luxolus/open-vault
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity
3775 commits 1 branch 0 tags 214 MiB
Commit graph

294 commits

Author SHA1 Message Date
vishalnayak 84d9b6c6b2 changelog++ 2016-02-18 17:11:50 -05:00
Jeff Mitchell 09176ff93b changelog++ 2016-02-18 15:33:14 -05:00
Jeff Mitchell ea12dff28b changelog++ 2016-02-12 15:38:52 -05:00
Jeff Mitchell fdc7317ef0 changelog++ 2016-02-11 12:54:49 -05:00
Jeff Mitchell 4f5c65ae74 changelog++ 2016-02-10 08:01:46 -05:00
Jeff Mitchell b7896fba65 changelog++ 2016-02-08 11:40:52 -05:00
Jeff Mitchell c36007ab25 changelog++ 2016-02-07 14:02:55 -05:00
Jeff Mitchell 06810f2ac7 changelog++ 2016-02-04 16:40:00 -05:00
Jeff Mitchell 4837ba23df changelog++ 2016-02-04 13:49:01 -05:00
Jeff Mitchell 550d6096ed Add some extra info on the build to the changelog and bump the version in preparation for release 2016-02-04 11:54:14 -05:00
Jeff Mitchell 642240db27 changelog++ 2016-02-04 11:42:58 -05:00
Jeff Mitchell 64309b3b4b Fix some changelog formatting 2016-02-04 09:53:23 -05:00
Jeff Mitchell ed3ae4541a changelog++ 2016-02-03 15:14:34 -05:00
Jeff Mitchell fc7eadbbb7 changelog++ 2016-02-03 15:07:53 -05:00
Jeff Mitchell 93cf4ba2c4 changelog++ 2016-02-03 11:25:43 -05:00
Jeff Mitchell bb9d364cce changelog++ 2016-02-03 09:13:40 -05:00
Jeff Mitchell fc5a09135f changelog++ 2016-02-02 11:38:27 -05:00
Jeff Mitchell 416176a5aa changelog++ 2016-02-01 20:16:56 -05:00
Jeff Mitchell 10788215fc Add rekey nonce info to Changelog 2016-02-01 16:13:42 -05:00
Jeff Mitchell dc584d4905 changelog++ 2016-02-01 13:45:28 -05:00
Jeff Mitchell 5abc77b263 changelog++ 2016-02-01 13:37:13 -05:00
Jeff Mitchell 0f5db5da6c changelog++ 2016-02-01 10:29:40 -05:00
Jeff Mitchell 88148e6190 changelog++ 2016-01-29 21:01:48 -05:00
Jeff Mitchell 088f8a22c3 changelog++ 2016-01-29 14:43:28 -05:00
Jeff Mitchell b8ca0cccb8 changelog++ 2016-01-29 10:36:37 -05:00
Jeff Mitchell 4ac568bdfa changelog++ 2016-01-29 10:32:12 -05:00
Jeff Mitchell ad00131735 changelog++ 2016-01-28 15:18:54 -05:00
Jeff Mitchell 5d36d27d0c changelog++ 2016-01-28 15:05:59 -05:00
Jeff Mitchell 059640c33a changelog++ 2016-01-28 12:49:25 -05:00
Jeff Mitchell 63d891f36f changelog++ 2016-01-28 08:59:57 -05:00
Jeff Mitchell ccd10668f0 changelog++ 2016-01-27 17:27:53 -05:00
Jeff Mitchell 7776aebdfc changelog++ 2016-01-27 17:18:17 -05:00
Jeff Mitchell 0279c60d9e changelog++ 2016-01-27 17:07:54 -05:00
Jeff Mitchell 92a0fae392 Changelog formatting 2016-01-27 14:33:41 -05:00
Jeff Mitchell 6d21bb7b98 Changelog formatting 2016-01-27 14:05:20 -05:00
Jeff Mitchell dd89018511 changelog++ 2016-01-27 13:43:53 -05:00
Jeff Mitchell 3761f19932 changelog++ 2016-01-25 14:48:34 -05:00
Jeff Mitchell 0c2829d2a2 changelog++ 2016-01-23 14:46:20 -05:00
Jeff Mitchell c7c8dc3f5b changelog++ 2016-01-22 21:24:25 -05:00
Jeff Mitchell d663c46757 changelog++ 2016-01-22 13:09:21 -05:00
Jeff Mitchell babecad8ac changelog++ 2016-01-22 10:22:43 -05:00
Jeff Mitchell 19e7266406 changelog++ 2016-01-21 16:30:50 -05:00
Jeff Mitchell b2d2bb9545 Add generate-root info to changelog 2016-01-21 12:37:26 -05:00
Jeff Mitchell c8ae8189d7 changelog++ 2016-01-18 17:05:51 -05:00
Jeff Mitchell d68b1cf1af changelog++ 2016-01-16 18:03:58 -05:00
Jeff Mitchell 5873824ee2 Version 0.4.1 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJWls/HAAoJEFGFLYc0j/xMarQH/i6rW+wLm9DadkFV23jwjttt
 TRumTPDoBxHQDoB0wkC4CmA8UiZnzc68o5OlxisC8KAz/89HWZf8sUDxkOSY1vUX
 BGDkiv+KF6LiDRAdDyIqK6PYUkKHaJgue9Vnwu5+1iRv1sjK5PyPb992Wmt/DtOM
 nRn8Hn5qmmDCUm79TKXpZNMs/CRx21VM7q2Sm139kLzTr0Qg2Oyxcp3mB8TR7LtV
 ATdMQ//HzL/tGJ6Yw7zkgZzdf7EMFFO1SSVqAzqag6kqNqwjvmDGrQaTzkdl7anv
 72zMXqVcryeSL6DRZuR+OrHs63aaoTwIXcqO56nBrZ1NAEqkI0oCcvDZNLt7yi4=
 =YCXl
 -----END PGP SIGNATURE-----

