2015-09-10 01:58:09 +00:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
|
|
|
"fmt"
|
|
|
|
"strings"
|
|
|
|
|
2016-07-06 16:25:40 +00:00
|
|
|
"github.com/hashicorp/vault/helper/jsonutil"
|
2015-09-10 01:58:09 +00:00
|
|
|
"github.com/hashicorp/vault/logical"
|
|
|
|
"github.com/hashicorp/vault/logical/framework"
|
|
|
|
)
|
|
|
|
|
|
|
|
// CubbyholeBackendFactory constructs a new cubbyhole backend
|
|
|
|
func CubbyholeBackendFactory(conf *logical.BackendConfig) (logical.Backend, error) {
|
|
|
|
var b CubbyholeBackend
|
|
|
|
b.Backend = &framework.Backend{
|
|
|
|
Help: strings.TrimSpace(cubbyholeHelp),
|
|
|
|
|
|
|
|
Paths: []*framework.Path{
|
|
|
|
&framework.Path{
|
|
|
|
Pattern: ".*",
|
|
|
|
|
|
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
|
|
logical.ReadOperation: b.handleRead,
|
2016-01-17 00:35:11 +00:00
|
|
|
logical.CreateOperation: b.handleWrite,
|
|
|
|
logical.UpdateOperation: b.handleWrite,
|
2015-09-10 01:58:09 +00:00
|
|
|
logical.DeleteOperation: b.handleDelete,
|
|
|
|
logical.ListOperation: b.handleList,
|
|
|
|
},
|
|
|
|
|
2016-01-17 00:35:11 +00:00
|
|
|
ExistenceCheck: b.handleExistenceCheck,
|
|
|
|
|
2015-09-10 01:58:09 +00:00
|
|
|
HelpSynopsis: strings.TrimSpace(cubbyholeHelpSynopsis),
|
|
|
|
HelpDescription: strings.TrimSpace(cubbyholeHelpDescription),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
if conf == nil {
|
|
|
|
return nil, fmt.Errorf("Configuation passed into backend is nil")
|
|
|
|
}
|
|
|
|
b.Backend.Setup(conf)
|
|
|
|
|
2015-09-15 16:27:22 +00:00
|
|
|
return &b, nil
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// CubbyholeBackend is used for storing secrets directly into the physical
|
|
|
|
// backend. The secrets are encrypted in the durable storage.
|
|
|
|
// This differs from generic in that every token has its own private
|
|
|
|
// storage view. The view is removed when the token expires.
|
|
|
|
type CubbyholeBackend struct {
|
|
|
|
*framework.Backend
|
2015-09-15 17:49:53 +00:00
|
|
|
|
|
|
|
saltUUID string
|
|
|
|
storageView logical.Storage
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
|
2015-09-15 17:49:53 +00:00
|
|
|
func (b *CubbyholeBackend) revoke(saltedToken string) error {
|
2015-09-10 01:58:09 +00:00
|
|
|
if saltedToken == "" {
|
2016-08-19 20:45:17 +00:00
|
|
|
return fmt.Errorf("cubbyhole: client token empty during revocation")
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
|
2015-09-15 17:49:53 +00:00
|
|
|
if err := ClearView(b.storageView.(*BarrierView).SubView(saltedToken + "/")); err != nil {
|
2015-09-15 15:28:07 +00:00
|
|
|
return err
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-01-17 00:35:11 +00:00
|
|
|
func (b *CubbyholeBackend) handleExistenceCheck(
|
|
|
|
req *logical.Request, data *framework.FieldData) (bool, error) {
|
|
|
|
out, err := req.Storage.Get(req.ClientToken + "/" + req.Path)
|
|
|
|
if err != nil {
|
|
|
|
return false, fmt.Errorf("existence check failed: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return out != nil, nil
|
|
|
|
}
|
|
|
|
|
2015-09-10 01:58:09 +00:00
|
|
|
func (b *CubbyholeBackend) handleRead(
|
|
|
|
req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
|
|
if req.ClientToken == "" {
|
2016-08-19 20:45:17 +00:00
|
|
|
return nil, fmt.Errorf("cubbyhole read: client token empty")
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Read the path
|
|
|
|
out, err := req.Storage.Get(req.ClientToken + "/" + req.Path)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("read failed: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Fast-path the no data case
|
|
|
|
if out == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Decode the data
|
|
|
|
var rawData map[string]interface{}
|
2016-07-06 16:25:40 +00:00
|
|
|
if err := jsonutil.DecodeJSON(out.Value, &rawData); err != nil {
|
2015-09-10 01:58:09 +00:00
|
|
|
return nil, fmt.Errorf("json decoding failed: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Generate the response
|
|
|
|
resp := &logical.Response{
|
|
|
|
Data: rawData,
|
|
|
|
}
|
|
|
|
|
|
|
|
return resp, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (b *CubbyholeBackend) handleWrite(
