2015-03-16 02:34:47 +00:00
|
|
|
package http
|
|
|
|
|
|
|
|
import (
|
2015-04-07 21:36:17 +00:00
|
|
|
"io"
|
2015-05-20 05:23:41 +00:00
|
|
|
"net"
|
2015-03-16 02:34:47 +00:00
|
|
|
"net/http"
|
2016-01-19 23:09:26 +00:00
|
|
|
"strconv"
|
2015-03-16 02:34:47 +00:00
|
|
|
"strings"
|
2016-09-23 16:32:07 +00:00
|
|
|
"time"
|
2015-03-16 02:34:47 +00:00
|
|
|
|
2016-05-02 02:39:45 +00:00
|
|
|
"github.com/hashicorp/errwrap"
|
2016-07-26 19:50:37 +00:00
|
|
|
"github.com/hashicorp/go-uuid"
|
2015-03-16 02:34:47 +00:00
|
|
|
"github.com/hashicorp/vault/logical"
|
|
|
|
"github.com/hashicorp/vault/vault"
|
|
|
|
)
|
|
|
|
|
2016-09-29 04:01:28 +00:00
|
|
|
type PrepareRequestFunc func(*vault.Core, *logical.Request) error
|
2016-03-18 02:29:53 +00:00
|
|
|
|
2016-10-29 21:01:49 +00:00
|
|
|
func buildLogicalRequest(core *vault.Core, w http.ResponseWriter, r *http.Request) (*logical.Request, int, error) {
|
2016-05-20 17:03:54 +00:00
|
|
|
// Determine the path...
|
|
|
|
if !strings.HasPrefix(r.URL.Path, "/v1/") {
|
|
|
|
return nil, http.StatusNotFound, nil
|
|
|
|
}
|
|
|
|
path := r.URL.Path[len("/v1/"):]
|
|
|
|
if path == "" {
|
|
|
|
return nil, http.StatusNotFound, nil
|
|
|
|
}
|
2015-03-16 02:34:47 +00:00
|
|
|
|
2016-05-20 17:03:54 +00:00
|
|
|
// Determine the operation
|
|
|
|
var op logical.Operation
|
|
|
|
switch r.Method {
|
|
|
|
case "DELETE":
|
|
|
|
op = logical.DeleteOperation
|
|
|
|
case "GET":
|
|
|
|
op = logical.ReadOperation
|
|
|
|
// Need to call ParseForm to get query params loaded
|
|
|
|
queryVals := r.URL.Query()
|
|
|
|
listStr := queryVals.Get("list")
|
|
|
|
if listStr != "" {
|
|
|
|
list, err := strconv.ParseBool(listStr)
|
2015-04-07 21:36:17 +00:00
|
|
|
if err != nil {
|
2016-05-20 17:03:54 +00:00
|
|
|
return nil, http.StatusBadRequest, nil
|
|
|
|
}
|
|
|
|
if list {
|
|
|
|
op = logical.ListOperation
|
2015-03-16 02:34:47 +00:00
|
|
|
}
|
|
|
|
}
|
2016-05-20 17:03:54 +00:00
|
|
|
case "POST", "PUT":
|
|
|
|
op = logical.UpdateOperation
|
|
|
|
case "LIST":
|
|
|
|
op = logical.ListOperation
|
|
|
|
default:
|
|
|
|
return nil, http.StatusMethodNotAllowed, nil
|
|
|
|
}
|
2015-03-16 02:34:47 +00:00
|
|
|
|
2016-05-20 17:03:54 +00:00
|
|
|
// Parse the request if we can
|
|
|
|
var data map[string]interface{}
|
|
|
|
if op == logical.UpdateOperation {
|
2016-12-01 18:59:00 +00:00
|
|
|
err := parseRequest(r, w, &data)
|
2016-05-20 17:03:54 +00:00
|
|
|
if err == io.EOF {
|
|
|
|
data = nil
|
|
|
|
err = nil
|
|
|
|
}
|
2016-05-02 02:39:45 +00:00
|
|
|
if err != nil {
|
2016-05-20 17:03:54 +00:00
|
|
|
