1001 lines
32 KiB
Go
1001 lines
32 KiB
Go
package vault
|
|
|
|
import (
|
|
"context"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"path"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
|
|
log "github.com/hashicorp/go-hclog"
|
|
"github.com/hashicorp/go-multierror"
|
|
"github.com/hashicorp/go-plugin"
|
|
"github.com/hashicorp/go-secure-stdlib/base62"
|
|
semver "github.com/hashicorp/go-version"
|
|
"github.com/hashicorp/vault/helper/versions"
|
|
v4 "github.com/hashicorp/vault/sdk/database/dbplugin"
|
|
v5 "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
|
"github.com/hashicorp/vault/sdk/helper/jsonutil"
|
|
"github.com/hashicorp/vault/sdk/helper/pluginutil"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
backendplugin "github.com/hashicorp/vault/sdk/plugin"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/metadata"
|
|
)
|
|
|
|
var (
|
|
pluginCatalogPath = "core/plugin-catalog/"
|
|
ErrDirectoryNotConfigured = errors.New("could not set plugin, plugin directory is not configured")
|
|
ErrPluginNotFound = errors.New("plugin not found in the catalog")
|
|
ErrPluginConnectionNotFound = errors.New("plugin connection not found for client")
|
|
ErrPluginBadType = errors.New("unable to determine plugin type")
|
|
)
|
|
|
|
// PluginCatalog keeps a record of plugins known to vault. External plugins need
|
|
// to be registered to the catalog before they can be used in backends. Builtin
|
|
// plugins are automatically detected and included in the catalog.
|
|
type PluginCatalog struct {
|
|
builtinRegistry BuiltinRegistry
|
|
catalogView *BarrierView
|
|
directory string
|
|
logger log.Logger
|
|
|
|
// externalPlugins holds plugin process connections by plugin name
|
|
//
|
|
// This allows plugins that suppport multiplexing to use a single grpc
|
|
// connection to communicate with multiple "backends". Each backend
|
|
// configuration using the same plugin will be routed to the existing
|
|
// plugin process.
|
|
externalPlugins map[string]*externalPlugin
|
|
mlockPlugins bool
|
|
|
|
lock sync.RWMutex
|
|
}
|
|
|
|
// externalPlugin holds client connections for multiplexed and
|
|
// non-multiplexed plugin processes
|
|
type externalPlugin struct {
|
|
// name is the plugin name
|
|
name string
|
|
|
|
// connections holds client connections by ID
|
|
connections map[string]*pluginClient
|
|
|
|
multiplexingSupport bool
|
|
}
|
|
|
|
// pluginClient represents a connection to a plugin process
|
|
type pluginClient struct {
|
|
logger log.Logger
|
|
|
|
// id is the connection ID
|
|
id string
|
|
pid int
|
|
|
|
// client handles the lifecycle of a plugin process
|
|
// multiplexed plugins share the same client
|
|
client *plugin.Client
|
|
clientConn grpc.ClientConnInterface
|
|
cleanupFunc func() error
|
|
reloadFunc func() error
|
|
|
|
plugin.ClientProtocol
|
|
}
|
|
|
|
func wrapFactoryCheckPerms(core *Core, f logical.Factory) logical.Factory {
|
|
return func(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
|
|
if err := core.CheckPluginPerms(conf.Config["plugin_name"]); err != nil {
|
|
return nil, err
|
|
}
|
|
return f(ctx, conf)
|
|
}
|
|
}
|
|
|
|
func (c *Core) setupPluginCatalog(ctx context.Context) error {
|
|
c.pluginCatalog = &PluginCatalog{
|
|
builtinRegistry: c.builtinRegistry,
|
|
catalogView: NewBarrierView(c.barrier, pluginCatalogPath),
|
|
directory: c.pluginDirectory,
|
|
logger: c.logger,
|
|
mlockPlugins: c.enableMlock,
|
|
}
|
|
|
|
// Run upgrade if untyped plugins exist
|
|
err := c.pluginCatalog.UpgradePlugins(ctx, c.logger)
|
|
if err != nil {
|
|
c.logger.Error("error while upgrading plugin storage", "error", err)
|
|
return err
|
|
}
|
|
|
|
if c.logger.IsInfo() {
|
|
c.logger.Info("successfully setup plugin catalog", "plugin-directory", c.pluginDirectory)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
type pluginClientConn struct {
|
|
*grpc.ClientConn
|
|
id string
|
|
}
|
|
|
|
var _ grpc.ClientConnInterface = &pluginClientConn{}
|
|
|
|
func (d *pluginClientConn) Invoke(ctx context.Context, method string, args interface{}, reply interface{}, opts ...grpc.CallOption) error {
|
|
// Inject ID to the context
|
|
md := metadata.Pairs(pluginutil.MultiplexingCtxKey, d.id)
|
|
idCtx := metadata.NewOutgoingContext(ctx, md)
|
|
|
|
return d.ClientConn.Invoke(idCtx, method, args, reply, opts...)
