79 Commits (deeac5c457e86c6c2bf6db50f00a385ecbf4a360)

Author	SHA1	Message	Date
Johan Brandhorst-Satzkorn	ec0a3f964b	Worker status refactor (#5417) ... * oss: feat(proto): statistics rpc added to server coordination service * oss: feat(session): add update statistics status service * oss: feat(handlers): add Statistics method to worker service server * oss: feat(worker): add statistics ticking * oss: internal/proto: define the new RoutingInfo RPC * oss: internal/server: repository changes for RoutingInfo RPC * oss: internal/daemon: add RoutingInfo handler to worker service The new RoutingInfo RPC is used to get information from the worker that is used to make routing decisions on the controller. It also handles the initial request from the worker. * oss: feat(db): server_worker_session_info table * oss: feat(proto): session info rpc for server coordination service * oss: feat(server): worker session info request data type * oss: feat(worker): session info ticker * oss: feat(handler): server coordination handler for session info * oss: feat(session): utilize session info request time for session cleanup * oss: proto: fix some gotags comments Some of these fields were missing comments, while others had incorrectly formatted comments. * oss: worker: send connection status to server This is required for the correct tracking of orphaned connections * oss: internal/daemon/worker: add function to wait for Statistics RPC * oss: internal/daemon/worker: add routing info RPC The new RoutingInfo RPC replaces part of the Status RPC, namely the part which is used by the controller and worker to perform decisions around the establishment of new sessions and new worker connections. * oss: internal/daemon/worker: remove unnecessary error check * oss: internal/daemon/worker: lock access to config and upstreams The new confLock protects access to the conf value and to the addressReceivers slice. * oss: worker: replace Status RPC with RoutingInfo * oss: worker: deprecate the Status RPC and related types The Status RPC and related messages have been replaced by the RoutingInfo/SessionInfo/Statistics RPCs. The controller will continue to support the Status RPC until two new minor versions have been released. * oss: internal/event: add default deny for new worker RPCs * oss: internal/daemon/worker: allow RPC interval to be set The new SessionInfo/RoutingInfo/Statistics RPCs run at long intervals, which make some of our cluster tests take a long time to complete. This allows their interval to be configured in tests. * oss: all: use TestWorkerRPCInterval in slow tests This should speed up these tests significantly. * oss: internal/tests/cluster: reset sys eventer in test --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Jim	28b465e4b8	refact: to use go-dbw CreateItems, DeleteItems (#4974) ... * refact: to use go-dbw CreateItems, DeleteItems Latest version of go-dbw updated the signature of CreateItems(...) and DeleteItems(...) on a happy note this latest version of go-dbw actually does batch inserts and updates for this functions. * all: regenerate protos with new protoc-gen-go version	2 years ago
Damian Debkowski	88c67e4eea	feat(proto): define storage bucket state in worker status	2 years ago
Elim Tsiagbey	f483d1417c	feat: Update Proto Definition for Local Storage State ... Update `ServerWorkerStatus` Proto Definition to include Local Storage State	2 years ago
Michael Li	9eb608feeb	chore: Update protobuf to 1.33 (#4485) ... Release: https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.33.0 CVE: https://nvd.nist.gov/vuln/detail/CVE-2024-24786	2 years ago
Johan Brandhorst-Satzkorn	d9c6de4e8b	deps: update runc dependency (#4349) ... Fixes GHSA-xr7r-f8xq-vfvv	2 years ago
Jeff Mitchell	de4ce93931	Update main module deps (#3971)	2 years ago
Sepehr	14af8e8cd7	observation tags proto messages	3 years ago
Jim	d5411a26f6	chore: update protobuf dep (#3669)	3 years ago
hashicorp-copywrite[bot]	29da0bcb92	[COMPLIANCE] License changes (#3567) ... * Adding explicit MPL license for sub-package. This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * Update copyright file headers to BUS-1.1 * Rerun make gen This will pick up the last of the license changes * Revert "Rerun make gen" This reverts commit dbe0968bff. * Remove copywrite from generation script The current version of copywrite is not sophisticated enough to only apply the copywrite changes to certain subdirectories, so to avoid accidentally relicensing our api and sdk modules, we will stop running the copywrite script until such time that it can do the right thing. * License protobuf API as MPL The protobuf API files are used to generate the SDK, since we want the SDK to be MPL, the protobuf files must also be MPL. This extends to all protobuf files whose sources end up in the SDK directory, including: - internal/proto/controller/api - internal/proto/controller/custom_options - internal/proto/plugin It also includes the generated service directory in internal/gen/controller/api/services, since they are generated from the protobuf sources used for the SDK. * Change website license file name This makes the naming scheme consistent with the rest of the repository. * Add note on licensing to README * Set copywrite license to BUSL * Revert "Add note on licensing to README" This reverts commit 4d865a91a7. --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Todd	bc48f2d0e0	Add monitor session job proto and controller changes ... This adds a new Job type that is for generic session state monitoring. Monitoring sessions does not include any information about specific connections.	3 years ago
