boundary

Commit Graph

Author	SHA1	Message	Date
Jeff Mitchell	483f13226e	Adjust tofu token check	2 years ago
Jeff Mitchell	8e71caa2e3	Address some review feedback	2 years ago
Jeff Mitchell	cb1386932d	Use sdk wspb library and remove internal (#4025 )	2 years ago
Timothy Messier	dd23f6fdbf	Update websocket library (#3908 ) The nhooyr/websocket library now has a release with the new default behavior that removes the message size limit. This allows us to switch off of the fork and back to the upstream. In the same release that includes the fix we need for the boundary client, the wspb helper package was removed from websocket. This package contained some functions to read and write protobuf messages. However, it was using the deprecated github.com/golang/protobuf/proto library. To avoid this dependancy in the library they opted to just remove wspb. Thus this provides a replacement implementation that uses google.golang.org/protobuf/proto. Notably the newer proto library seems to lack an equivalent of proto.NewBuffer so writes to the websocket and not able to leverage a sync.Pool of byte.Buffers to reduce allocations. Refs: `88bb253554` See: `ac385120c6`	2 years ago
Jeff Mitchell	fb4a5a98dc	Add some target fields and move some things around (#3879 ) In preparation for putting proxy code in the api package this creates some necessary fields in the target output and it pre-moves credential parsing and proxy handshake code to their new places. This will make the diff for the actual proxy code move quite a bit smaller. Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Jeff Mitchell	20ac42c851	Add some useful dev flags (#3865 )	3 years ago
Irena Rindos	9733a250fa	refact(event): move observability/event to event (#3704 )	3 years ago
hashicorp-copywrite[bot]	29da0bcb92	[COMPLIANCE] License changes (#3567 ) * Adding explicit MPL license for sub-package. This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * Update copyright file headers to BUS-1.1 * Rerun make gen This will pick up the last of the license changes * Revert "Rerun make gen" This reverts commit `dbe0968bff`. * Remove copywrite from generation script The current version of copywrite is not sophisticated enough to only apply the copywrite changes to certain subdirectories, so to avoid accidentally relicensing our api and sdk modules, we will stop running the copywrite script until such time that it can do the right thing. * License protobuf API as MPL The protobuf API files are used to generate the SDK, since we want the SDK to be MPL, the protobuf files must also be MPL. This extends to all protobuf files whose sources end up in the SDK directory, including: - internal/proto/controller/api - internal/proto/controller/custom_options - internal/proto/plugin It also includes the generated service directory in internal/gen/controller/api/services, since they are generated from the protobuf sources used for the SDK. * Change website license file name This makes the naming scheme consistent with the rest of the repository. * Add note on licensing to README * Set copywrite license to BUSL * Revert "Add note on licensing to README" This reverts commit `4d865a91a7`. --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Todd	fb1ea92a30	Pass both the control and data context into handle	3 years ago
Todd	feb87e717e	Add Closed error code and rename recorder cache to manager	3 years ago
Todd	bd2bca987d	Add the first iteration of the recorder cache and wire it in	3 years ago
Jeff Mitchell	163ce184b8	KMS-PKI Workers (#3101 ) This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.	3 years ago
Jeff Mitchell	b76b24a4ad	Move prefixes for many packages into the globals package (#3069 ) This is a prerequisite for some enhancements to grant validation	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Todd	87b09d5e27	Rename router to receiver for secondary connections (#2816 )	3 years ago
Todd	bc409bc7d4	Graceful shutdown blocks on running proxy handler connections (#2789 )	3 years ago
Todd	38b74ce897	Provide a worker decryption function to proxy handlers (#2784 )	3 years ago
Irena Rindos	d3d1fa0b55	initial commit (#2768 )	3 years ago
Irena Rindos	beb97ac9f2	SSH Proxy support (#2736 ) * initial commit	3 years ago
Irena Rindos	a403b3904c	initial commit (#2735 )	3 years ago
Todd	b6c0ccc1e8	Refactor proxy handler to separate connection and protocol handling (#2678 )	3 years ago
Hugo	f023f05c11	feat(worker): Report bytes up/down on Worker connection closure Introduces data about bytes read and written to the connection close payload. No changes are required in the Controller because the RPC messages already contained the required fields. As of this commit, bytes_up and bytes_down columns in the session_connection table are now populated when a connection closes. Refs: #2509	4 years ago
Hugo	1bb80624b8	feat(worker): net.Conn implementation to count Bytes Read and Written This commit introduces a new net.Conn implementation (countingConn) that will keep track of bytes read and written for a particular client connection. This is then implemented into the worker code using interface composition. Refs: #2501	4 years ago
Louis Ruch	50490d71ae	chore(targets): Improve help and errors around ssh targets (#2445 )	4 years ago
Louis Ruch	a17e973712	feat(credentials): Refactor credential purposes (#2260 ) * feat(credentials): Refactor credential purposes * Application credentials have been refactored to Brokered credentials * Egress credentials have been refactored to Injected Application credentials Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Todd	155c5f578b	Create session manager for workers to use to interact with sessions (#2235 )	4 years ago
Jeff Mitchell	f5bf3b2c0c	Add events on session activation and connection authz/close (#2215 ) * Add events on session activation and connection authz/close * Only send success event on actual success	4 years ago
Jim	bd167da7d1	fix (worker): send workerId when authorizing session (#2207 ) * fix (worker): send workerId when authorizing session Send the workerId returned from the last success worker status when authorizing a session. * fixup! fix (worker): send workerId when authorizing session * fixup! fix (worker): send workerId when authorizing session * refactor (worker): deprecate workerId in ActivateSessionRequest It wasn't being used anywho * fixup! fix (worker): send workerId when authorizing session * Update LookupSessionRequest Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Todd	b58dada40d	Move the server daemons into their own package (#2061 ) * Move the server daemons into their own package With this change the internal/server package now is dedicated to the server domain (workers and controllers) and not to the server daemons. The hope is that this will make it easier to keep the daemons decoupled from the representation of the servers in the database.	4 years ago

29 Commits (b24f6dcee825caf59cd484fbf6edfeb4cab72e75)