CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,130 Commits 7 Branches 2 Tags
ab4ed3c9e5ff755d00b6a5e9f9f2d0ed9aa35616
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ToddandJohan Brandhorst-Satzkorn 5ff3216565 Instead of relying on termination reason use status (#4852) 
* Instead of relying on termination reason use status

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
 2024-05-31 08:12:31 -07:00
Todd 98b5e3fa52 Close proxy listener if session is no longer active (#4850) 
* Close proxy listener if session is no longer active
 2024-05-30 16:12:17 -07:00
Todd 6cb7c74336 point to new api taged version (#4836) 2024-05-29 12:05:59 -07:00
Todd 6c378e7723 Create an option to set the session teardown timeout (#4834) 2024-05-29 10:23:23 -07:00
Todd e0a7c9acdd Document the deprecation of include_terminated (#4602) 
* Document the deprecation of include_terminated

* Update the changelog
 2024-05-24 12:04:08 -07:00
Todd 6936a5448c update status cli to optionally return some fields (#4810) 2024-05-22 09:51:58 -07:00
Todd 590182cf72 Updated the expected status code for unimplemented api errors. (#4802) 
* Updated the expected status code for unimplemented api errors.
 2024-05-15 12:48:09 -07:00
Todd e675aed978 Add the unimplemented api error. (#4799) 2024-05-14 15:03:36 -07:00
Todd 5a06e4fe66 Auto generate the permissions pages. (#4786) 
* Auto generate the permissions pages.

* Add add- set- remove- auto descriptions. Hide scope line when no scope provided

* Document the resource info struct
 2024-05-10 12:49:48 -07:00
Todd c3f9fde5d7 Wait to select tokens until we know we need to (#4794) 
AuthToken selection involves checking to seeing if the one we are picking has been canceled or expired on the boundary controller. If we are only searching locally and not performing a refresh, there is no need to check if the tokens have expired or not.
 2024-05-10 09:38:30 -07:00
Todd 3cae272c27 Hide ferry specific flags (#4737) 2024-04-26 13:48:56 -07:00
Todd 7ccc099807 Use the default retry limit across client cache (#4727) 2024-04-25 15:18:23 -07:00
Todd 7df9144fbf Fix typos in request validation errors for aliases (#4671) 
* Fix typos in request validation errors for aliases

* Add format validation for destination id field.
 2024-04-19 07:49:11 -07:00
Todd 55cf055285 Fix build and test breakage. (#4659) 2024-04-17 14:02:31 -07:00
Todd adea8e0f14 Change aliases to resolvable aliases in client cache (#4656) 2024-04-17 12:37:42 -07:00
Todd 608b6bb2b7 Add ListResolvableAliases SDK changes (#4653) 
* Add API changs for list resolvable aliases
 2024-04-17 11:13:08 -07:00
Todd 0d67b86543 Add ListResolvableAliases to the user service (#4609) 
* Add ListResolvableAliases to the user service

There are a few non common ways this method uses our ACL
and grant system. A user is able to list resolvable
aliases for another user if they are granted permission
to do so. That means we had to load the grants for
the user being listed for and not the requester when
determining if an alias is able to resolve to a destination
for which the requested user has permission.

Similarly, the grant hash used for the list pagination
is required to be that of the user being listed and not
the requester.
 2024-04-17 08:26:46 -07:00
ToddandJohan Brandhorst-Satzkorn 55fe70e643 Change 404 errors for aliases to 401s (#4575) 
* Change 404 errors for alias resolution to 401s
---------

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
 2024-03-27 16:14:49 -07:00
Todd 95c507fad5 Add hidden ferry commands and auto adding tokens to ferry daemon (#4572) 
* Add boundary ferry command (#4462)

* Add boundary ferry status (#4463)

* Add sending auth token automatically to ferry daemon (#4465)

* Hide ferry cmds, background error msgs, and dont retry background add-token requests (#4571)
 2024-03-25 15:04:13 -07:00
Todd c42a940332 Updating deps (#4537) 2024-03-25 10:09:44 -07:00
ToddandDanielle Miu 83e887e2f5 Updating changelog for 0.15.3 (#4515) (#4538) 
* Updating changelog for 0.15.3

* Update changelog for 0.15.2

---------

Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>
 2024-03-18 10:07:41 -07:00
Todd cb1e9b570b Add CLI flags for creating an alias with a target (#4512) 
* Add CLI flags for creating an alias with a target

