2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2015-09-04 23:58:12 +03:00
|
|
|
package vault
|
|
|
|
|
2016-01-07 23:10:05 +03:00
|
|
|
import (
|
2018-01-08 21:31:38 +03:00
|
|
|
"context"
|
2017-04-25 04:31:27 +03:00
|
|
|
"fmt"
|
2016-01-07 23:10:05 +03:00
|
|
|
"time"
|
|
|
|
|
2020-01-06 21:16:52 +03:00
|
|
|
"github.com/hashicorp/vault/helper/identity"
|
2019-04-13 10:44:06 +03:00
|
|
|
"github.com/hashicorp/vault/helper/namespace"
|
2020-06-17 23:24:38 +03:00
|
|
|
"github.com/hashicorp/vault/helper/random"
|
2019-04-13 00:54:35 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
|
|
|
"github.com/hashicorp/vault/sdk/helper/license"
|
|
|
|
"github.com/hashicorp/vault/sdk/helper/pluginutil"
|
|
|
|
"github.com/hashicorp/vault/sdk/helper/wrapping"
|
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2022-12-07 21:29:51 +03:00
|
|
|
"github.com/hashicorp/vault/version"
|
2016-01-07 23:10:05 +03:00
|
|
|
)
|
2015-09-04 23:58:12 +03:00
|
|
|
|
2019-06-11 23:13:03 +03:00
|
|
|
type ctxKeyForwardedRequestMountAccessor struct{}
|
|
|
|
|
|
|
|
func (c ctxKeyForwardedRequestMountAccessor) String() string {
|
|
|
|
return "forwarded-req-mount-accessor"
|
|
|
|
}
|
|
|
|
|
2015-09-04 23:58:12 +03:00
|
|
|
type dynamicSystemView struct {
|
2022-10-05 15:56:36 +03:00
|
|
|
core *Core
|
|
|
|
mountEntry *MountEntry
|
|
|
|
perfStandby bool
|
2015-09-04 23:58:12 +03:00
|
|
|
}
|
|
|
|
|
2019-08-26 17:23:46 +03:00
|
|
|
type extendedSystemView interface {
|
|
|
|
logical.SystemView
|
|
|
|
logical.ExtendedSystemView
|
|
|
|
// SudoPrivilege won't work over the plugin system so we keep it here
|
|
|
|
// instead of in sdk/logical to avoid exposing to plugins
|
|
|
|
SudoPrivilege(context.Context, string, string) bool
|
|
|
|
}
|
|
|
|
|
|
|
|
type extendedSystemViewImpl struct {
|
2019-05-23 01:52:53 +03:00
|
|
|
dynamicSystemView
|
|
|
|
}
|
|
|
|
|
2019-08-26 17:23:46 +03:00
|
|
|
func (e extendedSystemViewImpl) Auditor() logical.Auditor {
|
2019-05-23 01:52:53 +03:00
|
|
|
return genericAuditor{
|
|
|
|
mountType: e.mountEntry.Type,
|
|
|
|
namespace: e.mountEntry.Namespace(),
|
|
|
|
c: e.core,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-08-26 17:23:46 +03:00
|
|
|
func (e extendedSystemViewImpl) ForwardGenericRequest(ctx context.Context, req *logical.Request) (*logical.Response, error) {
|
2019-06-11 23:13:03 +03:00
|
|
|
// Forward the request if allowed
|
|
|
|
if couldForward(e.core) {
|
|
|
|
ctx = namespace.ContextWithNamespace(ctx, e.mountEntry.Namespace())
|
2021-02-24 14:58:10 +03:00
|
|
|
ctx = logical.IndexStateContext(ctx, &logical.WALState{})
|
2019-06-11 23:13:03 +03:00
|
|
|
ctx = context.WithValue(ctx, ctxKeyForwardedRequestMountAccessor{}, e.mountEntry.Accessor)
|
|
|
|
return forward(ctx, e.core, req)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil, logical.ErrReadOnly
|
|
|
|
}
|
|
|
|
|
2019-08-26 17:23:46 +03:00
|
|
|
// SudoPrivilege returns true if given path has sudo privileges
|
|
|
|
// for the given client token
|
|
|
|
