2014-04-27 19:56:06 +00:00
|
|
|
package consul
|
|
|
|
|
|
|
|
import (
|
2015-07-07 00:28:09 +00:00
|
|
|
"fmt"
|
|
|
|
|
2017-08-23 14:52:48 +00:00
|
|
|
"github.com/hashicorp/consul/acl"
|
pkg refactor
command/agent/* -> agent/*
command/consul/* -> agent/consul/*
command/agent/command{,_test}.go -> command/agent{,_test}.go
command/base/command.go -> command/base.go
command/base/* -> command/*
commands.go -> command/commands.go
The script which did the refactor is:
(
cd $GOPATH/src/github.com/hashicorp/consul
git mv command/agent/command.go command/agent.go
git mv command/agent/command_test.go command/agent_test.go
git mv command/agent/flag_slice_value{,_test}.go command/
git mv command/agent .
git mv command/base/command.go command/base.go
git mv command/base/config_util{,_test}.go command/
git mv commands.go command/
git mv consul agent
rmdir command/base/
gsed -i -e 's|package agent|package command|' command/agent{,_test}.go
gsed -i -e 's|package agent|package command|' command/flag_slice_value{,_test}.go
gsed -i -e 's|package base|package command|' command/base.go command/config_util{,_test}.go
gsed -i -e 's|package main|package command|' command/commands.go
gsed -i -e 's|base.Command|BaseCommand|' command/commands.go
gsed -i -e 's|agent.Command|AgentCommand|' command/commands.go
gsed -i -e 's|\tCommand:|\tBaseCommand:|' command/commands.go
gsed -i -e 's|base\.||' command/commands.go
gsed -i -e 's|command\.||' command/commands.go
gsed -i -e 's|command|c|' main.go
gsed -i -e 's|range Commands|range command.Commands|' main.go
gsed -i -e 's|Commands: Commands|Commands: command.Commands|' main.go
gsed -i -e 's|base\.BoolValue|BoolValue|' command/operator_autopilot_set.go
gsed -i -e 's|base\.DurationValue|DurationValue|' command/operator_autopilot_set.go
gsed -i -e 's|base\.StringValue|StringValue|' command/operator_autopilot_set.go
gsed -i -e 's|base\.UintValue|UintValue|' command/operator_autopilot_set.go
gsed -i -e 's|\bCommand\b|BaseCommand|' command/base.go
gsed -i -e 's|BaseCommand Options|Command Options|' command/base.go
gsed -i -e 's|base.Command|BaseCommand|' command/*.go
gsed -i -e 's|c\.Command|c.BaseCommand|g' command/*.go
gsed -i -e 's|\tCommand:|\tBaseCommand:|' command/*_test.go
gsed -i -e 's|base\.||' command/*_test.go
gsed -i -e 's|\bCommand\b|AgentCommand|' command/agent{,_test}.go
gsed -i -e 's|cmd.AgentCommand|cmd.BaseCommand|' command/agent.go
gsed -i -e 's|cli.AgentCommand = new(Command)|cli.Command = new(AgentCommand)|' command/agent_test.go
gsed -i -e 's|exec.AgentCommand|exec.Command|' command/agent_test.go
gsed -i -e 's|exec.BaseCommand|exec.Command|' command/agent_test.go
gsed -i -e 's|NewTestAgent|agent.NewTestAgent|' command/agent_test.go
gsed -i -e 's|= TestConfig|= agent.TestConfig|' command/agent_test.go
gsed -i -e 's|: RetryJoin|: agent.RetryJoin|' command/agent_test.go
gsed -i -e 's|\.\./\.\./|../|' command/config_util_test.go
gsed -i -e 's|\bverifyUniqueListeners|VerifyUniqueListeners|' agent/config{,_test}.go command/agent.go
gsed -i -e 's|\bserfLANKeyring\b|SerfLANKeyring|g' agent/{agent,keyring,testagent}.go command/agent.go
gsed -i -e 's|\bserfWANKeyring\b|SerfWANKeyring|g' agent/{agent,keyring,testagent}.go command/agent.go
gsed -i -e 's|\bNewAgent\b|agent.New|g' command/agent{,_test}.go
gsed -i -e 's|\bNewAgent|New|' agent/{acl_test,agent,testagent}.go
