open-vault/vault/acme_billing_system_view.go

144 lines
4.7 KiB
Go

// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0
package vault
import (
"context"
"crypto/sha256"
"encoding/base64"
"fmt"
"sort"
"strings"
"time"
"github.com/hashicorp/vault/sdk/logical"
"github.com/hashicorp/go-kms-wrapping/entropy/v2"
)
// See comment in command/format.go
const hopeDelim = "♨"
// Modifying this constant will result in previous activities not being
// associated with future activities of this same type. A storage
// migration would need to occur to fix this.
//
// Suggested naming precedence: <plugin name>-<client type>. Since this
// comes from the builtin PKI plugin, and we're counting ACME certificates,
// this becomes pki-acme.
const ACMEActivityType = "pki-acme"
// acmeBillingImpl is the (single) implementation of the actual client
// counting interface. It needs a reference to core (as per discussions
// with Mike, in the future the activityLog reference will no longer be
// static but may be replaced throughout the lifecycle of a core instance)
// and a reference to the mount that is being counted.
type acmeBillingImpl struct {
core *Core
entry *MountEntry
}
var _ logical.ACMEBillingSystemView = (*acmeBillingImpl)(nil)
// Due to unfortunate layering of system view interfaces, there are three
// possible sets of interfaces we need to layer with this ACME interface:
//
// 1. Everything: a managed key system view, an entropy sourcer, and an
// extended system view.
// 2. Managed keys without an entropy sourcer.
// 3. Just extended system view.
//
// Unfortunately, just using acmeBillingSystemViewImpl is not sufficient:
// because of the embedded interfaces, even when these are nil, the
// implementation will claim to support these interfaces, (thus, their cast
// being accepted by the toolchain), but when the caller goes to use the new
// value, they are hit with a nil panic.
//
// This is unfortunate.
//
// To avoid this, we create three possible implementations and use the lowest
// common denominator of the caller of NewAcmeBillingSystemView(...) to assume
// it is _just_ an extendedSystemView implementation.
// Scenario 1 above.
type acmeBillingSystemViewImpl struct {
extendedSystemView
logical.ManagedKeySystemView
entropy.Sourcer
acmeBillingImpl
}
var (
_ logical.ACMEBillingSystemView = (*acmeBillingSystemViewImpl)(nil)
_ extendedSystemView = (*acmeBillingSystemViewImpl)(nil)
_ logical.ManagedKeySystemView = (*acmeBillingSystemViewImpl)(nil)
_ entropy.Sourcer = (*acmeBillingSystemViewImpl)(nil)
)
// Scenario 2 above.
type acmeBillingSystemViewImplNoSourcer struct {
extendedSystemView
logical.ManagedKeySystemView
acmeBillingImpl
}
var (
_ logical.ACMEBillingSystemView = (*acmeBillingSystemViewImplNoSourcer)(nil)
_ extendedSystemView = (*acmeBillingSystemViewImplNoSourcer)(nil)
_ logical.ManagedKeySystemView = (*acmeBillingSystemViewImplNoSourcer)(nil)
)
// Scenario 3 above.
type acmeBillingSystemViewImplNoManagedKeys struct {
extendedSystemView
acmeBillingImpl
}
var (
_ logical.ACMEBillingSystemView = (*acmeBillingSystemViewImplNoManagedKeys)(nil)
_ extendedSystemView = (*acmeBillingSystemViewImplNoManagedKeys)(nil)
)
// NewAcmeBillingSystemView creates the appropriate implementation based on
// the passed arguments, mapping them to the above scenarios. We further
// restrict sysView to have a dynamicSystemView implementation, to get the
// mount entry out of.
func (c *Core) NewAcmeBillingSystemView(sysView interface{}) extendedSystemView {
es := sysView.(extendedSystemViewImpl)
des := es.dynamicSystemView
// Scenario 3.
return &acmeBillingSystemViewImplNoManagedKeys{
extendedSystemView: es,
acmeBillingImpl: acmeBillingImpl{
core: c,
entry: des.mountEntry,
},
}
}
func (a *acmeBillingImpl) CreateActivityCountEventForIdentifiers(ctx context.Context, identifiers []string) error {
// Fake our clientID from the identifiers, but ensure it is
// independent of ordering.
//
// TODO: Because of prefixing currently handled by AddActivityToFragment,
// we do not need to ensure it is globally unique.
sort.Strings(identifiers)
joinedIdentifiers := "[" + strings.Join(identifiers, "]"+hopeDelim+"[") + "]"
identifiersHash := sha256.Sum256([]byte(joinedIdentifiers))
clientID := base64.RawURLEncoding.EncodeToString(identifiersHash[:])
// Log so users can correlate ACME requests to client count tokens.
a.core.activityLogLock.RLock()
activityLog := a.core.activityLog
a.core.activityLogLock.RUnlock()
if activityLog == nil {
return nil
}
activityLog.logger.Debug(fmt.Sprintf("Handling ACME client count event for [%v] -> %v", identifiers, clientID))
activityLog.AddActivityToFragment(clientID, a.entry.NamespaceID, time.Now().Unix(), ACMEActivityType, a.entry.Accessor)
return nil
}