boundary

Commit Graph

Author	SHA1	Message	Date
Todd	9025e126fb	Fix dependency that got reverted to older version	2 years ago
Todd	8af20349e7	update mql and clean search flags (#4030 )	2 years ago
Todd	ab4ab0e8f9	Handle log rotation (#3948 ) * Handle log rotation	2 years ago
Jim	fba9d1cdf1	Add client daemon repo, server, and cmd The commands added are: boundary daemon start boundary daemon stop boundary daemon add-token boundary daemon status boundary search If these actions are performed on a platform that doesn't support sqlite natively in go an error is returned. Besides some hooks into the cmd package all the significant logic resides in internal/clientcache feat (cmds/authenticate): output the token name when storing token feat: update go-dbw which now uses pure go sqlite driver refact (base.Command): export FlagOutputCurlString Exporting FlagOutputCurlString allows other commands that embed the base.Command to access the flag as needed feat: add a cache Repository to manage cache storage feat: add a "cache" CLI command This new command will support both managing and searching the local CLI cache daemon. feat: start cache daemon as needed when issue CLI commands Move files to new directories and add persona table (#3526) * Add persona table and move files to new directories Client daemon now uses unix sockets and update pathing (#3535) * Add unix socket listen and dialers with file permissions applied * Update the pathing to match RFC Cache refreshing now uses all stored personas. (#3545) Updating headers for LLB files Decouple daemon and cache server (#3566) * Separate daemon from server * Add persona handler to daemon server (#3579) Moved search to use mql and added tests for the search command (#3589) * search uses hashicorp/mql Windows support for client side daemon (#3618) * exec.Command for background process * Log to stderr when in foreground and file always * Use pid files across platform for start and stop Requests with version info must match the daemon's version (#3640) * requests with version info must match daemons Update dependencies and breakout cgo/pure go sqlite drivers (#3657) upgrade go-dbw deps and add cgo build tags Enable graceful shutdown in windows (#3695) * Enable graceful shutdown in windows Co-authored-by: Jim <jlambert@hashicorp.com> Targets delete when a persona changes address or user id (#3673) * Handle cache refresh in repo Add sessions to the client side cache (#3682) * Add sessions to repository * Search command supports sessions * adding session related tests to db and refresh Change cache schema from personas to tokens+users (#3737) * Change from personas to tokens+users * Separate keyring tokens from auth tokens Add support for keyringless auth tokens (#3765) * Add support for keyringless auth tokens Remove expired auth tokens from cache (#3768) * Remove expired auth tokens from cache Complete the TODO of checking for inflight tx (#3779) Delete tokens that the controller says are invalid (#3782) fix search test with boundary token check (#3799) Collect resource info in repository_<resource>s.go (#3769) * Collect resource info in repository_<resource>s.go * Move search logic into the domain (#3794) Daemon and search restricted to supported platforms (#3801) * Daemon and search restricted to supported platforms Reorganize the clientcache packages (#3814) * Refactor for self contained domain logic * Put clientcache stuff under internal	2 years ago
Timothy Messier	6e233c879f	fix(ratelimit): Round up when setting Retry-After header Previously this would truncate to the nearest integer, which could result in clients retrying before the quota has reset, and getting rate limited again. This also includes an update from go-rate that will round up when reporting the reset time for the RateLimit header. Note that in the case of a 503, the Retry-After header was already being set correctly. See: https://github.com/hashicorp/go-rate/pull/8	2 years ago
Timothy Messier	d0c3da5f1d	refact(ratelimiter): Updates due to refactor in go-rate	2 years ago
Timothy Messier	059d4992de	feat(ratelimit): Add support for limits per ip address and auth token	2 years ago
Timothy Messier	bc48e58035	chore: Add go-rate dependency	2 years ago
Damian Debkowski	3394d3e13a	chore: update go mod and dependencies (#4073 )	2 years ago
Jim	18729721a1	fix (plugins/gcpkms): update dep to fix issue with using gcp kms (#4058 )	2 years ago
Jeff Mitchell	71e685b276	Copy wspb into sdk in preparation for moving it out of main (#4023 )	2 years ago
