summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Increase logging output of Kubernetes pluginskubeChristian Heimes2015-11-113-10/+25
| | | | Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Add authz plugin that verify kubelets requestsSimo Sorce2015-11-111-0/+66
| | | | | | | | | | | | This patch adds a special authorization plugin that verifies the identity of the node as well as checking that the node is authorized to make a request on behalf of the pod for which it is asking secrets. If all checks pass the path is rewritten to point to the proper secrets namespace for the pod. By rewriting paths, in case of catastrophic failure of the plugin no secret can be found as the path matches nothing. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add Authentication module for Kubernetes nodeSimo Sorce2015-11-113-1/+74
| | | | | | | | | | | This authentication module connects to docker to figure out the pod name associated to the PID requesting the service by ay of discovering the container id via the process cgroup namespace. The pod name as set in the metadata label named 'io.kubernetes.pod.name' is then used as the 'remote_user' attribute on the request. Signed-off-by: Simo Sorce <simo@redhat.com>
* Custodia client loggingreviewChristian Heimes2015-11-113-3/+10
| | | | | | | | | | custodia.client library now logs requests and responses. The auditfile argument of setup_logging() can be set to None to configure client logging without audit file. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add support in the client for the kem message typeSimo Sorce2015-11-067-24/+270
| | | | | | | This allows to easily use end-to-end encrypted requests and replies to fetch secrets. Signed-off-by: Simo Sorce <simo@redhat.com>
* Refactor CustodiaClient interfaceSimo Sorce2015-11-062-56/+73
| | | | | | | | | | | | Use the term secret and not key to refer to .. well .. secrets. Store the last response instead of returning it to the caller, this way there is a consistent way to get access to it and only as needed. Change the name to CustodiaSimpleClient in preparaion for extending the support to other Secret types. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix KEM messages handling when storing data.Simo Sorce2015-11-061-3/+11
| | | | | | | | The payload was not being set with the provided value when a PUT operation token was parsed. This resulted in attempting to store an empty value instead of the provided secret. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix authorization stack to call all modulesSimo Sorce2015-11-061-2/+6
| | | | | | | | | | | All authorization modules need to be executed, we cannot bail at the first one that returns a positive answer. Some authz modules attach data to the requst as a side effect and they need to be run even if others also authorize access. Additionally if a later module returns an explicit Deny, then that must override any previous granted access. Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not use a private name for public variablesSimo Sorce2015-11-061-8/+8
| | | | | | In the server case auditlog is used in the pipeline too, so make it public. Signed-off-by: Simo Sorce <simo@redhat.com>
* Silence broad-except warningsSimo Sorce2015-11-062-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not use reserved words wor argument namesSimo Sorce2015-11-061-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix bad variable name aliasings in custodia/log.pySimo Sorce2015-11-061-4/+3
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix pylint violationsChristian Heimes2015-11-062-1/+2
| | | | Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Don't install testsChristian Heimes2015-10-272-1/+3
| | | | | | | | setup.py no longer installs Custodia's tests files. The test cases are only shipped in the source distribution. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add a generic encrypting layer for storageSimo Sorce2015-10-234-0/+119
| | | | | | | | This plugin takes a nother store to use and ecnrypts all content. note: it does not encrypt key names nor the containers Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Improve logging format and configurationSimo Sorce2015-10-2311-142/+146
| | | | | | | | | | | | | | This patch adda an 'origin' argument to the logger formatting that coms from the configuration parser and ties a log entry to the implementing class as well as the specific configuration facility that instantiated it. Also adds per configuration section debugging unless the global debug statment is true, in which case all objects have debugging forcibly turned on. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Change tests to be more self containedSimo Sorce2015-10-233-28/+107
| | | | | | | Use custom configuration and databases, do not rely on in-tree data. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add some debug loggig in SecretsSimo Sorce2015-10-231-0/+7
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add incoming requests to debug logSimo Sorce2015-10-231-0/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add more debug logging to storage pluginsSimo Sorce2015-10-232-2/+25
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add more debug logging to auth/authz pluginsSimo Sorce2015-10-232-1/+13
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Secrets: Allow creation of root directoriesSimo Sorce2015-10-231-3/+4
| | | | | | | | | | The code was errnoeously refusing to create containers or keys on the base directory where there are no parents. For single component keys always assume / exists in the database. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Do not spam logs with tracebacks on HTTP ErrorsSimo Sorce2015-10-231-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Use Python's logging framework for loggingChristian Heimes2015-10-2013-118/+123