gsed -i -e 's|\bAgent\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bBool\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bConfig\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bDefaultConfig\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bDevConfig\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bMergeConfig\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bReadConfigPaths\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bParseMetaPair\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bSerfLANKeyring\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|\bSerfWANKeyring\b|agent.&|g' command/agent{,_test}.go
gsed -i -e 's|circonus\.agent|circonus|g' command/agent{,_test}.go
gsed -i -e 's|logger\.agent|logger|g' command/agent{,_test}.go
gsed -i -e 's|metrics\.agent|metrics|g' command/agent{,_test}.go
gsed -i -e 's|// agent.Agent|// agent|' command/agent{,_test}.go
gsed -i -e 's|a\.agent\.Config|a.Config|' command/agent{,_test}.go
gsed -i -e 's|agent\.AppendSliceValue|AppendSliceValue|' command/{configtest,validate}.go
gsed -i -e 's|consul/consul|agent/consul|' GNUmakefile
gsed -i -e 's|\.\./test|../../test|' agent/consul/server_test.go
# fix imports
f=$(grep -rl 'github.com/hashicorp/consul/command/agent' * | grep '\.go')
gsed -i -e 's|github.com/hashicorp/consul/command/agent|github.com/hashicorp/consul/agent|' $f
goimports -w $f
f=$(grep -rl 'github.com/hashicorp/consul/consul' * | grep '\.go')
gsed -i -e 's|github.com/hashicorp/consul/consul|github.com/hashicorp/consul/agent/consul|' $f
goimports -w $f
goimports -w command/*.go main.go
)
2017-06-09 22:28:28 +00:00
|
|
|
"github.com/hashicorp/consul/agent/consul/state"
|
2017-07-06 10:34:00 +00:00
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
2019-04-16 16:00:15 +00:00
|
|
|
bexpr "github.com/hashicorp/go-bexpr"
|
2020-01-28 23:50:41 +00:00
|
|
|
"github.com/hashicorp/go-hclog"
|
2017-01-24 17:06:51 +00:00
|
|
|
"github.com/hashicorp/go-memdb"
|
2017-08-14 14:36:07 +00:00
|
|
|
"github.com/hashicorp/go-multierror"
|
2014-10-02 06:09:00 +00:00
|
|
|
"github.com/hashicorp/serf/serf"
|
2014-04-27 19:56:06 +00:00
|
|
|
)
|
|
|
|
|
2014-04-28 21:44:36 +00:00
|
|
|
// Internal endpoint is used to query the miscellaneous info that
|
2014-04-27 19:56:06 +00:00
|
|
|
// does not necessarily fit into the other systems. It is also
|
|
|
|
// used to hold undocumented APIs that users should not rely on.
|
2014-04-28 21:44:36 +00:00
|
|
|
type Internal struct {
|
2020-01-28 23:50:41 +00:00
|
|
|
srv *Server
|
|
|
|
logger hclog.Logger
|
2014-04-27 19:56:06 +00:00
|
|
|
}
|
|
|
|
|
2015-06-09 19:36:25 +00:00
|
|
|
// NodeInfo is used to retrieve information about a specific node.
|
2014-04-28 21:44:36 +00:00
|
|
|
func (m *Internal) NodeInfo(args *structs.NodeSpecificRequest,
|
2014-04-27 19:56:06 +00:00
|
|
|
reply *structs.IndexedNodeDump) error {
|
2020-07-07 19:45:08 +00:00
|
|
|
if done, err := m.srv.ForwardRPC("Internal.NodeInfo", args, args, reply); done {
|
2014-04-27 19:56:06 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2020-02-10 15:40:44 +00:00
|
|
|
_, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, nil)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-01-24 17:06:51 +00:00
|
|
|
return m.srv.blockingQuery(
|
2015-10-13 03:48:50 +00:00
|
|
|
&args.QueryOptions,
|
2014-04-27 19:56:06 +00:00
|
|
|
&reply.QueryMeta,
|
2017-04-21 00:46:29 +00:00
|
|
|
func(ws memdb.WatchSet, state *state.Store) error {
|
2019-12-10 02:26:41 +00:00
|
|
|
index, dump, err := state.NodeInfo(ws, args.Node, &args.EnterpriseMeta)
|
2015-10-13 03:48:50 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
reply.Index, reply.Dump = index, dump
|
2015-06-11 19:48:38 +00:00
|
|
|
return m.srv.filterACL(args.Token, reply)
|
2014-04-27 19:56:06 +00:00
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2015-06-09 19:36:25 +00:00
|
|
|
// NodeDump is used to generate information about all of the nodes.
