2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
|
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
|
2015-03-16 05:47:32 +03:00
|
|
|
package api
|
|
|
|
|
2016-05-28 00:01:42 +03:00
|
|
|
import (
|
2018-05-16 03:01:58 +03:00
|
|
|
"bytes"
|
2018-07-25 01:49:55 +03:00
|
|
|
"context"
|
2023-02-06 17:41:56 +03:00
|
|
|
"encoding/json"
|
2018-05-16 03:01:58 +03:00
|
|
|
"fmt"
|
2018-04-04 05:35:45 +03:00
|
|
|
"io"
|
2022-03-24 20:58:03 +03:00
|
|
|
"net/http"
|
2018-08-14 05:00:26 +03:00
|
|
|
"net/url"
|
2016-09-29 07:01:28 +03:00
|
|
|
"os"
|
2021-11-24 21:13:45 +03:00
|
|
|
"strings"
|
2018-05-16 03:01:58 +03:00
|
|
|
|
|
|
|
"github.com/hashicorp/errwrap"
|
2016-05-28 00:01:42 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
wrappedResponseLocation = "cubbyhole/response"
|
|
|
|
)
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
var (
|
|
|
|
// The default TTL that will be used with `sys/wrapping/wrap`, can be
|
|
|
|
// changed
|
|
|
|
DefaultWrappingTTL = "5m"
|
|
|
|
|
2020-06-08 17:50:48 +03:00
|
|
|
// The default function used if no other function is set. It honors the env
|
|
|
|
// var to set the wrap TTL. The default wrap TTL will apply when when writing
|
|
|
|
// to `sys/wrapping/wrap` when the env var is not set.
|
2016-09-29 07:01:28 +03:00
|
|
|
DefaultWrappingLookupFunc = func(operation, path string) string {
|
|
|
|
if os.Getenv(EnvVaultWrapTTL) != "" {
|
|
|
|
return os.Getenv(EnvVaultWrapTTL)
|
|
|
|
}
|
|
|
|
|
2022-03-24 20:58:03 +03:00
|
|
|
if (operation == http.MethodPut || operation == http.MethodPost) && path == "sys/wrapping/wrap" {
|
2016-09-29 07:01:28 +03:00
|
|
|
return DefaultWrappingTTL
|
|
|
|
}
|
|
|
|
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
)
|
|
|
|
|
2015-03-16 05:47:32 +03:00
|
|
|
// Logical is used to perform logical backend operations on Vault.
|
|
|
|
type Logical struct {
|
|
|
|
c *Client
|
|
|
|
}
|
|
|
|
|
|
|
|
// Logical is used to return the client for logical-backend API calls.
|
|
|
|
func (c *Client) Logical() *Logical {
|
|
|
|
return &Logical{c: c}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) Read(path string) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.ReadWithDataWithContext(context.Background(), path, nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) ReadWithContext(ctx context.Context, path string) (*Secret, error) {
|
|
|
|
return c.ReadWithDataWithContext(ctx, path, nil)
|
2018-08-14 05:00:26 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) ReadWithData(path string, data map[string][]string) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.ReadWithDataWithContext(context.Background(), path, data)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) ReadWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Secret, error) {
|
|
|
|
ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
|
|
|
|
defer cancelFunc()
|
|
|
|
|
Vault Raw Read Support (CLI & Client) (#14945)
* Expose raw request from client.Logical()
Not all Vault API endpoints return well-formatted JSON objects.
Sometimes, in the case of the PKI secrets engine, they're not even
printable (/pki/ca returns a binary (DER-encoded) certificate). While
this endpoint isn't authenticated, in general the API caller would
either need to use Client.RawRequestWithContext(...) directly (which
the docs advise against), or setup their own net/http client and
re-create much of Client and/or Client.Logical.
Instead, exposing the raw Request (via the new ReadRawWithData(...))
allows callers to directly consume these non-JSON endpoints like they
would nearly any other endpoint.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add raw formatter for direct []byte data
As mentioned in the previous commit, some API endpoints return non-JSON
data. We get as far as fetching this data (via client.Logical().Read),
but parsing it as an api.Secret fails (as in this case, it is non-JSON).
