Jeff Mitchell
6cfdd7b40c
Rejig some error messages in pki
2017-10-27 12:02:18 -04:00
Jeff Mitchell
cd6d67d84b
Final sync
2017-10-23 17:39:21 -04:00
Vishal Nayak
a5e0e42b6a
return the actual error for base64 decoding failure ( #3397 )
2017-10-20 11:21:45 -04:00
Jeremy Voorhis
333bd83a3f
Implement signing of pre-hashed data ( #3448 )
...
Transit backend sign and verify endpoints now support algorithm=none
2017-10-11 11:48:51 -04:00
Jeff Mitchell
04e8d163ba
Allow entering PKI URLs as arrays. ( #3409 )
...
Fixes #3407
2017-10-03 16:13:57 -04:00
Nicolas Corrarello
222b9d1c52
Removing ignore to cleanup function
2017-09-29 09:35:17 +01:00
Nicolas Corrarello
7e5c465ecb
Working tests
2017-09-29 09:33:58 +01:00
Nicolas Corrarello
bf68079051
Various fixes (Null pointer, wait for Nomad go up, Auth before policy creation)
2017-09-28 23:58:41 +01:00
Nicolas Corrarello
ca9ad73565
Adding Global tokens to the data model
2017-09-28 23:57:48 +01:00
Nicolas Corrarello
9338277c67
Added tests
2017-09-28 21:44:30 +01:00
Nicolas Corrarello
393e7bf7e8
Fixing data model
2017-09-20 17:14:35 -05:00
Nicolas Corrarello
4cda42ad8f
MVP of working Nomad Secret Backend
2017-09-20 15:59:35 -05:00
Jeff Mitchell
2c6e64226c
Tests were not actually forcing the intermediate to have a longer TTL
...
because of mount max TTL constraint. This ups the mount max to force the
test to work as expected.
2017-09-14 22:49:04 -04:00
Jeff Mitchell
f970aea9f8
Change behavior of TTL in sign-intermediate ( #3325 )
...
* Fix using wrong public key in sign-self-issued
* Change behavior of TTL in sign-intermediate
This allows signing CA certs with an expiration past the signer's
NotAfter.
It also change sign-self-issued to replace the Issuer, since it's
potentially RFC legal but stacks won't validate it.
Ref: https://groups.google.com/d/msg/vault-tool/giP69-n2o20/FfhRpW1vAQAJ
2017-09-13 11:42:45 -04:00
Calvin Leung Huang
8a65b1745b
Handle errors from getRootConfig on aws logical backend ( #3294 )
2017-09-08 13:00:29 -04:00
Jeff Mitchell
cdc5b0b1da
Add a bit more delay to backend test in case Travis is loaded
2017-09-04 14:45:12 -04:00
Jeff Mitchell
4ad96d9513
Add pki/root/sign-self-issued. ( #3274 )
...
* Add pki/root/sign-self-issued.
This is useful for root CA rolling, and is also suitably dangerous.
Along the way I noticed we weren't setting the authority key IDs
anywhere, so I addressed that.
* Add tests
2017-08-31 23:07:15 -04:00
Jeff Mitchell
f3a3e5ad8f
Use TypeDurationSecond for TTL values in PKI. ( #3270 )
2017-08-31 15:46:13 -04:00
Lars Lehtonen
56f127300d
fix swallowed errors in pki package tests ( #3215 )
2017-08-29 13:15:36 -04:00
Jeff Mitchell
e6b43f7278
Add permitted dns domains to pki ( #3164 )
2017-08-15 16:10:36 -04:00
Jeff Mitchell
2946d133af
Make PKI root generation idempotent-ish and add delete endpoint. ( #3165 )
2017-08-15 14:00:40 -04:00
Calvin Leung Huang
e0c84d0f9f
Direct plugin logs through vault's logger ( #3142 )
...
* Direct plugin logs through vault's logger
* Pass in a logger in testConfig
2017-08-15 10:16:48 -04:00
Brian Kassouf
6e6bd6ee5c
Bump database plugin protocol version
2017-08-08 17:01:38 -07:00
Lars Lehtonen
cdc7a2dd0c
Handle dropped checkok pattern in mysql package ( #3082 )
2017-08-02 19:34:58 -04:00
Chris Hoffman
915cd3a188
adding warning for conflicting role and request parameters ( #3083 )
2017-08-02 10:02:40 -04:00
Jeff Mitchell
54e3d61d6b
Use RemoteCredProvider instead of EC2RoleProvider ( #2983 )
2017-07-31 18:27:16 -04:00
Jeff Mitchell
efe5a35c4a
Clean up plugin tests with CA info
2017-07-31 15:09:19 -04:00
Jeff Mitchell
c6615e1b51
Add a -dev-three-node option for devs. ( #3081 )
2017-07-31 11:28:06 -04:00
Calvin Leung Huang
dd72c96dc8
Add BackendType to existing backends ( #3078 )
2017-07-28 14:04:46 -04:00
Jeff Mitchell
158c21905e
Add note about ed25519 hashing to docs and path help.
...
Fixes #3074
Closes #3076
2017-07-28 09:30:27 -04:00
Chris Hoffman
0ac923d38b
fixing recovery from x/golang/crypto panics
2017-07-27 21:00:31 -04:00
Jeff Mitchell
4a951fdeac
Recover during a request forward.
...
gRPC doesn't have a handler for recovering from a panic like a normal
HTTP request so a panic will actually kill Vault's listener. This
basically copies the net/http logic for managing this.
The SSH-specific logic is removed here as the underlying issue is caused
by the request forwarding mechanism.
2017-07-27 11:44:56 -04:00
Lars Lehtonen
79b1c910fe
Handle dropped checkok pattern in postgresql package ( #3046 )
2017-07-26 12:28:02 -04:00
Calvin Leung Huang
2b0f80b981
Backend plugin system ( #2874 )
...
