498)
* feat(kms): Add ability to list data key version destruction jobs
* feat(scopes): Add ListKeyVersionDestructionJobs
* feat(cli): Add list-key-version-destruction-jobs
* feat(kms): Add recurring job that performs table rewrapping
The new recurring job runs for each job table with a registered
rewrapping callback. It attempts to become the running run and
start its rewrapping, gracefully handling sudden interruptions
by resuming it's work if it finds evidence of sudden interruption.
* feat(kms): Add recurring job for destroying key versions
The new job monitors the database for data key version destruction
jobs that have finished rewrapping all its data, performing
the final data key version revocation.
* feat(kms): Add DestroyKeyVersion
DestroyKeyVersion immediately destroys a key version
if it is a root key version or a data key version
which encrypts no data. If the data key version
encrypts data which needs to be rewrapped, it
queues an asynchronous job to complete the rewrapping
operation.
* feat(scopes): Add DestroyKeyVersion API endpoint
* feat(cli): Add scopes destroy-key-version CLI command
* Ensure all secret updates include key ID (#2556)
* feat(all): Ensure all secret updates include key ID
When updating a secret, it is paramount that the key ID
is also updated, as it is the only means we have of ensuring
that we only destroy keys once there is no more data
associated with the key.
* Remove fix to session repository for now
This breaks the current private key derivation method
* add new encrypt/decrypt funcs and made necessary proto changes (#2557)
* add new encrypt/decrypt funcs and made necessary proto changes
* address all PR comments
* fix test panic
* add param checking to rewraps
* fix(schema): Correctly organize migrations again
* Review comments part 1
* Review comments part 2
* Review comments part 3
* Store cert private key, encrypt tofu token (#2583)
* fix(session): store cert private key, encrypt tofu token
Previously, we would derive a session certificate private key from
the session key used in each project, and not store the key. We
would also encrypt the tofu token with the database key but not
store a reference to this key in the database.
This change fixes this by replacing our key derivation with a key
generation step, and instead store the generated key, encrypted,
in the database. We also ensure that any new tofu tokens are
encrypted with the same key.
To handle existing sessions, we lazily rewrite the sessions whenever
a user lists them. There is a minor risk that a user could end up
destroying the database key that encrypts the tofu token before
that session has been rewrapped, but this is going to be rare and
temporary.
* feat(session): Allow the random source for secrets to be configured
* Review comments
* Minor fixes
* More minor fixes
* More small fixes
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* fix(session): Unset session key ID when scope is deleted
Unsetting the key ID allows the session to live beyond the lifetime of
the scope, while allowing the scope to cascade delete its keys.
* fix(migrations): Rewrite migration 56 tests
These tests can no longer use the normal test helpers
as they try to use the new oplog table structure, so we
have to manually write all the interactions.
* fix(migrations): Rename migration 58 file name
This was the name used in the release branch, update
it to the new migration number.
* fix(e2e): Add some comments and debug to kms tests
* fix(session): Handle empty project and user IDs in read
When a project or user is deleted, the session is automatically
canceled and the respective field on the session is unset.
LookupSession did not handle this case gracefully, and would
error on decryption in this state. Skip decrypting sessions that
do not have either a user or project to avoid this error. The
decrypted values are not used for a canceled session.
* Fix worker test
* Increase test timeout
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
With this commit, the Worker now sends BytesUp and BytesDown for each
of the connections it handles to the Controller in the Status request.
The Controller then persists these fields to the database. There is also
a new trigger to prevent bytes_up and bytes_down to change after a
connection has been closed, as the last update to a session_connection
row should be the one that is performed as part of the connection
closure process.
The session repository can now be passed an optional set of permissions.
The permissions are used to restrict results from the repository.
Currently this only impacts the List method. This enabled the sessions
service to use a single query to retrieve sessions and replaces the
previous behavior where the session service would first request all
sessions for a given set of scopes, evaluate the permissions, and then
request sessions based on a set of session ids.
It was determined that it is a more common use case for users to request
non-terminated sessions (i.e. sessions in `pending`, `active`, or
`canceling` when requesting sessions. Notably, end users would need
non-terminated sessions to:
- Establish a new connection to a session.
- Terminate a session
So now by default a list request to `/v1/sessions` will *not* include
terminated sessions.
To still enable use cases where terminated sessions are needed, this
adds a new query parameter to include the terminated session:
`/v1/sessions?include_terminated=true`.
