From a4593e8913e9bca88b0587d306b26aa7d7bdbdad Mon Sep 17 00:00:00 2001 From: Josh Black Date: Tue, 26 Apr 2022 09:13:45 -0700 Subject: [PATCH] When tainting a route during setup, pre-calculate the namespace specific path (#15067) --- changelog/15067.txt | 3 +++ helper/namespace/namespace.go | 5 +++++ vault/auth.go | 9 ++++++--- vault/rollback_test.go | 3 +-- vault/router.go | 14 ++++++++------ vault/router_test.go | 2 +- 6 files changed, 24 insertions(+), 12 deletions(-) create mode 100644 changelog/15067.txt diff --git a/changelog/15067.txt b/changelog/15067.txt new file mode 100644 index 000000000..4adee8fb6 --- /dev/null +++ b/changelog/15067.txt @@ -0,0 +1,3 @@ +```release-note:bug +core: pre-calculate namespace specific paths when tainting a route during postUnseal +``` diff --git a/helper/namespace/namespace.go b/helper/namespace/namespace.go index 045d2abe4..90ddadefd 100644 --- a/helper/namespace/namespace.go +++ b/helper/namespace/namespace.go @@ -3,6 +3,7 @@ package namespace import ( "context" "errors" + "fmt" "strings" "github.com/hashicorp/vault/sdk/helper/consts" @@ -15,6 +16,10 @@ type Namespace struct { Path string `json:"path"` } +func (n *Namespace) String() string { + return fmt.Sprintf("ID: %s. Path: %s", n.ID, n.Path) +} + const ( RootNamespaceID = "root" ) diff --git a/vault/auth.go b/vault/auth.go index 19d510038..ec287f2f7 100644 --- a/vault/auth.go +++ b/vault/auth.go @@ -7,7 +7,7 @@ import ( "strings" "github.com/hashicorp/go-secure-stdlib/strutil" - uuid "github.com/hashicorp/go-uuid" + "github.com/hashicorp/go-uuid" "github.com/hashicorp/vault/builtin/plugin" "github.com/hashicorp/vault/helper/namespace" "github.com/hashicorp/vault/sdk/helper/consts" @@ -825,16 +825,19 @@ func (c *Core) setupCredentials(ctx context.Context) error { path := credentialRoutePrefix + entry.Path err = c.router.Mount(backend, path, entry, view) if err != nil { - c.logger.Error("failed to mount auth entry", "path", entry.Path, "error", err) + c.logger.Error("failed to mount auth entry", "path", entry.Path, "namespace", entry.Namespace(), "error", err) return errLoadAuthFailed } if c.logger.IsInfo() { - c.logger.Info("successfully enabled credential backend", "type", entry.Type, "path", entry.Path) + c.logger.Info("successfully enabled credential backend", "type", entry.Type, "path", entry.Path, "namespace", entry.Namespace()) } // Ensure the path is tainted if set in the mount table if entry.Tainted { + // Calculate any namespace prefixes here, because when Taint() is called, there won't be + // a namespace to pull from the context. This is similar to what we do above in c.router.Mount(). + path = entry.Namespace().Path + path c.router.Taint(ctx, path) } diff --git a/vault/rollback_test.go b/vault/rollback_test.go index 4308d70e1..681101217 100644 --- a/vault/rollback_test.go +++ b/vault/rollback_test.go @@ -7,8 +7,7 @@ import ( "time" log "github.com/hashicorp/go-hclog" - uuid "github.com/hashicorp/go-uuid" - + "github.com/hashicorp/go-uuid" "github.com/hashicorp/vault/helper/namespace" "github.com/hashicorp/vault/sdk/helper/logging" ) diff --git a/vault/router.go b/vault/router.go index a75167059..1c11234eb 100644 --- a/vault/router.go +++ b/vault/router.go @@ -9,9 +9,9 @@ import ( "sync/atomic" "time" - metrics "github.com/armon/go-metrics" - radix "github.com/armon/go-radix" - hclog "github.com/hashicorp/go-hclog" + "github.com/armon/go-metrics" + "github.com/armon/go-radix" + "github.com/hashicorp/go-hclog" "github.com/hashicorp/go-secure-stdlib/strutil" "github.com/hashicorp/vault/helper/namespace" "github.com/hashicorp/vault/sdk/helper/consts" @@ -47,6 +47,8 @@ func NewRouter() *Router { storagePrefix: radix.New(), mountUUIDCache: radix.New(), mountAccessorCache: radix.New(), + // this will get replaced in production with a real logger but it's useful to have a default in place for tests + logger: hclog.NewNullLogger(), } return r } @@ -530,7 +532,7 @@ func (r *Router) routeCommon(ctx context.Context, req *logical.Request, existenc } r.l.RUnlock() if !ok { - return logical.ErrorResponse(fmt.Sprintf("no handler for route '%s'", req.Path)), false, false, logical.ErrUnsupportedPath + return logical.ErrorResponse(fmt.Sprintf("no handler for route %q. route entry not found.", req.Path)), false, false, logical.ErrUnsupportedPath } req.Path = adjustedPath defer metrics.MeasureSince([]string{ @@ -551,7 +553,7 @@ func (r *Router) routeCommon(ctx context.Context, req *logical.Request, existenc // Filtered mounts will have a nil backend if re.backend == nil { - return logical.ErrorResponse(fmt.Sprintf("no handler for route '%s'", req.Path)), false, false, logical.ErrUnsupportedPath + return logical.ErrorResponse(fmt.Sprintf("no handler for route %q. route entry found, but backend is nil.", req.Path)), false, false, logical.ErrUnsupportedPath } // If the path is tainted, we reject any operation except for @@ -560,7 +562,7 @@ func (r *Router) routeCommon(ctx context.Context, req *logical.Request, existenc switch req.Operation { case logical.RevokeOperation, logical.RollbackOperation: default: - return logical.ErrorResponse(fmt.Sprintf("no handler for route '%s'", req.Path)), false, false, logical.ErrUnsupportedPath + return logical.ErrorResponse(fmt.Sprintf("no handler for route %q. route entry is tainted.", req.Path)), false, false, logical.ErrUnsupportedPath } } diff --git a/vault/router_test.go b/vault/router_test.go index b7ade5ca2..2a2340a51 100644 --- a/vault/router_test.go +++ b/vault/router_test.go @@ -5,7 +5,7 @@ import ( "strings" "testing" - uuid "github.com/hashicorp/go-uuid" + "github.com/hashicorp/go-uuid" "github.com/hashicorp/vault/helper/namespace" "github.com/hashicorp/vault/sdk/logical" )