2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2016-01-09 05:21:02 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
|
|
|
"bytes"
|
2018-01-19 09:44:44 +03:00
|
|
|
"context"
|
2016-01-09 05:21:02 +03:00
|
|
|
"encoding/base64"
|
2019-10-15 07:55:31 +03:00
|
|
|
"errors"
|
2016-01-09 05:21:02 +03:00
|
|
|
"fmt"
|
2019-10-18 21:46:00 +03:00
|
|
|
|
2019-10-15 07:55:31 +03:00
|
|
|
"github.com/hashicorp/go-uuid"
|
2016-01-09 05:21:02 +03:00
|
|
|
"github.com/hashicorp/vault/helper/pgpkeys"
|
2019-04-13 10:44:06 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
2021-12-01 16:05:49 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/roottoken"
|
2016-01-09 05:21:02 +03:00
|
|
|
"github.com/hashicorp/vault/shamir"
|
|
|
|
)
|
|
|
|
|
2017-11-10 21:19:42 +03:00
|
|
|
const coreDROperationTokenPath = "core/dr-operation-token"
|
|
|
|
|
|
|
|
var (
|
|
|
|
// GenerateStandardRootTokenStrategy is the strategy used to generate a
|
|
|
|
// typical root token
|
|
|
|
GenerateStandardRootTokenStrategy GenerateRootStrategy = generateStandardRootToken{}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
// GenerateDROperationTokenStrategy is the strategy used to generate a
|
|
|
|
// DR operational token
|
|
|
|
GenerateDROperationTokenStrategy GenerateRootStrategy = generateStandardRootToken{}
|
2017-11-10 21:19:42 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
// GenerateRootStrategy allows us to swap out the strategy we want to use to
|
|
|
|
// create a token upon completion of the generate root process.
|
|
|
|
type GenerateRootStrategy interface {
|
2018-01-19 09:44:44 +03:00
|
|
|
generate(context.Context, *Core) (string, func(), error)
|
2019-10-23 19:52:28 +03:00
|
|
|
authenticate(context.Context, *Core, []byte) error
|
2017-11-10 21:19:42 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// generateStandardRootToken implements the GenerateRootStrategy and is in
|
|
|
|
// charge of creating standard root tokens.
|
|
|
|
type generateStandardRootToken struct{}
|
|
|
|
|
2019-10-23 19:52:28 +03:00
|
|
|
func (g generateStandardRootToken) authenticate(ctx context.Context, c *Core, combinedKey []byte) error {
|
2021-12-07 04:12:20 +03:00
|
|
|
rootKey, err := c.unsealKeyToRootKeyPostUnseal(ctx, combinedKey)
|
2019-10-23 19:52:28 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("unable to authenticate: %w", err)
|
2019-10-23 19:52:28 +03:00
|
|
|
}
|
2021-12-07 04:12:20 +03:00
|
|
|
if err := c.barrier.VerifyRoot(rootKey); err != nil {
|
|
|
|
return fmt.Errorf("root key verification failed: %w", err)
|
2019-10-23 19:52:28 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
func (g generateStandardRootToken) generate(ctx context.Context, c *Core) (string, func(), error) {
|
|
|
|
te, err := c.tokenStore.rootToken(ctx)
|
2017-11-10 21:19:42 +03:00
|
|
|
if err != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
c.logger.Error("root token generation failed", "error", err)
|
2017-11-10 21:19:42 +03:00
|
|
|
return "", nil, err
|
|
|
|
}
|
|
|
|
if te == nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
c.logger.Error("got nil token entry back from root generation")
|
2017-11-10 21:19:42 +03:00
|
|
|
return "", nil, fmt.Errorf("got nil token entry back from root generation")
|
|
|
|
}
|
|
|
|
|
|
|
|
cleanupFunc := func() {
|
2018-05-10 22:50:02 +03:00
|
|
|
c.tokenStore.revokeOrphan(ctx, te.ID)
|
2017-11-10 21:19:42 +03:00
|
|
|
}
|
|
|
|
|
2022-02-17 22:43:07 +03:00
|
|
|
return te.ExternalID, cleanupFunc, nil
|
2017-11-10 21:19:42 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
// GenerateRootConfig holds the configuration for a root generation
|
2016-01-09 05:21:02 +03:00
|
|
|
// command.
