Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions docs/_docs/admin-guide/tavern.md
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ By default, Tavern will listen on `0.0.0.0:8000`. If you ever wish to change thi

### Metrics

By default, Tavern does not export metrics. You may use the below environment configuration variables to enable [Prometheus](https://prometheus.io/docs/introduction/overview/) metric collection. These metrics become available at the "/metrics" endpoint configured. These metrics are hosted on a separate HTTP server such that it can be restricted to localhost (default). This is because the endpoint is unauthenticated, and would leak sensitive information if it was accessible.
By default, Tavern does not export metrics. You may use the below environment configuration variables to enable [Prometheus](https://prometheus.io/docs/introduction/overview/) metric collection. These metrics become available at the "/metrics" endpoint configured. These metrics are hosted on a separate HTTP server so that it can be restricted to localhost (default). This is because the endpoint is unauthenticated, and would leak sensitive information if it was accessible.

| Env Var | Description | Default | Required |
| ------- | ----------- | ------- | -------- |
Expand All @@ -193,7 +193,7 @@ By default, Tavern does not export metrics. You may use the below environment co
### Secrets

By default, Tavern wants to use a GCP KMS for secrets management. The secrets engine is used to generate keypairs when communicating with agents.
If you're running locally make sure to set the secrets manager to a local file path using:
If you're running locally, make sure to set the secrets manager to a local file path using:

```bash
SECRETS_FILE_PATH="/tmp/secrets" go run ./tavern/
Expand Down Expand Up @@ -479,7 +479,7 @@ query listtomes{

### Upload - POST /cdn/upload - AUTHENTICATED

The upload API for the Tavern CDN use forms and the POST method. The parameters are `fileName` and `fileContent`. and the API will return an Ent ID for the file created. A curl example is shown below:
The upload API for the Tavern CDN uses forms and the POST method. The parameters are `fileName` and `fileContent`. and the API will return an Ent ID for the file created. A curl example is shown below:

```bash
[$ /tmp] curl --cookie "auth-session=REDACTED" -F "fileName=test_file" -F "fileContent=@/path/to/file" https://example.com/cdn/upload
Expand All @@ -488,7 +488,7 @@ The upload API for the Tavern CDN use forms and the POST method. The parameters

### Create a link - AUTHENTICATED

Once a file's been uploaded you won't be able to download it until you create a link for it through the graphql playground `/playground`
Once a file's been uploaded you won't be able to download it until you create a link for it through the GraphQL playground `/playground`

```graphql
mutation tempLink {
Expand All @@ -498,9 +498,9 @@ mutation tempLink {
}
```

This will create a link that allows the link to be active until Feburary 2nd 2026 at 21:33:18 UTC with 10 downloads. These two conditions are or'd so if either is allowed the download will work.
This will create a link that allows the link to be active until February 2nd 2026 at 21:33:18 UTC with 10 downloads. These two conditions are or'd so if either is allowed the download will work.

If no path is specified a random 6 character path will be generated. In the graphql query above we request the path back to ensure we know where to grab the file.
If no path is specified a random 6 character path will be generated. In the GraphQL query above we request the path back to ensure we know where to grab the file.

### Playground - GET /cdn/{path} - UNAUTHENTICATED

Expand Down
14 changes: 7 additions & 7 deletions docs/_docs/dev-guide/eldritch.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ Currently Eldritch has the following libraries your function can be bound to:
* `crypto` Is used to encrypt/decrypt or hash data.
* `file`: Is used for any on disk file processing.
* `http`: Is used for any web requests needed to be made.
* `pivot`: Is used to migrate to identify, and migrate between systems. The pivot library is also responsible for facilitating connectivity within an environment.
* `pivot`: Is used to identify targets and migrate between systems. The pivot library is also responsible for facilitating connectivity within an environment.
* `process`: Is used to manage running processes on a system.
* `random` - Used to generate cryptographically secure random values.
* `regex`: Is used to perform regex operations on strings.
Expand All @@ -50,7 +50,7 @@ Currently Eldritch has the following libraries your function can be bound to:
If your function does not fall under a specific standard library reach out to the core developers about adding a new library or finding the right fit.

Specify the input and output according to the [supported types.](/user-guide/eldritch#data-types)
If there are OS or edge case specific behaviors make sure to document them here. If there are limitations (e.g. if a function doesn't use file streaming) specify that it can't be used for large files.
If there are OS- or edge-case-specific behaviors make sure to document them here. If there are limitations (e.g. if a function doesn't use file streaming) specify that it can't be used for large files.

Please add your function in alphabetical order this makes it easy to search by key words.