* Add bats tests
 2024-03-15 09:36:34 -07:00
Todd c8d8736f49 Do not emit 404 errors when resolving aliases (#4518) 2024-03-13 14:25:33 -07:00
Todd 868228847d Add handler and API support for alias creation with target (#4508) 
* Add handler and API support for alias creation with target
 2024-03-12 13:57:47 -07:00
Todd 8d5ec21d73 Create aliases when creating a target in repo (#4504) 
* Create aliases when creating a target in repo
 2024-03-12 13:04:20 -07:00
Todd 13d07e51fd Don't log resource staleness when no refresh token is recorded (#4503) 2024-03-08 15:48:18 -08:00
Todd f7631edcab rename target2 import alias to talias (#4482) 2024-03-05 07:41:38 -08:00
Todd d5ae3d8dc6 fixup! Add aliases to the client cache daemon and make them searchable (#4418) 2024-02-29 15:52:27 -08:00
Todd 4bd38037b3 fixup! Create the alias service and resource (#4276) 2024-02-29 15:52:27 -08:00
Todd 240f86f0a9 fixup! Resolve aliases prior to subtype attribute transforming interceptor (#4379) 2024-02-29 15:52:27 -08:00
Todd ce250cbc57 fixup! Create the alias service and resource (#4276) 2024-02-29 15:52:27 -08:00
Todd deab1d5f17 fixup! Create the alias service and resource (#4276) 2024-02-29 15:52:27 -08:00
Todd a2ea1f8f90 Add aliases to the client cache daemon and make them searchable (#4418) 
* Add aliases to the client cache daemon and make them searchable
 2024-02-29 15:52:27 -08:00
ToddandIrena Rindos c8ca773f9f Add boundary connect alias bats tests (#4441) 
* Add boundary connect alias bats tests

Adding tests that validate the authorize-session requests when a host-id is provided when an alias is used, both configured and not configured with a host id already.

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
 2024-02-29 15:52:27 -08:00
Todd 24a2089db8 Add aliases to table format output for target reads (#4416) 2024-02-29 15:52:27 -08:00
Todd 305bb09c35 Treat alias values like other required fields in API and CLI (#4404) 
* Treat Alias values like other required fields in API and CLI

* Fix protoc versions since we recently rebased on main which uses updated version
 2024-02-29 15:52:27 -08:00
Todd a6c96d69ae Add TargetAliasAuthorizeSessionArgumentsHostId api options (#4397) 
* Add host id api option
 2024-02-29 15:52:27 -08:00
Todd 5a17c9cd39 Resolve aliases prior to subtype attribute transforming interceptor (#4379) 
* Resolve aliases prior to subtype interceptor
 2024-02-29 15:52:27 -08:00
Todd 203ea57165 Target aliases added to changelog (#4357) 
* Target aliases added to changelog
 2024-02-29 15:52:26 -08:00
Todd 78e10864c4 Add alias CLI CRUDL commands (#4353) 
* Add alias CLI CRUDL commands
 2024-02-29 15:51:24 -08:00
Todd 3f3b624b54 Add alias resolution to target service (#4277) 
* Add aliases to target resource and alias resolution to target service

* Wire up the target alias domain package to the target service handler

* Adding alias resolution to target api tests
 2024-02-29 15:51:24 -08:00
Todd 92181e272a Create the alias service and resource (#4276) 
* Create the alias service and resource

* Add alias generated API files and tests
 2024-02-29 15:51:24 -08:00
Todd e848e76b48 Create Alias Domain Object and Repo (#4275) 
* Create alias domain object resource

* Add paginated listing

* fixing ratelimit related panics

* Address reviewer comments

* remove NewAlias value checks
 2024-02-29 15:51:24 -08:00
ToddandIrena Rindos 7e2038bfcc Add alias schema changes (#4230) 
* Adding alias resource

* Update website/content/docs/install-boundary/system-requirements.mdx

---------

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
 2024-02-29 15:51:24 -08:00
Todd 53c95e1775 Extract out the setup of workers and targets to handle ent specific configurations (#4461) 2024-02-28 08:52:11 -08:00
Todd 366d9e95aa Add Error logging and hclog.Logger debug logging throughout the daemon (#4384) (#4439) 
* Save and assign hclogger throughout the client cache daemon

* Don't event for errors happening outside of the handlers or tickers.

