2021-10-14 16:10:59 +00:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"encoding/json"
|
|
|
|
"fmt"
|
2022-02-17 19:43:07 +00:00
|
|
|
"strings"
|
2021-10-14 16:10:59 +00:00
|
|
|
"time"
|
|
|
|
|
2022-02-17 19:43:07 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
2021-10-14 16:10:59 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
|
|
)
|
|
|
|
|
2022-02-17 19:43:07 +00:00
|
|
|
const (
|
|
|
|
vaultVersionPath string = "core/versions/"
|
|
|
|
)
|
2021-10-14 16:10:59 +00:00
|
|
|
|
2022-02-14 20:26:57 +00:00
|
|
|
// storeVersionTimestamp will store the version and timestamp pair to storage
|
|
|
|
// only if no entry for that version already exists in storage. Version
|
|
|
|
// timestamps were initially stored in local time. UTC should be used. Existing
|
|
|
|
// entries can be overwritten via the force flag. A bool will be returned
|
|
|
|
// denoting whether the entry was updated
|
|
|
|
func (c *Core) storeVersionTimestamp(ctx context.Context, version string, timestampInstalled time.Time, force bool) (bool, error) {
|
|
|
|
key := vaultVersionPath + version
|
|
|
|
|
|
|
|
vaultVersion := VaultVersion{
|
|
|
|
TimestampInstalled: timestampInstalled.UTC(),
|
|
|
|
Version: version,
|
|
|
|
}
|
|
|
|
|
|
|
|
marshalledVaultVersion, err := json.Marshal(vaultVersion)
|
2021-10-14 16:10:59 +00:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
2022-02-14 20:26:57 +00:00
|
|
|
newEntry := &logical.StorageEntry{
|
|
|
|
Key: key,
|
|
|
|
Value: marshalledVaultVersion,
|
2021-10-14 16:10:59 +00:00
|
|
|
}
|
|
|
|
|
2022-02-14 20:26:57 +00:00
|
|
|
if force {
|
|
|
|
// avoid storage lookup and write immediately
|
|
|
|
err = c.barrier.Put(ctx, newEntry)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
existingEntry, err := c.barrier.Get(ctx, key)
|
2021-10-14 16:10:59 +00:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
2022-02-14 20:26:57 +00:00
|
|
|
if existingEntry != nil {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
err = c.barrier.Put(ctx, newEntry)
|
|
|
|
|
2021-10-14 16:10:59 +00:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
2022-02-14 20:26:57 +00:00
|
|
|
|
2021-10-14 16:10:59 +00:00
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// FindOldestVersionTimestamp searches for the vault version with the oldest
|
2022-02-14 20:26:57 +00:00
|
|
|
// upgrade timestamp from storage. The earliest version this can be is 1.9.0.
|
2021-10-14 16:10:59 +00:00
|
|
|
func (c *Core) FindOldestVersionTimestamp() (string, time.Time, error) {
|
2022-03-07 23:42:06 +00:00
|
|
|
if c.versionTimestamps == nil {
|
2021-10-14 16:10:59 +00:00
|
|
|
return "", time.Time{}, fmt.Errorf("version timestamps are not initialized")
|
|
|
|
}
|
|
|
|
|
2022-02-14 20:26:57 +00:00
|
|
|
oldestUpgradeTime := time.Now().UTC()
|
2021-10-14 16:10:59 +00:00
|
|
|
var oldestVersion string
|
2022-02-14 20:26:57 +00:00
|
|
|
|
2021-11-16 20:05:59 +00:00
|
|
|
for version, upgradeTime := range c.versionTimestamps {
|
2021-10-14 16:10:59 +00:00
|
|
|
if upgradeTime.Before(oldestUpgradeTime) {
|
|
|
|
oldestVersion = version
|
|
|
|
oldestUpgradeTime = upgradeTime
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return oldestVersion, oldestUpgradeTime, nil
|
|
|
|
}
|
|
|
|
|
2022-03-04 22:16:51 +00:00
|
|
|
func (c *Core) FindNewestVersionTimestamp() (string, time.Time, error) {
|
2022-03-07 23:42:06 +00:00
|
|
|
if c.versionTimestamps == nil {
|
2022-03-04 22:16:51 +00:00
|
|
|
return "", time.Time{}, fmt.Errorf("version timestamps are not initialized")
|
|
|
|
}
|
|
|
|
|
|
|
|
var newestUpgradeTime time.Time
|
|
|
|
var newestVersion string
|
|
|
|
|
|
|
|
for version, upgradeTime := range c.versionTimestamps {
|
|
|
|
if upgradeTime.After(newestUpgradeTime) {
|
|
|
|
newestVersion = version
|
|
|
|
newestUpgradeTime = upgradeTime
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return newestVersion, newestUpgradeTime, nil
|
|
|
|
}
|
|
|
|
|
2022-02-14 20:26:57 +00:00
|
|
|
// loadVersionTimestamps loads all the vault versions and associated upgrade
|
|
|
|
// timestamps from storage. Version timestamps were originally stored in local
|
|
|
|
// time. A timestamp that is not in UTC will be rewritten to storage as UTC.
