CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,158 Commits 7 Branches 2 Tags
330c5cca22b7b8adb66d2e9f93b277d015c73f4a
Commit Graph
332 Commits
Author SHA1 Message Date
Jim 2b3e50ebdd fix (listing): return all resources from listing requests (#3278) 2023-06-05 12:53:59 -04:00
Jim 5029be9999 fix: allow responses larger than the default 4194304 recv msg size (#3276) 2023-06-05 12:13:05 -04:00
Todd 2d102a61c5 HcpbWorkers no longer must be KMS workers for LookupHcpbWorkers (#3269) 2023-06-02 13:53:37 -07:00
Louis Ruch 281f217dcc feat(plugins): Refactor host plugins to boundary plugins (#3262) 2023-06-02 08:04:50 -07:00
Jim d4e537c88d chore: updgrade pgx direct deps to v5 (#3258) 2023-06-01 08:59:38 -04:00
Jeff Mitchell 3d5bed9ce8 Don't allow managed workers to be deleted (#3254) 
This also adds checks to ensure the tag cannot be added to workers via
the API.
 2023-05-31 14:23:57 -04:00
Timothy Messier f64f03ed46 fix(targets): Support authorize session request with target name (#3252) 
For requests to the target authorize session endpoint we support passing
a target name instead of an id. This means that `req.GetId()` might not
be the target's public id. Since the first thing authorize session does
includes retrieving the target as part of the authorization checks, this
subtype check can leverage the public id of the target instead of using
the request.

Fixes: 6178dd516e
 2023-05-31 11:25:03 -04:00
Todd fb1ea92a30 Pass both the control and data context into handle 2023-05-31 12:18:24 +00:00
Todd 6178dd516e Let a target subtype validate the authorize session's session state 2023-05-31 12:18:23 +00:00
Jim 21e4827178 fix(Upstream Msg): limit types used in tests 2023-05-31 12:18:23 +00:00
Jim 7dc15f1f39 fix(Upstream Msg): limit types supported in toMsgType(...) 2023-05-31 12:18:23 +00:00
Jim d49fde2299 feat(cli/session-recordings): add download cmd 2023-05-31 12:18:22 +00:00
Jim 9207ec08f2 feat: add request ctx stream interceptor 2023-05-31 12:18:22 +00:00
Jim 0c465706cc chore: increment base version to 0.13.0 2023-05-31 12:18:22 +00:00
Jeff Mitchell 18e59998e9 Add storage bucket worker filter handling 2023-05-31 12:18:18 +00:00
Todd 25d50d1077 Add tests for recording collection actions on scopes 2023-05-31 12:18:17 +00:00
Todd cfe0dc08d9 Add session recording service stuff 2023-05-31 12:18:17 +00:00
Todd 59ae4b5901 Expand the recorder manager interface 2023-05-31 12:18:15 +00:00
Johan Brandhorst-Satzkorn 328b039138 scopes: fix test expectation 2023-05-31 12:18:15 +00:00
Jim ac67b8d7f5 chore: fix typo in workerUpstreamMessageServiceServer godoc 2023-05-31 12:18:15 +00:00
Louis Ruch 1662445e8e feat(storage): Wire up storage buckets in session recording 2023-05-31 12:18:14 +00:00
Louis Ruch 8ea61054cd feat(storage): Add support for Storage Bucket API 2023-05-31 12:18:14 +00:00
Todd feb87e717e Add Closed error code and rename recorder cache to manager 2023-05-31 12:18:14 +00:00
Danielle Miu a4a14fc7fc merged commit for plugin rework, storage bucket sql and proto, storage bucket secret rewrapping, storage bucket repository 2023-05-31 12:18:13 +00:00
Johan Brandhorst-Satzkorn ad62df6b36 cluster: pass controller ext to authorize conn 
Make the controller extension availalbe to the protocol
context constructor.
 2023-05-31 12:18:13 +00:00
Johan Brandhorst-Satzkorn 5837d6f387 target: add PostSessionAuthorization callback 
The callback is called for any steps that need to be performed
after a successful authorization but before returning to the user.
 2023-05-31 12:18:13 +00:00
Johan Brandhorst-Satzkorn 13e1196797 target: add error handling to authorize session 
Attempt to undo operations if there are failures during
session authorization.
 2023-05-31 12:18:13 +00:00
Johan Brandhorst-Satzkorn 517fc91ebf target: return selected worker when authorizing 2023-05-31 12:18:13 +00:00
Johan Brandhorst-Satzkorn 6d219bd5d1 target: add controller extension to service handler 
The controller extension can be used to access types unavailable
in OSS.
 2023-05-31 12:18:13 +00:00
Todd bc48f2d0e0 Add monitor session job proto and controller changes 
This adds a new Job type that is for generic session state monitoring.  Monitoring sessions does not include any information about specific connections.
 2023-05-31 12:18:12 +00:00
Jim 4d60f42210 feat(bsr): add bsr kms support in config, dev and tests 2023-05-31 12:18:12 +00:00
Louis Ruch 798a1f952a feat(storage): Add support for storage plugins 2023-05-31 12:18:12 +00:00
Damian Debkowski 9ef94892f4 test(plugin): Support storage service in loopback plugin 2023-05-31 12:18:12 +00:00
Louis Ruch 351444f1bd refact(plugin): Move host loopback plugin into internal/plugin/loopback 2023-05-31 12:18:12 +00:00
Todd 4c801cca18 update the recording msg type enums 2023-05-31 12:18:12 +00:00
Todd e2a681a66a stop exporting registerUpstreamMessageTypeSpecifier 2023-05-31 12:18:11 +00:00
Todd dbe3473874 Add CreateChannel enum for upstream message handler 2023-05-31 12:18:11 +00:00
Jim 8cd0e8595f refact: split UpstreamMessageHandler into two interfaces 
Originally, UpstreamMessageHandler was used by
controllerUpstreamMessageServiceServer.UpstreamMessage to process
(aka handle) an upstream message and by SendUpstreamMessage to
send an upstream msg.