Given that we intend to update `vault read` to support such endpoints,
we'll need a "raw" formatter that accepts []byte-encoded data and simply
writes it to the UI.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add support for reading raw API endpoints
Some endpoints, such as `pki/ca` and `pki/ca/pem` return non-JSON
objects. When calling `vault read` on these endpoints, an error
is returned because they cannot be parsed as api.Secret instances:
> Error reading pki/ca/pem: invalid character '-' in numeric literal
Indeed, we go to all the trouble of (successfully) fetching this value,
only to be unable to Unmarshal into a Secrets value. Instead, add
support for a new -format=raw option, allowing these endpoints to be
consumed by callers of `vault read` directly.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Remove panic
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
2022-10-28 16:45:32 +03:00
|
|
|
resp, err := c.readRawWithDataWithContext(ctx, path, data)
|
2022-11-16 17:27:56 +03:00
|
|
|
return c.ParseRawResponseAndCloseBody(resp, err)
|
|
|
|
}
|
|
|
|
|
2023-01-17 23:41:59 +03:00
|
|
|
// ReadRaw attempts to read the value stored at the given Vault path
|
|
|
|
// (without '/v1/' prefix) and returns a raw *http.Response.
|
|
|
|
//
|
|
|
|
// Note: the raw-response functions do not respect the client-configured
|
|
|
|
// request timeout; if a timeout is desired, please use ReadRawWithContext
|
|
|
|
// instead and set the timeout through context.WithTimeout or context.WithDeadline.
|
2022-11-16 17:27:56 +03:00
|
|
|
func (c *Logical) ReadRaw(path string) (*Response, error) {
|
2023-01-17 23:41:59 +03:00
|
|
|
return c.ReadRawWithDataWithContext(context.Background(), path, nil)
|
2022-11-16 17:27:56 +03:00
|
|
|
}
|
|
|
|
|
2023-01-17 23:41:59 +03:00
|
|
|
// ReadRawWithContext attempts to read the value stored at the give Vault path
|
|
|
|
// (without '/v1/' prefix) and returns a raw *http.Response.
|
|
|
|
//
|
|
|
|
// Note: the raw-response functions do not respect the client-configured
|
|
|
|
// request timeout; if a timeout is desired, please set it through
|
|
|
|
// context.WithTimeout or context.WithDeadline.
|
|
|
|
func (c *Logical) ReadRawWithContext(ctx context.Context, path string) (*Response, error) {
|
|
|
|
return c.ReadRawWithDataWithContext(ctx, path, nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
// ReadRawWithData attempts to read the value stored at the given Vault
|
|
|
|
// path (without '/v1/' prefix) and returns a raw *http.Response. The 'data' map
|
|
|
|
// is added as query parameters to the request.
|
|
|
|
//
|
|
|
|
// Note: the raw-response functions do not respect the client-configured
|
|
|
|
// request timeout; if a timeout is desired, please use
|
|
|
|
// ReadRawWithDataWithContext instead and set the timeout through
|
|
|
|
// context.WithTimeout or context.WithDeadline.
|
2022-11-16 17:27:56 +03:00
|
|
|
func (c *Logical) ReadRawWithData(path string, data map[string][]string) (*Response, error) {
|
|
|
|
return c.ReadRawWithDataWithContext(context.Background(), path, data)
|
|
|
|
}
|
|
|
|
|
2023-01-17 23:41:59 +03:00
|
|
|
// ReadRawWithDataWithContext attempts to read the value stored at the given
|
|
|
|
// Vault path (without '/v1/' prefix) and returns a raw *http.Response. The 'data'
|
|
|
|
// map is added as query parameters to the request.
|
|
|
|
//
|
|
|
|
// Note: the raw-response functions do not respect the client-configured
|
|
|
|
// request timeout; if a timeout is desired, please set it through
|
|
|
|
// context.WithTimeout or context.WithDeadline.