|
2014-04-28 21:44:36 +00:00
|
|
|
func (m *Internal) NodeDump(args *structs.DCSpecificRequest,
|
2014-04-27 19:56:06 +00:00
|
|
|
reply *structs.IndexedNodeDump) error {
|
2020-07-07 19:45:08 +00:00
|
|
|
if done, err := m.srv.ForwardRPC("Internal.NodeDump", args, args, reply); done {
|
2014-04-27 19:56:06 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2020-02-10 15:40:44 +00:00
|
|
|
_, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, nil)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2019-04-16 16:00:15 +00:00
|
|
|
filter, err := bexpr.CreateFilter(args.Filter, nil, reply.Dump)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-01-24 17:06:51 +00:00
|
|
|
return m.srv.blockingQuery(
|
2015-10-13 03:48:50 +00:00
|
|
|
&args.QueryOptions,
|
2014-04-27 19:56:06 +00:00
|
|
|
&reply.QueryMeta,
|
2017-04-21 00:46:29 +00:00
|
|
|
func(ws memdb.WatchSet, state *state.Store) error {
|
2019-12-10 02:26:41 +00:00
|
|
|
index, dump, err := state.NodeDump(ws, &args.EnterpriseMeta)
|
2015-10-13 03:48:50 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
reply.Index, reply.Dump = index, dump
|
2019-04-16 16:00:15 +00:00
|
|
|
if err := m.srv.filterACL(args.Token, reply); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
raw, err := filter.Execute(reply.Dump)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
reply.Dump = raw.(structs.NodeDump)
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2020-07-30 16:21:11 +00:00
|
|
|
func (m *Internal) ServiceDump(args *structs.ServiceDumpRequest, reply *structs.IndexedNodesWithGateways) error {
|
2020-07-07 19:45:08 +00:00
|
|
|
if done, err := m.srv.ForwardRPC("Internal.ServiceDump", args, args, reply); done {
|
2019-04-16 16:00:15 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2020-02-10 15:40:44 +00:00
|
|
|
_, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, nil)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2019-04-16 16:00:15 +00:00
|
|
|
filter, err := bexpr.CreateFilter(args.Filter, nil, reply.Nodes)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return m.srv.blockingQuery(
|
|
|
|
&args.QueryOptions,
|
|
|
|
&reply.QueryMeta,
|
|
|
|
func(ws memdb.WatchSet, state *state.Store) error {
|
2020-07-30 16:21:11 +00:00
|
|
|
// Get, store, and filter nodes
|
|
|
|
maxIdx, nodes, err := state.ServiceDump(ws, args.ServiceKind, args.UseServiceKind, &args.EnterpriseMeta)
|
2019-04-16 16:00:15 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2020-07-30 16:21:11 +00:00
|
|
|
reply.Nodes = nodes
|
2019-04-16 16:00:15 +00:00
|
|
|
|
2020-08-05 22:07:11 +00:00
|
|
|
if err := m.srv.filterACL(args.Token, &reply.Nodes); err != nil {
|
2020-07-30 16:21:11 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get, store, and filter gateway services
|
|
|
|
idx, gatewayServices, err := state.DumpGatewayServices(ws)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
reply.Gateways = gatewayServices
|
|
|
|
|
|
|
|
if idx > maxIdx {
|
|
|
|
maxIdx = idx
|
|
|
|
}
|
|
|
|
reply.Index = maxIdx
|
|
|
|
|
2020-08-05 22:07:11 +00:00
|
|
|
if err := m.srv.filterACL(args.Token, &reply.Gateways); err != nil {
|
2019-04-16 16:00:15 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
raw, err := filter.Execute(reply.Nodes)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
reply.Nodes = raw.(structs.CheckServiceNodes)
|
|
|
|
return nil
|
2014-04-27 19:56:06 +00:00
|
|
|
})
|
|
|
|
}
|
2014-08-28 22:00:49 +00:00
|
|
|
|
2020-09-29 01:42:03 +00:00
|
|
|
func (m *Internal) ServiceTopology(args *structs.ServiceSpecificRequest, reply *structs.IndexedServiceTopology) error {
|
|
|
|
if done, err := m.srv.ForwardRPC("Internal.ServiceTopology", args, args, reply); done {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if args.ServiceName == "" {
|
|
|
|
return fmt.Errorf("Must provide a service name")
|
|
|
|
}
|
|
|
|
|
|
|
|
var authzContext acl.AuthorizerContext
|
|
|
|
authz, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, &authzContext)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := m.srv.validateEnterpriseRequest(&args.EnterpriseMeta, false); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if authz != nil && authz.ServiceRead(args.ServiceName, &authzContext) != acl.Allow {
|
|
|
|
return acl.ErrPermissionDenied
|
|
|
|
}
|
|
|
|
|
|
|
|
return m.srv.blockingQuery(
|
|
|
|
&args.QueryOptions,
|
|
|
|
&reply.QueryMeta,
|
|
|
|
func(ws memdb.WatchSet, state *state.Store) error {
|
2020-10-08 00:35:34 +00:00
|
|
|
defaultAllow := acl.Allow
|
|
|
|
if authz != nil {
|
|
|
|
defaultAllow = authz.IntentionDefaultAllow(nil)
|
|
|
|
}
|
|
|
|
|
2020-10-08 23:31:54 +00:00
|
|
|
index, topology, err := state.ServiceTopology(ws, args.Datacenter, args.ServiceName, args.ServiceKind, defaultAllow, &args.EnterpriseMeta)
|
2020-09-29 01:42:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
reply.Index = index
|
|
|
|
reply.ServiceTopology = topology
|
|
|
|
|
|
|
|
if err := m.srv.filterACL(args.Token, reply); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2021-03-15 23:50:47 +00:00
|
|
|
// IntentionUpstreams returns the upstreams of a service. Upstreams are inferred from intentions.