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017 )
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 13:28:40 -04:00
Lars Lehtonen
730bb03c77
Fix swallowed errors in builtin ( #2977 )
2017-07-07 08:23:12 -04:00
Jeff Mitchell
a7d0fb7d50
Don't panic in audit logs when reading transit keys. ( #2970 )
2017-07-05 11:25:10 -04:00
Brian Shumate
99fe56434e
DOCS: fix typo in ssh path help ( #2966 )
2017-07-04 13:59:34 -04:00
Jeff Mitchell
f75f5b0add
Port TestCluster changes from proxy branch
2017-07-03 14:54:01 -04:00
Brian Nuszkowski
5bc4dc7540
Add the option to specify a specific key id format that is generated … ( #2888 )
2017-06-29 04:05:06 +01:00
Jeff Mitchell
25757049d3
Ensure TOTP codes cannot be reused. ( #2908 )
2017-06-23 16:21:34 +01:00
Jeff Mitchell
f6155ea8c5
If recovering from panic ensure the cert returned is nil
2017-06-16 18:18:15 -04:00
Jeff Mitchell
0ee100e0ec
Go's SSH library can panic without warning; recover.
...
Ping #2877 -- but don't close yet in case there are more places.
2017-06-16 18:16:45 -04:00
Matthew Irish
5190b87714
add min_encryption_version to the transit key response ( #2838 )
2017-06-08 13:07:18 -05:00
Jeff Mitchell
2daf018361
Add listing to database connections. ( #2827 )
...
Fixes #2823
2017-06-07 10:03:17 -04:00
Jeff Mitchell
bca213cf6d
Add ability to specify encryption key version in transit ( #2821 )
2017-06-06 16:02:54 -04:00
Brian Kassouf
abc900157b
Use the role name in the db username ( #2812 )
2017-06-06 09:49:49 -04:00
Jeff Mitchell
a52fae256a
ed25519 support in transit ( #2778 )
2017-06-05 15:00:39 -04:00
Jeff Mitchell
83ecd0f9ad
Allow accessing Warnings directly in Response. ( #2806 )
...
A change in copystructure has caused some panics due to the custom copy
function. I'm more nervous about production panics than I am about
keeping some bad code wiping out some existing warnings, so remove the
custom copy function and just allow direct setting of Warnings.
2017-06-05 10:52:43 -04:00
Jeff Mitchell
41d4c69b54
Update some path-help in datakey
2017-05-23 10:04:32 -04:00
Vishal Nayak
5d9277b2fb
Added host key call back for ssh config ( #2752 )
2017-05-21 20:16:13 -04:00
emily
38ffde5a9d
add gofmt checks to Vault and format existing code ( #2745 )
2017-05-19 08:34:17 -04:00
sprohaska
3ba9486ba9
logical/aws: Fix typo in warning message ( #2747 )
...
Signed-off-by: Steffen Prohaska <prohaska@zib.de>
2017-05-19 06:20:54 -04:00
Brian Kassouf
a51a0874b6
Update the error when no key can be found to a more clear error text ( #2720 )
2017-05-12 14:14:00 -04:00
Brian Kassouf
c55fd585f3
Add plugin level docs for what statements are supported and how they should be formatted
2017-05-11 11:59:58 -07:00
Seth Rutner
8675332afa
Fix typos in error message ( #2692 )
2017-05-10 10:28:35 -04:00
Jeff Mitchell
eb0e7cd0d2
Don't write salts in initialization, look up on demand ( #2702 )
2017-05-09 17:51:09 -04:00
Jeff Mitchell
2e567bd5e7
Only run cassandra tests on Travis for right now
2017-05-09 08:36:20 -04:00
Jeff Mitchell
2fbd973001
Add logic to skip initialization in some cases and some invalidation logic
2017-05-05 15:01:52 -04:00
Brian Kassouf
fcd4f903c3
Merge remote-tracking branch 'oss/master' into database-refactor
2017-05-04 12:40:00 -07:00
Brian Kassouf
886f873ffc
Update docs and return a better error message
2017-05-04 11:45:27 -07:00
mymercurialsky
461d658e88
Implemented TOTP Secret Backend ( #2492 )
...
* Initialized basic outline of TOTP backend using Postgresql backend as template
* Updated TOTP backend.go's structure and help string
* Updated TOTP path_roles.go's structure and help strings
* Updated TOTP path_role_create.go's structure and help strings
* Fixed typo in path_roles.go
* Fixed errors in path_role_create.go and path_roles.go
* Added TOTP secret backend information to cli commands
* Fixed build errors in path_roles.go and path_role_create.go
* Changed field values of period and digits from uint to int, added uint conversion of period when generating passwords
* Initialized TOTP test file based on structure of postgresql test file
* Added enforcement of input values
* Added otp library to vendor folder
* Added test steps and cleaned up errors
* Modified read credential test step, not working yet
* Use of vendored package not allowed - Test error
* Removed vendor files for TOTP library
* Revert "Removed vendor files for TOTP library"
This reverts commit fcd030994b
2017-05-04 10:49:42 -07:00
Brian Kassouf
55f1f5116a
Merge remote-tracking branch 'oss/master' into database-refactor
2017-05-04 10:45:18 -07:00
Brian Kassouf
c825362304
PR comments
2017-05-04 10:41:59 -07:00
Brian Kassouf
2af2b855f5
Feedback from PR
2017-05-03 17:37:34 -07:00
Brian Kassouf
a3619c4521
Update databse backend tests to use the APIClientMeta for the plugin conns
2017-05-03 16:34:09 -07:00
Calvin Leung Huang
207983f526
Minor comment update on cert_util
2017-05-03 16:13:54 -04:00
Chris Hoffman
cf4ef59477
Merge pull request #2575 from hashicorp/pki-colons-to-hyphens
...
