2023-03-15 19:00:52 +03:00
// Copyright (c) HashiCorp, Inc.
2024-01-02 21:36:20 +03:00
// SPDX-License-Identifier: BUSL-1.1
2023-03-15 19:00:52 +03:00
2015-03-18 23:19:19 +03:00
package vault
import (
2018-01-08 21:31:38 +03:00
"context"
2022-02-17 22:43:07 +03:00
"crypto/hmac"
"crypto/sha256"
2018-10-15 19:56:24 +03:00
"encoding/base64"
2015-03-18 23:19:19 +03:00
"encoding/json"
2018-05-21 21:05:04 +03:00
"errors"
2015-03-18 23:19:19 +03:00
"fmt"
2018-07-11 22:45:09 +03:00
"net/http"
2015-04-16 00:24:07 +03:00
"regexp"
2015-03-25 01:10:46 +03:00
"strings"
2019-07-01 12:39:54 +03:00
"sync"
"sync/atomic"
2015-03-25 01:10:46 +03:00
"time"
2015-03-18 23:19:19 +03:00
2019-07-01 12:39:54 +03:00
"github.com/armon/go-metrics"
2020-06-24 02:36:24 +03:00
"github.com/armon/go-radix"
2019-07-01 12:39:54 +03:00
"github.com/golang/protobuf/proto"
2018-04-03 03:46:59 +03:00
log "github.com/hashicorp/go-hclog"
2019-07-01 12:39:54 +03:00
"github.com/hashicorp/go-multierror"
2021-07-16 03:17:31 +03:00
"github.com/hashicorp/go-secure-stdlib/base62"
"github.com/hashicorp/go-secure-stdlib/parseutil"
"github.com/hashicorp/go-secure-stdlib/strutil"
2019-07-01 12:39:54 +03:00
"github.com/hashicorp/go-sockaddr"
2022-03-05 01:16:51 +03:00
"github.com/hashicorp/go-version"
2018-04-17 18:16:26 +03:00
"github.com/hashicorp/vault/helper/identity"
2020-10-14 02:38:21 +03:00
"github.com/hashicorp/vault/helper/metricsutil"
2019-04-13 10:44:06 +03:00
"github.com/hashicorp/vault/helper/namespace"
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/helper/consts"
2019-04-13 00:54:35 +03:00
"github.com/hashicorp/vault/sdk/helper/jsonutil"
"github.com/hashicorp/vault/sdk/helper/locksutil"
2019-04-13 01:08:46 +03:00
"github.com/hashicorp/vault/sdk/helper/policyutil"
2019-04-13 00:54:35 +03:00
"github.com/hashicorp/vault/sdk/helper/salt"
2019-06-14 17:17:04 +03:00
"github.com/hashicorp/vault/sdk/helper/tokenutil"
2019-04-13 00:54:35 +03:00
"github.com/hashicorp/vault/sdk/logical"
"github.com/hashicorp/vault/sdk/plugin/pb"
2022-02-17 22:43:07 +03:00
"github.com/hashicorp/vault/vault/tokens"
2015-03-18 23:19:19 +03:00
)
const (
2018-09-18 06:03:00 +03:00
// idPrefix is the prefix used to store tokens for their
2015-03-18 23:19:19 +03:00
// primary ID based index
2018-09-18 06:03:00 +03:00
idPrefix = "id/"
2015-03-18 23:19:19 +03:00
2016-03-09 17:05:04 +03:00
// accessorPrefix is the prefix used to store the index from
// Accessor to Token ID
accessorPrefix = "accessor/"
2015-03-18 23:19:19 +03:00
// parentPrefix is the prefix used to store tokens for their
2019-06-14 17:17:04 +03:00
// secondary parent based index
2015-03-18 23:19:19 +03:00
parentPrefix = "parent/"
2015-03-19 00:00:42 +03:00
// tokenSubPath is the sub-path used for the token store
// view. This is nested under the system view.
tokenSubPath = "token/"
2016-03-01 20:33:35 +03:00
// rolesPrefix is the prefix used to store role information
rolesPrefix = "roles/"
2016-12-16 21:11:55 +03:00
2018-05-10 22:50:02 +03:00
// tokenRevocationPending indicates that the token should not be used
// again. If this is encountered during an existing request flow, it means
// that the token is but is currently fulfilling its final use; after this
// request it will not be able to be looked up as being valid.
tokenRevocationPending = - 1
2015-03-18 23:19:19 +03:00
2018-11-13 19:16:10 +03:00
// TokenLength is the size of tokens we are currently generating, without
2018-09-18 06:03:00 +03:00
// any namespace information
TokenLength = 24
2022-08-31 15:56:45 +03:00
// MaxNsIdLength is the maximum namespace ID length (5 characters prepended by a ".")
MaxNsIdLength = 6
2022-02-17 22:43:07 +03:00
// TokenPrefixLength is the length of the new token prefixes ("hvs.", "hvb.",
// and "hvr.")
TokenPrefixLength = 4
// OldTokenPrefixLength is the length of the old token prefixes ("s.", "b.". "r.")
OldTokenPrefixLength = 2
// GenerationCounterBuffer is a buffer for the generation counter estimation in the
// case where a counter cannot be retrieved from storage
GenerationCounterBuffer = 5
// MaxRetrySSCTokensGenerationCounter is the maximum number of retries the TokenStore
// will make when attempting to get the SSCTokensGenerationCounter
MaxRetrySSCTokensGenerationCounter = 3
2022-09-06 21:11:04 +03:00
// IgnoreForBilling used for HCP Link batch tokens and inserted into the InternalMeta
// Tokens created for the purpose of HCP Link should bypass counting for billing purposes
IgnoreForBilling = "ignore_for_billing"
2022-02-17 22:43:07 +03:00
)
var (
2015-04-16 00:24:07 +03:00
// displayNameSanitize is used to sanitize a display name given to a token.
displayNameSanitize = regexp . MustCompile ( "[^a-zA-Z0-9-]" )
2016-02-29 21:27:31 +03:00
2016-03-01 23:30:37 +03:00
// pathSuffixSanitize is used to ensure a path suffix in a role is valid.