|
|
}
|
|
|
|
func (d *pluginClientConn) NewStream(ctx context.Context, desc *grpc.StreamDesc, method string, opts ...grpc.CallOption) (grpc.ClientStream, error) {
|
|
// Inject ID to the context
|
|
md := metadata.Pairs(pluginutil.MultiplexingCtxKey, d.id)
|
|
idCtx := metadata.NewOutgoingContext(ctx, md)
|
|
|
|
return d.ClientConn.NewStream(idCtx, desc, method, opts...)
|
|
}
|
|
|
|
func (p *pluginClient) Conn() grpc.ClientConnInterface {
|
|
return p.clientConn
|
|
}
|
|
|
|
func (p *pluginClient) Reload() error {
|
|
p.logger.Debug("reload external plugin process")
|
|
return p.reloadFunc()
|
|
}
|
|
|
|
// reloadExternalPlugin
|
|
// This should be called with the write lock held.
|
|
func (c *PluginCatalog) reloadExternalPlugin(name, id string) error {
|
|
extPlugin, ok := c.externalPlugins[name]
|
|
if !ok {
|
|
return fmt.Errorf("plugin client not found")
|
|
}
|
|
if !extPlugin.multiplexingSupport {
|
|
err := c.cleanupExternalPlugin(name, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
pc, ok := extPlugin.connections[id]
|
|
if !ok {
|
|
return fmt.Errorf("%w id: %s", ErrPluginConnectionNotFound, id)
|
|
}
|
|
|
|
delete(c.externalPlugins, name)
|
|
pc.client.Kill()
|
|
c.logger.Debug("killed external plugin process for reload", "name", name, "pid", pc.pid)
|
|
|
|
return nil
|
|
}
|
|
|
|
// Close calls the plugin client's cleanupFunc to do any necessary cleanup on
|
|
// the plugin client and the PluginCatalog. This implements the
|
|
// plugin.ClientProtocol interface.
|
|
func (p *pluginClient) Close() error {
|
|
p.logger.Debug("cleaning up plugin client connection", "id", p.id)
|
|
return p.cleanupFunc()
|
|
}
|
|
|
|
// cleanupExternalPlugin will kill plugin processes and perform any necessary
|
|
// cleanup on the externalPlugins map for multiplexed and non-multiplexed
|
|
// plugins. This should be called with the write lock held.
|
|
func (c *PluginCatalog) cleanupExternalPlugin(name, id string) error {
|
|
extPlugin, ok := c.externalPlugins[name]
|
|
if !ok {
|
|
return fmt.Errorf("plugin client not found")
|
|
}
|
|
|
|
pc, ok := extPlugin.connections[id]
|
|
if !ok {
|
|
// this can happen if the backend is reloaded due to a plugin process
|
|
// being killed out of band
|
|
c.logger.Warn(ErrPluginConnectionNotFound.Error(), "id", id)
|
|
return fmt.Errorf("%w id: %s", ErrPluginConnectionNotFound, id)
|
|
}
|
|
|
|
delete(extPlugin.connections, id)
|
|
c.logger.Debug("removed plugin client connection", "id", id)
|
|
|
|
if !extPlugin.multiplexingSupport {
|
|
pc.client.Kill()
|
|
|
|
if len(extPlugin.connections) == 0 {
|
|
delete(c.externalPlugins, name)
|
|
}
|
|
c.logger.Debug("killed external plugin process", "name", name, "pid", pc.pid)
|
|
} else if len(extPlugin.connections) == 0 || pc.client.Exited() {
|
|
pc.client.Kill()
|
|
delete(c.externalPlugins, name)
|
|
c.logger.Debug("killed external multiplexed plugin process", "name", name, "pid", pc.pid)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (c *PluginCatalog) getExternalPlugin(pluginName string) *externalPlugin {
|
|
if extPlugin, ok := c.externalPlugins[pluginName]; ok {
|
|
return extPlugin
|
|
}
|
|
|
|
return c.newExternalPlugin(pluginName)
|
|
}
|
|
|
|
func (c *PluginCatalog) newExternalPlugin(pluginName string) *externalPlugin {
|
|
if c.externalPlugins == nil {
|
|
c.externalPlugins = make(map[string]*externalPlugin)
|
|
}
|
|
|
|
extPlugin := &externalPlugin{
|
|
connections: make(map[string]*pluginClient),
|
|
name: pluginName,
|
|
}
|
|
|
|
c.externalPlugins[pluginName] = extPlugin
|
|
return extPlugin
|
|
}
|
|
|
|
// NewPluginClient returns a client for managing the lifecycle of a plugin
|
|
// process
|
|
func (c *PluginCatalog) NewPluginClient(ctx context.Context, config pluginutil.PluginClientConfig) (*pluginClient, error) {
|
|
c.lock.Lock()
|
|
defer c.lock.Unlock()
|
|
|
|
if config.Name == "" {
|
|
return nil, fmt.Errorf("no name provided for plugin")
|
|
}
|
|
if config.PluginType == consts.PluginTypeUnknown {
|
|
return nil, fmt.Errorf("no plugin type provided")
|
|
}
|
|
|
|
pluginRunner, err := c.get(ctx, config.Name, config.PluginType, config.Version)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to lookup plugin: %w", err)
|
|
}
|
|
if pluginRunner == nil {
|
|
return nil, fmt.Errorf("no plugin found")
|
|
}
|
|
pc, err := c.newPluginClient(ctx, pluginRunner, config)
|
|
return pc, err
|
|
}
|
|
|
|
// newPluginClient returns a client for managing the lifecycle of a plugin
|
|
// process. Callers should have the write lock held.
