open-vault/builtin/logical/transit/path_keys.go

package transit

import (
	"fmt"
	"strconv"

	"github.com/hashicorp/vault/logical"
	"github.com/hashicorp/vault/logical/framework"
)

func (b *backend) pathKeys() *framework.Path {
	return &framework.Path{
		Pattern: "keys/" + framework.GenericNameRegex("name"),
		Fields: map[string]*framework.FieldSchema{
			"name": &framework.FieldSchema{
				Type:        framework.TypeString,
				Description: "Name of the key",
			},

			"derived": &framework.FieldSchema{
				Type:        framework.TypeBool,
				Description: "Enables key derivation mode. This allows for per-transaction unique keys",
			},
		},

		Callbacks: map[logical.Operation]framework.OperationFunc{
			logical.UpdateOperation: b.pathPolicyWrite,
			logical.DeleteOperation: b.pathPolicyDelete,
			logical.ReadOperation:   b.pathPolicyRead,
		},

		HelpSynopsis:    pathPolicyHelpSyn,
		HelpDescription: pathPolicyHelpDesc,
	}
}

func (b *backend) pathPolicyWrite(
	req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
	// Grab a write lock right off the bat
	b.policies.Lock()
	defer b.policies.Unlock()

	name := d.Get("name").(string)
	derived := d.Get("derived").(bool)

	// Generate the policy; this will also check if it exists for safety
	_, err := b.policies.generatePolicy(req.Storage, name, derived)
	return nil, err
}

func (b *backend) pathPolicyRead(
	req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
	name := d.Get("name").(string)

	lp, err := b.policies.getPolicy(req.Storage, name)
	if err != nil {
		return nil, err
	}
	if lp == nil {
		return nil, nil
	}

	lp.RLock()
	defer lp.RUnlock()

	// Verify if wasn't deleted before we grabbed the lock
	if lp.Policy() == nil {
		return nil, fmt.Errorf("no existing policy named %s could be found", name)
	}

	// Return the response
	resp := &logical.Response{
		Data: map[string]interface{}{
			"name":                   lp.Policy().Name,
			"cipher_mode":            lp.Policy().CipherMode,
			"derived":                lp.Policy().Derived,
			"deletion_allowed":       lp.Policy().DeletionAllowed,
			"min_decryption_version": lp.Policy().MinDecryptionVersion,
			"latest_version":         lp.Policy().LatestVersion,
		},
	}
	if lp.Policy().Derived {
		resp.Data["kdf_mode"] = lp.Policy().KDFMode
	}

	retKeys := map[string]int64{}
	for k, v := range lp.Policy().Keys {
		retKeys[strconv.Itoa(k)] = v.CreationTime
	}
	resp.Data["keys"] = retKeys

	return resp, nil
}

func (b *backend) pathPolicyDelete(
	req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
	name := d.Get("name").(string)

	// Some sanity checking
	lp, err := b.policies.getPolicy(req.Storage, name)
	if err != nil {
		return logical.ErrorResponse(fmt.Sprintf("error looking up policy %s, error is %s", name, err)), err
	}
	if lp == nil {
		return logical.ErrorResponse(fmt.Sprintf("no such key %s", name)), logical.ErrInvalidRequest
	}

	// Hold both locks since we'll be affecting both the cache (if it exists)
	// and the locking policy itself
	b.policies.Lock()
	defer b.policies.Unlock()
	lp.Lock()
	defer lp.Unlock()

	// Make sure that we have up-to-date values since deletePolicy will check
	// things like whether deletion is allowed
	lp, err = b.policies.refreshPolicy(req.Storage, name)
	if err != nil {
		return nil, err
	}
	if lp == nil {
		return nil, fmt.Errorf("error finding key %s after locking for deletion", name)
	}

	err = b.policies.deletePolicy(req.Storage, lp, name)
	if err != nil {
		return logical.ErrorResponse(fmt.Sprintf("error deleting policy %s: %s", name, err)), err
	}

	return nil, nil
}

const pathPolicyHelpSyn = `Managed named encryption keys`

const pathPolicyHelpDesc = `
This path is used to manage the named keys that are available.
Doing a write with no value against a new named key will create
it using a randomly generated key.
`