351 Commits (1cf94d0e3edd25f412ffdb618b0e2116a7c343ea)

Author	SHA1	Message	Date
Jeff Mitchell	1cf94d0e3e	Fix merge issues	5 years ago
Jeff Mitchell	0fd906d964	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Oleg Butuzov	5a2fa689a7	refactor: replace (*regexp.Regexp).Match on (*regexp.Regexp).MatchString (#1617) ... This PR change one method of regexp.Regexp struct with a similar one, as result code produce less allocations on heap.	5 years ago
Louis Ruch	95327b5e43	style: Run make fmt (#1626)	5 years ago
Timothy Messier	b5fbf9608e	refact(target): Remove old TargetType (#1618) ... Now that subtypes are registered via sub-packages, this TargetType is not needed and should not be used. This removes it and updates the target.Repository and targets.Service to use the updated code. This was missed in eac433f7ff.	5 years ago
Jim	769416c2ff	refactor (controller): Use a grpc server for the grpc-gateway (#1576) ... * refactor (controller): Use a grpc server for the grpc-gateway This starts a grpc server for the grpc-gateway. The new gateway server uses an in-memory listener which also supports "dialing", so the http proxy can connect to the in-memory listener. This change allows us to use all grpc server features and was in part motivated by a need for an interceptor of inbound requests. With that said, having a "proper" grpc server for the gateway will provide a lot more flexibility and capabilities moving forward. The request context will still be verified via middleware in the http proxy (see wrapHandlerWithCommonFuncs). This verified context will be serialized into a protobuf and sent along to the grpc-gateway via metadata where an interceptor will add the verified request info to the request's context (see requestCtxInterceptor). The interceptor will verify the serialized request info via a shared ticket with it's companion in-memory http proxy. FYI: the ticket is simply random base62 string (see db.NewPrivateId). This change also necessitated a minor change to services. We need to return an empty response instead of nil, nil when there are no errors and the response is empty. * refactor (handlers): Rename gRPC Gateway filter Originally, this was called an OutgoingInterceptor, which is an unfortunate name since it's not an interceptor. Now that we're refactoring the gateway stuff and have proper interceptors, renaming this should remove ambiguity * refactor: Rework how 204 with empty msg is handled Recent changes to grpc gateway has necessitated a change to how 204s are handled by the gateway * tests (bats): Check status codes for delete operations	5 years ago
Timothy Messier	eac433f7ff	refact(target): Move tcp into subpackage ... This moves all of the tcp target functionality into a tcp package. It also establishes a Register function in the target package to allow specific target types to be registered at initilazation time. When registering, a target type needs to provide its Subtype, as well as some RepositoryHooks that are used by the target Repository.	5 years ago
Jeff Mitchell	f01a8060a0	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jeff Mitchell	c05324282f	Rename the UI passthrough dir flag/env var (#1600) ... This puts it more in line with other upcoming options that use "dir" instead of "directory" (plus it's easier to type), and makes it clear that this directory and the passthrough behavior is related to the UI as opposed to other upcoming items.	5 years ago
Jeff Mitchell	1c8e0ed1e1	Add scaffolding for external host plugins and convert aws/azure over (#1581)	5 years ago
Jeff Mitchell	70e6536919	Swap server interface for client (#1580)	5 years ago
Jeff Mitchell	158ab09952	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jim	c8b29ded1c	Events: Add outbound detail protobufs, request status code, and update event encrypt filter. (#1569) ... * feat (events): Add status code to audit events * feat (events): Add the resp proto msg to every audit event * chore (events): Update eventlogger dep This latest version will redact any map and/or map field which isn't explicitly classified via a Taggable interface * feat (events): Begin to add tagging to response proto msgs	5 years ago
Jim	8d6dee09a9	refact: Add db.DB wrapper and refact all test fixtures to use it. (#1535) ... * refact: Changes required for gorm v2 * refact: Add db.DB wrapper and refact all test fixtures to use it Stop leaking the gorm abstraction within our unit tests. * refact: Migrate direct calls to pq to pgx driver The refactor will remove the remaining direct dependencies on the pq driver which has been deprecated in favor of the pgx driver. It includes the addition of common.SqlOpen which is a wrapper around sql.Open, which is needed to deal with the driver name changing from "postgres" to "pgx" but in our code base the dialect and driver are synonyms.	5 years ago
Jim	136ac00b49	refact: Changes required for gorm v2 (#1528)	5 years ago
Todd	e11a481256	Register Azure and AWS at controller start up (#1570) ... * Register Plugins. * Pass catalogs and persisted data when listing hosts for host sets. Register azure plugin at startup if not present.	5 years ago
Jeff Mitchell	8b1ca4b0b8	Add host IDs to plugin host sets read response (#1568) ... This also includes tweaks here and there within the service and repos.	5 years ago