|
2022-11-16 17:27:56 +03:00
|
|
|
func (c *Logical) ReadRawWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Response, error) {
|
|
|
|
return c.readRawWithDataWithContext(ctx, path, data)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) ParseRawResponseAndCloseBody(resp *Response, err error) (*Secret, error) {
|
2015-09-15 01:22:33 +03:00
|
|
|
if resp != nil {
|
|
|
|
defer resp.Body.Close()
|
|
|
|
}
|
2015-04-07 21:15:20 +03:00
|
|
|
if resp != nil && resp.StatusCode == 404 {
|
2018-04-04 11:41:46 +03:00
|
|
|
secret, parseErr := ParseSecret(resp.Body)
|
|
|
|
switch parseErr {
|
2018-04-04 05:35:45 +03:00
|
|
|
case nil:
|
|
|
|
case io.EOF:
|
|
|
|
return nil, nil
|
|
|
|
default:
|
2021-08-17 20:19:39 +03:00
|
|
|
return nil, parseErr
|
2018-04-04 05:35:45 +03:00
|
|
|
}
|
|
|
|
if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
|
|
|
|
return secret, nil
|
|
|
|
}
|
2018-04-04 10:50:24 +03:00
|
|
|
return nil, nil
|
2015-04-07 21:15:20 +03:00
|
|
|
}
|
2015-03-16 05:47:32 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return ParseSecret(resp.Body)
|
|
|
|
}
|
|
|
|
|
Vault Raw Read Support (CLI & Client) (#14945)
* Expose raw request from client.Logical()
Not all Vault API endpoints return well-formatted JSON objects.
Sometimes, in the case of the PKI secrets engine, they're not even
printable (/pki/ca returns a binary (DER-encoded) certificate). While
this endpoint isn't authenticated, in general the API caller would
either need to use Client.RawRequestWithContext(...) directly (which
the docs advise against), or setup their own net/http client and
re-create much of Client and/or Client.Logical.
Instead, exposing the raw Request (via the new ReadRawWithData(...))
allows callers to directly consume these non-JSON endpoints like they
would nearly any other endpoint.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add raw formatter for direct []byte data
As mentioned in the previous commit, some API endpoints return non-JSON
data. We get as far as fetching this data (via client.Logical().Read),
but parsing it as an api.Secret fails (as in this case, it is non-JSON).
Given that we intend to update `vault read` to support such endpoints,
we'll need a "raw" formatter that accepts []byte-encoded data and simply
writes it to the UI.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add support for reading raw API endpoints
Some endpoints, such as `pki/ca` and `pki/ca/pem` return non-JSON
objects. When calling `vault read` on these endpoints, an error
is returned because they cannot be parsed as api.Secret instances:
> Error reading pki/ca/pem: invalid character '-' in numeric literal
Indeed, we go to all the trouble of (successfully) fetching this value,
only to be unable to Unmarshal into a Secrets value. Instead, add
support for a new -format=raw option, allowing these endpoints to be
consumed by callers of `vault read` directly.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Remove panic
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
2022-10-28 16:45:32 +03:00
|
|
|
func (c *Logical) readRawWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Response, error) {
|
|
|
|
r := c.c.NewRequest(http.MethodGet, "/v1/"+path)
|
|
|
|
|
|
|
|
var values url.Values
|
|
|
|
for k, v := range data {
|
|
|
|
if values == nil {
|
|
|
|
values = make(url.Values)
|
|
|
|
}
|
|
|
|
for _, val := range v {
|
|
|
|
values.Add(k, val)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if values != nil {
|
|
|
|
r.Params = values
|
|
|
|
}
|
|
|
|
|
|
|
|
return c.c.RawRequestWithContext(ctx, r)
|
|
|
|
}
|
|
|
|
|
2015-09-14 22:42:12 +03:00
|
|
|
func (c *Logical) List(path string) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.ListWithContext(context.Background(), path)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) ListWithContext(ctx context.Context, path string) (*Secret, error) {
