Jeff Mitchell
1782f6a4e4
This stores worker connection nonces within the database to ensure uniqueness of connections. Prior the connection required any attacker to be able to decrypt the incoming encrypted authentication message in order to replay (and if the attacker has access to the KMS you have bigger problems), but with this change even if an attacker does have access to the KMS key, they cannot reuse the same message. (If they're able to encrypt against the KMS key, they can still act as a worker with a new message, so this only really helps if they only have decryption capabilities.)
38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
package globals
|
|
|
|
import "time"
|
|
|
|
const (
|
|
TcpProxyV1 = "boundary-tcp-proxy-v1"
|
|
ServiceTokenV1 = "s1"
|
|
)
|
|
|
|
type (
|
|
ContextMaxRequestSizeType struct{}
|
|
ContextOriginalRequestPathType struct{}
|
|
)
|
|
|
|
var (
|
|
// DefaultMaxRequestDuration is the amount of time we'll wait for a request
|
|
DefaultMaxRequestDuration = 90 * time.Second
|
|
|
|
// DefaultMaxRequestSize is the maximum size of a request we allow by default
|
|
DefaultMaxRequestSize = int64(1024 * 1024)
|
|
|
|
// ContextMaxRequestSizeTypeKey is a value to keep linters from complaining
|
|
// about clashing string identifiers
|
|
ContextMaxRequestSizeTypeKey ContextMaxRequestSizeType
|
|
|
|
// ContextOriginalRequestPathTypeKey is a value to keep linters from complaining
|
|
// about clashing string identifiers
|
|
ContextOriginalRequestPathTypeKey ContextOriginalRequestPathType
|
|
|
|
// RecoveryTokenValidityPeriod is exported so we can modify it in tests if
|
|
// we want
|
|
RecoveryTokenValidityPeriod = 5 * time.Minute
|
|
|
|
// WorkerAuthNonceValidityPeriod is exported so we can modify it in tests if
|
|
// we want
|
|
WorkerAuthNonceValidityPeriod = 2 * time.Minute
|
|
)
|