pathSuffixSanitize = regexp . MustCompile ( "\\w[\\w-.]+\\w" )
2016-12-16 21:11:55 +03:00
2018-09-18 06:03:00 +03:00
destroyCubbyhole = func ( ctx context . Context , ts * TokenStore , te * logical . TokenEntry ) error {
2016-12-16 21:11:55 +03:00
if ts . cubbyholeBackend == nil {
// Should only ever happen in testing
return nil
}
2015-04-16 00:24:07 +03:00
2018-09-18 06:03:00 +03:00
if te == nil {
return errors . New ( "nil token entry" )
}
2018-07-24 23:57:25 +03:00
2023-10-16 14:38:11 +03:00
storage := ts . core . router . MatchingStorageByAPIPath ( ctx , mountPathCubbyhole )
2021-04-20 00:28:04 +03:00
if storage == nil {
return fmt . Errorf ( "no cubby mount entry" )
}
view := storage . ( * BarrierView )
2019-01-09 21:53:41 +03:00
switch {
2022-02-17 22:43:07 +03:00
case te . NamespaceID == namespace . RootNamespaceID && ! IsServiceToken ( te . ID ) :
2018-09-18 06:03:00 +03:00
saltedID , err := ts . SaltID ( ctx , te . ID )
if err != nil {
return err
}
2021-04-20 00:28:04 +03:00
return ts . cubbyholeBackend . revoke ( ctx , view , salt . SaltID ( ts . cubbyholeBackend . saltUUID , saltedID , salt . SHA1Hash ) )
2018-05-31 03:30:50 +03:00
2018-09-18 06:03:00 +03:00
default :
if te . CubbyholeID == "" {
return fmt . Errorf ( "missing cubbyhole ID while destroying" )
}
2021-04-20 00:28:04 +03:00
return ts . cubbyholeBackend . revoke ( ctx , view , te . CubbyholeID )
2018-09-18 06:03:00 +03:00
}
2018-05-31 03:30:50 +03:00
}
2018-09-18 06:03:00 +03:00
)
2018-05-31 03:30:50 +03:00
2018-09-18 06:03:00 +03:00
func ( ts * TokenStore ) paths ( ) [ ] * framework . Path {
2023-07-11 00:34:10 +03:00
commonFieldsForCreate := map [ string ] * framework . FieldSchema {
"display_name" : {
Type : framework . TypeString ,
Description : "Name to associate with this token" ,
} ,
"explicit_max_ttl" : {
Type : framework . TypeString ,
Description : "Explicit Max TTL of this token" ,
} ,
"entity_alias" : {
Type : framework . TypeString ,
Description : "Name of the entity alias to associate with this token" ,
} ,
"num_uses" : {
Type : framework . TypeInt ,
Description : "Max number of uses for this token" ,
} ,
"period" : {
Type : framework . TypeString ,
Description : "Renew period" ,
} ,
"renewable" : {
Type : framework . TypeBool ,
Description : "Allow token to be renewed past its initial TTL up to system/mount maximum TTL" ,
Default : true ,
} ,
"ttl" : {
Type : framework . TypeString ,
Description : "Time to live for this token" ,
} ,
"lease" : {
Type : framework . TypeString ,
Description : "Use 'ttl' instead" ,
Deprecated : true ,
} ,
"type" : {
Type : framework . TypeString ,
Description : "Token type" ,
} ,
"no_default_policy" : {
Type : framework . TypeBool ,
Description : "Do not include default policy for this token" ,
} ,
"id" : {
Type : framework . TypeString ,
Description : "Value for the token" ,
} ,
"meta" : {
Type : framework . TypeKVPairs ,
Description : "Arbitrary key=value metadata to associate with the token" ,
} ,
"no_parent" : {
Type : framework . TypeBool ,
Description : "Create the token with no parent" ,
} ,
"policies" : {
Type : framework . TypeStringSlice ,
Description : "List of policies for the token" ,
} ,
}
fieldsForCreateWithRole := map [ string ] * framework . FieldSchema {
"role_name" : {
Type : framework . TypeString ,
Description : "Name of the role" ,
} ,
}
for k , v := range commonFieldsForCreate {
fieldsForCreateWithRole [ k ] = v
}
2023-04-06 18:11:49 +03:00
const operationPrefixToken = "token"
2019-06-14 17:17:04 +03:00
p := [ ] * framework . Path {
2018-09-18 06:03:00 +03:00
{
Pattern : "roles/?$" ,
2015-03-31 22:48:19 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationSuffix : "roles" ,
} ,
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . ListOperation : ts . tokenStoreRoleList ,
} ,
2015-04-03 21:40:08 +03:00
2018-09-18 06:03:00 +03:00
HelpSynopsis : tokenListRolesHelp ,
HelpDescription : tokenListRolesHelp ,
} ,
2015-09-10 04:58:09 +03:00
2018-09-18 06:03:00 +03:00
{
2023-07-06 23:01:33 +03:00
Pattern : "accessors/?$" ,
2015-10-07 22:30:54 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationSuffix : "accessors" ,
} ,
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . ListOperation : ts . tokenStoreAccessorList ,
} ,
2016-05-02 10:11:14 +03:00
2018-09-18 06:03:00 +03:00
HelpSynopsis : tokenListAccessorsHelp ,
HelpDescription : tokenListAccessorsHelp ,
} ,
2016-12-16 21:11:55 +03:00
2018-09-18 06:03:00 +03:00
{
Pattern : "create-orphan$" ,
2015-04-12 02:28:16 +03:00
2023-07-11 00:34:10 +03:00
Fields : commonFieldsForCreate ,
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "create" ,
OperationSuffix : "orphan" ,
} ,
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleCreateOrphan ,
2015-04-03 21:40:08 +03:00
} ,
2017-02-17 07:09:39 +03:00
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenCreateOrphanHelp ) ,
HelpDescription : strings . TrimSpace ( tokenCreateOrphanHelp ) ,
2015-04-03 21:40:08 +03:00
} ,
2018-09-18 06:03:00 +03:00
{
Pattern : "create/" + framework . GenericNameRegex ( "role_name" ) ,
2016-02-29 21:27:31 +03:00
2023-07-11 00:34:10 +03:00
Fields : fieldsForCreateWithRole ,
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "create" ,
OperationSuffix : "against-role" ,
} ,
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleCreateAgainstRole ,
2016-02-29 21:27:31 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenCreateRoleHelp ) ,
HelpDescription : strings . TrimSpace ( tokenCreateRoleHelp ) ,
} ,
2016-07-30 01:20:38 +03:00
2018-09-18 06:03:00 +03:00
{
Pattern : "create$" ,
2016-08-01 20:07:41 +03:00
2023-07-11 00:34:10 +03:00
Fields : commonFieldsForCreate ,
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "create" ,
} ,
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleCreate ,
2016-07-30 01:20:38 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenCreateHelp ) ,
HelpDescription : strings . TrimSpace ( tokenCreateHelp ) ,
} ,
2016-02-29 21:27:31 +03:00
2018-09-18 06:03:00 +03:00
{
2018-11-20 00:58:19 +03:00
Pattern : "lookup" ,
2016-02-29 21:27:31 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "look-up" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"token" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Token to lookup (POST request body)" ,
} ,
} ,
2016-03-09 19:59:54 +03:00
2023-04-06 18:11:49 +03:00
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . ReadOperation : & framework . PathOperation {
Callback : ts . handleLookup ,
DisplayAttrs : & framework . DisplayAttributes {
2023-07-04 03:37:25 +03:00
OperationSuffix : "2" ,
2023-04-06 18:11:49 +03:00
} ,
} ,
logical . UpdateOperation : & framework . PathOperation {
Callback : ts . handleLookup ,
} ,
2016-02-29 21:27:31 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenLookupHelp ) ,
HelpDescription : strings . TrimSpace ( tokenLookupHelp ) ,
} ,
{
2018-11-20 00:58:19 +03:00
Pattern : "lookup-accessor" ,
2015-11-03 23:10:46 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "look-up" ,
OperationSuffix : "accessor" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"accessor" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Accessor of the token to look up (request body)" ,
} ,
} ,
2015-11-03 23:10:46 +03:00
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleUpdateLookupAccessor ,
2015-11-03 23:10:46 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenLookupAccessorHelp ) ,
HelpDescription : strings . TrimSpace ( tokenLookupAccessorHelp ) ,
} ,
2016-02-29 21:27:31 +03:00
2018-09-18 06:03:00 +03:00
{
Pattern : "lookup-self$" ,
2016-02-29 21:27:31 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "look-up" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"token" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Token to look up (unused, does not need to be set)" ,
2016-02-29 21:27:31 +03:00
} ,
2018-09-18 06:03:00 +03:00
} ,
2016-02-29 21:27:31 +03:00
2023-04-06 18:11:49 +03:00
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . ReadOperation : & framework . PathOperation {
Callback : ts . handleLookupSelf ,
DisplayAttrs : & framework . DisplayAttributes {
OperationSuffix : "self" ,
} ,
} ,
logical . UpdateOperation : & framework . PathOperation {
Callback : ts . handleLookupSelf ,
DisplayAttrs : & framework . DisplayAttributes {
OperationSuffix : "self2" ,
} ,
} ,
2016-02-29 21:27:31 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenLookupHelp ) ,
HelpDescription : strings . TrimSpace ( tokenLookupHelp ) ,
} ,
{
2018-11-20 00:58:19 +03:00
Pattern : "revoke-accessor" ,
2015-03-31 22:48:19 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "revoke" ,
