152 lines
4.4 KiB
Go
152 lines
4.4 KiB
Go
package ssh
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/vault/sdk/helper/strutil"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
// Structure to hold roles that are allowed to accept any IP address.
|
|
type zeroAddressRoles struct {
|
|
Roles []string `json:"roles" mapstructure:"roles"`
|
|
}
|
|
|
|
func pathConfigZeroAddress(b *backend) *framework.Path {
|
|
return &framework.Path{
|
|
Pattern: "config/zeroaddress",
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"roles": &framework.FieldSchema{
|
|
Type: framework.TypeCommaStringSlice,
|
|
Description: `[Required] Comma separated list of role names which
|
|
allows credentials to be requested for any IP address. CIDR blocks
|
|
previously registered under these roles will be ignored.`,
|
|
},
|
|
},
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
logical.UpdateOperation: b.pathConfigZeroAddressWrite,
|
|
logical.ReadOperation: b.pathConfigZeroAddressRead,
|
|
logical.DeleteOperation: b.pathConfigZeroAddressDelete,
|
|
},
|
|
HelpSynopsis: pathConfigZeroAddressSyn,
|
|
HelpDescription: pathConfigZeroAddressDesc,
|
|
}
|
|
}
|
|
|
|
func (b *backend) pathConfigZeroAddressDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
err := req.Storage.Delete(ctx, "config/zeroaddress")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func (b *backend) pathConfigZeroAddressRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
entry, err := b.getZeroAddressRoles(ctx, req.Storage)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if entry == nil {
|
|
return nil, nil
|
|
}
|
|
|
|
return &logical.Response{
|
|
Data: map[string]interface{}{
|
|
"roles": entry.Roles,
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
func (b *backend) pathConfigZeroAddressWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
roles := d.Get("roles").([]string)
|
|
if len(roles) == 0 {
|
|
return logical.ErrorResponse("Missing roles"), nil
|
|
}
|
|
|
|
// Check if the roles listed actually exist in the backend
|
|
for _, item := range roles {
|
|
role, err := b.getRole(ctx, req.Storage, item)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if role == nil {
|
|
return logical.ErrorResponse(fmt.Sprintf("Role %q does not exist", item)), nil
|
|
}
|
|
}
|
|
|
|
err := b.putZeroAddressRoles(ctx, req.Storage, roles)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return nil, nil
|
|
}
|
|
|
|
// Stores the given list of roles at zeroaddress endpoint
|
|
func (b *backend) putZeroAddressRoles(ctx context.Context, s logical.Storage, roles []string) error {
|
|
entry, err := logical.StorageEntryJSON("config/zeroaddress", &zeroAddressRoles{
|
|
Roles: roles,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := s.Put(ctx, entry); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Retrieves the list of roles from the zeroaddress endpoint.
|
|
func (b *backend) getZeroAddressRoles(ctx context.Context, s logical.Storage) (*zeroAddressRoles, error) {
|
|
entry, err := s.Get(ctx, "config/zeroaddress")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if entry == nil {
|
|
return nil, nil
|
|
}
|
|
|
|
var result zeroAddressRoles
|
|
if err := entry.DecodeJSON(&result); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &result, nil
|
|
}
|
|
|
|
// Removes a role from the list of roles present in config/zeroaddress path
|
|
func (b *backend) removeZeroAddressRole(ctx context.Context, s logical.Storage, roleName string) error {
|
|
zeroAddressEntry, err := b.getZeroAddressRoles(ctx, s)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if zeroAddressEntry == nil {
|
|
return nil
|
|
}
|
|
|
|
zeroAddressEntry.Roles = strutil.StrListDelete(zeroAddressEntry.Roles, roleName)
|
|
|
|
return b.putZeroAddressRoles(ctx, s, zeroAddressEntry.Roles)
|
|
}
|
|
|
|
const pathConfigZeroAddressSyn = `
|
|
Assign zero address as default CIDR block for select roles.
|
|
`
|
|
|
|
const pathConfigZeroAddressDesc = `
|
|
Administrator can choose to make a select few registered roles to accept any IP
|
|
address, overriding the CIDR blocks registered during creation of roles. This
|
|
doesn't mean that the credentials are created for any IP address. Clients who
|
|
have access to these roles are trusted to make valid requests. Access to these
|
|
roles should be controlled using Vault policies. It is recommended that all the
|
|
roles that are allowed to accept any IP address should have an explicit policy
|
|
of deny for unintended clients.
|
|
|
|
This is a root authenticated endpoint. If backend is mounted at 'ssh' then use
|
|
the endpoint 'ssh/config/zeroaddress' to provide the list of allowed roles.
|
|
After mounting the backend, use 'path-help' for additional information.
|
|
`
|