func (e extendedSystemViewImpl) SudoPrivilege(ctx context.Context, path string, token string) bool {
|
2015-09-21 17:04:03 +03:00
|
|
|
// Resolve the token policy
|
2019-08-26 17:23:46 +03:00
|
|
|
te, err := e.core.tokenStore.Lookup(ctx, token)
|
2015-09-19 02:59:06 +03:00
|
|
|
if err != nil {
|
2021-11-17 19:21:54 +03:00
|
|
|
e.core.logger.Error("failed to lookup sudo token", "error", err)
|
2015-09-19 02:59:06 +03:00
|
|
|
return false
|
|
|
|
}
|
2015-09-21 17:04:03 +03:00
|
|
|
|
|
|
|
// Ensure the token is valid
|
|
|
|
if te == nil {
|
2019-08-26 17:23:46 +03:00
|
|
|
e.core.logger.Error("entry not found for given token")
|
2015-09-21 17:04:03 +03:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2021-10-07 20:36:22 +03:00
|
|
|
policyNames := make(map[string][]string)
|
2018-09-18 06:03:00 +03:00
|
|
|
// Add token policies
|
2021-10-07 20:36:22 +03:00
|
|
|
policyNames[te.NamespaceID] = append(policyNames[te.NamespaceID], te.Policies...)
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2019-08-26 17:23:46 +03:00
|
|
|
tokenNS, err := NamespaceByID(ctx, te.NamespaceID, e.core)
|
2018-09-18 06:03:00 +03:00
|
|
|
if err != nil {
|
2019-08-26 17:23:46 +03:00
|
|
|
e.core.logger.Error("failed to lookup token namespace", "error", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
if tokenNS == nil {
|
2019-08-26 17:23:46 +03:00
|
|
|
e.core.logger.Error("failed to lookup token namespace", "error", namespace.ErrNoNamespace)
|
2018-09-18 06:03:00 +03:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// Add identity policies from all the namespaces
|
2021-10-07 20:36:22 +03:00
|
|
|
entity, identityPolicies, err := e.core.fetchEntityAndDerivedPolicies(ctx, tokenNS, te.EntityID, te.NoIdentityPolicies)
|
2018-08-15 21:42:56 +03:00
|
|
|
if err != nil {
|
2019-08-26 17:23:46 +03:00
|
|
|
e.core.logger.Error("failed to fetch identity policies", "error", err)
|
2018-08-15 21:42:56 +03:00
|
|
|
return false
|
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
for nsID, nsPolicies := range identityPolicies {
|
2021-10-07 20:36:22 +03:00
|
|
|
policyNames[nsID] = append(policyNames[nsID], nsPolicies...)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
2018-08-15 21:42:56 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
tokenCtx := namespace.ContextWithNamespace(ctx, tokenNS)
|
|
|
|
|
2021-10-07 20:36:22 +03:00
|
|
|
// Add the inline policy if it's set
|
|
|
|
policies := make([]*Policy, 0)
|
|
|
|
if te.InlinePolicy != "" {
|
|
|
|
inlinePolicy, err := ParseACLPolicy(tokenNS, te.InlinePolicy)
|
|
|
|
if err != nil {
|
|
|
|
e.core.logger.Error("failed to parse the token's inline policy", "error", err)
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
policies = append(policies, inlinePolicy)
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
// Construct the corresponding ACL object. Derive and use a new context that
|
|
|
|
// uses the req.ClientToken's namespace
|
2021-10-07 20:36:22 +03:00
|
|
|
acl, err := e.core.policyStore.ACL(tokenCtx, entity, policyNames, policies...)
