vishalnayak
581b293a26
Use go-uuid's GenerateUUID in PutWAL and discart logical.UUID()
2016-07-07 17:57:36 -04:00
vishalnayak
98fca2a31a
Added json.Number as recognized type for FieldData
2016-07-06 18:54:18 -04:00
vishalnayak
ad7cb2c8f1
Added JSON Decode and Encode helpers.
...
Changed all the occurances of Unmarshal to use the helpers.
Fixed http/ package tests.
2016-07-06 12:25:40 -04:00
vishalnayak
6c5e1969ac
Added GetDefaultOrZero method to FieldData
2016-06-10 10:42:01 -04:00
Sean Chittenden
7a4b31ce51
Speling police
2016-05-15 09:58:36 -07:00
vishalnayak
6f65d9293a
Fix framework rollback manager tests
2016-05-14 19:35:36 -04:00
Jeff Mitchell
3e71221839
Merge remote-tracking branch 'origin/master' into aws-auth-backend
2016-05-05 10:04:52 -04:00
vishalnayak
92fe94546c
Split SanitizeTTL method to support time.Duration parameters as well
2016-05-05 09:45:48 -04:00
vishalnayak
21854776af
Added cooldown period for periodic tidying operation
2016-04-26 10:22:29 -04:00
vishalnayak
9aa8fb6cc1
Support periodic tidy callback and config endpoints.
2016-04-26 10:22:29 -04:00
Seth Vargo
86455b4720
Only show params if there are fields
2016-04-13 22:15:06 +01:00
vishalnayak
ba9b5b8847
Fix SanitizeTTL check
2016-03-16 14:27:01 -04:00
vishalnayak
3861c88211
Accept params both as part of URL or as part of http body
2016-03-14 19:14:36 -04:00
Jeff Mitchell
f9fb20bbe4
Make SanitizeTTL treat an empty string the same as a "0" string.
...
This causes a 0 TTL to be returned for the value, which is a clue to
other parts of Vault to use appropriate defaults. However, this makes
the defaults be used at lease allocation or extension time instead of
when parsing parameters.
2016-02-18 16:51:36 -05:00
Jeff Mitchell
627082b838
Remove grace periods
2016-01-31 19:33:16 -05:00
Jeff Mitchell
d5584e12bc
invert logic to prefer client increment
2016-01-29 20:02:15 -05:00
Jeff Mitchell
4619473175
Update proposed time
2016-01-29 19:31:37 -05:00
Jeff Mitchell
7353fa3e56
Adjust framework unit tests for new LeaseExtend
2016-01-29 19:31:37 -05:00
Jeff Mitchell
f53136ab09
Update LeaseExtend
2016-01-29 19:31:37 -05:00
Jeff Mitchell
9db22dcfad
Address some more review feedback
2016-01-12 15:09:16 -05:00
Jeff Mitchell
4f4ddbf017
Create more granular ACL capabilities.
...
This commit splits ACL policies into more fine-grained capabilities.
This both drastically simplifies the checking code and makes it possible
to support needed workflows that are not possible with the previous
method. It is backwards compatible; policies containing a "policy"
string are simply converted to a set of capabilities matching previous
behavior.
Fixes #724 (and others).
2016-01-08 13:05:14 -05:00
Jeff Mitchell
f3ce90164f
WriteOperation -> UpdateOperation
2016-01-08 13:03:03 -05:00
Jeff Mitchell
35a7f0de22
Add '.' to GenericNameRegex; it cannot appear as the first or last
...
character. This allows its usage in a number of extra path-based
variables.
Ping #244
2015-10-13 16:04:10 -04:00
Jeff Mitchell
ab7d35b95e
Fix up per-backend timing logic; also fix error in TypeDurationSecond in
...
GetOkErr.
2015-09-21 09:55:03 -04:00
Jeff Mitchell
b655f6b858
Add HMAC capability to salt. Pass a salt into audit backends. Require it for audit.Hash.
2015-09-18 17:38:22 -04:00
vishalnayak
7f640c4374
Error on violating SysView boundaries
2015-09-17 11:24:46 -04:00
vishalnayak
6a4089b2a8
Vault userpass: Enable renewals for login tokens
2015-09-16 23:55:35 -04:00
Jeff Mitchell
77e7379ab5
Implement the cubbyhole backend
...
