ffce5ca702
* Fix various read only storage errors A mistake we've seen multiple times in our own plugins and that we've seen in the GCP plugin now is that control flow (how the code is structured, helper functions, etc.) can obfuscate whether an error came from storage or some other Vault-core location (in which case likely it needs to be a 5XX message) or because of user input (thus 4XX). Error handling for functions therefore often ends up always treating errors as either user related or internal. When the error is logical.ErrReadOnly this means that treating errors as user errors skips the check that triggers forwarding, instead returning a read only view error to the user. While it's obviously more correct to fix that code, it's not always immediately apparent to reviewers or fixers what the issue is and fixing it when it's found both requires someone to hit the problem and report it (thus exposing bugs to users) and selective targeted refactoring that only helps that one specific case. If instead we check whether the logical.Response is an error and, if so, whether it contains the error value, we work around this in all of these cases automatically. It feels hacky since it's a coding mistake, but it's one we've made too multiple times, and avoiding bugs altogether is better for our users.
48 lines
1.2 KiB
Go
48 lines
1.2 KiB
Go
// +build !enterprise
|
|
|
|
package vault
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/hashicorp/vault/helper/identity"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
func waitForReplicationState(context.Context, *Core, *logical.Request) error { return nil }
|
|
|
|
func checkNeedsCG(context.Context, *Core, *logical.Request, *logical.Auth, error, []string) (error, *logical.Response, *logical.Auth, error) {
|
|
return nil, nil, nil, nil
|
|
}
|
|
|
|
func checkErrControlGroupTokenNeedsCreated(err error) bool {
|
|
return false
|
|
}
|
|
|
|
func shouldForward(c *Core, resp *logical.Response, err error) bool {
|
|
return false
|
|
}
|
|
|
|
func syncCounter(c *Core) {
|
|
}
|
|
|
|
func couldForward(c *Core) bool {
|
|
return false
|
|
}
|
|
|
|
func forward(ctx context.Context, c *Core, req *logical.Request) (*logical.Response, error) {
|
|
panic("forward called in OSS Vault")
|
|
}
|
|
|
|
func getLeaseRegisterFunc(c *Core) (func(context.Context, *logical.Request, *logical.Response) (string, error), error) {
|
|
return c.expiration.Register, nil
|
|
}
|
|
|
|
func getAuthRegisterFunc(c *Core) (RegisterAuthFunc, error) {
|
|
return c.RegisterAuth, nil
|
|
}
|
|
|
|
func possiblyForwardAliasCreation(ctx context.Context, c *Core, inErr error, auth *logical.Auth, entity *identity.Entity) (*identity.Entity, error) {
|
|
return entity, inErr
|
|
}
|