Commit Graph
247 Commits
Author SHA1 Message Date
Todd fe5b554370 AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility (#2957)
* AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility
2023-02-13 13:52:25 -08:00
Todd 3461caee41 fix downstream manager test (#2950) 2023-02-13 13:52:00 -08:00
Johan Brandhorst-Satzkorn cf412b95a2 fix: Support streaming HTTP responses (#2956)
* all: Upgrade listenerutil dependency

The new listenerutil implements http.Flusher, which is necessary
for streaming responses from the grpc-gateway to work.

* daemon/controller: Remove newline delimiter in streaming responses

The default gRPC-Gateway HTTPBody marshaler uses newlines
as a delimiter. This introduces newlines in our streamed responses.
Wrapping the default marshaler lets us define a nil delimiter, which
ensures our streaming responses are unaffected by the server side
chunking.
2023-02-13 14:56:53 -05:00
Todd 1e89be1b1a Downstream worker connections are tracked by worker id (#2949)
When possible downstream workers will include their worker id information in
the connections they establish with the upstream using the nodeenrollment
library.  The tracking listener now tracks connections that are connected in
this same way instead of just connections of type *tls.Conn.
2023-02-10 15:27:42 -08:00
Eng Zer Jun 6403b0f389 test: use t.TempDir to create temporary test directory (#2922)
This commit replaces `os.MkdirTemp` with `t.TempDir` in tests. The
directory created by `t.TempDir` is automatically removed when the test
and all its subtests [complete.

Prior to this commit, temporary directory created using `os.MkdirTemp`
needs to be removed manually by calling `os.RemoveAll`, which is omitted
in some tests. The error handling boilerplate e.g.
	defer func() {
		if err := os.RemoveAll(dir); err != nil {
			t.Fatal(err)
		}
	}
is also tedious, but `t.TempDir` handles this for us nicely.

Reference: https://pkg.go.dev/testing#T.TempDir

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2023-02-07 16:23:30 -05:00
Damian Debkowski cabe362534 fix(handler): return targetId as hostId for cli edge case support (#2920) 2023-02-07 10:14:01 -08:00
Jeff Mitchell 1e9057d8a3 Update KMS references 2023-02-06 18:23:54 -05:00
Damian Debkowski 84b410974b fix(handlers): return error when updating json cred w/ empty obj (#2903)
* fix(handlers): return error when updating json cred w/ empty obj

* chore(handlers): split cond stmt & refactor func name
2023-02-06 08:20:12 -08:00
Timothy Messier e25b0e7888 fix(credentiallibraries): Fallback logic to support 0.11.x cli (#2910) 2023-02-06 11:00:34 -05:00
Johan Brandhorst-Satzkorn 3c29308673 chore: Add license headers to all files 2023-02-03 15:54:27 -08:00
Timothy Messier 718e183a1e fix(credentiallibraries): Correctly populate attrs for vault-generic (#2901) 2023-02-03 14:21:08 -05:00
Irena Rindos 4114b41527 Filter managed workers from egress workers when the host address is unsafe (#2899) 2023-02-03 11:40:41 -05:00
Hugo e455e31f9e fix(target): Incorrectly allowing whitespace on Target's address field (#2862) 2023-02-02 10:51:39 -08:00
Timothy Messier 12a53bbfa9 feat(target): Allow vault ssh cert library as credential source
This allows the new vault ssh certificate credential library to be used
as an injected application credential source.
2023-02-02 17:43:17 +00:00
Timothy Messier 1aaaf4af1d feat(controller): Translate ssh certificate credentials for worker 2023-02-02 17:43:17 +00:00
Haotian 43f0ba89cf feat(credentiallibraries): support vault ssh certificates 2023-02-02 17:43:16 +00:00
Todd d8aea569c5 Only return live workers in ListHcpbWorkersResponse (#2876) 2023-02-01 10:24:56 -08:00
Irena Rindos a030c15403 Support HCPBInt in hcpb_cluster_id field (#2880)
* initial commit
2023-02-01 13:20:07 -05:00
Johan Brandhorst-Satzkorn 55259029f1 Add job run cleaner (#2866)
* chore: remove duplicate import

* feat: Add job run cleaner

The new job cleans job runs older than a configured interval.
Configure the job to clean jobs older than 1 minute.
2023-01-31 20:41:33 -05:00
Irena Rindos ed9f2b2730 bug(workers): Check initial upstreams for an HCBP environment (#2869) 2023-01-31 15:53:11 -05:00
Jeff MitchellandJohan Brandhorst-Satzkorn 19180af0eb Fix target port handling (#2846)
* Fix target port handling

This fixes two issues that compounded on each other (see the Changelog
update for more information):

* The verification logic for hosts was not correct for update operations
(in multiple ways) which meant that a host could be updated after
creation to have a port. Targets had a previously fixed bug where they
did not require a default port, which meant that ports could be used
from hosts
* A recent (unreleased) change had prioritized any port coming from the
host over the default port, which would mean there was no way if a
host had a port specified to use it in multiple targets.