OperationSuffix : "accessor" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"accessor" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Accessor of the token (request body)" ,
} ,
} ,
2015-03-31 22:48:19 +03:00
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleUpdateRevokeAccessor ,
2015-03-31 22:48:19 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenRevokeAccessorHelp ) ,
HelpDescription : strings . TrimSpace ( tokenRevokeAccessorHelp ) ,
} ,
2015-03-31 22:51:00 +03:00
2018-09-18 06:03:00 +03:00
{
Pattern : "revoke-self$" ,
2015-03-31 22:51:00 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "revoke" ,
OperationSuffix : "self" ,
} ,
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleRevokeSelf ,
2015-03-31 22:51:00 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenRevokeSelfHelp ) ,
HelpDescription : strings . TrimSpace ( tokenRevokeSelfHelp ) ,
} ,
{
2018-11-20 00:58:19 +03:00
Pattern : "revoke" ,
2016-03-08 23:13:29 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "revoke" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"token" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Token to revoke (request body)" ,
} ,
} ,
2016-03-08 23:13:29 +03:00
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleRevokeTree ,
2016-03-08 23:13:29 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenRevokeHelp ) ,
HelpDescription : strings . TrimSpace ( tokenRevokeHelp ) ,
} ,
{
2018-11-20 00:58:19 +03:00
Pattern : "revoke-orphan" ,
2015-03-31 22:48:19 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "revoke" ,
OperationSuffix : "orphan" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"token" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Token to revoke (request body)" ,
2015-03-31 22:48:19 +03:00
} ,
2018-09-18 06:03:00 +03:00
} ,
2015-03-31 22:48:19 +03:00
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleRevokeOrphan ,
2015-03-31 22:48:19 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenRevokeOrphanHelp ) ,
HelpDescription : strings . TrimSpace ( tokenRevokeOrphanHelp ) ,
} ,
2019-11-08 19:32:01 +03:00
{
Pattern : "renew-accessor" ,
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "renew" ,
OperationSuffix : "accessor" ,
} ,
2019-11-08 19:32:01 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"accessor" : {
2019-11-08 19:32:01 +03:00
Type : framework . TypeString ,
Description : "Accessor of the token to renew (request body)" ,
} ,
2021-04-08 19:43:39 +03:00
"increment" : {
2019-11-08 19:32:01 +03:00
Type : framework . TypeDurationSecond ,
Default : 0 ,
Description : "The desired increment in seconds to the token expiration" ,
} ,
} ,
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleUpdateRenewAccessor ,
} ,
HelpSynopsis : strings . TrimSpace ( tokenRenewAccessorHelp ) ,
HelpDescription : strings . TrimSpace ( tokenRenewAccessorHelp ) ,
} ,
2018-09-18 06:03:00 +03:00
{
Pattern : "renew-self$" ,
2016-03-09 02:07:27 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "renew" ,
OperationSuffix : "self" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"token" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Token to renew (unused, does not need to be set)" ,
2016-03-08 23:13:29 +03:00
} ,
2021-04-08 19:43:39 +03:00
"increment" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeDurationSecond ,
Default : 0 ,
Description : "The desired increment in seconds to the token expiration" ,
} ,
} ,
2016-03-08 23:13:29 +03:00
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleRenewSelf ,
2016-03-08 23:13:29 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenRenewSelfHelp ) ,
HelpDescription : strings . TrimSpace ( tokenRenewSelfHelp ) ,
} ,
{
2018-11-20 00:58:19 +03:00
Pattern : "renew" ,
2015-09-17 20:22:30 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "renew" ,
} ,
2018-09-18 06:03:00 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"token" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeString ,
Description : "Token to renew (request body)" ,
} ,
2021-04-08 19:43:39 +03:00
"increment" : {
2018-09-18 06:03:00 +03:00
Type : framework . TypeDurationSecond ,
Default : 0 ,
Description : "The desired increment in seconds to the token expiration" ,
2015-09-17 20:22:30 +03:00
} ,
2018-09-18 06:03:00 +03:00
} ,
2015-09-17 20:22:30 +03:00
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleRenew ,
2015-09-17 20:22:30 +03:00
} ,
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenRenewHelp ) ,
HelpDescription : strings . TrimSpace ( tokenRenewHelp ) ,
} ,
2015-03-31 22:48:19 +03:00
2018-09-18 06:03:00 +03:00
{
Pattern : "tidy$" ,
2015-03-31 22:48:19 +03:00
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationVerb : "tidy" ,
} ,
2018-09-18 06:03:00 +03:00
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . UpdateOperation : ts . handleTidy ,
2015-03-31 22:48:19 +03:00
} ,
2015-04-03 22:11:49 +03:00
2018-09-18 06:03:00 +03:00
HelpSynopsis : strings . TrimSpace ( tokenTidyHelp ) ,
HelpDescription : strings . TrimSpace ( tokenTidyDesc ) ,
} ,
}
2019-06-14 17:17:04 +03:00
rolesPath := & framework . Path {
Pattern : "roles/" + framework . GenericNameRegex ( "role_name" ) ,
2023-04-06 18:11:49 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : operationPrefixToken ,
OperationSuffix : "role" ,
} ,
2019-06-14 17:17:04 +03:00
Fields : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"role_name" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeString ,
Description : "Name of the role" ,
} ,
2021-04-08 19:43:39 +03:00
"allowed_policies" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeCommaStringSlice ,
Description : tokenAllowedPoliciesHelp ,
} ,
2021-04-08 19:43:39 +03:00
"disallowed_policies" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeCommaStringSlice ,
Description : tokenDisallowedPoliciesHelp ,
} ,
2021-09-21 18:25:06 +03:00
"allowed_policies_glob" : {
Type : framework . TypeCommaStringSlice ,
Description : tokenAllowedPoliciesGlobHelp ,
} ,
"disallowed_policies_glob" : {
Type : framework . TypeCommaStringSlice ,
Description : tokenDisallowedPoliciesGlobHelp ,
} ,
2021-04-08 19:43:39 +03:00
"orphan" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeBool ,
Description : tokenOrphanHelp ,
} ,
2021-04-08 19:43:39 +03:00
"period" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeDurationSecond ,
2019-06-27 21:52:52 +03:00
Description : "Use 'token_period' instead." ,
2019-06-14 17:17:04 +03:00
Deprecated : true ,
} ,
2021-04-08 19:43:39 +03:00
"path_suffix" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeString ,
Description : tokenPathSuffixHelp + pathSuffixSanitize . String ( ) ,
} ,
2021-04-08 19:43:39 +03:00
"explicit_max_ttl" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeDurationSecond ,
2019-06-27 21:52:52 +03:00
Description : "Use 'token_explicit_max_ttl' instead." ,
2019-06-14 17:17:04 +03:00
Deprecated : true ,
} ,
2021-04-08 19:43:39 +03:00
"renewable" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeBool ,
Default : true ,
Description : tokenRenewableHelp ,
} ,
2021-04-08 19:43:39 +03:00
"bound_cidrs" : {
2019-06-14 17:17:04 +03:00
Type : framework . TypeCommaStringSlice ,
2019-06-27 21:52:52 +03:00
Description : "Use 'token_bound_cidrs' instead." ,
2019-06-14 17:17:04 +03:00
Deprecated : true ,
} ,
2019-07-01 12:39:54 +03:00
2021-04-08 19:43:39 +03:00
"allowed_entity_aliases" : {
2019-07-01 12:39:54 +03:00
Type : framework . TypeCommaStringSlice ,
Description : "String or JSON list of allowed entity aliases. If set, specifies the entity aliases which are allowed to be used during token generation. This field supports globbing." ,
} ,
2019-06-14 17:17:04 +03:00
} ,
Callbacks : map [ logical . Operation ] framework . OperationFunc {
logical . ReadOperation : ts . tokenStoreRoleRead ,
logical . CreateOperation : ts . tokenStoreRoleCreateUpdate ,
logical . UpdateOperation : ts . tokenStoreRoleCreateUpdate ,
logical . DeleteOperation : ts . tokenStoreRoleDelete ,
} ,
ExistenceCheck : ts . tokenStoreRoleExistenceCheck ,
}
tokenutil . AddTokenFieldsWithAllowList ( rolesPath . Fields , [ ] string { "token_bound_cidrs" , "token_explicit_max_ttl" , "token_period" , "token_type" , "token_no_default_policy" , "token_num_uses" } )
p = append ( p , rolesPath )
return p
2018-09-18 06:03:00 +03:00
}
2015-03-31 22:48:19 +03:00
2018-09-18 06:03:00 +03:00
// LookupToken returns the properties of the token from the token store. This
// is particularly useful to fetch the accessor of the client token and get it
// populated in the logical request along with the client token. The accessor
// of the client token can get audit logged.