|
2016-01-15 18:55:35 +03:00
|
|
|
type GenerateRootConfig struct {
|
2016-01-09 05:21:02 +03:00
|
|
|
Nonce string
|
|
|
|
PGPKey string
|
|
|
|
PGPFingerprint string
|
|
|
|
OTP string
|
2017-11-10 21:19:42 +03:00
|
|
|
Strategy GenerateRootStrategy
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
// GenerateRootResult holds the result of a root generation update
|
2016-01-09 05:21:02 +03:00
|
|
|
// command
|
2016-01-15 18:55:35 +03:00
|
|
|
type GenerateRootResult struct {
|
2017-11-13 23:44:26 +03:00
|
|
|
Progress int
|
|
|
|
Required int
|
|
|
|
EncodedToken string
|
|
|
|
PGPFingerprint string
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2017-11-13 23:44:26 +03:00
|
|
|
// GenerateRootProgress is used to return the root generation progress (num shares)
|
2016-01-15 18:55:35 +03:00
|
|
|
func (c *Core) GenerateRootProgress() (int, error) {
|
2016-01-09 05:21:02 +03:00
|
|
|
c.stateLock.RLock()
|
|
|
|
defer c.stateLock.RUnlock()
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.Sealed() && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return 0, consts.ErrSealed
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.standby && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return 0, consts.ErrStandby
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootLock.Lock()
|
|
|
|
defer c.generateRootLock.Unlock()
|
2016-01-09 05:21:02 +03:00
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
return len(c.generateRootProgress), nil
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2017-11-13 23:44:26 +03:00
|
|
|
// GenerateRootConfiguration is used to read the root generation configuration
|
2016-01-09 05:21:02 +03:00
|
|
|
// It stubbornly refuses to return the OTP if one is there.
|
2016-01-15 18:55:35 +03:00
|
|
|
func (c *Core) GenerateRootConfiguration() (*GenerateRootConfig, error) {
|
2016-01-09 05:21:02 +03:00
|
|
|
c.stateLock.RLock()
|
|
|
|
defer c.stateLock.RUnlock()
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.Sealed() && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return nil, consts.ErrSealed
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.standby && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return nil, consts.ErrStandby
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootLock.Lock()
|
|
|
|
defer c.generateRootLock.Unlock()
|
2016-01-09 05:21:02 +03:00
|
|
|
|
|
|
|
// Copy the config if any
|
2016-01-15 18:55:35 +03:00
|
|
|
var conf *GenerateRootConfig
|
|
|
|
if c.generateRootConfig != nil {
|
|
|
|
conf = new(GenerateRootConfig)
|
|
|
|
*conf = *c.generateRootConfig
|
2016-01-09 05:21:02 +03:00
|
|
|
conf.OTP = ""
|
2017-11-10 21:19:42 +03:00
|
|
|
conf.Strategy = nil
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
return conf, nil
|
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
// GenerateRootInit is used to initialize the root generation settings
|
2017-11-10 21:19:42 +03:00
|
|
|
func (c *Core) GenerateRootInit(otp, pgpKey string, strategy GenerateRootStrategy) error {
|
2016-01-09 05:21:02 +03:00
|
|
|
var fingerprint string
|
|
|
|
switch {
|
|
|
|
case len(otp) > 0:
|
2022-02-17 22:43:07 +03:00
|
|
|
if (len(otp) != TokenLength+TokenPrefixLength && !c.DisableSSCTokens()) ||
|
|
|
|
(len(otp) != TokenLength+OldTokenPrefixLength && c.DisableSSCTokens()) {
|
2018-09-18 06:03:00 +03:00
|
|
|
return fmt.Errorf("OTP string is wrong length")
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
case len(pgpKey) > 0:
|
|
|
|
fingerprints, err := pgpkeys.GetFingerprints([]string{pgpKey}, nil)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("error parsing PGP key: %w", err)
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
if len(fingerprints) != 1 || fingerprints[0] == "" {
