* Initial test environment implementation
* linter pass
* wip: update request latency test
* bugfixes
* Fix logic race in envoy process monitor when canceling context
* skip tests using test environment on non-linux
Move the parseCRLs() method from package 'authorize/evaluator' to
'pkg/cryptutil', replacing the existing DecodeCRL() method. This method
will parse all CRLs found in the PEM input, rather than just the first.
(This removes our usage of the deprecated method x509.ParseDERCRL.)
Update this method to return an error if there is non-PEM data found in
the input, to satisfy the existing test that raw DER-encoded CRLs are
not permitted.
Delete the CRLFromBase64() and CRLFromFile() methods, as these are no
longer used.
* envoyconfig: add virtual host domains for certificates in addition to routes
* Update pkg/cryptutil/certificates.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
* Update pkg/cryptutil/tls.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
* comments
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
* wip
* storage: add filtering to SyncLatest
* don't increment the record version, so intermediate changes are requested
* databroker: add support for query filtering
* fill server and record version
* postgres: databroker storage backend
* wip
* serialize puts
* add test
* skip tests for macos
* add test
* return error from protojson
* set data
* exclude postgres from cover tests
* envoy: check certificates for must-staple flag and drop them if they are missing the response
* Update config/envoyconfig/tls_test.go
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
* tls: fallback to self-signed certificate
* remove unknown domain because certs are no longer valid
* update multi-deployment to use service-specific certificates
* refactor backend, implement encrypted store
* refactor in-memory store
* wip
* wip
* wip
* add syncer test
* fix redis expiry
* fix linting issues
* fix test by skipping non-config records
* fix backoff import
* fix init issues
* fix query
* wait for initial sync before starting directory sync
* add type to SyncLatest
* add more log messages, fix deadlock in in-memory store, always return server version from SyncLatest
* update sync types and tests
* add redis tests
* skip macos in github actions
* add comments to proto
* split getBackend into separate methods
* handle errors in initVersion
* return different error for not found vs other errors in get
* use exponential backoff for redis transaction retry
* rename raw to result
* use context instead of close channel
* store type urls as constants in databroker
* use timestampb instead of ptypes
* fix group merging not waiting
* change locked names
* update GetAll to return latest record version
* add method to grpcutil to get the type url for a protobuf type
* use incremental API
* add test
* use backoff v4
* remove panic, add comment to exponential try, add test for HashProto
* merge master
* fix missing import
- gofumpt everything
- fix TLS MinVersion to be at least 1.2
- add octal syntax
- remove newlines
- fix potential decompression bomb in ecjson
- remove implicit memory aliasing in for loops.
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
* use custom default http transport
* Update config/http.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
* Update config/http.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
* return early
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
