198 Commits (e596daf34d444872f072de49a4ee2d16caa965eb)

Author	SHA1	Message	Date
Jeff Mitchell	7eb29261b2	Update to go-kms-wrapping version 2, and plugin-based KMS (#1901)	4 years ago
Louis Ruch	64fd93e088	chore(release): Bump API version and changelog for 0.7.5	4 years ago
Louis Ruch	ecbeab9035	chore(release): bump api/sdk versions	4 years ago
Jim	591ec476e7	refactor: Update internal/db and oplog to use go-dbw package for database operations. (#1785) ... * chore: Add new dbw dependency * refactor: Convert to use dbw.DB * refactor (db): Change GetTicket(...) signature * feature (db tests): Added TestDeleteWhere(...) Adding this allows us to eliminate a leak of the gorm library * refactor: Add ctx to ScanRows(...) signature This is required to refactor all the deprecated errors pkg calls. This refactor required adding a context to quite a few call chains and in particular the job scheduler bits * feature (db/tests): Add support for test opt: WithTestLogLevel(...) This test only option allows callers to specify a log level for the underlying db package (where supported/applicable) when calling TestSetup(...) * refactor (db): Simplify Db type Only store the underlying *DB and create the *RW on demand when needed. * refactor (oplog): Port to using dbw pkg for db operations * refactor (db): Remove gormDB(...) func * tests (db): Add unit tests for TestDeleteWhere(...) * chore: make fmt changes to formatting	4 years ago
Jim	baa1d88f1f	feature: Add client ip to inbound request information (#1678) ... * feature: Add client ip to inbound request information * feature (workers): Add the user's client IP to a session's connection information (#1749)	4 years ago
Hugo Vieira	f1063a62a0	feature(config): add sockaddr template support	4 years ago
Jim	dba5bc88a0	chore: Upgrade gorm deps (#1747)	4 years ago
Louis Ruch	bc0e23bdf1	chore: bump api/sdk versions	4 years ago
Jeff Mitchell	4bf86e6394	Update SDK/API versions to main branches after merge	4 years ago
Todd Knight	884e1f2d18	Merge branch 'main' into plugin-hostcatalogs ... # Conflicts: # go.mod # sdk/go.mod	4 years ago
Jeff Mitchell	962c9463fd	Update SDK/API modules	4 years ago
Jim	b96f57ec4e	fix (events): Only "sign" audit events (#1677) ... * chore: Update eventlogger dependency. We need the latest version, so we can limit the type of events that are signed. * fix (events): Only "sign" audit events	4 years ago
Jeff Mitchell	48ac8b8f0b	Merge branch 'main' into plugin-hostcatalogs	4 years ago
Jim	eecd878b36	feature: Add signing (hmac-sha256) of audit entries (#1666)	5 years ago
Jeff Mitchell	80d41b9044	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Todd	ec36528e97	Updating dependencies since the host plugins were updated. (#1649)	5 years ago
Todd	1312628a1e	Add plugin set sync and orphaned host cleanup jobs (#1647)	5 years ago
Jim	8ae6e9892f	feature (events/audit): Add auth info to audit events (#1644)	5 years ago
Jeff Mitchell	b64761f38f	Add repository and functions around plugin host set membership (#1629) ... Co-authored-by: Todd <T.Alan.Knight@gmail.com>	5 years ago
Jeff Mitchell	b1a72bd445	Merge remote-tracking branch 'origin/main' into plugin-hostcatalogs	5 years ago
Jeff Mitchell	1782f6a4e4	Enhance worker connection security (#1641) ... This stores worker connection nonces within the database to ensure uniqueness of connections. Prior the connection required any attacker to be able to decrypt the incoming encrypted authentication message in order to replay (and if the attacker has access to the KMS you have bigger problems), but with this change even if an attacker does have access to the KMS key, they cannot reuse the same message. (If they're able to encrypt against the KMS key, they can still act as a worker with a new message, so this only really helps if they only have decryption capabilities.)	5 years ago
Jim	a679300b50	feature (events): Classify auth method request/resp messages for audit events. (#1640) ... * refactor (oidc): Stop emitting error for not found token id Stop emitting errors when authtoken repo.IssueAuthToken is called and there's if no pending token. It's not an "normal" state and not an error condition. * feature (audit tagging): Add tags for auth method requests/responses Including testing functions for asserting audit events created when a service is called	5 years ago
Todd	8795b20fe2	Delete actions for plugin based catalogs and sets (#1622) ... * Add ability to delete plugin based host catalogs and host sets * Add plugin host catalog and set tests for API.	5 years ago
