0d077d7945
* Initial work * rework * s/dr/recovery * Add sys/raw support to recovery mode (#7577) * Factor the raw paths out so they can be run with a SystemBackend. # Conflicts: # vault/logical_system.go * Add handleLogicalRecovery which is like handleLogical but is only sufficient for use with the sys-raw endpoint in recovery mode. No authentication is done yet. * Integrate with recovery-mode. We now handle unauthenticated sys/raw requests, albeit on path v1/raw instead v1/sys/raw. * Use sys/raw instead raw during recovery. * Don't bother persisting the recovery token. Authenticate sys/raw requests with it. * RecoveryMode: Support generate-root for autounseals (#7591) * Recovery: Abstract config creation and log settings * Recovery mode integration test. (#7600) * Recovery: Touch up (#7607) * Recovery: Touch up * revert the raw backend creation changes * Added recovery operation token prefix * Move RawBackend to its own file * Update API path and hit it using CLI flag on generate-root * Fix a panic triggered when handling a request that yields a nil response. (#7618) * Improve integ test to actually make changes while in recovery mode and verify they're still there after coming back in regular mode. * Refuse to allow a second recovery token to be generated. * Resize raft cluster to size 1 and start as leader (#7626) * RecoveryMode: Setup raft cluster post unseal (#7635) * Setup raft cluster post unseal in recovery mode * Remove marking as unsealed as its not needed * Address review comments * Accept only one seal config in recovery mode as there is no scope for migration
141 lines
4.4 KiB
Go
141 lines
4.4 KiB
Go
package api
|
|
|
|
import "context"
|
|
|
|
func (c *Sys) GenerateRootStatus() (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootStatusCommon("/v1/sys/generate-root/attempt")
|
|
}
|
|
|
|
func (c *Sys) GenerateDROperationTokenStatus() (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootStatusCommon("/v1/sys/replication/dr/secondary/generate-operation-token/attempt")
|
|
}
|
|
|
|
func (c *Sys) GenerateRecoveryOperationTokenStatus() (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootStatusCommon("/v1/sys/generate-recovery-token/attempt")
|
|
}
|
|
|
|
func (c *Sys) generateRootStatusCommon(path string) (*GenerateRootStatusResponse, error) {
|
|
r := c.c.NewRequest("GET", path)
|
|
|
|
ctx, cancelFunc := context.WithCancel(context.Background())
|
|
defer cancelFunc()
|
|
resp, err := c.c.RawRequestWithContext(ctx, r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
var result GenerateRootStatusResponse
|
|
err = resp.DecodeJSON(&result)
|
|
return &result, err
|
|
}
|
|
|
|
func (c *Sys) GenerateRootInit(otp, pgpKey string) (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootInitCommon("/v1/sys/generate-root/attempt", otp, pgpKey)
|
|
}
|
|
|
|
func (c *Sys) GenerateDROperationTokenInit(otp, pgpKey string) (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootInitCommon("/v1/sys/replication/dr/secondary/generate-operation-token/attempt", otp, pgpKey)
|
|
}
|
|
|
|
func (c *Sys) GenerateRecoveryOperationTokenInit(otp, pgpKey string) (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootInitCommon("/v1/sys/generate-recovery-token/attempt", otp, pgpKey)
|
|
}
|
|
|
|
func (c *Sys) generateRootInitCommon(path, otp, pgpKey string) (*GenerateRootStatusResponse, error) {
|
|
body := map[string]interface{}{
|
|
"otp": otp,
|
|
"pgp_key": pgpKey,
|
|
}
|
|
|
|
r := c.c.NewRequest("PUT", path)
|
|
if err := r.SetJSONBody(body); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
ctx, cancelFunc := context.WithCancel(context.Background())
|
|
defer cancelFunc()
|
|
resp, err := c.c.RawRequestWithContext(ctx, r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
var result GenerateRootStatusResponse
|
|
err = resp.DecodeJSON(&result)
|
|
return &result, err
|
|
}
|
|
|
|
func (c *Sys) GenerateRootCancel() error {
|
|
return c.generateRootCancelCommon("/v1/sys/generate-root/attempt")
|
|
}
|
|
|
|
func (c *Sys) GenerateDROperationTokenCancel() error {
|
|
return c.generateRootCancelCommon("/v1/sys/replication/dr/secondary/generate-operation-token/attempt")
|
|
}
|
|
|
|
func (c *Sys) GenerateRecoveryOperationTokenCancel() error {
|
|
return c.generateRootCancelCommon("/v1/sys/generate-recovery-token/attempt")
|
|
}
|
|
|
|
func (c *Sys) generateRootCancelCommon(path string) error {
|
|
r := c.c.NewRequest("DELETE", path)
|
|
|
|
ctx, cancelFunc := context.WithCancel(context.Background())
|
|
defer cancelFunc()
|
|
resp, err := c.c.RawRequestWithContext(ctx, r)
|
|
if err == nil {
|
|
defer resp.Body.Close()
|
|
}
|
|
return err
|
|
}
|
|
|
|
func (c *Sys) GenerateRootUpdate(shard, nonce string) (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootUpdateCommon("/v1/sys/generate-root/update", shard, nonce)
|
|
}
|
|
|
|
func (c *Sys) GenerateDROperationTokenUpdate(shard, nonce string) (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootUpdateCommon("/v1/sys/replication/dr/secondary/generate-operation-token/update", shard, nonce)
|
|
}
|
|
|
|
func (c *Sys) GenerateRecoveryOperationTokenUpdate(shard, nonce string) (*GenerateRootStatusResponse, error) {
|
|
return c.generateRootUpdateCommon("/v1/sys/generate-recovery-token/update", shard, nonce)
|
|
}
|
|
|
|
func (c *Sys) generateRootUpdateCommon(path, shard, nonce string) (*GenerateRootStatusResponse, error) {
|
|
body := map[string]interface{}{
|
|
"key": shard,
|
|
"nonce": nonce,
|
|
}
|
|
|
|
r := c.c.NewRequest("PUT", path)
|
|
if err := r.SetJSONBody(body); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
ctx, cancelFunc := context.WithCancel(context.Background())
|
|
defer cancelFunc()
|
|
resp, err := c.c.RawRequestWithContext(ctx, r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
var result GenerateRootStatusResponse
|
|
err = resp.DecodeJSON(&result)
|
|
return &result, err
|
|
}
|
|
|
|
type GenerateRootStatusResponse struct {
|
|
Nonce string `json:"nonce"`
|
|
Started bool `json:"started"`
|
|
Progress int `json:"progress"`
|
|
Required int `json:"required"`
|
|
Complete bool `json:"complete"`
|
|
EncodedToken string `json:"encoded_token"`
|
|
EncodedRootToken string `json:"encoded_root_token"`
|
|
PGPFingerprint string `json:"pgp_fingerprint"`
|
|
OTP string `json:"otp"`
|
|
OTPLength int `json:"otp_length"`
|
|
}
|