return nil, http.StatusBadRequest, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-07-26 16:20:27 +00:00
|
|
|
var err error
|
2016-07-26 19:50:37 +00:00
|
|
|
request_id, err := uuid.GenerateUUID()
|
|
|
|
if err != nil {
|
|
|
|
return nil, http.StatusBadRequest, errwrap.Wrapf("failed to generate identifier for the request: {{err}}", err)
|
|
|
|
}
|
|
|
|
|
2016-10-29 21:01:49 +00:00
|
|
|
req := requestAuth(core, r, &logical.Request{
|
2016-07-26 20:44:50 +00:00
|
|
|
ID: request_id,
|
2016-05-20 17:03:54 +00:00
|
|
|
Operation: op,
|
|
|
|
Path: path,
|
|
|
|
Data: data,
|
|
|
|
Connection: getConnection(r),
|
|
|
|
})
|
2016-10-29 21:01:49 +00:00
|
|
|
|
2016-05-20 17:03:54 +00:00
|
|
|
req, err = requestWrapTTL(r, req)
|
|
|
|
if err != nil {
|
|
|
|
return nil, http.StatusBadRequest, errwrap.Wrapf("error parsing X-Vault-Wrap-TTL header: {{err}}", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return req, 0, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func handleLogical(core *vault.Core, dataOnly bool, prepareRequestCallback PrepareRequestFunc) http.Handler {
|
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
2016-10-29 21:01:49 +00:00
|
|
|
req, statusCode, err := buildLogicalRequest(core, w, r)
|
2016-05-20 17:03:54 +00:00
|
|
|
if err != nil || statusCode != 0 {
|
|
|
|
respondError(w, statusCode, err)
|
2016-05-02 02:39:45 +00:00
|
|
|
return
|
|
|
|
}
|
2016-03-18 02:29:53 +00:00
|
|
|
|
2016-05-19 17:33:51 +00:00
|
|
|
// Certain endpoints may require changes to the request object. They
|
|
|
|
// will have a callback registered to do the needed operations, so
|
|
|
|
// invoke it before proceeding.
|
2016-03-18 02:29:53 +00:00
|
|
|
if prepareRequestCallback != nil {
|
2016-09-29 04:01:28 +00:00
|
|
|
if err := prepareRequestCallback(core, req); err != nil {
|
|
|
|
respondError(w, http.StatusBadRequest, err)
|
2016-03-18 02:29:53 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Make the internal request. We attach the connection info
|
|
|
|
// as well in case this is an authentication request that requires
|
|
|
|
// it. Vault core handles stripping this if we need to.
|
|
|
|
resp, ok := request(core, w, r, req)
|
2015-04-08 18:19:03 +00:00
|
|
|
if !ok {
|
2015-03-16 02:42:24 +00:00
|
|
|
return
|
|
|
|
}
|
2016-05-02 23:37:47 +00:00
|
|
|
switch {
|
2016-05-20 17:03:54 +00:00
|
|
|
case req.Operation == logical.ReadOperation:
|
2016-05-02 23:37:47 +00:00
|
|
|
if resp == nil {
|
|
|
|
respondError(w, http.StatusNotFound, nil)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Basically: if we have empty "keys" or no keys at all, 404. This
|
|
|
|
// provides consistency with GET.