* Hide and ignore -store-debug and expose the -log-level flag
 2024-02-22 10:20:48 -08:00
ToddandJim eb6d0dbd6a Use the intercepted token always. If the keyring matches, use it from there (#4355) 
* Use the intercepted token if present, use it through the keyring if keyring contains it

* fixup! Use the intercepted token if present, use it through the keyring if keyring contains it

* Apply suggestions from code review

Co-authored-by: Jim <jlambert@hashicorp.com>

---------

Co-authored-by: Jim <jlambert@hashicorp.com>
 2024-02-06 11:46:28 -08:00
Todd acabfd7f2c boundary daemon add-token to return returns 403 Forbidden when Boundary returns the same (#4345) 2024-02-02 12:24:14 -08:00
Todd d500f24014 fix: boundary authenticate returns an API error code when auth fails (#4342) 2024-01-31 15:11:28 -08:00
ToddandJohan Brandhorst-Satzkorn d6c9db968a Fix calculating uptime after system sleep (#4332) 
* Fix calculating uptime after system sleep

* Update internal/clientcache/internal/daemon/status_handler.go

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>

---------

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
 2024-01-31 12:31:43 -08:00
Todd 7e7e6369ae pass on the max search refresh timeout to server (#4321) 2024-01-29 15:38:45 -08:00
Todd 0705ed4e68 Do not try to autodiscover tokens when doing token lookups using provided tokens. (#4316) 2024-01-29 10:23:23 -08:00
ToddJeff MitchellJohan Brandhorst-Satzkorn
 		dde833e8cf Decrease number of flags shown for daemon/search (#4312) 
* Decrease number of flags shown for daemon/search
* Update changelog
---------

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
 2024-01-26 15:56:41 -08:00
Todd b734c43cda return error when creating table fails (#4305) 2024-01-26 10:46:29 -08:00
Todd e32a25f2a4 No longer enforce version matching between daemon and cli (#4271) 
* No longer check version matching between daemon and cli

* Add Log Service Handler and report if the daemon is running in background mode
 2024-01-24 16:26:15 -08:00
Todd d0eb670dcf s/Full Fetch/Recheck Support/ in logs and expose filter query param to search command (#4269) 
* s/Full Fetch/Recheck Support/  and expose filter query param to command
 2024-01-22 17:39:52 -08:00
Todd 0dac9005c1 Boundary auth without a keyring configured behaves like -keyring-type none (#4268) 2024-01-22 16:40:23 -08:00
Todd 30066c06f5 Add log location to the status output (#4260) 2024-01-22 08:42:19 -08:00
Todd b8f4e16ecf Fix flaky log rotation test (#4257) 
* Fix flaky log rotation test
 2024-01-18 14:44:53 -08:00
Todd 884a0cb1fc Fix daemon synopsis and command grouping (#4249) 2024-01-18 09:54:21 -08:00
Todd 962f9bd638 Pass in options to NewCommand call (#4248) 2024-01-17 16:41:28 -08:00
Todd 5056c93845 Fix typo (#4226) 2024-01-09 11:25:59 -08:00
Todd fa2dc80e36 Close the logfile at test cleanup (#4224) 2024-01-08 10:20:43 -08:00
Todd 0823e395a6 Give more time for worker to start up (#4223) 2024-01-05 16:19:00 -08:00
Todd f49ba4662c Add more logged events (#4206) 2024-01-05 07:43:21 -08:00
Todd c94a933578 Manually build the socket url (#4205) 2024-01-05 07:43:21 -08:00
Todd 36a8c6e289 Client cache: Update the default values timing issues (#4203) 2024-01-05 07:43:21 -08:00
Todd 40d9c3fd1d Paginate iam groups (#4194) 2024-01-05 07:43:21 -08:00
Todd 0fad770d8a Paginate iam user (#4185) 
* paginate iam user
 2024-01-05 07:43:21 -08:00
Todd a8c360ebf4 update mql dependency (#4191) 2024-01-05 07:43:21 -08:00
Todd e429e91bc4 Do not cache or allow searching for old controllers (#4136) 
* Do not cache or allow searching for old controllers

* Identify resourceless responses as coming from supported or unsupported controllers

