2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2017-06-17 07:04:55 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
2018-01-19 09:44:44 +03:00
|
|
|
"context"
|
2017-06-17 07:04:55 +03:00
|
|
|
"errors"
|
2021-05-11 20:12:54 +03:00
|
|
|
"fmt"
|
2017-06-17 07:04:55 +03:00
|
|
|
"sync"
|
2017-06-17 08:26:25 +03:00
|
|
|
"sync/atomic"
|
2017-06-17 07:04:55 +03:00
|
|
|
|
2021-07-16 03:17:31 +03:00
|
|
|
"github.com/hashicorp/go-secure-stdlib/strutil"
|
2019-04-13 00:54:35 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2017-06-17 07:04:55 +03:00
|
|
|
)
|
|
|
|
|
2017-06-17 08:26:25 +03:00
|
|
|
const (
|
|
|
|
CORSDisabled uint32 = iota
|
|
|
|
CORSEnabled
|
|
|
|
)
|
2017-06-17 07:04:55 +03:00
|
|
|
|
2017-08-07 22:02:08 +03:00
|
|
|
var StdAllowedHeaders = []string{
|
2017-08-07 17:03:30 +03:00
|
|
|
"Content-Type",
|
|
|
|
"X-Requested-With",
|
|
|
|
"X-Vault-MFA",
|
|
|
|
"X-Vault-No-Request-Forwarding",
|
|
|
|
"X-Vault-Wrap-Format",
|
|
|
|
"X-Vault-Wrap-TTL",
|
2017-10-23 23:03:36 +03:00
|
|
|
"X-Vault-Policy-Override",
|
2018-10-01 20:33:21 +03:00
|
|
|
"Authorization",
|
2018-09-25 19:34:40 +03:00
|
|
|
consts.AuthHeaderName,
|
2017-08-07 17:03:30 +03:00
|
|
|
}
|
|
|
|
|
2017-06-17 07:04:55 +03:00
|
|
|
// CORSConfig stores the state of the CORS configuration.
|
|
|
|
type CORSConfig struct {
|
2017-06-17 08:26:25 +03:00
|
|
|
sync.RWMutex `json:"-"`
|
|
|
|
core *Core
|
2018-06-09 22:35:22 +03:00
|
|
|
Enabled *uint32 `json:"enabled"`
|
2017-06-17 08:26:25 +03:00
|
|
|
AllowedOrigins []string `json:"allowed_origins,omitempty"`
|
2017-08-07 17:03:30 +03:00
|
|
|
AllowedHeaders []string `json:"allowed_headers,omitempty"`
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *Core) saveCORSConfig(ctx context.Context) error {
|
2017-06-17 07:04:55 +03:00
|
|
|
view := c.systemBarrierView.SubView("config/")
|
|
|
|
|
2018-06-09 22:35:22 +03:00
|
|
|
enabled := atomic.LoadUint32(c.corsConfig.Enabled)
|
2017-06-17 08:26:25 +03:00
|
|
|
localConfig := &CORSConfig{
|
2018-06-09 22:35:22 +03:00
|
|
|
Enabled: &enabled,
|
2017-06-17 08:26:25 +03:00
|
|
|
}
|
|
|
|
c.corsConfig.RLock()
|
|
|
|
localConfig.AllowedOrigins = c.corsConfig.AllowedOrigins
|
2017-08-07 17:03:30 +03:00
|
|
|
localConfig.AllowedHeaders = c.corsConfig.AllowedHeaders
|
2017-06-17 08:26:25 +03:00
|
|
|
c.corsConfig.RUnlock()
|
|
|
|
|
|
|
|
entry, err := logical.StorageEntryJSON("cors", localConfig)
|
2017-06-17 07:04:55 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to create CORS config entry: %w", err)
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
if err := view.Put(ctx, entry); err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to save CORS config: %w", err)
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-06-17 08:26:25 +03:00
|
|
|
// This should only be called with the core state lock held for writing
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *Core) loadCORSConfig(ctx context.Context) error {
|
2017-06-17 07:04:55 +03:00
|
|
|
view := c.systemBarrierView.SubView("config/")
|
|
|
|
|
|
|
|
// Load the config in
|
2018-01-19 09:44:44 +03:00
|
|
|
out, err := view.Get(ctx, "cors")
|
2017-06-17 07:04:55 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to read CORS config: %w", err)
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
if out == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-06-17 08:26:25 +03:00
|
|
|
newConfig := new(CORSConfig)
|
|
|
|
err = out.DecodeJSON(newConfig)
|
2017-06-17 07:04:55 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2018-06-09 23:57:57 +03:00
|
|
|
|
|
|
|
if newConfig.Enabled == nil {
|
|
|
|
newConfig.Enabled = new(uint32)
|
|
|
|
}
|
|
|
|
|
2017-06-17 08:26:25 +03:00
|
|
|
newConfig.core = c
|
|
|
|
|
|
|
|
c.corsConfig = newConfig
|
2017-06-17 07:04:55 +03:00
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2018-03-20 21:54:10 +03:00
|
|
|
// Enable takes either a '*' or a comma-separated list of URLs that can make
|
2017-06-17 07:04:55 +03:00
|
|
|
// cross-origin requests to Vault.