| | | | | | | | | | The custom logging and traceback functions as well as the audit logger are replaced with Python's logging framework. For now the loggers are hard-coded to use a StreamHandler(sys.stderr) as root handler and a FileHandler for the audit log. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Split README and README.mdHEADmasterSimo Sorce2015-10-191-1/+23
| | | | | | | | | | The latter is customized to show Travis' CI build status on Github, and will have more hosting specific content going forward. The regular README will be targeted for offline information, and will not be necessarilya markdown file either. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix Travis CI buildsChristian Heimes2015-10-192-1/+3
| | | | | | | | | | tox 2.0 has a bug in envsitepackagesdir variable substitution. Install tox<2.0 for Travis CI. Custodia now depends on python-requests. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Allow non prefixed forwardingSimo Sorce2015-10-191-2/+6
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add support for using listening on TCP socketsChristian Heimes2015-10-197-49/+107
| | | | | | | | | | | | | | | | | | | The server can be now configured using a new parameter called "server_url". Setting server_url to "http://0.0.0.0:80/" will make the server listen on TCP port 80, while setting it to "http+unix://%2fsocket" will make the server listen on the unix socket named "/socket". The backwards compatible "server_socket" is retained and used if no server_url is provided. The request dict has a new field "client_id" that contains either a PID or a peer name. In the future the field can be augmented with a TLS client cert DN or other similar identifier. Signed-off-by: Christian Heimes <cheimes@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Add forwarder pluginSimo Sorce2015-10-193-1/+109
| | | | | | | | This pugin allows to mangle and forward requests to another custodia server, locally or on the network. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Use CustodiaClient in testsSimo Sorce2015-10-192-60/+51
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add auditing to auth/authz modulesSimo Sorce2015-10-194-10/+77
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add client classes to query custodia serversSimo Sorce2015-10-191-0/+133
| | | | | | | | This makes it simpler to use a custodia server, whether exposed over HTTP, HTTPS or a unix socket with the http+unix schema. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add simple Keys-in-Header based authenticationSimo Sorce2015-10-193-1/+53
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* etcdstore: prevent path traversal attacksChristian Heimes2015-10-191-6/+14
| | | | | | | | | | A new internal method _absolute_key() is used to join key name and name space. etcd treats the key space like a file system so the method checks the key for '//', '.', and '..' to prevent invalid paths and path traversal attacks. Signed-off-by: Christian Heimes <cheimes@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Implement ETCD based StoreSimo Sorce2015-10-192-0/+95
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Extend store interface to create namespacesSimo Sorce2015-10-193-3/+43
| | | | | | | | | | Use a new verb, "span" to create namespaces/containers. This will be needed for the Etcd plugin which need to distinguish between a directory and a key. The sqlite/enclite just pass the request to their set() method. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add UserNameSpace auths pluginSimo Sorce2015-10-193-33/+32
| | | | | | | | Moves the secrets.Namespaces plugin to the proper authorizers file and fixes it to properly enforce the user-named namespace is being used. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add Ability to retrieve peer's SELinux ContextSimo Sorce2015-10-191-2/+16
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Better error handling for enclite storeSimo Sorce2015-10-191-3/+11
| | | | | | | | | The store as throwing an exception in case of an unesisting key. Now it returns None as expected on missing keys, and properly wraps encoding exceptions if the JWE can't be decoded. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Remove filter option for directory listingsSimo Sorce2015-10-193-71/+42
| | | | | | | | | | This commit removes the option to pas a filter parameter. It also changes the way database plugins are expected to return results, results are now expected to be relative to the path requested. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Avoid running tests twiceSimo Sorce2015-10-191-23/+0
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Fix traceback support in python 3.4Simo Sorce2015-10-191-5/+14
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Make tox pep8 happySimo Sorce2015-10-1913-91/+100
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Fix pep8 issuesSimo Sorce2015-10-191-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Fix tox env for machine installed python versionSimo Sorce2015-10-191-0/+2
| | | | | | | | With this env var we force the local /bin/coverage to still source locally unavailable modules from the .tox directory. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Also capture loginuid of the remote processPavel Odvody2015-09-011-1/+18
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Closes #9
* README: Fix typoColin Walters2015-08-251-1/+1
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Closes #8
* Enhance README and point to wikiSimo Sorce2015-08-241-1/+18
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Remove unused directorySimo Sorce2015-08-032-2/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Allow tox to use locally installed packagesSimo Sorce2015-08-031-1/+6
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-26 22:01:41 +0000