|
|
func (c *PluginCatalog) newPluginClient(ctx context.Context, pluginRunner *pluginutil.PluginRunner, config pluginutil.PluginClientConfig) (*pluginClient, error) {
|
|
if pluginRunner == nil {
|
|
return nil, fmt.Errorf("no plugin found")
|
|
}
|
|
|
|
extPlugin := c.getExternalPlugin(pluginRunner.Name)
|
|
id, err := base62.Random(10)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
pc := &pluginClient{
|
|
id: id,
|
|
logger: c.logger.Named(pluginRunner.Name),
|
|
cleanupFunc: func() error {
|
|
c.lock.Lock()
|
|
defer c.lock.Unlock()
|
|
return c.cleanupExternalPlugin(pluginRunner.Name, id)
|
|
},
|
|
reloadFunc: func() error {
|
|
c.lock.Lock()
|
|
defer c.lock.Unlock()
|
|
return c.reloadExternalPlugin(pluginRunner.Name, id)
|
|
},
|
|
}
|
|
|
|
// Multiplexing support will always be false initially, but will be
|
|
// adjusted once we query from the plugin whether it can multiplex or not
|
|
if !extPlugin.multiplexingSupport || len(extPlugin.connections) == 0 {
|
|
c.logger.Debug("spawning a new plugin process", "plugin_name", pluginRunner.Name, "id", id)
|
|
client, err := pluginRunner.RunConfig(ctx,
|
|
pluginutil.PluginSets(config.PluginSets),
|
|
pluginutil.HandshakeConfig(config.HandshakeConfig),
|
|
pluginutil.Logger(config.Logger),
|
|
pluginutil.MetadataMode(config.IsMetadataMode),
|
|
pluginutil.MLock(c.mlockPlugins),
|
|
pluginutil.AutoMTLS(config.AutoMTLS),
|
|
pluginutil.Runner(config.Wrapper),
|
|
)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
pc.client = client
|
|
} else {
|
|
c.logger.Debug("returning existing plugin client for multiplexed plugin", "id", id)
|
|
|
|
// get the first client, since they are all the same
|
|
for k := range extPlugin.connections {
|
|
pc.client = extPlugin.connections[k].client
|
|
break
|
|
}
|
|
|
|
if pc.client == nil {
|
|
return nil, fmt.Errorf("plugin client is nil")
|
|
}
|
|
}
|
|
|
|
// Get the protocol client for this connection.
|
|
// Subsequent calls to this will return the same client.
|
|
rpcClient, err := pc.client.Client()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// get the external plugin pid
|
|
conf := pc.client.ReattachConfig()
|
|
if conf != nil {
|
|
pc.pid = conf.Pid
|
|
}
|
|
|
|
clientConn := rpcClient.(*plugin.GRPCClient).Conn
|
|
|
|
muxed, err := pluginutil.MultiplexingSupported(ctx, clientConn, config.Name)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
pc.clientConn = &pluginClientConn{
|
|
ClientConn: clientConn,
|
|
id: id,
|
|
}
|
|
|
|
pc.ClientProtocol = rpcClient
|
|
|
|
extPlugin.connections[id] = pc
|
|
extPlugin.name = pluginRunner.Name
|
|
extPlugin.multiplexingSupport = muxed
|
|
|
|
return extPlugin.connections[id], nil
|
|
}
|
|
|
|
// getPluginTypeFromUnknown will attempt to run the plugin to determine the
|
|
// type. It will first attempt to run as a database plugin then a backend
|
|
// plugin.
|
|
func (c *PluginCatalog) getPluginTypeFromUnknown(ctx context.Context, plugin *pluginutil.PluginRunner) (consts.PluginType, error) {
|
|
merr := &multierror.Error{}
|
|
err := c.isDatabasePlugin(ctx, plugin)
|
|
if err == nil {
|
|
return consts.PluginTypeDatabase, nil
|
|
}
|
|
merr = multierror.Append(merr, err)
|
|
|
|
pluginType, err := c.getBackendPluginType(ctx, plugin)
|
|
if err == nil {
|
|
return pluginType, nil
|
|
}
|
|
merr = multierror.Append(merr, err)
|
|
|
|
return consts.PluginTypeUnknown, merr
|
|
}
|
|
|
|
// getBackendPluginType returns an error if the plugin is not a backend plugin.