|
2015-09-21 17:04:03 +03:00
|
|
|
if err != nil {
|
2019-08-26 17:23:46 +03:00
|
|
|
e.core.logger.Error("failed to retrieve ACL for token's policies", "token_policies", te.Policies, "error", err)
|
2015-09-21 17:04:03 +03:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2016-01-07 23:10:05 +03:00
|
|
|
// The operation type isn't important here as this is run from a path the
|
|
|
|
// user has already been given access to; we only care about whether they
|
2019-08-05 23:03:47 +03:00
|
|
|
// have sudo. Note that we use root context because the path that comes in
|
|
|
|
// must be fully-qualified already so we don't want AllowOperation to
|
|
|
|
// prepend a namespace prefix onto it.
|
2017-01-20 03:54:08 +03:00
|
|
|
req := new(logical.Request)
|
|
|
|
req.Operation = logical.ReadOperation
|
|
|
|
req.Path = path
|
2019-08-05 23:03:47 +03:00
|
|
|
authResults := acl.AllowOperation(namespace.RootContext(ctx), req, true)
|
2017-10-23 23:03:36 +03:00
|
|
|
return authResults.RootPrivs
|
2015-09-19 02:59:06 +03:00
|
|
|
}
|
|
|
|
|
2023-07-31 20:57:29 +03:00
|
|
|
func (e extendedSystemViewImpl) APILockShouldBlockRequest() (bool, error) {
|
|
|
|
mountEntry := e.mountEntry
|
|
|
|
if mountEntry == nil {
|
|
|
|
return false, fmt.Errorf("no mount entry")
|
|
|
|
}
|
|
|
|
ns := mountEntry.Namespace()
|
|
|
|
|
|
|
|
if err := enterpriseBlockRequestIfError(e.core, ns.Path, mountEntry.Path); err != nil {
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
2019-08-26 17:23:46 +03:00
|
|
|
func (d dynamicSystemView) DefaultLeaseTTL() time.Duration {
|
|
|
|
def, _ := d.fetchTTLs()
|
|
|
|
return def
|
|
|
|
}
|
|
|
|
|
|
|
|
func (d dynamicSystemView) MaxLeaseTTL() time.Duration {
|
|
|
|
_, max := d.fetchTTLs()
|
|
|
|
return max
|
|
|
|
}
|
|
|
|
|
2015-09-04 23:58:12 +03:00
|
|
|
// TTLsByPath returns the default and max TTLs corresponding to a particular
|
|
|
|
// mount point, or the system default
|
2015-09-10 22:09:34 +03:00
|
|
|
func (d dynamicSystemView) fetchTTLs() (def, max time.Duration) {
|
2015-09-04 23:58:12 +03:00
|
|
|
def = d.core.defaultLeaseTTL
|
|
|
|
max = d.core.maxLeaseTTL
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
if d.mountEntry != nil {
|
|
|
|
if d.mountEntry.Config.DefaultLeaseTTL != 0 {
|
|
|
|
def = d.mountEntry.Config.DefaultLeaseTTL
|
|
|
|
}
|
|
|
|
if d.mountEntry.Config.MaxLeaseTTL != 0 {
|
|
|
|
max = d.mountEntry.Config.MaxLeaseTTL
|
|
|
|
}
|
2015-09-04 23:58:12 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return
|
|
|
|
}
|
2016-01-23 01:01:22 +03:00
|
|
|
|
|
|
|
// Tainted indicates that the mount is in the process of being removed
|
|
|
|
func (d dynamicSystemView) Tainted() bool {
|
|
|
|
return d.mountEntry.Tainted
|
|
|
|
}
|
2016-04-21 16:52:42 +03:00
|
|
|
|
2016-04-21 23:32:06 +03:00
|
|
|
// CachingDisabled indicates whether to use caching behavior
|
|
|
|
func (d dynamicSystemView) CachingDisabled() bool {
|
2017-03-08 17:20:09 +03:00
|
|
|
return d.core.cachingDisabled || (d.mountEntry != nil && d.mountEntry.Config.ForceNoCache)
|
2016-04-21 16:52:42 +03:00
|
|
|
}
|
2017-01-12 23:13:47 +03:00
|
|
|
|
2018-02-03 02:17:12 +03:00
|
|
|
func (d dynamicSystemView) LocalMount() bool {
|
|
|
|
return d.mountEntry != nil && d.mountEntry.Local
|
|
|
|
}
|
|
|
|
|
2017-09-05 02:38:37 +03:00
|
|
|
// Checks if this is a primary Vault instance. Caller should hold the stateLock
|
|
|
|
// in read mode.