In order to implement this efficiently, I have introduced the concept of
"singleton" backends -- currently, 'sys' and 'cubbyhole'. There isn't
much reason to allow sys to be mounted at multiple places, and there
isn't much reason you'd need multiple per-token storage areas. By
restricting it to just one, I can store that particular mount instead of
iterating through them in order to call the appropriate revoke function.
Additionally, because revocation on the backend needs to be triggered by
the token store, the token store's salt is kept in the router and
client tokens going to the cubbyhole backend are double-salted by the
router. This allows the token store to drive when revocation happens
using its salted tokens.
2015-09-15 13:50:37 -04:00
Lassi Pölönen
fb07cf9f53
Implement clean up routine to backend as some backends may require
...
e.g closing database connections on unmount to avoud connection
stacking.
2015-09-11 11:45:58 +03:00
Jeff Mitchell
488d33c70a
Rejig how dynamic values are represented in system view and location of some functions in various packages; create mount-tune command and API analogues; update documentation
2015-09-10 15:09:54 -04:00
Jeff Mitchell
4239f9d243
Add DynamicSystemView. This uses a pointer to a pointer to always have
...
up-to-date information. This allows remount to be implemented with the
same source and dest, allowing mount options to be changed on the fly.
If/when Vault gains the ability to HUP its configuration, this should
just work for the global values as well.
Need specific unit tests for this functionality.
2015-09-10 15:09:54 -04:00
Jeff Mitchell
b74fa8c888
Make DefaultSystemView StaticSystemView with statically-configured information. Export this from Framework to make it easy to override for testing.
2015-08-27 11:25:07 -07:00
Jeff Mitchell
7c2bbe4c7f
Use a SystemView interface and turn SystemConfig into DefaultSystemView
2015-08-27 10:36:44 -07:00
Jeff Mitchell
e58553e7d5
Plumb the system configuration information up into framework
2015-08-27 09:41:03 -07:00
Jeff Mitchell
5695d57ba0
Merge pull request #561 from hashicorp/fix-wild-cards
...
Allow hyphens in endpoint patterns of most backends
2015-08-21 11:40:42 -07:00
vishalnayak
6c2927ede0
Vault: Fix wild card paths for all backends
2015-08-21 00:56:13 -07:00
Jeff Mitchell
ea9fbb90bc
Rejig Lease terminology internally; also, put a few JSON names back to their original values
2015-08-20 22:27:01 -07:00
Jeff Mitchell
93ef9a54bd
Internally refactor Lease/LeaseGracePeriod into TTL/GracePeriod
2015-08-20 18:00:51 -07:00
Caleb Tennis
ae990884a6
Add a validation step in field data to error more quickly vs. allowing panics to happen when we go to get the data and convert it
2015-08-11 12:34:14 -04:00
Armon Dadgar
c40cf7fcdf
logical/framework: handle nil duration value. Fixes #408
2015-07-08 16:55:52 -06:00
Armon Dadgar
4b27e4d8c5
Remove SetLogger, and unify on framework.Setup
2015-06-30 17:45:20 -07:00
Armon Dadgar
e892d728a2
logical/framework: support Salt in PathMap
2015-06-30 14:28:45 -07:00
Armon Dadgar
6b23b14773
logical/framework: adding a new duration type to convert to seconds
2015-06-17 15:56:26 -07:00
Armon Dadgar
f39b522681
logical/framework: allow the lease max to come from existing lease
2015-06-17 14:24:12 -07:00
Armon Dadgar
cfab07b19f
logical/framework: simplify calculation of lease renew
2015-06-17 14:16:44 -07:00
Jonathan Sokolowski
d58512b3f8
logical/framework: Fix help text in PathMap
2015-05-15 07:56:32 +10:00
Jonathan Sokolowski
283e8ccacb