|
|
func (c *PluginCatalog) getBackendPluginType(ctx context.Context, pluginRunner *pluginutil.PluginRunner) (consts.PluginType, error) {
|
|
merr := &multierror.Error{}
|
|
// Attempt to run as backend plugin
|
|
config := pluginutil.PluginClientConfig{
|
|
Name: pluginRunner.Name,
|
|
PluginSets: backendplugin.PluginSet,
|
|
HandshakeConfig: backendplugin.HandshakeConfig,
|
|
Logger: log.NewNullLogger(),
|
|
IsMetadataMode: false,
|
|
AutoMTLS: true,
|
|
}
|
|
|
|
var client logical.Backend
|
|
var attemptV4 bool
|
|
// First, attempt to run as backend V5 plugin
|
|
c.logger.Debug("attempting to load backend plugin", "name", pluginRunner.Name)
|
|
pc, err := c.newPluginClient(ctx, pluginRunner, config)
|
|
if err == nil {
|
|
// we spawned a subprocess, so make sure to clean it up
|
|
defer c.cleanupExternalPlugin(pluginRunner.Name, pc.id)
|
|
|
|
// dispense the plugin so we can get its type
|
|
client, err = backendplugin.Dispense(pc.ClientProtocol, pc)
|
|
if err != nil {
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to dispense plugin as backend v5: %w", err))
|
|
c.logger.Debug("failed to dispense v5 backend plugin", "name", pluginRunner.Name)
|
|
attemptV4 = true
|
|
} else {
|
|
c.logger.Debug("successfully dispensed v5 backend plugin", "name", pluginRunner.Name)
|
|
}
|
|
} else {
|
|
attemptV4 = true
|
|
}
|
|
|
|
if attemptV4 {
|
|
c.logger.Debug("failed to dispense v5 backend plugin", "name", pluginRunner.Name)
|
|
config.AutoMTLS = false
|
|
config.IsMetadataMode = true
|
|
// attempt to run as a v4 backend plugin
|
|
client, err = backendplugin.NewPluginClient(ctx, nil, pluginRunner, log.NewNullLogger(), true)
|
|
if err != nil {
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to dispense v4 backend plugin: %w", err))
|
|
c.logger.Debug("failed to dispense v4 backend plugin", "name", pluginRunner.Name, "error", merr)
|
|
return consts.PluginTypeUnknown, merr.ErrorOrNil()
|
|
}
|
|
c.logger.Debug("successfully dispensed v4 backend plugin", "name", pluginRunner.Name)
|
|
defer client.Cleanup(ctx)
|
|
}
|
|
|
|
err = client.Setup(ctx, &logical.BackendConfig{})
|
|
if err != nil {
|
|
return consts.PluginTypeUnknown, err
|
|
}
|
|
backendType := client.Type()
|
|
|
|
switch backendType {
|
|
case logical.TypeCredential:
|
|
return consts.PluginTypeCredential, nil
|
|
case logical.TypeLogical:
|
|
return consts.PluginTypeSecrets, nil
|
|
}
|
|
|
|
if client == nil || client.Type() == logical.TypeUnknown {
|
|
c.logger.Warn("unknown plugin type",
|
|
"plugin name", pluginRunner.Name,
|
|
"error", merr.Error())
|
|
} else {
|
|
c.logger.Warn("unsupported plugin type",
|
|
"plugin name", pluginRunner.Name,
|
|
"plugin type", client.Type().String(),
|
|
"error", merr.Error())
|
|
}
|
|
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to load plugin as backend plugin: %w", err))
|
|
|
|
return consts.PluginTypeUnknown, merr.ErrorOrNil()
|
|
}
|
|
|
|
// getBackendRunningVersion attempts to get the plugin version
|
|
func (c *PluginCatalog) getBackendRunningVersion(ctx context.Context, pluginRunner *pluginutil.PluginRunner) (logical.PluginVersion, error) {
|
|
merr := &multierror.Error{}
|
|
// Attempt to run as backend plugin
|
|
config := pluginutil.PluginClientConfig{
|
|
Name: pluginRunner.Name,
|
|
PluginSets: backendplugin.PluginSet,
|
|
HandshakeConfig: backendplugin.HandshakeConfig,
|
|
Logger: log.NewNullLogger(),
|
|
IsMetadataMode: false,
|
|
AutoMTLS: true,
|
|
}
|
|
|
|
var client logical.Backend
|
|
// First, attempt to run as backend V5 plugin
|
|
c.logger.Debug("attempting to load backend plugin", "name", pluginRunner.Name)
|
|
pc, err := c.newPluginClient(ctx, pluginRunner, config)
|
|
if err == nil {
|
|
// we spawned a subprocess, so make sure to clean it up
|
|
defer c.cleanupExternalPlugin(pluginRunner.Name, pc.id)
|
|
|
|
// dispense the plugin so we can get its version
|
|
client, err = backendplugin.Dispense(pc.ClientProtocol, pc)
|
|
if err == nil {
|
|
c.logger.Debug("successfully dispensed v5 backend plugin", "name", pluginRunner.Name)
|
|
|
|
err = client.Setup(ctx, &logical.BackendConfig{})
|
|
if err != nil {
|
|
return logical.EmptyPluginVersion, nil
|
|
}
|
|
if versioner, ok := client.(logical.PluginVersioner); ok {
|
|
return versioner.PluginVersion(), nil
|
|
}
|
|
return logical.EmptyPluginVersion, nil
|
|
}
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to dispense plugin as backend v5: %w", err))
|
|
}
|
|
c.logger.Debug("failed to dispense v5 backend plugin", "name", pluginRunner.Name, "error", err)
|
|
config.AutoMTLS = false
|
|
config.IsMetadataMode = true
|
|