Jeff Mitchell	7d71618df0	Add more host-catalog and host-set CLI support (#1567) ... Add more host-catalog and host-set CLI support Co-authored-by: Todd <T.Alan.Knight@gmail.com>	5 years ago
Jim	350b79be2d	chore: Update go:build tags to new fmt	5 years ago
Jeff Mitchell	a834a14785	Add attribute flag building and parsing (#1562) ... This adds a few command sketches but that's not the main point of the PR and filling those out will come in a different PR. This adds a new flag type that can combine inputs to a single target slice, retaining the ability to distinguish where it came from but also keep ordering across different flag names. It also implements a function that does the heuristic parsing with fallback.	5 years ago
Todd	14cc97b645	Add authorize session for plugin based host sets. (#1559) ... Added a new Endpoint struct at the top level host package level to capture host, set, and address chosen. Temporarily add a host_plugin_host table to capture the hosts returned by the plugins. This ensures the datawarehouse is able to query the table to decide what host was chosen. The view used to update the datawarehouse dimension table provides rows with host set ids and hosts which are not in that host set. This is ok since the function which updates the dimension table provides the host set and host id chosen so that relationship doesn't need to be captured in the view itself. Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Todd	a4ea99047f	Remove Prefix Id and Plugin Name fields (#1563) ... * Remove Prefix Id and Plugin Name fields. Creating catalogs now require either the plugin id or the name of the plugin resource (but not both). Host Catalogs and Host Sets API resources now have a read only plugin field populated with plugin info. Host Catalogs have a plugin id field as a top level field.	5 years ago
Louis Ruch	49d5711a49	fix (service): corrects permission bug in hostset service (#1549) ... * fix (service): corrects permission bug in hostset service * fixup! fix (service): corrects permission bug in hostset service	5 years ago
Todd	bbfef2802f	Placeholder Plugin Providers for Repos and added testPlugin struct (#1532) ... * Create minimalistic plugin map and test plugin. * Pass secrets and attributes to the plugin when creating catalogs or sets. Add tests for CreateSet and CreateCatalog repo methods. * make fmt and extract out getPrivateCatalog and getCatalog helper methods. * Exporting TestPluginServer so it can be used in the handlers. * Keep separate persisted data from host catalogs lookups which facilitate passing it onto the plugins. * Add TODO to merge get Catalog and get Persisted data. * Adding tests for unimplemented being returned by the plugin. * Use GetFields() instead of AsMap() to confirm attributes should be populated. Make clone consistent between catalog and sets. Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Todd Knight	843d126428	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jeff Mitchell	01d4383c1b	Add preferred endpoints logic to API/handler/DB and some CLI bits (#1529)	5 years ago
Louis Ruch	6000f20ae5	chore(authenticate): remove deprecated authenticate:login and credentials field (#1534) ... * chore(authenticate): remove deprecated authenticate:login * Update changelog	5 years ago
Jeff Mitchell	a71cdae204	Merge remote-tracking branch 'origin/main' into plugin-hostcatalogs	5 years ago
Jeff Mitchell	1f7999ed97	Add authorized collection actions output for credential stores (#1530) ... Add authorized collection actions output for credential stores	5 years ago
Todd Knight	f2236482ad	Creating plugin catalog handler (#1521) ... The handler only supports create, lookup, and list for plugin based host catalogs.	5 years ago
Jim	2afac7348a	fix (controller): Set controller CancelCtx (#1513)	5 years ago
Jeff Mitchell	70cb75d030	Fix sessions authorized actions output (#1527)	5 years ago
Todd Knight	eb6bab8298	Add plugin sets to targets. (#1522)	5 years ago
Jeff Mitchell	ec1c9c3584	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Todd Knight	715982148f	Create Plugin Host Set Handler for Create, List, Get (#1518)	5 years ago
Jeff Mitchell	92809b733a	Fix unknown permission issue with credential-store (#1524) ... This also affected credential libraries and managed groups. It seems that any end-to-end tests of these grants currently had them included in wildcards instead of individually, but these types were never added to the valid list for resources. Additionally, credential store wasn't added as a valid top level type for pinning purposes.	5 years ago
Timothy Messier	75388f727a	test: Refactor to use dbtest package instead of docker ... This swaps the test initialization to use the dbtest package so each test will get a fresh database created from a template database, instead of a completely new docker container.	5 years ago
Jeff Mitchell	081de3cf79	Migrate sdk/recovery to api/ and sdk/wrapper to internal (#1507) ... * `recovery` is only used by the API (and the main module, for decryption) * `wrapper` is only used by the CLI right now Moving these brings them closer to the code that uses them, and makes the SDK package a bit more clear in terms of functionality.	5 years ago