|
2021-03-14 04:44:24 +00:00
|
|
|
// If intentions allow a connection from the target to some candidate service, the candidate service is considered
|
|
|
|
// an upstream of the target.
|
|
|
|
func (m *Internal) IntentionUpstreams(args *structs.ServiceSpecificRequest, reply *structs.IndexedServiceList) error {
|
|
|
|
// Exit early if Connect hasn't been enabled.
|
|
|
|
if !m.srv.config.ConnectEnabled {
|
|
|
|
return ErrConnectNotEnabled
|
|
|
|
}
|
|
|
|
if args.ServiceName == "" {
|
|
|
|
return fmt.Errorf("Must provide a service name")
|
|
|
|
}
|
|
|
|
if done, err := m.srv.ForwardRPC("Internal.IntentionUpstreams", args, args, reply); done {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
authz, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, nil)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := m.srv.validateEnterpriseRequest(&args.EnterpriseMeta, false); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return m.srv.blockingQuery(
|
|
|
|
&args.QueryOptions,
|
|
|
|
&reply.QueryMeta,
|
|
|
|
func(ws memdb.WatchSet, state *state.Store) error {
|
|
|
|
defaultDecision := acl.Allow
|
|
|
|
if authz != nil {
|
|
|
|
defaultDecision = authz.IntentionDefaultAllow(nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
sn := structs.NewServiceName(args.ServiceName, &args.EnterpriseMeta)
|
|
|
|
index, services, err := state.IntentionTopology(ws, sn, false, defaultDecision)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
reply.Index, reply.Services = index, services
|
|
|
|
return m.srv.filterACLWithAuthorizer(authz, reply)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2020-05-11 17:35:17 +00:00
|
|
|
// GatewayServiceNodes returns all the nodes for services associated with a gateway along with their gateway config
|
|
|
|
func (m *Internal) GatewayServiceDump(args *structs.ServiceSpecificRequest, reply *structs.IndexedServiceDump) error {
|
2020-07-07 19:45:08 +00:00
|
|
|
if done, err := m.srv.ForwardRPC("Internal.GatewayServiceDump", args, args, reply); done {
|
2020-05-11 17:35:17 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Verify the arguments
|
|
|
|
if args.ServiceName == "" {
|
|
|
|
return fmt.Errorf("Must provide gateway name")
|
|
|
|
}
|
|
|
|
|
|
|
|
var authzContext acl.AuthorizerContext
|
|
|
|
authz, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &args.EnterpriseMeta, &authzContext)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := m.srv.validateEnterpriseRequest(&args.EnterpriseMeta, false); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// We need read access to the gateway we're trying to find services for, so check that first.