|
|
|
|
return fmt.Errorf("could not acquire PGP key entity")
|
|
|
|
}
|
|
|
|
fingerprint = fingerprints[0]
|
|
|
|
|
|
|
|
default:
|
2018-09-18 06:03:00 +03:00
|
|
|
return fmt.Errorf("otp or pgp_key parameter must be provided")
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
c.stateLock.RLock()
|
|
|
|
defer c.stateLock.RUnlock()
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.Sealed() && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return consts.ErrSealed
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
2019-10-15 07:55:31 +03:00
|
|
|
barrierSealed, err := c.barrier.Sealed()
|
|
|
|
if err != nil {
|
|
|
|
return errors.New("unable to check barrier seal status")
|
|
|
|
}
|
|
|
|
if !barrierSealed && c.recoveryMode {
|
|
|
|
return errors.New("attempt to generate recovery operation token when already unsealed")
|
|
|
|
}
|
|
|
|
if c.standby && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return consts.ErrStandby
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootLock.Lock()
|
|
|
|
defer c.generateRootLock.Unlock()
|
2016-01-09 05:21:02 +03:00
|
|
|
|
|
|
|
// Prevent multiple concurrent root generations
|
2016-01-15 18:55:35 +03:00
|
|
|
if c.generateRootConfig != nil {
|
2016-01-09 05:21:02 +03:00
|
|
|
return fmt.Errorf("root generation already in progress")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Copy the configuration
|
|
|
|
generationNonce, err := uuid.GenerateUUID()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootConfig = &GenerateRootConfig{
|
2016-01-09 05:21:02 +03:00
|
|
|
Nonce: generationNonce,
|
|
|
|
OTP: otp,
|
|
|
|
PGPKey: pgpKey,
|
|
|
|
PGPFingerprint: fingerprint,
|
2017-11-10 21:19:42 +03:00
|
|
|
Strategy: strategy,
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-08-19 23:45:17 +03:00
|
|
|
if c.logger.IsInfo() {
|
2018-09-18 06:03:00 +03:00
|
|
|
switch strategy.(type) {
|
|
|
|
case generateStandardRootToken:
|
|
|
|
c.logger.Info("root generation initialized", "nonce", c.generateRootConfig.Nonce)
|
2019-10-15 07:55:31 +03:00
|
|
|
case *generateRecoveryToken:
|
|
|
|
c.logger.Info("recovery operation token generation initialized", "nonce", c.generateRootConfig.Nonce)
|
2018-09-18 06:03:00 +03:00
|
|
|
default:
|
|
|
|
c.logger.Info("dr operation token generation initialized", "nonce", c.generateRootConfig.Nonce)
|
|
|
|
}
|
2016-08-19 23:45:17 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2016-01-09 05:21:02 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
// GenerateRootUpdate is used to provide a new key part
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *Core) GenerateRootUpdate(ctx context.Context, key []byte, nonce string, strategy GenerateRootStrategy) (*GenerateRootResult, error) {
|
2016-01-09 05:21:02 +03:00
|
|
|
// Verify the key length
|
|
|
|
min, max := c.barrier.KeyLength()
|
|
|
|
max += shamir.ShareOverhead
|
|
|
|
if len(key) < min {
|
|
|
|
return nil, &ErrInvalidKey{fmt.Sprintf("key is shorter than minimum %d bytes", min)}
|
|
|
|
}
|
|
|
|
if len(key) > max {
|
|
|
|
return nil, &ErrInvalidKey{fmt.Sprintf("key is longer than maximum %d bytes", max)}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the seal configuration
|
2016-04-04 17:44:22 +03:00
|
|
|
var config *SealConfig
|
|
|
|
var err error
|
2018-01-19 11:44:06 +03:00
|
|
|
if c.seal.RecoveryKeySupported() {
|
2018-01-19 09:44:44 +03:00
|
|
|
config, err = c.seal.RecoveryConfig(ctx)
|
2016-04-04 17:44:22 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
} else {
|
2018-01-19 09:44:44 +03:00
|
|
|
config, err = c.seal.BarrierConfig(ctx)
|
2016-04-04 17:44:22 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure the barrier is initialized
|
|
|
|