We split UpstreamMessageHandler into two interfaces so we can
register handlers independently of a senders.
 2023-05-31 12:18:11 +00:00
Jim 3995f2e6ae feat: add proper audit events for UpstreamMessage 
The upstream messages all basically looked the same; regardless
of which message was sent.  This PR adds DetailsUpstreamMessage to
audit events emitted by UpstreamMessage requests/response
 2023-05-31 12:18:11 +00:00
Jim c4b31313a6 feat (controller): define a ControllerExtension 2023-05-31 12:18:11 +00:00
Todd 68dc4da50e Add CloseConnectionRecording enums to the upstream message service 2023-05-31 12:18:11 +00:00
Johan Brandhorst-Satzkorn 7632143861 add session recording API definitions 2023-05-31 12:18:10 +00:00
Jim f9b45ca5b7 refact: extend registerControllerUpstreamMessageService to reg hdrs 
Extend registerControllerUpstreamMessageService to register upstream
message handlers
 2023-05-31 12:18:10 +00:00
Jim 9f01e1b3c1 refact: RegisterUpstreamMessageHandler stop returning dup err 
Stop returning an error if RegisterUpstreamMessageHandler is called
multiple times, since it provides little/no value and creates
invalid errors when more than one test controller is started across
all the unit tests.
 2023-05-31 12:18:10 +00:00
Jim 410bec1e00 feature(worker/controller): register UpstreamMessageServiceServer 2023-05-31 12:18:10 +00:00
Jim 20cf521cc0 feat(bsr): add bsr kms support in config, dev and tests 2023-05-31 12:18:10 +00:00
Jim a8574621c7 refact(tests): upstream msg tests for node enrollment chg 2023-05-31 12:18:10 +00:00
Louis Ruch def8e47f32 feat(storage): Add pluginInfo to storageBucket 2023-05-31 12:18:10 +00:00
Louis Ruch 52fbc6410c feat(storage): Add interface, options and errors 2023-05-31 12:18:09 +00:00
Jim b9cc441227 feature (handlers): add UpstreamMessageService and its oss impl. 
Define OSS protos for UpstreamMessageService rpc which defines a way
to send an upstream message to a controller (across multi-hops if
needed).

Implement OSS versions of both workers and controllers for the
UpstreamMessageService. The upstream requests/responses are encrypted
using the originating worker's NodeCredential's key.

The worker always forwards the request upstream.

The controller attends to find a registered UpstreamMessageHandler to
handle the msg; if none if found, then an Unimplemented status error
is returned.
 2023-05-31 12:18:09 +00:00