Change storage of PKI entries from colons to hyphens
2017-05-03 15:07:15 -04:00
Chris Hoffman
29e5ce66bb
Minor readability enhancements for migration path from old to new
2017-05-03 14:58:22 -04:00
Calvin Leung Huang
96bcd50de0
Include and use normalizeSerial func
2017-05-03 10:12:58 -04:00
Brian Kassouf
60753dcf12
Only wrap in tracing middleware if the logger is set to trace level
2017-05-02 17:19:49 -07:00
Brian Kassouf
1df8ec9ef7
Update the api for serving plugins and provide a utility to pass TLS data for commuinicating with the vault process
2017-05-02 14:40:11 -07:00
Calvin Leung Huang
8c03765bb5
Use variables for string replacements on cert_util
2017-05-02 14:11:57 -04:00
Brian Kassouf
6ddfe9aa7f
Rename NewPluginServer to just Serve
2017-05-02 02:00:39 -07:00
Brian Kassouf
6ca436cdf5
Don't store an error response as a package variable
2017-05-01 15:30:56 -07:00
Brian Kassouf
b87f8a13ed
Update interface name from Wrapper to a more descriptive RunnerUtil
2017-05-01 14:59:55 -07:00
Justin Gerace
2e8e9ed02d
Add globbing support to the PKI backend's allowed_domains list ( #2517 )
2017-05-01 10:40:18 -04:00
Calvin Leung Huang
74965a87af
Add test for ca and crl case
2017-04-28 08:55:28 -04:00
Vishal Nayak
c947e31d1b
Return error message for failure to parse CSR ( #2657 )
2017-04-28 08:30:24 -04:00
Calvin Leung Huang
38a01b8e1b
Refactor cert_util_test
2017-04-27 17:09:59 -04:00
Calvin Leung Huang
7fdf4acc6f
Verify update operation was performed on revokeCert
2017-04-27 12:30:44 -04:00
Calvin Leung Huang
a5ddaabdba
Rename tests, use HandleRequest() for existing paths
2017-04-27 09:47:56 -04:00
Brian Kassouf
2e2d3827da
Add check to ensure we don't overwrite existing connections
2017-04-26 16:43:42 -07:00
Brian Kassouf
f92d6868a0
Add an error check to reset a plugin if it is closed
2017-04-26 15:55:34 -07:00
Brian Kassouf
6b050470fd
Update to a RWMutex
2017-04-26 15:23:14 -07:00
Calvin Leung Huang
ced4c88050
Add remaining tests
2017-04-26 16:05:58 -04:00
Brian Kassouf
d8dbfc6a0c
Update the error messages for renew and revoke
2017-04-26 10:29:16 -07:00
Brian Kassouf
37aacba0da
Change ttl types to TypeDurationSecond
2017-04-26 10:02:37 -07:00
Calvin Leung Huang
4bf51ca52c
Fix crl_util test
2017-04-26 09:58:34 -04:00
Calvin Leung Huang
c269fe1ce0
Tests for cert and crl util
2017-04-26 02:46:01 -04:00
Brian Kassouf
6131bdd3b9
Default deny when allowed roles is empty
2017-04-25 11:48:24 -07:00
Brian Kassouf
e18757628c
Update the connection details data and fix allowedRoles
2017-04-25 11:11:10 -07:00
Brian Kassouf
58b0bbd477
Rename path_role_create to path_creds_create
2017-04-25 10:39:17 -07:00
Brian Kassouf
22612adefc
Use TypeCommaStringSlice for allowed_roles
2017-04-25 10:26:23 -07:00
Brian Kassouf
6741811407
Update logging to new structure
2017-04-25 10:24:19 -07:00
Brian Kassouf
194695f1fa
Don't uppercase ErrorResponses
2017-04-24 14:03:48 -07:00
Brian Kassouf
f6b96ccfa2
s/DatabaseType/Database/
2017-04-24 13:59:12 -07:00
Brian Kassouf
f1fa617e03
Calls to builtin plugins now go directly to the implementation instead of go-plugin
2017-04-20 18:46:41 -07:00
Brian Kassouf
afc5be1c67
Merge remote-tracking branch 'oss/master' into database-refactor
2017-04-19 15:16:00 -07:00
Chris Hoffman
d6edfc2a25
Rename ParseDedupAndSortStrings to ParseDedupLowercaseAndSortStrings ( #2614 )
2017-04-19 10:39:07 -04:00
Chris Hoffman
6b55ab5db0
Mssql driver update ( #2610 )
...
* Switching driver from mssql to sqlserver
* Adding explicit database to sp_msloginmappings call
2017-04-18 17:49:59 -04:00
Jeff Mitchell
85b92811ab
Update sign-verbatim to correctly set generate_lease ( #2593 )
2017-04-18 15:54:31 -04:00
Jeff Mitchell
866b384494
Parse and dedup but do not lowercase principals in SSH certs. ( #2591 )
2017-04-18 12:21:02 -04:00
Jeff Mitchell
dba2de57de
Change storage of entries from colons to hyphens and add a
...
lookup/migration path
Still TODO: tests on migration path
Fixes #2552
2017-04-18 11:14:23 -04:00
Jeff Mitchell
f698db479c
Fix cassandra dep breakage
2017-04-17 11:51:42 -04:00
Jeff Mitchell
f92b173295
Verify that a CSR specifies IP SANs before checking whether it's allowed ( #2574 )
2017-04-13 13:40:31 -04:00
Brian Kassouf
b20c17745c
Add allowed_roles parameter and checks
2017-04-13 10:33:34 -07:00
Brian Kassouf
4c75326aad
Cleanup path files
2017-04-12 17:35:02 -07:00
Brian Kassouf
03e2bcbc79
Update Type() to return an error
2017-04-12 16:41:06 -07:00
Brian Kassouf
f2401c0128
Merge branch 'master' into database-refactor
2017-04-12 14:29:10 -07:00
Brian Kassouf
8f75c30311
Update help text and comments
2017-04-11 11:50:34 -07:00
Brian Kassouf
da4d9a8b4f
Remove unnecessary abstraction
2017-04-10 18:38:34 -07:00
Brian Kassouf
de36d61e5a
Mlock the plugin process
2017-04-10 17:12:52 -07:00
Brian Kassouf
f54c4de98a
Add a flag to tell plugins to verify the connection was successful
2017-04-10 15:36:59 -07:00
Brian Kassouf
64efc505c8
Update plugin test
2017-04-10 14:12:28 -07:00
Brian Kassouf
73f66f89cd
Update the interface for plugins removing functions for creating creds
2017-04-10 12:24:16 -07:00
Brian Kassouf
3c1c388589
Update backend tests
2017-04-10 10:35:16 -07:00
Brian Kassouf
9ae5a2aede
Add backend test
2017-04-07 15:50:03 -07:00
Shivaram Lingamneni
7cbc5d6e05
implement a no_store option for pki roles ( #2565 )
2017-04-07 11:25:47 -07:00
Jeff Mitchell
14c0000169
Update SSH CA documentation
...