|
2017-02-16 21:37:21 +03:00
|
|
|
func (d dynamicSystemView) ReplicationState() consts.ReplicationState {
|
2018-09-18 06:03:00 +03:00
|
|
|
state := d.core.ReplicationState()
|
2022-10-05 15:56:36 +03:00
|
|
|
if d.perfStandby {
|
2018-09-18 06:03:00 +03:00
|
|
|
state |= consts.ReplicationPerformanceStandby
|
|
|
|
}
|
|
|
|
return state
|
|
|
|
}
|
|
|
|
|
|
|
|
func (d dynamicSystemView) HasFeature(feature license.Features) bool {
|
|
|
|
return d.core.HasFeature(feature)
|
2017-01-12 23:13:47 +03:00
|
|
|
}
|
2017-03-16 03:14:48 +03:00
|
|
|
|
|
|
|
// ResponseWrapData wraps the given data in a cubbyhole and returns the
|
|
|
|
// token used to unwrap.
|
2018-01-19 09:44:44 +03:00
|
|
|
func (d dynamicSystemView) ResponseWrapData(ctx context.Context, data map[string]interface{}, ttl time.Duration, jwt bool) (*wrapping.ResponseWrapInfo, error) {
|
2017-03-16 03:14:48 +03:00
|
|
|
req := &logical.Request{
|
|
|
|
Operation: logical.CreateOperation,
|
2017-04-24 22:15:01 +03:00
|
|
|
Path: "sys/wrapping/wrap",
|
2017-03-16 03:14:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
resp := &logical.Response{
|
2017-04-24 22:15:01 +03:00
|
|
|
WrapInfo: &wrapping.ResponseWrapInfo{
|
2017-03-16 03:14:48 +03:00
|
|
|
TTL: ttl,
|
|
|
|
},
|
|
|
|
Data: data,
|
|
|
|
}
|
|
|
|
|
|
|
|
if jwt {
|
|
|
|
resp.WrapInfo.Format = "jwt"
|
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
_, err := d.core.wrapInCubbyhole(ctx, req, resp, nil)
|
2017-03-16 03:14:48 +03:00
|
|
|
if err != nil {
|
2017-04-24 22:15:01 +03:00
|
|
|
return nil, err
|
2017-03-16 03:14:48 +03:00
|
|
|
}
|
|
|
|
|
2017-04-24 22:15:01 +03:00
|
|
|
return resp.WrapInfo, nil
|
2017-03-16 03:14:48 +03:00
|
|
|
}
|
2017-04-04 03:52:29 +03:00
|
|
|
|
2022-02-17 17:50:33 +03:00
|
|
|
func (d dynamicSystemView) NewPluginClient(ctx context.Context, config pluginutil.PluginClientConfig) (pluginutil.PluginClient, error) {
|
|
|
|
if d.core == nil {
|
|
|
|
return nil, fmt.Errorf("system view core is nil")
|
|
|
|
}
|
|
|
|
if d.core.pluginCatalog == nil {
|
|
|
|
return nil, fmt.Errorf("system view core plugin catalog is nil")
|
|
|
|
}
|
|
|
|
|
|
|
|
c, err := d.core.pluginCatalog.NewPluginClient(ctx, config)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return c, nil
|
|
|
|
}
|
|
|
|
|
2017-04-11 03:12:52 +03:00
|
|
|
// LookupPlugin looks for a plugin with the given name in the plugin catalog. It
|
|
|
|
// returns a PluginRunner or an error if no plugin was found.
