* Add ability to read and list hosts. Tests to follow.
* Add tests for reading and listing as well as validation checks to not modify hosts.
* Add IpAddress and DnsNames to the api resource. Populate the plugin info.
* Adding go sdk tests for reading and listing hosts and ensuring update and deleting is disallowed.
This stores worker connection nonces within the database to ensure
uniqueness of connections. Prior the connection required any attacker to
be able to decrypt the incoming encrypted authentication message in
order to replay (and if the attacker has access to the KMS you have
bigger problems), but with this change even if an attacker does have
access to the KMS key, they cannot reuse the same message. (If they're
able to encrypt against the KMS key, they can still act as a worker with
a new message, so this only really helps if they only have decryption
capabilities.)
* refactor (oidc): Stop emitting error for not found token id
Stop emitting errors when authtoken repo.IssueAuthToken is called and
there's if no pending token. It's not an "normal" state and not
an error condition.
* feature (audit tagging): Add tags for auth method requests/responses
Including testing functions for asserting audit events created
when a service is called
For the target Repository's Create method, the options of
WithHostSources and WithCredentialSources where never used by the
targets.Service. As such the repository does not need to support these
options.
See: 51812ff779
* internal/libs/patchstruct: add package for patching structpb
This adds a small helper package for patching *structpb.Struct values
using the same patterns that our APIs use for updating records. The
intent of this package is to provide a fallback mechanism for working
with these values when said record update behavior is unavailable, such
as when working with plugin-based host subtypes where the exact
structure of the subtype's attributes is unavailable.
patchstruct.Patch follows the following logic:
* The source (src) map is merged into the destination map (dst).
* Values are overwritten by the source map if they exist in both.
* Values are deleted from the destination if they are set to null in the
source.
* Maps are recursively applied, meaning that a nested map at key "foo" in
the destination would be patched with a map at key "foo" in the
source.
* A map in the destination is overwritten by a non-map in the source,
and a non-map in the destination is overwritten by a map in the
source.
Patch returns the updated map as a copy, dst and src are not altered.
* Add doc comment for patchstruct.Patch
* vim snafu
* Premature commit of repository_host_catalog.go
* add nil cases
* internal/libs/patchstruct: add PatchJSON
* small comment formatting fix
* Change PatchJSON to PatchBytes
PatchJSON wasn't what was needed here - we need a helper to patch the
protobuf encoding of structpb.Struct.
* remove equality for original src/dst for patchbytes
* Add DB changes for host, set members, and host addresses for plugins.
* Add priority, address review feedback, update tests, naming, protos
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* website: use canary release of open-api-page
* website: bump to latest open-api-page pre-release
* chore: bump to latest open-api-page pre-release
* chore: refresh package files from main to avoid conflicts
* bump to stable open-api-page release
Now that subtypes are registered via sub-packages, this TargetType is
not needed and should not be used. This removes it and updates the
target.Repository and targets.Service to use the updated code.
This was missed in eac433f7ff.
* refactor (controller): Use a grpc server for the grpc-gateway
This starts a grpc server for the grpc-gateway. The new gateway
server uses an in-memory listener which also supports "dialing", so
the http proxy can connect to the in-memory listener.
This change allows us to use all grpc server features and was in part
motivated by a need for an interceptor of inbound requests. With that
said, having a "proper" grpc server for the gateway will provide a lot
more flexibility and capabilities moving forward.
The request context will still be verified via middleware in the
http proxy (see wrapHandlerWithCommonFuncs). This verified context
will be serialized into a protobuf and sent along to the grpc-gateway
via metadata where an interceptor will add the verified request
info to the request's context (see requestCtxInterceptor). The
interceptor will verify the serialized request info via a shared ticket
with it's companion in-memory http proxy. FYI: the ticket is simply
random base62 string (see db.NewPrivateId).
This change also necessitated a minor change to services. We need to
return an empty response instead of nil, nil when there are no errors
and the response is empty.
* refactor (handlers): Rename gRPC Gateway filter
Originally, this was called an OutgoingInterceptor, which is an
unfortunate name since it's not an interceptor. Now that we're
refactoring the gateway stuff and have proper interceptors, renaming
this should remove ambiguity
* refactor: Rework how 204 with empty msg is handled
Recent changes to grpc gateway has necessitated a change to how
204s are handled by the gateway
* tests (bats): Check status codes for delete operations
This moves all of the tcp target functionality into a tcp package. It
also establishes a Register function in the target package to allow
specific target types to be registered at initilazation time. When
registering, a target type needs to provide its Subtype, as well as some
RepositoryHooks that are used by the target Repository.
When creating or updating a target, the following fields should have
been marked as output only:
- host_set_ids
- host_source_ids
- application_credential_source_ids
- application_credential_library_ids
This updates the protobuf and generated files including the swagger file
used by the docs site to correctly mark these are output only.
Fixes#1588
This puts it more in line with other upcoming options that use "dir"
instead of "directory" (plus it's easier to type), and makes it clear
that this directory and the passthrough behavior is related to the UI as
opposed to other upcoming items.
Todd
Jeff Mitchell
Jim
Timothy Messier
Michael Gaffney
Chris Marchesi
Louis Ruch
Oleg Butuzov
Pete Pacent
Brandon Romano
Zachary Shilton
Noel Quiles