// attempt to run as a v4 backend plugin
|
|
client, err = backendplugin.NewPluginClient(ctx, nil, pluginRunner, log.NewNullLogger(), true)
|
|
if err != nil {
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to dispense v4 backend plugin: %w", err))
|
|
c.logger.Debug("failed to dispense v4 backend plugin", "name", pluginRunner.Name, "error", merr)
|
|
return logical.EmptyPluginVersion, merr.ErrorOrNil()
|
|
}
|
|
c.logger.Debug("successfully dispensed v4 backend plugin", "name", pluginRunner.Name)
|
|
defer client.Cleanup(ctx)
|
|
|
|
err = client.Setup(ctx, &logical.BackendConfig{})
|
|
if err != nil {
|
|
return logical.EmptyPluginVersion, err
|
|
}
|
|
if versioner, ok := client.(logical.PluginVersioner); ok {
|
|
return versioner.PluginVersion(), nil
|
|
}
|
|
return logical.EmptyPluginVersion, nil
|
|
}
|
|
|
|
// getDatabaseRunningVersion returns the version reported by a database plugin
|
|
func (c *PluginCatalog) getDatabaseRunningVersion(ctx context.Context, pluginRunner *pluginutil.PluginRunner) (logical.PluginVersion, error) {
|
|
merr := &multierror.Error{}
|
|
config := pluginutil.PluginClientConfig{
|
|
Name: pluginRunner.Name,
|
|
PluginSets: v5.PluginSets,
|
|
PluginType: consts.PluginTypeDatabase,
|
|
Version: pluginRunner.Version,
|
|
HandshakeConfig: v5.HandshakeConfig,
|
|
Logger: log.Default(),
|
|
IsMetadataMode: true,
|
|
AutoMTLS: true,
|
|
}
|
|
|
|
// Attempt to run as database V5+ multiplexed plugin
|
|
c.logger.Debug("attempting to load database plugin as v5", "name", pluginRunner.Name)
|
|
v5Client, err := c.newPluginClient(ctx, pluginRunner, config)
|
|
if err == nil {
|
|
defer func() {
|
|
// Close the client and cleanup the plugin process
|
|
err = c.cleanupExternalPlugin(pluginRunner.Name, v5Client.id)
|
|
if err != nil {
|
|
c.logger.Error("error closing plugin client", "error", err)
|
|
}
|
|
}()
|
|
|
|
raw, err := v5Client.Dispense("database")
|
|
if err != nil {
|
|
return logical.EmptyPluginVersion, err
|
|
}
|
|
if versioner, ok := raw.(logical.PluginVersioner); ok {
|
|
return versioner.PluginVersion(), nil
|
|
}
|
|
return logical.EmptyPluginVersion, nil
|
|
}
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to load plugin as database v5: %w", err))
|
|
|
|
c.logger.Debug("attempting to load database plugin as v4", "name", pluginRunner.Name)
|
|
v4Client, err := v4.NewPluginClient(ctx, nil, pluginRunner, log.NewNullLogger(), true)
|
|
if err == nil {
|
|
// Close the client and cleanup the plugin process
|
|
defer func() {
|
|
err = v4Client.Close()
|
|
if err != nil {
|
|
c.logger.Error("error closing plugin client", "error", err)
|
|
}
|
|
}()
|
|
|
|
if versioner, ok := v4Client.(logical.PluginVersioner); ok {
|
|
return versioner.PluginVersion(), nil
|
|
}
|
|
|
|
return logical.EmptyPluginVersion, nil
|
|
}
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to load plugin as database v4: %w", err))
|
|
return logical.EmptyPluginVersion, merr
|
|
}
|
|
|
|
// isDatabasePlugin returns an error if the plugin is not a database plugin.
|
|
func (c *PluginCatalog) isDatabasePlugin(ctx context.Context, pluginRunner *pluginutil.PluginRunner) error {
|
|
merr := &multierror.Error{}
|
|
config := pluginutil.PluginClientConfig{
|
|
Name: pluginRunner.Name,
|
|
PluginSets: v5.PluginSets,
|
|
PluginType: consts.PluginTypeDatabase,
|
|
Version: pluginRunner.Version,
|
|
HandshakeConfig: v5.HandshakeConfig,
|
|
Logger: log.NewNullLogger(),
|
|
IsMetadataMode: true,
|
|
AutoMTLS: true,
|
|
}
|
|
|
|
// Attempt to run as database V5+ multiplexed plugin
|
|
c.logger.Debug("attempting to load database plugin as v5", "name", pluginRunner.Name)
|
|
v5Client, err := c.newPluginClient(ctx, pluginRunner, config)
|
|
if err == nil {
|
|
// Close the client and cleanup the plugin process
|
|
err = c.cleanupExternalPlugin(pluginRunner.Name, v5Client.id)
|
|
if err != nil {
|
|
c.logger.Error("error closing plugin client", "error", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to load plugin as database v5: %w", err))
|
|
|
|
c.logger.Debug("attempting to load database plugin as v4", "name", pluginRunner.Name)
|
|
v4Client, err := v4.NewPluginClient(ctx, nil, pluginRunner, log.NewNullLogger(), true)
|
|
if err == nil {
|
|
// Close the client and cleanup the plugin process
|
|
err = v4Client.Close()
|
|
if err != nil {
|
|
c.logger.Error("error closing plugin client", "error", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
merr = multierror.Append(merr, fmt.Errorf("failed to load plugin as database v4: %w", err))
|
|
|
|
return merr.ErrorOrNil()
|
|
}
|
|
|
|
// UpdatePlugins will loop over all the plugins of unknown type and attempt to