Merge tag 'v0.4.1'

Version 0.4.1
 2016-01-14 09:57:21 -05:00
Jeff Mitchell eeac69939c Bump values to 0.4.1 2016-01-13 17:28:17 -05:00
Jeff Mitchell 55a802f9ca changelog++ 2016-01-12 21:19:25 -05:00
Jeff Mitchell 1efb33cfd5 changelog++ 2016-01-12 09:31:07 -05:00
Jeff Mitchell ae6df99b19 changelog++ 2016-01-12 08:47:33 -05:00
Jeff Mitchell 2527a9d18e changelog++ 2016-01-09 14:21:36 -05:00
Jeff Mitchell 87f686997f changelog++ 2016-01-07 11:36:32 -05:00
Jeff Mitchell d6b6cbe9aa changelog++ 2016-01-07 09:22:45 -05:00
Jeff Mitchell 06d19e4269 changelog++ 2016-01-05 11:27:08 -05:00
Jeff Mitchell a99c29dad4 changelog++ 2016-01-04 17:01:32 -05:00
Jeff Mitchell dbd7c9aaab changelog++ 2016-01-04 14:14:51 -05:00
Jeff Mitchell 80d92903f4 changelog++ 2015-12-31 18:11:32 -05:00
Jeff Mitchell a7a02b3043 Cert documentation fix. 
Fixes #899
 2015-12-30 16:44:24 -05:00
Jeff Mitchell 7e93071404 Move the information about the new behavior of token-renew to the breaking changes section 2015-12-30 15:29:24 -05:00
Jeff Mitchell be4277199f changelog++ 2015-12-30 15:20:02 -05:00
Jeff Mitchell e0d0ff6884 changelog++ 2015-12-30 14:43:51 -05:00
Jeff Mitchell 0ef4fadb25 changelog++ 2015-12-30 13:28:49 -05:00
Jeff Mitchell 0c338f01ea changelog++ 2015-12-29 13:18:36 -05:00
Jeff Mitchell e43656c045 changelog++ 2015-12-29 13:03:22 -05:00
Jeff Mitchell 822144b321 changelog++ 2015-12-29 13:00:57 -05:00
Jeff Mitchell b206775301 changelog++ 2015-12-29 12:39:56 -05:00
Jeff Mitchell 52545ce020 changelog++ 2015-12-23 13:34:39 -05:00
Jeff Mitchell 49d2793acc changelog++ 2015-12-22 10:22:57 -05:00
Jeff Mitchell 56bc82f7cd changelog++ 2015-12-18 10:08:14 -05:00
Jeff Mitchell 68773ec5a3 changelog++ 2015-12-17 15:09:53 -05:00
Jeff Mitchell f8a824c476 changelog++ 2015-12-17 13:50:56 -05:00
Jeff Mitchell 8f78998e89 changelog++ 2015-12-17 10:24:12 -05:00
Jeff Mitchell 113393d988 changelog++ 2015-12-17 10:12:53 -05:00
Jeff Mitchell 048f1284e4 CL++ 2015-12-15 20:02:43 -05:00
Jeff Mitchell af64f3401c CL++ 2015-12-14 21:27:12 -05:00
Jeff Mitchell 8816359bf5 CL++ 2015-12-14 21:24:29 -05:00
Jeff Mitchell ff9745bb00 Update Changelog and documentation with separate-HA-backend info. 2015-12-14 21:04:58 -05:00
Jeff Mitchell d149294e48 CL++ 2015-12-14 20:55:45 -05:00
Jeff Mitchell 468d1553af CL++ 2015-12-14 14:47:32 -05:00
Jeff Mitchell 39b87960f3 CL++ 2015-12-14 14:45:55 -05:00
Jeff Mitchell a9a8700f29 CL++ 2015-12-14 11:21:06 -05:00
Jeff Mitchell 546b3add9c Changelogify 2015-12-11 12:05:22 -05:00
Jeff Mitchell 0a568761ea Changelogify 2015-12-11 12:02:43 -05:00
Jeff Mitchell 944862bb33 Update changelog and in-progress dev version number 2015-12-10 16:34:10 -05:00
Jeff Mitchell e02acf9943 Fill in release date in Changelog 2015-12-10 13:21:44 -05:00
Jeff Mitchell e25b3ad344 Update documentation to be consistent with return codes 
Fixes #831
 2015-12-10 10:26:40 -05:00
Jeff Mitchell d332200495 Merge branch 'master' into pki-csrs 2015-12-09 16:48:07 -05:00
Jeff Mitchell 900b3d8882 Return 400 instead of 500 if generic backend is written to without data. 
Fixes #825
 2015-12-09 10:39:22 -05:00
Jeff Mitchell 448efd56fa Merge branch 'master' into pki-csrs 2015-12-08 10:57:53 -05:00
Jeff Mitchell dab0049d0e Changelogify 2015-12-07 13:22:24 -05:00
Jeff Mitchell 1dbfcc3b45 Merge branch 'master' into pki-csrs 2015-12-03 15:23:08 -05:00
Jeff Mitchell 3bdbd66f7d Remove datacenter from Consul configuration, as it cannot actually do 
anything

