CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
911 Commits 7 Branches 2 Tags
942fa7bc9ce703add12ff9fd845deffe613fcbf9
Commit Graph
569 Commits
Author SHA1 Message Date
Jeff Mitchell b8a953ba53 Add anon listing test 2021-02-04 16:02:20 -05:00
Louis Ruch 178d4efa64 ICU-745/Refactor internal/session to new domain errors (#877) 
* Refactor internal/sessions to use domain errors
 2021-02-03 16:25:56 -08:00
s-christoff 81785e139f [enhancement] Refactor authtoken repo to return domain specific errors (#876) 2021-02-03 17:34:46 -06:00
Jeff Mitchell 61ec5b47e4 When running single-server mode, use public_cluster_addr if given (#904) 
When running single-server mode, use public_cluster_addr if given

Right now you don't need to specify a controller address and we use the
cluster listener address; this allows overriding it to the
public_cluster_addr if one is given.

If `controllers` is specified we allow it to be either the cluster
listener or the public cluster address if one is specified before trying
to parse and use it.
 2021-02-03 08:58:42 -05:00
Jeff Mitchell 7cf74596bf Update info output key name 2021-02-02 18:42:52 -05:00
Todd Knight 02cd972043 Create Sessions List Self Action (#888) 2021-02-02 13:37:32 -07:00
Louis Ruch 06c59e19bd Add worker filter to create target tests (#899) 2021-02-02 11:03:47 -08:00
Randall Morey e324d23a44 chore: bump ui commitish to latest from boundary-ui/main (#895) 
* chore: bump ui commitish to latest from boundary-ui/main

* fix: bump UI version to fix scopes nav bug
 2021-01-29 15:44:49 -05:00
Jeff Malnick 10a5f1b832 test: add tests for authorized-action (#893) 2021-01-29 08:04:46 -08:00
Todd Knight 57d4bf2bfd Removing dev migration feature and checks (#892) 2021-01-28 19:28:31 -07:00
Todd Knight 955ae41215 Support upgrading from old migration table name (#889) 2021-01-28 14:30:08 -07:00
Jeff Mitchell 3461dcbd0c Remove down and dev migrations (#890) 
* Remove down and dev migrations

This won't be the pattern going forward, so this removes these from the
code.
 2021-01-28 16:12:14 -05:00
Jeff Mitchell 54b9c8c3dc Add perms-table to make gen and commit migrations update 2021-01-28 08:56:55 -05:00
Todd Knight d2bb8820ea Wrap postgres up migrations into a single transaction (#887) 2021-01-27 15:58:22 -07:00
Jim 1c744c28ab oidc schema changes. (#874) 2021-01-27 10:55:28 -05:00
Jim f7aad2e0c8 add a new oidc key+ key version for encrypting oidc state payloads returned in auth URLs. (#884) 2021-01-26 14:37:10 -05:00
Jeff Mitchell 6cd97a4a6e Add support for recursive listing (#885) 2021-01-25 19:37:40 -05:00
Todd Knight 1f9fcad1cd Adding Migrate Command (#872) 2021-01-25 14:43:50 -07:00
Jeff Mitchell 6b58a3317d Add recursive listing to roles (#881) 
This also lays the framework for adding recursive listing to the rest of the resources.
 2021-01-23 13:39:04 -05:00
Jeff Mitchell 0629526319 Add read/list/cancel:self actions and support for ACL subactions. (#882) 
Update perms table in anticipation of session support for these.
 2021-01-22 16:38:19 -07:00
Louis Ruch 558f9220a5 ICU-744/Refactor internal/target to new domain errors (#865) 
* Refactor internal/target to new domain errors
 2021-01-22 13:46:20 -08:00
Jeff Mitchell ee33a18caa Add scope repo function to recursively list (#879) 
A simple function that returns an appropriate set of scopes based on the
incoming scope ID. Includes a test.
 2021-01-21 21:03:30 -05:00
Jeff Mitchell 526e24cd19 Goimports reordering 2021-01-21 17:04:01 -05:00
Jeff Mitchell 717a3b52ee Add worker tagging (#862) 
This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.
 2021-01-21 16:27:20 -05:00
Todd Knight 595a86508e Fix lockup when initalizing database. (#875) 2021-01-20 18:10:45 -07:00
Jeff Mitchell 46644300d9 Switch to execabs for os/exec in connect cmd (#873) 
* Switch to execabs for os/exec in connect cmd

This is more of an abundance-of-caution change (e.g. defense in depth)
but it doesn't seem like we should be using binaries from the current
directory for `boundary connect` executions (unless given an explicit
path).