|
2016-09-02 05:13:14 +00:00
|
|
|
case req.Operation == logical.ListOperation && resp.WrapInfo == nil:
|
2016-05-02 23:37:47 +00:00
|
|
|
if resp == nil || len(resp.Data) == 0 {
|
|
|
|
respondError(w, http.StatusNotFound, nil)
|
|
|
|
return
|
|
|
|
}
|
2016-09-02 05:13:14 +00:00
|
|
|
keysRaw, ok := resp.Data["keys"]
|
|
|
|
if !ok || keysRaw == nil {
|
2016-05-02 23:37:47 +00:00
|
|
|
respondError(w, http.StatusNotFound, nil)
|
|
|
|
return
|
|
|
|
}
|
2016-09-02 05:13:14 +00:00
|
|
|
keys, ok := keysRaw.([]string)
|
2016-05-02 23:37:47 +00:00
|
|
|
if !ok {
|
2016-05-03 00:00:46 +00:00
|
|
|
respondError(w, http.StatusInternalServerError, nil)
|
2016-05-02 23:37:47 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
if len(keys) == 0 {
|
|
|
|
respondError(w, http.StatusNotFound, nil)
|
|
|
|
return
|
|
|
|
}
|
2015-04-01 04:24:20 +00:00
|
|
|
}
|
2015-03-16 02:34:47 +00:00
|
|
|
|
2015-04-14 00:21:31 +00:00
|
|
|
// Build the proper response
|
2016-07-26 16:20:27 +00:00
|
|
|
respondLogical(w, r, req, dataOnly, resp)
|
2015-04-14 00:21:31 +00:00
|
|
|
})
|
|
|
|
}
|
2015-03-31 04:06:15 +00:00
|
|
|
|
2016-07-26 16:20:27 +00:00
|
|
|
func respondLogical(w http.ResponseWriter, r *http.Request, req *logical.Request, dataOnly bool, resp *logical.Response) {
|
2016-08-08 15:55:24 +00:00
|
|
|
var httpResp *logical.HTTPResponse
|
|
|
|
var ret interface{}
|
|
|
|
|
2015-04-14 00:21:31 +00:00
|
|
|
if resp != nil {
|
|
|
|
if resp.Redirect != "" {
|
2015-08-20 20:20:35 +00:00
|
|
|
// If we have a redirect, redirect! We use a 307 code
|
2015-04-14 00:21:31 +00:00
|
|
|
// because we don't actually know if its permanent.
|
2015-08-20 20:20:35 +00:00
|
|
|
http.Redirect(w, r, resp.Redirect, 307)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2015-05-27 21:10:00 +00:00
|
|
|
// Check if this is a raw response
|
2016-09-29 04:01:28 +00:00
|
|
|
if _, ok := resp.Data[logical.HTTPStatusCode]; ok {
|
|
|
|
respondRaw(w, r, resp)
|
2015-05-27 21:10:00 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-05-07 23:17:51 +00:00
|
|
|
if resp.WrapInfo != nil && resp.WrapInfo.Token != "" {
|
2016-08-08 15:55:24 +00:00
|
|
|
httpResp = &logical.HTTPResponse{
|
2016-05-02 04:08:07 +00:00
|
|
|
WrapInfo: &logical.HTTPWrapInfo{
|
2016-06-13 23:58:17 +00:00
|
|
|
Token: resp.WrapInfo.Token,
|
|
|
|
TTL: int(resp.WrapInfo.TTL.Seconds()),
|
2016-09-23 16:32:07 +00:00
|
|
|
CreationTime: resp.WrapInfo.CreationTime.Format(time.RFC3339Nano),
|
2016-06-13 23:58:17 +00:00
|
|
|
WrappedAccessor: resp.WrapInfo.WrappedAccessor,
|
2016-05-02 04:08:07 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
} else {
|
2016-09-29 19:03:47 +00:00
|
|
|
httpResp = logical.LogicalResponseToHTTPResponse(resp)
|
2016-08-08 15:55:24 +00:00
|
|
|
httpResp.RequestID = req.ID
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = httpResp
|
|
|
|
|
|
|
|
if dataOnly {
|
|
|
|
injector := logical.HTTPSysInjector{
|
|
|
|
Response: httpResp,
|
|
|
|
}
|
|
|
|
ret = injector
|
2016-05-02 04:08:07 +00:00
|
|
|
}
|
2015-04-14 00:21:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Respond
|
2016-08-08 15:55:24 +00:00
|
|
|
respondOk(w, ret)
|
2016-05-20 15:49:48 +00:00
|
|
|
return
|
2015-03-16 02:34:47 +00:00
|
|
|
}
|
|
|
|
|
2015-05-27 21:10:00 +00:00
|
|
|
// respondRaw is used when the response is using HTTPContentType and HTTPRawBody
|
|
|
|
// to change the default response handling. This is only used for specific things like
|
|
|
|
// returning the CRL information on the PKI backends.
