Commit Graph
241 Commits
Author SHA1 Message Date
Jeff Mitchell 1e9057d8a3 Update KMS references 2023-02-06 18:23:54 -05:00
Damian Debkowski 84b410974b fix(handlers): return error when updating json cred w/ empty obj (#2903)
* fix(handlers): return error when updating json cred w/ empty obj

* chore(handlers): split cond stmt & refactor func name
2023-02-06 08:20:12 -08:00
Timothy Messier e25b0e7888 fix(credentiallibraries): Fallback logic to support 0.11.x cli (#2910) 2023-02-06 11:00:34 -05:00
Johan Brandhorst-Satzkorn 3c29308673 chore: Add license headers to all files 2023-02-03 15:54:27 -08:00
Timothy Messier 718e183a1e fix(credentiallibraries): Correctly populate attrs for vault-generic (#2901) 2023-02-03 14:21:08 -05:00
Irena Rindos 4114b41527 Filter managed workers from egress workers when the host address is unsafe (#2899) 2023-02-03 11:40:41 -05:00
Hugo e455e31f9e fix(target): Incorrectly allowing whitespace on Target's address field (#2862) 2023-02-02 10:51:39 -08:00
Timothy Messier 12a53bbfa9 feat(target): Allow vault ssh cert library as credential source
This allows the new vault ssh certificate credential library to be used
as an injected application credential source.
2023-02-02 17:43:17 +00:00
Timothy Messier 1aaaf4af1d feat(controller): Translate ssh certificate credentials for worker 2023-02-02 17:43:17 +00:00
Haotian 43f0ba89cf feat(credentiallibraries): support vault ssh certificates 2023-02-02 17:43:16 +00:00
Todd d8aea569c5 Only return live workers in ListHcpbWorkersResponse (#2876) 2023-02-01 10:24:56 -08:00
Irena Rindos a030c15403 Support HCPBInt in hcpb_cluster_id field (#2880)
* initial commit
2023-02-01 13:20:07 -05:00
Johan Brandhorst-Satzkorn 55259029f1 Add job run cleaner (#2866)
* chore: remove duplicate import

* feat: Add job run cleaner

The new job cleans job runs older than a configured interval.
Configure the job to clean jobs older than 1 minute.
2023-01-31 20:41:33 -05:00
Irena Rindos ed9f2b2730 bug(workers): Check initial upstreams for an HCBP environment (#2869) 2023-01-31 15:53:11 -05:00
Jeff MitchellandJohan Brandhorst-Satzkorn 19180af0eb Fix target port handling (#2846)
* Fix target port handling

This fixes two issues that compounded on each other (see the Changelog
update for more information):

* The verification logic for hosts was not correct for update operations
(in multiple ways) which meant that a host could be updated after
creation to have a port. Targets had a previously fixed bug where they
did not require a default port, which meant that ports could be used
from hosts
* A recent (unreleased) change had prioritized any port coming from the
host over the default port, which would mean there was no way if a
host had a port specified to use it in multiple targets.

This fixes the update verification logic, and strikes a middle ground
between breaking things and not by allowing existing addresses with
ports to be used with targets but ignoring that port, instead requiring
targets to have default port set at authorize time (currently there is
backwards compat that does not require this due to the original optional
port bug).

* Update CHANGELOG.md

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
2023-01-26 13:35:29 -05:00
Irena Rindos 00a73f64d9 bug(sessions): Fix authorizeSession race conditions in handleProxy (#2795)
* initial commit
2023-01-24 09:24:03 -05:00
Todd d66b92abe0 Add directly connected downstream workers to the worker resource api (#2831) 2023-01-23 11:45:09 -08:00
Todd 87b09d5e27 Rename router to receiver for secondary connections (#2816) 2023-01-20 10:43:57 -08:00
Todd b359561e51 Filter WorkerList by feature and go from version string to version.Info (#2807) 2023-01-19 14:39:49 -08:00
Jim e64163ad1d fix (controller): prevent panic when controller stops when there's no listener (#2793) 2023-01-18 16:46:45 -05:00
Todd bc409bc7d4 Graceful shutdown blocks on running proxy handler connections (#2789) 2023-01-17 08:54:01 -08:00
Todd 38b74ce897 Provide a worker decryption function to proxy handlers (#2784) 2023-01-12 13:16:36 -08:00
Todd 0b87acb896 Always call PostConnectionHook in dialer and fix Dial bug (#2783) 2023-01-12 11:04:16 -08:00
Irena Rindos bb281e494f Fix status NPE if worker has been sitting waiting for registration (#2781) 2023-01-12 12:02:08 -05:00
Irena Rindos 5d5dc7524c update dial function doc to include options (#2776) 2023-01-11 13:26:37 -05:00
Irena Rindos d3d1fa0b55 initial commit (#2768) 2023-01-10 08:10:54 -05:00
Irena Rindos beb97ac9f2 SSH Proxy support (#2736)
* initial commit
2023-01-09 13:43:02 -05:00
Hugo 1fb960575f Merge pull request #2613 from hashicorp/llb-target-address
Assign a Network Address to a Target
2023-01-09 18:35:19 +00:00
Irena Rindos a403b3904c initial commit (#2735) 2023-01-09 12:35:13 -05:00
Hugo Vieira f85da3ee2b feat(cmd): Create target using address on boundary dev / database init
Creates a target using an address for boundary dev and when first
init-ing boundary (boundary database init).