Fixes #2551
Fixes #2569
2017-04-07 11:59:25 -04:00
Brian Kassouf
8e77bd98d8
Move plugin code into sub directory
2017-04-06 12:20:10 -07:00
Brian Kassouf
8a2e29c607
Refactor to use builtin plugins from an external repo
2017-04-05 16:20:31 -07:00
Calvin Leung Huang
73a2cdf6a5
Do not mark conn as initialized until the end ( #2567 )
2017-04-04 14:26:59 -07:00
Brian Kassouf
df944f2d92
Don't return strings, always structs
2017-04-04 11:33:58 -07:00
Calvin Leung Huang
8e3cb50bfc
Database refactor invalidate ( #2566 )
...
* WIP on invalidate function
* cassandraConnectionProducer has Close()
* Delete database from connections map on successful db.Close()
* Move clear connection into its own func
* Use const for database config path
2017-04-04 11:32:42 -07:00
Jeff Mitchell
cfd522e0f0
Use ParseStringSlice on PKI organization/organizational unit. ( #2561 )
...
After, separately dedup and use new flag to not lowercase value.
Fixes #2555
2017-04-04 08:54:18 -07:00
Brian Kassouf
1faa5fc020
On change of configuration rotate the database type
2017-04-03 18:30:38 -07:00
Brian Kassouf
b54e1cd295
Merge branch 'database-refactor' of github.com:hashicorp/vault into database-refactor
2017-04-03 17:52:41 -07:00
Brian Kassouf
ac519abecf
Plugin catalog
2017-04-03 17:52:29 -07:00
Calvin Leung Huang
2b08521ab6
Database refactor mssql ( #2562 )
...
* WIP on mssql secret backend refactor
* Add RevokeUser test, and use sqlserver driver internally
* Remove debug statements
* Fix code comment
2017-04-03 09:59:30 -07:00
Brian Kassouf
1d3d3b7803
fix for plugin commands that have more than one paramater
2017-03-28 14:37:57 -07:00
Brian Kassouf
8ef78f0610
Add comments to connection and credential producers
2017-03-28 13:08:11 -07:00
Brian Kassouf
947fd66480
Cleanup the db factory code and add comments
2017-03-28 12:57:30 -07:00
Brian Kassouf
0c562fa3d7
Update tests
2017-03-28 12:20:17 -07:00
Brian Kassouf
6de5cfad5e
Add functionaility to build db objects from disk so restarts work
2017-03-28 11:30:45 -07:00
Brian Kassouf
d93378bb29
Fix for checking types of database on update
2017-03-28 10:04:42 -07:00
Brian Kassouf
b2c4555c1f
Wrap the database calls with tracing information
2017-03-27 15:17:28 -07:00
Brian Kassouf
ca026c6cfd
Remove the unused sync.Once object
2017-03-27 11:46:20 -07:00
Brian Kassouf
e870e399a2
More work on getting tests to pass
2017-03-23 15:54:15 -07:00
Brian Kassouf
a1b72465dd
Remove unsused code block
2017-03-22 17:09:39 -07:00
Brian Kassouf
cab491f7b7
s/postgres/mysql/
2017-03-22 16:44:33 -07:00
Brian Kassouf
73e553af95
Add test files for postgres and mysql databases
2017-03-22 16:39:08 -07:00
Brian Kassouf
9aaec25a4e
Add a error message for empty creation statement
2017-03-22 12:40:16 -07:00
Brian Kassouf
1be813605f
Fix race with deleting the connection
2017-03-22 09:54:19 -07:00
Brian Kassouf
2d6f36df17
Add a delete method
2017-03-21 17:19:30 -07:00
Brian Kassouf
2fdb3422a9
Verify connections regardless of if this connections is already existing
2017-03-21 16:05:59 -07:00
Vishal Nayak
16d41a8b28
sshca: ensure atleast cert type is allowed ( #2508 )
2017-03-19 18:58:48 -04:00
Brian Kassouf
ff6749b198
Comment and fix plugin Type function
2017-03-16 18:24:56 -07:00
Brian Kassouf
404596e261
Change the handshake config from the default
2017-03-16 17:51:25 -07:00
Brian Kassouf
4043f533b8
Add a secure config to verify the checksum of the plugin
2017-03-16 16:20:18 -07:00
Brian Kassouf
2ef1cbf3a6
Comment and slight refactor of the TLS plugin helper
2017-03-16 14:14:49 -07:00
Brian Kassouf
3890f194a4
Break tls code into helper library
2017-03-16 11:55:21 -07:00
Jeff Mitchell
3f67ab489a
Ensure CN check is made when exclude_cn_from_sans is used
...
Fixes #2363
2017-03-16 11:41:13 -04:00
Jeff Mitchell
a5d1808efe
Always include a hash of the public key and "vault" (to know where it ( #2498 )
...
came from) when generating a cert for SSH.
Follow on from #2494
2017-03-16 11:14:17 -04:00
Mike Okner
6f84f7ffd0
Adding allow_user_key_ids field to SSH role config ( #2494 )
...
Adding a boolean field that determines whether users will be allowed to
set the ID of the signed SSH key or whether it will always be the token
display name. Preventing users from changing the ID and always using
the token name is useful for auditing who actually used a key to access
a remote host since sshd logs key IDs.