if config == nil {
|
|
|
|
return nil, ErrNotInit
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we are already unsealed
|
|
|
|
c.stateLock.RLock()
|
|
|
|
defer c.stateLock.RUnlock()
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.Sealed() && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return nil, consts.ErrSealed
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
2019-10-15 07:55:31 +03:00
|
|
|
|
|
|
|
barrierSealed, err := c.barrier.Sealed()
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.New("unable to check barrier seal status")
|
|
|
|
}
|
|
|
|
if !barrierSealed && c.recoveryMode {
|
|
|
|
return nil, errors.New("attempt to generate recovery operation token when already unsealed")
|
|
|
|
}
|
|
|
|
|
|
|
|
if c.standby && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return nil, consts.ErrStandby
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootLock.Lock()
|
|
|
|
defer c.generateRootLock.Unlock()
|
2016-01-09 05:21:02 +03:00
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
// Ensure a generateRoot is in progress
|
|
|
|
if c.generateRootConfig == nil {
|
2016-01-09 05:21:02 +03:00
|
|
|
return nil, fmt.Errorf("no root generation in progress")
|
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
if nonce != c.generateRootConfig.Nonce {
|
2018-04-05 18:49:21 +03:00
|
|
|
return nil, fmt.Errorf("incorrect nonce supplied; nonce for this root generation operation is %q", c.generateRootConfig.Nonce)
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2017-11-10 21:19:42 +03:00
|
|
|
if strategy != c.generateRootConfig.Strategy {
|
2018-03-20 21:54:10 +03:00
|
|
|
return nil, fmt.Errorf("incorrect strategy supplied; a generate root operation of another type is already in progress")
|
2017-11-10 21:19:42 +03:00
|
|
|
}
|
|
|
|
|
2016-01-09 05:21:02 +03:00
|
|
|
// Check if we already have this piece
|
2016-01-15 18:55:35 +03:00
|
|
|
for _, existing := range c.generateRootProgress {
|
2016-01-09 05:21:02 +03:00
|
|
|
if bytes.Equal(existing, key) {
|
2016-09-02 00:40:01 +03:00
|
|
|
return nil, fmt.Errorf("given key has already been provided during this generation operation")
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Store this key
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootProgress = append(c.generateRootProgress, key)
|
|
|
|
progress := len(c.generateRootProgress)
|
2016-01-09 05:21:02 +03:00
|
|
|
|
|
|
|
// Check if we don't have enough keys to unlock
|
2016-01-15 18:55:35 +03:00
|
|
|
if len(c.generateRootProgress) < config.SecretThreshold {
|
2016-08-19 23:45:17 +03:00
|
|
|
if c.logger.IsDebug() {
|
2018-04-03 03:46:59 +03:00
|
|
|
c.logger.Debug("cannot generate root, not enough keys", "keys", progress, "threshold", config.SecretThreshold)
|
2016-08-19 23:45:17 +03:00
|
|
|
}
|
2016-01-15 18:55:35 +03:00
|
|
|
return &GenerateRootResult{
|
2016-01-09 05:21:02 +03:00
|
|
|
Progress: progress,
|
|
|
|
Required: config.SecretThreshold,
|
2016-01-15 18:55:35 +03:00
|
|
|
PGPFingerprint: c.generateRootConfig.PGPFingerprint,
|
2016-01-09 05:21:02 +03:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2019-10-15 07:55:31 +03:00
|
|
|
// Combine the key parts
|
|
|
|
var combinedKey []byte
|
2016-01-09 05:21:02 +03:00
|
|
|
if config.SecretThreshold == 1 {
|
2019-10-15 07:55:31 +03:00
|
|
|
combinedKey = c.generateRootProgress[0]
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootProgress = nil
|
2016-01-09 05:21:02 +03:00
|
|
|
} else {
|
2019-10-15 07:55:31 +03:00
|
|
|
combinedKey, err = shamir.Combine(c.generateRootProgress)
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootProgress = nil
|
2016-01-09 05:21:02 +03:00
|
|
|
if err != nil {
|
2021-12-07 04:12:20 +03:00
|
|
|
