* Add ability to read and list hosts. Tests to follow.
* Add tests for reading and listing as well as validation checks to not modify hosts.
* Add IpAddress and DnsNames to the api resource. Populate the plugin info.
* Adding go sdk tests for reading and listing hosts and ensuring update and deleting is disallowed.
This test started failing when the order of the list response changed.
Since the order does not matter, this test was updated to not depend on
the order.
Target subtypes must now implement another repository hook to validate
any CredentialLibraries that are being added/set. This allows for
subtypes to determine the valid set of CredentialLibraries.
For tcp.Targets only CredentialLibaries with
credential.ApplicationPurpose are allowed. If any other purpose is
provided an error is returned.
This change removes the hard-coded credential purpose for the Credential
Libraries. It also moves the logic of creating CredentialLibraries from
CredentialSources out of the repository and into the targets.Service.
This refactor will allow for additional credential purposes to be
supported in both the service and the repository.
This stores worker connection nonces within the database to ensure
uniqueness of connections. Prior the connection required any attacker to
be able to decrypt the incoming encrypted authentication message in
order to replay (and if the attacker has access to the KMS you have
bigger problems), but with this change even if an attacker does have
access to the KMS key, they cannot reuse the same message. (If they're
able to encrypt against the KMS key, they can still act as a worker with
a new message, so this only really helps if they only have decryption
capabilities.)
* refactor (oidc): Stop emitting error for not found token id
Stop emitting errors when authtoken repo.IssueAuthToken is called and
there's if no pending token. It's not an "normal" state and not
an error condition.
* feature (audit tagging): Add tags for auth method requests/responses
Including testing functions for asserting audit events created
when a service is called
For the target Repository's Create method, the options of
WithHostSources and WithCredentialSources where never used by the
targets.Service. As such the repository does not need to support these
options.
See: 51812ff779
* internal/libs/patchstruct: add package for patching structpb
This adds a small helper package for patching *structpb.Struct values
using the same patterns that our APIs use for updating records. The
intent of this package is to provide a fallback mechanism for working
with these values when said record update behavior is unavailable, such
as when working with plugin-based host subtypes where the exact
structure of the subtype's attributes is unavailable.
patchstruct.Patch follows the following logic:
* The source (src) map is merged into the destination map (dst).
* Values are overwritten by the source map if they exist in both.
* Values are deleted from the destination if they are set to null in the
source.
* Maps are recursively applied, meaning that a nested map at key "foo" in
the destination would be patched with a map at key "foo" in the
source.
* A map in the destination is overwritten by a non-map in the source,
and a non-map in the destination is overwritten by a map in the
source.
Patch returns the updated map as a copy, dst and src are not altered.
* Add doc comment for patchstruct.Patch
* vim snafu
* Premature commit of repository_host_catalog.go
* add nil cases
* internal/libs/patchstruct: add PatchJSON
* small comment formatting fix
* Change PatchJSON to PatchBytes
PatchJSON wasn't what was needed here - we need a helper to patch the
protobuf encoding of structpb.Struct.
* remove equality for original src/dst for patchbytes
* Add DB changes for host, set members, and host addresses for plugins.
* Add priority, address review feedback, update tests, naming, protos
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
Jeff Mitchell
Jim
Kevin Wang
Chris Marchesi
Todd
Hugo
Timothy Messier
Louis Ruch
Michael Gaffney
Oleg Butuzov
Pete Pacent
Brandon Romano