Fixes #816
 2015-12-03 15:16:37 -05:00
Jeff Mitchell 4eec9d69e8 Change allowed_base_domain to allowed_domains and allow_base_domain to 
allow_bare_domains, for comma-separated multi-domain support.
 2015-11-30 23:49:11 -05:00
Jeff Mitchell b6c49ddf01 Remove token display names from input options as there isn't a viable 
use-case for it at the moment
 2015-11-30 18:07:42 -05:00
Jeff Mitchell ee8e143555 Add PKI enhancements to Changelog 2015-11-20 13:18:07 -05:00
Jeff Mitchell 1c7157e632 Reintroduce the ability to look up obfuscated values in the audit log 
with a new endpoint '/sys/audit-hash', which returns the given input
string hashed with the given audit backend's hash function and salt
(currently, always HMAC-SHA256 and a backend-specific salt).

In the process of adding the HTTP handler, this also removes the custom
HTTP handlers for the other audit endpoints, which were simply
forwarding to the logical system backend. This means that the various
audit functions will now redirect correctly from a standby to master.
(Tests all pass.)

Fixes #784
 2015-11-18 20:26:03 -05:00
Jeff Mitchell 29135b65ca Changelogify 2015-11-18 10:34:50 -05:00
Jeff Mitchell bc4c18a1cf Rearchitect MountTable locking and fix rollback. 
The rollback manager was using a saved MountTable rather than the
current table, causing it to attempt to rollback unmounted mounts, and
never rollback new mounts.

In fixing this, it became clear that bad things could happen to the
mount table...the table itself could be locked, but the table pointer
(which is what the rollback manager needs) could be modified at any time
without locking. This commit therefore also returns locking to a mutex
outside the table instead of inside, and plumbs RLock/RUnlock through to
the various places that are reading the table but not holding a write
lock.

Both unit tests and race detection pass.

Fixes #771
 2015-11-11 11:54:52 -05:00
Jeff Mitchell 1a45696208 Add no-default-policy flag and API parameter to allow exclusion of the 
default policy from a token create command.
 2015-11-09 17:30:50 -05:00
Jeff Mitchell d6693129de Create a "default" policy with sensible rules. 
It is forced to be included with each token, but can be changed (but not
deleted).