return nil, fmt.Errorf("failed to compute root key: %w", err)
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-10-23 19:52:28 +03:00
|
|
|
if err := strategy.authenticate(ctx, c, combinedKey); err != nil {
|
|
|
|
c.logger.Error("root generation aborted", "error", err.Error())
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("root generation aborted: %w", err)
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2017-11-10 21:19:42 +03:00
|
|
|
// Run the generate strategy
|
2018-09-18 06:03:00 +03:00
|
|
|
token, cleanupFunc, err := strategy.generate(ctx, c)
|
2016-01-20 03:44:33 +03:00
|
|
|
if err != nil {
|
2016-01-09 05:21:02 +03:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2021-12-01 16:05:49 +03:00
|
|
|
var encodedToken string
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2016-01-09 05:21:02 +03:00
|
|
|
switch {
|
2016-01-15 18:55:35 +03:00
|
|
|
case len(c.generateRootConfig.OTP) > 0:
|
2021-12-01 16:05:49 +03:00
|
|
|
encodedToken, err = roottoken.EncodeToken(token, c.generateRootConfig.OTP)
|
2016-01-15 18:55:35 +03:00
|
|
|
case len(c.generateRootConfig.PGPKey) > 0:
|
2021-12-01 16:05:49 +03:00
|
|
|
var tokenBytesArr [][]byte
|
|
|
|
_, tokenBytesArr, err = pgpkeys.EncryptShares([][]byte{[]byte(token)}, []string{c.generateRootConfig.PGPKey})
|
|
|
|
encodedToken = base64.StdEncoding.EncodeToString(tokenBytesArr[0])
|
2016-01-09 05:21:02 +03:00
|
|
|
default:
|
2021-12-01 16:05:49 +03:00
|
|
|
err = fmt.Errorf("unreachable condition")
|
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
2017-11-10 21:19:42 +03:00
|
|
|
cleanupFunc()
|
2021-12-01 16:05:49 +03:00
|
|
|
return nil, err
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
results := &GenerateRootResult{
|
2017-11-13 23:44:26 +03:00
|
|
|
Progress: progress,
|
|
|
|
Required: config.SecretThreshold,
|
2021-12-01 16:05:49 +03:00
|
|
|
EncodedToken: encodedToken,
|
2017-11-13 23:44:26 +03:00
|
|
|
PGPFingerprint: c.generateRootConfig.PGPFingerprint,
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
switch strategy.(type) {
|
|
|
|
case generateStandardRootToken:
|
2019-10-15 07:55:31 +03:00
|
|
|
c.logger.Info("root generation finished", "nonce", c.generateRootConfig.Nonce)
|
|
|
|
case *generateRecoveryToken:
|
|
|
|
c.logger.Info("recovery operation token generation finished", "nonce", c.generateRootConfig.Nonce)
|
2018-09-18 06:03:00 +03:00
|
|
|
default:
|
2019-10-15 07:55:31 +03:00
|
|
|
c.logger.Info("dr operation token generation finished", "nonce", c.generateRootConfig.Nonce)
|
2016-08-19 23:45:17 +03:00
|
|
|
}
|
2016-01-09 05:21:02 +03:00
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootProgress = nil
|
|
|
|
c.generateRootConfig = nil
|
2016-01-09 05:21:02 +03:00
|
|
|
return results, nil
|
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
// GenerateRootCancel is used to cancel an in-progress root generation
|
|
|
|
func (c *Core) GenerateRootCancel() error {
|
2016-01-09 05:21:02 +03:00
|
|
|
c.stateLock.RLock()
|
|
|
|
defer c.stateLock.RUnlock()
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.Sealed() && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return consts.ErrSealed
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
2019-10-15 07:55:31 +03:00
|
|
|
if c.standby && !c.recoveryMode {
|
2017-02-16 23:15:02 +03:00
|
|
|
return consts.ErrStandby
|
2016-01-09 05:21:02 +03:00
|
|
|
}
|
|
|
|
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootLock.Lock()
|
|
|
|
defer c.generateRootLock.Unlock()
|
2016-01-09 05:21:02 +03:00
|
|
|
|
|
|
|
// Clear any progress or config
|
2016-01-15 18:55:35 +03:00
|
|
|
c.generateRootConfig = nil
|
|
|
|
c.generateRootProgress = nil
|
2016-01-09 05:21:02 +03:00
|
|
|
return nil
|
|
|
|
}
|