Note that this query parameter is considered experimental and subject to
change.
* Remove the server_id from session table, change it to worker_id on session_connection
This is step 1 in updating the worker table. The worker is becoming a public resource so it must have
a public id. We drop the server_id column on the session_connection table and add the worker_id column
so we can use the wt_public_key type. Since db migrations are applied while the controller is offline,
it should be safe to assume all session connections are not in a running state, thus allowing us to null
out all the worker ids in the session_connection table.
For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently
defined in the worker config, but this will soon change and the worker's id will be generated by the
controller.
When applying the limit and order by, the where clause also needs to be
applied to yield the correct results. This can be seen with an example.
Assuming a data set where there are 100 sessions, with 10 sessions
belonging to a user with id `u_user1` and 90 sessions belonging to
`u_user2`. If the constructed query is like:
select *
from
(select public_id from session limit 10) s,
session_list ss
where
s.public_id = ss.public_id
and s.user_id = 'u_user1'
order by create_time asc;
The initial sub-query with the limit could return sessions only
belonging to `u_user2`, then it would apply the where clause and exclude
all of the rows.
Instead if the query is:
with
session_ids as (
select public_id
from sessions as s
where
s.user_id = 'u_user1'
order by create_time asc
limit 10
)
select *
from session_list
where
session_list.public_id in (select * from session_ids)
order by create_time asc;
The CTE applies the where clause ensuring that only sessions for
`u_user1` are used for the final select from the view.
Note that the CTE is use primarily for readability.
This also adds an index on `session (create_time)` to aide the query
planner in performing the order by.
* Reorder session authz checks
This implements a mechanism for service handlers to pass a repo
satisfying an interface into the scope IDs listing function. The purpose
of this interface is to allow the same function to perform authorization
checking against resources rather than requiring service handlers to
fetch all resources in the determined set of scopes and then perform
this checking. While this could be done in each service handler, this
approach centralizes the logic, which has the nice benefit of removing
some boilerplate from service handler list functions that have adapted
to it.
Tests haven't changed, which is expected -- the function should return
exactly what was being returned before, simply faster.
This allows us to use SNI for actual host (e.g. routing) information. We
don't have the client cert yet so we can't look at that, so this
provides a way for us to convey the information needed to look up that
session's TLS stack.
Using SNI for hosts means we also run into the fact that we don't have
automatic agreement in terms of SANs. So when generating the certs we
now also pass worker address information to the function to be encoded
in the cert.
Finally, there is a change in how the websocket dialing happens, because
http.RoundTripper tries to be too clever for its own good and overwrites
NextProtos on a whim.
This creates a domain service function `session.WorkerStatusReport`. The
service performs two functions:
1. Checks the status for all of the reported sessions, returning a
report of the sessions that are in a "non-active" state, i.e.
"cacneling" or "terminated".
2. Looks for any "orphaned" session connections, i.e. connections that
are active but were not reported by the worker. These connections are
marked as closed.
This also removes the "ShouldCloseConnectionsOnWorker" logic, as this
was determined to not be a possible state, and was unnecessary.
* chore: Add new dbw dependency
* refactor: Convert to use dbw.DB
* refactor (db): Change GetTicket(...) signature
* feature (db tests): Added TestDeleteWhere(...)
Adding this allows us to eliminate a leak of the gorm library
* refactor: Add ctx to ScanRows(...) signature
This is required to refactor all the deprecated errors pkg calls.
This refactor required adding a context to quite a few call chains
and in particular the job scheduler bits
* feature (db/tests): Add support for test opt: WithTestLogLevel(...)
This test only option allows callers to specify a log level for the
underlying db package (where supported/applicable) when calling
TestSetup(...)
* refactor (db): Simplify Db type
Only store the underlying *DB and create the *RW on demand when
needed.
* refactor (oplog): Port to using dbw pkg for db operations
* refactor (db): Remove gormDB(...) func
* tests (db): Add unit tests for TestDeleteWhere(...)
* chore: make fmt changes to formatting
Michael Gaffney
Timothy Messier
Jim
Jeff MitchellandDamian Debkowski
Johan Brandhorst-Satzkorn
Todd
Michael Milton
Irena Rindos
hashicorp-copywrite[bot]andJohan Brandhorst-Satzkorn
Hugo Vieira
Louis Ruch
irenarindos
Thor