|
|
// upgrade them to typed plugins
|
|
func (c *PluginCatalog) UpgradePlugins(ctx context.Context, logger log.Logger) error {
|
|
c.lock.Lock()
|
|
defer c.lock.Unlock()
|
|
|
|
// If the directory isn't set we can skip the upgrade attempt
|
|
if c.directory == "" {
|
|
return nil
|
|
}
|
|
|
|
// List plugins from old location
|
|
pluginsRaw, err := c.catalogView.List(ctx, "")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
plugins := make([]string, 0, len(pluginsRaw))
|
|
for _, p := range pluginsRaw {
|
|
if !strings.HasSuffix(p, "/") {
|
|
plugins = append(plugins, p)
|
|
}
|
|
}
|
|
|
|
logger.Info("upgrading plugin information", "plugins", plugins)
|
|
|
|
var retErr error
|
|
for _, pluginName := range plugins {
|
|
pluginRaw, err := c.catalogView.Get(ctx, pluginName)
|
|
if err != nil {
|
|
retErr = multierror.Append(fmt.Errorf("failed to load plugin entry: %w", err))
|
|
continue
|
|
}
|
|
|
|
plugin := new(pluginutil.PluginRunner)
|
|
if err := jsonutil.DecodeJSON(pluginRaw.Value, plugin); err != nil {
|
|
retErr = multierror.Append(fmt.Errorf("failed to decode plugin entry: %w", err))
|
|
continue
|
|
}
|
|
|
|
// prepend the plugin directory to the command
|
|
cmdOld := plugin.Command
|
|
plugin.Command = filepath.Join(c.directory, plugin.Command)
|
|
|
|
// Upgrade the storage. At this point we don't know what type of plugin this is so pass in the unknown type.
|
|
runner, err := c.setInternal(ctx, pluginName, consts.PluginTypeUnknown, plugin.Version, cmdOld, plugin.Args, plugin.Env, plugin.Sha256)
|
|
if err != nil {
|
|
if errors.Is(err, ErrPluginBadType) {
|
|
retErr = multierror.Append(retErr, fmt.Errorf("could not upgrade plugin %s: plugin of unknown type", pluginName))
|
|
continue
|
|
}
|
|
|
|
retErr = multierror.Append(retErr, fmt.Errorf("could not upgrade plugin %s: %s", pluginName, err))
|
|
continue
|
|
}
|
|
|
|
err = c.catalogView.Delete(ctx, pluginName)
|
|
if err != nil {
|
|
logger.Error("could not remove plugin", "plugin", pluginName, "error", err)
|
|
}
|
|
|
|
logger.Info("upgraded plugin type", "plugin", pluginName, "type", runner.Type.String())
|
|
}
|
|
|
|
return retErr
|
|
}
|
|
|
|
// Get retrieves a plugin with the specified name from the catalog. It first
|
|
// looks for external plugins with this name and then looks for builtin plugins.
|
|
// It returns a PluginRunner or an error if no plugin was found.
|
|
func (c *PluginCatalog) Get(ctx context.Context, name string, pluginType consts.PluginType, version string) (*pluginutil.PluginRunner, error) {
|
|
c.lock.RLock()
|
|
runner, err := c.get(ctx, name, pluginType, version)
|
|
c.lock.RUnlock()
|
|
return runner, err
|
|
}
|
|
|
|
func (c *PluginCatalog) get(ctx context.Context, name string, pluginType consts.PluginType, version string) (*pluginutil.PluginRunner, error) {
|
|
// If the directory isn't set only look for builtin plugins.
|
|
if c.directory != "" {
|
|
// Look for external plugins in the barrier
|
|
storageKey := path.Join(pluginType.String(), name)
|
|
if version != "" {
|
|
storageKey = path.Join(storageKey, version)
|
|
}
|
|
out, err := c.catalogView.Get(ctx, storageKey)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to retrieve plugin %q: %w", name, err)
|
|
}
|
|
if out == nil && version == "" {
|
|
// Also look for external plugins under what their name would have been if they
|
|
// were registered before plugin types existed.
|
|
out, err = c.catalogView.Get(ctx, name)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to retrieve plugin %q: %w", name, err)
|
|
}
|
|
}
|
|
if out != nil {
|
|
entry := new(pluginutil.PluginRunner)
|
|
if err := jsonutil.DecodeJSON(out.Value, entry); err != nil {
|
|
return nil, fmt.Errorf("failed to decode plugin entry: %w", err)
|
|
}
|
|
if entry.Type != pluginType && entry.Type != consts.PluginTypeUnknown {
|
|
return nil, nil
|
|
}
|
|
|
|
// prepend the plugin directory to the command
|
|
entry.Command = filepath.Join(c.directory, entry.Command)
|
|
|
|
return entry, nil
|
|
}
|
|
}
|
|
|
|
builtinVersion := versions.GetBuiltinVersion(pluginType, name)
|
|
if version == "" || version == builtinVersion {
|
|
// Look for builtin plugins
|
|
if factory, ok := c.builtinRegistry.Get(name, pluginType); ok {
|
|
return &pluginutil.PluginRunner{
|
|
Name: name,
|
|
Type: pluginType,
|
|
Builtin: true,
|
|
BuiltinFactory: factory,
|
|
Version: builtinVersion,
|
|
}, nil
|
|
}
|
|
}
|
|
|
|
return nil, nil
|
|
}
|
|
|
|
// Set registers a new external plugin with the catalog, or updates an existing
|
|
// external plugin. It takes the name, command and SHA256 of the plugin.