Jeff Mitchell	0fd906d964	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jim	769416c2ff	refactor (controller): Use a grpc server for the grpc-gateway (#1576) ... * refactor (controller): Use a grpc server for the grpc-gateway This starts a grpc server for the grpc-gateway. The new gateway server uses an in-memory listener which also supports "dialing", so the http proxy can connect to the in-memory listener. This change allows us to use all grpc server features and was in part motivated by a need for an interceptor of inbound requests. With that said, having a "proper" grpc server for the gateway will provide a lot more flexibility and capabilities moving forward. The request context will still be verified via middleware in the http proxy (see wrapHandlerWithCommonFuncs). This verified context will be serialized into a protobuf and sent along to the grpc-gateway via metadata where an interceptor will add the verified request info to the request's context (see requestCtxInterceptor). The interceptor will verify the serialized request info via a shared ticket with it's companion in-memory http proxy. FYI: the ticket is simply random base62 string (see db.NewPrivateId). This change also necessitated a minor change to services. We need to return an empty response instead of nil, nil when there are no errors and the response is empty. * refactor (handlers): Rename gRPC Gateway filter Originally, this was called an OutgoingInterceptor, which is an unfortunate name since it's not an interceptor. Now that we're refactoring the gateway stuff and have proper interceptors, renaming this should remove ambiguity * refactor: Rework how 204 with empty msg is handled Recent changes to grpc gateway has necessitated a change to how 204s are handled by the gateway * tests (bats): Check status codes for delete operations	5 years ago
Jeff Mitchell	1c8e0ed1e1	Add scaffolding for external host plugins and convert aws/azure over (#1581)	5 years ago
Jeff Mitchell	f6efde041d	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jim	3b99ded7ad	refactor: Update gorm deps (#1591) ... Our recent upstream PR was merged into gorm. We needed to change just a few bits to migrate our gorm dep back to the upstream source.	5 years ago
Jeff Mitchell	098c3e1f22	Update sdk dep from proper branch and fix building	5 years ago
Jeff Mitchell	158ab09952	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jim	c8b29ded1c	Events: Add outbound detail protobufs, request status code, and update event encrypt filter. (#1569) ... * feat (events): Add status code to audit events * feat (events): Add the resp proto msg to every audit event * chore (events): Update eventlogger dep This latest version will redact any map and/or map field which isn't explicitly classified via a Taggable interface * feat (events): Begin to add tagging to response proto msgs	5 years ago
Jim	8d6dee09a9	refact: Add db.DB wrapper and refact all test fixtures to use it. (#1535) ... * refact: Changes required for gorm v2 * refact: Add db.DB wrapper and refact all test fixtures to use it Stop leaking the gorm abstraction within our unit tests. * refact: Migrate direct calls to pq to pgx driver The refactor will remove the remaining direct dependencies on the pq driver which has been deprecated in favor of the pgx driver. It includes the addition of common.SqlOpen which is a wrapper around sql.Open, which is needed to deal with the driver name changing from "postgres" to "pgx" but in our code base the dialect and driver are synonyms.	5 years ago
Jim	136ac00b49	refact: Changes required for gorm v2 (#1528)	5 years ago
Jeff Mitchell	08ce7ac889	Update azure plugin to fix tag-based filtering	5 years ago
Todd	e11a481256	Register Azure and AWS at controller start up (#1570) ... * Register Plugins. * Pass catalogs and persisted data when listing hosts for host sets. Register azure plugin at startup if not present.	5 years ago
Jim	f9c043c866	chore: Update sdk and api deps	5 years ago
Jeff Mitchell	f9c620a5d5	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jeff Mitchell	7c32d25dd8	Bump dockertest and atomic (#1545)	5 years ago
Jeff Mitchell	7dff943a91	Bump some x deps up (#1544)	5 years ago
Jeff Mitchell	8a2716c503	Update various grpc deps (#1541)	5 years ago
Jeff Mitchell	8503d6c62e	Update protoc-go-inject-tag and pq deps (#1539)	5 years ago
Jeff Mitchell	c82d37bfba	Updating dbassert (no code changes, just newer version number)	5 years ago
Jeff Mitchell	021f1ff55e	Update various dependencies (#1540)	5 years ago
Jeff Mitchell	e07792cf74	Add endpoint preferencer (#1526)	5 years ago
Jeff Mitchell	68867ef01e	Update api/sdk tags	5 years ago
Jeff Mitchell	e9a8ede0d6	Move wrapper package back to SDK (#1511) ... TF uses this, so SDK is a decent place for it. It doesn't create dependencies between it and API.	5 years ago
Jeff Mitchell	d7a990b62b	Bump api/sdk in main module	5 years ago
Jim	6ad8333b97	chore: update sdk and api deps	5 years ago
Jim	5f46207e76	Events: add redact/encrypt node for audit events to Eventer (#1490) ... * feat (events): Add new options needed for AuditConfig WithAuditWrapper and WithFilterOperations all for optional paramters when creating AuditConfig types. * refactor (event): Change EventerConfig.Sinks to a ptr We need to modify the SinkConfig.AuditConfig during the NewEventer factory, so we have to use a ptr not a ref. * feat (events): Add audit configuration types * feat (events): add audit config to sink configuration. * feat (events): add redact/encrypt node for audit events to Eventer Integrate the encrypt.Filter node from the eventlogger into the event.Eventer, so audit events can be redacted/encrypted based on data classifications. * test (events) Add test protobufs for events Add test protobufs along with a test service for testing the audit event encrypt node	5 years ago
Jeff Mitchell	b0dbd0182e	Add support for additional awskms parameters (#1468) ... This updates to the latest go-kms-wrapping tag to support these parameters and documents them.	5 years ago