|
|
|
|
if authz != nil && authz.ServiceRead(args.ServiceName, &authzContext) != acl.Allow {
|
|
|
|
return acl.ErrPermissionDenied
|
|
|
|
}
|
|
|
|
|
|
|
|
err = m.srv.blockingQuery(
|
|
|
|
&args.QueryOptions,
|
|
|
|
&reply.QueryMeta,
|
|
|
|
func(ws memdb.WatchSet, state *state.Store) error {
|
|
|
|
var maxIdx uint64
|
|
|
|
idx, gatewayServices, err := state.GatewayServices(ws, args.ServiceName, &args.EnterpriseMeta)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if idx > maxIdx {
|
|
|
|
maxIdx = idx
|
|
|
|
}
|
|
|
|
|
|
|
|
// Loop over the gateway <-> serviceName mappings and fetch all service instances for each
|
|
|
|
var result structs.ServiceDump
|
|
|
|
for _, gs := range gatewayServices {
|
2020-06-12 14:57:41 +00:00
|
|
|
idx, instances, err := state.CheckServiceNodes(ws, gs.Service.Name, &gs.Service.EnterpriseMeta)
|
2020-05-11 17:35:17 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if idx > maxIdx {
|
|
|
|
maxIdx = idx
|
|
|
|
}
|
|
|
|
for _, n := range instances {
|
|
|
|
svc := structs.ServiceInfo{
|
|
|
|
Node: n.Node,
|
|
|
|
Service: n.Service,
|
|
|
|
Checks: n.Checks,
|
|
|
|
GatewayService: gs,
|
|
|
|
}
|
|
|
|
result = append(result, &svc)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we store the gateway <-> service mapping even if there are no instances of the service
|
|
|
|
if len(instances) == 0 {
|
|
|
|
svc := structs.ServiceInfo{
|
|
|
|
GatewayService: gs,
|
|
|
|
}
|
|
|
|
result = append(result, &svc)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
reply.Index, reply.Dump = maxIdx, result
|
|
|
|
|
|
|
|
if err := m.srv.filterACL(args.Token, reply); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2020-08-11 23:20:41 +00:00
|
|
|
// Match returns the set of intentions that match the given source/destination.
|
|
|
|
func (m *Internal) GatewayIntentions(args *structs.IntentionQueryRequest, reply *structs.IndexedIntentions) error {
|
|
|
|
// Forward if necessary
|
|
|
|
if done, err := m.srv.ForwardRPC("Internal.GatewayIntentions", args, args, reply); done {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(args.Match.Entries) > 1 {
|
|
|
|
return fmt.Errorf("Expected 1 gateway name, got %d", len(args.Match.Entries))
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the ACL token for the request for the checks below.
|
|
|
|
var entMeta structs.EnterpriseMeta
|
|
|
|
var authzContext acl.AuthorizerContext
|
|
|
|
|
|
|
|
authz, err := m.srv.ResolveTokenAndDefaultMeta(args.Token, &entMeta, &authzContext)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if args.Match.Entries[0].Namespace == "" {
|
|
|
|
args.Match.Entries[0].Namespace = entMeta.NamespaceOrDefault()
|
|
|
|
}
|
|
|
|
if err := m.srv.validateEnterpriseIntentionNamespace(args.Match.Entries[0].Namespace, true); err != nil {
|
|
|
|
return fmt.Errorf("Invalid match entry namespace %q: %v", args.Match.Entries[0].Namespace, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// We need read access to the gateway we're trying to find intentions for, so check that first.
|
|
|
|
if authz != nil && authz.ServiceRead(args.Match.Entries[0].Name, &authzContext) != acl.Allow {
|
|
|
|
return acl.ErrPermissionDenied
|
|
|
|
}
|
|
|
|
|
|
|
|
return m.srv.blockingQuery(
|
|
|
|
&args.QueryOptions,
|
|
|
|
&reply.QueryMeta,
|
|
|
|
func(ws memdb.WatchSet, state *state.Store) error {
|
|
|
|
var maxIdx uint64
|
|
|
|
idx, gatewayServices, err := state.GatewayServices(ws, args.Match.Entries[0].Name, &entMeta)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if idx > maxIdx {
|
|
|
|
maxIdx = idx
|
|
|
|
}
|
|
|
|
|
|
|
|
// Loop over the gateway <-> serviceName mappings and fetch all intentions for each
|
|
|
|
seen := make(map[string]bool)
|
|
|
|
result := make(structs.Intentions, 0)
|
|
|
|
|
|
|
|
for _, gs := range gatewayServices {
|
|
|
|
entry := structs.IntentionMatchEntry{
|
|
|
|
Namespace: gs.Service.NamespaceOrDefault(),
|
|
|
|
Name: gs.Service.Name,
|
|
|
|
}
|
|
|
|
idx, intentions, err := state.IntentionMatchOne(ws, entry, structs.IntentionMatchDestination)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if idx > maxIdx {
|
|
|
|
maxIdx = idx
|
|
|
|
}
|
|
|
|
|
|
|
|
// Deduplicate wildcard intentions
|
|
|
|
for _, ixn := range intentions {
|
|
|
|
if !seen[ixn.ID] {
|
|
|
|
result = append(result, ixn)
|
|
|
|
seen[ixn.ID] = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
reply.Index, reply.Intentions = maxIdx, result
|
|
|
|
if reply.Intentions == nil {
|
|
|
|
reply.Intentions = make(structs.Intentions, 0)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := m.srv.filterACL(args.Token, reply); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
2014-08-28 22:00:49 +00:00
|
|
|
// EventFire is a bit of an odd endpoint, but it allows for a cross-DC RPC
|
|
|
|
// call to fire an event. The primary use case is to enable user events being
|
|
|
|
// triggered in a remote DC.
