CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,408 Commits 7 Branches 2 Tags
b7684a857af28f51bf448d0c2a1321e8968bd1f9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Louis Ruch b7684a857a feat(ssh): Use HostId as HostKeyAlias for connect ssh helper (#2490) 2022-09-22 17:51:30 -07:00
Louis Ruch b78d83e242 log(vault): Log formatted duration instead of nanoseconds (#2481) 2022-09-21 12:04:29 -07:00
Louis Ruch 42696d5da6 enos(smoke): Test brokered credential consumption instead of manually (#2456) 
passing private key to boundary connect
 2022-09-16 15:41:38 -07:00
Louis Ruch c73a13aa3e scheduler: log details when starting scheduler (#2459) 2022-09-15 11:44:45 -07:00
Louis Ruch 506fdfa5c3 cli(ssh): Do not print private key if consumed (#2451) 2022-09-14 12:46:34 -07:00
Louis Ruch 50490d71ae chore(targets): Improve help and errors around ssh targets (#2445) 2022-09-13 13:05:36 -07:00
Louis Ruch b908cfb860 chore: prep for next release 2022-09-13 10:16:48 -07:00
Louis Ruch 5812a42ba3 feat(scheduler): set intervals from config (#2443) 2022-09-13 10:01:49 -07:00
Louis Ruch cb8a541b02 chore: prep for next release 2022-09-07 11:38:55 -07:00
Louis Ruch d7c4c648ec bug(vault): Correctly handle credential stores with expired tokens (#2399) 
* bug(vault): Correctly handle credential stores with expired tokens

Boundary makes use of a database view to perform CRUD operations on
Vault credential stores and libraries. This view did not include
credential stores with tokens that have expired in Vault, causing
errors when attempting to perform any action against them.
 2022-09-06 07:50:15 -07:00
Louis Ruch 929a385fdb fix: move 'drop target_all_subtypes' after whx views 2022-08-24 09:33:37 -07:00
Louis Ruch 564affa294 chore: Add 0.10.2 changelog 2022-08-23 15:36:27 -07:00
Louis Ruch 66d536eb5d chore: prep for next release 2022-08-11 15:59:11 -07:00
Louis Ruch 5b3672536e chore: prep for next release 2022-08-11 14:34:00 -07:00
Louis Ruch d01f374490 bug(db): Fix credential purpose migration (#2351) 
* bug(db): Fix credential purpose migration
 2022-08-11 10:41:48 -07:00
Louis Ruch ad9a47a7f9 chore: update changelog for release 2022-08-09 15:40:30 -07:00
Louis Ruch 7fafadd70b db: Add credential_sha256 to session_credentials (#2339) 
* db: Add credential_sha256 to session_credentials
 2022-08-08 18:54:42 -07:00
Louis Ruch dcccaf1bcf bug(cmd): Ensure RunShutdownFuncs is called when an early error occurs (#2333) 
* bug(cmd): Ensure RunShutdownFuncs is called when an early error occurs
 2022-08-08 09:13:47 -07:00
Louis Ruch 82a39f8582 chore: update api/sdk deps 2022-08-05 13:22:20 -07:00
Louis Ruch 53dbd51f14 Only consume ssh brokered credentials if the target is tcp (#2323) 2022-08-05 10:22:07 -07:00
Louis Ruch 9b6b767edb chore: Update changelog 2022-08-03 10:20:59 -07:00
Louis Ruch fc25178827 bug(server): Start ops listener even if controller is nil (#2314) 2022-08-02 17:18:09 -07:00
Louis Ruch 47739566bc bug(vault): Fix token len check (#2291) 2022-07-25 11:08:06 -07:00
Louis Ruch 5c80942453 docs(credentials): Update website domain docs (#2287) 2022-07-25 10:12:10 -07:00
Louis Ruch 52c1a4f9f9 feat(targets): Support extraWorkerFilterFunc in target 2022-07-22 14:50:57 -07:00
Louis Ruch d6c1402223 bug(cli): Correctly generate private key file (#2274) 2022-07-21 15:07:01 -07:00
Louis Ruch 7d1a989ea7 feat(cli): Support using brokered private key in ssh subcommand (#2267) 
* feat(cli): Support using brokered private key in ssh subcommand
 2022-07-20 15:17:15 -07:00
Louis RuchandJeff Mitchell a17e973712 feat(credentials): Refactor credential purposes (#2260) 
* feat(credentials): Refactor credential purposes

 * Application credentials have been refactored to Brokered credentials
 * Egress credentials have been refactored to Injected Application
credentials