2021-06-11 20:18:16 +03:00
//
// Should be called with read stateLock held.
2018-09-18 06:03:00 +03:00
func ( c * Core ) LookupToken ( ctx context . Context , token string ) ( * logical . TokenEntry , error ) {
if c . Sealed ( ) {
return nil , consts . ErrSealed
}
2015-03-31 22:48:19 +03:00
2018-09-18 06:03:00 +03:00
if c . standby && ! c . perfStandby {
return nil , consts . ErrStandby
}
2015-10-07 19:49:13 +03:00
2018-09-18 06:03:00 +03:00
// Many tests don't have a token store running
2018-09-25 23:27:57 +03:00
if c . tokenStore == nil || c . tokenStore . expiration == nil {
2018-09-18 06:03:00 +03:00
return nil , nil
}
2015-10-07 19:49:13 +03:00
2018-09-18 06:03:00 +03:00
return c . tokenStore . Lookup ( ctx , token )
}
2015-10-07 19:49:13 +03:00
2021-10-14 04:59:36 +03:00
// CreateToken creates the given token in the core's token store.
func ( c * Core ) CreateToken ( ctx context . Context , entry * logical . TokenEntry ) error {
if c . tokenStore == nil {
return errors . New ( "unable to create token with nil token store" )
}
return c . tokenStore . create ( ctx , entry )
}
2018-09-18 06:03:00 +03:00
// TokenStore is used to manage client tokens. Tokens are used for
// clients to authenticate, and each token is mapped to an applicable
// set of policy which is used for authorization.
type TokenStore struct {
* framework . Backend
2015-04-03 22:11:49 +03:00
2018-09-18 06:03:00 +03:00
activeContext context . Context
2015-04-03 22:11:49 +03:00
2018-09-18 06:03:00 +03:00
core * Core
2016-12-16 23:29:27 +03:00
2018-10-15 19:56:24 +03:00
batchTokenEncryptor BarrierEncryptor
2018-09-18 06:03:00 +03:00
baseBarrierView * BarrierView
idBarrierView * BarrierView
accessorBarrierView * BarrierView
parentBarrierView * BarrierView
rolesBarrierView * BarrierView
2016-12-16 23:29:27 +03:00
2021-10-14 19:10:59 +03:00
expiration * ExpirationManager
2018-09-18 06:03:00 +03:00
cubbyholeBackend * CubbyholeBackend
tokenLocks [ ] * locksutil . LockEntry
// tokenPendingDeletion stores tokens that are being revoked. If the token is
// not in the map, it means that there's no deletion in progress. If the value
// is true it means deletion is in progress, and if false it means deletion
// failed. Revocation needs to handle these states accordingly.
tokensPendingDeletion * sync . Map
cubbyholeDestroyer func ( context . Context , * TokenStore , * logical . TokenEntry ) error
logger log . Logger
saltLock sync . RWMutex
salts map [ string ] * salt . Salt
tidyLock * uint32
identityPoliciesDeriverFunc func ( string ) ( * identity . Entity , [ ] string , error )
quitContext context . Context
2022-02-17 22:43:07 +03:00
// sscTokensGenerationCounter is a per-cluster version that counts how many
// "sync points" the cluster has encountered in its lifecycle. "Sync points" are the
// number of times all nodes in the cluster have stepped down. Currently the only sync
// point is a DR cluster promoting to the primary.
sscTokensGenerationCounter SSCTokenGenerationCounter
2018-09-18 06:03:00 +03:00
}
// NewTokenStore is used to construct a token store that is
// backed by the given barrier view.
func NewTokenStore ( ctx context . Context , logger log . Logger , core * Core , config * logical . BackendConfig ) ( * TokenStore , error ) {
// Create a sub-view
view := core . systemBarrierView . SubView ( tokenSubPath )
// Initialize the store
t := & TokenStore {
activeContext : ctx ,
core : core ,
2018-10-15 19:56:24 +03:00
batchTokenEncryptor : core . barrier ,
2018-09-18 06:03:00 +03:00
baseBarrierView : view ,
idBarrierView : view . SubView ( idPrefix ) ,
accessorBarrierView : view . SubView ( accessorPrefix ) ,
parentBarrierView : view . SubView ( parentPrefix ) ,
rolesBarrierView : view . SubView ( rolesPrefix ) ,
cubbyholeDestroyer : destroyCubbyhole ,
logger : logger ,
tokenLocks : locksutil . CreateLocks ( ) ,
tokensPendingDeletion : & sync . Map { } ,
saltLock : sync . RWMutex { } ,
tidyLock : new ( uint32 ) ,
quitContext : core . activeContext ,
salts : make ( map [ string ] * salt . Salt ) ,
}
// Setup the framework endpoints
t . Backend = & framework . Backend {
AuthRenew : t . authRenew ,
PathsSpecial : & logical . Paths {
Root : [ ] string {
"revoke-orphan/*" ,
"accessors*" ,
} ,
2016-12-16 23:29:27 +03:00
2018-09-18 06:03:00 +03:00
// Most token store items are local since tokens are local, but a
// notable exception is roles
LocalStorage : [ ] string {
idPrefix ,
accessorPrefix ,
parentPrefix ,
salt . DefaultLocation ,
2016-12-16 23:29:27 +03:00
} ,
2015-03-31 22:48:19 +03:00
} ,
2018-11-07 04:21:24 +03:00
BackendType : logical . TypeCredential ,
2015-03-31 22:48:19 +03:00
}
2018-09-18 06:03:00 +03:00
t . Backend . Paths = append ( t . Backend . Paths , t . paths ( ) ... )
2018-01-19 09:44:44 +03:00
t . Backend . Setup ( ctx , config )
2015-09-04 23:58:12 +03:00
2022-02-17 22:43:07 +03:00
if err := t . loadSSCTokensGenerationCounter ( ctx ) ; err != nil {
return t , err
}
2015-03-18 23:19:19 +03:00
return t , nil
}
2018-01-19 09:44:44 +03:00
func ( ts * TokenStore ) Invalidate ( ctx context . Context , key string ) {
2017-07-18 19:02:03 +03:00
switch key {
case tokenSubPath + salt . DefaultLocation :
ts . saltLock . Lock ( )
2018-09-18 06:03:00 +03:00
ts . salts = make ( map [ string ] * salt . Salt )
2017-07-18 19:02:03 +03:00
ts . saltLock . Unlock ( )
}
}
2018-03-08 22:21:11 +03:00
func ( ts * TokenStore ) Salt ( ctx context . Context ) ( * salt . Salt , error ) {
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
2017-07-18 19:02:03 +03:00
ts . saltLock . RLock ( )
2018-09-18 06:03:00 +03:00
if salt , ok := ts . salts [ ns . ID ] ; ok {
2017-07-18 19:02:03 +03:00
defer ts . saltLock . RUnlock ( )
2018-09-18 06:03:00 +03:00
return salt , nil
2017-07-18 19:02:03 +03:00
}
ts . saltLock . RUnlock ( )
ts . saltLock . Lock ( )
defer ts . saltLock . Unlock ( )
2018-09-18 06:03:00 +03:00
if salt , ok := ts . salts [ ns . ID ] ; ok {
return salt , nil
2017-07-18 19:02:03 +03:00
}
2018-09-18 06:03:00 +03:00
salt , err := salt . NewSalt ( ctx , ts . baseView ( ns ) , & salt . Config {
2018-01-26 04:19:27 +03:00
HashFunc : salt . SHA1Hash ,
Location : salt . DefaultLocation ,
} )
2017-07-18 19:02:03 +03:00
if err != nil {
return nil , err
}
2018-09-18 06:03:00 +03:00
ts . salts [ ns . ID ] = salt
2017-07-18 19:02:03 +03:00
return salt , nil
}
2016-02-29 21:27:31 +03:00
// tsRoleEntry contains token store role information
type tsRoleEntry struct {
2019-06-14 17:17:04 +03:00
tokenutil . TokenParams
2016-02-29 21:27:31 +03:00
// The name of the role. Embedded so it can be used for pathing