2017-03-16 08:45:11 -04:00
Brian Kassouf
5b05f62fa3
Work on TLS communication over plugins
2017-03-15 17:14:48 -07:00
Jeff Mitchell
688104e69a
Allow roles to specify whether CSR SANs should be used instead of ( #2489 )
...
request values. Fix up some documentation.
Fixes #2451
Fixes #2488
2017-03-15 14:38:18 -04:00
Jeff Mitchell
799000be20
Set CA chain when intermediate does not have an authority key ID.
...
This is essentially an approved review of the code provided in #2465 .
Fixes #2465
2017-03-15 11:52:02 -04:00
Brian Kassouf
a6ae4bd356
wrap plugin database type with metrics middleware
2017-03-14 13:12:47 -07:00
Brian Kassouf
143166b1ba
Add a metrics middleware
2017-03-14 13:11:28 -07:00
Stanislav Grozev
70b30b40d4
Reads on unconfigured SSH CA public key return 400
2017-03-14 10:21:48 -04:00
Stanislav Grozev
5f3397bff5
Reads on ssh/config/ca return the public keys
...
If configured/generated.
2017-03-14 10:21:48 -04:00
Stanislav Grozev
d22796c644
If generating an SSH CA signing key - return the public part
...
So that the user can actually use the SSH CA, by adding the public key
to their respective sshd_config/authorized_keys, etc.
2017-03-14 10:21:48 -04:00
Brian Kassouf
c111b02568
Add a way to initalize plugins and builtin databases the same way.
2017-03-13 14:39:55 -07:00
Brian Kassouf
a0d207e254
Add checksum attribute
2017-03-10 14:10:42 -08:00
Brian Kassouf
72a878b180
Rename reset to close
2017-03-09 22:35:45 -08:00
Brian Kassouf
b63147b7c2
Add special path to enforce root on plugin configuration
2017-03-09 21:31:29 -08:00
Brian Kassouf
3766ab14e5
Add plugin file
2017-03-09 17:43:58 -08:00
Brian Kassouf
d4ea6c1768
Add plugin features
2017-03-09 17:43:37 -08:00
Vishal Nayak
9af1ca3d2c
doc: ssh allowed_users update ( #2462 )
...
* doc: ssh allowed_users update
* added some more context in default_user field
2017-03-09 10:34:55 -05:00
vishalnayak
3bd667a931
Fix typo
2017-03-08 17:49:39 -05:00
Brian Kassouf
00359cdea4
Update secrets fields
2017-03-08 14:46:53 -08:00
Vishal Nayak
a4e41f6568
SSH CA enhancements ( #2442 )
...
* Use constants for storage paths
* Upgrade path for public key storage
* Fix calculateValidPrincipals, upgrade ca_private_key, and other changes
* Remove a print statement
* Added tests for upgrade case
* Make exporting consistent in creation bundle
* unexporting and constants
* Move keys into a struct instead of plain string
* minor changes
2017-03-08 17:36:21 -05:00
Brian Kassouf
cd68899a4a
Fix renew and revoke calls
2017-03-07 17:21:44 -08:00
Brian Kassouf
73200db1d9
Add defaults to the cassandra databse type
2017-03-07 17:00:52 -08:00
Brian Kassouf
78fdc2ad24
Pass statements object
2017-03-07 16:48:17 -08:00
Brian Kassouf
01300e026b
Remove unused sql object
2017-03-07 15:34:23 -08:00
Brian Kassouf
1d23bbbe28
Remove double lock
2017-03-07 15:33:05 -08:00
Brian Kassouf
c823ad0597
Update locking functionaility
2017-03-07 13:48:29 -08:00
Jeff Mitchell
df575f0b3a
Rename helper 'duration' to 'parseutil'. ( #2449 )
...
Add a ParseBool function that accepts various kinds of ways of
specifying booleans.
Have config use ParseBool for UI and disabling mlock/cache.
2017-03-07 11:21:22 -05:00
Brian Kassouf
354233f91d
rename mysql variable
2017-03-03 15:07:41 -08:00
Brian Kassouf
4d335099de
Make db instances immutable and add a reset path to tear down and create a new database instance with an updated config
2017-03-03 14:38:49 -08:00
Brian Kassouf
fa8da4cf91
Fix mysql connections
2017-03-03 14:38:49 -08:00
Brian Kassouf
e442917e26
Add mysql into the factory
2017-03-03 14:38:48 -08:00
Brian Kassouf
5e2cffcdd0
Add max connection lifetime param and set consistancy on cassandra session
2017-03-03 14:38:48 -08:00
Brian Kassouf
cee3dc9b9e
s/Statement/Statements/
2017-03-03 14:38:48 -08:00
Brian Kassouf
bfbb104e19
Add mysql database type
2017-03-03 14:38:48 -08:00
Brian Kassouf
ad17d113c7
More work on refactor and cassandra database
2017-03-03 14:38:48 -08:00
Brian Kassouf
3d77a9a6f4
Begin work on database refactor
2017-03-03 14:38:48 -08:00
Vishal Nayak
8491db3ce6
ssh: Added DeleteOperation to config/ca ( #2434 )
...
* ssh: Added DeleteOperation to config/ca
* Address review feedback
2017-03-03 10:19:45 -05:00
Jeff Mitchell
5fe459f91a
Update SSH CA logic/tests
2017-03-02 16:39:22 -05:00
Vishal Nayak
93b74ebe71
Refactor the generate_signing_key processing ( #2430 )
2017-03-02 16:22:06 -05:00
Jeff Mitchell
1c821e448d
Update error text to make it more obvious what the issue is when valid principals aren't found
2017-03-02 15:56:08 -05:00
Jeff Mitchell
db29bde264
Fix a bunch of errors from returning 5xx, and parse more duration types
2017-03-02 15:38:34 -05:00
Will May
ffb5ee7fda
Changes from code review
2017-03-02 14:36:13 -05:00
Will May
f9d853f7f0
Allow internal generation of the signing SSH key pair
2017-03-02 14:36:13 -05:00
Vishal Nayak
d30a833db7
Rework ssh ca ( #2419 )
...
