Files
teleport/lib/utils/grpc.go
T
d89879c2f5 Add gRPC service definition for Plugin resources (#21750)
* Add plugin exchange service

* Add Plugin methods to auth

* Add gRPC-layer methods for Plugin

* Add RBAC presets for Plugin

* Test GetPlugin()/NoSecrets access

* Make error assertions more correct in role test

* Deny setting credentials if user can not read them

* gofmt

* Apply minor suggestions from code review

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>

* Move dependency into an existing block in go.mod

* Improve error messages for failed type assertions

* DRY WithSecrets access checks for Plugins

* Run new tests in parallel

* Improve error assertions in auth_with_roles_test

* TestGetPluginWithSecrets: split cases to subtests

* Clean up test servers and clients

* Add proto for plugin service

* Remove Plugin methods from auth service

Moved to a dedicated service

* Remove plugin-related auth methods

Moved to a dedicated service in Enterprise

* Remove CreatePlugin test from auth_with_roles_test

Moved to a dedicated service in Enterprise

* Pass "backend getter" to local plugins service

This pattern is used in Enterprise to set up secondary services
before auth (and backend) are created.

* Rename InitialCredentials to BootstrapCredentials

* Add plugins service to genproto.sh

* Reformat generated proto

* Remove obsolete PluginExchangeService

The equivalent of this is now in Enterprise

* Add kube service to genproto.sh; regenerate

* Add ListPlugins to plugin backend service

* Reimplement GetPlugins on top of ListPlugins

This is a "convenience" implementation for the backend service layer.

