* all: Upgrade listenerutil dependency
The new listenerutil implements http.Flusher, which is necessary
for streaming responses from the grpc-gateway to work.
* daemon/controller: Remove newline delimiter in streaming responses
The default gRPC-Gateway HTTPBody marshaler uses newlines
as a delimiter. This introduces newlines in our streamed responses.
Wrapping the default marshaler lets us define a nil delimiter, which
ensures our streaming responses are unaffected by the server side
chunking.
* chore: Upgrade Go version
* fix: Upgrade golangci-lint to support 1.20
* fix: Don't use t.SetEnv in parallel tests
This is a panic in Go 1.20 and it sounds like a recipe
for distaster in general.
* chore: remove duplicate import
* feat: Add job run cleaner
The new job cleans job runs older than a configured interval.
Configure the job to clean jobs older than 1 minute.
Used by the CORE SRE team Heimdall product to give
quick overview of all the HashiCorp repositories.
Initially this just adds some very basic information
about this repository. Could be expanded if we
expand the use of Heimdall.
* testing(perms): Add Parse fuzz test
I ran this for a few minutes and it didn't discover anything catastrophic.
* Add roundtrip tests
* Fix invalid unicode parsing, empty output fields
* Do the unicode conversion once on input
* Remove incorrect fix for empty output fields
* Allow empty output_fields
This is the same behavior as output_fields=,
* Add tests back, make JSON behaviour consistent
* Rework the output fields mechanism to fix some bugs such as properly handling no fields
* Change signature of Fields
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Migration numbers need to be consistent between version upgrades.
The migrations for the key lifecycle management were merged
into v0.11.1 as number 56, but are currently 58 in main.
This reorders them down to 56, fixing an issue when
migrating from 0.11.1 to main.
* fix(worker): Verify contents of loaded session (#2629)
* fix(worker): Verify contents of loaded session
Previously, it was possible for an empty private key to be used
when the session had no user or project associated with it.
The new checks guarantee that we will fail gracefully in these
cases.
* Check against len instead of nil
* Add CHANGELOG
* fix(session): Always invoke all parts of session cancel trigger
The session cancelation trigger would not set the key_id to null
appropriately if another one of the fields on the session was
already null, since that case statement would be matched first.
The new structure matches all statements, in case any of them have
special logic (such as in the project case).
* Key Rotation/Destruction (#2477)
* fix: Correct kms.CreateKeys comment
This method does not return anything.
* feat(kms): Add new ListKeys method
The new ListKeys method wraps the underlying KMS wrapper,
returning all the keys in the scope specified.
* feat(scopes): Add new scope actions for key management
Adds list-keys, rotate-keys and revoke-keys actions for scopes.
* feat(scopes): Add ListKeys API endpoint
This new endpoint lists all keys in a scope
* feat(api): Add ListKeys to Scopes client
This has to be a custom function because it is a custom action
and doesn't map well to any of the existing templates, or
generalises well in a way that would make it reasonable
to create a new template.
* feat(cli): Add new scopes list-keys command
* add RotateKeys function to the kms repository
* Add Rotate Keys Endpoint to Scopes Api (#2360)
* add rotate keys endpoint
* add tests for RotateKeys endpoint
* remove that one comment I forgot about
* addressing more PR comments
* Add Rotate Keys CLI Command (#2395)
* add cli command and client
* add bats tests
* fix some info text and pr comments
* write a new rotate keys description
* Add Missing DEK Foreign Keys (#2408)
* add missing fks
* mark key as nullable in gorm
* update tests to use a new wrapper with a real key_id
* fix formatting in test and add keys for auth_token test
* replace key values
* revert postgres_40_01_test.go
* style: reformat sql for readability
* refactor: change type of key_id columns to kms_private_id
* Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431)
* fix(db): Correct types of data key version referencers
* fix(oplog): Fix missing error handling
* feat(oplog): Store key_id and scope_id with oplog entries
This migration truncates all existing oplog entries, as
migrating existing data would have been complex and
likely unnecessary.
* Update view references
* Always delete oplog entries when dropping keys
* Fix rebase issues
* Fix sql tests
* Add schema for new kms destruction jobs (#2479)
* feat: Add schema for new kms destruction jobs
The schema lets us manage destruction jobs per-table
while providing a guarantee that only one run is running
at a time.