|
|
|
|
ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
|
|
|
|
defer cancelFunc()
|
|
|
|
|
2016-09-02 08:13:14 +03:00
|
|
|
r := c.c.NewRequest("LIST", "/v1/"+path)
|
|
|
|
// Set this for broader compatibility, but we use LIST above to be able to
|
|
|
|
// handle the wrapping lookup function
|
2022-03-24 20:58:03 +03:00
|
|
|
r.Method = http.MethodGet
|
2016-01-14 22:18:27 +03:00
|
|
|
r.Params.Set("list", "true")
|
2018-07-25 01:49:55 +03:00
|
|
|
|
2022-03-24 00:47:43 +03:00
|
|
|
resp, err := c.c.rawRequestWithContext(ctx, r)
|
2015-09-15 00:30:42 +03:00
|
|
|
if resp != nil {
|
|
|
|
defer resp.Body.Close()
|
|
|
|
}
|
2015-09-14 22:42:12 +03:00
|
|
|
if resp != nil && resp.StatusCode == 404 {
|
2018-04-04 11:41:46 +03:00
|
|
|
secret, parseErr := ParseSecret(resp.Body)
|
|
|
|
switch parseErr {
|
2018-04-04 05:35:45 +03:00
|
|
|
case nil:
|
|
|
|
case io.EOF:
|
|
|
|
return nil, nil
|
|
|
|
default:
|
2021-08-17 20:19:39 +03:00
|
|
|
return nil, parseErr
|
2018-04-04 05:35:45 +03:00
|
|
|
}
|
|
|
|
if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
|
|
|
|
return secret, nil
|
|
|
|
}
|
2018-04-04 10:50:24 +03:00
|
|
|
return nil, nil
|
2015-09-14 22:42:12 +03:00
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return ParseSecret(resp.Body)
|
|
|
|
}
|
|
|
|
|
2015-04-06 19:53:43 +03:00
|
|
|
func (c *Logical) Write(path string, data map[string]interface{}) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.WriteWithContext(context.Background(), path, data)
|
|
|
|
}
|
2021-10-13 22:24:31 +03:00
|
|
|
|
2022-03-24 00:47:43 +03:00
|
|
|
func (c *Logical) WriteWithContext(ctx context.Context, path string, data map[string]interface{}) (*Secret, error) {
|
2022-03-24 20:58:03 +03:00
|
|
|
r := c.c.NewRequest(http.MethodPut, "/v1/"+path)
|
2015-03-16 05:47:32 +03:00
|
|
|
if err := r.SetJSONBody(data); err != nil {
|
2015-04-06 19:53:43 +03:00
|
|
|
return nil, err
|
2015-03-16 05:47:32 +03:00
|
|
|
}
|
|
|
|
|
2021-10-13 22:24:31 +03:00
|
|
|
return c.write(ctx, path, r)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) JSONMergePatch(ctx context.Context, path string, data map[string]interface{}) (*Secret, error) {
|
2022-03-24 20:58:03 +03:00
|
|
|
r := c.c.NewRequest(http.MethodPatch, "/v1/"+path)
|
2022-02-24 01:09:57 +03:00
|
|
|
r.Headers.Set("Content-Type", "application/merge-patch+json")
|
2021-10-13 22:24:31 +03:00
|
|
|
if err := r.SetJSONBody(data); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return c.write(ctx, path, r)
|
2019-11-08 04:54:05 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) WriteBytes(path string, data []byte) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.WriteBytesWithContext(context.Background(), path, data)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) WriteBytesWithContext(ctx context.Context, path string, data []byte) (*Secret, error) {
|
2022-03-24 20:58:03 +03:00
|
|
|
r := c.c.NewRequest(http.MethodPut, "/v1/"+path)
|
2019-11-08 04:54:05 +03:00
|
|
|
r.BodyBytes = data
|
|
|
|
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.write(ctx, path, r)
|
2019-11-08 04:54:05 +03:00
|
|
|
}
|
|
|
|
|
2021-10-13 22:24:31 +03:00
|
|
|
func (c *Logical) write(ctx context.Context, path string, request *Request) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
|
|
|
|
defer cancelFunc()
|
|
|
|
|
|
|
|
resp, err := c.c.rawRequestWithContext(ctx, request)
|
2015-09-15 01:22:33 +03:00
|
|
|
if resp != nil {
|
|
|
|
defer resp.Body.Close()
|
|
|
|
}
|
2018-04-04 05:35:45 +03:00
|
|
|
if resp != nil && resp.StatusCode == 404 {
|
2018-04-04 11:41:46 +03:00
|
|
|
secret, parseErr := ParseSecret(resp.Body)
|
|
|
|
switch parseErr {
|
2018-04-04 05:35:45 +03:00
