2015-04-16 00:08:12 +00:00
|
|
|
package transit
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/aes"
|
|
|
|
"crypto/cipher"
|
|
|
|
"crypto/rand"
|
|
|
|
"encoding/base64"
|
2015-06-18 01:51:05 +00:00
|
|
|
"fmt"
|
2015-04-16 00:08:12 +00:00
|
|
|
|
|
|
|
"github.com/hashicorp/vault/logical"
|
|
|
|
"github.com/hashicorp/vault/logical/framework"
|
|
|
|
)
|
|
|
|
|
|
|
|
func pathEncrypt() *framework.Path {
|
|
|
|
return &framework.Path{
|
2015-08-21 07:56:13 +00:00
|
|
|
Pattern: "encrypt/" + framework.GenericNameRegex("name"),
|
2015-04-16 00:08:12 +00:00
|
|
|
Fields: map[string]*framework.FieldSchema{
|
|
|
|
"name": &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: "Name of the policy",
|
|
|
|
},
|
|
|
|
|
|
|
|
"plaintext": &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: "Plaintext value to encrypt",
|
|
|
|
},
|
2015-07-05 21:12:07 +00:00
|
|
|
|
|
|
|
"context": &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: "Context for key derivation. Required for derived keys.",
|
|
|
|
},
|
2015-04-16 00:08:12 +00:00
|
|
|
},
|
|
|
|
|
|
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
|
|
logical.WriteOperation: pathEncryptWrite,
|
|
|
|
},
|
2015-04-27 19:47:09 +00:00
|
|
|
|
|
|
|
HelpSynopsis: pathEncryptHelpSyn,
|
|
|
|
HelpDescription: pathEncryptHelpDesc,
|
2015-04-16 00:08:12 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func pathEncryptWrite(
|
|
|
|
req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
|
|
name := d.Get("name").(string)
|
|
|
|
value := d.Get("plaintext").(string)
|
|
|
|
if len(value) == 0 {
|
|
|
|
return logical.ErrorResponse("missing plaintext to encrypt"), logical.ErrInvalidRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
// Decode the plaintext value
|
|
|
|
plaintext, err := base64.StdEncoding.DecodeString(value)
|
|
|
|
if err != nil {
|
|
|
|
return logical.ErrorResponse("failed to decode plaintext as base64"), logical.ErrInvalidRequest
|
|
|
|
}
|
|
|
|
|
2015-07-05 21:37:51 +00:00
|
|
|
// Decode the context if any
|
|
|
|
contextRaw := d.Get("context").(string)
|
|
|
|
var context []byte
|
|
|
|
if len(contextRaw) != 0 {
|
|
|
|
var err error
|
|
|
|
context, err = base64.StdEncoding.DecodeString(contextRaw)
|
|
|
|
if err != nil {
|
|
|
|
return logical.ErrorResponse("failed to decode context as base64"), logical.ErrInvalidRequest
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-04-16 00:08:12 +00:00
|
|
|
// Get the policy
|
|
|
|
p, err := getPolicy(req, name)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Error if invalid policy
|
|
|
|
if p == nil {
|
2015-07-06 01:58:31 +00:00
|
|
|
isDerived := len(context) != 0
|
|
|
|
p, err = generatePolicy(req.Storage, name, isDerived)
|
2015-06-18 01:51:05 +00:00
|
|
|
if err != nil {
|
|
|
|
return logical.ErrorResponse(fmt.Sprintf("failed to upsert policy: %v", err)), logical.ErrInvalidRequest
|
|
|
|
}
|
2015-04-16 00:08:12 +00:00
|
|
|
}
|
|
|
|
|
2015-07-05 21:19:24 +00:00
|
|
|
// Derive the key that should be used
|
2015-07-05 21:37:51 +00:00
|
|
|
key, err := p.DeriveKey(context)
|
2015-07-05 21:19:24 +00:00
|
|
|
if err != nil {
|
|
|
|
return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
|
|
|
|
}
|
|
|
|
|
2015-04-16 00:08:12 +00:00
|
|
|
// Guard against a potentially invalid cipher-mode
|
|
|
|
switch p.CipherMode {
|
|
|
|
case "aes-gcm":
|
|
|
|
default:
|
|
|
|
return logical.ErrorResponse("unsupported cipher mode"), logical.ErrInvalidRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
// Setup the cipher
|
2015-07-05 21:19:24 +00:00
|
|
|
aesCipher, err := aes.NewCipher(key)
|
2015-04-16 00:08:12 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Setup the GCM AEAD
|
|
|
|
gcm, err := cipher.NewGCM(aesCipher)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Compute random nonce
|
|
|
|
nonce := make([]byte, gcm.NonceSize())
|
|
|
|
_, err = rand.Read(nonce)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Encrypt and tag with GCM
|
|
|
|
out := gcm.Seal(nil, nonce, plaintext, nil)
|
|
|
|
|
|
|
|
// Place the encrypted data after the nonce
|
|
|
|
full := append(nonce, out...)
|
|
|
|
|
|
|
|
// Convert to base64
|
|
|
|
encoded := base64.StdEncoding.EncodeToString(full)
|
|
|
|
|
|
|
|
// Prepend some information
|
|
|
|
encoded = "vault:v0:" + encoded
|
|
|
|
|
|
|
|
// Generate the response
|
|
|
|
resp := &logical.Response{
|
|
|
|
Data: map[string]interface{}{
|
|
|
|
"ciphertext": encoded,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
return resp, nil
|
|
|
|
}
|
2015-04-27 19:47:09 +00:00
|
|
|
|
|
|
|
const pathEncryptHelpSyn = `Encrypt a plaintext value using a named key`
|
|
|
|
|
|
|
|
const pathEncryptHelpDesc = `
|
|
|
|
This path uses the named key from the request path to encrypt a user
|
|
|
|
provided plaintext. The plaintext must be base64 encoded.
|
|
|
|
`
|