* Apply suggestions from code review
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Fix table reference and tests
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* update domain, api, and cli to all include key versions in outputs (#2472)
* update domain, api, and cli to all include key versions in outputs
* fix go sum
* add migration to fix immutable error
* fix final test issue as well as make gen issue
* rebase and fix
* address johan pr comments
* make gen, didn't realize comments were included
* update migrations based on new migration 55 file 03
* Move migrations to 56
* feat: Add key version rewrapping function registry (#2478)
The new RegisterTableRewrapFn can be used by a domain
to register a callback to use when rewrapping data in a
specific table name.
* feat(kms): Add scopeId to RewrapFn (#2539)
This makes it much easier for rewrap functions to look up
the correct wrapper and limit the number of rows searched.
* Update Root Cert Proto Definition (#2542)
* update root cert proto definition to properly identify public_key as the table primary key
* add the test fix as well
* Rewrap Functions for Encrypted Tables (#2532)
* add oidc rewrap
* add argon2 config rewrap
* add auth token rewrapping
* add worker auth cert rewrapping
* check the err
* add username password credential rewrapping
* add ssh private key credential rewrapping
* add vault client certificate rewrap function
* add host catalog secret rewrap function
* cleanup a little
* add host vault token rewrap function
* add session credential rewrap function
* add session rewrap function
* add worker auth rewrap function
* update test to include full assert gamut
* add session rewrap function TEST
* bring all tests up to current standards, make more readable, and include full assert gamut
* rework all rewrap functions to utilize scope id
* update comments, queries, sql refs, etc, in response to PR comments
* forgot a comment
* remove hmac updates and fix a couple comments again
* Rewrapping Registered Tables Test (#2555)
* add the registered table test as well as the two missing rewrap functions
* address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test
* Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498)
* feat(kms): Add ability to list data key version destruction jobs
* feat(scopes): Add ListKeyVersionDestructionJobs
* feat(cli): Add list-key-version-destruction-jobs
* feat(kms): Add recurring job that performs table rewrapping
The new recurring job runs for each job table with a registered
rewrapping callback. It attempts to become the running run and
start its rewrapping, gracefully handling sudden interruptions
by resuming it's work if it finds evidence of sudden interruption.
* feat(kms): Add recurring job for destroying key versions
The new job monitors the database for data key version destruction
jobs that have finished rewrapping all its data, performing
the final data key version revocation.
* feat(kms): Add DestroyKeyVersion
DestroyKeyVersion immediately destroys a key version
if it is a root key version or a data key version
which encrypts no data. If the data key version
encrypts data which needs to be rewrapped, it
queues an asynchronous job to complete the rewrapping
operation.
* feat(scopes): Add DestroyKeyVersion API endpoint
* feat(cli): Add scopes destroy-key-version CLI command
* Ensure all secret updates include key ID (#2556)
* feat(all): Ensure all secret updates include key ID
When updating a secret, it is paramount that the key ID
is also updated, as it is the only means we have of ensuring
that we only destroy keys once there is no more data
associated with the key.
* Remove fix to session repository for now
This breaks the current private key derivation method
* add new encrypt/decrypt funcs and made necessary proto changes (#2557)
* add new encrypt/decrypt funcs and made necessary proto changes
* address all PR comments
* fix test panic
* add param checking to rewraps
* fix(schema): Correctly organize migrations again
* Review comments part 1
* Review comments part 2
* Review comments part 3
* Store cert private key, encrypt tofu token (#2583)
* fix(session): store cert private key, encrypt tofu token
Previously, we would derive a session certificate private key from
the session key used in each project, and not store the key. We
would also encrypt the tofu token with the database key but not
store a reference to this key in the database.
This change fixes this by replacing our key derivation with a key
generation step, and instead store the generated key, encrypted,
in the database. We also ensure that any new tofu tokens are
encrypted with the same key.
To handle existing sessions, we lazily rewrite the sessions whenever
a user lists them. There is a minor risk that a user could end up
destroying the database key that encrypts the tofu token before
that session has been rewrapped, but this is going to be rare and
temporary.
