open-vault/helper/pluginutil/runner.go

131 lines
3.7 KiB
Go
Raw Normal View History

2017-04-04 00:52:29 +00:00
package pluginutil
import (
"crypto/sha256"
"flag"
2017-04-04 00:52:29 +00:00
"fmt"
"os/exec"
2017-04-11 00:12:52 +00:00
"time"
2017-04-04 00:52:29 +00:00
plugin "github.com/hashicorp/go-plugin"
"github.com/hashicorp/vault/api"
"github.com/hashicorp/vault/helper/wrapping"
2017-04-04 00:52:29 +00:00
)
2017-04-13 00:35:53 +00:00
// Looker defines the plugin Lookup function that looks into the plugin catalog
// for availible plugins and returns a PluginRunner
2017-04-04 00:52:29 +00:00
type Looker interface {
LookupPlugin(string) (*PluginRunner, error)
}
2017-04-13 00:35:53 +00:00
// Wrapper interface defines the functions needed by the runner to wrap the
// metadata needed to run a plugin process. This includes looking up Mlock
// configuration and wrapping data in a respose wrapped token.
type RunnerUtil interface {
ResponseWrapData(data map[string]interface{}, ttl time.Duration, jwt bool) (*wrapping.ResponseWrapInfo, error)
2017-04-24 19:21:49 +00:00
MlockEnabled() bool
2017-04-11 00:12:52 +00:00
}
2017-04-13 00:35:53 +00:00
// LookWrapper defines the functions for both Looker and Wrapper
type LookRunnerUtil interface {
2017-04-06 19:20:10 +00:00
Looker
RunnerUtil
2017-04-06 19:20:10 +00:00
}
2017-04-13 00:35:53 +00:00
// PluginRunner defines the metadata needed to run a plugin securely with
// go-plugin.
2017-04-04 00:52:29 +00:00
type PluginRunner struct {
Name string `json:"name"`
Command string `json:"command"`
Args []string `json:"args"`
Sha256 []byte `json:"sha256"`
Builtin bool `json:"builtin"`
BuiltinFactory func() (interface{}, error) `json:"-"`
2017-04-04 00:52:29 +00:00
}
2017-04-13 00:35:53 +00:00
// Run takes a wrapper instance, and the go-plugin paramaters and executes a
// plugin.
func (r *PluginRunner) Run(wrapper RunnerUtil, pluginMap map[string]plugin.Plugin, hs plugin.HandshakeConfig, env []string) (*plugin.Client, error) {
2017-04-04 00:52:29 +00:00
// Get a CA TLS Certificate
certBytes, key, err := GenerateCert()
2017-04-04 00:52:29 +00:00
if err != nil {
return nil, err
}
// Use CA to sign a client cert and return a configured TLS config
clientTLSConfig, err := CreateClientTLSConfig(certBytes, key)
2017-04-04 00:52:29 +00:00
if err != nil {
return nil, err
}
// Use CA to sign a server cert and wrap the values in a response wrapped
// token.
wrapToken, err := WrapServerConfig(wrapper, certBytes, key)
2017-04-04 00:52:29 +00:00
if err != nil {
return nil, err
}
cmd := exec.Command(r.Command, r.Args...)
cmd.Env = append(cmd.Env, env...)
2017-04-11 00:12:52 +00:00
// Add the response wrap token to the ENV of the plugin
2017-04-04 00:52:29 +00:00
cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", PluginUnwrapTokenEnv, wrapToken))
2017-04-11 00:12:52 +00:00
// Add the mlock setting to the ENV of the plugin
2017-04-24 19:21:49 +00:00
if wrapper.MlockEnabled() {
cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", PluginMlockEnabled, "true"))
}
2017-04-04 00:52:29 +00:00
secureConfig := &plugin.SecureConfig{
Checksum: r.Sha256,
Hash: sha256.New(),
}
client := plugin.NewClient(&plugin.ClientConfig{
HandshakeConfig: hs,
Plugins: pluginMap,
Cmd: cmd,
TLSConfig: clientTLSConfig,
SecureConfig: secureConfig,
})
return client, nil
}
type APIClientMeta struct {
// These are set by the command line flags.
flagCACert string
flagCAPath string
flagClientCert string
flagClientKey string
flagInsecure bool
}
func (f *APIClientMeta) FlagSet() *flag.FlagSet {
fs := flag.NewFlagSet("tls settings", flag.ContinueOnError)
fs.StringVar(&f.flagCACert, "ca-cert", "", "")
fs.StringVar(&f.flagCAPath, "ca-path", "", "")
fs.StringVar(&f.flagClientCert, "client-cert", "", "")
fs.StringVar(&f.flagClientKey, "client-key", "", "")
fs.BoolVar(&f.flagInsecure, "tls-skip-verify", false, "")
return fs
}
func (f *APIClientMeta) GetTLSConfig() *api.TLSConfig {
// If we need custom TLS configuration, then set it
if f.flagCACert != "" || f.flagCAPath != "" || f.flagClientCert != "" || f.flagClientKey != "" || f.flagInsecure {
t := &api.TLSConfig{
CACert: f.flagCACert,
CAPath: f.flagCAPath,
ClientCert: f.flagClientCert,
ClientKey: f.flagClientKey,
TLSServerName: "",
Insecure: f.flagInsecure,
}
return t
}
return nil
}