It also makes this newly created target the default one
(ttcp_1234567890). The target using host sources is now a secondary
target (ttcp_0987654321).
2023-01-09 15:39:55 +00:00
Damian Debkowski 1d3930a711 feat(handlers): Support address field on a Target 2023-01-09 15:39:55 +00:00
Johan Brandhorst-SatzkornandJeff Mitchell 61c90c5623 Add grant parsing fuzz test (#2534)
* testing(perms): Add Parse fuzz test

I ran this for a few minutes and it didn't discover anything catastrophic.

* Add roundtrip tests

* Fix invalid unicode parsing, empty output fields

* Do the unicode conversion once on input

* Remove incorrect fix for empty output fields

* Allow empty output_fields

This is the same behavior as output_fields=,

* Add tests back, make JSON behaviour consistent

* Rework the output fields mechanism to fix some bugs such as properly handling no fields

* Change signature of Fields

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
2023-01-06 18:27:19 -05:00
Irena Rindos 9135cc7668 In absence of ingress filter, use directly connected worker (#2757)
* directly connected ingress filtering
2023-01-05 12:09:31 -05:00
Irena Rindos 24bbf57a19 AuthorizeConnection with filters (#2734)
* AuthorizeConnection with filters
2023-01-04 11:24:09 -05:00
Irena Rindos 7db9fc59ce Expose State() *structpb.Struct interface through the metric connection trackers 2022-12-23 08:14:58 -05:00
Irena Rindos 5c73e43912 revert 2712 (#2713) 2022-12-13 14:25:40 -05:00
Irena Rindos a135127524 Move dialingListener setAddresses 2022-12-13 13:29:14 -05:00
Irena Rindos 173e1587d0 Append initial worker upstreams if current upstreams are unresponsive (#2698)
* Append initial worker upstreams if current upstreams are unresponsive
2022-12-12 13:48:28 -05:00
Todd 7a6983c463 Fix wrapped reverse grpc listener (#2702) 2022-12-12 10:27:31 -08:00
Haotian 340cfb0d88 refactor(metric): adds filter function to collector init method (#2695) 2022-12-12 09:12:33 -08:00
Todd a0600138fa Fix wrapped reverse grpc listener (#2687) 2022-12-06 16:17:13 -08:00
Todd b6c0ccc1e8 Refactor proxy handler to separate connection and protocol handling (#2678) 2022-12-06 11:44:00 -08:00
Haotian fbd0a8272b feat(metric): adds accepted/closed connections counters to worker and controller servers (#2668)
* adds counters and changelog entry
2022-12-06 10:13:44 -08:00
Irena Rindos 5b162a4433 add worker version to network graph (#2672)
* add worker version to network graph
2022-12-02 12:36:10 -05:00
Danielle 5f8d292ea1 Inject Custom Response Headers By Status (#2587)
* add custom ResponseWriter struct to inject custom response headers based on status code

* docs

* upgrade listenerutil

* fix config tests

* replace all instances of "data:*" with "data:" to reflect changes to listenerutil

* swapping strings.HasPrefix in favor of mux.Handler for ui request matching

* set ui path as const

* add custom response headers to changelog
2022-12-01 13:15:53 -05:00
Irena Rindos 834a2a88f7 feat(targets): Addition of egress and ingress worker filters (#2654)
* feat(targets): Addition of egress and ingress worker filters
2022-11-30 15:23:37 -05:00
Haotian 2b84013379 Revert " feat(metric): adds accepted/closed connections counters for controller and worker cluster connections (#2656)" for failing a build test (#2660)
This reverts commit 80f72b8511.
2022-11-29 10:22:53 -08:00
Haotian 80f72b8511 feat(metric): adds accepted/closed connections counters for controller and worker cluster connections (#2656)
same contents as PR https://github.com/hashicorp/boundary/pull/2593 but this time actually push to main
2022-11-28 17:35:16 -08:00
Johan Brandhorst-Satzkorn 8908dccf6d Forward port some release fixes (#2631)
* fix(worker): Verify contents of loaded session (#2629)

* fix(worker): Verify contents of loaded session

Previously, it was possible for an empty private key to be used
when the session had no user or project associated with it.
The new checks guarantee that we will fail gracefully in these
cases.

* Check against len instead of nil

* Add CHANGELOG

* fix(session): Always invoke all parts of session cancel trigger

The session cancelation trigger would not set the key_id to null
appropriately if another one of the fields on the session was
already null, since that case statement would be matched first.
The new structure matches all statements, in case any of them have
special logic (such as in the project case).
2022-11-17 18:21:20 -05:00
Irena Rindos 70e20b5cf5 revert merge llb-multihop-sessions (#2628) 2022-11-17 14:51:29 -05:00