|
|
|
case nil:
|
|
|
|
case io.EOF:
|
|
|
|
return nil, nil
|
|
|
|
default:
|
2021-08-17 20:19:39 +03:00
|
|
|
return nil, parseErr
|
2018-04-04 05:35:45 +03:00
|
|
|
}
|
|
|
|
if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
|
2018-04-04 11:41:46 +03:00
|
|
|
return secret, err
|
2018-04-04 05:35:45 +03:00
|
|
|
}
|
|
|
|
}
|
2015-03-16 05:47:32 +03:00
|
|
|
if err != nil {
|
2015-04-06 19:53:43 +03:00
|
|
|
return nil, err
|
2015-03-16 05:47:32 +03:00
|
|
|
}
|
|
|
|
|
2018-07-12 17:18:50 +03:00
|
|
|
return ParseSecret(resp.Body)
|
2015-03-16 05:47:32 +03:00
|
|
|
}
|
2015-04-07 21:04:56 +03:00
|
|
|
|
|
|
|
func (c *Logical) Delete(path string) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.DeleteWithContext(context.Background(), path)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) DeleteWithContext(ctx context.Context, path string) (*Secret, error) {
|
|
|
|
return c.DeleteWithDataWithContext(ctx, path, nil)
|
2019-07-18 20:42:36 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) DeleteWithData(path string, data map[string][]string) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.DeleteWithDataWithContext(context.Background(), path, data)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) DeleteWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Secret, error) {
|
|
|
|
ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
|
|
|
|
defer cancelFunc()
|
|
|
|
|
2022-03-24 20:58:03 +03:00
|
|
|
r := c.c.NewRequest(http.MethodDelete, "/v1/"+path)
|
2018-07-25 01:49:55 +03:00
|
|
|
|
2019-07-18 20:42:36 +03:00
|
|
|
var values url.Values
|
|
|
|
for k, v := range data {
|
|
|
|
if values == nil {
|
|
|
|
values = make(url.Values)
|
|
|
|
}
|
|
|
|
for _, val := range v {
|
|
|
|
values.Add(k, val)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if values != nil {
|
|
|
|
r.Params = values
|
|
|
|
}
|
|
|
|
|
2022-03-24 00:47:43 +03:00
|
|
|
resp, err := c.c.rawRequestWithContext(ctx, r)
|
2015-09-15 01:22:33 +03:00
|
|
|
if resp != nil {
|
|
|
|
defer resp.Body.Close()
|
|
|
|
}
|
2018-04-04 05:35:45 +03:00
|
|
|
if resp != nil && resp.StatusCode == 404 {
|
2018-04-04 11:41:46 +03:00
|
|
|
secret, parseErr := ParseSecret(resp.Body)
|
|
|
|
switch parseErr {
|
2018-04-04 05:35:45 +03:00
|
|
|
case nil:
|
|
|
|
case io.EOF:
|
|
|
|
return nil, nil
|
|
|
|
default:
|
2021-08-17 20:19:39 +03:00
|
|
|
return nil, parseErr
|
2018-04-04 05:35:45 +03:00
|
|
|
}
|
|
|
|
if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
|
2018-04-04 11:41:46 +03:00
|
|
|
return secret, err
|
2018-04-04 05:35:45 +03:00
|
|
|
}
|
|
|
|
}
|
2015-04-07 21:04:56 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2018-07-12 17:18:50 +03:00
|
|
|
return ParseSecret(resp.Body)
|
2015-04-07 21:04:56 +03:00
|
|
|
}
|
2016-05-28 00:01:42 +03:00
|
|
|
|
|
|
|
func (c *Logical) Unwrap(wrappingToken string) (*Secret, error) {
|
2022-03-24 00:47:43 +03:00
|
|
|
return c.UnwrapWithContext(context.Background(), wrappingToken)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Logical) UnwrapWithContext(ctx context.Context, wrappingToken string) (*Secret, error) {
|
|
|
|
ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
|
|
|
|
defer cancelFunc()
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
var data map[string]interface{}
|
2021-11-24 21:13:45 +03:00
|
|
|
wt := strings.TrimSpace(wrappingToken)
|
2016-11-08 19:36:15 +03:00
|
|
|
if wrappingToken != "" {
|
|
|
|
if c.c.Token() == "" {
|
2021-11-24 21:13:45 +03:00
|
|
|
c.c.SetToken(wt)
|
2016-11-08 19:36:15 +03:00
|
|
|
} else if wrappingToken != c.c.Token() {
|
|
|
|
data = map[string]interface{}{
|
2021-11-24 21:13:45 +03:00
|
|
|
"token": wt,
|
2016-11-08 19:36:15 +03:00
|
|
|
}
|
2016-09-29 07:01:28 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-03-24 20:58:03 +03:00