Timothy Messier	dd23f6fdbf	Update websocket library (#3908 ) The nhooyr/websocket library now has a release with the new default behavior that removes the message size limit. This allows us to switch off of the fork and back to the upstream. In the same release that includes the fix we need for the boundary client, the wspb helper package was removed from websocket. This package contained some functions to read and write protobuf messages. However, it was using the deprecated github.com/golang/protobuf/proto library. To avoid this dependancy in the library they opted to just remove wspb. Thus this provides a replacement implementation that uses google.golang.org/protobuf/proto. Notably the newer proto library seems to lack an equivalent of proto.NewBuffer so writes to the websocket and not able to leverage a sync.Pool of byte.Buffers to reduce allocations. Refs: `88bb253554` See: `ac385120c6`	2 years ago
Jim	61ef033fb6	chore (deps): update gldap dependency (#3989 )	2 years ago
Jeff Mitchell	a9e372930d	Revert `0bf60996c5` (#3990 ) Post-merge some issues were discovered with the ways typing is used for proto reflection. This will be reworked without moving the subtypes around.	2 years ago
Jeff Mitchell	de4ce93931	Update main module deps (#3971 )	2 years ago
dependabot[bot]	b528696325	chore(deps): bump github.com/docker/docker (#3949 ) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.3+incompatible to 24.0.7+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v23.0.3...v24.0.7) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 years ago
Jeff Mitchell	20ac42c851	Add some useful dev flags (#3865 )	3 years ago
Hugo	a6de891c53	chore: Bump gRPC to v1.58.3 gRPC v1.58.3 fixes a vulnerability in the HTTP stack where a malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. See https://github.com/grpc/grpc-go/pull/6708 for more details.	3 years ago
dependabot[bot]	dc51613fba	chore(deps): bump golang.org/x/net from 0.15.0 to 0.17.0 (#3827 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.15.0 to 0.17.0. - [Commits](https://github.com/golang/net/compare/v0.15.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
Jeff Mitchell	d7e44f6822	Bump nodeenrollment to remove multierrors (#3809 )	3 years ago
Timothy Messier	88bb253554	fix(cli): Remove websocket message size limit (#3808 ) When the boundary client establishes a connection to the websocket used to communicate with a worker, it was configured with a max websocket message size of 32KiB. This was the default behavior for v1.8.7 of nhooyr/websocket. However, there are cases where the worker can send messages to the client that are larger than 32KiB. When this happens the client returns an error and terminates the connection. Notably this seems to only currently impact sessions made to SSH Targets, although it could theoretically impact any target type depending on the details of how the worker performs the writing of the messages. The issue can be reproduced by attempting to scp a large enough file from an SSH Target to the client. In this case the connection gets terminated and results in a partial transfer of the file. This message size limit appears to be unnecessary, and the default behavior is changing in v1.8.8 of nhooyr/websocket to make the message size unlimited. Since this version is not yet released, this commit switches the dependency to a fork with a version that is v1.8.7 plus the patch to disable the limit. Once v1.8.8 is release this dependency can be set back. See: https://github.com/nhooyr/websocket/pull/254 https://github.com/nhooyr/websocket/pull/256	3 years ago
Jeff Mitchell	fc0d43459c	Bump password dep to fix issue entering password in Windows CLI (#3800 )	3 years ago
irenarindos	24771ff355	update go.mod	3 years ago
Jim	6c54988e58	chore: update cap/ldap dep (#3748 ) cap/ldap updated it's upstream dep on go-ldap	3 years ago
Irena Rindos	c3d3000a3e	chore: update go-eventlogger (#3735 )	3 years ago
Jim	457b618f6e	chore: update azurevaultkey wrapper dependency. (#3706 ) This update brings in PR #155 which adds support for azure workload identity authentication	3 years ago
Irena Rindos	6f10a0ac87	chore: update go-eventlogger (#3707 ) * chore: update go-eventlogger	3 years ago
Jim	5f66f2fa8e	chore: update cap/ldap dependency (#3699 )	3 years ago
Jim	a16033b73a	fix (kms): move oplog DEK into its own internal kms (#3665 ) * fix (auth/ldap): fix which DEK is used for oplog during authenticate * chore: update go-kms-wrapping dep for new extras/kms changes The latest version supports setting a table name prefix for a kms which is needed to fix our oplog DEK problem * chore: update extras/kms dep This latest version supports an optional TableNamePrefix which is required to fix our existing oplog DEK issue. * fix (oplog): schema oplog DEK fix These changes will allow use to store the oplog DEK in it's own set of tables, so they won't get deleted when a scope is deleted * fix (kms): move oplog DEK into its own internal kms * tests: update tests to be compatible with oplog fix * tests: remove migration tests which are incompatible with oplog fix These tests no longer work because they are missing the required schema changes for the oplog fix	3 years ago
