3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-06 10:21:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

ssh: rework cached record invalidation (#5688)

Browse source 
Add an additional method to the ssh.Evaluator interface for invalidating
cached databroker records. Invalidating the global cache is not
sufficient, because there may be sync queriers as well.

Make sure to invalidate the User record (in addition to the Session 
record) during the login flow.
This commit is contained in:
Kenneth Jenkins 2025-07-02 12:21:39 -07:00 • committed by GitHub
parent 177677f239
commit 8463020e68
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 14 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
authorize/ssh_grpc.go
View file

@ -12,8 +12,10 @@ import (
extensions_ssh "github.com/pomerium/envoy-custom/api/extensions/filters/network/ssh"
"github.com/pomerium/pomerium/authorize/evaluator"
"github.com/pomerium/pomerium/internal/log"
"github.com/pomerium/pomerium/pkg/grpc/databroker"
"github.com/pomerium/pomerium/pkg/grpc/user"
"github.com/pomerium/pomerium/pkg/ssh"
"github.com/pomerium/pomerium/pkg/storage"
)
func (a *Authorize) ManageStream(stream extensions_ssh.StreamManagement_ManageStreamServer) error {
@ -129,3 +131,7 @@ func (a *Authorize) EvaluateSSH(ctx context.Context, req *ssh.Request) (*evaluat
return res, nil
}
func (a *Authorize) InvalidateCacheForRecords(ctx context.Context, records ...*databroker.Record) {
storage.InvalidateCacheForDataBrokerRecords(a.withQuerierForCheckRequest(ctx), records...)
}

19
pkg/ssh/auth.go
View file

@ -27,12 +27,12 @@ import (
"github.com/pomerium/pomerium/pkg/identity"
"github.com/pomerium/pomerium/pkg/identity/manager"
"github.com/pomerium/pomerium/pkg/policy/criteria"
"github.com/pomerium/pomerium/pkg/storage"
)
type Evaluator interface {
EvaluateSSH(context.Context, *Request) (*evaluator.Result, error)
GetDataBrokerServiceClient() databroker.DataBrokerServiceClient
InvalidateCacheForRecords(context.Context, ...*databroker.Record)
}
type Request struct {
@ -271,7 +271,7 @@ func (a *Auth) DeleteSession(ctx context.Context, info StreamAuthInfo) error {
return err
}
err = session.Delete(ctx, a.evaluator.GetDataBrokerServiceClient(), sessionID)
a.invalidateCacheForRecord(ctx, &databroker.Record{
a.evaluator.InvalidateCacheForRecords(ctx, &databroker.Record{
Type: "type.googleapis.com/session.Session",
Id: sessionID,
})
@ -313,27 +313,20 @@ func (a *Auth) saveSession(
}
}
u.PopulateFromClaims(claims.Claims)
_, err := databroker.Put(ctx, a.evaluator.GetDataBrokerServiceClient(), u)
resp, err := databroker.Put(ctx, a.evaluator.GetDataBrokerServiceClient(), u)
if err != nil {
return err
}
a.evaluator.InvalidateCacheForRecords(ctx, resp.GetRecord())
resp, err := session.Put(ctx, a.evaluator.GetDataBrokerServiceClient(), sess)
resp, err = session.Put(ctx, a.evaluator.GetDataBrokerServiceClient(), sess)
if err != nil {
return err
}
a.invalidateCacheForRecord(ctx, resp.GetRecord())
a.evaluator.InvalidateCacheForRecords(ctx, resp.GetRecord())
return nil
}
func (a *Auth) invalidateCacheForRecord(ctx context.Context, record *databroker.Record) {
ctx = storage.WithQuerier(ctx,
storage.NewCachingQuerier(
storage.NewQuerier(a.evaluator.GetDataBrokerServiceClient()),
storage.GlobalCache))
storage.InvalidateCacheForDataBrokerRecords(ctx, record)
}
func (a *Auth) getAuthenticator(ctx context.Context, hostname string) (identity.Authenticator, error) {
opts := a.currentConfig.Load().Options

2
pkg/ssh/auth_test.go
View file

@ -446,6 +446,8 @@ func (f fakePolicyEvaluator) GetDataBrokerServiceClient() databroker.DataBrokerS
return f.client
}
func (f fakePolicyEvaluator) InvalidateCacheForRecords(_ context.Context, _ ...*databroker.Record) {}
type fakeDataBrokerServiceClient struct {
databroker.DataBrokerServiceClient