luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Pull out setting the root token ID; use the new ParseUUID method in 

go-uuid instead, and revoke if there is an error.
This commit is contained in:
Jeff Mitchell 2016-01-19 19:44:33 -05:00
parent 7a59af7d18
commit b2bde47b01
7 changed files with 60 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Godeps/Godeps.json generated
View File

@ -188,7 +188,7 @@
},
{
"ImportPath": "github.com/hashicorp/go-uuid",
"Rev": "132dbc4ad1e0f75b30c3785f667fedbc55b3b198"
"Rev": "36289988d83ca270bc07c234c36f364b0dd9c9a7"
},
{
"ImportPath": "github.com/hashicorp/golang-lru",

28
Godeps/_workspace/src/github.com/hashicorp/go-uuid/uuid.go generated vendored
View File

@ -2,6 +2,7 @@ package uuid
import (
"crypto/rand"
"encoding/hex"
"fmt"
)
@ -27,3 +28,30 @@ func FormatUUID(buf []byte) (string, error) {
buf[8:10],
buf[10:16]), nil
}
func ParseUUID(uuid string) ([]byte, error) {
if len(uuid) != 36 {
return nil, fmt.Errorf("uuid string is wrong length")
}
hyph := []byte("-")
if uuid[8] != hyph[0] ||
uuid[13] != hyph[0] ||
uuid[18] != hyph[0] ||
uuid[23] != hyph[0] {
return nil, fmt.Errorf("uuid is improperly formatted")
}
hexStr := uuid[0:8] + uuid[9:13] + uuid[14:18] + uuid[19:23] + uuid[24:36]
ret, err := hex.DecodeString(hexStr)
if err != nil {
return nil, err
}
if len(ret) != 16 {
return nil, fmt.Errorf("decoded hex is the wrong length")
}
return ret, nil
}

2
vault/core.go
View File

@ -915,7 +915,7 @@ func (c *Core) Initialize(config *SealConfig) (*InitResult, error) {
}
// Generate a new root token
rootToken, err := c.tokenStore.rootToken("")
rootToken, err := c.tokenStore.rootToken()
if err != nil {
c.logger.Printf("[ERR] core: root token generation failed: %v", err)
return nil, err

10
vault/expiration_test.go
View File

@ -121,7 +121,7 @@ func TestExpiration_Register(t *testing.T) {
func TestExpiration_RegisterAuth(t *testing.T) {
exp := mockExpiration(t)
root, err := exp.tokenStore.rootToken("")
root, err := exp.tokenStore.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}
@ -141,7 +141,7 @@ func TestExpiration_RegisterAuth(t *testing.T) {
func TestExpiration_RegisterAuth_NoLease(t *testing.T) {
exp := mockExpiration(t)
root, err := exp.tokenStore.rootToken("")
root, err := exp.tokenStore.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}
@ -400,7 +400,7 @@ func TestExpiration_RevokeByToken(t *testing.T) {
func TestExpiration_RenewToken(t *testing.T) {
exp := mockExpiration(t)
root, err := exp.tokenStore.rootToken("")
root, err := exp.tokenStore.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}
@ -431,7 +431,7 @@ func TestExpiration_RenewToken(t *testing.T) {
func TestExpiration_RenewToken_NotRenewable(t *testing.T) {
exp := mockExpiration(t)
root, err := exp.tokenStore.rootToken("")
root, err := exp.tokenStore.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}
@ -688,7 +688,7 @@ func TestExpiration_revokeEntry(t *testing.T) {
func TestExpiration_revokeEntry_token(t *testing.T) {
exp := mockExpiration(t)
root, err := exp.tokenStore.rootToken("")
root, err := exp.tokenStore.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}