Jim	dc89ca28a1	feat: add API support for additional LDAP auth method fields. (#3679 ) * feat (auth/ldap): add Repo support for max page size and deref aliases (#3670) * chore: update cap/ldap dependency This latest version of cap/ldap adds support for MaxPageSize and DerefAliases * feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto * feat (api/authmethods): add new ldap fields. Add support for maximum_page_size and dereference_aliases * feat (auth/ldap): schema changes to support new LDAP attributes * feat (auth/ldap): add Repo support for max page size and deref aliases * feat (handlers/ldap): add support for new fields (#3674) Added API support for new ldap fields: MaximumPageSize and DereferenceAliases * chore: add CHANGELOG entry for new api auth ldap fields	3 years ago
Jim	d5411a26f6	chore: update protobuf dep (#3669 )	3 years ago
Jim	f59b6364f2	chore: update "go mod tidy"	3 years ago
Jim	97c5e7dbc6	chore: update cap dependency (#3495 )	3 years ago
Irena Rindos	39e6fcfeba	chore: update cap dependency (#3456 )	3 years ago
Irena Rindos	d776f6702e	chore: update nodeenrollemnt version (#3439 )	3 years ago
Irena Rindos	0fcf0e21d9	chore(server): Update worker auth repository to handle dupe nodes (#3410 ) * chore(server): Update worker auth repository to use nodee DuplicateRecordError	3 years ago
Jim	7de0a299e4	chore: update gldap dep to fix intermittent shutdown/stop error (#3350 ) Occasionally, we see an error from the gldap test directory reported during the shutdown/close of the directories listener. This update should fix that issue.	3 years ago
Jim	d6c6d428ff	chore: update go-dbw dep, required a few other deps as well. (#3284 )	3 years ago
Jim	9ea00088bd	chore: update go-kms-wrapping dep (#3260 )	3 years ago
Johan Brandhorst-Satzkorn	0c8177590f	Upgrade grpc-gateway dependency (#3257 ) * proto: correct classification of authz token The target authorization token had the invalid classification "private". Fortunately, classification is a fail-closed system, so this won't have exposed users authorization tokens, but we should still use the correct classification. Use "secret". * scripts: add Go script to remove gotags comments The new version of grpc-gateway includes our gotags comments in the generate swagger documentation. This script removes all mentions of these. * Upgrade grpc-gateway dependency Mainly we need this to fix generation of our docs side API docs, but it also includes a nice fix for the new Download RPC, i.e. it now contains the correct response schema (a binary stream).	3 years ago
Johan Brandhorst-Satzkorn	c765db2bb8	Upgrade go-secure-stdlib dependencies (#3256 )	3 years ago
Jim	536551dc0c	fix: update go-dbw dep and refactor conversion of pgx errors (#3242 )	3 years ago
Johan Brandhorst-Satzkorn	59f78ac1f8	config: allow wasm execution under UI CSP The wasm-unsafe-eval option is necessary for the asciinema player on the Admin UI	3 years ago
Timothy Messier	9302705d1b	chore: Update go-kms-wrapping dep This is necessary to get the SigInfoSigner.	3 years ago
Jeff Mitchell	e8559d142a	Fix worker auth rotation test (#3243 ) Most of the changes here are changes or enhancements that are useful for tests. The crux of the issue was that I had pulled up one var to the package level so it could be read from tests, but that var was not being reset between tests. It's not even used in tests anymore, so I put it back to function-local.	3 years ago
Jeff Mitchell	5b98aecaba	Bump deps (#3240 ) These are deps either maintained by the Boundary team or approved by members of the team. A few specific notes on some of the non-HC and non-DB ones: github.com/fatih/color: fixes some windows issues github.com/zalando/go-keyring: fixes a windows crash	3 years ago
Jeff Mitchell	c8f37ca4dc	Perform mod tidy	3 years ago
Jeff Mitchell	4c024858c4	Bump nodeenrollment dep	3 years ago
Jeff Mitchell	5716a30813	Update nodeenrollment to fix TLS issue; add debug (#3231 ) * Add more logging to worker auth rotation and test flags This makes it much easier to figure out when and why rotation is happening and control it for tests/debugging. * Update auth rotation logic Because we were looking at validity period of client certs, which may not have matched the actual rotation interval, it was possible (mostly in test scenarios) for the rotation to happen multiple times on the roots before we actually hit the worker rotation interval. This changes how the interval is calculated by looking at the difference between not-after values on the certs to understand the rotation interval being used by the controller. We then use that as the starting point for calculating a next-rotation time.	3 years ago
Jeff Mitchell	33ccb121c8	Bump nodeenrollment version	3 years ago

1 2 3 4 5 ...

289 Commits (3bf925ca325964acd3b6c8d108e00a6aef5e65ff)