summaryrefslogtreecommitdiffstats
path: root/custodia
Commit message (Collapse)AuthorAgeFilesLines
* Add support in the client for the kem message typeSimo Sorce2015-11-065-20/+213
| | | | | | | This allows to easily use end-to-end encrypted requests and replies to fetch secrets. Signed-off-by: Simo Sorce <simo@redhat.com>
* Refactor CustodiaClient interfaceSimo Sorce2015-11-061-25/+43
| | | | | | | | | | | | Use the term secret and not key to refer to .. well .. secrets. Store the last response instead of returning it to the caller, this way there is a consistent way to get access to it and only as needed. Change the name to CustodiaSimpleClient in preparaion for extending the support to other Secret types. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix KEM messages handling when storing data.Simo Sorce2015-11-061-3/+11
| | | | | | | | The payload was not being set with the provided value when a PUT operation token was parsed. This resulted in attempting to store an empty value instead of the provided secret. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix authorization stack to call all modulesSimo Sorce2015-11-061-2/+6
| | | | | | | | | | | All authorization modules need to be executed, we cannot bail at the first one that returns a positive answer. Some authz modules attach data to the requst as a side effect and they need to be run even if others also authorize access. Additionally if a later module returns an explicit Deny, then that must override any previous granted access. Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not use a private name for public variablesSimo Sorce2015-11-061-8/+8
| | | | | | In the server case auditlog is used in the pipeline too, so make it public. Signed-off-by: Simo Sorce <simo@redhat.com>
* Silence broad-except warningsSimo Sorce2015-11-062-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not use reserved words wor argument namesSimo Sorce2015-11-061-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix bad variable name aliasings in custodia/log.pySimo Sorce2015-11-061-4/+3
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix pylint violationsChristian Heimes2015-11-062-1/+2
| | | | Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Add a generic encrypting layer for storageSimo Sorce2015-10-232-0/+56
| | | | | | | | This plugin takes a nother store to use and ecnrypts all content. note: it does not encrypt key names nor the containers Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Improve logging format and configurationSimo Sorce2015-10-2311-142/+146
| | | | | | | | | | | | | | This patch adda an 'origin' argument to the logger formatting that coms from the configuration parser and ties a log entry to the implementing class as well as the specific configuration facility that instantiated it. Also adds per configuration section debugging unless the global debug statment is true, in which case all objects have debugging forcibly turned on. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Change tests to be more self containedSimo Sorce2015-10-232-3/+2
| | | | | | | Use custom configuration and databases, do not rely on in-tree data. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add some debug loggig in SecretsSimo Sorce2015-10-231-0/+7
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add incoming requests to debug logSimo Sorce2015-10-231-0/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add more debug logging to storage pluginsSimo Sorce2015-10-232-2/+25
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add more debug logging to auth/authz pluginsSimo Sorce2015-10-232-1/+13
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Secrets: Allow creation of root directoriesSimo Sorce2015-10-231-3/+4
| | | | | | | | | | The code was errnoeously refusing to create containers or keys on the base directory where there are no parents. For single component keys always assume / exists in the database. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Do not spam logs with tracebacks on HTTP ErrorsSimo Sorce2015-10-231-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Use Python's logging framework for loggingChristian Heimes2015-10-2013-118/+123
| | | | | | | | | | The custom logging and traceback functions as well as the audit logger are replaced with Python's logging framework. For now the loggers are hard-coded to use a StreamHandler(sys.stderr) as root handler and a FileHandler for the audit log. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Allow non prefixed forwardingSimo Sorce2015-10-191-2/+6
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add support for using listening on TCP socketsChristian Heimes2015-10-195-48/+98
| | | | | | | | | | | | | | | | | | | The server can be now configured using a new parameter called "server_url". Setting server_url to "http://0.0.0.0:80/" will make the server listen on TCP port 80, while setting it to "http+unix://%2fsocket" will make the server listen on the unix socket named "/socket". The backwards compatible "server_socket" is retained and used if no server_url is provided. The request dict has a new field "client_id" that contains either a PID or a peer name. In the future the field can be augmented with a TLS client cert DN or other similar identifier. Signed-off-by: Christian Heimes <cheimes@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Add forwarder pluginSimo Sorce2015-10-191-0/+72
| | | | | | | | This pugin allows to mangle and forward requests to another custodia server, locally or on the network. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add auditing to auth/authz modulesSimo Sorce2015-10-194-10/+77
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add client classes to query custodia serversSimo Sorce2015-10-191-0/+133
| | | | | | | | This makes it simpler to use a custodia server, whether exposed over HTTP, HTTPS or a unix socket with the http+unix schema. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add simple Keys-in-Header based authenticationSimo Sorce2015-10-191-1/+47