Todd	4c801cca18	update the recording msg type enums	3 years ago
Todd	dbe3473874	Add CreateChannel enum for upstream message handler	3 years ago
Todd	68dc4da50e	Add CloseConnectionRecording enums to the upstream message service	3 years ago
Jim	b9cc441227	feature (handlers): add UpstreamMessageService and its oss impl. ... Define OSS protos for UpstreamMessageService rpc which defines a way to send an upstream message to a controller (across multi-hops if needed). Implement OSS versions of both workers and controllers for the UpstreamMessageService. The upstream requests/responses are encrypted using the originating worker's NodeCredential's key. The worker always forwards the request upstream. The controller attends to find a registered UpstreamMessageHandler to handle the msg; if none if found, then an Unimplemented status error is returned.	3 years ago
Jim	63a2b62b85	chore (deps): update GKW and protobuf; and run "make gen" (#3111)	3 years ago
Todd	fe5b554370	AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility (#2957) ... * AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility	3 years ago
Todd	1e89be1b1a	Downstream worker connections are tracked by worker id (#2949) ... When possible downstream workers will include their worker id information in the connections they establish with the upstream using the nodeenrollment library. The tracking listener now tracks connections that are connected in this same way instead of just connections of type *tls.Conn.	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Timothy Messier	1aaaf4af1d	feat(controller): Translate ssh certificate credentials for worker	3 years ago
Irena Rindos	24bbf57a19	AuthorizeConnection with filters (#2734) ... * AuthorizeConnection with filters	3 years ago
Todd	b6c0ccc1e8	Refactor proxy handler to separate connection and protocol handling (#2678)	3 years ago
Todd	2a4ce02de6	Disconnect PKI workers from upstreams when they are no longer authorized (#2515)	3 years ago
Hugo Vieira	d206635d74	fix(connection): Make bytes up and down a signed 64-bit integer ... This fixes a theoretical issue with database interaction. Because the fields in the database are signed 64-bit integers, it's theoretically possible to overflow them if we're using unsigned 64-bit integers in the application code.	3 years ago
Hugo Vieira	c81398cbf3	feat(worker): Report bytes up and down on Status updates ... With this commit, the Worker now sends BytesUp and BytesDown for each of the connections it handles to the Controller in the Status request. The Controller then persists these fields to the database. There is also a new trigger to prevent bytes_up and bytes_down to change after a connection has been closed, as the last update to a session_connection row should be the one that is performed as part of the connection closure process.	3 years ago
Louis Ruch	b7684a857a	feat(ssh): Use HostId as HostKeyAlias for connect ssh helper (#2490)	4 years ago
Irena Rindos	fc0ead73e6	feat(workers): worker operational state (#2427) ... * feat(workers): worker operational state	4 years ago
Irena Rindos	18dff62b7b	Merge BYOW GA branch to main (#2398) ... * feat(workers): Add ability to read and reinitialize cert authority (#2312) * feat(workers): Return Release Version on worker list and read (#2377) * feat(cli): Read and reinitialize worker certificate authority (#2387)	4 years ago
Johan Brandhorst-Satzkorn	aef9073fa6	Upgrade to Go 1.19 (#2347)	4 years ago
Johan Brandhorst-Satzkorn	222a935223	Update grpc-gateway dependency (#2311) ... * chore(deps): Update grpc-gateway dependency This fixes an issue which would allow an attacker to trigger a (recovered) panic in the gateway handler. * fix(server): Use cmp.Diff instead of assert.Equal Testify is not great at handling protobuf types, and was for some reason returning a diff here when in reality there is none. Switch to go-cmp for the comparison to remove the error.	4 years ago
Jeff Mitchell	02dd28f587	Add support for SSH private key passphrases (#2331) ... This adds support for encrypted SSH keys via passphrase. Co-authored-by: Louis Ruch <louisruch@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	4 years ago
Louis Ruch	ef5ac07f02	Add ssh_private_key support for Vault libraries and targets (#2263) ... * Add support for ssh_private_key credential type in Vault libraries * Add support for ssh_private_key credential type * Support jsonpointer for Vault library mapping overrides	4 years ago
Jeff Mitchell	fb3b2209e5	Add WithType to worker listing (#2252)	4 years ago
Jeff Mitchell	6b48346bf3	Add managed worker address fetching (#2244)	4 years ago
Todd	155c5f578b	Create session manager for workers to use to interact with sessions (#2235)	4 years ago
Damian Debkowski	3e9c99c217	refactor(user_password) rename all references of user_password to username_password (#2232)	4 years ago