|
|
|
|
func (c *Core) loadVersionTimestamps(ctx context.Context) error {
|
2021-10-14 16:10:59 +00:00
|
|
|
vaultVersions, err := c.barrier.List(ctx, vaultVersionPath)
|
|
|
|
if err != nil {
|
2022-02-14 20:26:57 +00:00
|
|
|
return fmt.Errorf("unable to retrieve vault versions from storage: %w", err)
|
2021-10-14 16:10:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, versionPath := range vaultVersions {
|
|
|
|
version, err := c.barrier.Get(ctx, vaultVersionPath+versionPath)
|
|
|
|
if err != nil {
|
2022-02-14 20:26:57 +00:00
|
|
|
return fmt.Errorf("unable to read vault version at path %s: err %w", versionPath, err)
|
2021-10-14 16:10:59 +00:00
|
|
|
}
|
|
|
|
if version == nil {
|
|
|
|
return fmt.Errorf("nil version stored at path %s", versionPath)
|
|
|
|
}
|
|
|
|
var vaultVersion VaultVersion
|
|
|
|
err = json.Unmarshal(version.Value, &vaultVersion)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("unable to unmarshal vault version for path %s: err %w", versionPath, err)
|
|
|
|
}
|
|
|
|
if vaultVersion.Version == "" || vaultVersion.TimestampInstalled.IsZero() {
|
|
|
|
return fmt.Errorf("found empty serialized vault version at path %s", versionPath)
|
|
|
|
}
|
2022-02-14 20:26:57 +00:00
|
|
|
|
|
|
|
timestampInstalled := vaultVersion.TimestampInstalled
|
|
|
|
|
|
|
|
// self-heal entries that were not stored in UTC
|
|
|
|
if timestampInstalled.Location() != time.UTC {
|
|
|
|
timestampInstalled = timestampInstalled.UTC()
|
|
|
|
isUpdated, err := c.storeVersionTimestamp(ctx, vaultVersion.Version, timestampInstalled, true)
|
|
|
|
if err != nil {
|
|
|
|
c.logger.Warn("failed to rewrite vault version timestamp as UTC", "error", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if isUpdated {
|
|
|
|
c.logger.Info("self-healed pre-existing vault version in UTC",
|
|
|
|
"vault version", vaultVersion.Version, "UTC time", timestampInstalled)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
c.versionTimestamps[vaultVersion.Version] = timestampInstalled
|
2021-10-14 16:10:59 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2022-02-17 19:43:07 +00:00
|
|
|
|
|
|
|
func IsJWT(token string) bool {
|
|
|
|
return len(token) > 3 && strings.Count(token, ".") == 2 &&
|
|
|
|
(token[3] != '.' && token[1] != '.')
|
|
|
|
}
|
|
|
|
|
|
|
|
func IsSSCToken(token string) bool {
|
|
|
|
return len(token) > MaxNsIdLength+TokenLength+TokenPrefixLength &&
|
|
|
|
strings.HasPrefix(token, consts.ServiceTokenPrefix)
|
|
|
|
}
|
|
|
|
|
|
|
|
func IsServiceToken(token string) bool {
|
|
|
|
return strings.HasPrefix(token, consts.ServiceTokenPrefix) ||
|
|
|
|
strings.HasPrefix(token, consts.LegacyServiceTokenPrefix)
|
|
|
|
}
|
|
|
|
|
|
|
|
func IsBatchToken(token string) bool {
|
|
|
|
return strings.HasPrefix(token, consts.LegacyBatchTokenPrefix) ||
|
|
|
|
strings.HasPrefix(token, consts.BatchTokenPrefix)
|
|
|
|
}
|