|
|
|
|
func (m *Internal) EventFire(args *structs.EventFireRequest,
|
|
|
|
reply *structs.EventFireResponse) error {
|
2020-07-07 19:45:08 +00:00
|
|
|
if done, err := m.srv.ForwardRPC("Internal.EventFire", args, args, reply); done {
|
2014-08-28 22:00:49 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2015-06-18 01:57:17 +00:00
|
|
|
// Check ACLs
|
2018-10-19 16:04:07 +00:00
|
|
|
rule, err := m.srv.ResolveToken(args.Token)
|
2015-06-18 01:57:17 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2019-10-15 20:58:50 +00:00
|
|
|
if rule != nil && rule.EventWrite(args.Name, nil) != acl.Allow {
|
2020-01-27 19:54:32 +00:00
|
|
|
accessorID := m.aclAccessorID(args.Token)
|
2020-01-28 23:50:41 +00:00
|
|
|
m.logger.Warn("user event blocked by ACLs", "event", args.Name, "accessorID", accessorID)
|
2017-08-23 14:52:48 +00:00
|
|
|
return acl.ErrPermissionDenied
|
2015-06-18 01:57:17 +00:00
|
|
|
}
|
|
|
|
|
2014-08-28 22:00:49 +00:00
|
|
|
// Set the query meta data
|
|
|
|
m.srv.setQueryMeta(&reply.QueryMeta)
|
|
|
|
|
2015-07-14 18:38:12 +00:00
|
|
|
// Add the consul prefix to the event name
|
|
|
|
eventName := userEventName(args.Name)
|
|
|
|
|
2017-08-14 14:36:07 +00:00
|
|
|
// Fire the event on all LAN segments
|
|
|
|
segments := m.srv.LANSegments()
|
|
|
|
var errs error
|
|
|
|
for name, segment := range segments {
|
|
|
|
err := segment.UserEvent(eventName, args.Payload, false)
|
|
|
|
if err != nil {
|
|
|
|
err = fmt.Errorf("error broadcasting event to segment %q: %v", name, err)
|
|
|
|
errs = multierror.Append(errs, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return errs
|
2014-08-28 22:00:49 +00:00
|
|
|
}
|
2014-09-24 23:39:14 +00:00
|
|
|
|
2014-10-09 17:25:53 +00:00
|
|
|
// KeyringOperation will query the WAN and LAN gossip keyrings of all nodes.
|
2014-10-03 00:10:54 +00:00
|
|
|
func (m *Internal) KeyringOperation(
|
2014-09-25 01:30:34 +00:00
|
|
|
args *structs.KeyringRequest,
|
|
|
|
reply *structs.KeyringResponses) error {
|
2014-09-24 23:39:14 +00:00
|
|
|
|
2020-08-11 11:35:48 +00:00
|
|
|
// Error aggressively to be clear about LocalOnly behavior
|
|
|
|
if args.LocalOnly && args.Operation != structs.KeyringList {
|
|
|
|
return fmt.Errorf("argument error: LocalOnly can only be used for List operations")
|
|
|
|
}
|
|
|
|
|
2015-07-07 00:28:09 +00:00
|
|
|
// Check ACLs
|
2020-02-04 20:58:56 +00:00
|
|
|
identity, rule, err := m.srv.ResolveTokenToIdentityAndAuthorizer(args.Token)
|
2015-07-07 00:28:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2020-02-04 20:58:56 +00:00
|
|
|
if err := m.srv.validateEnterpriseToken(identity); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-08-23 14:52:48 +00:00
|
|
|
if rule != nil {
|
2015-07-07 00:28:09 +00:00
|
|
|
switch args.Operation {
|
|
|
|
case structs.KeyringList:
|
2019-10-15 20:58:50 +00:00
|
|
|
if rule.KeyringRead(nil) != acl.Allow {
|
2015-07-07 00:28:09 +00:00
|
|
|
return fmt.Errorf("Reading keyring denied by ACLs")
|
|
|
|
}
|
|
|
|
case structs.KeyringInstall:
|
|
|
|
fallthrough
|
|
|
|
case structs.KeyringUse:
|
|
|
|
fallthrough
|
|
|
|
case structs.KeyringRemove:
|
2019-10-15 20:58:50 +00:00
|
|
|
if rule.KeyringWrite(nil) != acl.Allow {
|
2015-07-07 00:28:09 +00:00
|
|
|
return fmt.Errorf("Modifying keyring denied due to ACLs")
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
panic("Invalid keyring operation")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-08-11 11:35:48 +00:00
|
|
|
if args.LocalOnly || args.Forwarded || m.srv.serfWAN == nil {
|
|
|
|
// Handle operations that are localOnly, already forwarded or
|
|
|
|
// there is no serfWAN. If any of this is the case this
|
|
|
|
// operation shouldn't go out to other dcs or WAN pool.