Fixes #732
 2015-11-09 15:44:09 -05:00
Jeff Mitchell 8673f36b34 Don't require root tokens for mount and policy endpoints. 2015-11-09 15:29:21 -05:00
Jeff Mitchell 75f1c1e40c Print version on startup. 
Fixes #765
 2015-11-09 13:52:55 -05:00
Jeff Mitchell 5783f547ab Display whether a token is an orphan on lookup. 2015-11-09 13:19:59 -05:00
Jeff Mitchell b1a445dfbf Changelogify 2015-11-06 09:22:30 -05:00
Jeff Mitchell fde0bbf4b3 Merge pull request #752 from hashicorp/issue-749 
Fix removing secondary index from exp manager.
 2015-11-05 19:43:11 -05:00
Jeff Mitchell a121941925 Merge pull request #751 from hashicorp/issue-618 
Move environment variable reading logic to API.
 2015-11-05 19:42:16 -05:00
Jeff Mitchell 08dbc70c9f Switch etcd default port to 2379, in line with 2.x. 
Fixes #753
 2015-11-05 09:47:50 -05:00
Jeff Mitchell 395d6bead4 Fix removing secondary index from exp manager. 
Due to a typo, revoking ensures that index entries are created rather
than removed. This adds a failing, then fixed test case (and helper
function) to ensure that index entries are properly removed on revoke.

Fixes #749
 2015-11-04 10:50:31 -05:00
Jeff Mitchell 32e23bea71 Move environment variable reading logic to API. 
This allows the same environment variables to be read, parsed, and used
from any API client as was previously handled in the CLI. The CLI now
uses the API environment variable reading capability, then overrides any
values from command line flags, if necessary.

Fixes #618
 2015-11-04 10:28:00 -05:00
Jeff Mitchell f8c13ed69f Changelog++ 2015-11-04 09:42:07 -05:00
Jeff Mitchell 54d47957b5 Allow creating Consul management tokens 
Fixes #714
 2015-11-03 15:29:58 -05:00
Jeff Mitchell a4322afedb Merge pull request #746 from hashicorp/issue-677 
Add a PermitPool to physical and consul/inmem
 2015-11-03 15:26:58 -05:00
Jeff Mitchell 4f6ad849b8 Merge pull request #703 from hashicorp/crlsets 
Implement CRLs for the cert authentication backend
 2015-11-03 15:13:08 -05:00
Jeff Mitchell 6ccded7a2f Add ability to create orphan tokens from the API 2015-11-03 15:12:21 -05:00
Jeff Mitchell bf2e553785 Add a PermitPool to physical and consul/inmem 
The permit pool controls the number of outstanding operations that can
be queued for Consul (and inmem, for testing purposes). This prevents
possible situations where Vault launches thousands of concurrent
connections to Consul if e.g. a huge number of leases need to be
expired.

Fixes #677
 2015-11-03 11:49:20 -05:00
Jeff Mitchell c7493fca65 Changelogify 2015-11-03 11:43:57 -05:00
Jeff Mitchell 59cc61cc79 Add documentation for CRLs and some minor cleanup. 2015-11-03 10:52:20 -05:00
Jeff Mitchell 195caa6bf6 Implement LookupSelf, RevokeSelf, and RenewSelf in the API client 
Fixes #739
 2015-10-30 17:27:33 -04:00
Jeff Mitchell 1899bd8ef0 Merge pull request #730 from hashicorp/issue-713 
Write HMAC-SHA256'd client token to audited requests
 2015-10-30 13:36:22 -04:00
Jeff Mitchell ffa196da0e Note that the dev server does not fork 
Fixes #710.
 2015-10-30 12:47:56 -04:00
Jeff Mitchell 64eacd1564 Merge pull request #737 from hashicorp/issue-615 
Return data on a token with one use left if there is no Lease ID
 2015-10-30 12:42:19 -04:00
Jeff Mitchell a0c5a24c79 Update Postgres tests and changelogify 2015-10-30 12:41:45 -04:00
Jeff Mitchell 94b7be702b Return data on a token with one use left if there is no Lease ID 
Fixes #615
 2015-10-30 12:35:42 -04:00
Jeff Mitchell cf4b88c196 Write HMAC-SHA256'd client token to audited requests 
Fixes #713
 2015-10-29 13:26:18 -04:00
Jeff Mitchell e2d4a5fe0f Documentation update around path/key name encryption. 
Make it clear that path/key names in generic are not encrypted.