2016-02-29 22:13:09 +03:00
Name string ` json:"name" mapstructure:"name" structs:"name" `
2016-02-29 21:27:31 +03:00
// The policies that creation functions using this role can assign to a token,
// escaping or further locking down normal subset checking
2016-02-29 22:13:09 +03:00
AllowedPolicies [ ] string ` json:"allowed_policies" mapstructure:"allowed_policies" structs:"allowed_policies" `
2016-02-29 21:27:31 +03:00
2016-08-02 20:33:03 +03:00
// List of policies to be not allowed during token creation using this role
2016-08-02 17:33:50 +03:00
DisallowedPolicies [ ] string ` json:"disallowed_policies" mapstructure:"disallowed_policies" structs:"disallowed_policies" `
2021-09-21 18:25:06 +03:00
// An extension to AllowedPolicies that instead uses glob matching on policy names
AllowedPoliciesGlob [ ] string ` json:"allowed_policies_glob" mapstructure:"allowed_policies_glob" structs:"allowed_policies_glob" `
// An extension to DisallowedPolicies that instead uses glob matching on policy names
DisallowedPoliciesGlob [ ] string ` json:"disallowed_policies_glob" mapstructure:"disallowed_policies_glob" structs:"disallowed_policies_glob" `
2016-02-29 21:27:31 +03:00
// If true, tokens created using this role will be orphans
2016-02-29 22:13:09 +03:00
Orphan bool ` json:"orphan" mapstructure:"orphan" structs:"orphan" `
2016-02-29 21:27:31 +03:00
2019-02-01 19:23:40 +03:00
// If non-zero, tokens created using this role will be able to be renewed
// forever, but will have a fixed renewal period of this value
Period time . Duration ` json:"period" mapstructure:"period" structs:"period" `
2016-03-01 23:30:37 +03:00
// If set, a suffix will be set on the token path, making it easier to
2016-05-11 23:51:18 +03:00
// revoke using 'revoke-prefix'
2016-03-01 23:30:37 +03:00
PathSuffix string ` json:"path_suffix" mapstructure:"path_suffix" structs:"path_suffix" `
2016-05-11 23:51:18 +03:00
2016-06-08 22:17:22 +03:00
// If set, controls whether created tokens are marked as being renewable
Renewable bool ` json:"renewable" mapstructure:"renewable" structs:"renewable" `
2019-02-01 19:23:40 +03:00
// If set, the token entry will have an explicit maximum TTL set, rather
// than deferring to role/mount values
ExplicitMaxTTL time . Duration ` json:"explicit_max_ttl" mapstructure:"explicit_max_ttl" structs:"explicit_max_ttl" `
// The set of CIDRs that tokens generated using this role will be bound to
BoundCIDRs [ ] * sockaddr . SockAddrMarshaler ` json:"bound_cidrs" `
2019-07-01 12:39:54 +03:00
// The set of allowed entity aliases used during token creation
AllowedEntityAliases [ ] string ` json:"allowed_entity_aliases" mapstructure:"allowed_entity_aliases" structs:"allowed_entity_aliases" `
2015-03-18 23:19:19 +03:00
}
2016-07-30 01:20:38 +03:00
type accessorEntry struct {
2018-09-18 06:03:00 +03:00
TokenID string ` json:"token_id" `
AccessorID string ` json:"accessor_id" `
NamespaceID string ` json:"namespace_id" `
2016-07-30 01:20:38 +03:00
}
2015-04-03 21:40:08 +03:00
// SetExpirationManager is used to provide the token store with
// an expiration manager. This is used to manage prefix based revocation
2016-12-16 23:29:27 +03:00
// of tokens and to tidy entries when removed from the token store.
2015-09-18 23:33:52 +03:00
func ( ts * TokenStore ) SetExpirationManager ( exp * ExpirationManager ) {
ts . expiration = exp
2015-04-03 21:40:08 +03:00
}
2016-05-15 19:58:36 +03:00
// SaltID is used to apply a salt and hash to an ID to make sure its not reversible
2018-03-08 22:21:11 +03:00
func ( ts * TokenStore ) SaltID ( ctx context . Context , id string ) ( string , error ) {
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return "" , namespace . ErrNoNamespace
}
2018-03-08 22:21:11 +03:00
s , err := ts . Salt ( ctx )
2017-07-18 19:02:03 +03:00
if err != nil {
return "" , err
}
2018-10-17 23:23:04 +03:00
// For tokens of older format and belonging to the root namespace, use SHA1
// hash for salting.
if ns . ID == namespace . RootNamespaceID && ! strings . Contains ( id , "." ) {
return s . SaltID ( id ) , nil
2018-09-18 06:03:00 +03:00
}
2018-10-17 23:23:04 +03:00
// For all other tokens, use SHA2-256 HMAC for salting. This includes
// tokens of older format, but belonging to a namespace other than the root
// namespace.
return "h" + s . GetHMAC ( id ) , nil
2015-03-18 23:19:19 +03:00
}
2018-09-18 06:03:00 +03:00
// rootToken is used to generate a new token with root privileges and no parent
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) rootToken ( ctx context . Context ) ( * logical . TokenEntry , error ) {
2018-09-18 06:03:00 +03:00
ctx = namespace . ContextWithNamespace ( ctx , namespace . RootNamespace )
2018-06-09 00:24:27 +03:00
te := & logical . TokenEntry {
2015-09-18 23:33:52 +03:00
Policies : [ ] string { "root" } ,
Path : "auth/token/root" ,
DisplayName : "root" ,
CreationTime : time . Now ( ) . Unix ( ) ,
2018-09-18 06:03:00 +03:00
NamespaceID : namespace . RootNamespaceID ,
2018-10-15 19:56:24 +03:00
Type : logical . TokenTypeService ,
2015-03-24 03:16:37 +03:00
}
2018-01-19 09:44:44 +03:00
if err := ts . create ( ctx , te ) ; err != nil {
2015-03-24 03:16:37 +03:00
return nil , err
}
return te , nil
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) tokenStoreAccessorList ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
nsID := ns . ID
entries , err := ts . accessorView ( ns ) . List ( ctx , "" )
2016-07-30 01:20:38 +03:00
if err != nil {
return nil , err
}
resp := & logical . Response { }
ret := make ( [ ] string , 0 , len ( entries ) )
for _ , entry := range entries {
2018-09-18 06:03:00 +03:00
aEntry , err := ts . lookupByAccessor ( ctx , entry , true , false )
2016-07-30 01:20:38 +03:00
if err != nil {
2019-01-14 20:55:49 +03:00
resp . AddWarning ( fmt . Sprintf ( "Found an accessor entry that could not be successfully decoded; associated error is %q" , err . Error ( ) ) )
2016-07-30 01:20:38 +03:00
continue
}
2022-01-18 14:56:38 +03:00
if aEntry == nil {
continue
}
2018-09-18 06:03:00 +03:00
2016-08-01 20:07:41 +03:00
if aEntry . TokenID == "" {
resp . AddWarning ( fmt . Sprintf ( "Found an accessor entry missing a token: %v" , aEntry . AccessorID ) )
2018-09-18 06:03:00 +03:00
continue
}
if aEntry . NamespaceID == nsID {
2016-08-01 20:07:41 +03:00
ret = append ( ret , aEntry . AccessorID )
}
2016-07-30 01:20:38 +03:00
}
resp . Data = map [ string ] interface { } {
"keys" : ret ,
}
return resp , nil
}
2016-03-09 17:31:09 +03:00
// createAccessor is used to create an identifier for the token ID.