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *CORSConfig) Enable(ctx context.Context, urls []string, headers []string) error {
|
2017-06-17 07:04:55 +03:00
|
|
|
if len(urls) == 0 {
|
2018-04-09 21:35:21 +03:00
|
|
|
return errors.New("at least one origin or the wildcard must be provided")
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if strutil.StrListContains(urls, "*") && len(urls) > 1 {
|
|
|
|
return errors.New("to allow all origins the '*' must be the only value for allowed_origins")
|
|
|
|
}
|
|
|
|
|
|
|
|
c.Lock()
|
|
|
|
c.AllowedOrigins = urls
|
2017-08-07 17:03:30 +03:00
|
|
|
|
|
|
|
// Start with the standard headers to Vault accepts.
|
2019-02-11 21:10:26 +03:00
|
|
|
c.AllowedHeaders = append([]string{}, StdAllowedHeaders...)
|
2017-08-07 17:03:30 +03:00
|
|
|
|
|
|
|
// Allow the user to add additional headers to the list of
|
|
|
|
// headers allowed on cross-origin requests.
|
|
|
|
if len(headers) > 0 {
|
|
|
|
c.AllowedHeaders = append(c.AllowedHeaders, headers...)
|
|
|
|
}
|
2017-06-17 08:26:25 +03:00
|
|
|
c.Unlock()
|
2017-06-17 07:04:55 +03:00
|
|
|
|
2018-06-09 22:35:22 +03:00
|
|
|
atomic.StoreUint32(c.Enabled, CORSEnabled)
|
2017-06-17 08:26:25 +03:00
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
return c.core.saveCORSConfig(ctx)
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// IsEnabled returns the value of CORSConfig.isEnabled
|
|
|
|
func (c *CORSConfig) IsEnabled() bool {
|
2018-06-09 22:35:22 +03:00
|
|
|
return atomic.LoadUint32(c.Enabled) == CORSEnabled
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
|
2017-08-07 17:03:30 +03:00
|
|
|
// Disable sets CORS to disabled and clears the allowed origins & headers.
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *CORSConfig) Disable(ctx context.Context) error {
|
2018-06-09 22:35:22 +03:00
|
|
|
atomic.StoreUint32(c.Enabled, CORSDisabled)
|
2017-06-17 07:04:55 +03:00
|
|
|
c.Lock()
|
2017-08-07 17:03:30 +03:00
|
|
|
|
|
|
|
c.AllowedOrigins = nil
|
|
|
|
c.AllowedHeaders = nil
|
|
|
|
|
2017-06-17 08:26:25 +03:00
|
|
|
c.Unlock()
|
2017-08-07 17:03:30 +03:00
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
return c.core.saveCORSConfig(ctx)
|
2017-06-17 07:04:55 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// IsValidOrigin determines if the origin of the request is allowed to make
|
|
|
|
// cross-origin requests based on the CORSConfig.
|
|
|
|
func (c *CORSConfig) IsValidOrigin(origin string) bool {
|
2017-06-17 08:26:25 +03:00
|
|
|
// If we aren't enabling CORS then all origins are valid
|
|
|
|
if !c.IsEnabled() {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2017-06-17 07:04:55 +03:00
|
|
|
c.RLock()
|
|
|
|
defer c.RUnlock()
|
|
|
|
|
2017-06-17 08:26:25 +03:00
|
|
|
if len(c.AllowedOrigins) == 0 {
|
2017-06-17 07:04:55 +03:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(c.AllowedOrigins) == 1 && (c.AllowedOrigins)[0] == "*" {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
return strutil.StrListContains(c.AllowedOrigins, origin)
|
|
|
|
}
|