|
|
func (c *PluginCatalog) Set(ctx context.Context, name string, pluginType consts.PluginType, version string, command string, args []string, env []string, sha256 []byte) error {
|
|
if c.directory == "" {
|
|
return ErrDirectoryNotConfigured
|
|
}
|
|
|
|
switch {
|
|
case strings.Contains(name, ".."):
|
|
fallthrough
|
|
case strings.Contains(command, ".."):
|
|
return consts.ErrPathContainsParentReferences
|
|
}
|
|
|
|
c.lock.Lock()
|
|
defer c.lock.Unlock()
|
|
|
|
_, err := c.setInternal(ctx, name, pluginType, version, command, args, env, sha256)
|
|
return err
|
|
}
|
|
|
|
func (c *PluginCatalog) setInternal(ctx context.Context, name string, pluginType consts.PluginType, version string, command string, args []string, env []string, sha256 []byte) (*pluginutil.PluginRunner, error) {
|
|
// Best effort check to make sure the command isn't breaking out of the
|
|
// configured plugin directory.
|
|
commandFull := filepath.Join(c.directory, command)
|
|
sym, err := filepath.EvalSymlinks(commandFull)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error while validating the command path: %w", err)
|
|
}
|
|
symAbs, err := filepath.Abs(filepath.Dir(sym))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error while validating the command path: %w", err)
|
|
}
|
|
|
|
if symAbs != c.directory {
|
|
return nil, errors.New("cannot execute files outside of configured plugin directory")
|
|
}
|
|
|
|
// entryTmp should only be used for the below type and version checks, it uses the
|
|
// full command instead of the relative command.
|
|
entryTmp := &pluginutil.PluginRunner{
|
|
Name: name,
|
|
Command: commandFull,
|
|
Args: args,
|
|
Env: env,
|
|
Sha256: sha256,
|
|
Builtin: false,
|
|
}
|
|
// If the plugin type is unknown, we want to attempt to determine the type
|
|
if pluginType == consts.PluginTypeUnknown {
|
|
pluginType, err = c.getPluginTypeFromUnknown(ctx, entryTmp)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if pluginType == consts.PluginTypeUnknown {
|
|
return nil, ErrPluginBadType
|
|
}
|
|
}
|
|
|
|
// getting the plugin version is best-effort, so errors are not fatal
|
|
runningVersion := logical.EmptyPluginVersion
|
|
var versionErr error
|
|
switch pluginType {
|
|
case consts.PluginTypeSecrets, consts.PluginTypeCredential:
|
|
runningVersion, versionErr = c.getBackendRunningVersion(ctx, entryTmp)
|
|
case consts.PluginTypeDatabase:
|
|
runningVersion, versionErr = c.getDatabaseRunningVersion(ctx, entryTmp)
|
|
default:
|
|
return nil, fmt.Errorf("unknown plugin type: %v", pluginType)
|
|
}
|
|
if versionErr != nil {
|
|
c.logger.Warn("Error determining plugin version", "error", versionErr)
|
|
} else if version != "" && runningVersion.Version != "" && version != runningVersion.Version {
|
|
c.logger.Warn("Plugin self-reported version did not match requested version", "plugin", name, "requestedVersion", version, "reportedVersion", runningVersion.Version)
|
|
return nil, fmt.Errorf("plugin version mismatch: %s reported version (%s) did not match requested version (%s)", name, runningVersion.Version, version)
|
|
} else if version == "" && runningVersion.Version != "" {
|
|
version = runningVersion.Version
|
|
_, err := semver.NewVersion(version)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("plugin self-reported version %q is not a valid semantic version: %w", version, err)
|
|
}
|
|
|
|
}
|
|
|
|
entry := &pluginutil.PluginRunner{
|
|
Name: name,
|
|
Type: pluginType,
|
|
Version: version,
|
|
Command: command,
|
|
Args: args,
|
|
Env: env,
|
|
Sha256: sha256,
|
|
Builtin: false,
|
|
}
|
|
|
|
buf, err := json.Marshal(entry)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to encode plugin entry: %w", err)
|
|
}
|
|
|
|
storageKey := path.Join(pluginType.String(), name)
|
|
if version != "" {
|
|
storageKey = path.Join(storageKey, version)
|
|
}
|
|
logicalEntry := logical.StorageEntry{
|
|
Key: storageKey,
|
|
Value: buf,
|
|
}
|
|
if err := c.catalogView.Put(ctx, &logicalEntry); err != nil {
|
|
return nil, fmt.Errorf("failed to persist plugin entry: %w", err)
|
|
}
|
|
return entry, nil
|
|
}
|
|
|
|
// Delete is used to remove an external plugin from the catalog. Builtin plugins
|
|
// can not be deleted.
