custodia.git/custodia, branch master

Allow non prefixed forwarding

2015-10-19T16:18:34+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes

Add support for using listening on TCP sockets

2015-10-19T16:18:30+00:00

The server can be now configured using a new parameter called
"server_url".

Setting server_url to "http://0.0.0.0:80/" will make the server listen
on TCP port 80, while setting it to "http+unix://%2fsocket" will make
the server listen on the unix socket named "/socket".

The backwards compatible "server_socket" is retained and used if no
server_url is provided.

The request dict has a new field "client_id" that contains either a
PID or a peer name. In the future the field can be augmented with a
TLS client cert DN or other similar identifier.

Signed-off-by: Christian Heimes 
Signed-off-by: Simo Sorce

Add forwarder plugin

2015-10-19T16:18:26+00:00

This pugin allows to mangle and forward requests to another custodia
server, locally or on the network.

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes

Add auditing to auth/authz modules

2015-10-19T16:18:16+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes

Add client classes to query custodia servers

2015-10-19T16:18:10+00:00

This makes it simpler to use a custodia server, whether exposed over
HTTP, HTTPS or a unix socket with the http+unix schema.

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes

Add simple Keys-in-Header based authentication

2015-10-19T16:18:03+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes

etcdstore: prevent path traversal attacks

2015-10-19T16:17:58+00:00

A new internal method _absolute_key() is used to join key name and name
space. etcd treats the key space like a file system so the method checks
the key for '//', '.', and '..' to prevent invalid paths and path traversal
attacks.

Signed-off-by: Christian Heimes 
Signed-off-by: Simo Sorce

Implement ETCD based Store

2015-10-19T16:17:48+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes

Extend store interface to create namespaces

2015-10-19T16:17:42+00:00

Use a new verb, "span" to create namespaces/containers.
This will be needed for the Etcd plugin which need to distinguish between
a directory and a key.
The sqlite/enclite just pass the request to their set() method.

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes

Add UserNameSpace auths plugin

2015-10-19T16:17:37+00:00

Moves the secrets.Namespaces plugin to the proper authorizers file and
fixes it to properly enforce the user-named namespace is being used.

Signed-off-by: Simo Sorce 
Reviewed-by: Christian Heimes