2016-03-09 17:48:32 +03:00
// A storage index, mapping the accessor to the token ID is also created.
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) createAccessor ( ctx context . Context , entry * logical . TokenEntry ) error {
2016-03-09 14:23:31 +03:00
defer metrics . MeasureSince ( [ ] string { "token" , "createAccessor" } , time . Now ( ) )
2016-03-08 20:51:38 +03:00
2018-09-18 06:03:00 +03:00
var err error
2016-03-09 17:05:04 +03:00
// Create a random accessor
2018-12-20 18:40:01 +03:00
entry . Accessor , err = base62 . Random ( TokenLength )
2018-09-18 06:03:00 +03:00
if err != nil {
return err
}
tokenNS , err := NamespaceByID ( ctx , entry . NamespaceID , ts . core )
2016-03-08 20:51:38 +03:00
if err != nil {
return err
}
2018-09-18 06:03:00 +03:00
if tokenNS == nil {
return namespace . ErrNoNamespace
}
if tokenNS . ID != namespace . RootNamespaceID {
entry . Accessor = fmt . Sprintf ( "%s.%s" , entry . Accessor , tokenNS . ID )
}
2016-03-08 21:12:53 +03:00
2016-03-09 17:31:09 +03:00
// Create index entry, mapping the accessor to the token ID
2018-09-18 06:03:00 +03:00
saltCtx := namespace . ContextWithNamespace ( ctx , tokenNS )
saltID , err := ts . SaltID ( saltCtx , entry . Accessor )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2016-07-30 01:23:55 +03:00
aEntry := & accessorEntry {
2018-09-18 06:03:00 +03:00
TokenID : entry . ID ,
AccessorID : entry . Accessor ,
NamespaceID : entry . NamespaceID ,
2016-07-30 01:23:55 +03:00
}
2018-09-18 06:03:00 +03:00
2016-07-30 01:23:55 +03:00
aEntryBytes , err := jsonutil . EncodeJSON ( aEntry )
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to marshal accessor index entry: %w" , err )
2016-07-30 01:23:55 +03:00
}
2018-09-18 06:03:00 +03:00
le := & logical . StorageEntry { Key : saltID , Value : aEntryBytes }
if err := ts . accessorView ( tokenNS ) . Put ( ctx , le ) ; err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to persist accessor index entry: %w" , err )
2016-03-08 21:12:53 +03:00
}
2016-03-08 20:51:38 +03:00
return nil
}
2015-03-18 23:19:19 +03:00
// Create is used to create a new token entry. The entry is assigned
2015-03-25 00:22:50 +03:00
// a newly generated ID if not provided.
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) create ( ctx context . Context , entry * logical . TokenEntry ) error {
2015-04-09 02:43:17 +03:00
defer metrics . MeasureSince ( [ ] string { "token" , "create" } , time . Now ( ) )
2015-12-30 22:30:02 +03:00
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , entry . NamespaceID , ts . core )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2018-09-18 06:03:00 +03:00
if tokenNS == nil {
return namespace . ErrNoNamespace
}
2018-10-15 19:56:24 +03:00
entry . Policies = policyutil . SanitizePolicies ( entry . Policies , policyutil . DoNotAddDefaultPolicy )
2020-12-04 20:44:04 +03:00
var createRootTokenFlag bool
2019-10-28 19:30:11 +03:00
if len ( entry . Policies ) == 1 && entry . Policies [ 0 ] == "root" {
2020-12-04 20:44:04 +03:00
createRootTokenFlag = true
2019-10-28 19:31:58 +03:00
metrics . IncrCounter ( [ ] string { "token" , "create_root" } , 1 )
2019-10-28 19:30:11 +03:00
}
2018-10-15 19:56:24 +03:00
2021-10-07 20:36:22 +03:00
// Validate the inline policy if it's set
if entry . InlinePolicy != "" {
if _ , err := ParseACLPolicy ( tokenNS , entry . InlinePolicy ) ; err != nil {
return fmt . Errorf ( "failed to parse inline policy for token entry: %v" , err )
}
}
2018-10-15 19:56:24 +03:00
switch entry . Type {
case logical . TokenTypeDefault , logical . TokenTypeService :
// In case it was default, force to service
entry . Type = logical . TokenTypeService
// Generate an ID if necessary
userSelectedID := true
if entry . ID == "" {
userSelectedID = false
var err error
2020-12-04 20:44:04 +03:00
if createRootTokenFlag {
entry . ID , err = base62 . RandomWithReader ( TokenLength , ts . core . secureRandomReader )
} else {
entry . ID , err = base62 . Random ( TokenLength )
}
2018-09-18 06:03:00 +03:00
if err != nil {
return err
}
}
2020-04-27 19:39:33 +03:00
if userSelectedID {
switch {
2022-02-17 22:43:07 +03:00
case strings . HasPrefix ( entry . ID , consts . ServiceTokenPrefix ) :
return fmt . Errorf ( "custom token ID cannot have the 'hvs.' prefix" )
2022-03-01 23:24:45 +03:00
case strings . HasPrefix ( entry . ID , consts . LegacyServiceTokenPrefix ) :
2020-04-27 19:39:33 +03:00
return fmt . Errorf ( "custom token ID cannot have the 's.' prefix" )
case strings . Contains ( entry . ID , "." ) :
return fmt . Errorf ( "custom token ID cannot have a '.' in the value" )
}
2018-10-17 23:23:04 +03:00
}
if ! userSelectedID {
2022-02-17 22:43:07 +03:00
if ! ts . core . DisableSSCTokens ( ) {
entry . ID = fmt . Sprintf ( "hvs.%s" , entry . ID )
} else {
entry . ID = fmt . Sprintf ( "s.%s" , entry . ID )
}
2018-10-17 23:23:04 +03:00
}
// Attach namespace ID for tokens that are not belonging to the root
// namespace
2018-10-15 19:56:24 +03:00
if tokenNS . ID != namespace . RootNamespaceID {
entry . ID = fmt . Sprintf ( "%s.%s" , entry . ID , tokenNS . ID )
2018-10-17 23:23:04 +03:00
}
2023-03-06 23:09:45 +03:00
if tokenNS . ID != namespace . RootNamespaceID || strings . HasPrefix ( entry . ID , consts . ServiceTokenPrefix ) || strings . HasPrefix ( entry . ID , consts . LegacyServiceTokenPrefix ) {
2018-10-15 19:56:24 +03:00
if entry . CubbyholeID == "" {
2018-12-20 18:40:01 +03:00
cubbyholeID , err := base62 . Random ( TokenLength )
2018-10-15 19:56:24 +03:00
if err != nil {
return err
}
entry . CubbyholeID = cubbyholeID
}
}
2017-06-24 03:52:48 +03:00
2018-10-15 19:56:24 +03:00
// If the user didn't specifically pick the ID, e.g. because they were
// sudo/root, check for collision; otherwise trust the process
if userSelectedID {
exist , _ := ts . lookupInternal ( ctx , entry . ID , false , true )
if exist != nil {
return fmt . Errorf ( "cannot create a token with a duplicate ID" )
}
}
2016-05-13 18:50:00 +03:00
2018-10-15 19:56:24 +03:00
err = ts . createAccessor ( ctx , entry )
if err != nil {
return err
}
2022-02-17 22:43:07 +03:00
err = ts . storeCommon ( ctx , entry , true )
if err != nil {
return err
}
entry . ExternalID = entry . ID
if ! userSelectedID && ! ts . core . DisableSSCTokens ( ) {
entry . ExternalID = ts . GenerateSSCTokenID ( entry . ID , logical . IndexStateFromContext ( ctx ) , entry )
}
return nil
2018-10-15 19:56:24 +03:00
case logical . TokenTypeBatch :
// Ensure fields we don't support/care about are nilled, proto marshal,
// encrypt, skip persistence
entry . ID = ""
pEntry := & pb . TokenEntry {
2021-10-07 20:36:22 +03:00
Parent : entry . Parent ,
Policies : entry . Policies ,
Path : entry . Path ,
Meta : entry . Meta ,
DisplayName : entry . DisplayName ,
CreationTime : entry . CreationTime ,
