2023-03-15 19:00:52 +03:00
// Copyright (c) HashiCorp, Inc.
2024-01-02 21:36:20 +03:00
// SPDX-License-Identifier: BUSL-1.1
2023-03-15 19:00:52 +03:00
2016-05-02 07:08:07 +03:00
package vault
import (
2018-01-08 21:31:38 +03:00
"context"
2022-02-17 22:43:07 +03:00
"crypto/hmac"
"encoding/base64"
2018-05-31 03:30:50 +03:00
"errors"
2016-09-29 07:01:28 +03:00
"fmt"
2022-02-24 22:57:40 +03:00
"os"
2022-12-07 04:22:46 +03:00
"strconv"
2016-05-02 07:08:07 +03:00
"strings"
"time"
2022-02-18 00:08:51 +03:00
"github.com/armon/go-metrics"
2022-02-17 22:43:07 +03:00
"github.com/golang/protobuf/proto"
2018-08-10 16:59:58 +03:00
"github.com/hashicorp/errwrap"
2022-02-18 00:08:51 +03:00
"github.com/hashicorp/go-multierror"
2021-07-16 03:17:31 +03:00
"github.com/hashicorp/go-secure-stdlib/strutil"
2022-02-18 00:08:51 +03:00
"github.com/hashicorp/go-sockaddr"
"github.com/hashicorp/go-uuid"
2023-06-28 20:46:37 +03:00
uberAtomic "go.uber.org/atomic"
2022-12-07 04:22:46 +03:00
"github.com/hashicorp/vault/command/server"
2019-04-13 10:44:06 +03:00
"github.com/hashicorp/vault/helper/identity"
2022-02-18 00:08:51 +03:00
"github.com/hashicorp/vault/helper/identity/mfa"
2020-10-14 02:38:21 +03:00
"github.com/hashicorp/vault/helper/metricsutil"
2019-04-13 10:44:06 +03:00
"github.com/hashicorp/vault/helper/namespace"
2020-10-14 02:38:21 +03:00
"github.com/hashicorp/vault/internalshared/configutil"
2019-04-13 10:44:06 +03:00
"github.com/hashicorp/vault/sdk/framework"
2019-04-13 00:54:35 +03:00
"github.com/hashicorp/vault/sdk/helper/consts"
"github.com/hashicorp/vault/sdk/helper/errutil"
"github.com/hashicorp/vault/sdk/helper/jsonutil"
2019-04-13 01:08:46 +03:00
"github.com/hashicorp/vault/sdk/helper/policyutil"
2019-04-13 00:54:35 +03:00
"github.com/hashicorp/vault/sdk/helper/wrapping"
"github.com/hashicorp/vault/sdk/logical"
2020-06-27 00:13:16 +03:00
"github.com/hashicorp/vault/vault/quotas"
2022-02-17 22:43:07 +03:00
"github.com/hashicorp/vault/vault/tokens"
2016-05-02 07:08:07 +03:00
)
2017-10-23 21:59:37 +03:00
const (
2022-02-24 22:57:40 +03:00
replTimeout = 1 * time . Second
EnvVaultDisableLocalAuthMountEntities = "VAULT_DISABLE_LOCAL_AUTH_MOUNT_ENTITIES"
2022-12-07 04:22:46 +03:00
// base path to store locked users
coreLockedUsersPath = "core/login/lockedUsers/"
2017-10-23 21:59:37 +03:00
)
2018-07-25 00:50:49 +03:00
var (
// DefaultMaxRequestDuration is the amount of time we'll wait for a request
// to complete, unless overridden on a per-handler basis
2018-08-01 22:07:37 +03:00
DefaultMaxRequestDuration = 90 * time . Second
2018-09-18 06:03:00 +03:00
2023-11-06 16:51:52 +03:00
ErrNoApplicablePolicies = errors . New ( "no applicable policies" )
ErrPolicyNotExistInTypeMap = errors . New ( "policy does not exist in type map" )
2023-09-14 22:27:30 +03:00
2018-09-18 06:03:00 +03:00
egpDebugLogging bool
2021-10-14 03:15:54 +03:00
// if this returns an error, the request should be blocked and the error
// should be returned to the client
enterpriseBlockRequestIfError = blockRequestIfErrorImpl
2018-07-25 00:50:49 +03:00
)
2018-08-02 04:39:39 +03:00
// HandlerProperties is used to seed configuration into a vaulthttp.Handler.
2018-07-06 22:44:56 +03:00
// It's in this package to avoid a circular dependency
type HandlerProperties struct {
2020-05-14 16:19:27 +03:00
Core * Core
ListenerConfig * configutil . Listener
DisablePrintableCheck bool
RecoveryMode bool
RecoveryToken * uberAtomic . String
2018-07-06 22:44:56 +03:00
}
2018-05-31 03:30:50 +03:00
// fetchEntityAndDerivedPolicies returns the entity object for the given entity
// ID. If the entity is merged into a different entity object, the entity into
// which the given entity ID is merged into will be returned. This function
2021-10-07 20:36:22 +03:00
// also returns the cumulative list of policies that the entity is entitled to
// if skipDeriveEntityPolicies is set to false. This list includes the policies from the
// entity itself and from all the groups in which the given entity ID is a member of.
func ( c * Core ) fetchEntityAndDerivedPolicies ( ctx context . Context , tokenNS * namespace . Namespace , entityID string , skipDeriveEntityPolicies bool ) ( * identity . Entity , map [ string ] [ ] string , error ) {
2018-05-31 03:30:50 +03:00
if entityID == "" || c . identityStore == nil {
return nil , nil , nil
}
2021-04-08 19:43:39 +03:00
// c.logger.Debug("entity set on the token", "entity_id", te.EntityID)
2018-05-31 03:30:50 +03:00
// Fetch the entity
entity , err := c . identityStore . MemDBEntityByID ( entityID , false )
if err != nil {
c . logger . Error ( "failed to lookup entity using its ID" , "error" , err )
return nil , nil , err
}
if entity == nil {
// If there was no corresponding entity object found, it is
// possible that the entity got merged into another entity. Try
// finding entity based on the merged entity index.
entity , err = c . identityStore . MemDBEntityByMergedEntityID ( entityID , false )
if err != nil {
c . logger . Error ( "failed to lookup entity in merged entity ID index" , "error" , err )
return nil , nil , err
}
}
2018-09-18 06:03:00 +03:00
policies := make ( map [ string ] [ ] string )
2021-10-07 20:36:22 +03:00
if entity != nil && ! skipDeriveEntityPolicies {
2021-04-08 19:43:39 +03:00
// c.logger.Debug("entity successfully fetched; adding entity policies to token's policies to create ACL")
2018-05-31 03:30:50 +03:00
// Attach the policies on the entity
2018-09-18 06:03:00 +03:00
if len ( entity . Policies ) != 0 {
policies [ entity . NamespaceID ] = append ( policies [ entity . NamespaceID ] , entity . Policies ... )
}
2018-05-31 03:30:50 +03:00
groupPolicies , err := c . identityStore . groupPoliciesByEntityID ( entity . ID )
if err != nil {
c . logger . Error ( "failed to fetch group policies" , "error" , err )
return nil , nil , err
}
2023-09-14 22:27:30 +03:00
policiesByNS , err := c . filterGroupPoliciesByNS ( ctx , tokenNS , groupPolicies )
2023-01-05 21:00:55 +03:00
if err != nil {
return nil , nil , err
}
2023-09-14 22:27:30 +03:00
for nsID , pss := range policiesByNS {
policies [ nsID ] = append ( policies [ nsID ] , pss ... )
}
}
2023-01-05 21:00:55 +03:00
2023-09-14 22:27:30 +03:00
return entity , policies , err
}
// filterGroupPoliciesByNS takes a context, token namespace, and a map of
// namespace IDs to slices of group policy names and returns a similar map,
// but filtered down to the policies that should apply to the token based on the
// relationship between the namespace of the token and the namespace of the
// policy.
func ( c * Core ) filterGroupPoliciesByNS ( ctx context . Context , tokenNS * namespace . Namespace , groupPolicies map [ string ] [ ] string ) ( map [ string ] [ ] string , error ) {
policies := make ( map [ string ] [ ] string )
policyApplicationMode , err := c . GetGroupPolicyApplicationMode ( ctx )
if err != nil {
return nil , err
}
for nsID , nsPolicies := range groupPolicies {
filteredPolicies , err := c . getApplicableGroupPolicies ( ctx , tokenNS , nsID , nsPolicies , policyApplicationMode )
if err != nil && err != ErrNoApplicablePolicies {
return nil , err
}
filteredPolicies = strutil . RemoveDuplicates ( filteredPolicies , false )
if len ( filteredPolicies ) != 0 {
policies [ nsID ] = append ( policies [ nsID ] , filteredPolicies ... )
}
}
return policies , nil
}
// getApplicableGroupPolicies returns a slice of group policies that should
// apply to the token based on the group policy application mode,
// and the relationship between the token namespace and the group namespace.
func ( c * Core ) getApplicableGroupPolicies ( ctx context . Context , tokenNS * namespace . Namespace , nsID string , nsPolicies [ ] string , policyApplicationMode string ) ( [ ] string , error ) {
policyNS , err := NamespaceByID ( ctx , nsID , c )
if err != nil {
return nil , err
}
if policyNS == nil {
return nil , namespace . ErrNoNamespace
}
var filteredPolicies [ ] string
if tokenNS . Path == policyNS . Path {
// Same namespace - add all and continue
for _ , policyName := range nsPolicies {
filteredPolicies = append ( filteredPolicies , policyName )
}
return filteredPolicies , nil
}
for _ , policyName := range nsPolicies {
t , err := c . policyStore . GetNonEGPPolicyType ( policyNS . ID , policyName )
2023-11-06 16:51:52 +03:00
if err != nil && errors . Is ( err , ErrPolicyNotExistInTypeMap ) {
// When we attempt to get a non-EGP policy type, and receive an
// explicit error that it doesn't exist (in the type map) we log the
// ns/policy and continue without error.
c . Logger ( ) . Debug ( fmt . Errorf ( "%w: %v/%v" , err , policyNS . ID , policyName ) . Error ( ) )
continue
}
2023-09-14 22:27:30 +03:00
if err != nil || t == nil {
return nil , fmt . Errorf ( "failed to look up type of policy: %w" , err )
}
switch * t {
case PolicyTypeRGP :
if tokenNS . HasParent ( policyNS ) {
filteredPolicies = append ( filteredPolicies , policyName )
2018-09-18 06:03:00 +03:00
}
2023-09-14 22:27:30 +03:00
case PolicyTypeACL :
if policyApplicationMode != groupPolicyApplicationModeWithinNamespaceHierarchy {
// Group policy application mode isn't set to enforce
// the namespace hierarchy, so apply all the ACLs,
// regardless of their namespaces.
filteredPolicies = append ( filteredPolicies , policyName )
continue
2018-09-18 06:03:00 +03:00
}
2023-09-14 22:27:30 +03:00
if policyNS . HasParent ( tokenNS ) {
filteredPolicies = append ( filteredPolicies , policyName )
2018-09-18 06:03:00 +03:00
}
2023-09-14 22:27:30 +03:00
default :
return nil , fmt . Errorf ( "unexpected policy type: %v" , t )
2018-09-18 06:03:00 +03:00
}
2018-05-31 03:30:50 +03:00
}
2023-09-14 22:27:30 +03:00
if len ( filteredPolicies ) == 0 {
return nil , ErrNoApplicablePolicies
}
return filteredPolicies , nil
2018-05-31 03:30:50 +03:00
}
2018-09-18 06:03:00 +03:00
func ( c * Core ) fetchACLTokenEntryAndEntity ( ctx context . Context , req * logical . Request ) ( * ACL , * logical . TokenEntry , * identity . Entity , map [ string ] [ ] string , error ) {
2018-05-31 03:30:50 +03:00
defer metrics . MeasureSince ( [ ] string { "core" , "fetch_acl_and_token" } , time . Now ( ) )
// Ensure there is a client token
if req . ClientToken == "" {
2021-11-23 04:06:59 +03:00
return nil , nil , nil , nil , logical . ErrPermissionDenied
2018-05-31 03:30:50 +03:00
}
if c . tokenStore == nil {
c . logger . Error ( "token store is unavailable" )
2018-06-14 16:49:33 +03:00
return nil , nil , nil , nil , ErrInternalError
2018-05-31 03:30:50 +03:00
}
// Resolve the token policy
2018-06-09 00:24:27 +03:00
var te * logical . TokenEntry
switch req . TokenEntry ( ) {
case nil :
var err error
2018-09-18 06:03:00 +03:00
te , err = c . tokenStore . Lookup ( ctx , req . ClientToken )
2018-06-09 00:24:27 +03:00
if err != nil {
2021-11-17 19:21:54 +03:00
c . logger . Error ( "failed to lookup acl token" , "error" , err )
2018-06-14 16:49:33 +03:00
return nil , nil , nil , nil , ErrInternalError
2018-06-09 00:24:27 +03:00
}
2018-12-03 19:57:53 +03:00
// Set the token entry here since it has not been cached yet
req . SetTokenEntry ( te )
2018-06-09 00:24:27 +03:00
default :
te = req . TokenEntry ( )
2018-05-31 03:30:50 +03:00
}
// Ensure the token is valid
if te == nil {
2018-06-14 16:49:33 +03:00
return nil , nil , nil , nil , logical . ErrPermissionDenied
2018-05-31 03:30:50 +03:00
}
// CIDR checks bind all tokens except non-expiring root tokens
if te . TTL != 0 && len ( te . BoundCIDRs ) > 0 {
var valid bool
remoteSockAddr , err := sockaddr . NewSockAddr ( req . Connection . RemoteAddr )
if err != nil {
if c . Logger ( ) . IsDebug ( ) {
c . Logger ( ) . Debug ( "could not parse remote addr into sockaddr" , "error" , err , "remote_addr" , req . Connection . RemoteAddr )
}
2018-06-14 16:49:33 +03:00
return nil , nil , nil , nil , logical . ErrPermissionDenied
2018-05-31 03:30:50 +03:00
}
for _ , cidr := range te . BoundCIDRs {
if cidr . Contains ( remoteSockAddr ) {
valid = true
break
}
}
if ! valid {
2018-06-14 16:49:33 +03:00
return nil , nil , nil , nil , logical . ErrPermissionDenied
2018-05-31 03:30:50 +03:00
}
}
2021-10-07 20:36:22 +03:00
policyNames := make ( map [ string ] [ ] string )
2018-09-18 06:03:00 +03:00
// Add tokens policies
2021-10-07 20:36:22 +03:00
policyNames [ te . NamespaceID ] = append ( policyNames [ te . NamespaceID ] , te . Policies ... )
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , te . NamespaceID , c )
2018-05-31 03:30:50 +03:00
if err != nil {
2018-09-18 06:03:00 +03:00
c . logger . Error ( "failed to fetch token namespace" , "error" , err )
return nil , nil , nil , nil , ErrInternalError
}
if tokenNS == nil {
c . logger . Error ( "failed to fetch token namespace" , "error" , namespace . ErrNoNamespace )
2018-06-14 16:49:33 +03:00
return nil , nil , nil , nil , ErrInternalError
2018-05-31 03:30:50 +03:00
}
2018-09-18 06:03:00 +03:00
// Add identity policies from all the namespaces
2021-10-07 20:36:22 +03:00
entity , identityPolicies , err := c . fetchEntityAndDerivedPolicies ( ctx , tokenNS , te . EntityID , te . NoIdentityPolicies )
2018-09-18 06:03:00 +03:00
if err != nil {
return nil , nil , nil , nil , ErrInternalError
}
for nsID , nsPolicies := range identityPolicies {
2022-11-17 01:43:46 +03:00
policyNames [ nsID ] = policyutil . SanitizePolicies ( append ( policyNames [ nsID ] , nsPolicies ... ) , false )
2018-09-18 06:03:00 +03:00
}
2018-05-31 03:30:50 +03:00
2018-09-18 06:03:00 +03:00
// Attach token's namespace information to the context. Wrapping tokens by
// should be able to be used anywhere, so we also special case behavior.
var tokenCtx context . Context
2021-10-07 20:36:22 +03:00
if len ( policyNames ) == 1 &&
len ( policyNames [ te . NamespaceID ] ) == 1 &&
( policyNames [ te . NamespaceID ] [ 0 ] == responseWrappingPolicyName ||
policyNames [ te . NamespaceID ] [ 0 ] == controlGroupPolicyName ) &&
2018-09-18 06:03:00 +03:00
( strings . HasSuffix ( req . Path , "sys/wrapping/unwrap" ) ||
strings . HasSuffix ( req . Path , "sys/wrapping/lookup" ) ||
strings . HasSuffix ( req . Path , "sys/wrapping/rewrap" ) ) {
// Use the request namespace; will find the copy of the policy for the
// local namespace
tokenCtx = ctx
} else {
// Use the token's namespace for looking up policy
tokenCtx = namespace . ContextWithNamespace ( ctx , tokenNS )
}
2021-10-07 20:36:22 +03:00
// Add the inline policy if it's set
policies := make ( [ ] * Policy , 0 )
if te . InlinePolicy != "" {
inlinePolicy , err := ParseACLPolicy ( tokenNS , te . InlinePolicy )
if err != nil {
return nil , nil , nil , nil , ErrInternalError
}
policies = append ( policies , inlinePolicy )
}
2018-09-18 06:03:00 +03:00
// Construct the corresponding ACL object. ACL construction should be
// performed on the token's namespace.