logical/framework: Add delete to PathMap
2015-05-14 22:28:33 +10:00
Jonathan Sokolowski
896f9cd4d3
logical/framework: Add delete to PathStruct
2015-05-14 22:25:30 +10:00
Mitchell Hashimoto
5c63b70eea
logical/framework: PathMap is case insensitive by default
2015-05-11 10:27:04 -07:00
Mitchell Hashimoto
4e861f29bc
credential/github: case insensitive mappings
2015-05-11 10:24:39 -07:00
Armon Dadgar
8ed48191fb
logical/framework: Generate help output even if no synopsis provided
2015-05-07 15:45:43 -07:00
Mitchell Hashimoto
81b12660c5
logical/framework: PathMap allows hyphens in keys [GH-119]
2015-05-02 13:17:42 -07:00
Armon Dadgar
c4a92a276d
logical/framework: Supporting list of path map
2015-04-23 21:44:04 -07:00
Mitchell Hashimoto
cd3fa3be92
logical/framework: more flexible Pathmap and PolicyMap
2015-04-17 09:35:49 -07:00
Mitchell Hashimoto
910bf9c76d
logical/framework: PathStruct
2015-04-17 09:18:21 -07:00
Mitchell Hashimoto
463a32ba56
logical/framework: doc for defaultduration on secret
2015-04-13 20:42:06 -07:00
Mitchell Hashimoto
6272ad75dc
logical/framework: secret lease tests
2015-04-13 15:18:27 -07:00
Mitchell Hashimoto
209b275bfd
logical/framework: allow max session time
2015-04-11 16:41:08 -07:00
Mitchell Hashimoto
33d66f0130
vault: token store allows unlimited renew
2015-04-11 16:28:16 -07:00
Mitchell Hashimoto
d81707a222
logical/framework: more tests
2015-04-11 14:51:00 -07:00
Mitchell Hashimoto
a360ca4928
logical/framework: AuthRenew callback, add LeaseExtend
...
/cc @armon - Going with this "standard library" of callbacks approach
to make extending leases in a customizable way easy. See the docs/tests
above.
2015-04-11 14:46:09 -07:00
Mitchell Hashimoto
f996dcf964
logical: add LeaseOptions.IncrementedLease()
2015-04-10 21:35:17 -07:00
Mitchell Hashimoto
992028e23e
vault: the expiration time should be relative to the issue time
2015-04-10 21:21:06 -07:00
Armon Dadgar
f7dbb6966b
logical: Adding support for renew of Auth
2015-04-10 13:59:49 -07:00
Armon Dadgar
4679febdf3
logical: Refactor LeaseOptions to share between Secret and Auth
2015-04-09 12:14:04 -07:00
Mitchell Hashimoto
569991fcc5
credential/app-id
2015-04-04 18:41:49 -07:00
Mitchell Hashimoto
606b3dbff9
credential/github: improve help
2015-04-04 12:18:33 -07:00
Mitchell Hashimoto
7aee6269f7
vault: pass a logger around to logical backends
2015-04-04 11:39:58 -07:00
Mitchell Hashimoto
8dc9e0e0d5
logical/framework: better string values for types
2015-04-03 21:15:59 -07:00
Mitchell Hashimoto
ec9df0439b
logical/aws: help
2015-04-03 21:10:54 -07:00
Mitchell Hashimoto
246c2839b0
logical/framework: make help look nicer
2015-04-03 21:00:23 -07:00
Mitchell Hashimoto
0bbad03c70
logical/framework: support root help
2015-04-03 20:36:47 -07:00
Mitchell Hashimoto
2e3d6d6a0e
command/help
2015-04-02 22:42:05 -07:00
Armon Dadgar
faa759ea1d
logical/framework: Panic if routing pattern is blank
2015-04-01 22:12:03 -07:00
Armon Dadgar
c5a5c6e3a6
logical/framework: automatically anchor
2015-04-01 17:53:02 -07:00
Mitchell Hashimoto
04cf4ef093
logical/framework: add PolicyMap
2015-04-01 15:46:37 -07:00
Mitchell Hashimoto
83de0fd03d
logical/framework: PathMap can get missing things
2015-04-01 15:46:37 -07:00
Mitchell Hashimoto
67e4bdf1e4
misc typos
2015-03-31 17:27:04 -07:00
Armon Dadgar
0943c2bf45
logical/framework: Added missing case for TypeMap
2015-03-31 16:45:08 -07:00
Armon Dadgar
cb66c93a34
logical/framework: Adding TypeMap
2015-03-31 16:45:08 -07:00
Mitchell Hashimoto
62ee621ea3
