mirror of
https://github.com/openziti/ziti.git
synced 2026-10-26 13:39:58 +00:00
8415a7dbf6
* The controller and the router wrote the complete service session token, an OIDC service session JWT or a legacy session token, into structured log fields during edge control operations. Several of the sites logged at Error or Info, so the values reached logs at default verbosity during ordinary operation. * Adds LoggingFields to the session and api session types in common, controller/model and router/state, so a logging site asks for the session fields or the api session fields instead of picking values by hand. Ids, type, identity, service and the token's validity window go in; the token does not. Empty values are dropped, so the sets merge over each other. * AddLoggingFields in router/state now delegates to LoggingFields. Its output moves from a nested field to flat prefixed keys. * The edge control handlers log the session field set on the shared returnError and logResult paths, on circuit setup and on terminator update. The terminator removal paths log the terminator id, since they never load a session. * Adds unit tests over returnError and logResult that fail if a session token reaches a log entry, covering the loaded-session, failed-to-load and JWT-claims cases.
143 lines
4.3 KiB
Go
143 lines
4.3 KiB
Go
/*
|
|
Copyright NetFoundry Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package handler_edge_ctrl
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/michaelquigley/pfxlog"
|
|
"github.com/openziti/channel/v5"
|
|
"github.com/openziti/sdk-golang/v2/ziti/edge"
|
|
"github.com/openziti/ziti/v2/common/pb/edge_ctrl_pb"
|
|
"github.com/openziti/ziti/v2/controller/db"
|
|
"github.com/openziti/ziti/v2/controller/env"
|
|
"github.com/openziti/ziti/v2/controller/model"
|
|
"google.golang.org/protobuf/proto"
|
|
)
|
|
|
|
type createCircuitHandler struct {
|
|
baseRequestHandler
|
|
}
|
|
|
|
func NewCreateCircuitHandler(appEnv *env.AppEnv, ch channel.Channel) channel.ContentTypeReceiver {
|
|
handler := &createCircuitHandler{
|
|
baseRequestHandler: baseRequestHandler{
|
|
ch: ch,
|
|
appEnv: appEnv,
|
|
},
|
|
}
|
|
return &channel.AsyncFunctionReceiveAdapter{
|
|
Type: int32(edge_ctrl_pb.ContentType_CreateCircuitRequestType),
|
|
Handler: handler.HandleReceiveCreateCircuitV1,
|
|
}
|
|
}
|
|
|
|
func (self *createCircuitHandler) Label() string {
|
|
return "create.circuit"
|
|
}
|
|
|
|
func (self *createCircuitHandler) HandleReceiveCreateCircuitV1(msg *channel.Message, ch channel.Channel) {
|
|
req := &edge_ctrl_pb.CreateCircuitRequest{}
|
|
if err := proto.Unmarshal(msg.Body, req); err != nil {
|
|
pfxlog.ContextLogger(ch.Label()).WithError(err).Error("could not unmarshal CreateCircuitRequest")
|
|
return
|
|
}
|
|
|
|
ctx := &CreateCircuitRequestContext{
|
|
baseSessionRequestContext: baseSessionRequestContext{handler: self, msg: msg, env: self.appEnv},
|
|
req: req,
|
|
}
|
|
|
|
self.CreateCircuit(ctx, self.CreateCircuitV1Response)
|
|
}
|
|
|
|
func (self *createCircuitHandler) CreateCircuitV1Response(circuitInfo *model.Circuit, peerData map[uint32][]byte) (*channel.Message, error) {
|
|
response := &edge_ctrl_pb.CreateCircuitResponse{
|
|
CircuitId: circuitInfo.Id,
|
|
Address: circuitInfo.Path.IngressId,
|
|
PeerData: peerData,
|
|
Tags: circuitInfo.Tags,
|
|
}
|
|
|
|
body, err := proto.Marshal(response)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to marshal protobuf create circuit response (%w)", err)
|
|
}
|
|
responseMsg := channel.NewMessage(response.GetContentType(), body)
|
|
return responseMsg, nil
|
|
}
|
|
|
|
func (self *createCircuitHandler) CreateCircuit(ctx *CreateCircuitRequestContext, f createCircuitResponseFactory) {
|
|
if !ctx.loadRouter() {
|
|
return
|
|
}
|
|
ctx.loadSession(ctx.req.GetSessionToken(), ctx.req.GetApiSessionToken())
|
|
ctx.checkSessionType(db.SessionTypeDial)
|
|
ctx.verifyIdentityEdgeRouterAccess()
|
|
ctx.loadService()
|
|
circuitInfo, peerData := ctx.createCircuit(ctx.req.GetTerminatorInstanceId(), ctx.req.GetPeerData(), ctx.newCircuitCreateParms)
|
|
|
|
if ctx.err != nil {
|
|
if circuitInfo != nil {
|
|
ctx.errRespF = func(resp *channel.Message) {
|
|
resp.PutStringHeader(edge.CircuitIdHeader, circuitInfo.Id)
|
|
}
|
|
}
|
|
self.returnError(ctx, ctx.err)
|
|
return
|
|
}
|
|
|
|
log := pfxlog.ContextLogger(self.ch.Label()).WithFields(ctx.sessionLoggingFields())
|
|
responseMsg, err := f(circuitInfo, peerData)
|
|
if err != nil {
|
|
log.WithError(err).Error("error generating create circuit response")
|
|
}
|
|
log.Debugf("responding with successful circuit setup")
|
|
|
|
responseMsg.ReplyTo(ctx.msg)
|
|
if err = self.ch.Send(responseMsg); err != nil {
|
|
log.WithError(err).Error("failed to send create circuit response")
|
|
}
|
|
}
|
|
|
|
type createCircuitResponseFactory func(*model.Circuit, map[uint32][]byte) (*channel.Message, error)
|
|
|
|
var _ CreateCircuitRequest = (*edge_ctrl_pb.CreateCircuitRequest)(nil)
|
|
|
|
type CreateCircuitRequest interface {
|
|
GetSessionToken() string
|
|
GetApiSessionToken() string
|
|
GetTerminatorInstanceId() string
|
|
GetPeerData() map[uint32][]byte
|
|
}
|
|
|
|
type CreateCircuitRequestContext struct {
|
|
baseSessionRequestContext
|
|
req CreateCircuitRequest
|
|
errRespF func(m *channel.Message)
|
|
}
|
|
|
|
func (self *CreateCircuitRequestContext) GetSessionToken() string {
|
|
return self.req.GetSessionToken()
|
|
}
|
|
|
|
func (self *CreateCircuitRequestContext) UpdateResponse(m *channel.Message) {
|
|
if self.errRespF != nil {
|
|
self.errRespF(m)
|
|
}
|
|
}
|