* feat(session): Allow the random source for secrets to be configured
* Review comments
* Minor fixes
* More minor fixes
* More small fixes
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* fix(session): Unset session key ID when scope is deleted
Unsetting the key ID allows the session to live beyond the lifetime of
the scope, while allowing the scope to cascade delete its keys.
* fix(migrations): Rewrite migration 56 tests
These tests can no longer use the normal test helpers
as they try to use the new oplog table structure, so we
have to manually write all the interactions.
* fix(migrations): Rename migration 58 file name
This was the name used in the release branch, update
it to the new migration number.
* fix(e2e): Add some comments and debug to kms tests
* fix(session): Handle empty project and user IDs in read
When a project or user is deleted, the session is automatically
canceled and the respective field on the session is unset.
LookupSession did not handle this case gracefully, and would
error on decryption in this state. Skip decrypting sessions that
do not have either a user or project to avoid this error. The
decrypted values are not used for a canceled session.
* Fix worker test
* Increase test timeout
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
If callers want errors to create events, they can do so
by wrapping the error. Sometimes we don't want db
errors to be events, and before this there was no way
to supress them.
* test(cli): Remove skips in CI for cli tests
* fix(enos): Fix enos bats tests
The tests still sometimes suffer from timing issues,
but I was able to run a successful run (setup, run, destroy)
of the tests from my machine at least once.
There were 2 issues:
- Some tests in groups.bats were hardcoding the default user id
- The default grants for a user in a project were missing
the permission to connect to a target. We now add this
explicitly.
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* doc: Add link to generated API docs on API page
This makes it easier to find the generated API docs from the API
description page.
* Update website/content/docs/api-clients/api.mdx
Co-authored-by: Yoko Hyakuna <yoko@hashicorp.com>
Co-authored-by: Yoko Hyakuna <yoko@hashicorp.com>
* feat(sql): Fork pgtap to support arm64
This forks pgtap-docker and builds the image locally,
and updates our references to use our forked image.
* fixup! feat(sql): Fork pgtap to support arm64
Enos jobs are still a bit unstable, we should use them as
advisory for now. When they have gained more stability,
we can let them fail pipelines again.
* chore(deps): Update grpc-gateway dependency
This fixes an issue which would allow an attacker to trigger a
(recovered) panic in the gateway handler.
* fix(server): Use cmp.Diff instead of assert.Equal
Testify is not great at handling protobuf types, and
was for some reason returning a diff here when in
reality there is none. Switch to go-cmp for the
comparison to remove the error.
We generally care about preserving JSON compatibility for protobuf
files, but for some files, where we only use pure gRPC, we only
care about preserving wire compatibility.
Split our buf breaking invocation into two invocations, one that checks
for WIRE_JSON compatibility, and one that checks only for WIRE
compatibility. The former check ignores protos in controller/servers,
since they do not need to adhere to this stricter definition.
* fix: Propagate plugin options to CreatePlugin
Plugin options were previously only applied to the
BuildPluginMap call, resulting in the plugin
execution_dir variable being ineffective.
Also add a test to verify functionality
* fix: Support plugin execution_dir for all plugins
Previously, only external host plugins would respect
the plugin execution dir. Now, all uses of the embedded
plugins respect the configuration.
Updated examples to show the common use case of
specifying a directory path and file name for
a file sink. This should hopefully prevent users
from making the mistake of putting a full path
for the file_name field and seeing an error like:
[ERROR] unable to send event: operation="event.(Eventer).retrySend"
warning=
| 1 error occurred:
| * mkdir : no such file or directory
|
Both the init and migrate commands were ignoring
the configured max_open_connections database
setting. This fix ensures that both commands
respect the limits.
* fix(cmd): Add profiling build imports
It seems like this file has been bitrotted since last used,
and it was missing some imports. This was discovered
by running goimports on the code.
* Add build-memprof Makefile target
The list benchmark tests uses pre-created database
dumps to run its benchmarks. This benchmark
will be used to guide optimizations around listing
of sessions.
Fixes https://hashicorp.atlassian.net/browse/ICU-4042
Mount the benchmark dump directory when running
the test database and create a new script for creating
templates from the dumps. This makes it easy to create
pre-populated databases for benchmark tests.
Fixes https://hashicorp.atlassian.net/browse/ICU-4040
Sometimes when creating a lot of sessions concurrently we
can run into a unique constraint error in the warehouse triggers
in the database. Simply retrying the call will allow the
session creation to succeed.