35
vault/generate_root.go
View File

@ -2,7 +2,6 @@ package vault
import (
"bytes"
"crypto/rand"
"encoding/base64"
"fmt"
@ -220,18 +219,27 @@ func (c *Core) GenerateRootUpdate(key []byte, nonce string) (*GenerateRootResult
return nil, err
}
// Generate the raw token bytes
buf := make([]byte, 16)
if _, err := rand.Read(buf); err != nil {
c.logger.Printf("failed to read random bytes: %v", err)
te, err := c.tokenStore.rootToken()
if err != nil {
c.logger.Printf("[ERR] core: root token generation failed: %v", err)
return nil, err
}
if te == nil {
c.logger.Printf("[ERR] core: got nil token entry back from root generation")
return nil, fmt.Errorf("got nil token entry back from root generation")
}
uuidStr, err := uuid.FormatUUID(buf)
uuidBytes, err := uuid.ParseUUID(te.ID)
if err != nil {
c.logger.Printf("error formatting token: %v", err)
c.tokenStore.Revoke(te.ID)
c.logger.Printf("[ERR] core: error getting generated token bytes: %v", err)
return nil, err
}
if uuidBytes == nil {
c.tokenStore.Revoke(te.ID)
c.logger.Printf("[ERR] core: got nil parsed UUID bytes")
return nil, fmt.Errorf("got nil parsed UUID bytes")
}
var tokenBytes []byte
// Get the encoded value first so that if there is an error we don't create
@ -240,30 +248,27 @@ func (c *Core) GenerateRootUpdate(key []byte, nonce string) (*GenerateRootResult
case len(c.generateRootConfig.OTP) > 0:
// This function performs decoding checks so rather than decode the OTP,
// just encode the value we're passing in.
tokenBytes, err = xor.XORBase64(c.generateRootConfig.OTP, base64.StdEncoding.EncodeToString(buf))
tokenBytes, err = xor.XORBase64(c.generateRootConfig.OTP, base64.StdEncoding.EncodeToString(uuidBytes))
if err != nil {
c.tokenStore.Revoke(te.ID)
c.logger.Printf("[ERR] core: xor of root token failed: %v", err)
return nil, err
}
case len(c.generateRootConfig.PGPKey) > 0:
_, tokenBytesArr, err := pgpkeys.EncryptShares([][]byte{[]byte(uuidStr)}, []string{c.generateRootConfig.PGPKey})
_, tokenBytesArr, err := pgpkeys.EncryptShares([][]byte{[]byte(te.ID)}, []string{c.generateRootConfig.PGPKey})
if err != nil {
c.tokenStore.Revoke(te.ID)
c.logger.Printf("[ERR] core: error encrypting new root token: %v", err)
return nil, err
}
tokenBytes = tokenBytesArr[0]
default:
c.tokenStore.Revoke(te.ID)
return nil, fmt.Errorf("unreachable condition")
}
_, err = c.tokenStore.rootToken(uuidStr)
if err != nil {
c.logger.Printf("[ERR] core: root token generation failed: %v", err)
return nil, err
}
results := &GenerateRootResult{
Progress: progress,
Required: config.SecretThreshold,

3
vault/token_store.go
View File

@ -290,9 +290,8 @@ func (ts *TokenStore) SaltID(id string) string {
}
// RootToken is used to generate a new token with root privileges and no parent
func (ts *TokenStore) rootToken(id string) (*TokenEntry, error) {
func (ts *TokenStore) rootToken() (*TokenEntry, error) {
te := &TokenEntry{
ID: id,
Policies: []string{"root"},
Path: "auth/token/root",
DisplayName: "root",

8
vault/token_store_test.go
View File

@ -21,7 +21,7 @@ func getBackendConfig(c *Core) *logical.BackendConfig {
func TestTokenStore_RootToken(t *testing.T) {
_, ts, _, _ := TestCoreWithTokenStore(t)
te, err := ts.rootToken("")
te, err := ts.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}
@ -909,7 +909,7 @@ func TestTokenStore_HandleRequest_RevokePrefix(t *testing.T) {
ts := exp.tokenStore
// Create new token
root, err := ts.rootToken("")
root, err := ts.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}
@ -982,7 +982,7 @@ func TestTokenStore_HandleRequest_Renew(t *testing.T) {
ts := exp.tokenStore
// Create new token
root, err := ts.rootToken("")
root, err := ts.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}
@ -1026,7 +1026,7 @@ func TestTokenStore_HandleRequest_RenewSelf(t *testing.T) {
ts := exp.tokenStore
// Create new token
root, err := ts.rootToken("")
root, err := ts.rootToken()
if err != nil {
t.Fatalf("err: %v", err)
}