2021-10-07 20:36:22 +03:00
acl , err := c . policyStore . ACL ( tokenCtx , entity , policyNames , policies ... )
2018-05-31 03:30:50 +03:00
if err != nil {
c . logger . Error ( "failed to construct ACL" , "error" , err )
2018-06-14 16:49:33 +03:00
return nil , nil , nil , nil , ErrInternalError
2018-05-31 03:30:50 +03:00
}
2018-06-14 16:49:33 +03:00
return acl , te , entity , identityPolicies , nil
2018-05-31 03:30:50 +03:00
}
2023-02-10 23:56:00 +03:00
func ( c * Core ) CheckToken ( ctx context . Context , req * logical . Request , unauth bool ) ( * logical . Auth , * logical . TokenEntry , error ) {
2018-05-31 03:30:50 +03:00
defer metrics . MeasureSince ( [ ] string { "core" , "check_token" } , time . Now ( ) )
var acl * ACL
2018-06-09 00:24:27 +03:00
var te * logical . TokenEntry
2018-05-31 03:30:50 +03:00
var entity * identity . Entity
2018-09-18 06:03:00 +03:00
var identityPolicies map [ string ] [ ] string
2018-05-31 03:30:50 +03:00
// Even if unauth, if a token is provided, there's little reason not to
// gather as much info as possible for the audit log and to e.g. control
// trace mode for EGPs.
if ! unauth || ( unauth && req . ClientToken != "" ) {
2023-08-22 21:48:14 +03:00
var err error
2018-09-18 06:03:00 +03:00
acl , te , entity , identityPolicies , err = c . fetchACLTokenEntryAndEntity ( ctx , req )
2018-05-31 03:30:50 +03:00
// In the unauth case we don't want to fail the command, since it's
// unauth, we just have no information to attach to the request, so
// ignore errors...this was best-effort anyways
if err != nil && ! unauth {
return nil , te , err
}
}
if entity != nil && entity . Disabled {
2018-06-19 19:57:19 +03:00
c . logger . Warn ( "permission denied as the entity on the token is disabled" )
return nil , te , logical . ErrPermissionDenied
}
if te != nil && te . EntityID != "" && entity == nil {
2019-01-25 22:08:42 +03:00
if c . perfStandby {
return nil , nil , logical . ErrPerfStandbyPleaseForward
}
2018-06-19 19:57:19 +03:00
c . logger . Warn ( "permission denied as the entity on the token is invalid" )
2018-05-31 03:30:50 +03:00
return nil , te , logical . ErrPermissionDenied
}
// Check if this is a root protected path
2018-09-18 06:03:00 +03:00
rootPath := c . router . RootPath ( ctx , req . Path )
2018-05-31 03:30:50 +03:00
if rootPath && unauth {
return nil , nil , errors . New ( "cannot access root path in unauthenticated request" )
}
2019-02-11 21:08:15 +03:00
// At this point we won't be forwarding a raw request; we should delete
// authorization headers as appropriate
switch req . ClientTokenSource {
case logical . ClientTokenFromVaultHeader :
delete ( req . Headers , consts . AuthHeaderName )
case logical . ClientTokenFromAuthzHeader :
if headers , ok := req . Headers [ "Authorization" ] ; ok {
retHeaders := make ( [ ] string , 0 , len ( headers ) )
for _ , v := range headers {
if strings . HasPrefix ( v , "Bearer " ) {
continue
}
retHeaders = append ( retHeaders , v )
}
req . Headers [ "Authorization" ] = retHeaders
}
}
2018-05-31 03:30:50 +03:00
// When we receive a write of either type, rather than require clients to
// PUT/POST and trust the operation, we ask the backend to give us the real
// skinny -- if the backend implements an existence check, it can tell us
// whether a particular resource exists. Then we can mark it as an update
// or creation as appropriate.
if req . Operation == logical . CreateOperation || req . Operation == logical . UpdateOperation {
2018-10-15 19:56:24 +03:00
existsResp , checkExists , resourceExists , err := c . router . RouteExistenceCheck ( ctx , req )
2018-05-31 03:30:50 +03:00
switch err {
case logical . ErrUnsupportedPath :
// fail later via bad path to avoid confusing items in the log
checkExists = false
2022-03-30 16:08:02 +03:00
case logical . ErrRelativePath :
return nil , te , errutil . UserError { Err : err . Error ( ) }
2018-05-31 03:30:50 +03:00
case nil :
2018-10-15 19:56:24 +03:00
if existsResp != nil && existsResp . IsError ( ) {
return nil , te , existsResp . Error ( )
}
// Otherwise, continue on
2018-05-31 03:30:50 +03:00
default :
c . logger . Error ( "failed to run existence check" , "error" , err )
if _ , ok := err . ( errutil . UserError ) ; ok {
2018-10-15 19:56:24 +03:00
return nil , te , err
2018-05-31 03:30:50 +03:00
} else {
2018-10-15 19:56:24 +03:00
return nil , te , ErrInternalError
2018-05-31 03:30:50 +03:00
}
}
switch {
2022-02-18 17:35:53 +03:00
case ! checkExists :
2018-05-31 03:30:50 +03:00
// No existence check, so always treat it as an update operation, which is how it is pre 0.5
req . Operation = logical . UpdateOperation
2022-02-18 17:35:53 +03:00
case resourceExists :
2018-05-31 03:30:50 +03:00
// It exists, so force an update operation
req . Operation = logical . UpdateOperation
2022-02-18 17:35:53 +03:00
case ! resourceExists :
2018-05-31 03:30:50 +03:00
// It doesn't exist, force a create operation
req . Operation = logical . CreateOperation
default :
panic ( "unreachable code" )
}
}
// Create the auth response
auth := & logical . Auth {
2018-09-18 06:03:00 +03:00
ClientToken : req . ClientToken ,
Accessor : req . ClientTokenAccessor ,
2018-05-31 03:30:50 +03:00
}
2021-12-09 01:34:42 +03:00
var clientID string
var isTWE bool
2018-05-31 03:30:50 +03:00
if te != nil {
2018-09-18 06:03:00 +03:00
auth . IdentityPolicies = identityPolicies [ te . NamespaceID ]
2018-06-14 16:49:33 +03:00
auth . TokenPolicies = te . Policies
2022-11-17 01:43:46 +03:00
auth . Policies = policyutil . SanitizePolicies ( append ( te . Policies , identityPolicies [ te . NamespaceID ] ... ) , false )
2018-05-31 03:30:50 +03:00
auth . Metadata = te . Meta
auth . DisplayName = te . DisplayName
auth . EntityID = te . EntityID
2018-09-18 06:03:00 +03:00
delete ( identityPolicies , te . NamespaceID )
auth . ExternalNamespacePolicies = identityPolicies
2018-05-31 03:30:50 +03:00
// Store the entity ID in the request object
req . EntityID = te . EntityID
2018-10-15 19:56:24 +03:00
auth . TokenType = te . Type
2020-05-29 20:30:47 +03:00
auth . TTL = te . TTL
if te . CreationTime > 0 {
auth . IssueTime = time . Unix ( te . CreationTime , 0 )
}
2021-12-09 01:34:42 +03:00
clientID , isTWE = te . CreateClientID ( )
req . ClientID = clientID
2018-05-31 03:30:50 +03:00
}
// Check the standard non-root ACLs. Return the token entry if it's not
// allowed so we can decrement the use count.
authResults := c . performPolicyChecks ( ctx , acl , te , req , entity , & PolicyCheckOpts {
Unauth : unauth ,
RootPrivsRequired : rootPath ,
} )
2018-09-18 06:03:00 +03:00
2022-05-17 02:23:08 +03:00
auth . PolicyResults = & logical . PolicyResults {
Allowed : authResults . Allowed ,
}
2018-05-31 03:30:50 +03:00
if ! authResults . Allowed {
2018-08-11 05:32:10 +03:00
retErr := authResults . Error
2019-04-04 00:16:49 +03:00
// If we get a control group error and we are a performance standby,
// restore the client token information to the request so that we can
// forward this request properly to the active node.
if retErr . ErrorOrNil ( ) != nil && checkErrControlGroupTokenNeedsCreated ( retErr ) &&
c . perfStandby && len ( req . ClientToken ) != 0 {
switch req . ClientTokenSource {
case logical . ClientTokenFromVaultHeader :
req . Headers [ consts . AuthHeaderName ] = [ ] string { req . ClientToken }
case logical . ClientTokenFromAuthzHeader :
req . Headers [ "Authorization" ] = append ( req . Headers [ "Authorization" ] , fmt . Sprintf ( "Bearer %s" , req . ClientToken ) )
}
// We also return the appropriate error so that the caller can forward the
// request to the active node
return auth , te , logical . ErrPerfStandbyPleaseForward
}
2018-08-11 04:05:10 +03:00
if authResults . Error . ErrorOrNil ( ) == nil || authResults . DeniedError {
2018-08-11 05:32:10 +03:00
retErr = multierror . Append ( retErr , logical . ErrPermissionDenied )
2018-08-10 16:59:58 +03:00
}
2018-08-11 05:32:10 +03:00
return auth , te , retErr
2018-05-31 03:30:50 +03:00
}
2022-05-17 02:23:08 +03:00
if authResults . ACLResults != nil && len ( authResults . ACLResults . GrantingPolicies ) > 0 {
auth . PolicyResults . GrantingPolicies = authResults . ACLResults . GrantingPolicies
}
if authResults . SentinelResults != nil && len ( authResults . SentinelResults . GrantingPolicies ) > 0 {
auth . PolicyResults . GrantingPolicies = append ( auth . PolicyResults . GrantingPolicies , authResults . SentinelResults . GrantingPolicies ... )
}
2023-05-19 17:42:50 +03:00
c . activityLogLock . RLock ( )
activityLog := c . activityLog
c . activityLogLock . RUnlock ( )
2023-08-22 21:48:14 +03:00
// If it is an authenticated ( i.e. with vault token ) request, increment client count
2023-05-19 17:42:50 +03:00
if ! unauth && activityLog != nil {
2023-08-26 00:46:34 +03:00
err := activityLog . HandleTokenUsage ( ctx , te , clientID , isTWE )
2023-08-22 21:48:14 +03:00
if err != nil {
return auth , te , err
}
2021-07-23 00:01:49 +03:00
}
2018-05-31 03:30:50 +03:00
return auth , te , nil
}
2016-05-02 07:08:07 +03:00
// HandleRequest is used to handle a new incoming request
2018-07-25 00:50:49 +03:00
func ( c * Core ) HandleRequest ( httpCtx context . Context , req * logical . Request ) ( resp * logical . Response , err error ) {
2019-04-08 21:57:14 +03:00
return c . switchedLockHandleRequest ( httpCtx , req , true )
}
func ( c * Core ) switchedLockHandleRequest ( httpCtx context . Context , req * logical . Request , doLocking bool ) ( resp * logical . Response , err error ) {
if doLocking {
c . stateLock . RLock ( )
2019-06-19 16:40:57 +03:00
defer c . stateLock . RUnlock ( )
2019-04-08 21:57:14 +03:00
}
2018-07-24 23:57:25 +03:00
if c . Sealed ( ) {
2017-02-16 23:15:02 +03:00
return nil , consts . ErrSealed
2016-05-02 07:08:07 +03:00
}
2018-09-18 06:03:00 +03:00
if c . standby && ! c . perfStandby {
2017-02-16 23:15:02 +03:00
return nil , consts . ErrStandby
2016-05-02 07:08:07 +03:00
}
2019-06-28 03:35:01 +03:00
if c . activeContext == nil || c . activeContext . Err ( ) != nil {
return nil , errors . New ( "active context canceled after getting state lock" )
}
2018-01-19 09:44:44 +03:00
ctx , cancel := context . WithCancel ( c . activeContext )
2018-08-28 04:21:54 +03:00
go func ( ctx context . Context , httpCtx context . Context ) {
2018-07-25 00:50:49 +03:00
select {
case <- ctx . Done ( ) :
case <- httpCtx . Done ( ) :
cancel ( )
}
2018-08-28 04:21:54 +03:00
} ( ctx , httpCtx )
2018-07-25 00:50:49 +03:00
2018-12-03 22:35:20 +03:00
ns , err := namespace . FromContext ( httpCtx )
if err != nil {
cancel ( )
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "could not parse namespace from http context: %w" , err )
2018-12-03 22:35:20 +03:00
}
2021-12-09 01:34:42 +03:00
ctx = namespace . ContextWithNamespace ( ctx , ns )
inFlightReqID , ok := httpCtx . Value ( logical . CtxKeyInFlightRequestID { } ) . ( string )
if ok {
ctx = context . WithValue ( ctx , logical . CtxKeyInFlightRequestID { } , inFlightReqID )
}
2023-08-29 02:16:57 +03:00
requestRole , ok := httpCtx . Value ( logical . CtxKeyRequestRole { } ) . ( string )
if ok {
ctx = context . WithValue ( ctx , logical . CtxKeyRequestRole { } , requestRole )
}
2023-12-05 04:45:23 +03:00
body , ok := logical . ContextOriginalBodyValue ( httpCtx )
if ok {
ctx = logical . CreateContextOriginalBody ( ctx , body )
}
2021-12-09 01:34:42 +03:00
resp , err = c . handleCancelableRequest ( ctx , req )
2018-12-03 22:35:20 +03:00
req . SetTokenEntry ( nil )
cancel ( )
return resp , err
}
2021-06-11 20:18:16 +03:00
func ( c * Core ) handleCancelableRequest ( ctx context . Context , req * logical . Request ) ( resp * logical . Response , err error ) {
2016-05-02 07:08:07 +03:00
// Allowing writing to a path ending in / makes it extremely difficult to
2017-09-15 16:02:29 +03:00
// understand user intent for the filesystem-like backends (kv,
2016-05-02 07:08:07 +03:00
// cubbyhole) -- did they want a key named foo/ or did they want to write
// to a directory foo/ with no (or forgotten) key, or...? It also affects
// lookup, because paths ending in / are considered prefixes by some
// backends. Basically, it's all just terrible, so don't allow it.