TTL : int64 ( entry . TTL ) ,
Role : entry . Role ,
EntityID : entry . EntityID ,
NamespaceID : entry . NamespaceID ,
Type : uint32 ( entry . Type ) ,
InternalMeta : entry . InternalMeta ,
InlinePolicy : entry . InlinePolicy ,
NoIdentityPolicies : entry . NoIdentityPolicies ,
2018-10-15 19:56:24 +03:00
}
boundCIDRs := make ( [ ] string , len ( entry . BoundCIDRs ) )
for i , cidr := range entry . BoundCIDRs {
boundCIDRs [ i ] = cidr . String ( )
}
pEntry . BoundCIDRs = boundCIDRs
mEntry , err := proto . Marshal ( pEntry )
if err != nil {
return err
}
eEntry , err := ts . batchTokenEncryptor . Encrypt ( ctx , "" , mEntry )
if err != nil {
return err
}
bEntry := base64 . RawURLEncoding . EncodeToString ( eEntry )
2022-03-05 01:16:51 +03:00
ver , _ , err := ts . core . FindNewestVersionTimestamp ( )
if err != nil {
return err
}
2022-03-08 02:42:06 +03:00
var newestVersion * version . Version
var oneTen * version . Version
if ver != "" {
newestVersion , err = version . NewVersion ( ver )
if err != nil {
return err
}
oneTen , err = version . NewVersion ( "1.10.0" )
if err != nil {
return err
}
2022-03-05 01:16:51 +03:00
}
2022-03-08 02:42:06 +03:00
if ts . core . DisableSSCTokens ( ) || ( newestVersion != nil && newestVersion . LessThan ( oneTen ) ) {
2022-03-05 01:16:51 +03:00
entry . ID = consts . LegacyBatchTokenPrefix + bEntry
2022-02-17 22:43:07 +03:00
} else {
2022-03-05 01:16:51 +03:00
entry . ID = consts . BatchTokenPrefix + bEntry
2022-02-17 22:43:07 +03:00
}
2018-10-15 19:56:24 +03:00
if tokenNS . ID != namespace . RootNamespaceID {
entry . ID = fmt . Sprintf ( "%s.%s" , entry . ID , tokenNS . ID )
}
return nil
default :
return fmt . Errorf ( "cannot create a token of type %d" , entry . Type )
2016-03-08 20:51:38 +03:00
}
2015-12-30 22:30:02 +03:00
}
2022-02-17 22:43:07 +03:00
// GenerateSSCTokenID generates the ID field of the TokenEntry struct for newly
// minted service tokens. This function is meant to be robust so as to allow vault
// to continue operating even in the case where IDs can't be generated. Thus it logs
// errors as opposed to throwing them.
func ( ts * TokenStore ) GenerateSSCTokenID ( innerToken string , walState * logical . WALState , te * logical . TokenEntry ) string {
// Set up the prefix prepending function. This should really only be used in
// the token ID generation code itself.
prependServicePrefix := func ( externalToken string ) string {
if strings . HasPrefix ( externalToken , consts . ServiceTokenPrefix ) {
// We didn't generate a SSC token and furthermore are attempting
// to regenerate a token that already has passed through
// GenerateSSCTokenID, as it has a prefix.
return externalToken
}
return consts . ServiceTokenPrefix + externalToken
}
// If we are not using server side consistent tokens, log it and return here
if ts . core . DisableSSCTokens ( ) {
ts . logger . Trace ( "server side consistent tokens are disabled" )
return prependServicePrefix ( innerToken )
}
// If there is no WAL state, do not throw an error as it may be a single
// node cluster, or an OSS core. Instead, log that this has happened and
// create a walState with nil values to signify that these values should
// be ignored
if walState == nil {
ts . logger . Debug ( "no wal state found when generating token" )
walState = & logical . WALState { }
}
if te . IsRoot ( ) {
return prependServicePrefix ( innerToken )
}
// If the token is a root token, we will always set the index and epoch to 0 so as to ensure
// that root tokens are always fixed size. This is required because during root token
// generation, the size needs to be known to create the OTP.
localIndex := walState . LocalIndex
tokenGenerationCounter := uint32 ( ts . GetSSCTokensGenerationCounter ( ) )
t := tokens . Token { Random : innerToken , LocalIndex : localIndex , IndexEpoch : tokenGenerationCounter }
marshalledToken , err := proto . Marshal ( & t )
if err != nil {
ts . logger . Error ( "unable to marshal token" , "error" , err )
return prependServicePrefix ( innerToken )
}
hmac , err := ts . CalculateSignedTokenHMAC ( marshalledToken )
if err != nil {
// If we can't calculate the HMAC for any reason, we should log an error
// but still allow vault to function, using the old token instead.
ts . logger . Error ( "unable to calculate token signature" , "error" , err )
return prependServicePrefix ( innerToken )
}
st := tokens . SignedToken { TokenVersion : 1 , Token : marshalledToken , Hmac : hmac }
marshalledSignedToken , err := proto . Marshal ( & st )
if err != nil {
ts . logger . Error ( "unable to marshal signed token" , "error" , err )
return prependServicePrefix ( innerToken )
}
generatedSSCToken := base64 . RawURLEncoding . EncodeToString ( marshalledSignedToken )
return prependServicePrefix ( generatedSSCToken )
}
func ( ts * TokenStore ) CalculateSignedTokenHMAC ( marshalledToken [ ] byte ) ( [ ] byte , error ) {
key := ts . core . headerHMACKey ( )
if key == nil {
return nil , errors . New ( "token hmac key has not been initialized or has not been replicated yet to the active node" )
}
hm := hmac . New ( sha256 . New , key )
hm . Write ( [ ] byte ( marshalledToken ) )
return hm . Sum ( nil ) , nil
}
2016-01-05 00:43:07 +03:00
// Store is used to store an updated token entry without writing the
// secondary index.
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) store ( ctx context . Context , entry * logical . TokenEntry ) error {
2015-12-30 22:30:02 +03:00
defer metrics . MeasureSince ( [ ] string { "token" , "store" } , time . Now ( ) )
2018-01-19 09:44:44 +03:00
return ts . storeCommon ( ctx , entry , false )
2015-12-30 22:30:02 +03:00
}
// storeCommon handles the actual storage of an entry, possibly generating
// secondary indexes
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) storeCommon ( ctx context . Context , entry * logical . TokenEntry , writeSecondary bool ) error {
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , entry . NamespaceID , ts . core )
if err != nil {
return err
}
if tokenNS == nil {
return namespace . ErrNoNamespace
}
saltCtx := namespace . ContextWithNamespace ( ctx , tokenNS )
saltedID , err := ts . SaltID ( saltCtx , entry . ID )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2015-03-25 00:22:50 +03:00
// Marshal the entry
2015-03-18 23:19:19 +03:00
enc , err := json . Marshal ( entry )
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to encode entry: %w" , err )
2015-03-18 23:19:19 +03:00
}
2015-12-30 22:30:02 +03:00
if writeSecondary {
// Write the secondary index if necessary. This is done before the
// primary index because we'd rather have a dangling pointer with
// a missing primary instead of missing the parent index and potentially
// escaping the revocation chain.