Jeff Mitchell	2c61bd4963	Fix recursive listing when the ingress scope lacks permissions (#1478) ... The existing logic was to ignore Forbidden errors when recursively listing in favor of looking for downstream scopes with appropriate permissions. The problem is that when there is actually no authentication token at all, what comes back is an Unauthenticated error. Therefore if you didn't have permissions on the ingress scope (e.g. the default of `global`) but did downstream for the anonymous user, you'd get back an error. I don't think there's any security issue with doing this; the user could always have simply started the search at a downstream scope to begin with so nothing more is being revealed, this just fixes behavior to match expectations in this case. A test was added for one of the services; the code is exactly the same across them. The reason that the existing tests that were added with the output fields testing didn't catch this is that even though they were specifying `u_anon` as the user, the disabled test context skipped the logic that would return a 401 in this case. It turns out that fixing this is very complicated because we don't have a great way in most tests of defining grants to put onto the generated scopes, so even if a true anonymous context was added each test would require the anonymous user to have list permissions on whatever resource was under test, requiring a lot of role and grant and principal finagling. This is probably a good longer-term TODO but not one that seemed worth it for this fix. Fixes ICU-2301	5 years ago
Louis Ruch	030c09c6b9	bug(targets): Fix panic in authorize-session (#1496) ... When renaming credential libraries -> credential sources the target service added the credential library information to the SessionCredential response, while the target cmd was parsing the credential source. This prevents a panic like the following: boundary targets authorize-session -id ttcp_5PS2dktESb panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x1f99a31] goroutine 1 [running]: github.com/hashicorp/boundary/internal/cmd/commands/targetscmd.printCustomActionOutputImpl(0xc00046c0a0) /Users/louisruch/boundary/internal/cmd/commands/targetscmd/funcs.go:822 +0x9d1 github.com/hashicorp/boundary/internal/cmd/commands/targetscmd.(*Command).Run(0xc00046c0a0, {0xc000134030, 0x2, 0x2}) /Users/louisruch/boundary/internal/cmd/commands/targetscmd/targets.gen.go:324 +0x188b github.com/mitchellh/cli.(*CLI).Run(0xc0001c6500) /Users/louisruch/go/pkg/mod/github.com/mitchellh/cli@v1.1.2/cli.go:262 +0x5f8 github.com/hashicorp/boundary/internal/cmd.RunCustom({0xc000134010, 0x60, 0x0}, 0x0) /Users/louisruch/boundary/internal/cmd/main.go:186 +0x9d6 github.com/hashicorp/boundary/internal/cmd.Run(...) /Users/louisruch/boundary/internal/cmd/main.go:92 main.main() /Users/louisruch/boundary/cmd/boundary/main.go:13 +0xc9 Fixes #1488	5 years ago
Jeff Mitchell	2649d1b966	Move protooptions to sdk/pbs (#1486) ... This prevents a reverse dependency from sdk on the main module.	5 years ago
Jeff Mitchell	b13975cb6a	Move API resource pbs to new location (#1484) ... This moves the generated pb files to the `sdk` module. This allows third parties to make use of them if desired (e.g. in upcoming plugins) and moves away from the `gen` nomenclature in the directory, since we are going to be adding some extra interface functions to the messages.	5 years ago
Louis Ruch	31af49e76d	refactor(worker): Move tcp_proxy into its own package (#1458) ... * refactor(worker): Move tcp_proxy into its own package This refactors: - the tcp_proxy.go into worker/proxy/tcp - add a missing unit test for the HandleTcpProxyV1 - refactors session.go into worker/session, needed to avoid import cycle - adds a baseline for a mock controller session client - go lint fixes * Add sleep between spinning listener goroutine and dialing Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Jim	477b541bf0	Events: ongoing clean up of eventing (#1448)	5 years ago
Jeff Mitchell	e3012afb4f	Add primary auth method ID to default output fields, fix display bug (#1441)	5 years ago
Jim	68dd2a66ba	Remove unneeded hclog dependencies as we move forward with events (#1433)	5 years ago
Jeff Mitchell	f8a51b987c	Migrate target host sets -> host sources (#1424) ... This follows the same model as https://github.com/hashicorp/boundary/pull/1413 See there and CHANGELOG for more details.	5 years ago
s-christoff	6b78108ecf	Update primary error functions to take a context, deprecate old functions (#1358) ... * add new error funcs which take a ctx and deprecate existing funcs * use context where available when writing error events * remove circular internal/errors pkg dep * suppress some chatty errors using errors.WithoutEvent() * convert auth oidc funcs to take context where needed to write events Co-authored-by: Jim <jlambert@hashicorp.com>	5 years ago
Jim	70ad081e39	Events: convert from hclog to events (#1409)	5 years ago
Todd Knight	10e8aeae4b	Subtype Id registration moved to its own package (#1416) ... * Allow repo packages to register subtypes and id prefixes. * Refactor out request authentication logic to a new package as a sibling to handler.	5 years ago