|
2018-11-07 04:21:24 +03:00
|
|
|
func (d dynamicSystemView) LookupPlugin(ctx context.Context, name string, pluginType consts.PluginType) (*pluginutil.PluginRunner, error) {
|
2022-08-31 21:23:05 +03:00
|
|
|
return d.LookupPluginVersion(ctx, name, pluginType, "")
|
|
|
|
}
|
|
|
|
|
|
|
|
// LookupPluginVersion looks for a plugin with the given name and version in the plugin catalog. It
|
|
|
|
// returns a PluginRunner or an error if no plugin was found.
|
|
|
|
func (d dynamicSystemView) LookupPluginVersion(ctx context.Context, name string, pluginType consts.PluginType, version string) (*pluginutil.PluginRunner, error) {
|
2017-08-16 05:10:32 +03:00
|
|
|
if d.core == nil {
|
|
|
|
return nil, fmt.Errorf("system view core is nil")
|
|
|
|
}
|
|
|
|
if d.core.pluginCatalog == nil {
|
|
|
|
return nil, fmt.Errorf("system view core plugin catalog is nil")
|
|
|
|
}
|
2022-08-31 21:23:05 +03:00
|
|
|
r, err := d.core.pluginCatalog.Get(ctx, name, pluginType, version)
|
2017-04-25 04:31:27 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if r == nil {
|
2022-09-09 19:32:28 +03:00
|
|
|
errContext := name
|
|
|
|
if version != "" {
|
|
|
|
errContext += fmt.Sprintf(", version=%s", version)
|
|
|
|
}
|
|
|
|
return nil, fmt.Errorf("%w: %s", ErrPluginNotFound, errContext)
|
2017-04-25 04:31:27 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return r, nil
|
2017-04-04 03:52:29 +03:00
|
|
|
}
|
2017-04-11 03:12:52 +03:00
|
|
|
|
2022-09-09 19:32:28 +03:00
|
|
|
// ListVersionedPlugins returns information about all plugins of a certain
|
|
|
|
// typein the catalog, including any versioning information stored for them.
|
|
|
|
func (d dynamicSystemView) ListVersionedPlugins(ctx context.Context, pluginType consts.PluginType) ([]pluginutil.VersionedPlugin, error) {
|
|
|
|
if d.core == nil {
|
|
|
|
return nil, fmt.Errorf("system view core is nil")
|
|
|
|
}
|
|
|
|
if d.core.pluginCatalog == nil {
|
|
|
|
return nil, fmt.Errorf("system view core plugin catalog is nil")
|
|
|
|
}
|
|
|
|
return d.core.pluginCatalog.ListVersionedPlugins(ctx, pluginType)
|
|
|
|
}
|
|
|
|
|
2017-04-24 22:21:49 +03:00
|
|
|
// MlockEnabled returns the configuration setting for enabling mlock on plugins.
|
|
|
|
func (d dynamicSystemView) MlockEnabled() bool {
|
|
|
|
return d.core.enableMlock
|
2017-04-11 03:12:52 +03:00
|
|
|
}
|
2018-06-04 03:48:12 +03:00
|
|
|
|
|
|
|
func (d dynamicSystemView) EntityInfo(entityID string) (*logical.Entity, error) {
|
|
|
|
// Requests from token created from the token backend will not have entity information.
|
|
|
|
// Return missing entity instead of error when requesting from MemDB.