if strings . HasSuffix ( req . Path , "/" ) &&
( req . Operation == logical . UpdateOperation ||
2022-01-12 20:05:27 +03:00
req . Operation == logical . CreateOperation ||
req . Operation == logical . PatchOperation ) {
2016-05-02 07:08:07 +03:00
return logical . ErrorResponse ( "cannot write to a path ending in '/'" ) , nil
}
2021-02-04 17:10:35 +03:00
waitGroup , err := waitForReplicationState ( ctx , c , req )
2018-09-18 06:03:00 +03:00
if err != nil {
return nil , err
}
2022-06-03 22:45:21 +03:00
// MountPoint will not always be set at this point, so we ensure the req contains it
// as it is depended on by some functionality (e.g. quotas)
req . MountPoint = c . router . MatchingMount ( ctx , req . Path )
2021-02-04 17:10:35 +03:00
// Decrement the wait group when our request is done
if waitGroup != nil {
defer waitGroup . Done ( )
}
2021-06-11 20:18:16 +03:00
if c . MissingRequiredState ( req . RequiredState ( ) , c . perfStandby ) {
return nil , logical . ErrMissingRequiredState
}
err = c . PopulateTokenEntry ( ctx , req )
if err != nil {
return nil , err
}
// Always forward requests that are using a limited use count token.
if c . perfStandby && req . ClientTokenRemainingUses > 0 {
// Prevent forwarding on local-only requests.
return nil , logical . ErrPerfStandbyPleaseForward
}
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , fmt . Errorf ( "could not parse namespace from http context: %w" , err )
}
2022-02-17 22:43:07 +03:00
var requestBodyToken string
var returnRequestAuthToken bool
2021-06-11 20:18:16 +03:00
// req.Path will be relative by this point. The prefix check is first
// to fail faster if we're not in this situation since it's a hot path
switch {
case strings . HasPrefix ( req . Path , "sys/wrapping/" ) , strings . HasPrefix ( req . Path , "auth/token/" ) :
// Get the token ns info; if we match the paths below we want to
// swap in the token context (but keep the relative path)
te := req . TokenEntry ( )
newCtx := ctx
if te != nil {
ns , err := NamespaceByID ( ctx , te . NamespaceID , c )
if err != nil {
c . Logger ( ) . Warn ( "error looking up namespace from the token's namespace ID" , "error" , err )
return nil , err
}
if ns != nil {
newCtx = namespace . ContextWithNamespace ( ctx , ns )
}
}
switch req . Path {
// Route the token wrapping request to its respective sys NS
case "sys/wrapping/lookup" , "sys/wrapping/rewrap" , "sys/wrapping/unwrap" :
ctx = newCtx
// A lookup on a token that is about to expire returns nil, which means by the
// time we can validate a wrapping token lookup will return nil since it will
// be revoked after the call. So we have to do the validation here.
valid , err := c . validateWrappingToken ( ctx , req )
if err != nil {
2023-01-31 21:57:50 +03:00
return logical . ErrorResponse ( fmt . Sprintf ( "error validating wrapping token: %s" , err . Error ( ) ) ) , logical . ErrPermissionDenied
2021-06-11 20:18:16 +03:00
}
if ! valid {
return nil , consts . ErrInvalidWrappingToken
}
// The -self paths have no meaning outside of the token NS, so
// requests for these paths always go to the token NS
case "auth/token/lookup-self" , "auth/token/renew-self" , "auth/token/revoke-self" :
ctx = newCtx
2022-02-17 22:43:07 +03:00
returnRequestAuthToken = true
2021-06-11 20:18:16 +03:00
// For the following operations, we can set the proper namespace context
// using the token's embedded nsID if a relative path was provided.
// The operation will still be gated by ACLs, which are checked later.
case "auth/token/lookup" , "auth/token/renew" , "auth/token/revoke" , "auth/token/revoke-orphan" :
token , ok := req . Data [ "token" ]
// If the token is not present (e.g. a bad request), break out and let the backend
// handle the error
if ! ok {
// If this is a token lookup request and if the token is not
// explicitly provided, it will use the client token so we simply set
// the context to the client token's context.
if req . Path == "auth/token/lookup" {
ctx = newCtx
}
break
}
2021-12-06 20:38:53 +03:00
if token == nil {
2021-12-21 20:46:56 +03:00
return logical . ErrorResponse ( "invalid token" ) , logical . ErrPermissionDenied
2021-12-06 20:38:53 +03:00
}
2022-06-23 23:01:20 +03:00
// We don't care if the token is a server side consistent token or not. Either way, we're going
2022-02-17 22:43:07 +03:00
// to be returning it for these paths instead of the short token stored in vault.
requestBodyToken = token . ( string )
if IsSSCToken ( token . ( string ) ) {
token , err = c . CheckSSCToken ( ctx , token . ( string ) , c . isLoginRequest ( ctx , req ) , c . perfStandby )
2022-06-23 23:01:20 +03:00
// If we receive an error from CheckSSCToken, we can assume the token is bad somehow, and the client
2022-07-11 21:12:02 +03:00
// should receive a 403 bad token error like they do for all other invalid tokens, unless the error
// specifies that we should forward the request or retry the request.
2022-02-17 22:43:07 +03:00
if err != nil {
2022-07-11 21:12:02 +03:00
if errors . Is ( err , logical . ErrPerfStandbyPleaseForward ) || errors . Is ( err , logical . ErrMissingRequiredState ) {
return nil , err
}
2022-06-23 23:01:20 +03:00
return logical . ErrorResponse ( "bad token" ) , logical . ErrPermissionDenied
2022-02-17 22:43:07 +03:00
}
req . Data [ "token" ] = token
}
2021-06-11 20:18:16 +03:00
_ , nsID := namespace . SplitIDFromString ( token . ( string ) )
if nsID != "" {
ns , err := NamespaceByID ( ctx , nsID , c )
if err != nil {
c . Logger ( ) . Warn ( "error looking up namespace from the token's namespace ID" , "error" , err )
return nil , err
}
if ns != nil {
ctx = namespace . ContextWithNamespace ( ctx , ns )
}
}
}
// The following relative sys/leases/ paths handles re-routing requests
// to the proper namespace using the lease ID on applicable paths.
case strings . HasPrefix ( req . Path , "sys/leases/" ) :
switch req . Path {
// For the following operations, we can set the proper namespace context
// using the lease's embedded nsID if a relative path was provided.
// The operation will still be gated by ACLs, which are checked later.
case "sys/leases/lookup" , "sys/leases/renew" , "sys/leases/revoke" , "sys/leases/revoke-force" :
leaseID , ok := req . Data [ "lease_id" ]
// If lease ID is not present, break out and let the backend handle the error
2023-02-03 17:51:10 +03:00
if ! ok || leaseID == nil {
2021-06-11 20:18:16 +03:00
break
}
_ , nsID := namespace . SplitIDFromString ( leaseID . ( string ) )
if nsID != "" {
ns , err := NamespaceByID ( ctx , nsID , c )
if err != nil {
c . Logger ( ) . Warn ( "error looking up namespace from the lease's namespace ID" , "error" , err )
return nil , err
}
if ns != nil {
ctx = namespace . ContextWithNamespace ( ctx , ns )
}
}
}
// Prevent any metrics requests to be forwarded from a standby node.
// Instead, we return an error since we cannot be sure if we have an
// active token store to validate the provided token.
case strings . HasPrefix ( req . Path , "sys/metrics" ) :
if c . standby && ! c . perfStandby {
return nil , ErrCannotForwardLocalOnly
}
}
ns , err = namespace . FromContext ( ctx )
if err != nil {
return nil , errwrap . Wrapf ( "could not parse namespace from http context: {{err}}" , err )
}
2018-09-18 06:03:00 +03:00
if ! hasNamespaces ( c ) && ns . Path != "" {
return nil , logical . CodedError ( 403 , "namespaces feature not enabled" )
}
2021-04-08 19:43:39 +03:00
walState := & logical . WALState { }
2021-02-24 14:58:10 +03:00
ctx = logical . IndexStateContext ( ctx , walState )
2016-05-02 07:08:07 +03:00
var auth * logical . Auth
2022-02-17 22:43:07 +03:00
if c . isLoginRequest ( ctx , req ) {
2018-01-08 21:31:38 +03:00
resp , auth , err = c . handleLoginRequest ( ctx , req )
2016-05-02 07:08:07 +03:00
} else {
2018-01-08 21:31:38 +03:00
resp , auth , err = c . handleRequest ( ctx , req )
2016-05-02 07:08:07 +03:00
}
2023-02-15 22:57:57 +03:00
if err == nil && c . requestResponseCallback != nil {
c . requestResponseCallback ( c . router . MatchingBackend ( ctx , req . Path ) , req , resp )
}
2022-02-17 22:43:07 +03:00
// If we saved the token in the request, we should return it in the response
// data.
if resp != nil && resp . Data != nil {
if _ , ok := resp . Data [ "error" ] ; ! ok {
if requestBodyToken != "" {
resp . Data [ "id" ] = requestBodyToken
} else if returnRequestAuthToken && req . InboundSSCToken != "" {
resp . Data [ "id" ] = req . InboundSSCToken
}
}
}
if resp != nil && resp . Auth != nil && requestBodyToken != "" {
// if a client token has already been set and the request body token's internal token
// is equal to that value, then we can return the original request body token
tok , _ := c . DecodeSSCToken ( requestBodyToken )
if resp . Auth . ClientToken == tok {
resp . Auth . ClientToken = requestBodyToken
}
}
2016-05-02 07:08:07 +03:00
// Ensure we don't leak internal data
if resp != nil {
if resp . Secret != nil {
resp . Secret . InternalData = nil
}
if resp . Auth != nil {
resp . Auth . InternalData = nil
}
}
// We are wrapping if there is anything to wrap (not a nil response) and a
2016-09-29 07:01:28 +03:00
// TTL was specified for the token. Errors on a call should be returned to
// the caller, so wrapping is turned off if an error is hit and the error
// is logged to the audit log.
wrapping := resp != nil &&
err == nil &&
! resp . IsError ( ) &&
resp . WrapInfo != nil &&
2017-11-13 23:31:32 +03:00
resp . WrapInfo . TTL != 0 &&
resp . WrapInfo . Token == ""
2016-05-02 07:08:07 +03:00
2016-05-16 23:11:33 +03:00
if wrapping {
2018-01-08 21:31:38 +03:00
cubbyResp , cubbyErr := c . wrapInCubbyhole ( ctx , req , resp , auth )
2016-05-16 23:11:33 +03:00
// If not successful, returns either an error response from the
2016-09-29 07:01:28 +03:00
// cubbyhole backend or an error; if either is set, set resp and err to
// those and continue so that that's what we audit log. Otherwise
// finish the wrapping and audit log that.
if cubbyResp != nil || cubbyErr != nil {
resp = cubbyResp
err = cubbyErr
} else {
wrappingResp := & logical . Response {
WrapInfo : resp . WrapInfo ,
2017-06-05 17:52:43 +03:00
Warnings : resp . Warnings ,
2016-09-29 07:01:28 +03:00
}
resp = wrappingResp
2016-05-02 07:08:07 +03:00
}
}
2016-09-29 22:03:47 +03:00
auditResp := resp
// When unwrapping we want to log the actual response that will be written
// out. We still want to return the raw value to avoid automatic updating
// to any of it.
if req . Path == "sys/wrapping/unwrap" &&
resp != nil &&
resp . Data != nil &&
resp . Data [ logical . HTTPRawBody ] != nil {
// Decode the JSON
Fix response wrapping from K/V version 2 (#4511)
This takes place in two parts, since working on this exposed an issue
with response wrapping when there is a raw body set. The changes are (in
diff order):
* A CurrentWrappingLookupFunc has been added to return the current
value. This is necessary for the lookahead call since we don't want the
lookahead call to be wrapped.
* Support for unwrapping < 0.6.2 tokens via the API/CLI has been
removed, because we now have backends returning 404s with data and can't
rely on the 404 trick. These can still be read manually via
cubbyhole/response.
* KV preflight version request now ensures that its calls is not
wrapped, and restores any given function after.
* When responding with a raw body, instead of always base64-decoding a
string value and erroring on failure, on failure we assume that it
simply wasn't a base64-encoded value and use it as is.
* A test that fails on master and works now that ensures that raw body
responses that are wrapped and then unwrapped return the expected
values.
* A flag for response data that indicates to the wrapping handling that
the data contained therein is already JSON decoded (more later).
* RespondWithStatusCode now defaults to a string so that the value is
HMAC'd during audit. The function always JSON encodes the body, so
before now it was always returning []byte which would skip HMACing. We
don't know what's in the data, so this is a "better safe than sorry"
issue. If different behavior is needed, backends can always manually
populate the data instead of relying on the helper function.
* We now check unwrapped data after unwrapping to see if there were raw
flags. If so, we try to detect whether the value can be unbase64'd. The
reason is that if it can it was probably originally a []byte and
shouldn't be audit HMAC'd; if not, it was probably originally a string
and should be. In either case, we then set the value as the raw body and
hit the flag indicating that it's already been JSON decoded so not to
try again before auditing. Doing it this way ensures the right typing.
* There is now a check to see if the data coming from unwrapping is
already JSON decoded and if so the decoding is skipped before setting
the audit response.
2018-05-10 22:40:03 +03:00
if resp . Data [ logical . HTTPRawBodyAlreadyJSONDecoded ] != nil {
delete ( resp . Data , logical . HTTPRawBodyAlreadyJSONDecoded )
} else {
httpResp := & logical . HTTPResponse { }
err := jsonutil . DecodeJSON ( resp . Data [ logical . HTTPRawBody ] . ( [ ] byte ) , httpResp )
if err != nil {
c . logger . Error ( "failed to unmarshal wrapped HTTP response for audit logging" , "error" , err )
return nil , ErrInternalError
}
2016-09-29 22:03:47 +03:00
Fix response wrapping from K/V version 2 (#4511)
This takes place in two parts, since working on this exposed an issue
with response wrapping when there is a raw body set. The changes are (in
diff order):
* A CurrentWrappingLookupFunc has been added to return the current
value. This is necessary for the lookahead call since we don't want the
lookahead call to be wrapped.
* Support for unwrapping < 0.6.2 tokens via the API/CLI has been
removed, because we now have backends returning 404s with data and can't
rely on the 404 trick. These can still be read manually via
cubbyhole/response.
* KV preflight version request now ensures that its calls is not
wrapped, and restores any given function after.
* When responding with a raw body, instead of always base64-decoding a
string value and erroring on failure, on failure we assume that it
simply wasn't a base64-encoded value and use it as is.
* A test that fails on master and works now that ensures that raw body
responses that are wrapped and then unwrapped return the expected
values.
* A flag for response data that indicates to the wrapping handling that
the data contained therein is already JSON decoded (more later).
* RespondWithStatusCode now defaults to a string so that the value is
HMAC'd during audit. The function always JSON encodes the body, so
before now it was always returning []byte which would skip HMACing. We
don't know what's in the data, so this is a "better safe than sorry"
issue. If different behavior is needed, backends can always manually
populate the data instead of relying on the helper function.
* We now check unwrapped data after unwrapping to see if there were raw
flags. If so, we try to detect whether the value can be unbase64'd. The
reason is that if it can it was probably originally a []byte and
shouldn't be audit HMAC'd; if not, it was probably originally a string
and should be. In either case, we then set the value as the raw body and
hit the flag indicating that it's already been JSON decoded so not to
try again before auditing. Doing it this way ensures the right typing.
* There is now a check to see if the data coming from unwrapping is
already JSON decoded and if so the decoding is skipped before setting
the audit response.