|
|
|
|
req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
|
|
if req.ClientToken == "" {
|
2016-08-19 20:45:17 +00:00
|
|
|
return nil, fmt.Errorf("cubbyhole write: client token empty")
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
// Check that some fields are given
|
|
|
|
if len(req.Data) == 0 {
|
|
|
|
return nil, fmt.Errorf("missing data fields")
|
|
|
|
}
|
|
|
|
|
|
|
|
// JSON encode the data
|
|
|
|
buf, err := json.Marshal(req.Data)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("json encoding failed: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Write out a new key
|
|
|
|
entry := &logical.StorageEntry{
|
2016-01-19 23:19:38 +00:00
|
|
|
Key: req.ClientToken + "/" + req.Path,
|
2015-09-10 01:58:09 +00:00
|
|
|
Value: buf,
|
|
|
|
}
|
|
|
|
if err := req.Storage.Put(entry); err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to write: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (b *CubbyholeBackend) handleDelete(
|
|
|
|
req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
|
|
if req.ClientToken == "" {
|
2016-08-19 20:45:17 +00:00
|
|
|
return nil, fmt.Errorf("cubbyhole delete: client token empty")
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
// Delete the key at the request path
|
|
|
|
if err := req.Storage.Delete(req.ClientToken + "/" + req.Path); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (b *CubbyholeBackend) handleList(
|
|
|
|
req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
|
|
if req.ClientToken == "" {
|
2016-08-19 20:45:17 +00:00
|
|
|
return nil, fmt.Errorf("cubbyhole list: client token empty")
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
2016-01-14 19:18:27 +00:00
|
|
|
|
2016-02-03 19:05:29 +00:00
|
|
|
// Right now we only handle directories, so ensure it ends with / We also
|
|
|
|
// check if it's empty so we don't end up doing a listing on '<client
|
|
|
|
// token>//'
|
2016-01-19 22:05:01 +00:00
|
|
|
path := req.Path
|
2016-02-03 19:05:29 +00:00
|
|
|
if path != "" && !strings.HasSuffix(path, "/") {
|
2016-01-19 22:05:01 +00:00
|
|
|
path = path + "/"
|
|
|
|
}
|
|
|
|
|
2015-09-10 01:58:09 +00:00
|
|
|
// List the keys at the prefix given by the request
|
2016-01-19 22:05:01 +00:00
|
|
|
keys, err := req.Storage.List(req.ClientToken + "/" + path)
|
2015-09-10 01:58:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2016-01-19 22:05:01 +00:00
|
|
|
// Strip the token
|
2016-01-14 19:18:27 +00:00
|
|
|
strippedKeys := make([]string, len(keys))
|
|
|
|
for i, key := range keys {
|
2016-01-19 22:05:01 +00:00
|
|
|
strippedKeys[i] = strings.TrimPrefix(key, req.ClientToken+"/")
|
2015-09-10 01:58:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Generate the response
|
|
|
|
return logical.ListResponse(strippedKeys), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
const cubbyholeHelp = `
|
|
|
|
The cubbyhole backend reads and writes arbitrary secrets to the backend.
|
|
|
|
The secrets are encrypted/decrypted by Vault: they are never stored
|
|
|
|
unencrypted in the backend and the backend never has an opportunity to
|
|
|
|
see the unencrypted value.
|
|
|
|
|
|
|
|
This backend differs from the 'generic' backend in that it is namespaced
|
|
|
|
per-token. Tokens can only read and write their own values, with no
|
|
|
|
sharing possible (per-token cubbyholes). This can be useful for implementing
|
|
|
|
certain authentication workflows, as well as "scratch" areas for individual
|
|
|
|
clients. When the token is revoked, the entire set of stored values for that
|
|
|
|
token is also removed.
|
|
|
|
`
|
|
|
|
|
|
|
|
const cubbyholeHelpSynopsis = `
|
|
|
|
Pass-through secret storage to a token-specific cubbyhole in the storage
|
|
|
|
backend, allowing you to read/write arbitrary data into secret storage.
|
|
|
|
`
|
|
|
|
|
|
|
|
const cubbyholeHelpDescription = `
|
|
|
|
The cubbyhole backend reads and writes arbitrary data into secret storage,
|
|
|
|
encrypting it along the way.
|
|
|
|
|
|
|
|
The view into the cubbyhole storage space is different for each token; it is
|
|
|
|
a per-token cubbyhole. When the token is revoked all values are removed.
|
|
|
|
`
|