* Do not report refresh token status info for unsupported controllers
 2024-01-05 07:43:21 -08:00
Todd d453a2a48a Check in client wrapper if cache daemon is already in use (#4172) 2024-01-05 07:43:21 -08:00
Todd 6f488d7c59 Evanulate if cache daemon should be skipped after the flags are parsed (#4168) 2024-01-05 07:43:21 -08:00
Todd 5aa560387c Add pagination for iam Roles (#4161) 
* Add pagination for iam Roles
 2024-01-05 07:43:21 -08:00
Todd 9ebb69f2a4 Add target type and session user_id as searchable (#4076) 
* Add target type and session user_id to search
 2024-01-05 07:43:21 -08:00
Todd 3558589c90 Return and consume InvalidListToken error code (#4141) 
* Return and consume InvalidListToken error code
 2024-01-05 07:43:20 -08:00
Todd 2d18f82c9f Rename refresh token errors to list error (#4138) 2024-01-05 07:43:20 -08:00
Todd a1bc2be136 Remove accidentally re-added refresh token files 2024-01-05 07:43:20 -08:00
Todd 9025e126fb Fix dependency that got reverted to older version 2024-01-05 07:43:20 -08:00
Todd deab274ec0 make gen 2024-01-05 07:43:20 -08:00
Todd 97f800d396 Fix rebase issues 2024-01-05 07:43:20 -08:00
Todd c74579cead Allow forced refresh attempt when searching (#4077) 
* Allow forced refresh attempt when searching
 2024-01-05 07:43:20 -08:00
Todd cdc6fb0973 Refresh specific resources before searching when they are stale (#4046) 
validate versions for all handlers. Refresh specific user before searching

Pass flags on to the background process

Allow the search refresh timeout to be configured
 2024-01-05 07:43:20 -08:00
Todd b3d268eae5 Include terminated sessions in the client cache (#4051) 2024-01-05 07:43:20 -08:00
Todd 8974606dea Remove auth token when it is not found (#4050) 2024-01-05 07:43:20 -08:00
Todd 9aab26e91b clientcache commands now can output curl strings (#4042) 2024-01-05 07:43:20 -08:00
Todd b71d134e06 Create Client and update Errors for client daemon commands (#4011) 
* Create a client cache daemon client

* Fix error formatting for the client cache cmds
 2024-01-05 07:43:20 -08:00
Todd 8af20349e7 update mql and clean search flags (#4030) 2024-01-05 07:43:20 -08:00
Todd f6b9162953 consistently expect snake case json values in token handler (#4015) 2024-01-05 07:43:20 -08:00
Todd a077be691c Add scope id and target id as searchable fields (#4012) 2024-01-05 07:43:20 -08:00
Todd 9448fc931e Search uses base.Client's token to perform the search (#4006) 2024-01-05 07:43:20 -08:00
Todd ab4ab0e8f9 Handle log rotation (#3948) 
* Handle log rotation
 2024-01-05 07:43:20 -08:00
Todd 71b09222ae Add status command to the boundary client cache (#3871) 
* Add status command to the boundary client cache
 2024-01-05 07:43:20 -08:00
Todd 3a7ea64a31 Add skip daemon flag and send recently authed tokens to daemon (#3883) 
* Add skip daemon flag and send recently authed tokens to daemon

* Rename flag skip-daemon to skip-cache-daemon

* adding option test

* move common.Options to base.Option

* SocketAddress returns *url.URL, fix search test
 2024-01-05 07:43:20 -08:00
Todd 2f7459fa40 Add FullFetch to resource updating ticker (#3947) 
* Add full fetch for controllers w/o refresh tokens
 2024-01-05 07:43:20 -08:00
Todd b2fec2e4f0 Store and use refresh tokens in the client cache (#3857) 
* Refresh resources using refresh tokens
 2024-01-05 07:43:20 -08:00
Todd 5daef58f54 SQLite allows having 1 set to MaxOpenConnections (#3941) 
* let sqlite have a single concurrent connection
 2024-01-05 07:43:20 -08:00
ToddJohan Brandhorst-SatzkornMichael Gaffney
 		5bfc8a88b1 Add indexes on update_time (#3974) 
* Add indexes on update_time

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
 2024-01-05 07:43:20 -08:00
Todd 86b2f4b90a Strongly type API resource for session recording creation time value attributes (#3480) 2023-07-19 08:46:58 -07:00
ToddandDan Heath 277f0a0035 Add new host discovery documentation layout (#3429) 
* Add new host discovery documentation layout

Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
 2023-07-18 12:18:51 -07:00