2018-05-10 22:40:03 +03:00
auditResp = logical . HTTPResponseToLogicalResponse ( httpResp )
}
2016-09-29 22:03:47 +03:00
}
2018-03-02 20:18:39 +03:00
var nonHMACReqDataKeys [ ] string
var nonHMACRespDataKeys [ ] string
2018-09-18 06:03:00 +03:00
entry := c . router . MatchingMountEntry ( ctx , req . Path )
2018-03-02 20:18:39 +03:00
if entry != nil {
// Get and set ignored HMAC'd value. Reset those back to empty afterwards.
if rawVals , ok := entry . synthesizedConfigCache . Load ( "audit_non_hmac_request_keys" ) ; ok {
nonHMACReqDataKeys = rawVals . ( [ ] string )
}
// Get and set ignored HMAC'd value. Reset those back to empty afterwards.
if auditResp != nil {
if rawVals , ok := entry . synthesizedConfigCache . Load ( "audit_non_hmac_response_keys" ) ; ok {
nonHMACRespDataKeys = rawVals . ( [ ] string )
}
}
}
2016-05-02 07:08:07 +03:00
// Create an audit trail of the response
2018-09-18 06:03:00 +03:00
if ! isControlGroupRun ( req ) {
2020-05-21 16:20:05 +03:00
switch req . Path {
case "sys/replication/dr/status" , "sys/replication/performance/status" , "sys/replication/status" :
default :
logInput := & logical . LogInput {
Auth : auth ,
Request : req ,
Response : auditResp ,
OuterErr : err ,
NonHMACReqDataKeys : nonHMACReqDataKeys ,
NonHMACRespDataKeys : nonHMACRespDataKeys ,
}
if auditErr := c . auditBroker . LogResponse ( ctx , logInput , c . auditedHeaders ) ; auditErr != nil {
c . logger . Error ( "failed to audit response" , "request_path" , req . Path , "error" , auditErr )
return nil , ErrInternalError
}
2018-09-18 06:03:00 +03:00
}
2016-05-02 07:08:07 +03:00
}
2021-02-24 14:58:10 +03:00
if walState . LocalIndex != 0 || walState . ReplicatedIndex != 0 {
2023-01-07 01:06:54 +03:00
walState . ClusterID = c . ClusterID ( )
2021-02-24 14:58:10 +03:00
if walState . LocalIndex == 0 {
if c . perfStandby {
walState . LocalIndex = LastRemoteWAL ( c )
} else {
walState . LocalIndex = LastWAL ( c )
}
}
if walState . ReplicatedIndex == 0 {
if c . perfStandby {
walState . ReplicatedIndex = LastRemoteUpstreamWAL ( c )
} else {
walState . ReplicatedIndex = LastRemoteWAL ( c )
}
}
req . SetResponseState ( walState )
}
2016-05-02 07:08:07 +03:00
return
}
2018-09-18 06:03:00 +03:00
func isControlGroupRun ( req * logical . Request ) bool {
return req . ControlGroup != nil
}
2019-03-05 22:55:07 +03:00
func ( c * Core ) doRouting ( ctx context . Context , req * logical . Request ) ( * logical . Response , error ) {
// If we're replicating and we get a read-only error from a backend, need to forward to primary
resp , err := c . router . Route ( ctx , req )
2019-07-06 01:12:34 +03:00
if shouldForward ( c , resp , err ) {
2023-05-18 15:07:54 +03:00
fwdResp , fwdErr := forward ( ctx , c , req )
if fwdErr != nil && err != logical . ErrReadOnly {
// When handling the request locally, we got an error that
// contained ErrReadOnly, but had additional information.
// Since we've now forwarded this request and got _another_
// error, we should tell the user about both errors, so
// they know about both.
//
// When there is no error from forwarding, the request
// succeeded and so no additional context is necessary. When
// the initial error here was only ErrReadOnly, it's likely
// the plugin authors intended to forward this request
// remotely anyway.
repErr , ok := fwdErr . ( * logical . ReplicationCodedError )
if ok {
fwdErr = & logical . ReplicationCodedError {
Msg : fmt . Sprintf ( "errors from both primary and secondary; primary error was %s; secondary errors follow: %s" , repErr . Error ( ) , err . Error ( ) ) ,
Code : repErr . Code ,
}
} else {
fwdErr = multierror . Append ( fwdErr , err )
}
}
return fwdResp , fwdErr
2019-03-05 22:55:07 +03:00
}
return resp , err
}
2022-02-17 22:43:07 +03:00
func ( c * Core ) isLoginRequest ( ctx context . Context , req * logical . Request ) bool {
return c . router . LoginPath ( ctx , req . Path )
}
2018-01-08 21:31:38 +03:00
func ( c * Core ) handleRequest ( ctx context . Context , req * logical . Request ) ( retResp * logical . Response , retAuth * logical . Auth , retErr error ) {
2016-05-02 07:08:07 +03:00
defer metrics . MeasureSince ( [ ] string { "core" , "handle_request" } , time . Now ( ) )
2018-03-02 20:18:39 +03:00
var nonHMACReqDataKeys [ ] string
2018-09-18 06:03:00 +03:00
entry := c . router . MatchingMountEntry ( ctx , req . Path )
2018-03-02 20:18:39 +03:00
if entry != nil {
2020-07-06 19:17:41 +03:00
// Set here so the audit log has it even if authorization fails
2020-07-14 22:28:11 +03:00
req . MountType = entry . Type
2023-04-06 10:41:07 +03:00
req . SetMountRunningSha256 ( entry . RunningSha256 )
req . SetMountRunningVersion ( entry . RunningVersion )
req . SetMountIsExternalPlugin ( entry . IsExternalPlugin ( ) )
req . SetMountClass ( entry . MountClass ( ) )
2018-03-02 20:18:39 +03:00
// Get and set ignored HMAC'd value.
if rawVals , ok := entry . synthesizedConfigCache . Load ( "audit_non_hmac_request_keys" ) ; ok {
nonHMACReqDataKeys = rawVals . ( [ ] string )
}
}
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
c . logger . Error ( "failed to get namespace from context" , "error" , err )
retErr = multierror . Append ( retErr , ErrInternalError )
return
}
2016-05-02 07:08:07 +03:00
// Validate the token
2023-02-10 23:56:00 +03:00
auth , te , ctErr := c . CheckToken ( ctx , req , false )
2022-03-30 16:08:02 +03:00
if ctErr == logical . ErrRelativePath {
return logical . ErrorResponse ( ctErr . Error ( ) ) , nil , ctErr
}
2019-01-25 22:08:42 +03:00
if ctErr == logical . ErrPerfStandbyPleaseForward {
return nil , nil , ctErr
}
2021-12-09 01:34:42 +03:00
// Updating in-flight request data with client/entity ID
inFlightReqID , ok := ctx . Value ( logical . CtxKeyInFlightRequestID { } ) . ( string )
if ok && req . ClientID != "" {
c . UpdateInFlightReqData ( inFlightReqID , req . ClientID )
}
2019-01-25 22:08:42 +03:00
// We run this logic first because we want to decrement the use count even
// in the case of an error (assuming we can successfully look up; if we
// need to forward, we exit before now)
2018-09-18 06:03:00 +03:00
if te != nil && ! isControlGroupRun ( req ) {
2016-05-02 10:11:14 +03:00
// Attempt to use the token (decrement NumUses)
var err error
2018-01-19 09:44:44 +03:00
te , err = c . tokenStore . UseToken ( ctx , te )
2016-05-02 10:11:14 +03:00
if err != nil {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "failed to use token" , "error" , err )
2016-05-16 23:11:33 +03:00
retErr = multierror . Append ( retErr , ErrInternalError )
return nil , nil , retErr
2016-05-02 10:11:14 +03:00
}
if te == nil {
// Token has been revoked by this point
2016-05-16 23:11:33 +03:00
retErr = multierror . Append ( retErr , logical . ErrPermissionDenied )
return nil , nil , retErr
2016-05-02 10:11:14 +03:00
}
2018-05-10 22:50:02 +03:00
if te . NumUses == tokenRevocationPending {
2016-05-02 10:11:14 +03:00
// We defer a revocation until after logic has run, since this is a
// valid request (this is the token's final use). We pass the ID in
// directly just to be safe in case something else modifies te later.
defer func ( id string ) {
2018-09-18 06:03:00 +03:00
nsActiveCtx := namespace . ContextWithNamespace ( c . activeContext , ns )
leaseID , err := c . expiration . CreateOrFetchRevocationLeaseByToken ( nsActiveCtx , te )
2018-05-10 22:50:02 +03:00
if err == nil {
2018-08-02 04:39:39 +03:00
err = c . expiration . LazyRevoke ( ctx , leaseID )
2018-05-10 22:50:02 +03:00
}
2016-05-02 10:11:14 +03:00
if err != nil {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "failed to revoke token" , "error" , err )
2016-05-02 10:11:14 +03:00
retResp = nil
retAuth = nil
2016-05-16 23:11:33 +03:00
retErr = multierror . Append ( retErr , ErrInternalError )
2016-05-02 10:11:14 +03:00
}
if retResp != nil && retResp . Secret != nil &&
// Some backends return a TTL even without a Lease ID
retResp . Secret . LeaseID != "" {
retResp = logical . ErrorResponse ( "Secret cannot be returned; token had one use left, so leased credentials were immediately revoked." )
return
}
} ( te . ID )
}
2016-05-02 07:08:07 +03:00
}
2018-09-18 06:03:00 +03:00
2016-05-02 10:11:14 +03:00
if ctErr != nil {
2018-09-18 06:03:00 +03:00
newCtErr , cgResp , cgAuth , cgRetErr := checkNeedsCG ( ctx , c , req , auth , ctErr , nonHMACReqDataKeys )
switch {
case newCtErr != nil :
2019-01-10 04:39:58 +03:00
ctErr = newCtErr
2018-09-18 06:03:00 +03:00
case cgResp != nil || cgAuth != nil :
if cgRetErr != nil {
retErr = multierror . Append ( retErr , cgRetErr )
}
return cgResp , cgAuth , retErr
}
2016-05-02 07:08:07 +03:00
// If it is an internal error we return that, otherwise we
// return invalid request so that the status codes can be correct
2018-08-10 16:59:58 +03:00
switch {
case ctErr == ErrInternalError ,
errwrap . Contains ( ctErr , ErrInternalError . Error ( ) ) ,
ctErr == logical . ErrPermissionDenied ,
errwrap . Contains ( ctErr , logical . ErrPermissionDenied . Error ( ) ) :
switch ctErr . ( type ) {
case * multierror . Error :
retErr = ctErr
default :
retErr = multierror . Append ( retErr , ctErr )
}
default :
retErr = multierror . Append ( retErr , logical . ErrInvalidRequest )
2016-05-02 07:08:07 +03:00
}
2018-09-18 06:03:00 +03:00
if ! isControlGroupRun ( req ) {
2019-05-23 01:52:53 +03:00
logInput := & logical . LogInput {
2018-09-18 06:03:00 +03:00
Auth : auth ,
Request : req ,
OuterErr : ctErr ,
NonHMACReqDataKeys : nonHMACReqDataKeys ,
}
if err := c . auditBroker . LogRequest ( ctx , logInput , c . auditedHeaders ) ; err != nil {
c . logger . Error ( "failed to audit request" , "path" , req . Path , "error" , err )
}
2016-05-02 07:08:07 +03:00
}
2018-08-10 16:59:58 +03:00
if errwrap . Contains ( retErr , ErrInternalError . Error ( ) ) {
2017-08-15 23:44:16 +03:00
return nil , auth , retErr
}
2017-06-06 01:04:31 +03:00
return logical . ErrorResponse ( ctErr . Error ( ) ) , auth , retErr
2016-05-02 07:08:07 +03:00
}
// Attach the display name
req . DisplayName = auth . DisplayName
// Create an audit trail of the request
2018-09-18 06:03:00 +03:00
if ! isControlGroupRun ( req ) {
2019-05-23 01:52:53 +03:00
logInput := & logical . LogInput {
2018-09-18 06:03:00 +03:00
Auth : auth ,
Request : req ,
NonHMACReqDataKeys : nonHMACReqDataKeys ,
}
if err := c . auditBroker . LogRequest ( ctx , logInput , c . auditedHeaders ) ; err != nil {
c . logger . Error ( "failed to audit request" , "path" , req . Path , "error" , err )
retErr = multierror . Append ( retErr , ErrInternalError )
return nil , auth , retErr
}
2016-05-02 07:08:07 +03:00
}
2021-10-14 03:15:54 +03:00
if err := enterpriseBlockRequestIfError ( c , ns . Path , req . Path ) ; err != nil {
return nil , nil , multierror . Append ( retErr , err )
}
2020-06-27 00:13:16 +03:00
leaseGenerated := false
2021-09-02 17:54:21 +03:00
quotaResp , quotaErr := c . applyLeaseCountQuota ( ctx , & quotas . Request {
2020-06-27 00:13:16 +03:00
Path : req . Path ,
MountPath : strings . TrimPrefix ( req . MountPoint , ns . Path ) ,
NamespacePath : ns . Path ,
} )
if quotaErr != nil {
2021-02-10 21:24:35 +03:00
c . logger . Error ( "failed to apply quota" , "path" , req . Path , "error" , quotaErr )
2020-06-27 00:13:16 +03:00
retErr = multierror . Append ( retErr , quotaErr )
return nil , auth , retErr
}
if ! quotaResp . Allowed {
if c . logger . IsTrace ( ) {
c . logger . Trace ( "request rejected due to lease count quota violation" , "request_path" , req . Path )
}
2021-05-11 20:12:54 +03:00
retErr = multierror . Append ( retErr , fmt . Errorf ( "request path %q: %w" , req . Path , quotas . ErrLeaseCountQuotaExceeded ) )
2020-06-27 00:13:16 +03:00
return nil , auth , retErr
}
defer func ( ) {
if quotaResp . Access != nil {
quotaAckErr := c . ackLeaseQuota ( quotaResp . Access , leaseGenerated )
if quotaAckErr != nil {
retErr = multierror . Append ( retErr , quotaAckErr )
}
}
} ( )
2016-05-02 07:08:07 +03:00
// Route the request
2019-03-05 22:55:07 +03:00
resp , routeErr := c . doRouting ( ctx , req )
2016-05-16 23:11:33 +03:00
if resp != nil {
2019-03-05 22:55:07 +03:00
2016-11-11 23:12:11 +03:00
// If wrapping is used, use the shortest between the request and response
var wrapTTL time . Duration
2017-08-03 01:28:58 +03:00
var wrapFormat , creationPath string
2017-11-09 20:47:42 +03:00
var sealWrap bool
2016-05-16 23:11:33 +03:00
2016-11-11 23:12:11 +03:00
// Ensure no wrap info information is set other than, possibly, the TTL
if resp . WrapInfo != nil {
if resp . WrapInfo . TTL > 0 {
wrapTTL = resp . WrapInfo . TTL
}
2017-01-05 00:44:03 +03:00
wrapFormat = resp . WrapInfo . Format
2017-08-03 01:28:58 +03:00
creationPath = resp . WrapInfo . CreationPath
2017-11-09 20:47:42 +03:00
sealWrap = resp . WrapInfo . SealWrap
2016-11-11 23:12:11 +03:00
resp . WrapInfo = nil
}
2017-01-05 00:44:03 +03:00
if req . WrapInfo != nil {
if req . WrapInfo . TTL > 0 {
switch {
case wrapTTL == 0 :
wrapTTL = req . WrapInfo . TTL
case req . WrapInfo . TTL < wrapTTL :
wrapTTL = req . WrapInfo . TTL
}
}
// If the wrap format hasn't been set by the response, set it to
// the request format
if req . WrapInfo . Format != "" && wrapFormat == "" {
wrapFormat = req . WrapInfo . Format
2016-11-11 23:12:11 +03:00
}
}
if wrapTTL > 0 {
2017-04-24 22:15:01 +03:00
resp . WrapInfo = & wrapping . ResponseWrapInfo {
2017-08-03 01:28:58 +03:00
TTL : wrapTTL ,
Format : wrapFormat ,
CreationPath : creationPath ,
2017-11-09 20:47:42 +03:00
SealWrap : sealWrap ,
2016-05-16 23:11:33 +03:00
}
}
}
2016-05-02 07:08:07 +03:00
// If there is a secret, we must register it with the expiration manager.