* Update changelog
 2021-01-20 12:09:55 -05:00
Jeff Mitchell dcb15cffbd Add authorized actions output on resources (#870) 2021-01-20 10:53:01 -05:00
Todd Knight ec6151d174 Organize DB Schema Migration Code and DB Init Checks (#842) 
Create Schema Manager and propagate contexts into the DB calls downstream.
Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.
 2021-01-19 10:40:41 -07:00
Louis Ruch 84656dbfea ICU-747,ICU-748/refactor internal/oplog and internal/perms to use domain errors (#854) 
* Refactor internal/oplog to domain errors

* Refactor internal/perms

* Update changelog
 2021-01-13 15:50:07 -08:00
Jeff Mitchell 27919ab11b Groundwork for returning authorized actions (#860) 
This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.
 2021-01-13 14:42:37 -05:00
Louis Ruch 8151b30ce9 ICU-743/Domain errors internal/kms refactor (#848) 
* Domain errors internal/kms refactor

* Update changelog

* Update internal/host error op

* Incorrect error returned in read_writer
 2021-01-12 08:50:19 -08:00
Jeff Mitchell 9de928318d Skip curl output when using automatic versioning and reading (#858) 
This makes it so that the actual output is the update/delete.

Fixes #856
 2021-01-08 17:30:41 -05:00
Jeff Mitchell 84c617dc49 Run make gen after the gofumpt update 2021-01-08 10:32:02 -05:00
Michael GaffneyandJeff Mitchell 94cb79bbdd See how Boundary would look with gofumpt applied (#853) 
* See how Boundary would look with https://github.com/mvdan/gofumpt applied

Results of running `gofumpt -w -s .`

* Update tools file and Makefile for gofumpt

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-01-07 10:02:32 -05:00
Louis Ruch dbc796759b ICU-934/Verify controller config block (#851) 
* Verify controller config block

* update changelog
 2021-01-06 10:41:38 -08:00
Louis Ruch 4e31fdb10e Swap assert.Eqaul actual/expected (#849) 2021-01-05 17:34:04 -08:00
Jeff Mitchell 5b5602969f Update go-keyring to use forked version (#846) 
This may help with #830.
 2021-01-04 21:05:42 -05:00
Jeff Mitchell 6580d85388 Remove erronious IsGlobalUnicast check. (#845) 
Fixes the issue raised at https://www.boundaryproject.io/docs/configuration/worker#complete-configuration-example
 2021-01-02 19:49:39 -05:00
Louis Ruch 70a5899e99 ICU-739/iam domain error refactor (#841) 
* Refactor iam errors

* Update db and host doTx error ops

* Changelog
 2020-12-23 11:00:00 -08:00
Louis Ruch bfbb179741 ICU-738/Refactor internal/db to domain errors (#815) 
* Refactor internal/db to domain errors
 2020-12-21 10:07:34 -08:00
Jeff Mitchell b5d84495a3 Fix IDs being lowercased in role grants (#839) 
Fix IDs being lowercased in role grants

Fixes #794
 2020-12-18 13:25:28 -05:00
Jeff Mitchell e6c98f1454 Add logic to error on certain invalid listener configs (#838) 
This adds logic to error on certain invalid listener config:

* If an address in the worker's "controller" set is unspecified or
multicast or global unicast, error
* If the controller's cluster address is unspecified, ensure
public_cluster_addr is set

This has been a source of some confusing behavior on some GitHub tickets
and even on the team, so preventing it is probably a good idea.

It also relaxes the restriction around controller address matching cluster address in single-server mode when using DNS names.
 2020-12-18 12:12:25 -05:00
Jeff Mitchell 16f7dc1c96 Update connect unauthorized message to give a bit more detail 2020-12-17 11:06:01 -05:00
Jeff Mitchell 8b39faef1b Rearrange some auth logic and add some opts useful for filtering/testing (#835) 2020-12-17 10:30:40 -05:00
Jeff Mitchell a6cca576a3 Attempt canceling sessions by the client (#831) 
* Attempt canceling sessions by the client

In some circumstances (like a Ctrl-C), the client knows it's shutting
down and the TOFU token will be lost. In this case it makes sense to
cancel the session rather than have it time out. This introduces a
command enum to the handshake message which can be used for the client
to send commands to the worker -- in this case the only specified
command is to cancel the session. It doesn't occur if the session is
already timed out or if we can't authorize connections as this generally
means the session is already invalid.
 2020-12-16 17:14:47 -05:00
Jeff Mitchell 11b821a200 Bump deps (#818) 2020-12-15 14:56:41 -05:00
Jeff Mitchell b809d3f12a Add kube connect subcommand (#816) 2020-12-14 16:52:11 -05:00
Jeff Mitchell 9a84e50493 Minor linting 2020-12-09 17:05:16 -05:00
Jeff Mitchell 833f29e352 Switch connection limit for default target to -1 (#814) 
This makes the initial testing workflow less confusing for users
 2020-12-09 16:05:48 -05:00
Jeff Mitchell d4a6efb363 Pass endpoint to the client (#811) 
This allows us to automatically set TLS parameters, useful for `boundary
connect http` and some other features to come.
 2020-12-09 14:45:53 -05:00