Our test helper packages were not possible to use
with benchmarks. This refactor switches to testing.TB
to allow both tests and benchmarks to use the helpers.
The new docker-load target uses docker buildx to build
a local image of each of the Dockerfiles, and load them
into the local docker socket image store.
* refact(dbtest): Remove old migration code
This is no longer needed, so we can clean up this
script a bit.
* refact(dbtest): Change test image env var
The existing environment variable clashes with
the one used in the top level Makefile. The new
name prevents confusing behavior when setting
the env var and creating the test database from
the root of the repository.
The wrapper is sometimes unset at the time when the
audit config is validated, so it is impossible for us
to validate that a valid wrapper is configured. The wrapper
is configured by later setup steps because of a dependency
on the eventer in our KMS setup.
Classify fields for all api and cluster protobuf messages.
Before classification, audit events would be completely redacted.
Now events will contain unredacted values according to classification.
Audit events are now no longer considered a WIP.
The original idea was for these methods to eventually become
entirely encapsulated by the subtype package, but as it turns
out we still have use for them in custom transformation functions,
so move the subtype package to use these shared functions
instead.
This allows the user to register a custom transformation callback
for a specific protobuf message, in cases where the transformation
is sufficiently complex for it to be cumbersome to formalise
the logic through protobuf options.
This return value is just a reference to the input, which
is being mutated. We may as well make that clear via
the signature, which will also simplify the new custom
transformation function registration logic.
It is not unreasonable for downstream users of the request and response
messages to mutate them, indeed we mutate the response
on the way out to get the desired external API. To avoid
inconsistent messages being audited, make a copy of the
entire message before returning from the interceptor.
This was discovered while testing the new subtype transformation
interceptor.
Other parts of the system make use of a "type" field, while the
AuthenticateResponse sets a "token_type" on the response attributes
directly. Rename this field to "type", and move it up to the response
level, to be more consistent with other RPCs.
Also adds a new field to the AuthenticateRequest, "type" which will
replace the "token_type" field over time.
When requesting a token, any error is fatal to the test.
The previous behavior would return a nil token, which
could cause subsequent uses to panic. This will instead
interrupt any test immediately on error.
It is documented as illegal to use t.FailNow in a goroutine.
Uses of require assertions call t.FailNow. This may have led to
inconsistent test results as some assertions were subject to
undefined behavior. Note that it is still allowed to call
assert assertions in goroutines.
See: https://pkg.go.dev/testing#T.FailNow
* Install buf with go install
This reduces the impact of using buf on our dependency
closure, which was significant. It also avoids potential
issues with building buf given our own internal dependency
constraints. This has caused issues (including crashes!)
in the past.
See https://github.com/cockroachdb/cockroach/issues/67216#issuecomment-874176186
for more discussion on using tool dependencies generally, and
https://github.com/bufbuild/buf/issues/52
for an example of where this sort of thing caused an issue for a user.
* Upgrade buf version
We should migrate to v1 sooner rather than later, as it has some
breaking changes from v0.
* Change buf lint/breaking commands
These commands were moved up one level for v1
* Migrate to buf.yaml to v1
* Remove unused imports
These were uncovered by using "buf lint".
* Use buf v1.3.1
* Depend on googleapis and grpc-gateway via BSR
* Switch to buf for proto generation
* Remove third party dependency
* Remove unused tools and scripts
* Move local protos up one level
* Temporarily don't fail on breaking changes
* Generate CI config
* Fix generation of controller.json
* Replace use of deprecated flag
* Remove unused import, regenerate files
* Remove temporary skipping over breaking check
Use the standard Go heuristic for determining
whether a file should be ignored by formatting
for being a generated file.
This is effectively a no-op change today, but
if we add new generated files in the future,
we should automatically ignore them in formatting.
This is a slightly updated version of #1941 that should
work across all versions of grep.
Use the standard Go heuristic for determining
whether a file should be ignored by formatting
for being a generated file.
This is effectively a no-op change today, but
if we add new generated files in the future,
we should automatically ignore them in formatting.
* Revert version upgrade of dbus and go-keyring
The combination of these versions were causing build errors on freebsd
* Only revert zalando/go-keyring