// We exclude renewal of a lease, since it does not need to be re-registered
2017-06-20 19:34:00 +03:00
if resp != nil && resp . Secret != nil && ! strings . HasPrefix ( req . Path , "sys/renew" ) &&
! strings . HasPrefix ( req . Path , "sys/leases/renew" ) {
2017-09-15 16:02:29 +03:00
// KV mounts should return the TTL but not register
2016-05-02 07:08:07 +03:00
// for a lease as this provides a massive slowdown
registerLease := true
2018-03-21 22:04:27 +03:00
2018-09-18 06:03:00 +03:00
matchingMountEntry := c . router . MatchingMountEntry ( ctx , req . Path )
2018-03-21 22:04:27 +03:00
if matchingMountEntry == nil {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "unable to retrieve kv mount entry from router" )
2016-05-16 23:11:33 +03:00
retErr = multierror . Append ( retErr , ErrInternalError )
return nil , auth , retErr
2016-05-02 07:08:07 +03:00
}
2018-03-21 22:04:27 +03:00
switch matchingMountEntry . Type {
case "kv" , "generic" :
// If we are kv type, first see if we are an older passthrough
// backend, and otherwise check the mount entry options.
2018-09-18 06:03:00 +03:00
matchingBackend := c . router . MatchingBackend ( ctx , req . Path )
2018-03-21 22:04:27 +03:00
if matchingBackend == nil {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "unable to retrieve kv backend from router" )
2018-03-21 22:04:27 +03:00
retErr = multierror . Append ( retErr , ErrInternalError )
return nil , auth , retErr
}
if ptbe , ok := matchingBackend . ( * PassthroughBackend ) ; ok {
if ! ptbe . GeneratesLeases ( ) {
registerLease = false
resp . Secret . Renewable = false
}
} else if matchingMountEntry . Options == nil || matchingMountEntry . Options [ "leased_passthrough" ] != "true" {
registerLease = false
resp . Secret . Renewable = false
}
case "plugin" :
// If we are a plugin type and the plugin name is "kv" check the
// mount entry options.
2018-11-20 02:23:48 +03:00
if matchingMountEntry . Config . PluginName == "kv" && ( matchingMountEntry . Options == nil || matchingMountEntry . Options [ "leased_passthrough" ] != "true" ) {
2016-05-02 07:08:07 +03:00
registerLease = false
resp . Secret . Renewable = false
}
}
if registerLease {
2018-09-18 06:03:00 +03:00
sysView := c . router . MatchingSystemView ( ctx , req . Path )
2018-04-03 19:20:20 +03:00
if sysView == nil {
2018-04-10 04:14:23 +03:00
c . logger . Error ( "unable to look up sys view for login path" , "request_path" , req . Path )
2018-04-03 19:20:20 +03:00
return nil , nil , ErrInternalError
}
ttl , warnings , err := framework . CalculateTTL ( sysView , 0 , resp . Secret . TTL , 0 , resp . Secret . MaxTTL , 0 , time . Time { } )
if err != nil {
return nil , nil , err
}
for _ , warning := range warnings {
resp . AddWarning ( warning )
}
resp . Secret . TTL = ttl
2018-09-18 06:03:00 +03:00
registerFunc , funcGetErr := getLeaseRegisterFunc ( c )
if funcGetErr != nil {
retErr = multierror . Append ( retErr , funcGetErr )
return nil , auth , retErr
}
2023-08-18 16:09:32 +03:00
leaseID , err := registerFunc ( ctx , req , resp , "" )
2016-05-02 07:08:07 +03:00
if err != nil {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "failed to register lease" , "request_path" , req . Path , "error" , err )
2016-05-16 23:11:33 +03:00
retErr = multierror . Append ( retErr , ErrInternalError )
return nil , auth , retErr
2016-05-02 07:08:07 +03:00
}
2020-06-27 00:13:16 +03:00
leaseGenerated = true
2016-05-02 07:08:07 +03:00
resp . Secret . LeaseID = leaseID
2018-10-15 19:56:24 +03:00
2020-06-18 23:36:21 +03:00
// Count the lease creation
ttl_label := metricsutil . TTLBucket ( resp . Secret . TTL )
2020-07-14 22:28:11 +03:00
mountPointWithoutNs := ns . TrimmedPath ( req . MountPoint )
2020-06-18 23:36:21 +03:00
c . MetricSink ( ) . IncrCounterWithLabels (
[ ] string { "secret" , "lease" , "creation" } ,
1 ,
[ ] metrics . Label {
2020-10-14 02:38:21 +03:00
metricsutil . NamespaceLabel ( ns ) ,
2020-06-18 23:36:21 +03:00
{ "secret_engine" , req . MountType } ,
2020-07-14 22:28:11 +03:00
{ "mount_point" , mountPointWithoutNs } ,
2020-06-18 23:36:21 +03:00
{ "creation_ttl" , ttl_label } ,
} ,
)
2016-05-02 07:08:07 +03:00
}
}
// Only the token store is allowed to return an auth block, for any
2020-03-31 23:36:45 +03:00
// other request this is an internal error.
if resp != nil && resp . Auth != nil {
2016-05-02 07:08:07 +03:00
if ! strings . HasPrefix ( req . Path , "auth/token/" ) {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "unexpected Auth response for non-token backend" , "request_path" , req . Path )
2016-05-16 23:11:33 +03:00
retErr = multierror . Append ( retErr , ErrInternalError )
return nil , auth , retErr
2016-05-02 07:08:07 +03:00
}
2018-09-18 06:03:00 +03:00
// Fetch the namespace to which the token belongs
tokenNS , err := NamespaceByID ( ctx , te . NamespaceID , c )
if err != nil {
c . logger . Error ( "failed to fetch token's namespace" , "error" , err )
retErr = multierror . Append ( retErr , err )
return nil , auth , retErr
}
if tokenNS == nil {
c . logger . Error ( namespace . ErrNoNamespace . Error ( ) )
retErr = multierror . Append ( retErr , namespace . ErrNoNamespace )
return nil , auth , retErr
}
2021-10-07 20:36:22 +03:00
_ , identityPolicies , err := c . fetchEntityAndDerivedPolicies ( ctx , tokenNS , resp . Auth . EntityID , false )
2018-06-14 16:49:33 +03:00
if err != nil {
2019-11-09 00:14:03 +03:00
// Best-effort clean up on error, so we log the cleanup error as a
// warning but still return as internal error.
if err := c . tokenStore . revokeOrphan ( ctx , resp . Auth . ClientToken ) ; err != nil {
c . logger . Warn ( "failed to clean up token lease from entity and policy lookup failure" , "request_path" , req . Path , "error" , err )
}
2018-06-14 16:49:33 +03:00
return nil , nil , ErrInternalError
}
2020-03-31 23:36:45 +03:00
// We skip expiration manager registration for token renewal since it
// does not need to be re-registered
if strings . HasPrefix ( req . Path , "auth/token/renew" ) {
// We build the "policies" list to be returned by starting with
// token policies, and add identity policies right after this
// conditional
2022-02-17 22:43:07 +03:00
tok , _ := c . DecodeSSCToken ( req . InboundSSCToken )
if resp . Auth . ClientToken == tok {
resp . Auth . ClientToken = req . InboundSSCToken
}
2020-03-31 23:36:45 +03:00
resp . Auth . Policies = policyutil . SanitizePolicies ( resp . Auth . TokenPolicies , policyutil . DoNotAddDefaultPolicy )
} else {
resp . Auth . TokenPolicies = policyutil . SanitizePolicies ( resp . Auth . Policies , policyutil . DoNotAddDefaultPolicy )
switch resp . Auth . TokenType {
case logical . TokenTypeBatch :
case logical . TokenTypeService :
2023-01-24 22:00:27 +03:00
if ! c . perfStandby {
registeredTokenEntry := & logical . TokenEntry {
TTL : auth . TTL ,
Policies : auth . TokenPolicies ,
Path : resp . Auth . CreationPath ,
NamespaceID : ns . ID ,
2020-03-31 23:36:45 +03:00
}
2023-08-29 02:16:57 +03:00
2023-08-30 00:52:08 +03:00
// Only logins apply to role based quotas, so we can omit the role here, as we are not logging in.
if err := c . expiration . RegisterAuth ( ctx , registeredTokenEntry , resp . Auth , "" ) ; err != nil {
2023-01-24 22:00:27 +03:00
// Best-effort clean up on error, so we log the cleanup error as
// a warning but still return as internal error.
if err := c . tokenStore . revokeOrphan ( ctx , resp . Auth . ClientToken ) ; err != nil {
c . logger . Warn ( "failed to clean up token lease during auth/token/ request" , "request_path" , req . Path , "error" , err )
}
c . logger . Error ( "failed to register token lease during auth/token/ request" , "request_path" , req . Path , "error" , err )
retErr = multierror . Append ( retErr , ErrInternalError )
return nil , auth , retErr
}
if registeredTokenEntry . ExternalID != "" {
resp . Auth . ClientToken = registeredTokenEntry . ExternalID
}
leaseGenerated = true
2022-02-17 22:43:07 +03:00
}
2018-10-15 19:56:24 +03:00
}
2016-05-02 07:08:07 +03:00
}
2018-07-24 22:03:11 +03:00
// We do these later since it's not meaningful for backends/expmgr to
// have what is purely a snapshot of current identity policies, and
// plugins can be confused if they are checking contents of
// Auth.Policies instead of Auth.TokenPolicies
2018-09-18 06:03:00 +03:00
resp . Auth . Policies = policyutil . SanitizePolicies ( append ( resp . Auth . Policies , identityPolicies [ te . NamespaceID ] ... ) , policyutil . DoNotAddDefaultPolicy )
resp . Auth . IdentityPolicies = policyutil . SanitizePolicies ( identityPolicies [ te . NamespaceID ] , policyutil . DoNotAddDefaultPolicy )
delete ( identityPolicies , te . NamespaceID )
resp . Auth . ExternalNamespacePolicies = identityPolicies
2016-05-02 07:08:07 +03:00
}
2016-09-29 07:01:28 +03:00
if resp != nil &&
req . Path == "cubbyhole/response" &&
len ( te . Policies ) == 1 &&
te . Policies [ 0 ] == responseWrappingPolicyName {
2016-09-30 00:44:15 +03:00
resp . AddWarning ( "Reading from 'cubbyhole/response' is deprecated. Please use sys/wrapping/unwrap to unwrap responses, as it provides additional security checks and other benefits." )
2016-09-29 07:01:28 +03:00
}
2016-05-02 07:08:07 +03:00
// Return the response and error
2017-02-17 07:09:39 +03:00
if routeErr != nil {
retErr = multierror . Append ( retErr , routeErr )
2016-05-16 23:11:33 +03:00
}
2017-11-02 23:05:48 +03:00
2016-05-16 23:11:33 +03:00
return resp , auth , retErr
2016-05-02 07:08:07 +03:00
}
// handleLoginRequest is used to handle a login request, which is an
// unauthenticated request to the backend.
2018-01-08 21:31:38 +03:00
func ( c * Core ) handleLoginRequest ( ctx context . Context , req * logical . Request ) ( retResp * logical . Response , retAuth * logical . Auth , retErr error ) {
2016-05-02 07:08:07 +03:00
defer metrics . MeasureSince ( [ ] string { "core" , "handle_login_request" } , time . Now ( ) )
2017-10-23 21:59:37 +03:00
req . Unauthenticated = true
2017-10-23 23:49:46 +03:00
2019-04-29 23:14:26 +03:00
var nonHMACReqDataKeys [ ] string
entry := c . router . MatchingMountEntry ( ctx , req . Path )
if entry != nil {
2020-07-06 19:17:41 +03:00
// Set here so the audit log has it even if authorization fails
2020-07-14 22:28:11 +03:00
req . MountType = entry . Type
2023-04-06 10:41:07 +03:00
req . SetMountRunningSha256 ( entry . RunningSha256 )
req . SetMountRunningVersion ( entry . RunningVersion )
req . SetMountIsExternalPlugin ( entry . IsExternalPlugin ( ) )
req . SetMountClass ( entry . MountClass ( ) )
2019-04-29 23:14:26 +03:00
// Get and set ignored HMAC'd value.
if rawVals , ok := entry . synthesizedConfigCache . Load ( "audit_non_hmac_request_keys" ) ; ok {
nonHMACReqDataKeys = rawVals . ( [ ] string )
}
}
2018-09-18 06:03:00 +03:00
// Do an unauth check. This will cause EGP policies to be checked
2019-04-29 23:14:26 +03:00
var auth * logical . Auth
2018-09-18 06:03:00 +03:00
var ctErr error
2023-02-10 23:56:00 +03:00
auth , _ , ctErr = c . CheckToken ( ctx , req , true )
2019-01-25 22:08:42 +03:00
if ctErr == logical . ErrPerfStandbyPleaseForward {
return nil , nil , ctErr
}
2021-12-09 01:34:42 +03:00
// Updating in-flight request data with client/entity ID
inFlightReqID , ok := ctx . Value ( logical . CtxKeyInFlightRequestID { } ) . ( string )
if ok && req . ClientID != "" {
c . UpdateInFlightReqData ( inFlightReqID , req . ClientID )
}
2018-09-18 06:03:00 +03:00
if ctErr != nil {
// If it is an internal error we return that, otherwise we
// return invalid request so that the status codes can be correct
var errType error
switch ctErr {
case ErrInternalError , logical . ErrPermissionDenied :
errType = ctErr
default :
errType = logical . ErrInvalidRequest
}
2019-05-23 01:52:53 +03:00
logInput := & logical . LogInput {
2018-09-18 06:03:00 +03:00
Auth : auth ,
Request : req ,
OuterErr : ctErr ,
NonHMACReqDataKeys : nonHMACReqDataKeys ,
}
if err := c . auditBroker . LogRequest ( ctx , logInput , c . auditedHeaders ) ; err != nil {
2018-10-09 19:43:17 +03:00
c . logger . Error ( "failed to audit request" , "path" , req . Path , "error" , err )
2018-09-18 06:03:00 +03:00
return nil , nil , ErrInternalError
}
if errType != nil {
retErr = multierror . Append ( retErr , errType )
}
if ctErr == ErrInternalError {
return nil , auth , retErr
}
return logical . ErrorResponse ( ctErr . Error ( ) ) , auth , retErr
}
2020-05-21 16:20:05 +03:00
switch req . Path {
case "sys/replication/dr/status" , "sys/replication/performance/status" , "sys/replication/status" :
default :
// Create an audit trail of the request. Attach auth if it was returned,
// e.g. if a token was provided.
logInput := & logical . LogInput {
Auth : auth ,
Request : req ,
NonHMACReqDataKeys : nonHMACReqDataKeys ,
}
if err := c . auditBroker . LogRequest ( ctx , logInput , c . auditedHeaders ) ; err != nil {
c . logger . Error ( "failed to audit request" , "path" , req . Path , "error" , err )
return nil , nil , ErrInternalError
}
2016-05-02 07:08:07 +03:00
}
2016-08-09 00:32:37 +03:00
// The token store uses authentication even when creating a new token,
// so it's handled in handleRequest. It should not be reached here.