|
2016-09-29 04:01:28 +00:00
|
|
|
func respondRaw(w http.ResponseWriter, r *http.Request, resp *logical.Response) {
|
|
|
|
retErr := func(w http.ResponseWriter, err string) {
|
|
|
|
w.Header().Set("X-Vault-Raw-Error", err)
|
|
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
|
|
w.Write(nil)
|
|
|
|
}
|
|
|
|
|
2015-05-27 21:10:00 +00:00
|
|
|
// Ensure this is never a secret or auth response
|
|
|
|
if resp.Secret != nil || resp.Auth != nil {
|
2016-09-29 04:01:28 +00:00
|
|
|
retErr(w, "raw responses cannot contain secrets or auth")
|
2015-05-27 21:10:00 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the status code
|
|
|
|
statusRaw, ok := resp.Data[logical.HTTPStatusCode]
|
|
|
|
if !ok {
|
2016-09-29 04:01:28 +00:00
|
|
|
retErr(w, "no status code given")
|
2015-05-27 21:10:00 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
status, ok := statusRaw.(int)
|
|
|
|
if !ok {
|
2016-09-29 04:01:28 +00:00
|
|
|
retErr(w, "cannot decode status code")
|
2015-05-27 21:10:00 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-09-29 04:01:28 +00:00
|
|
|
nonEmpty := status != http.StatusNoContent
|
|
|
|
|
|
|
|
var contentType string
|
|
|
|
var body []byte
|
|
|
|
|
|
|
|
// Get the content type header; don't require it if the body is empty
|
2015-05-27 21:10:00 +00:00
|
|
|
contentTypeRaw, ok := resp.Data[logical.HTTPContentType]
|
2016-09-29 04:01:28 +00:00
|
|
|
if !ok && !nonEmpty {
|
|
|
|
retErr(w, "no content type given")
|
2015-05-27 21:10:00 +00:00
|
|
|
return
|
|
|
|
}
|
2016-09-29 04:01:28 +00:00
|
|
|
if ok {
|
|
|
|
contentType, ok = contentTypeRaw.(string)
|
|
|
|
if !ok {
|
|
|
|
retErr(w, "cannot decode content type")
|
|
|
|
return
|
|
|
|
}
|
2015-05-27 21:10:00 +00:00
|
|
|
}
|
|
|
|
|
2016-09-29 04:01:28 +00:00
|
|
|
if nonEmpty {
|
|
|
|
// Get the body
|
|
|
|
bodyRaw, ok := resp.Data[logical.HTTPRawBody]
|
|
|
|
if !ok {
|
|
|
|
retErr(w, "no body given")
|
|
|
|
return
|
|
|
|
}
|
|
|
|
body, ok = bodyRaw.([]byte)
|
|
|
|
if !ok {
|
|
|
|
retErr(w, "cannot decode body")
|
|
|
|
return
|
|
|
|
}
|
2015-05-27 21:10:00 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Write the response
|
2016-09-29 04:01:28 +00:00
|
|
|
if contentType != "" {
|
|
|
|
w.Header().Set("Content-Type", contentType)
|
|
|
|
}
|
2016-12-15 22:53:07 +00:00
|
|
|
|
2015-05-27 21:10:00 +00:00
|
|
|
w.WriteHeader(status)
|
|
|
|
w.Write(body)
|
|
|
|
}
|
|
|
|
|
2015-06-29 22:27:28 +00:00
|
|
|
// getConnection is used to format the connection information for
|
|
|
|
// attaching to a logical request
|
2015-06-19 00:17:18 +00:00
|
|
|
func getConnection(r *http.Request) (connection *logical.Connection) {
|
|
|
|
var remoteAddr string
|
|
|
|
|
|
|
|
remoteAddr, _, err := net.SplitHostPort(r.RemoteAddr)
|
|
|
|
if err != nil {
|
|
|
|
remoteAddr = ""
|
|
|
|
}
|
|
|
|
|
|
|
|
connection = &logical.Connection{
|
|
|
|
RemoteAddr: remoteAddr,
|
|
|
|
ConnState: r.TLS,
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|