mirror of
https://github.com/openziti/ziti.git
synced 2026-10-26 13:39:58 +00:00
Andrew Martinez
8415a7dbf6
* The controller and the router wrote the complete service session token, an OIDC service session JWT or a legacy session token, into structured log fields during edge control operations. Several of the sites logged at Error or Info, so the values reached logs at default verbosity during ordinary operation. * Adds LoggingFields to the session and api session types in common, controller/model and router/state, so a logging site asks for the session fields or the api session fields instead of picking values by hand. Ids, type, identity, service and the token's validity window go in; the token does not. Empty values are dropped, so the sets merge over each other. * AddLoggingFields in router/state now delegates to LoggingFields. Its output moves from a nested field to flat prefixed keys. * The edge control handlers log the session field set on the shared returnError and logResult paths, on circuit setup and on terminator update. The terminator removal paths log the terminator id, since they never load a session. * Adds unit tests over returnError and logResult that fail if a session token reaches a log entry, covering the loaded-session, failed-to-load and JWT-claims cases.
114 lines
3.5 KiB
Go
114 lines
3.5 KiB
Go
/*
|
|
Copyright NetFoundry Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package handler_edge_ctrl
|
|
|
|
import (
|
|
"github.com/michaelquigley/pfxlog"
|
|
"github.com/openziti/channel/v5"
|
|
"github.com/openziti/ziti/v2/common"
|
|
"github.com/openziti/ziti/v2/common/pb/edge_ctrl_pb"
|
|
"github.com/openziti/ziti/v2/controller/env"
|
|
"github.com/sirupsen/logrus"
|
|
"google.golang.org/protobuf/proto"
|
|
)
|
|
|
|
type removeTerminatorHandler struct {
|
|
baseRequestHandler
|
|
}
|
|
|
|
func NewRemoveTerminatorHandler(appEnv *env.AppEnv, ch channel.Channel) channel.ContentTypeReceiver {
|
|
return &removeTerminatorHandler{
|
|
baseRequestHandler{
|
|
ch: ch,
|
|
appEnv: appEnv,
|
|
},
|
|
}
|
|
}
|
|
|
|
func (self *removeTerminatorHandler) ContentType() int32 {
|
|
return int32(edge_ctrl_pb.ContentType_RemoveTerminatorRequestType)
|
|
}
|
|
|
|
func (self *removeTerminatorHandler) Label() string {
|
|
return "remove.terminator"
|
|
}
|
|
|
|
func (self *removeTerminatorHandler) sendResponse(ctx *RemoveTerminatorRequestContext) {
|
|
log := pfxlog.ContextLogger(self.ch.Label())
|
|
|
|
responseMsg := channel.NewMessage(int32(edge_ctrl_pb.ContentType_RemoveTerminatorResponseType), nil)
|
|
responseMsg.ReplyTo(ctx.msg)
|
|
if err := self.ch.Send(responseMsg); err != nil {
|
|
log.WithError(err).WithField("terminatorId", ctx.req.TerminatorId).Error("failed to send remove terminator response")
|
|
}
|
|
}
|
|
|
|
func (self *removeTerminatorHandler) HandleReceive(msg *channel.Message, ch channel.Channel) {
|
|
req := &edge_ctrl_pb.RemoveTerminatorRequest{}
|
|
if err := proto.Unmarshal(msg.Body, req); err != nil {
|
|
pfxlog.ContextLogger(ch.Label()).WithError(err).Error("could not unmarshal RemoveTerminator")
|
|
return
|
|
}
|
|
|
|
ctx := &RemoveTerminatorRequestContext{
|
|
baseSessionRequestContext: baseSessionRequestContext{handler: self, msg: msg, env: self.appEnv},
|
|
req: req,
|
|
}
|
|
|
|
go self.RemoveTerminator(ctx)
|
|
}
|
|
|
|
func (self *removeTerminatorHandler) RemoveTerminator(ctx *RemoveTerminatorRequestContext) {
|
|
if !ctx.loadRouter() {
|
|
return
|
|
}
|
|
|
|
terminator := ctx.verifyTerminator(ctx.req.TerminatorId, common.EdgeBinding)
|
|
if ctx.err != nil {
|
|
self.returnError(ctx, ctx.err)
|
|
return
|
|
}
|
|
|
|
// SDKs can't request terminator deletes directly, they can only do so through the router.
|
|
// The router will only ask to delete terminators that belong to the SDK, so we shouldn't need
|
|
// to check the session again here. The session may already be deleted, and if it is, we don't
|
|
// currently have a way to verify that it's associated. Also, with idempotent terminators, a
|
|
// terminator may belong to a series of sessions.
|
|
err := self.getNetwork().Terminator.Delete(ctx.req.TerminatorId, ctx.newChangeContext())
|
|
if err != nil {
|
|
self.returnError(ctx, internalError(err))
|
|
return
|
|
}
|
|
|
|
logrus.
|
|
WithField("routerId", self.ch.Id()).
|
|
WithField("serviceId", terminator.Service).
|
|
WithField("terminator", ctx.req.TerminatorId).
|
|
Info("removed terminator")
|
|
|
|
self.sendResponse(ctx)
|
|
}
|
|
|
|
type RemoveTerminatorRequestContext struct {
|
|
baseSessionRequestContext
|
|
req *edge_ctrl_pb.RemoveTerminatorRequest
|
|
}
|
|
|
|
func (self *RemoveTerminatorRequestContext) GetSessionToken() string {
|
|
return self.req.SessionToken
|
|
}
|