Expand Down Expand Up @@ -97,7 +97,7 @@ impl FileLibrary for StdFileLibrary {
function_impl::function(arg1, arg2, arg3)
}

// If your function does not return a value, return a () and error as string.
// If your function does not return a value, return () and error as string.
fn other_function(&self) -> Result<(), String> {
other_function_impl::other_function()
}
Expand Down Expand Up @@ -163,7 +163,7 @@ mod tests {
### Testing

Testing can be really daunting especially with complex system functions required by security professionals.
If you have any questions or hit any road blocks please reach out we'd love to help, also feel free to open a draft PR with what you have and mark it with the `help wanted` tag.
If you have any questions or hit any road blocks please reach out we'd love to help, also, feel free to open a draft PR with what you have and mark it with the `help wanted` tag.
Testing isn't meant to be a barrier to contributing but instead a safety net so you know your code doesn't affect other systems. If it becomes a blocker please reach out so we can help 🙂

#### How to Test
Expand Down Expand Up @@ -200,7 +200,7 @@ For all non supported OSes return an error with a message explaining which OSes
return Err(anyhow::anyhow!("This OS isn't supported by the dll_inject function.\nOnly windows systems are supported"));
```

### Using `Dict`
### Using `Dict`s

---
The `Dict` type requires dynamic memory allocation in eldritch. In order to achieve this we can leverage the `BTreeMap<String, Value>` and push entries onto it. It's pretty simple to implement and starlark does some magic to streamline the process. To make the heap available to your function simply add it as an argument to your function.
Expand Down Expand Up @@ -246,10 +246,10 @@ pub fn get_os() -> Result<Dict> {
}
```

### Using `Async`
### Using Asynchronous Code

---
When writing performant code bound by many I/O operations, it can be greatly beneficial to use `async` methods and a scheduler, to enable CPU bound operations to be performed while awaiting I/O. This can dramatically reduce latency for many applications. Using `async` for your eldritch function implementations can be difficult however. It can be done, but it will add complexity to your code and must be implemented carefully. **YOU SHOULD NOT** implement `async` functions without having a complete understanding of how eldritch manages threads and it's own async runtime. Doing so will likely result in bugs, where you attempt to create a new `tokio::Runtime` within an existing runtime. By default, the `eldritch::Runtime` creates a new blocking thread (`tokio::task::spawn_blocking`), which helps prevent it from blocking other tome evaluation. Any results reported via the `report` library will already be concurrent with the thread that started the eldritch evaluation. **ALL ELDRITCH CODE IS SYNCHRONOUS** which means that creating an `async` function will not enable tome developers to run code in parallel, it just may allow the `tokio` scheduler to allocate CPU away from your code while it awaits an I/O operation. The primary performance benefits of using `async` is for the environment from which eldritch is being run, it is unlikely to impact the performance of any individual Tome (due to their synchronous nature).
When writing performant code bound by many I/O operations, it can be greatly beneficial to use `async` methods and a scheduler, to enable CPU bound operations to be performed while awaiting I/O. This can dramatically reduce latency for many applications. Using `async` for your eldritch function implementations can be difficult however. It can be done, but it will add complexity to your code and must be implemented carefully. **YOU SHOULD NOT** implement `async` functions without having a complete understanding of how eldritch manages threads and its own async runtime. Doing so will likely result in bugs, where you attempt to create a new `tokio::Runtime` within an existing runtime. By default, the `eldritch::Runtime` creates a new blocking thread (`tokio::task::spawn_blocking`), which helps prevent it from blocking other tome evaluation. Any results reported via the `report` library will already be concurrent with the thread that started the eldritch evaluation. **ALL ELDRITCH CODE IS SYNCHRONOUS** which means that creating an `async` function will not enable tome developers to run code in parallel, it just may allow the `tokio` scheduler to allocate CPU away from your code while it awaits an I/O operation. The primary performance benefits of using `async` is for the environment from which eldritch is being run, it is unlikely to impact the performance of any individual Tome (due to their synchronous nature).

#### Async Testing

Expand Down
4 changes: 2 additions & 2 deletions docs/_docs/dev-guide/imix.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ Imix is the main bot for Realm.

## Agent protobuf

In order to communicate agent state and configuration during the claimTask request the agent sends a protobuf containing various configuration options. If any are updated agent side they're now synchronized with the server ensuring operators can track the state of their agents.
In order to communicate agent state and configuration during the claimTask request the agent sends a protobuf containing various configuration options. If any are updated agent-side they're now synchronized with the server ensuring operators can track the state of their agents.

In order to keep these configuration options in sync realm uses protobuf and code generation to ensure agent and server agree.