|
|
|
|
if entityID == "" {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.core == nil {
|
|
|
|
return nil, fmt.Errorf("system view core is nil")
|
|
|
|
}
|
|
|
|
if d.core.identityStore == nil {
|
|
|
|
return nil, fmt.Errorf("system view identity store is nil")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Retrieve the entity from MemDB
|
|
|
|
entity, err := d.core.identityStore.MemDBEntityByID(entityID, false)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if entity == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2018-07-23 19:45:06 +03:00
|
|
|
// Return a subset of the data
|
|
|
|
ret := &logical.Entity{
|
2019-05-29 00:31:50 +03:00
|
|
|
ID: entity.ID,
|
|
|
|
Name: entity.Name,
|
|
|
|
Disabled: entity.Disabled,
|
2018-07-23 19:45:06 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if entity.Metadata != nil {
|
|
|
|
ret.Metadata = make(map[string]string, len(entity.Metadata))
|
|
|
|
for k, v := range entity.Metadata {
|
|
|
|
ret.Metadata[k] = v
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-01-06 21:16:52 +03:00
|
|
|
aliases := make([]*logical.Alias, 0, len(entity.Aliases))
|
|
|
|
for _, a := range entity.Aliases {
|
|
|
|
|
|
|
|
// Don't return aliases from other namespaces
|
|
|
|
if a.NamespaceID != d.mountEntry.NamespaceID {
|
|
|
|
continue
|
2018-06-04 03:48:12 +03:00
|
|
|
}
|
2020-01-06 21:16:52 +03:00
|
|
|
|
|
|
|
alias := identity.ToSDKAlias(a)
|
|
|
|
|
2018-06-04 03:48:12 +03:00
|
|
|
// MountType is not stored with the entity and must be looked up
|
2021-08-30 22:31:11 +03:00
|
|
|
if mount := d.core.router.ValidateMountByAccessor(a.MountAccessor); mount != nil {
|
2018-07-23 19:45:06 +03:00
|
|
|
alias.MountType = mount.MountType
|
|
|
|
}
|
|
|
|
|
2020-01-06 21:16:52 +03:00
|
|
|
aliases = append(aliases, alias)
|
2018-06-04 03:48:12 +03:00
|
|
|
}
|
2018-07-23 19:45:06 +03:00
|
|
|
ret.Aliases = aliases
|
2018-06-04 03:48:12 +03:00
|
|
|
|
2018-07-23 19:45:06 +03:00
|
|
|
return ret, nil
|
2018-06-04 03:48:12 +03:00
|
|
|
}
|
2018-08-03 19:32:17 +03:00
|
|
|
|
2020-01-06 21:16:52 +03:00
|
|
|
func (d dynamicSystemView) GroupsForEntity(entityID string) ([]*logical.Group, error) {
|
|
|
|
// Requests from token created from the token backend will not have entity information.
|
|
|
|
// Return missing entity instead of error when requesting from MemDB.
|
|
|
|
if entityID == "" {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.core == nil {
|
|
|
|
return nil, fmt.Errorf("system view core is nil")
|
|
|
|
}
|
|
|
|
if d.core.identityStore == nil {
|
|
|
|
return nil, fmt.Errorf("system view identity store is nil")
|
|
|
|
}
|
|
|
|
|
|
|
|
groups, inheritedGroups, err := d.core.identityStore.groupsByEntityID(entityID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
groups = append(groups, inheritedGroups...)