|
|
|
r := c.c.NewRequest(http.MethodPut, "/v1/sys/wrapping/unwrap")
|
2016-09-29 07:01:28 +03:00
|
|
|
if err := r.SetJSONBody(data); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2016-05-28 00:01:42 +03:00
|
|
|
|
2022-03-24 00:47:43 +03:00
|
|
|
resp, err := c.c.rawRequestWithContext(ctx, r)
|
2016-12-02 00:38:08 +03:00
|
|
|
if resp != nil {
|
|
|
|
defer resp.Body.Close()
|
|
|
|
}
|
2018-05-16 03:01:58 +03:00
|
|
|
if resp == nil || resp.StatusCode != 404 {
|
|
|
|
if err != nil {
|
Fix response wrapping from K/V version 2 (#4511)
This takes place in two parts, since working on this exposed an issue
with response wrapping when there is a raw body set. The changes are (in
diff order):
* A CurrentWrappingLookupFunc has been added to return the current
value. This is necessary for the lookahead call since we don't want the
lookahead call to be wrapped.
* Support for unwrapping < 0.6.2 tokens via the API/CLI has been
removed, because we now have backends returning 404s with data and can't
rely on the 404 trick. These can still be read manually via
cubbyhole/response.
* KV preflight version request now ensures that its calls is not
wrapped, and restores any given function after.
* When responding with a raw body, instead of always base64-decoding a
string value and erroring on failure, on failure we assume that it
simply wasn't a base64-encoded value and use it as is.
* A test that fails on master and works now that ensures that raw body
responses that are wrapped and then unwrapped return the expected
values.
* A flag for response data that indicates to the wrapping handling that
the data contained therein is already JSON decoded (more later).
* RespondWithStatusCode now defaults to a string so that the value is
HMAC'd during audit. The function always JSON encodes the body, so
before now it was always returning []byte which would skip HMACing. We
don't know what's in the data, so this is a "better safe than sorry"
issue. If different behavior is needed, backends can always manually
populate the data instead of relying on the helper function.
* We now check unwrapped data after unwrapping to see if there were raw
flags. If so, we try to detect whether the value can be unbase64'd. The
reason is that if it can it was probably originally a []byte and
shouldn't be audit HMAC'd; if not, it was probably originally a string
and should be. In either case, we then set the value as the raw body and
hit the flag indicating that it's already been JSON decoded so not to
try again before auditing. Doing it this way ensures the right typing.
* There is now a check to see if the data coming from unwrapping is
already JSON decoded and if so the decoding is skipped before setting
the audit response.
2018-05-10 22:40:03 +03:00
|
|
|
return nil, err
|
|
|
|
}
|
2018-05-16 03:01:58 +03:00
|
|
|
if resp == nil {
|
|
|
|
return nil, nil
|
Fix response wrapping from K/V version 2 (#4511)
This takes place in two parts, since working on this exposed an issue
with response wrapping when there is a raw body set. The changes are (in
diff order):
* A CurrentWrappingLookupFunc has been added to return the current
value. This is necessary for the lookahead call since we don't want the
lookahead call to be wrapped.
* Support for unwrapping < 0.6.2 tokens via the API/CLI has been
removed, because we now have backends returning 404s with data and can't
rely on the 404 trick. These can still be read manually via
cubbyhole/response.
* KV preflight version request now ensures that its calls is not
wrapped, and restores any given function after.
* When responding with a raw body, instead of always base64-decoding a
string value and erroring on failure, on failure we assume that it
simply wasn't a base64-encoded value and use it as is.