logical: move cred stuff over here
2015-03-30 17:46:18 -07:00
Mitchell Hashimoto
27d33ad9f7
logical/framework: auto-extend leases if requested
2015-03-21 16:20:30 +01:00
Mitchell Hashimoto
f6d5e3f0f4
logical/testing: immediate rollback, ignore RollbackMinAge
2015-03-21 11:18:33 +01:00
Mitchell Hashimoto
17c58633d6
logical/framework: rollback should return error, easier API
2015-03-21 11:08:13 +01:00
Mitchell Hashimoto
a54d90ac1f
logical/framework: rollback needs to have access to request for storage
2015-03-21 11:03:59 +01:00
Mitchell Hashimoto
62d9bec8be
logical/aws
2015-03-20 19:03:20 +01:00
Mitchell Hashimoto
a0f59f682b
logical/framework: can specify InternalData for secret
2015-03-20 17:59:48 +01:00
Mitchell Hashimoto
c349e97168
vault: clean up VaultID duplications, make secret responses clearer
...
/cc @armon - This is a reasonably major refactor that I think cleans up
a lot of the logic with secrets in responses. The reason for the
refactor is that while implementing Renew/Revoke in logical/framework I
found the existing API to be really awkward to work with.
Primarily, we needed a way to send down internal data for Vault core to
store since not all the data you need to revoke a key is always sent
down to the user (for example the user than AWS key belongs to).
At first, I was doing this manually in logical/framework with
req.Storage, but this is going to be such a common event that I think
its something core should assist with. Additionally, I think the added
context for secrets will be useful in the future when we have a Vault
API for returning orphaned out keys: we can also return the internal
data that might help an operator.
So this leads me to this refactor. I've removed most of the fields in
`logical.Response` and replaced it with a single `*Secret` pointer. If
this is non-nil, then the response represents a secret. The Secret
struct encapsulates all the lease info and such.
It also has some fields on it that are only populated at _request_ time
for Revoke/Renew operations. There is precedent for this sort of
behavior in the Go stdlib where http.Request/http.Response have fields
that differ based on client/server. I copied this style.
All core unit tests pass. The APIs fail for obvious reasons but I'll fix
that up in the next commit.
2015-03-19 23:11:42 +01:00
Mitchell Hashimoto
8039fc5c63
logical/framework: support renew
2015-03-19 20:20:57 +01:00
Mitchell Hashimoto
d4b284fba4
logical/framework: revoke support
2015-03-19 19:41:41 +01:00
Mitchell Hashimoto
b655a78b78
logical/framework: can specify renew/revoke functins for secret
2015-03-19 15:07:45 +01:00
Mitchell Hashimoto
c7ed24282b
logical/framework: add methods to look up secret and gen response
2015-03-19 14:59:01 +01:00
Mitchell Hashimoto
c21bc26731
logical/framework: use custom request wrapper
2015-03-19 14:39:25 +01:00
Mitchell Hashimoto
7d03852f7c
logical/framework: test for minimum age
2015-03-17 20:42:35 -05:00
Mitchell Hashimoto
14a48f6e92
logical/framework: only rollback old enough WAL entries
2015-03-17 20:39:46 -05:00
Mitchell Hashimoto
378968d56e
logical/framework: WAL entry supports "kind"
2015-03-17 20:39:46 -05:00
Mitchell Hashimoto
b8e2272421
logical/framework: rollback support
2015-03-17 20:39:46 -05:00
Mitchell Hashimoto
4016aba7ad
logical/framework: WAL should live here
2015-03-17 20:39:45 -05:00
Mitchell Hashimoto
9f0d59d03f
vault: system using the framework
2015-03-15 17:35:59 -07:00
Mitchell Hashimoto
11f8423b4f
logical/framework, logical/testing
2015-03-15 16:39:49 -07:00