|
|
|
|
reply.Responses = append(reply.Responses, m.executeKeyringOpLAN(args)...)
|
|
|
|
} else {
|
|
|
|
// Handle not already forwarded, non-local operations.
|
2019-08-12 18:11:11 +00:00
|
|
|
|
2020-08-11 11:35:48 +00:00
|
|
|
// Marking this as forwarded because this is what we are about
|
|
|
|
// to do. Prevents the same message from being fowarded by
|
|
|
|
// other servers.
|
|
|
|
args.Forwarded = true
|
|
|
|
reply.Responses = append(reply.Responses, m.executeKeyringOpWAN(args))
|
|
|
|
reply.Responses = append(reply.Responses, m.executeKeyringOpLAN(args)...)
|
2019-08-12 18:11:11 +00:00
|
|
|
|
2020-08-11 11:35:48 +00:00
|
|
|
dcs := m.srv.router.GetRemoteDatacenters(m.srv.config.Datacenter)
|
|
|
|
responses, err := m.srv.keyringRPCs("Internal.KeyringOperation", args, dcs)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
2019-08-12 18:11:11 +00:00
|
|
|
}
|
2020-08-11 11:35:48 +00:00
|
|
|
reply.Add(responses)
|
2014-09-24 23:39:14 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-08-11 11:35:48 +00:00
|
|
|
func (m *Internal) executeKeyringOpLAN(args *structs.KeyringRequest) []*structs.KeyringResponse {
|
|
|
|
responses := []*structs.KeyringResponse{}
|
|
|
|
segments := m.srv.LANSegments()
|
|
|
|
for name, segment := range segments {
|
|
|
|
mgr := segment.KeyManager()
|
|
|
|
serfResp, err := m.executeKeyringOpMgr(mgr, args)
|
|
|
|
resp := translateKeyResponseToKeyringResponse(serfResp, m.srv.config.Datacenter, err)
|
|
|
|
resp.Segment = name
|
|
|
|
responses = append(responses, &resp)
|
|
|
|
}
|
|
|
|
return responses
|
|
|
|
}
|
2014-10-05 20:59:27 +00:00
|
|
|
|
2020-08-11 11:35:48 +00:00
|
|
|
func (m *Internal) executeKeyringOpWAN(args *structs.KeyringRequest) *structs.KeyringResponse {
|
|
|
|
mgr := m.srv.KeyManagerWAN()
|
|
|
|
serfResp, err := m.executeKeyringOpMgr(mgr, args)
|
|
|
|
resp := translateKeyResponseToKeyringResponse(serfResp, m.srv.config.Datacenter, err)
|
|
|
|
resp.WAN = true
|
|
|
|
return &resp
|
|
|
|
}
|
|
|
|
|
|
|
|
func translateKeyResponseToKeyringResponse(keyresponse *serf.KeyResponse, datacenter string, err error) structs.KeyringResponse {
|
|
|
|
resp := structs.KeyringResponse{
|
add primary keys to list keyring (#8522)
During gossip encryption key rotation it would be nice to be able to see if all nodes are using the same key. This PR adds another field to the json response from `GET v1/operator/keyring` which lists the primary keys in use per dc. That way an operator can tell when a key was successfully setup as primary key.