This fixes the update verification logic, and strikes a middle ground
between breaking things and not by allowing existing addresses with
ports to be used with targets but ignoring that port, instead requiring
targets to have default port set at authorize time (currently there is
backwards compat that does not require this due to the original optional
port bug).

* Update CHANGELOG.md

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
2023-01-26 13:35:29 -05:00
Irena Rindos 00a73f64d9 bug(sessions): Fix authorizeSession race conditions in handleProxy (#2795)
* initial commit
2023-01-24 09:24:03 -05:00
Todd d66b92abe0 Add directly connected downstream workers to the worker resource api (#2831) 2023-01-23 11:45:09 -08:00
Todd 87b09d5e27 Rename router to receiver for secondary connections (#2816) 2023-01-20 10:43:57 -08:00
Todd b359561e51 Filter WorkerList by feature and go from version string to version.Info (#2807) 2023-01-19 14:39:49 -08:00
Jim e64163ad1d fix (controller): prevent panic when controller stops when there's no listener (#2793) 2023-01-18 16:46:45 -05:00
Todd bc409bc7d4 Graceful shutdown blocks on running proxy handler connections (#2789) 2023-01-17 08:54:01 -08:00
Todd 38b74ce897 Provide a worker decryption function to proxy handlers (#2784) 2023-01-12 13:16:36 -08:00
Todd 0b87acb896 Always call PostConnectionHook in dialer and fix Dial bug (#2783) 2023-01-12 11:04:16 -08:00
Irena Rindos bb281e494f Fix status NPE if worker has been sitting waiting for registration (#2781) 2023-01-12 12:02:08 -05:00
Irena Rindos 5d5dc7524c update dial function doc to include options (#2776) 2023-01-11 13:26:37 -05:00
Irena Rindos d3d1fa0b55 initial commit (#2768) 2023-01-10 08:10:54 -05:00
Irena Rindos beb97ac9f2 SSH Proxy support (#2736)
* initial commit
2023-01-09 13:43:02 -05:00
Hugo 1fb960575f Merge pull request #2613 from hashicorp/llb-target-address
Assign a Network Address to a Target
2023-01-09 18:35:19 +00:00
Irena Rindos a403b3904c initial commit (#2735) 2023-01-09 12:35:13 -05:00
Hugo Vieira f85da3ee2b feat(cmd): Create target using address on boundary dev / database init
Creates a target using an address for boundary dev and when first
init-ing boundary (boundary database init).

It also makes this newly created target the default one
(ttcp_1234567890). The target using host sources is now a secondary
target (ttcp_0987654321).
2023-01-09 15:39:55 +00:00
Damian Debkowski 1d3930a711 feat(handlers): Support address field on a Target 2023-01-09 15:39:55 +00:00
Johan Brandhorst-SatzkornandJeff Mitchell 61c90c5623 Add grant parsing fuzz test (#2534)
* testing(perms): Add Parse fuzz test

I ran this for a few minutes and it didn't discover anything catastrophic.

* Add roundtrip tests

* Fix invalid unicode parsing, empty output fields

* Do the unicode conversion once on input

* Remove incorrect fix for empty output fields

* Allow empty output_fields

This is the same behavior as output_fields=,

* Add tests back, make JSON behaviour consistent

* Rework the output fields mechanism to fix some bugs such as properly handling no fields

* Change signature of Fields

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
2023-01-06 18:27:19 -05:00
Irena Rindos 9135cc7668 In absence of ingress filter, use directly connected worker (#2757)
* directly connected ingress filtering
2023-01-05 12:09:31 -05:00
Irena Rindos 24bbf57a19 AuthorizeConnection with filters (#2734)
* AuthorizeConnection with filters
2023-01-04 11:24:09 -05:00
Irena Rindos 7db9fc59ce Expose State() *structpb.Struct interface through the metric connection trackers 2022-12-23 08:14:58 -05:00
Irena Rindos 5c73e43912 revert 2712 (#2713) 2022-12-13 14:25:40 -05:00
Irena Rindos a135127524 Move dialingListener setAddresses 2022-12-13 13:29:14 -05:00
Irena Rindos 173e1587d0 Append initial worker upstreams if current upstreams are unresponsive (#2698)
* Append initial worker upstreams if current upstreams are unresponsive
2022-12-12 13:48:28 -05:00
Todd 7a6983c463 Fix wrapped reverse grpc listener (#2702) 2022-12-12 10:27:31 -08:00
Haotian 340cfb0d88 refactor(metric): adds filter function to collector init method (#2695) 2022-12-12 09:12:33 -08:00
Todd a0600138fa Fix wrapped reverse grpc listener (#2687) 2022-12-06 16:17:13 -08:00
Todd b6c0ccc1e8 Refactor proxy handler to separate connection and protocol handling (#2678) 2022-12-06 11:44:00 -08:00
Haotian fbd0a8272b feat(metric): adds accepted/closed connections counters to worker and controller servers (#2668)
* adds counters and changelog entry
2022-12-06 10:13:44 -08:00
Irena Rindos 5b162a4433 add worker version to network graph (#2672)
* add worker version to network graph
2022-12-02 12:36:10 -05:00