* Key Rotation/Destruction (#2477)
* fix: Correct kms.CreateKeys comment
This method does not return anything.
* feat(kms): Add new ListKeys method
The new ListKeys method wraps the underlying KMS wrapper,
returning all the keys in the scope specified.
* feat(scopes): Add new scope actions for key management
Adds list-keys, rotate-keys and revoke-keys actions for scopes.
* feat(scopes): Add ListKeys API endpoint
This new endpoint lists all keys in a scope
* feat(api): Add ListKeys to Scopes client
This has to be a custom function because it is a custom action
and doesn't map well to any of the existing templates, or
generalises well in a way that would make it reasonable
to create a new template.
* feat(cli): Add new scopes list-keys command
* add RotateKeys function to the kms repository
* Add Rotate Keys Endpoint to Scopes Api (#2360)
* add rotate keys endpoint
* add tests for RotateKeys endpoint
* remove that one comment I forgot about
* addressing more PR comments
* Add Rotate Keys CLI Command (#2395)
* add cli command and client
* add bats tests
* fix some info text and pr comments
* write a new rotate keys description
* Add Missing DEK Foreign Keys (#2408)
* add missing fks
* mark key as nullable in gorm
* update tests to use a new wrapper with a real key_id
* fix formatting in test and add keys for auth_token test
* replace key values
* revert postgres_40_01_test.go
* style: reformat sql for readability
* refactor: change type of key_id columns to kms_private_id
* Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431)
* fix(db): Correct types of data key version referencers
* fix(oplog): Fix missing error handling
* feat(oplog): Store key_id and scope_id with oplog entries
This migration truncates all existing oplog entries, as
migrating existing data would have been complex and
likely unnecessary.
* Update view references
* Always delete oplog entries when dropping keys
* Fix rebase issues
* Fix sql tests
* Add schema for new kms destruction jobs (#2479)
* feat: Add schema for new kms destruction jobs
The schema lets us manage destruction jobs per-table
while providing a guarantee that only one run is running
at a time.
* Apply suggestions from code review
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Fix table reference and tests
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* update domain, api, and cli to all include key versions in outputs (#2472)
* update domain, api, and cli to all include key versions in outputs
* fix go sum
* add migration to fix immutable error
* fix final test issue as well as make gen issue
* rebase and fix
* address johan pr comments
* make gen, didn't realize comments were included
* update migrations based on new migration 55 file 03
* Move migrations to 56
* feat: Add key version rewrapping function registry (#2478)
The new RegisterTableRewrapFn can be used by a domain
to register a callback to use when rewrapping data in a
specific table name.
* feat(kms): Add scopeId to RewrapFn (#2539)
This makes it much easier for rewrap functions to look up
the correct wrapper and limit the number of rows searched.
* Update Root Cert Proto Definition (#2542)
* update root cert proto definition to properly identify public_key as the table primary key
* add the test fix as well
* Rewrap Functions for Encrypted Tables (#2532)
* add oidc rewrap
* add argon2 config rewrap
* add auth token rewrapping
* add worker auth cert rewrapping
* check the err
* add username password credential rewrapping
* add ssh private key credential rewrapping
* add vault client certificate rewrap function
* add host catalog secret rewrap function
* cleanup a little
* add host vault token rewrap function
* add session credential rewrap function
* add session rewrap function
* add worker auth rewrap function
* update test to include full assert gamut
* add session rewrap function TEST
* bring all tests up to current standards, make more readable, and include full assert gamut
* rework all rewrap functions to utilize scope id
* update comments, queries, sql refs, etc, in response to PR comments
* forgot a comment
* remove hmac updates and fix a couple comments again
* Rewrapping Registered Tables Test (#2555)
* add the registered table test as well as the two missing rewrap functions
* address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test
* Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498)
* feat(kms): Add ability to list data key version destruction jobs
* feat(scopes): Add ListKeyVersionDestructionJobs
* feat(cli): Add list-key-version-destruction-jobs
* feat(kms): Add recurring job that performs table rewrapping
The new recurring job runs for each job table with a registered
rewrapping callback. It attempts to become the running run and
start its rewrapping, gracefully handling sudden interruptions
by resuming it's work if it finds evidence of sudden interruption.
* feat(kms): Add recurring job for destroying key versions
The new job monitors the database for data key version destruction
jobs that have finished rewrapping all its data, performing
the final data key version revocation.