if strings . HasPrefix ( req . Path , "auth/token/" ) {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "unexpected login request for token backend" , "request_path" , req . Path )
2016-08-09 00:56:14 +03:00
return nil , nil , ErrInternalError
2016-08-09 00:32:37 +03:00
}
2022-12-07 04:22:46 +03:00
// check if user lockout feature is disabled
isUserLockoutDisabled , err := c . isUserLockoutDisabled ( entry )
if err != nil {
return nil , nil , err
}
// if user lockout feature is not disabled, check if the user is locked
if ! isUserLockoutDisabled {
isloginUserLocked , err := c . isUserLocked ( ctx , entry , req )
if err != nil {
return nil , nil , err
}
if isloginUserLocked {
return nil , nil , logical . ErrPermissionDenied
}
}
2016-05-02 07:08:07 +03:00
// Route the request
2019-03-05 22:55:07 +03:00
resp , routeErr := c . doRouting ( ctx , req )
2022-12-07 04:22:46 +03:00
// if routeErr has invalid credentials error, update the userFailedLoginMap
if routeErr != nil && routeErr == logical . ErrInvalidCredentials {
2023-05-31 20:51:20 +03:00
if ! isUserLockoutDisabled {
err := c . failedUserLoginProcess ( ctx , entry , req )
if err != nil {
return nil , nil , err
}
2022-12-07 04:22:46 +03:00
}
2023-06-28 20:46:37 +03:00
return resp , nil , routeErr
2022-12-07 04:22:46 +03:00
}
2016-07-05 18:46:21 +03:00
if resp != nil {
2016-11-11 23:12:11 +03:00
// If wrapping is used, use the shortest between the request and response
var wrapTTL time . Duration
2017-08-03 01:28:58 +03:00
var wrapFormat , creationPath string
2017-11-09 20:47:42 +03:00
var sealWrap bool
2016-07-05 18:46:21 +03:00
2016-11-11 23:12:11 +03:00
// Ensure no wrap info information is set other than, possibly, the TTL
if resp . WrapInfo != nil {
if resp . WrapInfo . TTL > 0 {
wrapTTL = resp . WrapInfo . TTL
}
2017-01-05 00:44:03 +03:00
wrapFormat = resp . WrapInfo . Format
2017-08-03 01:28:58 +03:00
creationPath = resp . WrapInfo . CreationPath
2017-11-09 20:47:42 +03:00
sealWrap = resp . WrapInfo . SealWrap
2016-11-11 23:12:11 +03:00
resp . WrapInfo = nil
}
2017-01-05 00:44:03 +03:00
if req . WrapInfo != nil {
if req . WrapInfo . TTL > 0 {
switch {
case wrapTTL == 0 :
wrapTTL = req . WrapInfo . TTL
case req . WrapInfo . TTL < wrapTTL :
wrapTTL = req . WrapInfo . TTL
}
}
if req . WrapInfo . Format != "" && wrapFormat == "" {
wrapFormat = req . WrapInfo . Format
2016-11-11 23:12:11 +03:00
}
}
if wrapTTL > 0 {
2017-04-24 22:15:01 +03:00
resp . WrapInfo = & wrapping . ResponseWrapInfo {
2017-08-03 01:28:58 +03:00
TTL : wrapTTL ,
Format : wrapFormat ,
CreationPath : creationPath ,
2017-11-09 20:47:42 +03:00
SealWrap : sealWrap ,
2016-07-05 18:46:21 +03:00
}
}
}
2016-05-02 07:08:07 +03:00
// A login request should never return a secret!
if resp != nil && resp . Secret != nil {
2018-04-03 03:46:59 +03:00
c . logger . Error ( "unexpected Secret response for login path" , "request_path" , req . Path )
2016-05-02 07:08:07 +03:00
return nil , nil , ErrInternalError
}
2021-10-14 03:15:54 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
c . logger . Error ( "failed to get namespace from context" , "error" , err )
retErr = multierror . Append ( retErr , ErrInternalError )
return
}
2016-05-02 07:08:07 +03:00
// If the response generated an authentication, then generate the token
2022-02-18 00:08:51 +03:00
if resp != nil && resp . Auth != nil && req . Path != "sys/mfa/validate" {
2021-10-14 03:15:54 +03:00
leaseGenerated := false
// by placing this after the authorization check, we don't leak
// information about locked namespaces to unauthenticated clients.
if err := enterpriseBlockRequestIfError ( c , ns . Path , req . Path ) ; err != nil {
retErr = multierror . Append ( retErr , err )
2020-06-27 00:13:16 +03:00
return
}
2023-08-29 23:55:08 +03:00
// Check for request role in context to role based quotas
2023-08-29 02:16:57 +03:00
var role string
2023-08-30 18:28:32 +03:00
reqRole := ctx . Value ( logical . CtxKeyRequestRole { } )
if reqRole != nil {
2023-08-29 02:16:57 +03:00
role = reqRole . ( string )
}
2020-06-27 00:13:16 +03:00
// The request successfully authenticated itself. Run the quota checks
// before creating lease.
2021-09-02 17:54:21 +03:00
quotaResp , quotaErr := c . applyLeaseCountQuota ( ctx , & quotas . Request {
2020-06-27 00:13:16 +03:00
Path : req . Path ,
MountPath : strings . TrimPrefix ( req . MountPoint , ns . Path ) ,
2023-08-29 02:16:57 +03:00
Role : role ,
2020-06-27 00:13:16 +03:00
NamespacePath : ns . Path ,
} )
if quotaErr != nil {
2021-02-10 21:24:35 +03:00
c . logger . Error ( "failed to apply quota" , "path" , req . Path , "error" , quotaErr )
2020-06-27 00:13:16 +03:00
retErr = multierror . Append ( retErr , quotaErr )
return
}
if ! quotaResp . Allowed {
if c . logger . IsTrace ( ) {
c . logger . Trace ( "request rejected due to lease count quota violation" , "request_path" , req . Path )
}
2021-05-11 20:12:54 +03:00
retErr = multierror . Append ( retErr , fmt . Errorf ( "request path %q: %w" , req . Path , quotas . ErrLeaseCountQuotaExceeded ) )
2020-06-27 00:13:16 +03:00
return
}
defer func ( ) {
if quotaResp . Access != nil {
quotaAckErr := c . ackLeaseQuota ( quotaResp . Access , leaseGenerated )
if quotaAckErr != nil {
retErr = multierror . Append ( retErr , quotaAckErr )
}
}
} ( )
2018-05-10 01:39:55 +03:00
2017-10-11 20:21:20 +03:00
var entity * identity . Entity
2016-05-02 07:08:07 +03:00
auth = resp . Auth
2018-09-18 06:03:00 +03:00
mEntry := c . router . MatchingMountEntry ( ctx , req . Path )
2018-04-23 20:46:14 +03:00
2018-04-25 06:10:22 +03:00
if auth . Alias != nil &&
mEntry != nil &&
c . identityStore != nil {
2022-02-24 22:57:40 +03:00
if mEntry . Local && os . Getenv ( EnvVaultDisableLocalAuthMountEntities ) != "" {
goto CREATE_TOKEN
}
2017-10-11 20:21:20 +03:00
// Overwrite the mount type and mount path in the alias
// information
auth . Alias . MountType = req . MountType
auth . Alias . MountAccessor = req . MountAccessor
2021-10-15 22:20:00 +03:00
auth . Alias . Local = mEntry . Local
2017-10-11 20:21:20 +03:00
if auth . Alias . Name == "" {
return nil , nil , fmt . Errorf ( "missing name in alias" )
}
var err error
2018-02-09 18:40:56 +03:00
// Fetch the entity for the alias, or create an entity if one
// doesn't exist.
2022-05-18 19:16:13 +03:00
entity , entityCreated , err := c . identityStore . CreateOrFetchEntity ( ctx , auth . Alias )
2018-09-18 06:03:00 +03:00
if err != nil {
2021-10-15 22:20:00 +03:00
switch auth . Alias . Local {
case true :
2022-07-21 20:53:42 +03:00
// Only create a new entity if the error was a readonly error and the creation flag is true
// i.e the entity was in the middle of being created
if entityCreated && errors . Is ( err , logical . ErrReadOnly ) {
entity , err = possiblyForwardEntityCreation ( ctx , c , err , auth , nil )
if err != nil {
if strings . Contains ( err . Error ( ) , errCreateEntityUnimplemented ) {
resp . AddWarning ( "primary cluster doesn't yet issue entities for local auth mounts; falling back to not issuing entities for local auth mounts" )
goto CREATE_TOKEN
} else {
return nil , nil , err
}
}
2022-05-18 19:16:13 +03:00
}
2022-07-21 20:53:42 +03:00
err = updateLocalAlias ( ctx , c , auth , entity )
2021-10-15 22:20:00 +03:00
default :
2022-05-18 19:16:13 +03:00
entity , entityCreated , err = possiblyForwardAliasCreation ( ctx , c , err , auth , entity )
2021-10-15 22:20:00 +03:00
}
2018-09-18 06:03:00 +03:00
}
2017-10-11 20:21:20 +03:00
if err != nil {
return nil , nil , err
}
if entity == nil {
2018-02-09 18:40:56 +03:00
return nil , nil , fmt . Errorf ( "failed to create an entity for the authenticated alias" )
2017-10-11 20:21:20 +03:00
}
2018-04-14 04:49:40 +03:00
if entity . Disabled {
2018-04-23 23:50:04 +03:00
return nil , nil , logical . ErrPermissionDenied
2018-04-14 04:49:40 +03:00
}
2017-10-11 20:21:20 +03:00
auth . EntityID = entity . ID
2022-05-18 19:16:13 +03:00
auth . EntityCreated = entityCreated
2021-05-03 15:23:59 +03:00
validAliases , err := c . identityStore . refreshExternalGroupMembershipsByEntityID ( ctx , auth . EntityID , auth . GroupAliases , req . MountAccessor )
2020-03-24 01:00:26 +03:00
if err != nil {
return nil , nil , err
2017-11-02 23:05:48 +03:00
}
2020-03-24 01:00:26 +03:00
auth . GroupAliases = validAliases
2017-10-11 20:21:20 +03:00
}
2021-10-15 22:20:00 +03:00
CREATE_TOKEN :
2016-05-02 07:08:07 +03:00
// Determine the source of the login
2018-09-18 06:03:00 +03:00
source := c . router . MatchingMount ( ctx , req . Path )
2016-05-02 07:08:07 +03:00
2022-02-18 00:08:51 +03:00
// Login MFA
2023-10-31 17:49:28 +03:00
entity , _ , err := c . fetchEntityAndDerivedPolicies ( ctx , ns , auth . EntityID , true )
2018-06-14 16:49:33 +03:00
if err != nil {
return nil , nil , ErrInternalError
}
2022-02-18 00:08:51 +03:00
// finding the MFAEnforcementConfig that matches the ns and either of
// entityID, MountAccessor, GroupID, or Auth type.
matchedMfaEnforcementList , err := c . buildMFAEnforcementConfigList ( ctx , entity , req . Path )
if err != nil {
return nil , nil , fmt . Errorf ( "failed to find MFAEnforcement configuration, error: %v" , err )
}
// (for the context, a response warning above says: "primary cluster
// doesn't yet issue entities for local auth mounts; falling back
// to not issuing entities for local auth mounts")
// based on the above, if the entity is nil, check if MFAEnforcementConfig
// is configured or not. If not, continue as usual, but if there
// is something, then report an error indicating that the user is not
// allowed to login because there is no entity associated with it.
// This is because an entity is needed to enforce MFA.
if entity == nil && len ( matchedMfaEnforcementList ) > 0 {
// this logic means that an MFAEnforcementConfig was configured with
// only mount type or mount accessor
return nil , nil , logical . ErrPermissionDenied
}
// The resp.Auth has been populated with the information that is required for MFA validation
// This is why, the MFA check is placed at this point. The resp.Auth is going to be fully cached
// in memory so that it would be used to return to the user upon MFA validation is completed.
if entity != nil {
if len ( matchedMfaEnforcementList ) == 0 && len ( req . MFACreds ) > 0 {
resp . AddWarning ( "Found MFA header but failed to find MFA Enforcement Config" )
2016-09-29 07:01:28 +03:00
}
2022-02-18 00:08:51 +03:00
// If X-Vault-MFA header is supplied to the login request,
// run single-phase login MFA check, else run two-phase login MFA check
if len ( matchedMfaEnforcementList ) > 0 && len ( req . MFACreds ) > 0 {
for _ , eConfig := range matchedMfaEnforcementList {
err = c . validateLoginMFA ( ctx , eConfig , entity , req . Connection . RemoteAddr , req . MFACreds )
if err != nil {
return nil , nil , logical . ErrPermissionDenied
}
}
} else if len ( matchedMfaEnforcementList ) > 0 && len ( req . MFACreds ) == 0 {
mfaRequestID , err := uuid . GenerateUUID ( )
if err != nil {
return nil , nil , err
}
// sending back the MFARequirement config
mfaRequirement := & logical . MFARequirement {
MFARequestID : mfaRequestID ,
MFAConstraints : make ( map [ string ] * logical . MFAConstraintAny ) ,
}
for _ , eConfig := range matchedMfaEnforcementList {
mfaAny , err := c . buildMfaEnforcementResponse ( eConfig )
if err != nil {
return nil , nil , err
}
mfaRequirement . MFAConstraints [ eConfig . Name ] = mfaAny
}
2016-05-02 07:08:07 +03:00
2022-02-18 00:08:51 +03:00
// for two phased MFA enforcement, we should not return the regular auth
// response. This flag is indicate to store the auth response for later
// and return MFARequirement only
respAuth := & MFACachedAuthResponse {
CachedAuth : resp . Auth ,
RequestPath : req . Path ,
RequestNSID : ns . ID ,
RequestNSPath : ns . Path ,
RequestConnRemoteAddr : req . Connection . RemoteAddr , // this is needed for the DUO method
TimeOfStorage : time . Now ( ) ,
RequestID : mfaRequestID ,
}
2022-05-17 23:30:36 +03:00
err = possiblyForwardSaveCachedAuthResponse ( ctx , c , respAuth )
2022-02-18 00:08:51 +03:00
if err != nil {
return nil , nil , err
}
auth = nil
resp . Auth = & logical . Auth {
MFARequirement : mfaRequirement ,
}
resp . AddWarning ( "A login request was issued that is subject to MFA validation. Please make sure to validate the login by sending another request to mfa/validate endpoint." )
// going to return early before generating the token
// the user receives the mfaRequirement, and need to use the
// login MFA validate endpoint to get the token
return resp , auth , nil
2020-06-27 00:13:16 +03:00
}
2016-05-02 07:08:07 +03:00
}
// Attach the display name, might be used by audit backends
req . DisplayName = auth . DisplayName
2018-09-18 06:03:00 +03:00
2023-09-01 16:07:47 +03:00
requiresLease := resp . Auth . TokenType != logical . TokenTypeBatch
// If role was not already determined by http.rateLimitQuotaWrapping
// and a lease will be generated, calculate a role for the leaseEntry.
// We can skip this step if there are no pre-existing role-based quotas
// for this mount and Vault is configured to skip lease role-based lease counting
// until after they're created. This effectively zeroes out the lease count
// for new role-based quotas upon creation, rather than counting old leases toward
// the total.
if reqRole == nil && requiresLease && ! c . impreciseLeaseRoleTracking {
2023-08-30 18:28:32 +03:00
role = c . DetermineRoleFromLoginRequest ( ctx , req . MountPoint , req . Data )
}
2023-08-29 02:16:57 +03:00
leaseGen , respTokenCreate , errCreateToken := c . LoginCreateToken ( ctx , ns , req . Path , source , role , resp )
2022-02-18 00:08:51 +03:00
leaseGenerated = leaseGen
if errCreateToken != nil {
return respTokenCreate , nil , errCreateToken
}
resp = respTokenCreate
2016-05-02 07:08:07 +03:00
}
2022-12-07 04:22:46 +03:00
// Successful login, remove any entry from userFailedLoginInfo map
// if it exists. This is done for batch tokens (for oss & ent)
// For service tokens on oss it is taken care by core RegisterAuth function.
// For service tokens on ent it is taken care by registerAuth RPC calls.
// This update is done as part of registerAuth of RPC calls from standby
// to active node. This is added there to reduce RPC calls
if ! isUserLockoutDisabled && ( auth . TokenType == logical . TokenTypeBatch ) {
loginUserInfoKey := FailedLoginUser {
aliasName : auth . Alias . Name ,
mountAccessor : auth . Alias . MountAccessor ,
}
2023-05-31 20:51:20 +03:00
// We don't need to try to delete the lockedUsers storage entry, since we're
// processing a login request. If a login attempt is allowed, it means the user is
// unlocked and we only add storage entry when the user gets locked.
2022-12-07 04:22:46 +03:00
err = updateUserFailedLoginInfo ( ctx , c , loginUserInfoKey , nil , true )
if err != nil {
return nil , nil , err
}
}
2021-10-14 03:15:54 +03:00
// if we were already going to return some error from this login, do that.