* A test that fails on master and works now that ensures that raw body
responses that are wrapped and then unwrapped return the expected
values.
* A flag for response data that indicates to the wrapping handling that
the data contained therein is already JSON decoded (more later).
* RespondWithStatusCode now defaults to a string so that the value is
HMAC'd during audit. The function always JSON encodes the body, so
before now it was always returning []byte which would skip HMACing. We
don't know what's in the data, so this is a "better safe than sorry"
issue. If different behavior is needed, backends can always manually
populate the data instead of relying on the helper function.
* We now check unwrapped data after unwrapping to see if there were raw
flags. If so, we try to detect whether the value can be unbase64'd. The
reason is that if it can it was probably originally a []byte and
shouldn't be audit HMAC'd; if not, it was probably originally a string
and should be. In either case, we then set the value as the raw body and
hit the flag indicating that it's already been JSON decoded so not to
try again before auditing. Doing it this way ensures the right typing.
* There is now a check to see if the data coming from unwrapping is
already JSON decoded and if so the decoding is skipped before setting
the audit response.
2018-05-10 22:40:03 +03:00
|
|
|
}
|
2018-05-16 03:01:58 +03:00
|
|
|
return ParseSecret(resp.Body)
|
|
|
|
}
|
|
|
|
|
|
|
|
// In the 404 case this may actually be a wrapped 404 error
|
|
|
|
secret, parseErr := ParseSecret(resp.Body)
|
|
|
|
switch parseErr {
|
|
|
|
case nil:
|
|
|
|
case io.EOF:
|
2016-09-29 07:01:28 +03:00
|
|
|
return nil, nil
|
2018-05-16 03:01:58 +03:00
|
|
|
default:
|
2021-08-17 20:19:39 +03:00
|
|
|
return nil, parseErr
|
2018-05-16 03:01:58 +03:00
|
|
|
}
|
|
|
|
if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
|
|
|
|
return secret, nil
|
2016-09-29 07:01:28 +03:00
|
|
|
}
|
2018-05-16 03:01:58 +03:00
|
|
|
|
|
|
|
// Otherwise this might be an old-style wrapping token so attempt the old
|
|
|
|
// method
|
|
|
|
if wrappingToken != "" {
|
|
|
|
origToken := c.c.Token()
|
|
|
|
defer c.c.SetToken(origToken)
|
|
|
|
c.c.SetToken(wrappingToken)
|
|
|
|
}
|
|
|
|
|
2022-05-10 23:30:05 +03:00
|
|
|
secret, err = c.ReadWithContext(ctx, wrappedResponseLocation)
|
2016-05-28 00:01:42 +03:00
|
|
|
if err != nil {
|
2018-05-16 03:01:58 +03:00
|
|
|
return nil, errwrap.Wrapf(fmt.Sprintf("error reading %q: {{err}}", wrappedResponseLocation), err)
|
|
|
|
}
|
|
|
|
if secret == nil {
|
|
|
|
return nil, fmt.Errorf("no value found at %q", wrappedResponseLocation)
|
|
|
|
}
|
|
|
|
if secret.Data == nil {
|
|
|
|
return nil, fmt.Errorf("\"data\" not found in wrapping response")
|
|
|
|
}
|
|
|
|
if _, ok := secret.Data["response"]; !ok {
|
|
|
|
return nil, fmt.Errorf("\"response\" not found in wrapping response \"data\" map")
|
2016-05-28 00:01:42 +03:00
|
|
|
}
|
|
|
|
|
2018-05-16 03:01:58 +03:00
|
|
|
wrappedSecret := new(Secret)
|
|
|
|
buf := bytes.NewBufferString(secret.Data["response"].(string))
|
2023-02-06 17:41:56 +03:00
|
|
|
dec := json.NewDecoder(buf)
|
|
|
|
dec.UseNumber()
|
|
|
|
if err := dec.Decode(wrappedSecret); err != nil {
|
2018-05-16 03:01:58 +03:00
|
|
|
return nil, errwrap.Wrapf("error unmarshalling wrapped secret: {{err}}", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return wrappedSecret, nil
|
2016-05-28 00:01:42 +03:00
|
|
|
}
|