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* etcdstore: prevent path traversal attacksChristian Heimes2015-10-191-6/+14
| | | | | | | | | | A new internal method _absolute_key() is used to join key name and name space. etcd treats the key space like a file system so the method checks the key for '//', '.', and '..' to prevent invalid paths and path traversal attacks. Signed-off-by: Christian Heimes <cheimes@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Implement ETCD based StoreSimo Sorce2015-10-191-0/+94
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Extend store interface to create namespacesSimo Sorce2015-10-193-3/+43
| | | | | | | | | | Use a new verb, "span" to create namespaces/containers. This will be needed for the Etcd plugin which need to distinguish between a directory and a key. The sqlite/enclite just pass the request to their set() method. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add UserNameSpace auths pluginSimo Sorce2015-10-192-30/+29
| | | | | | | | Moves the secrets.Namespaces plugin to the proper authorizers file and fixes it to properly enforce the user-named namespace is being used. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Add Ability to retrieve peer's SELinux ContextSimo Sorce2015-10-191-2/+16
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Better error handling for enclite storeSimo Sorce2015-10-191-3/+11
| | | | | | | | | The store as throwing an exception in case of an unesisting key. Now it returns None as expected on missing keys, and properly wraps encoding exceptions if the JWE can't be decoded. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Remove filter option for directory listingsSimo Sorce2015-10-192-68/+41
| | | | | | | | | | This commit removes the option to pas a filter parameter. It also changes the way database plugins are expected to return results, results are now expected to be relative to the path requested. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Fix traceback support in python 3.4Simo Sorce2015-10-191-5/+14
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Make tox pep8 happySimo Sorce2015-10-199-66/+74
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Fix pep8 issuesSimo Sorce2015-10-191-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Christian Heimes <cheimes@redhat.com>
* Also capture loginuid of the remote processPavel Odvody2015-09-011-1/+18
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Closes #9
* Make KEMClient actually check the replySimo Sorce2015-07-091-18/+24
| | | | | | | | | Uses the same method as the server, the request and response are quite symmetrical here. also fix a bug with the subject name missing in the replies. Adapt tests. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add audit logSimo Sorce2015-07-093-5/+80
| | | | | | The Secrets class now logs any GET/SET/DEL of a key in a audit log file. Signed-off-by: Simo Sorce <simo@redhat.com>
* Unquote the path before processingSimo Sorce2015-07-081-2/+3
| | | | | | | This avoids issues where spaces get turned to %20 and then name matching comparisons (like for KEMHandler) fail. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix typos in tests and add cleanupChristian Heimes2015-07-081-1/+1
| | | | | | | | | The patch fixes to typos in the tear down function of two test suites. The tests now cleanup and remove temporary files like Unix socket and test databases. Reviewed-by: Simo Sorce <simo@redhat.com> Closes: #3
* Fix Python 3 portablility issuesSimo Sorce2015-06-071-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Use reasonable algorithms based on key typeSimo Sorce2015-06-051-8/+11
| | | | | | | If 'signing_algorithms' is not explicitly set in the configuration file use a reasonable default based on the server key type. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix name checking for kem backendSimo Sorce2015-06-052-4/+7
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Change KEMClient to be able to encrypt requestsSimo Sorce2015-06-051-30/+50
| | | | | | | Also fix errors in handling encrypted requests, as well errors in the test suite. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add basic debugging capabilitiesSimo Sorce2015-06-056-18/+62
| | | | | | | If debug is set to True, then custodia's own Exception handlers will print a stack trace to standard output to aid debugging. Signed-off-by: Simo Sorce <simo@redhat.com>
* Assume keys are JWK objectsSimo Sorce2015-06-041-5/+7
| | | | | | | | This way clients that already have JWK key objects do not have to export/import them. Other clients can simply call JWK upfront like in the modified test. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add client class to build and parse kem tokensSimo Sorce2015-06-041-5/+32
| | | | | | This makes it easier to build clients. Signed-off-by: Simo Sorce <simo@redhat.com>
* Change KEM Parsing to actually check claimsSimo Sorce2015-06-045-16/+26
| | | | | | | The name ('sub') and the time ('exp') must be checked before letting the reuqest proceed. Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not use the same key for encryption and signingSimo Sorce2015-06-031-37/+94
| | | | | | | | | | using the same key for signing and encryption is generally a frown upon approach in the scirty community as it may lead to some attacks. Change the code to use key pairs, where the first key is the signing key and the second one is the encryption key. Signed-off-by: Simo Sorce <simo@redhat.com>
* Use str to give back more human readable messagesSimo Sorce2015-05-281-2/+2
| | | | | | | These messages are returned as is by the HTTP server as the status code reason, str() returns a more human readable format. Signed-off-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-27 00:00:51 +0000