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2022-07-19 15:16:24 -07:00
Louis Ruch ef5ac07f02 Add ssh_private_key support for Vault libraries and targets (#2263) 
* Add support for ssh_private_key credential type in Vault libraries

* Add support for ssh_private_key credential type

* Support jsonpointer for Vault library mapping overrides
 2022-07-19 10:31:53 -07:00
Louis Ruch 4cacd0a605 bug(scheduler): Fix controller id length check (#2226) 
* bug(scheduler): Fix controller id length check

The job_run table has a foreign key to the server_controller private_id.
While this column is called a prviate_id it does not implement the wt_private_id
postgres domain type, and therefore does not have a minimum length of 10 characters.
 2022-06-22 13:20:27 -07:00
Louis Ruch 07406c2d18 chore(release): prep for next release 2022-06-20 12:26:22 -07:00
Louis Ruch 08c2e71272 chore(release): prep changelog for release 2022-06-18 13:49:28 -07:00
Louis Ruch 26bc992f38 chore(release): Update API and SDK deps 2022-06-16 17:27:17 -07:00
Louis Ruch 9671daf6e0 Revert "refactor(user_passsword) change all references of user_password into username_password (#2189)" 
This reverts commit ab58b24142.
 2022-06-16 11:11:39 -07:00
Louis Ruch 618bcb451e fix(target): fix type check (#2202) 2022-06-15 14:14:24 -07:00
Louis Ruch 5ef9496e0a feat(cli): Support credential brokering with sshpass (#2191) 2022-06-15 09:30:45 -07:00
Louis Ruch 68eb6e2bed chore(targets): remove deprecated credential libraries on target resources (#1533) 2022-06-15 08:56:24 -07:00
Louis Ruch b5a4dd0b44 Merge pull request #2174 from hashicorp/llb-static-credential-store 
Static Credential Store
 2022-06-14 13:20:50 -07:00
Louis Ruch 631de0e5e2 chore(changelog): Update changelog 2022-06-14 13:04:35 -07:00
Louis Ruch 4b365db634 feat(target): Add support for static credentials during authorize-session 2022-06-14 13:04:35 -07:00
Louis Ruch c14fe05036 feat(credential): Add support for retrieving static credentials 2022-06-14 13:04:28 -07:00
Louis Ruch 58d9d42a88 feat(session): Add support for session static credentials 2022-06-14 13:01:17 -07:00
Louis Ruch 00dfea1244 feat(target): Add support for static credential as target credential sources 2022-06-14 13:01:17 -07:00
Louis Ruch 58d546cdd4 feat(credential): Add static credential store and username_password credential 2022-06-14 13:01:17 -07:00
Louis Ruch b6ca61a7f6 refact(cred-libs): Update user_password to username_password (#2154) 
* refact(cred-libs): Update user_password to username_password
 2022-06-13 09:01:01 -07:00
Louis Ruch 9663404f1a feat(scheduler): Support unlimited job runs (#2173) 2022-06-11 13:23:28 -07:00
Louis Ruch c4285b29cc fix(target): Correctly return egress credentials assocaited with target (#2167) 2022-06-10 12:26:19 -07:00
Louis Ruch 6f4cee88bf fix(vault_store): Correctly return expected errors (#2081) 
* fix(vault_store): Correctly return errors
 2022-05-17 12:20:01 -07:00
Louis Ruch 9b48dbc2fd fix(logs): Remove erroneous scheduler run logs at first run. (#1980) 
The Scheduler is dependant on the server being inserted into the
database. Adding an upsert server call before starting scheduler
and tickers removes the race that caused log spam due to a missing
foreign key relationship.
 2022-04-12 08:17:14 -07:00
Louis Ruch e6b7b7f60a feat(db): Suppress not found events during db lookups (#1979) 2022-04-08 18:04:12 -07:00
Louis Ruch f8b27645d9 fix(scheduler): Update job run query to not error on running conflict (#1914) 2022-03-11 15:11:14 -08:00
Louis Ruch 4ed4575802 chore(fmt): make fmt 2022-02-16 15:52:37 -08:00
Louis Ruch 64fd93e088 chore(release): Bump API version and changelog for 0.7.5 2022-02-16 15:35:03 -08:00
Louis Ruch 8cab9a4315 feat(scheduler): Update job description on conflict (#1852) 2022-02-11 17:20:19 -08:00
Louis Ruch aaaf0241ff bug(host): Fix sync job failure blocking other set syncs (#1841) 
During the plugin_host_set_sync job, a single set failing to  sync
can cause all following syncs to fail.
 2022-02-04 12:02:37 -08:00
Louis Ruch 74e2bcdb52 chore(release): Bump website version to 0.7.4 2022-01-18 11:48:25 -08:00
Louis Ruch 221acff4cc chore(release): Bump Boundary version to 0.7.4 2022-01-13 14:22:47 -08:00
Louis Ruch ecbeab9035 chore(release): bump api/sdk versions 2022-01-13 14:22:37 -08:00
Louis Ruch 61fe77572e chore: make tools & make gen 2022-01-13 14:03:46 -08:00
Louis Ruch ac78ee6315 Merge pull request #1819 from hashicorp/louis-scheduler 
feat(scheduler): Add support for run now option
 2022-01-13 12:22:06 -08:00
Louis Ruch c4506ec743 feat(scheduler): Add support for run now option 2022-01-13 11:51:53 -08:00
Louis Ruch f8b2e99e11 Merge pull request #1815 from hashicorp/louis-decode-type 
feat(target): Decode based on credential type
 2022-01-10 10:45:26 -08:00
Louis Ruch a90f1f4eb1 feat(target): Decode based on credential type 2022-01-10 09:57:27 -08:00
Louis Ruch 58aca600a4 Merge pull request #1804 from hashicorp/louis-egress 
Egress credentials
 2021-12-17 12:51:01 -08:00
Louis Ruch 425a56179f feat(worker): Implement egress credentials 
Egress credentials Issued during AuthorizeSession are stored in the
session repo. These credentials are retrieved and stored in-memory on the
worker during the LookupSession call. Each proxy handler will need to
handle the credentials as required.
 2021-12-17 11:27:10 -08:00
Louis Ruch 5fe23ab14d feat(session): Store session credentials 
Creates a new session_credential table and repository functions
to add and list credentials attached to a session. All credentials
are encrypted using the session scope id.
 2021-12-17 11:26:52 -08:00
Louis Ruch ff3be7a74b Merge pull request #1802 from hashicorp/louis-recover 
feat(server): Add grpc_middleware recovery interceptor
 2021-12-16 21:03:03 -08:00
Louis Ruch d46daa573f feat(server): Add grpc_middleware recovery interceptor 2021-12-16 20:22:20 -08:00
Louis Ruch 1209b5180f release: Bump desktop version 2021-12-16 19:22:39 -08:00
Louis Ruch 8f44e6d49f release: Bump website version number 2021-12-16 09:42:52 -08:00
Louis Ruch c30adc286b release: Update changelog for 0.7.3 2021-12-16 09:42:28 -08:00
Louis Ruch b8afd4f50c feat(cli): Display credential type in library list 2021-12-16 10:01:44 -05:00
Louis Ruch e75f1d2f73 feat(credential): Add mapping override update for API/SDK/CLI 
This change adds support for updating a credential mapping override on a
credential library.
 2021-12-16 10:01:43 -05:00
Louis Ruch da20a8b434 feat(credential): Add support for Vault KV2 2021-12-16 10:01:38 -05:00
Louis Ruch 1cc35fb0df feat: Credential library mapping API/SDK/CLI on create path 
* feat(sdk): Add fields to credential library proto