* Replace GetPlugins with ListPlugins in gRPC schema

* Fix ListKubernetesResources unit test

* Simplify plugin pagination key to just the name

* Use existing constant for page size

* Make dummy clients return errors instead of panic

* Remove obsolete field

* Ensure go.mod is valid for corresponding e changes

* Fix passing mutex ref

* Move teleport-plugins import to e_imports

* Revert oauth change in go.mod

* Use limit+1 to look-ahead when paginating plugins

* Test plugin pagination with pageSize > numPlugins

* Add descriptive messages to gRPC dummy clients

* Plugin: add RW for editor; remove secrets from gRPC

* Make message more descriptive for dummy gRPC conn

---------

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
2023-02-23 14:32:41 +00:00

154 lines
6.4 KiB
Go

/*
Copyright 2022 Gravitational, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package utils
import (
"context"
"github.com/gravitational/trace"
"github.com/gravitational/trace/trail"
"google.golang.org/grpc"
)
// grpcServerStreamWrapper wraps around the embedded grpc.ServerStream
// and intercepts the RecvMsg and SendMsg method calls converting errors to the
// appropriate grpc status error.
type grpcServerStreamWrapper struct {
grpc.ServerStream
}
// SendMsg wraps around ServerStream.SendMsg and adds metrics reporting
func (s *grpcServerStreamWrapper) SendMsg(m interface{}) error {
return trail.FromGRPC(s.ServerStream.SendMsg(m))
}
// RecvMsg wraps around ServerStream.RecvMsg and adds metrics reporting
func (s *grpcServerStreamWrapper) RecvMsg(m interface{}) error {
return trail.FromGRPC(s.ServerStream.RecvMsg(m))
}
// grpcClientStreamWrapper wraps around the embedded grpc.ClientStream
// and intercepts the RecvMsg and SendMsg method calls converting errors to the
// appropriate grpc status error.
type grpcClientStreamWrapper struct {
grpc.ClientStream
}
// SendMsg wraps around ClientStream.SendMsg
func (s *grpcClientStreamWrapper) SendMsg(m interface{}) error {
return trail.FromGRPC(s.ClientStream.SendMsg(m))
}
// RecvMsg wraps around ClientStream.RecvMsg
func (s *grpcClientStreamWrapper) RecvMsg(m interface{}) error {
return trail.FromGRPC(s.ClientStream.RecvMsg(m))
}
// GRPCServerUnaryErrorInterceptor is a GPRC unary server interceptor that
// handles converting errors to the appropriate grpc status error.
func GRPCServerUnaryErrorInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
resp, err := handler(ctx, req)
return resp, trail.ToGRPC(err)
}
// GRPCClientUnaryErrorInterceptor is a GPRC unary client interceptor that
// handles converting errors to the appropriate grpc status error.
func GRPCClientUnaryErrorInterceptor(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
return trail.FromGRPC(invoker(ctx, method, req, reply, cc, opts...))
}
// GRPCServerStreamErrorInterceptor is a GPRC server stream interceptor that
// handles converting errors to the appropriate grpc status error.
func GRPCServerStreamErrorInterceptor(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
serverWrapper := &grpcServerStreamWrapper{ss}
return trail.ToGRPC(handler(srv, serverWrapper))
}
// GRPCClientStreamErrorInterceptor is GPRC client stream interceptor that
// handles converting errors to the appropriate grpc status error.
func GRPCClientStreamErrorInterceptor(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
s, err := streamer(ctx, desc, cc, method, opts...)
if err != nil {
return nil, trail.ToGRPC(err)
}
return &grpcClientStreamWrapper{s}, nil
}
// ChainUnaryServerInterceptors takes 1 or more grpc.UnaryServerInterceptors and
// chains them into a single grpc.UnaryServerInterceptor. The first interceptor
// will be the outer most, while the last interceptor will be the inner most
// wrapper around the real call.
func ChainUnaryServerInterceptors(first grpc.UnaryServerInterceptor, rest ...grpc.UnaryServerInterceptor) grpc.UnaryServerInterceptor {
return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
for i := len(rest) - 1; i >= 0; i-- {
// wrap the current handler with the current interceptor
// create local variables scoped to the current loop iteration so
// they will be correctly captured.
currentHandler := handler
currentInterceptor := rest[i]
handler = func(ctx context.Context, req interface{}) (interface{}, error) {
return currentInterceptor(ctx, req, info, currentHandler)
}
}
// call the first interceptor with the wrapped handler
return first(ctx, req, info, handler)
}
}
// ChainStreamServerInterceptors takes 1 or more grpc.StreamServerInterceptors and
// chains them into a single grpc.StreamServerInterceptor. The first interceptor
// will be the outer most, while the last interceptor will be the inner most
// wrapper around the real call.
func ChainStreamServerInterceptors(first grpc.StreamServerInterceptor, rest ...grpc.StreamServerInterceptor) grpc.StreamServerInterceptor {
return func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
for i := len(rest) - 1; i >= 0; i-- {
// wrap the current handler with the current interceptor
// create local variables scoped to the current loop iteration so
// they will be correctly captured.
currentHandler := handler
currentInterceptor := rest[i]
handler = func(srv interface{}, stream grpc.ServerStream) error {
return currentInterceptor(srv, ss, info, currentHandler)
}
}
// call the first interceptor with the wrapped handler
return first(srv, ss, info, handler)
}
}
// NewGRPCDummyClientConnection returns an implementation of grpc.ClientConnInterface
// that always responds with "not implemented" error with the given error message.
func NewGRPCDummyClientConnection(message string) grpc.ClientConnInterface {
return &grpcDummyClientConnection{
message: message,
}
}
type grpcDummyClientConnection struct {
message string
}
// Invoke implements grpc.ClientConnInterface
func (g *grpcDummyClientConnection) Invoke(ctx context.Context, method string, args interface{}, reply interface{}, opts ...grpc.CallOption) error {
return trace.NotImplemented("%s: %s", method, g.message)
}
// NewStream implements grpc.ClientConnInterface
func (g *grpcDummyClientConnection) NewStream(ctx context.Context, desc *grpc.StreamDesc, method string, opts ...grpc.CallOption) (grpc.ClientStream, error) {
return nil, trace.NotImplemented("%s: %s", method, g.message)
}