* feat(kms): Add DestroyKeyVersion
DestroyKeyVersion immediately destroys a key version
if it is a root key version or a data key version
which encrypts no data. If the data key version
encrypts data which needs to be rewrapped, it
queues an asynchronous job to complete the rewrapping
operation.
* feat(scopes): Add DestroyKeyVersion API endpoint
* feat(cli): Add scopes destroy-key-version CLI command
* Ensure all secret updates include key ID (#2556)
* feat(all): Ensure all secret updates include key ID
When updating a secret, it is paramount that the key ID
is also updated, as it is the only means we have of ensuring
that we only destroy keys once there is no more data
associated with the key.
* Remove fix to session repository for now
This breaks the current private key derivation method
* add new encrypt/decrypt funcs and made necessary proto changes (#2557)
* add new encrypt/decrypt funcs and made necessary proto changes
* address all PR comments
* fix test panic
* add param checking to rewraps
* fix(schema): Correctly organize migrations again
* Review comments part 1
* Review comments part 2
* Review comments part 3
* Store cert private key, encrypt tofu token (#2583)
* fix(session): store cert private key, encrypt tofu token
Previously, we would derive a session certificate private key from
the session key used in each project, and not store the key. We
would also encrypt the tofu token with the database key but not
store a reference to this key in the database.
This change fixes this by replacing our key derivation with a key
generation step, and instead store the generated key, encrypted,
in the database. We also ensure that any new tofu tokens are
encrypted with the same key.
To handle existing sessions, we lazily rewrite the sessions whenever
a user lists them. There is a minor risk that a user could end up
destroying the database key that encrypts the tofu token before
that session has been rewrapped, but this is going to be rare and
temporary.
* feat(session): Allow the random source for secrets to be configured
* Review comments
* Minor fixes
* More minor fixes
* More small fixes
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* fix(session): Unset session key ID when scope is deleted
Unsetting the key ID allows the session to live beyond the lifetime of
the scope, while allowing the scope to cascade delete its keys.
* fix(migrations): Rewrite migration 56 tests
These tests can no longer use the normal test helpers
as they try to use the new oplog table structure, so we
have to manually write all the interactions.
* fix(migrations): Rename migration 58 file name
This was the name used in the release branch, update
it to the new migration number.
* fix(e2e): Add some comments and debug to kms tests
* fix(session): Handle empty project and user IDs in read
When a project or user is deleted, the session is automatically
canceled and the respective field on the session is unset.
LookupSession did not handle this case gracefully, and would
error on decryption in this state. Skip decrypting sessions that
do not have either a user or project to avoid this error. The
decrypted values are not used for a canceled session.
* Fix worker test
* Increase test timeout
Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* feat(workers): Add ability to read and reinitialize cert authority (#2312)
* feat(workers): Return Release Version on worker list and read (#2377)
* feat(cli): Read and reinitialize worker certificate authority (#2387)
This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
* feat(credentials): Refactor credential purposes
* Application credentials have been refactored to Brokered credentials
* Egress credentials have been refactored to Injected Application
credentials
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Adds WorkerAuthStorage wrapper for worker credential encryption using nodeenrollment library.
* Adds AuthStoragePath field in worker config and dev mode to specify directory to store credentials.
This allows us to use SNI for actual host (e.g. routing) information. We
don't have the client cert yet so we can't look at that, so this
provides a way for us to convey the information needed to look up that
session's TLS stack.
Using SNI for hosts means we also run into the fact that we don't have
automatic agreement in terms of SANs. So when generating the certs we
now also pass worker address information to the function to be encoded
in the cert.
Finally, there is a change in how the websocket dialing happens, because
http.RoundTripper tries to be too clever for its own good and overwrites
NextProtos on a whim.
* feat(sdk): Add fields to credential library proto
Adds CredentialType and CredentialMappingOverrides to credential
library SDK.
* feat(api): Add fields to credenttial library service
Adds support for CredentialType and CredentialMappingOverrides
to the credential library service (API)
* feat(cli): Add feilds for credential library cmd
Adds support for CredentialType and CredentialMappingOverrides to the
credential library cmd command.
This adds a parameter to host sets allowing the sync interval to be
user-specified on a per-host-set basis. A value of -1 disables syncing;
a value of null uses the current default.