Expand Down Expand Up @@ -51,7 +51,7 @@ And add a new enum definition to `tavern/internal/c2/c2pb/enum_<MESSAGE NAME>_<E

## Host Selector

The host selector defined in `implants/lib/host_unique` allows imix to reliably identify which host it's running on. This is helpful for operators when creating tasking across multiple beacons as well as when searching for command results. Uniqueness is stored as a UUIDv4 value.
The host selector defined in `implants/lib/host_unique` allows imix to reliably identify which host it's running on. This is helpful for operators when creating tasks across multiple beacons as well as when searching for command results. Uniqueness is stored as a UUIDv4 value.

Out of the box realm comes with two options `File` and `Env` to determine what host it's on.

Expand Down
6 changes: 3 additions & 3 deletions docs/_docs/dev-guide/introduction.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ permalink: dev-guide/introduction
---
# Overview

This section of the documentation is meant for new Realm-contributors, and should be read in its entirety before submitting your first PR. Below you can learn more about our testing & documentation requirements, project layout, and some of the internals of our codebase.
This section of the documentation is meant for new Realm contributors, and should be read in its entirety before submitting your first PR. Below you can learn more about our testing & documentation requirements, project layout, and some of the internals of our codebase.

## Contribution Guidelines

Expand All @@ -23,7 +23,7 @@ Realm contains code across a variety of languages and frameworks. Testing helps

#### Eldritch

Any methods added to the Eldritch Standard Library should have tests collocated in the method's `<name>_impl.rs` file. Here are a few things to keep in mind:
Any methods added to the Eldritch Standard Library should have tests colocated in the method's `<name>_impl.rs` file. Here are a few things to keep in mind:

* Tests should be cross platform
* Rely on [NamedTempFile](https://docs.rs/tempfile/1.1.1/tempfile/struct.NamedTempFile.html) for temporary files
Expand All @@ -39,7 +39,7 @@ All code changes to Tavern must be tested. Below are some standards for test wri
* For GraphQL API Tests, please refer to our [YAML specification](/dev-guide/tavern#yaml-test-reference-graphql)
* For gRPC API Tests, please refer to our [YAML specification](/dev-guide/tavern#yaml-test-reference-grpc)
* Conventionally, please colocate your test code with the code it is testing and include it in the `<packagename>_test` package
* We rely on the standard [testify](https://github.com/stretchr/testify) assert & require libraries for ensuring expected values (or errors) are returned
* We rely on the standard [testify](https://github.com/stretchr/testify) assert and require libraries for ensuring expected values (or errors) are returned
* To enable a variety of inputs for a test case, we rely on closure-driven testing for Golang, you can read more about it [here](https://medium.com/@cep21/closure-driven-tests-an-alternative-style-to-table-driven-tests-in-go-628a41497e5e)
* Reusable test code should go in a sub-package suffixed with test
* For example, reusable test code for the `ent` package would be located in the `ent/enttest` package
Expand Down
4 changes: 2 additions & 2 deletions docs/_docs/dev-guide/tavern.md
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,7 @@ If you can't use the default google oauth2 backend Realm has a flexible implemen
For example to add Hashicorp Vault as an OIDC backend you'll need to:

1. Setup an OIDC provider in vault - <https://developer.hashicorp.com/vault/docs/secrets/identity/oidc-provider>
2. Get the relevant variables from the '.well-known/openid-configuration` endpoint: `authorization_endpoint`,`token_endpoint`,`userinfo_endpoint`,`scopes_supported`
2. Get the relevant variables from the `.well-known/openid-configuration` endpoint: `authorization_endpoint`,`token_endpoint`,`userinfo_endpoint`,`scopes_supported`
3. Open the `tavern/config.go` file and find where the `oauth2.Config` is initialized.
4. You'll need to change `Endpoint: google.Endpoint` to `oauth2.Endpoint{}` and fill in the `AuthURL` and `TokenURL` with `authorization_endpoint` and `token_endpoint` respectively.
5. Update the `cfg.userProfiles` link with the `userinfo_endpoint`
Expand Down Expand Up @@ -233,4 +233,4 @@ func ConfigureOAuthFromEnv(redirectPath string) func(*Config) {

```

_Keep in mind `/default/` in vault corresponds to the name of the OIDC provider and may be different in your environment. You may need to include / create additional scopes to get things like profile pictures and users names from vault into Tavern_
_Keep in mind `/default/` in vault corresponds to the name of the OIDC provider and may be different in your environment. You may need to include / create additional scopes to get things like profile pictures and usernames from vault into Tavern_
Loading
Loading