Adds CredentialType and CredentialMappingOverrides to credential
library SDK.

* feat(api): Add fields to credenttial library service

Adds support for CredentialType and CredentialMappingOverrides
to the credential library service (API)

* feat(cli): Add feilds for credential library cmd

Adds support for CredentialType and CredentialMappingOverrides to the
credential library cmd command.
 2021-12-16 09:43:34 -05:00
Louis Ruch f4b9b83caf fmt: Fix import groups 2021-12-15 22:34:16 -08:00
Louis Ruch 59734e97fa Merge pull request #1798 from hashicorp/louis-panic 
bug(credential): Fix panic in credential Issue
 2021-12-15 18:42:54 -08:00
Louis Ruch 9b39345c7f bug(credential): Fix panic in credential Issue 
Vault KV backend returns a nil secret and no error if the secret does not
exist. This caused a panic in during Issue:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x1388279]

goroutine 2639 [running]:
github.com/hashicorp/boundary/internal/credential/vault.(*Repository).Issue(0xc001222200, {0x3b932d0, 0xc001203350}, {0xc000dc6e90, 0xc}, {0xc0010e5e40, 0x0, 0x0})
        /home/louis/boundary/internal/credential/vault/repository_credentials.go:67 +0x2d9
github.com/hashicorp/boundary/internal/servers/controller/handlers/targets.Service.AuthorizeSession({{}, 0xc000cd4a38, 0xc000cd4840, 0xc000cd48d0, 0xc000cd4a50, 0xc000cd4870, 0xc000cd4858, 0xc000cd48b8, 0xc0001a8880}, {0x3b932d0, ...}, ...)
        /home/louis/boundary/internal/servers/controller/handlers/targets/target_service.go:1059 +0x1525
github.com/hashicorp/boundary/internal/gen/controller/api/services._TargetService_AuthorizeSession_Handler.func1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880})
        /home/louis/boundary/internal/gen/controller/api/services/target_service_grpc.pb.go:631 +0x78
github.com/hashicorp/boundary/internal/servers/controller.auditResponseInterceptor.func1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880}, 0x461279, 0x40d234)
        /home/louis/boundary/internal/servers/controller/interceptor.go:262 +0x4e
github.com/grpc-ecosystem/go-grpc-middleware.ChainUnaryServer.func1.1.1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880})
        /home/louis/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware@v1.3.0/chain.go:25 +0x3a
github.com/hashicorp/boundary/internal/servers/controller.statusCodeInterceptor.func1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880}, 0x203000, 0x203000)
        /home/louis/boundary/internal/servers/controller/interceptor.go:207 +0x34
github.com/grpc-ecosystem/go-grpc-middleware.ChainUnaryServer.func1.1.1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880})
        /home/louis/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware@v1.3.0/chain.go:25 +0x3a
github.com/hashicorp/boundary/internal/servers/controller.errorInterceptor.func1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880}, 0x18e2b40, 0x0)
        /home/louis/boundary/internal/servers/controller/interceptor.go:156 +0x4e
github.com/grpc-ecosystem/go-grpc-middleware.ChainUnaryServer.func1.1.1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880})
        /home/louis/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware@v1.3.0/chain.go:25 +0x3a
github.com/hashicorp/boundary/internal/servers/controller.auditRequestInterceptor.func1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880}, 0x1a1c860, 0xc0010e5280)
