When a resource relating to a session is deleted,
notably a target, host, or auth_token, the corresponding sessions are
marked as canceled via a database trigger that calls the cancel_session
function. This function was performing a select as part of the insert
call to ensure that it would not attempt to insert a session_sate of
canceled if it was an invalid state transition. However, since this
function was first introduced, there has been additional constraints
added that would prevent an invalid state transition. In addition,
performing a select as part of an insert increases the chances for
contention with other queries that interact with the session_state
table, especially since a large number of sessions and session_state
rows can be included in a single transaction when things like
auth_tokens or targets get deleted.
Now, the cancel_function will perform the insert, and catch any of the
potential violations, allowing the query to continue without needing to
perform the select, thus reduction the potential for contention.
This issue was surfaced through other changes (PR 5137).
Given that the eventer works in a singleton pattern (see sysEventer
global variable), performing this shallow object copy can cause a data
race because the copy operation reads the underlying eventer data
structures. At the same time, given the global nature of this eventer,
other goroutines can be writing to those same data structures.
Since we're already using a singleton pattern in this package, and given
that the current copy operation is shallow, copying the object doesn't
seem necessary, so this commit changes `StandardWriter` to build the
`logAdapter` with the `e` eventer directly instead of copying it.
This replaces the start_time, end_time, and previous_end_time columns on
the session_state table with a time range column that records when the
state was active. This allowed for dropping several constraints on the
session_state table that were used to ensure that states for a session
did not overlap. Instead this can be ensured with a single exclusion
constraint. By reducing the number of constraints, it improves the
performance for a number of queries involved with session state. Most
notably when resolving delete cascades of resources related to sessions,
such as targets, where as part of the delete transaction large numbers
of sessions get canceled. Similarly, when sessions get deleted, and the
corresponding session_state rows are deleted, these constraints all must
be checked during the transaction.
The domain layer continues to expose StartTime and EndTime fields on
session.State. However it drops PreviousEndTime, which was never used by
anything calling the domain layer.
See:
https://www.postgresql.org/docs/current/ddl-constraints.html#DDL-CONSTRAINTS-EXCLUSIONhttps://www.postgresql.org/docs/current/rangetypes.html
Cache speed up and additional performance improvements
This includes several changes to improve the performance of the
client cache, including:
* Making the sqlite database for the cache persistent, so the cache does
not need to be rebuilt each time the boundary client is started.
* Limiting the number of results retrieved when listing resources to 250.
* Preventing redundant refreshes running at the same time for a given
client.
* Adding indexes to the cache database.
It also refactors the grants query that is run to fetch grants for a
user when processing a controller API request. This greatly reduces the
amount of data that is returned from the database, but required a number
of changes in the application logic to account for different kinds of
grant scopes.
Lastly this makes some performance improvements in the controller
database. It adds several indexes to help with the grants query and with
delete cascades for several resources. And it changes the delete trigger
for sessions to run per statement instead of per row to help with bulk
deleting of sessions.
This function was returning the set of deletion tables. A view seems
better suited for this task since it would allow for applying additional
filters of the result set. This was particularly necessary to easily
make changes to some sqltests due to switching the delete trigger for
the session table.
(cherry picked from commit 32d41639892950b21fafc39b50c10b997c6d5121)
When sessions are deleted, a trigger is used to insert records into the
session_deleted table. This table is utilized by the sessions list
endpoint when using a refresh token to inform a client of the sessions
that have been deleted since the last request. We delete sessions in
bulk via a controller job to delete sessions that have been terminated
over an hour ago, which results in the trigger running a large number of
separate insert statements while processing the delete statement.
This changes the trigger to run once for the delete statement, instead
of for each row, resulting in a single bulk insert statement to the
session_deleted table.
This new trigger function also avoids the use of `on conflict`. When
testing this function, while the single statement was still faster than
running multiple inserts, the `on conflict` still added significant
overhead, even when there were no conflicts. It should be safe to
perform the insert without the `on conflict`, since the same ID should
never be deleted more than once if it is successfully deleted.
(cherry picked from commit 3569b36c6eb2bee7a4e36e7584fcc6bbf1124f95)
When processing a controller API request, system uses a query to fetch
the grants for the requesting user. This query requires pulling together
information from several tables, and is currently performing many
sequential scans to do so. For a number of the tables involved, there
are indexes from multi-column primary keys, however, due to the order of
the columns in the index, the postgres planner would need to do a full
scan of the index, which can be less efficient than a sequential scan,
so instead it will perform a sequential scan of the table.