* Add ability to read and list hosts. Tests to follow.
* Add tests for reading and listing as well as validation checks to not modify hosts.
* Add IpAddress and DnsNames to the api resource. Populate the plugin info.
* Adding go sdk tests for reading and listing hosts and ensuring update and deleting is disallowed.
This stores worker connection nonces within the database to ensure
uniqueness of connections. Prior the connection required any attacker to
be able to decrypt the incoming encrypted authentication message in
order to replay (and if the attacker has access to the KMS you have
bigger problems), but with this change even if an attacker does have
access to the KMS key, they cannot reuse the same message. (If they're
able to encrypt against the KMS key, they can still act as a worker with
a new message, so this only really helps if they only have decryption
capabilities.)
* Remove Prefix Id and Plugin Name fields. Creating catalogs now require either the plugin id or the name of the plugin resource (but not both). Host Catalogs and Host Sets API resources now have a read only plugin field populated with plugin info. Host Catalogs have a plugin id field as a top level field.
* Fix down migrations
* Udpates due to merge
* Sentinel values only have to be greater than 0
* Create credential related sdk structs and methods.
* Post merge interface updating.
* Removing scratch code that was not cleaned up.
* updates
* Convert client certificate and client certificate keys into pem blocks and validate.
* Add newline at end of file.
* Faster check for "s" at the end of a resource name when generating from templates.
* make fmt
* updates
* Add dynamic credentials to a session
* Refactor: move contents of file
* updates
* Updates
* Add InvalidDynamicCredential error
* Assign credentials
* Allow updating client certificates seperate from the client certificate key.
* Replace application purpose string with enum value
* PR feedback / fix go test .
* Delete dead code
* Use common view
* Refactor: extract interface and rename method
* Refactor: move code to eliminate privPurpLibrary
* Add comment to requestMap
* Refactor: do not export methods on an unexported struct
* Update internal/db/schema/migrations/postgres/10/03_vault_credential.up.sql
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Add comments to credential Purpose constants
* Reorder switch statements to handle errors first
* PR feedback
* update
* fix merge
* Organizing the scheduler code and extract the individual store creation test helper function.
* Run 'make fmt'
* Create certificate when creating store. Allow vault address to be passed in as option
* Refactor: rename database views and associated structs
This change renames two database views and associated go structs to use
a consistent naming pattern. Views ending in 'private' contain encrypted
credentials needed for connecting to Vault. Views ending in 'public'
mirror the 'private' views but do not include any encrypted values.
This change does not include any changes to functionality or behavior.
* Adding SAD target operations for credential libraries to the SDK.
* Add status field and enumeration table for credential status
* Refactor: rename Status to TokenStatus
* Add status to vault credentials
* Creating the template for the CLI and helper functions.
* Add private database view for vault credentials
* Add scope_id to view and cleanup TODO comment
* Reformat embedded sql queries
* Add vault client helpers
* updates
* white space
* Add LookupLease test
* CLI commands for Store work. Renamed fields in proto w/ vault prefix.
* Test issue credentials with client TLS
* Add additional checks to vault ping
* Add an error for vault token capabilities and create a VaultToken error kind
* Add support for working with Vault policies
* Use Vault 1.7.2 for testing
* Add testing helper for creating a vault client with a non-root token
* Fix Vault renew lease test
The Vault renew lease endpoint accepts an optional duration parameter
for requesting the number of seconds to extend the lease by. However,
Vault is not required to honor this request.
* Add a var for the required capabilities of a boundary Vault token
* Enhance the test helper for adding a policy to Vault
* Allow the test role in postgresql to revoke credentials
* Remove out of date comments
* Enhance Vault test helpers for the database secrets engine
* Reformat comments
* Add a method for getting the capabilities of the current Vault token
* Add revoke lease to internal Vault client
* Reformat: combine err return line with check for nil line
* Remove redundant checks in test code
Remove checks in test code that are redundant with checks in the test
harness.
* Refactor CreateToken test helper to return the secret and the token
* Fix build failures caused by signature change in vault.CreateToken
* Fix Vault version and Vault API link in comments
* ran `make gen` after merging from mgaffney-vault.
* Remove Vault prefix from attribute fields in API, create a base CLI option for adding field prefixes. format now uses that prefix for error reporting.
* Template now allows attaching attribute field prefixes.