* docs: input format for default_critical_options and default_extensions
* s/sshca/ssh
* Added default_critical_options and default_extensions to the read endpoint of role
* Change default time return value to 0
2017-03-01 15:50:23 -05:00
Will May
7d9cb5bffe
Changes from code review
...
Major changes are:
* Remove duplicate code
* Check the public key used to configure the backend is a valid one
2017-03-01 15:19:18 -05:00
Will May
59397250da
Changes from code review
...
Major changes are:
* Change `allow_{user,host}_certificates` to default to false
* Add separate `allowed_domains` role property
2017-03-01 15:19:18 -05:00
Will May
1d59b965cb
Add ability to create SSH certificates
2017-03-01 15:19:18 -05:00
vishalnayak
041817b300
Fix broken build caused due to resolve merge conflicts
2017-02-24 12:41:20 -05:00
Vishal Nayak
e3016053b3
PKI: Role switch to control lease generation ( #2403 )
...
* pki: Make generation of leases optional
* pki: add tests for upgrading generate_lease
* pki: add tests for leased and non-leased certs
* docs++ pki generate_lease
* Generate lease is applicable for both issuing and signing
* pki: fix tests
* Address review feedback
* Address review feedback
2017-02-24 12:12:40 -05:00
Saj Goonatilleke
9cd9fbbad3
pki: Include private_key_type on DER-formatted responses from /pki/issue/ ( #2405 )
2017-02-24 11:17:59 -05:00
Jeff Mitchell
8acbdefdf2
More porting from rep ( #2388 )
...
* More porting from rep
* Address review feedback
2017-02-16 16:29:30 -05:00
Jeff Mitchell
98c7bd6c03
Port some replication bits to OSS ( #2386 )
2017-02-16 15:15:02 -05:00
Jeff Mitchell
28883acc16
Fix copypasta, thanks tests
2017-02-16 01:32:39 -05:00
Jeff Mitchell
5e5d9baabe
Add Organization support to PKI backend. ( #2380 )
...
Fixes #2369
2017-02-16 01:04:29 -05:00
Vishal Nayak
a9121ff733
transit: change batch input format ( #2331 )
...
* transit: change batch input format
* transit: no json-in-json for batch response
* docs: transit: update batch input format
* transit: fix tests after changing response format
2017-02-06 14:56:16 -05:00
Vishal Nayak
3797666436
Transit: Support batch encryption and decryption ( #2143 )
...
* Transit: Support batch encryption
* Address review feedback
* Make the normal flow go through as a batch request
* Transit: Error out if encryption fails during batch processing
* Transit: Infer the 'derived' parameter based on 'context' being set
* Transit: Batch encryption doc updates
* Transit: Return a JSON string instead of []byte
* Transit: Add batch encryption tests
* Remove plaintext empty check
* Added tests for batch encryption, more coming..
* Added more batch encryption tests
* Check for base64 decoding of plaintext before encrypting
* Transit: Support batch decryption
* Transit: Added tests for batch decryption
* Transit: Doc update for batch decryption
* Transit: Sync the path-help and website docs for decrypt endpoint
* Add batch processing for rewrap
* transit: input validation for context
* transit: add rewrap batch option to docs
* Remove unnecessary variables from test
* transit: Added tests for rewrap use cases
* Address review feedback
* Address review feedback
* Address review feedback
* transit: move input checking out of critical path
* transit: allow empty plaintexts for batch encryption
* transit: use common structs for batch processing
* transit: avoid duplicate creation of structs; add omitempty to response structs
* transit: address review feedback
* transit: fix tests
* address review feedback
* transit: fix tests
* transit: rewrap encrypt user error should not error out
* transit: error out for internal errors
2017-02-02 14:24:20 -05:00
Jeff Mitchell
3789e8c427
Add cleanup functions to multiple DB backends. ( #2313 )
...
Ensure it's called on unmount, not just for seal.
2017-02-01 14:05:25 -05:00
Jeff Mitchell
b44519e742
Make export errors a bit more meaningful
2017-01-30 09:25:50 -05:00
Jeff Mitchell
082aa90103
Have transit exporting return the same structure regardless of one key or many
2017-01-28 10:37:35 -05:00
Brian Kassouf
c642fbf18e
Migrate cassandra test from acceptance to dockertest ( #2295 )
2017-01-25 15:37:55 -05:00
Jeff Mitchell
28978861de
Revert "Disable PKI OU tests to fix the build"
...
This reverts commit b1ab7c5603
2017-01-24 09:58:28 -05:00
vishalnayak
b1ab7c5603
Disable PKI OU tests to fix the build
2017-01-24 06:25:56 -05:00
joe miller
90e32515ea
allow roles to set OU value in certificates issued by the pki backend ( #2251 )
2017-01-23 12:44:45 -05:00
Chris Hoffman
43bae79d01
Adding support for exportable transit keys ( #2133 )
2017-01-23 11:04:43 -05:00
Vishal Nayak
0645606f84
Merge pull request #2202 from fcantournet/fix_govet_fatalf
...
all: test: Fix govet warnings
2017-01-17 16:45:35 -05:00
Matthew Irish
231f00dff2
Transit key actions ( #2254 )
...
* add supports_* for transit key reads
* update transit docs with new supports_* fields
2017-01-11 10:05:06 -06:00
joe miller
a76a49732d
sign-verbatim should set use_csr_common_name to true ( #2243 )
2017-01-10 09:47:59 -05:00
Jeff Mitchell
454ddd4c48
Use dockertest.v2 ( #2247 )
...
New dockertest has a totally different API and will require some serious
refactoring. This will tide over until then by pinning the API version.
2017-01-09 13:46:54 -05:00
Félix Cantournet
0d6d4211b8
all: test: Fix govet warnings
...
Fix calls to t.Fatal() with formatting.