|
|
|
|
|
|
|
|
logicalGroups := make([]*logical.Group, 0, len(groups))
|
|
|
|
for _, g := range groups {
|
|
|
|
// Don't return groups from other namespaces
|
|
|
|
if g.NamespaceID != d.mountEntry.NamespaceID {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
logicalGroups = append(logicalGroups, identity.ToSDKGroup(g))
|
|
|
|
}
|
|
|
|
|
|
|
|
return logicalGroups, nil
|
|
|
|
}
|
|
|
|
|
2018-08-03 19:32:17 +03:00
|
|
|
func (d dynamicSystemView) PluginEnv(_ context.Context) (*logical.PluginEnvironment, error) {
|
2022-04-05 08:31:01 +03:00
|
|
|
v := version.GetVersion()
|
2018-08-03 19:32:17 +03:00
|
|
|
return &logical.PluginEnvironment{
|
2022-04-05 08:31:01 +03:00
|
|
|
VaultVersion: v.Version,
|
|
|
|
VaultVersionPrerelease: v.VersionPrerelease,
|
|
|
|
VaultVersionMetadata: v.VersionMetadata,
|
2018-08-03 19:32:17 +03:00
|
|
|
}, nil
|
|
|
|
}
|
2020-05-27 21:28:00 +03:00
|
|
|
|
2022-12-07 21:29:51 +03:00
|
|
|
func (d dynamicSystemView) VaultVersion(_ context.Context) (string, error) {
|
|
|
|
return version.GetVersion().Version, nil
|
|
|
|
}
|
|
|
|
|
2020-05-27 21:28:00 +03:00
|
|
|
func (d dynamicSystemView) GeneratePasswordFromPolicy(ctx context.Context, policyName string) (password string, err error) {
|
|
|
|
if policyName == "" {
|
|
|
|
return "", fmt.Errorf("missing password policy name")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure there's a timeout on the context of some sort
|
|
|
|
if _, hasTimeout := ctx.Deadline(); !hasTimeout {
|
|
|
|
var cancel func()
|
2021-05-13 16:55:46 +03:00
|
|
|
ctx, cancel = context.WithTimeout(ctx, 1*time.Second)
|
2020-05-27 21:28:00 +03:00
|
|
|
defer cancel()
|
|
|
|
}
|
|
|
|
|
2021-09-27 19:08:07 +03:00
|
|
|
ctx = namespace.ContextWithNamespace(ctx, d.mountEntry.Namespace())
|
|
|
|
|
2021-05-13 16:55:46 +03:00
|
|
|
policyCfg, err := d.retrievePasswordPolicy(ctx, policyName)
|
2020-05-27 21:28:00 +03:00
|
|
|
if err != nil {
|
|
|
|
return "", fmt.Errorf("failed to retrieve password policy: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if policyCfg == nil {
|
|
|
|
return "", fmt.Errorf("no password policy found")
|
|
|
|
}
|
|
|
|
|
|
|
|
passPolicy, err := random.ParsePolicy(policyCfg.HCLPolicy)
|
|
|
|
if err != nil {
|
|
|
|
return "", fmt.Errorf("stored password policy is invalid: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return passPolicy.Generate(ctx, nil)
|
|
|
|
}
|
Add path based primary write forwarding (PBPWF) - OSS (#18735)
* Add WriteForwardedStorage to sdk's plugin, logical in OSS
This should allow backends to specify paths to forward write
(storage.Put(...) and storage.Delete(...)) operations for.
Notably, these semantics are subject to change and shouldn't yet be
relied on.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Collect paths for write forwarding in OSS
This adds a path manager to Core, allowing tracking across all Vault
versions of paths which could use write forwarding if available. In
particular, even on OSS offerings, we'll need to template {{clusterId}}
into the paths, in the event of later upgrading to Enterprise. If we
didn't, we'd end up writing paths which will no longer be accessible
post-migration, due to write forwarding now replacing the sentinel with
the actual cluster identifier.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add forwarded writer implementation to OSS
Here, for paths given to us, we determine if we need to do cluster
translation and perform local writing. This is the OSS variant.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Wire up mount-specific request forwarding in OSS
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Clarify that state lock needs to be held to call HAState in OSS
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Move cluster sentinel constant to sdk/logical
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Expose ClusterID to Plugins via SystemView
This will let plugins learn what the Cluster's ID is, without having to
resort to hacks like writing a random string to its cluster-prefixed
namespace and then reading it once it has replicated.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add GRPC ClusterID implementation
For any external plugins which wish to use it.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
2023-01-21 00:36:18 +03:00
|
|
|
|
|
|
|
func (d dynamicSystemView) ClusterID(ctx context.Context) (string, error) {
|
|
|
|
clusterInfo, err := d.core.Cluster(ctx)
|
|
|
|
if err != nil || clusterInfo.ID == "" {
|
|
|
|
return "", fmt.Errorf("unable to retrieve cluster info or empty ID: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return clusterInfo.ID, nil
|
|
|
|
}
|