* Credential store uses PrefixAttributeFieldErrorsWithSubactionPrefix.
* Fixing naming of vault flags and helper flags.
* Updating more references to generated api methods.
* Make the capabilities String method more readable
* Add comment outlining PrintApiError usage of Options.
* Refactor test to move declarations closer to first use
* Fix comment
* Implement revoke method on vault repository
* Tests now verify certs, CA, and tokens, addresses can be updated in a store.
* Added test for creating store with pk/cert in same field.
* Allo updating certificates seperate from private key. Only contact backing vault service when updating token.
* Fixing bad tests and removing unused code.
* Adding tests for various ways of updating tokens.
* Add private credential
* Add token revocation job and cred renewal/revocation job
* Regen after merge.
* Fixing field mask related merge error.
* Create Library CLI. Removes vault prefix from path. Adds a WithoutCleanup testOption for vault.
* Set all credentials to revoked when a token is revoked
* Fixing missed renaming update.
* fix copy/paste error.
* Fixing code generation errors after merge.
* make gen after merge.
* Update internal/cmd/commands/credentialstorescmd/vault_funcs.go
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Update internal/cmd/commands/credentialstorescmd/vault_funcs.go
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Update internal/cmd/commands/credentialstorescmd/vault_funcs.go
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Refactor: move migrations from 10 to 12
* Removing logic from transaction.
* wrapping client errors in the calling op for CredentialStore's client() method.
* Redact token
* redact client key
* updates
* Add trigger to revoke credentials when session is canceled or terminated
* Fixing some help text for some flags.
* Add ability to load values from files (file://) or environment variables (env://).
* Updating comments
* fix bad merge
* feedback
* Adding issued credentials to sessions.
* Error on capabilities
* updates
* Expose NewVaulTestServer
* Add godoc
* Adding generated SessionCredential struct for API.
* Progress on building handler test for Authorize Session.
* feedback
* Update policies
* Add 'revoke' as a status for Vault Tokens
* Add delete_time to vault credential store
* Create dynamic credentials at session creation time.
* Tests pass with credentials attached to AuthorizedSession result.
* Only call issue if there are credentials to issue.
* Fixing output only issues. Adding type to credential library.
* Fix test to clear un/pw generated. confirm generated un/pw changes from 1 authorize session call to another.
* Update lookupTokenError
* Add delete_time to private credential store
* Refactor: move private store to separate file
* Fixing tests for AuthorizeSession and verifying error cases.
* Only create the credential repo if there are credentials to issue.
* Rename Library field to CredentialLibrary.
* Fixing missing change of Library to CredentialLibrary.
* Removing Default SDK functions for fields which are required and update CLI to match.
* Replace resource specific id variables with "id" and the input parmater for paths to be just a single string and the resource name as it should show up in the path.
* Soft delete vault credential stores
* Prevent new SQL functions from silently overwriting existing functions
* Rename "Hmac" to "HMAC" in the human readable cli response table.
* Fix tests
* Add vault database cleanup jobs
* Add ability to set the token period in the vault test harness
* updates
* Add not_null_columns func test
* remove unused struct
* Up no output timeout
* Validate current vault token on addr update
* Fix client cert change test
* add cert test
* Update revocation job where
* Fix comment
* Use Vault's default port in CLI help strings
* Remove down migrations
* Increase migration file numbers by 1
* Run make migrations
* Move migrations from 12 to 10
* Increase Circle CI timeout for acceptance tests
* Fix spelling mistake in error messages
* ASD cmds for Target and returning credentials to AuthSession request (#1338)
* Add Add/Set/Remove commands for libraries on Targets. Return credentials on AuthorizeSession request.
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
Co-authored-by: Louis Ruch <louisruch@gmail.com>
Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com>
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Encrypt tokens on the way out and decrypt on the way in
This isn't a security feature related to tokens specifically; it's so
that we can discard cryptographically bad tokens before we ever hit the
DB. This way we can't pass through a DDoS to the database due to
fetching obviously invalid token values.
I'm using base58 to encode the resulting value as there aren't great
base62 options, and allowing base64 / and + values can hamper usability
by creating copying/highlighting breaks.
Todd
Irena Rindos
Johan Brandhorst-SatzkornandDan Heath
Jeff MitchellandIrena Rindos
Louis RuchandJeff Mitchell
Haotian
Jim
Timothy Messier
Thor
Todd