// if not, we will then check if the API is locked for the requesting
// namespace, to avoid leaking locked namespaces to unauthenticated clients.
if resp != nil && resp . Data != nil {
if _ , ok := resp . Data [ "error" ] ; ok {
return resp , auth , routeErr
}
}
if routeErr != nil {
return resp , auth , routeErr
}
// this check handles the bad login credential case
if err := enterpriseBlockRequestIfError ( c , ns . Path , req . Path ) ; err != nil {
return nil , nil , multierror . Append ( retErr , err )
}
2017-02-17 07:09:39 +03:00
return resp , auth , routeErr
2016-05-02 07:08:07 +03:00
}
2018-09-18 06:03:00 +03:00
2022-02-18 00:08:51 +03:00
// LoginCreateToken creates a token as a result of a login request.
// If MFA is enforced, mfa/validate endpoint calls this functions
// after successful MFA validation to generate the token.
2023-08-29 02:16:57 +03:00
func ( c * Core ) LoginCreateToken ( ctx context . Context , ns * namespace . Namespace , reqPath , mountPoint , role string , resp * logical . Response ) ( bool , * logical . Response , error ) {
2022-02-18 00:08:51 +03:00
auth := resp . Auth
source := strings . TrimPrefix ( mountPoint , credentialRoutePrefix )
2022-08-03 22:22:48 +03:00
source = strings . ReplaceAll ( source , "/" , "-" )
2022-02-18 00:08:51 +03:00
// Prepend the source to the display name
auth . DisplayName = strings . TrimSuffix ( source + auth . DisplayName , "-" )
// Determine mount type
mountEntry := c . router . MatchingMountEntry ( ctx , reqPath )
if mountEntry == nil {
return false , nil , fmt . Errorf ( "failed to find a matching mount" )
}
sysView := c . router . MatchingSystemView ( ctx , reqPath )
if sysView == nil {
c . logger . Error ( "unable to look up sys view for login path" , "request_path" , reqPath )
return false , nil , ErrInternalError
}
tokenTTL , warnings , err := framework . CalculateTTL ( sysView , 0 , auth . TTL , auth . Period , auth . MaxTTL , auth . ExplicitMaxTTL , time . Time { } )
if err != nil {
return false , nil , err
}
for _ , warning := range warnings {
resp . AddWarning ( warning )
}
_ , identityPolicies , err := c . fetchEntityAndDerivedPolicies ( ctx , ns , auth . EntityID , false )
if err != nil {
return false , nil , ErrInternalError
}
auth . TokenPolicies = policyutil . SanitizePolicies ( auth . Policies , ! auth . NoDefaultPolicy )
allPolicies := policyutil . SanitizePolicies ( append ( auth . TokenPolicies , identityPolicies [ ns . ID ] ... ) , policyutil . DoNotAddDefaultPolicy )
// Prevent internal policies from being assigned to tokens. We check
// this on auth.Policies including derived ones from Identity before
// actually making the token.
for _ , policy := range allPolicies {
if policy == "root" {
return false , logical . ErrorResponse ( "auth methods cannot create root tokens" ) , logical . ErrInvalidRequest
}
if strutil . StrListContains ( nonAssignablePolicies , policy ) {
return false , logical . ErrorResponse ( fmt . Sprintf ( "cannot assign policy %q" , policy ) ) , logical . ErrInvalidRequest
}
}
var registerFunc RegisterAuthFunc
var funcGetErr error
// Batch tokens should not be forwarded to perf standby
if auth . TokenType == logical . TokenTypeBatch {
registerFunc = c . RegisterAuth
} else {
registerFunc , funcGetErr = getAuthRegisterFunc ( c )
}
if funcGetErr != nil {
return false , nil , funcGetErr
}
leaseGenerated := false
2023-08-29 02:16:57 +03:00
err = registerFunc ( ctx , tokenTTL , reqPath , auth , role )
2022-02-18 00:08:51 +03:00
switch {
case err == nil :
if auth . TokenType != logical . TokenTypeBatch {
leaseGenerated = true
}
case err == ErrInternalError :
return false , nil , err
default :
return false , logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
auth . IdentityPolicies = policyutil . SanitizePolicies ( identityPolicies [ ns . ID ] , policyutil . DoNotAddDefaultPolicy )
delete ( identityPolicies , ns . ID )
auth . ExternalNamespacePolicies = identityPolicies
auth . Policies = allPolicies
// Count the successful token creation
ttl_label := metricsutil . TTLBucket ( tokenTTL )
// Do not include namespace path in mount point; already present as separate label.
mountPointWithoutNs := ns . TrimmedPath ( mountPoint )
c . metricSink . IncrCounterWithLabels (
[ ] string { "token" , "creation" } ,
1 ,
[ ] metrics . Label {
metricsutil . NamespaceLabel ( ns ) ,
{ "auth_method" , mountEntry . Type } ,
{ "mount_point" , mountPointWithoutNs } ,
{ "creation_ttl" , ttl_label } ,
{ "token_type" , auth . TokenType . String ( ) } ,
} ,
)
return leaseGenerated , resp , nil
}
2022-12-07 04:22:46 +03:00
// failedUserLoginProcess updates the userFailedLoginMap with login count and last failed
// login time for users with failed login attempt
// If the user gets locked for current login attempt, it updates the storage entry too
func ( c * Core ) failedUserLoginProcess ( ctx context . Context , mountEntry * MountEntry , req * logical . Request ) error {
// get the user lockout configuration for the user
userLockoutConfiguration := c . getUserLockoutConfiguration ( mountEntry )
// determine the key for userFailedLoginInfo map
loginUserInfoKey , err := c . getLoginUserInfoKey ( ctx , mountEntry , req )
if err != nil {
return err
}
// get entry from userFailedLoginInfo map for the key
userFailedLoginInfo , err := getUserFailedLoginInfo ( ctx , c , loginUserInfoKey )
if err != nil {
return err
}
// update the last failed login time with current time
failedLoginInfo := FailedLoginInfo {
lastFailedLoginTime : int ( time . Now ( ) . Unix ( ) ) ,
}
// set the failed login count value for the entry in userFailedLoginInfo map
switch userFailedLoginInfo {
case nil : // entry does not exist in userfailedLoginMap
failedLoginInfo . count = 1
default :
failedLoginInfo . count = userFailedLoginInfo . count + 1
// if counter reset, set the count value to 1 as this gets counted as new entry
lastFailedLoginTime := time . Unix ( int64 ( userFailedLoginInfo . lastFailedLoginTime ) , 0 )
counterResetDuration := userLockoutConfiguration . LockoutCounterReset
if time . Now ( ) . After ( lastFailedLoginTime . Add ( counterResetDuration ) ) {
failedLoginInfo . count = 1
}
}
2023-05-31 20:51:20 +03:00
// update the userFailedLoginInfo map (and/or storage) with the updated/new entry
2022-12-07 04:22:46 +03:00
err = updateUserFailedLoginInfo ( ctx , c , loginUserInfoKey , & failedLoginInfo , false )
if err != nil {
return err
}
return nil
}
// getLoginUserInfoKey gets failedUserLoginInfo map key for login user
func ( c * Core ) getLoginUserInfoKey ( ctx context . Context , mountEntry * MountEntry , req * logical . Request ) ( FailedLoginUser , error ) {
userInfo := FailedLoginUser { }
aliasName , err := c . aliasNameFromLoginRequest ( ctx , req )
if err != nil {
return userInfo , err
}
if aliasName == "" {
return userInfo , errors . New ( "failed to determine alias name from login request" )
}
userInfo . aliasName = aliasName
userInfo . mountAccessor = mountEntry . Accessor
return userInfo , nil
}
// isUserLockoutDisabled checks if user lockout feature to prevent brute forcing is disabled
// Auth types userpass, ldap and approle support this feature
// precedence: environment var setting >> auth tune setting >> config file setting >> default (enabled)
func ( c * Core ) isUserLockoutDisabled ( mountEntry * MountEntry ) ( bool , error ) {
if ! strutil . StrListContains ( configutil . GetSupportedUserLockoutsAuthMethods ( ) , mountEntry . Type ) {
return true , nil
}
// check environment variable
if disableUserLockoutEnv := os . Getenv ( consts . VaultDisableUserLockout ) ; disableUserLockoutEnv != "" {
var err error
2023-05-31 20:51:20 +03:00
disableUserLockout , err := strconv . ParseBool ( disableUserLockoutEnv )
2022-12-07 04:22:46 +03:00
if err != nil {
return false , errors . New ( "Error parsing the environment variable VAULT_DISABLE_USER_LOCKOUT" )
}
2023-05-31 20:51:20 +03:00
if disableUserLockout {
return true , nil
}
return false , nil
2022-12-07 04:22:46 +03:00
}
// read auth tune for mount entry
userLockoutConfigFromMount := mountEntry . Config . UserLockoutConfig
if userLockoutConfigFromMount != nil && userLockoutConfigFromMount . DisableLockout {
return true , nil
}
// read config for auth type from config file
userLockoutConfiguration := c . getUserLockoutFromConfig ( mountEntry . Type )
if userLockoutConfiguration . DisableLockout {
return true , nil
}
// default
return false , nil
}
// isUserLocked determines if the login user is locked
func ( c * Core ) isUserLocked ( ctx context . Context , mountEntry * MountEntry , req * logical . Request ) ( locked bool , err error ) {
// get userFailedLoginInfo map key for login user
loginUserInfoKey , err := c . getLoginUserInfoKey ( ctx , mountEntry , req )
if err != nil {
return false , err
}
// get entry from userFailedLoginInfo map for the key
userFailedLoginInfo , err := getUserFailedLoginInfo ( ctx , c , loginUserInfoKey )
if err != nil {
return false , err
}
userLockoutConfiguration := c . getUserLockoutConfiguration ( mountEntry )
switch userFailedLoginInfo {
case nil :
// entry not found in userFailedLoginInfo map, check storage to re-verify
ns , err := namespace . FromContext ( ctx )
if err != nil {
return false , fmt . Errorf ( "could not parse namespace from http context: %w" , err )
}
storageUserLockoutPath := fmt . Sprintf ( coreLockedUsersPath + "%s/%s/%s" , ns . ID , loginUserInfoKey . mountAccessor , loginUserInfoKey . aliasName )
existingEntry , err := c . barrier . Get ( ctx , storageUserLockoutPath )
if err != nil {
return false , err
}
var lastLoginTime int
if existingEntry == nil {
// no storage entry found, user is not locked
return false , nil
}
err = jsonutil . DecodeJSON ( existingEntry . Value , & lastLoginTime )
if err != nil {
return false , err
}
// if time passed from last login time is within lockout duration, the user is locked
if time . Now ( ) . Unix ( ) - int64 ( lastLoginTime ) < int64 ( userLockoutConfiguration . LockoutDuration . Seconds ( ) ) {
// user locked
return true , nil
}
2023-05-31 20:51:20 +03:00
// else user is not locked. Entry is stale, this will be removed from storage during cleanup
// by the background thread
2022-12-07 04:22:46 +03:00
default :
// entry found in userFailedLoginInfo map, check if the user is locked
isCountOverLockoutThreshold := userFailedLoginInfo . count >= uint ( userLockoutConfiguration . LockoutThreshold )
isWithinLockoutDuration := time . Now ( ) . Unix ( ) - int64 ( userFailedLoginInfo . lastFailedLoginTime ) < int64 ( userLockoutConfiguration . LockoutDuration . Seconds ( ) )
if isCountOverLockoutThreshold && isWithinLockoutDuration {
// user locked
return true , nil
}
}
return false , nil
}
// getUserLockoutConfiguration gets the user lockout configuration for a mount entry
// it checks the config file and auth tune values
// precedence: auth tune >> config file values for auth type >> config file values for all type
// >> default user lockout values
// getUserLockoutFromConfig call in this function takes care of config file precedence
func ( c * Core ) getUserLockoutConfiguration ( mountEntry * MountEntry ) ( userLockoutConfig UserLockoutConfig ) {
// get user configuration values from config file
userLockoutConfig = c . getUserLockoutFromConfig ( mountEntry . Type )
authTuneUserLockoutConfig := mountEntry . Config . UserLockoutConfig
// if user lockout is not configured using auth tune, return values from config file
if authTuneUserLockoutConfig == nil {
return userLockoutConfig
}
// replace values in return with config file configuration
// for fields that are not configured using auth tune
if authTuneUserLockoutConfig . LockoutThreshold != 0 {
userLockoutConfig . LockoutThreshold = authTuneUserLockoutConfig . LockoutThreshold
}
if authTuneUserLockoutConfig . LockoutDuration != 0 {
userLockoutConfig . LockoutDuration = authTuneUserLockoutConfig . LockoutDuration
}
if authTuneUserLockoutConfig . LockoutCounterReset != 0 {
userLockoutConfig . LockoutCounterReset = authTuneUserLockoutConfig . LockoutCounterReset
}
if authTuneUserLockoutConfig . DisableLockout {
userLockoutConfig . DisableLockout = authTuneUserLockoutConfig . DisableLockout
}
return userLockoutConfig
}
// getUserLockoutFromConfig gets the userlockout configuration for given mount type from config file
// it reads the user lockout configuration from server config
// it has values for "all" type and any mountType that is configured using config file
// "all" type values are updated in shared config with default values i.e; if "all" type is
// not configured in config file, it is updated in shared config with default configuration
// If "all" type is configured in config file, any missing fields are updated with default values
// similarly missing values for a given mount type in config file are updated with "all" type
// default values
// If user_lockout configuration is not configured using config file at all, defaults are returned
func ( c * Core ) getUserLockoutFromConfig ( mountType string ) UserLockoutConfig {
defaultUserLockoutConfig := UserLockoutConfig {
LockoutThreshold : configutil . UserLockoutThresholdDefault ,
LockoutDuration : configutil . UserLockoutDurationDefault ,
LockoutCounterReset : configutil . UserLockoutCounterResetDefault ,
DisableLockout : configutil . DisableUserLockoutDefault ,
}
conf := c . rawConfig . Load ( )
if conf == nil {
return defaultUserLockoutConfig
}
userlockouts := conf . ( * server . Config ) . UserLockouts
if userlockouts == nil {
return defaultUserLockoutConfig
}
for _ , userLockoutConfig := range userlockouts {
switch userLockoutConfig . Type {
case "all" :
defaultUserLockoutConfig = UserLockoutConfig {
LockoutThreshold : userLockoutConfig . LockoutThreshold ,
LockoutDuration : userLockoutConfig . LockoutDuration ,
LockoutCounterReset : userLockoutConfig . LockoutCounterReset ,
DisableLockout : userLockoutConfig . DisableLockout ,
}
case mountType :
return UserLockoutConfig {
LockoutThreshold : userLockoutConfig . LockoutThreshold ,
LockoutDuration : userLockoutConfig . LockoutDuration ,
LockoutCounterReset : userLockoutConfig . LockoutCounterReset ,
DisableLockout : userLockoutConfig . DisableLockout ,
}
}
}
return defaultUserLockoutConfig
}
2022-02-18 00:08:51 +03:00
func ( c * Core ) buildMfaEnforcementResponse ( eConfig * mfa . MFAEnforcementConfig ) ( * logical . MFAConstraintAny , error ) {
mfaAny := & logical . MFAConstraintAny {
Any : [ ] * logical . MFAMethodID { } ,
}
for _ , methodID := range eConfig . MFAMethodIDs {
mConfig , err := c . loginMFABackend . MemDBMFAConfigByID ( methodID )
if err != nil {
return nil , fmt . Errorf ( "failed to get methodID %s from MFA config table, error: %v" , methodID , err )
}
mfaMethod := & logical . MFAMethodID {
Type : mConfig . Type ,
ID : methodID ,
2024-07-01 20:37:46 +03:00
UsesPasscode : mConfig . Type == mfaMethodTypeTOTP ,
2023-01-23 23:51:22 +03:00
Name : mConfig . Name ,
2022-02-18 00:08:51 +03:00
}
mfaAny . Any = append ( mfaAny . Any , mfaMethod )
}
return mfaAny , nil
}
2021-10-14 03:15:54 +03:00
func blockRequestIfErrorImpl ( _ * Core , _ , _ string ) error { return nil }
2019-11-09 00:14:03 +03:00
// RegisterAuth uses a logical.Auth object to create a token entry in the token
// store, and registers a corresponding token lease to the expiration manager.