|
|
func (c *PluginCatalog) Delete(ctx context.Context, name string, pluginType consts.PluginType, pluginVersion string) error {
|
|
c.lock.Lock()
|
|
defer c.lock.Unlock()
|
|
|
|
// Check the name under which the plugin exists, but if it's unfound, don't return any error.
|
|
pluginKey := path.Join(pluginType.String(), name)
|
|
if pluginVersion != "" {
|
|
pluginKey = path.Join(pluginKey, pluginVersion)
|
|
}
|
|
out, err := c.catalogView.Get(ctx, pluginKey)
|
|
if err != nil || out == nil {
|
|
pluginKey = name
|
|
}
|
|
|
|
return c.catalogView.Delete(ctx, pluginKey)
|
|
}
|
|
|
|
// List returns a list of all the known plugin names. If an external and builtin
|
|
// plugin share the same name, only one instance of the name will be returned.
|
|
func (c *PluginCatalog) List(ctx context.Context, pluginType consts.PluginType) ([]string, error) {
|
|
plugins, err := c.listInternal(ctx, pluginType, false)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// Use a set to de-dupe between builtin and unversioned external plugins.
|
|
// External plugins with the same name as a builtin override the builtin.
|
|
uniquePluginNames := make(map[string]struct{})
|
|
for _, plugin := range plugins {
|
|
uniquePluginNames[plugin.Name] = struct{}{}
|
|
}
|
|
|
|
retList := make([]string, 0, len(uniquePluginNames))
|
|
for plugin := range uniquePluginNames {
|
|
retList = append(retList, plugin)
|
|
}
|
|
|
|
return retList, nil
|
|
}
|
|
|
|
func (c *PluginCatalog) ListVersionedPlugins(ctx context.Context, pluginType consts.PluginType) ([]pluginutil.VersionedPlugin, error) {
|
|
return c.listInternal(ctx, pluginType, true)
|
|
}
|
|
|
|
func (c *PluginCatalog) listInternal(ctx context.Context, pluginType consts.PluginType, includeVersioned bool) ([]pluginutil.VersionedPlugin, error) {
|
|
c.lock.RLock()
|
|
defer c.lock.RUnlock()
|
|
|
|
var result []pluginutil.VersionedPlugin
|
|
|
|
// Collect keys for external plugins in the barrier.
|
|
keys, err := logical.CollectKeys(ctx, c.catalogView)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
unversionedPlugins := make(map[string]struct{})
|
|
for _, key := range keys {
|
|
var semanticVersion *semver.Version
|
|
|
|
entry, err := c.catalogView.Get(ctx, key)
|
|
if err != nil || entry == nil {
|
|
continue
|
|
}
|
|
|
|
plugin := new(pluginutil.PluginRunner)
|
|
if err := jsonutil.DecodeJSON(entry.Value, plugin); err != nil {
|
|
return nil, fmt.Errorf("failed to decode plugin entry: %w", err)
|
|
}
|
|
|
|
if plugin.Version == "" {
|
|
semanticVersion, err = semver.NewVersion("0.0.0")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
} else {
|
|
if !includeVersioned {
|
|
continue
|
|
}
|
|
|
|
semanticVersion, err = semver.NewVersion(plugin.Version)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unexpected error parsing version from plugin catalog entry %q: %w", key, err)
|
|
}
|
|
}
|
|
|
|
// Only list user-added plugins if they're of the given type.
|
|
if plugin.Type != consts.PluginTypeUnknown && plugin.Type != pluginType {
|
|
continue
|
|
}
|
|
|
|
result = append(result, pluginutil.VersionedPlugin{
|
|
Name: plugin.Name,
|
|
Type: plugin.Type.String(),
|
|
Version: plugin.Version,
|
|
SHA256: hex.EncodeToString(plugin.Sha256),
|
|
SemanticVersion: semanticVersion,
|
|
})
|
|
|
|
if plugin.Version == "" {
|
|
unversionedPlugins[plugin.Name] = struct{}{}
|
|
}
|
|
}
|
|
|
|
// Get the builtin plugins.
|
|
builtinPlugins := c.builtinRegistry.Keys(pluginType)
|
|
for _, plugin := range builtinPlugins {
|
|
// Unversioned plugins fully replace builtins of the same name.
|
|
if _, ok := unversionedPlugins[plugin]; ok {
|
|
continue
|
|
}
|
|
|
|
version := versions.GetBuiltinVersion(pluginType, plugin)
|
|
semanticVersion, err := semver.NewVersion(version)
|
|
deprecationStatus, _ := c.builtinRegistry.DeprecationStatus(plugin, pluginType)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
result = append(result, pluginutil.VersionedPlugin{
|
|
Name: plugin,
|
|
Type: pluginType.String(),
|
|
Version: version,
|
|
Builtin: true,
|
|
SemanticVersion: semanticVersion,
|
|
DeprecationStatus: deprecationStatus.String(),
|
|
})
|
|
}
|
|
|
|
return result, nil
|
|
}
|