Todd	9af6c09c36	Move generated pb.go file in to the internal/gen directory (#2225)	4 years ago
Todd	19b549c44a	Rename package servers to server (#2222)	4 years ago
Louis Ruch	9671daf6e0	Revert "refactor(user_passsword) change all references of user_password into username_password (#2189)" ... This reverts commit ab58b24142.	4 years ago
Damian Debkowski	ab58b24142	refactor(user_passsword) change all references of user_password into username_password (#2189) ... * (refactor) change all sql references of user_password to username_password * refactor(pkg) renamed pkg userpassword to usernamepassword * refactor(proto) updated protocol buffers to use UsernamePassword * refactor(code) updated references from UserPassword to UsernamePassword in golang files * refactor(test) updated unit tests to reference UsernamePassword changes * refactor(ddtest) updated references in dbtests to use UsernamePassword * chore(sql-test) fixed spelling issue * chore(sql) added and updated comments in migartion & tables. fixed indentations * chore(proto) updated comments to reflect username_password changes * refactor(tests) updated unit tests to replace user-password with username-password * refactor(cmd) updated cmd help text to use username * chore(tests) update test name & comments * fix(cmd) fixed cmd usage definition for credentials update * refactor(tests) removed out of scope changes * fix(sql) incremented sql migration id & updated migration comments	4 years ago
Jim	bd167da7d1	fix (worker): send workerId when authorizing session (#2207) ... * fix (worker): send workerId when authorizing session Send the workerId returned from the last success worker status when authorizing a session. * fixup! fix (worker): send workerId when authorizing session * fixup! fix (worker): send workerId when authorizing session * refactor (worker): deprecate workerId in ActivateSessionRequest It wasn't being used anywho * fixup! fix (worker): send workerId when authorizing session * Update LookupSessionRequest Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Jim	9dde83aea7	feature (byow): classify status msg data (#2181) ... Classifying the data allows it to appropriately included in audit events	4 years ago
irenarindos	16d95262a6	feature(worker): add workerKeyId to status	4 years ago
Haotian	1830605a7e	refact(servers) Update api for new worker and controller server tables (#2101) ... * Discontinue support for old Server message in ServerCoordinationService. Split message into ServerWorkerStatus and UpstreamServer (which currently contains controller addresses). Remove unnecessary fields. Modify workerStatusServer to use new fields. Co-authored-by: Todd <github@quaddi.com>	4 years ago
irenarindos	9e27605213	refact(servers): Split server table into worker and controller	4 years ago
Johan Brandhorst-Satzkorn	f69fbf2255	feat(proto): Format protobuf files with buf (#2033) ... Formats all protobuf files with buf format. This ensures a consistent style across all our protobuf files, similar to gofumpt.	4 years ago
Johan Brandhorst-Satzkorn	b1d6a1da9a	Switch to buf for protobuf generation (#1944) ... * Install buf with go install This reduces the impact of using buf on our dependency closure, which was significant. It also avoids potential issues with building buf given our own internal dependency constraints. This has caused issues (including crashes!) in the past. See https://github.com/cockroachdb/cockroach/issues/67216#issuecomment-874176186 for more discussion on using tool dependencies generally, and https://github.com/bufbuild/buf/issues/52 for an example of where this sort of thing caused an issue for a user. * Upgrade buf version We should migrate to v1 sooner rather than later, as it has some breaking changes from v0. * Change buf lint/breaking commands These commands were moved up one level for v1 * Migrate to buf.yaml to v1 * Remove unused imports These were uncovered by using "buf lint". * Use buf v1.3.1 * Depend on googleapis and grpc-gateway via BSR * Switch to buf for proto generation * Remove third party dependency * Remove unused tools and scripts * Move local protos up one level * Temporarily don't fail on breaking changes * Generate CI config * Fix generation of controller.json * Replace use of deprecated flag * Remove unused import, regenerate files * Remove temporary skipping over breaking check	4 years ago
Louis Ruch	425a56179f	feat(worker): Implement egress credentials ... Egress credentials Issued during AuthorizeSession are stored in the session repo. These credentials are retrieved and stored in-memory on the worker during the LookupSession call. Each proxy handler will need to handle the credentials as required.	4 years ago
Jim	baa1d88f1f	feature: Add client ip to inbound request information (#1678) ... * feature: Add client ip to inbound request information * feature (workers): Add the user's client IP to a session's connection information (#1749)	4 years ago
Jim	048fceaf54	feature (workers): Add audit events for worker requests (#1681) ... * feature (audit events): Add interceptor for auditing worker requests * feature (events): Add default deny filter for worker status events * feature (worker audit events): Add tags to SessionService req/resp	4 years ago