        /home/louis/boundary/internal/servers/controller/interceptor.go:248 +0x198
github.com/grpc-ecosystem/go-grpc-middleware.ChainUnaryServer.func1.1.1({0x3b932d0, 0xc001203350}, {0x1a0dd40, 0xc000dc8880})
        /home/louis/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware@v1.3.0/chain.go:25 +0x3a
github.com/hashicorp/boundary/internal/servers/controller.requestCtxInterceptor.func1({0x3b932d0, 0xc001203260}, {0x1a0dd40, 0xc000dc8880}, 0x18, 0xc0010e52a0)
        /home/louis/boundary/internal/servers/controller/interceptor.go:140 +0x5de
github.com/grpc-ecosystem/go-grpc-middleware.ChainUnaryServer.func1.1.1({0x3b932d0, 0xc001203260}, {0x1a0dd40, 0xc000dc8880})
        /home/louis/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware@v1.3.0/chain.go:25 +0x3a
github.com/grpc-ecosystem/go-grpc-middleware.ChainUnaryServer.func1({0x3b932d0, 0xc001203260}, {0x1a0dd40, 0xc000dc8880}, 0xc00331abb8, 0x18675e0)
        /home/louis/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware@v1.3.0/chain.go:34 +0xbf
github.com/hashicorp/boundary/internal/gen/controller/api/services._TargetService_AuthorizeSession_Handler({0x1ada420, 0xc00093a180}, {0x3b932d0, 0xc001203260}, 0xc001200840, 0xc000465260)
        /home/louis/boundary/internal/gen/controller/api/services/target_service_grpc.pb.go:633 +0x138
google.golang.org/grpc.(*Server).processUnaryRPC(0xc000cca540, {0x3bb4c58, 0xc0005a9c80}, 0xc001208480, 0xc0004a7440, 0x499e2b8, 0x0)
        /home/louis/go/pkg/mod/google.golang.org/grpc@v1.40.0/server.go:1297 +0xccf
google.golang.org/grpc.(*Server).handleStream(0xc000cca540, {0x3bb4c58, 0xc0005a9c80}, 0xc001208480, 0x0)
        /home/louis/go/pkg/mod/google.golang.org/grpc@v1.40.0/server.go:1626 +0xa2a
google.golang.org/grpc.(*Server).serveStreams.func1.2()
        /home/louis/go/pkg/mod/google.golang.org/grpc@v1.40.0/server.go:941 +0x98
created by google.golang.org/grpc.(*Server).serveStreams.func1
        /home/louis/go/pkg/mod/google.golang.org/grpc@v1.40.0/server.go:939 +0x294
 2021-12-15 16:13:30 -08:00
Louis Ruch 155d8e1cbd release: Bump website version number 2021-12-15 14:04:40 -08:00
Louis Ruch d74611b6f6 release: Update changelog for 0.7.2 2021-12-15 14:03:47 -08:00
Louis Ruch 72a15b8d2d bug(target): Add *-host-sources actions to target service (#1794) 2021-12-15 10:06:35 -08:00
Louis Ruch b692e0e54c api(session): Add connection to api input (#1763) 2021-12-07 09:33:05 -08:00
Louis Ruch 9b6d7d8105 chore: fmt changelog entry 2021-11-30 11:20:11 -08:00
Louis Ruch 9bec68f32c refact(servers): Cleanup redundant if else (#1741) 2021-11-24 11:56:04 -08:00
Louis Ruch e0587afb5f chore: bump website verison 2021-11-17 14:47:53 -08:00
Louis Ruch 384120fd7d chore: bump to version 0.7.0 2021-11-16 17:29:39 -08:00
Louis Ruch bc0e23bdf1 chore: bump api/sdk versions 2021-11-16 17:28:10 -08:00
Louis Ruch 0cf9573f24 chore: make fmt 2021-11-16 17:27:16 -08:00
Louis Ruch c33efbf223 chore: make fmt (#1721) 2021-11-16 16:38:30 -08:00
Louis Ruch c9a189a18e test(kms): Add missing tests and fixup some log lines (#1645) 2021-10-28 09:45:58 -07:00
Louis Ruch 157bea08b9 test(vault): Register vault jobs for tests to reduce error spam in logs (#1630) 2021-10-22 15:53:18 -07:00
Louis Ruch 95327b5e43 style: Run make fmt (#1626) 2021-10-20 19:16:14 -07:00
Louis Ruch 49d5711a49 fix (service): corrects permission bug in hostset service (#1549) 
* fix (service): corrects permission bug in hostset service