2022-07-05 20:02:00 +03:00
// role is the login role used as part of the creation of the token entry. If not
// relevant, can be omitted (by being provided as "").
func ( c * Core ) RegisterAuth ( ctx context . Context , tokenTTL time . Duration , path string , auth * logical . Auth , role string ) error {
2018-09-18 06:03:00 +03:00
// We first assign token policies to what was returned from the backend
// via auth.Policies. Then, we get the full set of policies into
// auth.Policies from the backend + entity information -- this is not
// stored in the token, but we perform sanity checks on it and return
// that information to the user.
// Generate a token
ns , err := namespace . FromContext ( ctx )
if err != nil {
return err
}
te := logical . TokenEntry {
2018-09-22 00:31:29 +03:00
Path : path ,
Meta : auth . Metadata ,
DisplayName : auth . DisplayName ,
CreationTime : time . Now ( ) . Unix ( ) ,
TTL : tokenTTL ,
NumUses : auth . NumUses ,
EntityID : auth . EntityID ,
BoundCIDRs : auth . BoundCIDRs ,
Policies : auth . TokenPolicies ,
NamespaceID : ns . ID ,
ExplicitMaxTTL : auth . ExplicitMaxTTL ,
2020-10-26 23:25:56 +03:00
Period : auth . Period ,
2018-10-15 19:56:24 +03:00
Type : auth . TokenType ,
2018-09-18 06:03:00 +03:00
}
2019-11-06 00:11:13 +03:00
if te . TTL == 0 && ( len ( te . Policies ) != 1 || te . Policies [ 0 ] != "root" ) {
c . logger . Error ( "refusing to create a non-root zero TTL token" )
return ErrInternalError
}
2018-09-18 06:03:00 +03:00
if err := c . tokenStore . create ( ctx , & te ) ; err != nil {
c . logger . Error ( "failed to create token" , "error" , err )
return ErrInternalError
}
// Populate the client token, accessor, and TTL
auth . ClientToken = te . ID
auth . Accessor = te . Accessor
auth . TTL = te . TTL
2019-03-05 01:32:09 +03:00
auth . Orphan = te . Parent == ""
2018-09-18 06:03:00 +03:00
2018-10-15 19:56:24 +03:00
switch auth . TokenType {
case logical . TokenTypeBatch :
// Ensure it's not marked renewable since it isn't
auth . Renewable = false
case logical . TokenTypeService :
// Register with the expiration manager
2022-07-05 20:02:00 +03:00
if err := c . expiration . RegisterAuth ( ctx , & te , auth , role ) ; err != nil {
2019-11-09 00:14:03 +03:00
if err := c . tokenStore . revokeOrphan ( ctx , te . ID ) ; err != nil {
c . logger . Warn ( "failed to clean up token lease during login request" , "request_path" , path , "error" , err )
}
c . logger . Error ( "failed to register token lease during login request" , "request_path" , path , "error" , err )
2018-10-15 19:56:24 +03:00
return ErrInternalError
}
2022-02-17 22:43:07 +03:00
if te . ExternalID != "" {
auth . ClientToken = te . ExternalID
}
2022-12-07 04:22:46 +03:00
// Successful login, remove any entry from userFailedLoginInfo map
// if it exists. This is done for service tokens (for oss) here.
// For ent it is taken care by registerAuth RPC calls.
if auth . Alias != nil {
loginUserInfoKey := FailedLoginUser {
aliasName : auth . Alias . Name ,
mountAccessor : auth . Alias . MountAccessor ,
}
2023-05-31 20:51:20 +03:00
// We don't need to try to delete the lockedUsers storage entry, since we're
// processing a login request. If a login attempt is allowed, it means the user is
// unlocked and we only add storage entry when the user gets locked.
err = updateUserFailedLoginInfo ( ctx , c , loginUserInfoKey , nil , true )
2022-12-07 04:22:46 +03:00
if err != nil {
return err
}
}
2018-09-18 06:03:00 +03:00
}
return nil
}
2021-06-11 20:18:16 +03:00
2023-05-31 20:51:20 +03:00
// LocalGetUserFailedLoginInfo gets the failed login information for a user based on alias name and mountAccessor
func ( c * Core ) LocalGetUserFailedLoginInfo ( ctx context . Context , userKey FailedLoginUser ) * FailedLoginInfo {
2022-12-07 04:22:46 +03:00
c . userFailedLoginInfoLock . Lock ( )
value , exists := c . userFailedLoginInfo [ userKey ]
c . userFailedLoginInfoLock . Unlock ( )
if exists {
return value
}
return nil
2022-11-16 02:07:52 +03:00
}
2023-05-31 20:51:20 +03:00
// LocalUpdateUserFailedLoginInfo updates the failed login information for a user based on alias name and mountAccessor
func ( c * Core ) LocalUpdateUserFailedLoginInfo ( ctx context . Context , userKey FailedLoginUser , failedLoginInfo * FailedLoginInfo , deleteEntry bool ) error {
2022-12-07 04:22:46 +03:00
c . userFailedLoginInfoLock . Lock ( )
2024-02-29 19:00:06 +03:00
defer c . userFailedLoginInfoLock . Unlock ( )
2022-12-07 04:22:46 +03:00
switch deleteEntry {
case false :
2023-05-31 20:51:20 +03:00
// update entry in the map
2022-12-07 04:22:46 +03:00
c . userFailedLoginInfo [ userKey ] = failedLoginInfo
2023-05-31 20:51:20 +03:00
// get the user lockout configuration for the user
mountEntry := c . router . MatchingMountByAccessor ( userKey . mountAccessor )
if mountEntry == nil {
mountEntry = & MountEntry { }
mountEntry . NamespaceID = namespace . RootNamespaceID
}
userLockoutConfiguration := c . getUserLockoutConfiguration ( mountEntry )
// if failed login count has reached threshold, create a storage entry as the user got locked
if failedLoginInfo . count >= uint ( userLockoutConfiguration . LockoutThreshold ) {
// user locked
storageUserLockoutPath := fmt . Sprintf ( coreLockedUsersPath + "%s/%s/%s" , mountEntry . NamespaceID , userKey . mountAccessor , userKey . aliasName )
compressedBytes , err := jsonutil . EncodeJSONAndCompress ( failedLoginInfo . lastFailedLoginTime , nil )
if err != nil {
c . logger . Error ( "failed to encode or compress failed login user entry" , "error" , err )
return err
}
// Create an entry
entry := & logical . StorageEntry {
Key : storageUserLockoutPath ,
Value : compressedBytes ,
}
// Write to the physical backend
if err := c . barrier . Put ( ctx , entry ) ; err != nil {
c . logger . Error ( "failed to persist failed login user entry" , "error" , err )
return err
}
}
2022-12-07 04:22:46 +03:00
default :
2023-05-31 20:51:20 +03:00
// delete the entry from the map, if no key exists it is no-op
2022-12-07 04:22:46 +03:00
delete ( c . userFailedLoginInfo , userKey )
}
2022-11-16 02:07:52 +03:00
return nil
}
2021-06-11 20:18:16 +03:00
// PopulateTokenEntry looks up req.ClientToken in the token store and uses
// it to set other fields in req. Does nothing if ClientToken is empty
// or a JWT token, or for service tokens that don't exist in the token store.
// Should be called with read stateLock held.
func ( c * Core ) PopulateTokenEntry ( ctx context . Context , req * logical . Request ) error {
if req . ClientToken == "" {
return nil
}
// Also attach the accessor if we have it. This doesn't fail if it
// doesn't exist because the request may be to an unauthenticated
// endpoint/login endpoint where a bad current token doesn't matter, or
// a token from a Vault version pre-accessors. We ignore errors for
// JWTs.
token := req . ClientToken
2022-02-17 22:43:07 +03:00
var err error
req . InboundSSCToken = token
2023-03-28 17:32:30 +03:00
decodedToken := token
2022-02-17 22:43:07 +03:00
if IsSSCToken ( token ) {
2023-03-28 17:32:30 +03:00
// If ForwardToActive is set to ForwardSSCTokenToActive, we ignore
// whether the endpoint is a login request, as since we have the token
// forwarded to us, we should treat it as an unauthenticated endpoint
// and ensure the token is populated too regardless.
// Notably, this is important for some endpoints, such as endpoints
// such as sys/ui/mounts/internal, which is unauthenticated but a token
// may be provided to be used.
// Without the check to see if
// c.ForwardToActive() == ForwardSSCTokenToActive unauthenticated
// requests that do not use a token but were provided one anyway
// could fail with a 412.
// We only follow this behaviour if we're a perf standby, as
// this behaviour only makes sense in that case as only they
// could be missing the token population.
// Without ForwardToActive being set to ForwardSSCTokenToActive,
// behaviours that rely on this functionality also wouldn't make
// much sense, as they would fail with 412 required index not present
// as perf standbys aren't guaranteed to have the WAL state
// for new tokens.
unauth := c . isLoginRequest ( ctx , req )
if c . ForwardToActive ( ) == ForwardSSCTokenToActive && c . perfStandby {
unauth = false
}
decodedToken , err = c . CheckSSCToken ( ctx , token , unauth , c . perfStandby )
2022-08-16 00:16:32 +03:00
// If we receive an error from CheckSSCToken, we can assume the token is bad somehow, and the client
// should receive a 403 bad token error like they do for all other invalid tokens, unless the error
// specifies that we should forward the request or retry the request.
2022-02-17 22:43:07 +03:00
if err != nil {
2022-08-16 00:16:32 +03:00
if errors . Is ( err , logical . ErrPerfStandbyPleaseForward ) || errors . Is ( err , logical . ErrMissingRequiredState ) {
return err
}
return logical . ErrPermissionDenied
2022-02-17 22:43:07 +03:00
}
}
2023-03-28 17:32:30 +03:00
req . ClientToken = decodedToken
// We ignore the token returned from CheckSSCToken here as Lookup also
// decodes the SSCT, and it may need the original SSCT to check state.
2021-06-11 20:18:16 +03:00
te , err := c . LookupToken ( ctx , token )
if err != nil {
2023-03-28 17:32:30 +03:00
// If we're missing required state, return that error
// as-is to the client
if errors . Is ( err , logical . ErrPerfStandbyPleaseForward ) || errors . Is ( err , logical . ErrMissingRequiredState ) {
return err
}
2021-06-11 20:18:16 +03:00
// If we have two dots but the second char is a dot it's a vault
// token of the form s.SOMETHING.nsid, not a JWT
2023-03-23 18:47:10 +03:00
if ! IsJWT ( token ) {
2021-06-11 20:18:16 +03:00
return fmt . Errorf ( "error performing token check: %w" , err )
}
}
if err == nil && te != nil {
req . ClientTokenAccessor = te . Accessor
req . ClientTokenRemainingUses = te . NumUses
req . SetTokenEntry ( te )
}
return nil
}
2022-02-17 22:43:07 +03:00
func ( c * Core ) CheckSSCToken ( ctx context . Context , token string , unauth bool , isPerfStandby bool ) ( string , error ) {
if unauth && token != "" {
// This token shouldn't really be here, but alas it was sent along with the request
// Since we're already knee deep in the token checking code pre-existing token checking
// code, we have to deal with this token whether we like it or not. So, we'll just try
// to get the inner token, and if that fails, return the token as-is. We intentionally
// will skip any token checks, because this is an unauthenticated paths and the token
// is just a nuisance rather than a means of auth.
// We cannot return whatever we like here, because if we do then CheckToken, which looks up
// the corresponding lease, will not find the token entry and lease. There are unauth'ed
// endpoints that use the token entry (such as sys/ui/mounts/internal) to do custom token
// checks, which would then fail. Therefore, we must try to get whatever thing is tied to
// token entries, but we must explicitly not do any SSC Token checks.
tok , err := c . DecodeSSCToken ( token )
if err != nil || tok == "" {
return token , nil
}
return tok , nil
}
return c . checkSSCTokenInternal ( ctx , token , isPerfStandby )
}
// DecodeSSCToken returns the random part of an SSCToken without
// performing any signature or WAL checks.
func ( c * Core ) DecodeSSCToken ( token string ) ( string , error ) {
// Skip batch and old style service tokens. These can have the prefix "b.",
// "s." (for old tokens) or "hvb."
if ! IsSSCToken ( token ) {
return token , nil
}
tok , err := c . DecodeSSCTokenInternal ( token )
if err != nil {
return "" , err
}
return tok . Random , nil
}
// DecodeSSCTokenInternal is a helper used to get the inner part of a SSC token without
// checking the token signature or the WAL index.
func ( c * Core ) DecodeSSCTokenInternal ( token string ) ( * tokens . Token , error ) {
signedToken := & tokens . SignedToken { }
// Skip batch and old style service tokens. These can have the prefix "b.",
// "s." (for old tokens) or "hvb."
if ! strings . HasPrefix ( token , consts . ServiceTokenPrefix ) {
return nil , fmt . Errorf ( "not service token" )
}
// Consider the suffix of the token only when unmarshalling
suffixToken := token [ 4 : ]
tokenBytes , err := base64 . RawURLEncoding . DecodeString ( suffixToken )
if err != nil {
return nil , fmt . Errorf ( "can't decode token" )
}
err = proto . Unmarshal ( tokenBytes , signedToken )
if err != nil {
return nil , err
}
plainToken := & tokens . Token { }
err2 := proto . Unmarshal ( [ ] byte ( signedToken . Token ) , plainToken )
if err2 != nil {
return nil , err2
}
return plainToken , nil
}
func ( c * Core ) checkSSCTokenInternal ( ctx context . Context , token string , isPerfStandby bool ) ( string , error ) {
signedToken := & tokens . SignedToken { }
// Skip batch and old style service tokens. These can have the prefix "b.",
// "s." (for old tokens) or "hvb."
if ! strings . HasPrefix ( token , consts . ServiceTokenPrefix ) {
return token , nil
}
// Check token length to guess if this is an server side consistent token or not.
// Note that even when the DisableSSCTokens flag is set, index
// bearing tokens that have already been given out may still be used.
if ! IsSSCToken ( token ) {
return token , nil
}
// Consider the suffix of the token only when unmarshalling
suffixToken := token [ 4 : ]
tokenBytes , err := base64 . RawURLEncoding . DecodeString ( suffixToken )
if err != nil {
c . logger . Warn ( "cannot decode token" , "error" , err )
return token , nil
}
err = proto . Unmarshal ( tokenBytes , signedToken )
if err != nil {
return "" , fmt . Errorf ( "error occurred when unmarshalling ssc token: %w" , err )
}
hm , err := c . tokenStore . CalculateSignedTokenHMAC ( signedToken . Token )
if ! hmac . Equal ( hm , signedToken . Hmac ) {
return "" , fmt . Errorf ( "token mac for %+v is incorrect: err %w" , signedToken , err )
}
plainToken := & tokens . Token { }
err = proto . Unmarshal ( [ ] byte ( signedToken . Token ) , plainToken )
if err != nil {
return "" , err
}
2022-06-08 23:58:22 +03:00
// Disregard SSCT on perf-standbys for non-raft storage
if c . perfStandby && c . getRaftBackend ( ) == nil {
return plainToken . Random , nil
}
2022-02-17 22:43:07 +03:00
ep := int ( plainToken . IndexEpoch )
if ep < c . tokenStore . GetSSCTokensGenerationCounter ( ) {
return plainToken . Random , nil
}
2023-01-07 01:06:54 +03:00
requiredWalState := & logical . WALState { ClusterID : c . ClusterID ( ) , LocalIndex : plainToken . LocalIndex , ReplicatedIndex : 0 }
2022-02-17 22:43:07 +03:00
if c . HasWALState ( requiredWalState , isPerfStandby ) {
return plainToken . Random , nil
}
// Make sure to forward the request instead of checking the token if the flag
// is set and we're on a perf standby
if c . ForwardToActive ( ) == ForwardSSCTokenToActive && isPerfStandby {
return "" , logical . ErrPerfStandbyPleaseForward
}
// In this case, the server side consistent token cannot be used on this node. We return the appropriate
// status code.
return "" , logical . ErrMissingRequiredState
}