Fixed some calls to Fatalf() with wrong formatting
2016-12-21 19:44:07 +01:00
vishalnayak
cc92d166f3
Address review feedback
2016-12-20 11:19:47 -05:00
vishalnayak
c80b1dc2b9
pki: Avoiding a storage read
2016-12-20 11:07:20 -05:00
vishalnayak
faa975326d
pki: Appended error to error message
2016-12-19 10:49:32 -05:00
vishalnayak
c8319e330d
PKI: Added error to the error message
2016-12-19 10:47:29 -05:00
Jeff Mitchell
a498cec44f
normalize some capitlization in error messages
2016-12-15 19:02:33 -05:00
Jeff Mitchell
b9be3da2bc
Fix nil value panic when Consul returns a user error ( #2145 )
2016-12-01 10:22:32 -08:00
vascop
59c55e0aa6
Fix typo and remove trailing whitespace. ( #2074 )
2016-11-08 09:32:23 -05:00
Jeff Mitchell
5a6b1987c5
Add listing to Consul secret roles ( #2065 )
2016-11-04 12:35:16 -04:00
vishalnayak
e6daa3782a
Return the revocation_sql from role read all the time
2016-10-27 12:24:31 -04:00
vishalnayak
8293b19a98
Added revocation_sql to the website docs
2016-10-27 12:15:08 -04:00
vishalnayak
2ac019a9c5
Move policy test to keysutil package
2016-10-26 19:57:28 -04:00
vishalnayak
b30d5f5c57
Pulled out transit's lock manager and policy structs into a helper
2016-10-26 19:52:31 -04:00
vishalnayak
b408c95e0d
ssh: Use temporary file to store the identity file
2016-10-18 12:50:12 -04:00
Chris Hoffman
4406a39da2
Add ability to list keys in transit backend ( #1987 )
2016-10-18 10:13:01 -04:00
Laura Bennett
1cc7c811c7
address feedback
2016-10-10 12:16:55 -04:00
Laura Bennett
bc58e02fe8
initial commit to fix empty consistency option issue
2016-10-08 20:22:26 -04:00
Jeff Mitchell
d7615b0477
Don't use quoted identifier for the username
2016-10-05 14:31:19 -04:00
Jeff Mitchell
37df43d534
Postgres revocation sql, beta mode ( #1972 )
2016-10-05 13:52:59 -04:00
vishalnayak
e90acaeb6c
Refactor mysql's revoke SQL
2016-10-04 19:30:25 -04:00
Vishal Nayak
b22b4edc71
Merge pull request #1914 from jpweber/mysql-revoke
...
Mysql revoke with non-wildcard hosts
2016-10-04 17:44:15 -04:00
Jim Weber
6b9b646e8a
removed an unused ok variable. Added warning and force use for default queries if role is nil
2016-10-04 17:15:29 -04:00
Jim Weber
1ec0a2d403
fixed an incorrect assignment
2016-10-03 21:51:40 -04:00
Jim Weber
1b591fb6d5
More resilient around cases of missing role names and using the default when needed.
2016-10-03 20:20:00 -04:00
Jim Weber
67d991f4ab
Refactored logic some to make sure we can always fall back to default revoke statments
...
Changed rolename to role
made default sql revoke statments a const
2016-10-03 15:59:56 -04:00
Jim Weber
179c07075a
fixed some more issues I had with the tests.
2016-10-03 15:58:09 -04:00
Jim Weber
aa5bb3b354
renamed rolname to role
2016-10-03 15:57:47 -04:00
Jim Weber
003d0df191
Reduced duplicated code and fixed comments and simple variable name mistakes
2016-10-03 14:53:05 -04:00
Jim Weber
10855b070f
Added test for revoking mysql user with wild card host and non-wildcard host
2016-10-02 22:28:54 -04:00
Jim Weber
47465e782c
saving role name to the Secret Internal data. Default revoke query added
...
The rolename is now saved to the secret internal data for fetching
later during the user revocation process. No longer deriving the role
name from request path
Added support for default revoke SQL statements that will provide the
same functionality as before. If not revoke SQL statements are provided
the default statements are used.
Cleaned up personal ignores from the .gitignore file
2016-10-02 18:53:16 -04:00
Jeff Mitchell
c748ff322f
Change default TTL from 30 to 32 to accommodate monthly operations ( #1942 )
2016-09-28 18:32:49 -04:00
Laura Bennett
4cfe098ce4
Merge pull request #1931 from hashicorp/cass-consistency
...
Adding consistency into cassandra
2016-09-27 21:12:02 -04:00
Chris Hoffman
10c8024fa3
Adding support for chained intermediate CAs in pki backend ( #1694 )
2016-09-27 17:50:17 -07:00
Laura Bennett
8b41676dbc
minor updates
2016-09-27 20:35:11 -04:00
Laura Bennett
011d65f59c
added parsing at role creation
2016-09-27 16:01:51 -04:00
Laura Bennett
dc4fdf37d7
initial commit for consistency added into cassandra
2016-09-27 13:25:18 -04:00
Vishal Nayak
92cb781be9
Merge pull request #1910 from hashicorp/secret-id-cidr-list
...
CIDR restrictions on Secret ID
2016-09-26 10:22:48 -04:00
Jim Weber
eebd592f78
Getting role name from the creds path used in revocation
2016-09-23 16:57:08 -04:00
Jim Weber
f56f0b174c
secretCredsRevoke command no longer uses hardcoded query
...
The removal of a user from the db is now handled similar to the
creation. The SQL is read out of a key from the role and then executed
with values substituted for username.
2016-09-23 16:05:49 -04:00
Jim Weber
235d67e451
Added support for a revokeSQL key value pair to the role
2016-09-23 16:00:23 -04:00
Jeff Mitchell
bba2ea63f1
Don't use time.Time in responses. ( #1912 )
...
This fixes #1911 but not directly; it doesn't address the cause of the
panic. However, it turns out that this is the correct fix anyways,
because it ensures that the value being logged is RFC3339 format, which
is what the time turns into in JSON but not the normal time string
value, so what we audit log (and HMAC) matches what we are returning.