This recreates the primary keys while swapping the order of the columns
in the primary key definition, and thus the order in the index. By doing
so, the planner will not need to perform a full index scan, and will be
more likely to use the index when executing the grants query.
(cherry picked from commit 5577b3c358e9d45cd7ec02fc951e45d52e50595e)
This adds indexes for a few categories:
1. Foreign keys on the session table. These are set to `null` when the
referenced row is deleted. These indexes will help to more
efficiently set these `null` values in the case where a target is
deleted, or and auth token is deleted.
2. Foreign keys from other tables to the session table. These are either
set to `null` or cascade deleted when a session is deleted. These
indexes help with these update/deletes when a session is deleted.
3. A multi-column index on session_state. This helps with the query that
is used to delete all terminated sessions that have been terminated
for over an hour.
(cherry picked from commit 263a96e9ddd197cb36f2c4c74e91ac034112321e)
This removes the Cartesian product in the DB for GrantsForUser in favor
of returning the actual grant scope information and dealing with it in
application code.
(cherry picked from commit 913cd536823d73994acc4f4d833208c1cc05f91b)
* internal/clientcache: add -force-reset-schema flag
* clientcache: stream list pages directly to DB
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
(cherry picked from commit ccea8a4ce53f7b0d1105c1c1e4875e443635d96a)
Fix ensures that the TestServer returned uses the
correct directory for writing its sqlite files,
which was created via t.TempDir()
(cherry picked from commit 85f91043a164bdacc1c6738ae0e7c50077d55c79)
This ensures we don't have competing update processes running. When doing the
inline RefreshForSearch, a specific error will be returned so we can hint in
the API that we're in the middle of a refresh.
(cherry picked from commit 54776091e32af2f2f110f2bf10d0617bd5677aba)
This allows getting a list of scope IDs known by the cache via cached
targets and sessions. It is not refreshed from the controller. The name
contains `implicit` in case we ever want e.g. `scopes`.
(cherry picked from commit c0a318c58367d8ec55365447f41cf007eab64ce3)
By default, we will use a persistent cache for the
client cache. This will allow us to keep the cache
across restarts of the server and it will also
reduce the amount of time it takes to start the
server while reducing the amount of memory used.
This change also includes a validation of the cache
schema version. If the schema version is different
from the one expected, the cache will be
reset/recreated.
(cherry picked from commit cf8a51f3834033b7f986a9a7e091ab31c4328415)
A query parameter `max_result_set_size` can be specified to set a
per-request limit, with `-1` meaning all values. If there were more
entries than the max size used for the request, an `incomplete` boolean
is set in the response.
(cherry picked from commit 3cdd07889be5e4e6f21d044cb60fad1face4be08)
* Add semgrep rules
Instrument our security scanner with the ability to use custom semgrep
rules. This is inspired by the HVS teams use of semgrep.
* semgrep: add rule to detect string interpolation in WithInfoMsg
The event.WithInfoMsg function expects a set of key value tuples,
but it can easily be misunderstood to accept string interpolation
arguments. This check will error if any string interpolation verbs are
used in calls to event.WithInfoMsg
The target authorize session endpoint allows for alternative target
identifiers besides the public id. For this to function correctly, the
grpc gateway path definition for the endpoint deviates from the common
pattern used for other endpoints that include ids. When this change was
done, it was not accounted for in the logic used to capture the
prometheus metrics for api requests to this particular endpoint,
resulting in the metrics never incrementing for the authorize session
endpoint.
This fix updates the matching logic used for the metrics to ensure that
the metrics are incremented for this endpoint.
See: c149bc4a79
This commit modifies the credential renewal job to handle a case where the `renewLease` method can
return `nil, nil`. Currently, a panic is caused by usage of the `renewedCred` variable in this scenario.
This commit adds a nil check and returns an error if the `renewedCred` variable is returned as `nil`.
Signed-off-by: David Bond <davidsbond93@gmail.com>
Hugo
Michael Gaffney
Timothy Messier
Irena Rindos
Ryan Derr
Jeff Mitchell
Jim
Johan Brandhorst-Satzkorn
Damian Debkowski
dani
David Bond