* fixup! fix (service): corrects permission bug in hostset service
 2021-09-22 11:01:51 -07:00
Louis Ruch 1c40100edd tests(scheduler): fix unit test deadlock (#1550) 
If a new job is started as the test successfully compeltes and begins
the scheduler shutdown process.  The new job will deadlock waiting on
channel reads.
 2021-09-20 11:31:54 -07:00
Louis Ruch 96b0c18f25 docs(dbtest): corrects echo in makefile (#1548) 
After running make test-database-up, the output gave the
incorrect command to run to see docker logs.
 2021-09-20 10:21:48 -07:00
Louis Ruch 6000f20ae5 chore(authenticate): remove deprecated authenticate:login and credentials field (#1534) 
* chore(authenticate): remove deprecated authenticate:login

* Update changelog
 2021-09-17 18:23:24 -07:00
Louis Ruch 6a92e08928 refact(worker): update worker porxy handler signature to return an error (#1536) 
Instead of requiring the each proxy handler to handle the webSocket
connection closure.  On error the worker handler will appropriately
close the connection and event any errors.
 2021-09-17 11:48:44 -07:00
Louis Ruch 8b5e4a175a feat(worker): add egress credentials option to proxy (#1531) 2021-09-17 11:26:04 -07:00
Louis Ruch 61722659d1 test(scheduler) Remove un-needed test causing intermittent failures (#1501) 2021-09-04 07:30:31 -07:00
Louis Ruch 4cdce29a84 fix(connect): Remove erroneous event error message (#1500) 
When a session is terminated by the user, the cancel session path is
triggered, in this path the websocket connection is closed.  If the
connection is already closed, an EOF is returned. In this situation an
EOF is expected and should not be logged to the user.

Example log line:
{
  "id": "ezqk6w9dOQ",
  "source": "https://hashicorp.com/boundary/dev-controller/boundary-dev",
  "specversion": "1.0",
  "type": "error",
  "data": {
    "error": "failed to close WebSocket: failed to read frame header: EOF",
    "error_fields": {},
    "id": "e_n60YPsDkaj",
    "version": "v0.1",
    "op": "worker.(Worker).handleProxy",
    "info": {
      "msg": "error closing client connection"
    }
  },
  "datacontentype": "text/plain",
  "time": "2021-09-02T10:05:46.587513-07:00"
}
 2021-09-02 12:24:12 -07:00