Based on https://github.com/hashicorp/serf/pull/611 to add primary key to list keyring output:
```json
[
{
"WAN": true,
"Datacenter": "dc2",
"Segment": "",
"Keys": {
"0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 6,
"SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 6
},
"PrimaryKeys": {
"SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 6
},
"NumNodes": 6
},
{
"WAN": false,
"Datacenter": "dc2",
"Segment": "",
"Keys": {
"0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 8,
"SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8
},
"PrimaryKeys": {
"SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8
},
"NumNodes": 8
},
{
"WAN": false,
"Datacenter": "dc1",
"Segment": "",
"Keys": {
"0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 3,
"SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8
},
"PrimaryKeys": {
"SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8
},
"NumNodes": 8
}
]
```
I intentionally did not change the CLI output because I didn't find a good way of displaying this information. There are a couple of options that we could implement later:
* add a flag to show the primary keys
* add a flag to show json output
Fixes #3393.
2020-08-18 07:50:24 +00:00
|
|
|
Datacenter: datacenter,
|
|
|
|
Messages: keyresponse.Messages,
|
|
|
|
Keys: keyresponse.Keys,
|
|
|
|
PrimaryKeys: keyresponse.PrimaryKeys,
|
|
|
|
NumNodes: keyresponse.NumNodes,
|
2014-10-05 20:59:27 +00:00
|
|
|
}
|
2020-08-11 11:35:48 +00:00
|
|
|
if err != nil {
|
|
|
|
resp.Error = err.Error()
|
2014-10-05 20:59:27 +00:00
|
|
|
}
|
2020-08-11 11:35:48 +00:00
|
|
|
return resp
|
2017-08-14 14:36:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// executeKeyringOpMgr executes the appropriate keyring-related function based on
|
|
|
|
// the type of keyring operation in the request. It takes the KeyManager as an
|
|
|
|
// argument, so it can handle any operation for either LAN or WAN pools.
|
|
|
|
func (m *Internal) executeKeyringOpMgr(
|
|
|
|
mgr *serf.KeyManager,
|
|
|
|
args *structs.KeyringRequest,
|
2020-08-11 11:35:48 +00:00
|
|
|
) (*serf.KeyResponse, error) {
|
2017-08-14 14:36:07 +00:00
|
|
|
var serfResp *serf.KeyResponse
|
|
|
|
var err error
|
2014-10-03 00:10:54 +00:00
|
|
|
|
2017-02-02 02:42:41 +00:00
|
|
|
opts := &serf.KeyRequestOptions{RelayFactor: args.RelayFactor}
|
2014-10-03 00:10:54 +00:00
|
|
|
switch args.Operation {
|
|
|
|
case structs.KeyringList:
|
2017-02-02 02:42:41 +00:00
|
|
|
serfResp, err = mgr.ListKeysWithOptions(opts)
|
2014-10-03 00:10:54 +00:00
|
|
|
case structs.KeyringInstall:
|
2017-02-02 02:42:41 +00:00
|
|
|
serfResp, err = mgr.InstallKeyWithOptions(args.Key, opts)
|
2014-10-03 00:10:54 +00:00
|
|
|
case structs.KeyringUse:
|
2017-02-02 02:42:41 +00:00
|
|
|
serfResp, err = mgr.UseKeyWithOptions(args.Key, opts)
|
2014-10-03 00:10:54 +00:00
|
|
|
case structs.KeyringRemove:
|
2017-02-02 02:42:41 +00:00
|
|
|
serfResp, err = mgr.RemoveKeyWithOptions(args.Key, opts)
|
2014-09-24 23:39:14 +00:00
|
|
|
}
|
|
|
|
|
2020-08-11 11:35:48 +00:00
|
|
|
return serfResp, err
|
2014-10-02 06:09:00 +00:00
|
|
|
}
|
2020-01-27 19:54:32 +00:00
|
|
|
|
|
|
|
// aclAccessorID is used to convert an ACLToken's secretID to its accessorID for non-
|
|
|
|
// critical purposes, such as logging. Therefore we interpret all errors as empty-string
|
|
|
|
// so we can safely log it without handling non-critical errors at the usage site.
|
|
|
|
func (m *Internal) aclAccessorID(secretID string) string {
|
|
|
|
_, ident, err := m.srv.ResolveIdentityFromToken(secretID)
|
2020-01-29 17:16:08 +00:00
|
|
|
if acl.IsErrNotFound(err) {
|
|
|
|
return ""
|
|
|
|
}
|
2020-01-27 19:54:32 +00:00
|
|
|
if err != nil {
|
2020-01-29 17:16:08 +00:00
|
|
|
m.logger.Debug("non-critical error resolving acl token accessor for logging", "error", err)
|
2020-01-27 19:54:32 +00:00
|
|
|
return ""
|
|
|
|
}
|
|
|
|
if ident == nil {
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
return ident.ID()
|
|
|
|
}
|