2016-09-23 12:32:07 -04:00
vishalnayak
fb2f7f27ba
Fix ssh tests
2016-09-22 11:37:55 -04:00
vishalnayak
c93bded97b
Added cidrutil helper
2016-09-21 13:58:32 -04:00
Jeff Mitchell
902067d620
Ensure upgrades have a valid HMAC key
2016-09-21 11:10:57 -04:00
Jeff Mitchell
8482118ac6
Transit and audit enhancements
2016-09-21 10:49:26 -04:00
Chris Hoffman
cd567eb480
Renaming ttl_max -> max_ttl in mssql backend ( #1905 )
2016-09-20 12:39:02 -04:00
Jeff Mitchell
6f6d1f7237
Rename GetOctalFormatted and add serial number to ParsedCertBundle. Basically a noop.
2016-09-16 11:05:43 -04:00
Jeff Mitchell
cf05edaf18
Allow encrypting empty ciphertext values. ( #1881 )
...
Replaces #1874
2016-09-13 12:00:04 -04:00
vishalnayak
f563f38748
Use uuid.GenerateRandomBytes
2016-09-09 14:17:09 -04:00
vishalnayak
70246395d6
Not exposing structs from the backend's package
2016-09-01 11:57:28 -04:00
Jeff Mitchell
201cd2e1f7
Use unexported kdf const names
2016-08-31 07:19:58 -04:00
Jeff Mitchell
9a97f436ef
Use hkdf for transit key derivation for new keys ( #1812 )
...
Use hkdf for transit key derivation for new keys
2016-08-30 16:29:09 -04:00
vishalnayak
8cc5cdb746
STS path field description update
2016-08-30 10:53:21 -04:00
vishalnayak
39b75c6ae9
Added UpdateOperation to logical AWS STS path
2016-08-30 10:30:13 -04:00
Vishal Nayak
fb775993f3
Merge pull request #1804 from hashicorp/issue-1800
...
Mark STS secrets as non-renwable
2016-08-29 11:46:19 -04:00
navinanandaraj
7fbdf927c1
Fixes #1801 Reuse Cassandra session object for create creds ( #1802 )
2016-08-28 17:32:41 -04:00
Jeff Mitchell
9cd4243362
Mark STS secrets as non-renwable
...
Ping #1800
2016-08-28 14:27:56 -04:00
Jeff Mitchell
a542df0173
Derive nonce fully in convergent mode ( #1796 )
...
Ping #1794
2016-08-26 17:01:56 -04:00
Jeff Mitchell
c9aa308804
Use key derivation for convergent nonce. ( #1794 )
...
Use key derivation for convergent nonce.
Fixes #1792
2016-08-26 14:11:03 -04:00
Jeff Mitchell
c2f3c465d3
Decode secret internal data into struct and fix type assertion. ( #1781 )
2016-08-24 15:04:04 -04:00
Jeff Mitchell
68345eb770
Convert to logxi
2016-08-21 18:13:37 -04:00
Jeff Mitchell
357ecb4dfe
gofmt
2016-08-19 16:48:32 -04:00
Jeff Mitchell
6eca449261
Parameter change
...
Both revocation times are UTC so clarify via parameter name that it's just a formatting difference. Also leave as a time.Time here, as it automatically marshals into RFC3339.
2016-08-14 21:43:57 -04:00
Jeff Mitchell
5a12143f16
Cleanup
2016-08-13 11:52:09 -04:00
Jeff Mitchell
f0e0f960ca
Ensure utc value is not zero before adding
2016-08-13 11:50:57 -04:00
Jeff Mitchell
8fd8ae7330
Ensure values to be encoded in a CRL are in UTC. This aligns with the
...
RFC. You might expect Go to ensure this in the CRL generation call,
but...it doesn't.
Fixes #1727
2016-08-13 08:40:09 -04:00
Jeff Mitchell
031437a98f
Fix build
2016-08-08 17:00:59 -04:00
Jeff Mitchell
24bf6fc68e
Address review feedback
2016-08-08 16:30:48 -04:00
Jeff Mitchell
84cd3c20b3
Remove context-as-nonce, add docs, and properly support datakey
2016-08-07 15:53:40 -04:00
Jeff Mitchell
b5858e2237
Add unit tests for convergence in non-context mode
2016-08-07 15:16:36 -04:00
Jeff Mitchell
c7bf73f924
Refactor convergent encryption to make specifying a nonce in addition to context possible
2016-08-05 17:52:44 -04:00
Vincent Batoufflet
38a30a92e3
Fix PKI logical backend email alt_names
2016-08-04 12:10:34 +02:00
Jeff Mitchell
9732c10d03
Add postgres test for block statements
2016-08-03 15:34:50 -04:00
Jeff Mitchell
7d1f0facb8
Add arbitrary string slice parsing.
...
Like the KV function, this supports either separated strings or JSON
strings, base64-encoded or not.
Fixes #1619 in theory.
2016-08-03 14:24:16 -04:00
vishalnayak
ddb6ae18a0
Fix invalid input getting marked as internal error
2016-07-28 16:23:11 -04:00
Jeff Mitchell
4fd83816bf
Add convergence tests to transit backend
2016-07-28 11:30:52 -04:00
Laura Bennett
c6cc73b3bd
Merge pull request #1635 from hashicorp/mysql-idle-conns
...
Added maximum idle connections to mysql to close hashicorp/vault#1616
2016-07-20 15:31:37 -04:00
Jeff Mitchell
6708b5d75f
Set defaults to handle upgrade cases.
...
Ping #1604
2016-07-20 14:07:19 -04:00
Jeff Mitchell
a8a2886538
Merge pull request #1604 from memory/mysql-displayname-2
...
concat role name and token displayname to form mysql username
2016-07-20 14:02:17 -04:00
Nathan J. Mehl
e824f6040b
use both role name and token display name to form mysql username
2016-07-20 10:17:00 -07:00
