Merge pull request #4609 from Infisical/misc/allow-connecting-to-dbs-with-ssl-via-proxy

misc: allow connecting to PAM dbs with ssl via proxy

backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts

@@ -1,4 +1,5 @@
 import knex, { Knex } from "knex";
+import tls, { PeerCertificate } from "tls";
 
 import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
 import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
@@ -30,7 +31,12 @@ const getConnectionConfig = (
           ? {
               rejectUnauthorized: sslRejectUnauthorized,
               ca: sslCertificate,
-              servername: host
+              servername: host,
+              // When using proxy, we need to bypass hostname validation since we connect to localhost
+              // but validate the certificate against the actual hostname
+              checkServerIdentity: (hostname: string, cert: PeerCertificate) => {
+                return tls.checkServerIdentity(host, cert);
+              }
             }
           : false
       };
@@ -114,6 +120,10 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
           return connectionDetails;
         }
 
+        if (error.message.includes("no pg_hba.conf entry for host")) {
+          return connectionDetails;
+        }
+
         if (error.message === "Connection terminated unexpectedly") {
           throw new BadRequestError({
             message: "Connection terminated unexpectedly. Verify that host and port are correct"

frontend/src/components/projects/NewProjectModal.tsx

@@ -80,11 +80,11 @@ const PROJECT_TYPE_MENU_ITEMS = [
   {
     label: "Secret Scanning",
     value: ProjectType.SecretScanning
+  },
+  {
+    label: "PAM",
+    value: ProjectType.PAM
   }
-  // {
-  //   label: "PAM",
-  //   value: ProjectType.PAM
-  // }
 ];
 
 const NewProjectForm = ({ onOpenChange }: NewProjectFormProps) => {

frontend/src/pages/pam/PamSessionsByIDPage/components/PamSessionLogsSection.tsx

@@ -69,7 +69,18 @@ export const PamSessionLogsSection = ({ session }: Props) => {
           })
         ) : (
           <div className="flex w-full grow items-center justify-center text-bunker-300">
-            No session logs
+            {session.startedAt && session.endedAt ? (
+              <div className="text-center">
+                <div className="mb-2">Session logs are not yet available</div>
+                <div className="text-xs text-bunker-400">
+                  Logs will be uploaded after the session duration has elapsed.
+                  <br />
+                  If logs do not appear after some time, please contact your Gateway administrators.
+                </div>
+              </div>
+            ) : (
+              "No session logs"
+            )}
           </div>
         )}
       </div>

helm-charts/infisical-gateway/Chart.yaml

@@ -15,10 +15,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.0.1
+version: 1.0.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.0.1"
+appVersion: "1.0.2"

helm-charts/infisical-gateway/values.yaml

@@ -1,6 +1,6 @@
 image:
   pullPolicy: IfNotPresent
-  tag: "0.42.3"
+  tag: "0.43.0"
 
 secret:
   # The secret that contains the environment variables to be used by the gateway, such as INFISICAL_API_URL and TOKEN