Fixes #697
 2015-10-29 11:21:40 -04:00
Jeff Mitchell 85d4dd6a1d Check TTL provided to generic backend on write 
If existing entries have unparseable TTLs, return the value plus a
warning, rather than an error.

Fixes #718
 2015-10-29 11:05:21 -04:00
Jeff Mitchell c1d8b97342 Add reset support to the unseal command. 
Reset clears the provided unseal keys, allowing the process to be begun
again. Includes documentation and unit test changes.

Fixes #695
 2015-10-28 15:59:39 -04:00
Jeff Mitchell 9026b5c127 Update changelog 2015-10-23 09:18:03 -04:00
Jeff Mitchell 691f9e9b92 Rewrap changelog 2015-10-20 12:57:42 -04:00
Jeff Mitchell ffe531923d Changelogify 2015-10-20 12:31:01 -04:00
Jeff Mitchell 35a7f0de22 Add '.' to GenericNameRegex; it cannot appear as the first or last 
character. This allows its usage in a number of extra path-based
variables.

Ping #244
 2015-10-13 16:04:10 -04:00
Jeff Mitchell 78b5fcdf51 Serialize changing the state of the expiration manager pointer and 
calling emitMetrics from its own goroutine.

Fixes #694
 2015-10-12 16:33:54 -04:00
Jeff Mitchell 9f0b1547bb Allow disabling the physical storage cache with 'disable_cache'. 
Fixes #674.
 2015-10-12 13:00:32 -04:00
Jeff Mitchell 55c26a909e Documentation updates to remove lease id and duration from generic 
backend example.
 2015-10-12 10:01:15 -04:00
Jeff Mitchell 5fbaa0e64d Apply mount-tune properties to the token authentication backend. 
Fixes #688.
 2015-10-09 20:26:39 -04:00
Jeff Mitchell ee92124357 Fix output of token-create help to use ttl instead of lease 2015-10-09 19:40:30 -04:00
Jeff Mitchell b5d674d94e Add 301 redirect checking to the API client. 
Vault doesn't generate these, but in some cases Go's internal HTTP
handler does. For instance, during a mount-tune command, finishing the
mount path with / (as in secret/) would cause the final URL path to
contain .../mounts/secret//tune. The double slash would trigger this
behavior in Go's handler and generate a 301. Since Vault generates 307s,
this would cause the client to think that everything was okay when in
fact nothing had happened.
 2015-10-09 17:11:31 -04:00
Jeff Mitchell bf70b677b7 Add timeout to changelog 2015-10-08 19:47:16 -04:00
Jeff Mitchell d58a3b601c Add a cleanLeaderPrefix function to clean up stale leader entries in core/leader 
Fixes #679.
 2015-10-08 14:04:58 -04:00
Jeff Mitchell 0ca86fa2cd Changelogify 2015-10-07 16:18:39 -04:00
Jeff Mitchell 50b9129e65 Normalize policy names to lowercase on write. They are not currently 
normalized when reading or deleting, for backwards compatibility.

Ping #676.
 2015-10-07 13:52:21 -04:00
Jeff Mitchell 4a52de13e3 Add renew-self endpoint. 
Fixes #455.
 2015-10-07 12:49:13 -04:00
Jeff Mitchell ad840233eb Allow base64-encoded keys to be used on the CLI for init/rekey. 
Fixes #653.
 2015-10-06 12:47:01 -04:00
Jeff Mitchell de571c304d Add changelog entries for 0.3.1 and bump version in CLI 2015-10-06 11:03:55 -04:00
Jeff Mitchell 6fe4139ac3 Changelogify++ 2015-09-29 19:03:43 -07:00
Jeff Mitchell 6a7e87d471 Changelogify 2015-09-29 19:01:45 -07:00
Jeff Mitchell 62ac518ae7 Switch per-mount values to strings going in and seconds coming out, like other commands. Indicate deprecation of 'lease' in the token backend. 2015-09-25 10:41:21 -04:00
Jeff Mitchell af27a99bb7 Remove JWT for the 0.3 release; it needs a lot of rework. 2015-09-24 16:23:44 -04:00
Jeff Mitchell 8fa7d3bd0b Add revoke-self to docs 2015-09-24 12:05:00 -04:00
Jeff Mitchell fb7c05d7f6 Reorder changelog slightly 2015-09-24 10:55:32 -04:00