if entry . Parent != "" {
// Ensure the parent exists
2018-01-19 09:44:44 +03:00
parent , err := ts . Lookup ( ctx , entry . Parent )
2015-12-30 22:30:02 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to lookup parent: %w" , err )
2015-12-30 22:30:02 +03:00
}
if parent == nil {
return fmt . Errorf ( "parent token not found" )
}
2015-03-18 23:19:19 +03:00
2018-09-18 06:03:00 +03:00
parentNS , err := NamespaceByID ( ctx , parent . NamespaceID , ts . core )
if err != nil {
return err
}
if parentNS == nil {
return namespace . ErrNoNamespace
}
parentCtx := namespace . ContextWithNamespace ( ctx , parentNS )
2015-12-30 22:30:02 +03:00
// Create the index entry
2018-09-18 06:03:00 +03:00
parentSaltedID , err := ts . SaltID ( parentCtx , entry . Parent )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2018-09-18 06:03:00 +03:00
path := parentSaltedID + "/" + saltedID
if tokenNS . ID != namespace . RootNamespaceID {
path = fmt . Sprintf ( "%s.%s" , path , tokenNS . ID )
}
2015-12-30 22:30:02 +03:00
le := & logical . StorageEntry { Key : path }
2018-09-18 06:03:00 +03:00
if err := ts . parentView ( parentNS ) . Put ( ctx , le ) ; err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to persist entry: %w" , err )
2015-12-30 22:30:02 +03:00
}
2015-03-18 23:19:19 +03:00
}
}
// Write the primary ID
2018-09-18 06:03:00 +03:00
le := & logical . StorageEntry { Key : saltedID , Value : enc }
2017-11-06 21:10:36 +03:00
if len ( entry . Policies ) == 1 && entry . Policies [ 0 ] == "root" {
le . SealWrap = true
}
2018-09-18 06:03:00 +03:00
if err := ts . idView ( tokenNS ) . Put ( ctx , le ) ; err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to persist entry: %w" , err )
2015-03-18 23:19:19 +03:00
}
return nil
}
2016-05-02 10:11:14 +03:00
// UseToken is used to manage restricted use tokens and decrement their
// available uses. Returns two values: a potentially updated entry or, if the
// token has been revoked, nil; and whether an error was encountered. The
// locking here isn't perfect, as other parts of the code may update an entry,
// but usually none after the entry is already created...so this is pretty
// good.
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) UseToken ( ctx context . Context , te * logical . TokenEntry ) ( * logical . TokenEntry , error ) {
2016-05-02 10:11:14 +03:00
if te == nil {
return nil , fmt . Errorf ( "invalid token entry provided for use count decrementing" )
}
2016-05-02 21:57:17 +03:00
// This case won't be hit with a token with restricted uses because we go
// from 1 to -1. So it's a nice optimization to check this without a read
// lock.
2015-04-17 21:51:04 +03:00
if te . NumUses == 0 {
2016-05-02 10:11:14 +03:00
return te , nil
}
2017-11-13 23:31:32 +03:00
// If we are attempting to unwrap a control group request, don't use the token.
// It will be manually revoked by the handler.
if len ( te . Policies ) == 1 && te . Policies [ 0 ] == controlGroupPolicyName {
return te , nil
}
2017-03-07 19:21:32 +03:00
lock := locksutil . LockForKey ( ts . tokenLocks , te . ID )
2016-05-02 10:11:14 +03:00
lock . Lock ( )
defer lock . Unlock ( )
2018-09-18 06:03:00 +03:00
var err error
te , err = ts . lookupInternal ( ctx , te . ID , false , false )
2016-05-02 10:11:14 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to refresh entry: %w" , err )
2016-05-02 10:11:14 +03:00
}
2016-05-16 23:11:33 +03:00
// If it can't be found we shouldn't be trying to use it, so if we get nil
// back, it is because it has been revoked in the interim or will be
// revoked (NumUses is -1)
2016-05-02 10:11:14 +03:00
if te == nil {
2016-05-16 23:11:33 +03:00
return nil , fmt . Errorf ( "token not found or fully used already" )
2015-04-17 21:51:04 +03:00
}
2016-05-02 21:57:17 +03:00
// Decrement the count. If this is our last use count, we need to indicate
// that this is no longer valid, but revocation is deferred to the end of
// the call, so this will make sure that any Lookup that happens doesn't
2016-05-16 23:11:33 +03:00
// return an entry. This essentially acts as a write-ahead lock and is
// especially useful since revocation can end up (via the expiration
// manager revoking children) attempting to acquire the same lock
// repeatedly.
2016-05-02 21:57:17 +03:00
if te . NumUses == 1 {
2018-05-10 22:50:02 +03:00
te . NumUses = tokenRevocationPending
2016-05-02 21:57:17 +03:00
} else {
2018-05-10 22:50:02 +03:00
te . NumUses --
2015-04-17 21:51:04 +03:00
}
2018-05-10 22:50:02 +03:00
err = ts . store ( ctx , te )
2015-04-17 21:51:04 +03:00
if err != nil {
2016-12-16 21:11:55 +03:00
return nil , err
2015-04-17 21:51:04 +03:00
}
2016-05-02 10:11:14 +03:00
return te , nil
2015-04-17 21:51:04 +03:00
}
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) UseTokenByID ( ctx context . Context , id string ) ( * logical . TokenEntry , error ) {
2018-01-19 09:44:44 +03:00
te , err := ts . Lookup ( ctx , id )
2016-09-29 07:01:28 +03:00
if err != nil {
return te , err
}
2018-01-19 09:44:44 +03:00
return ts . UseToken ( ctx , te )
2016-09-29 07:01:28 +03:00
}
2018-09-18 06:03:00 +03:00
// Lookup is used to find a token given its ID. It acquires a read lock, then calls lookupInternal.
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) Lookup ( ctx context . Context , id string ) ( * logical . TokenEntry , error ) {
2015-04-09 02:43:17 +03:00
defer metrics . MeasureSince ( [ ] string { "token" , "lookup" } , time . Now ( ) )
2015-03-18 23:21:16 +03:00
if id == "" {
return nil , fmt . Errorf ( "cannot lookup blank token" )
}
2016-05-02 10:11:14 +03:00
2018-10-17 23:23:04 +03:00
// If it starts with "b." it's a batch token
2022-02-17 22:43:07 +03:00
if IsBatchToken ( id ) {
2018-10-15 19:56:24 +03:00
return ts . lookupBatchToken ( ctx , id )
}
2017-03-07 19:21:32 +03:00
lock := locksutil . LockForKey ( ts . tokenLocks , id )
2016-05-02 10:11:14 +03:00
lock . RLock ( )
defer lock . RUnlock ( )
2018-09-18 06:03:00 +03:00
return ts . lookupInternal ( ctx , id , false , false )
2015-03-18 23:19:19 +03:00
}
2022-02-17 22:43:07 +03:00
func ( ts * TokenStore ) stripBatchPrefix ( id string ) string {
2022-03-01 23:24:45 +03:00
if strings . HasPrefix ( id , consts . LegacyBatchTokenPrefix ) {
2022-02-17 22:43:07 +03:00
return id [ 2 : ]
}
if strings . HasPrefix ( id , consts . BatchTokenPrefix ) {
return id [ 4 : ]
}
return ""
}
2018-10-15 19:56:24 +03:00
// lookupTainted is used to find a token that may or may not be tainted given
// its ID. It acquires a read lock, then calls lookupInternal.
2018-06-09 00:24:27 +03:00
func ( ts * TokenStore ) lookupTainted ( ctx context . Context , id string ) ( * logical . TokenEntry , error ) {
2017-11-13 23:31:32 +03:00
defer metrics . MeasureSince ( [ ] string { "token" , "lookup" } , time . Now ( ) )
if id == "" {
return nil , fmt . Errorf ( "cannot lookup blank token" )
}
lock := locksutil . LockForKey ( ts . tokenLocks , id )
lock . RLock ( )
defer lock . RUnlock ( )
2018-09-18 06:03:00 +03:00
return ts . lookupInternal ( ctx , id , false , true )
}
2021-04-17 00:03:22 +03:00
func ( ts * TokenStore ) lookupBatchTokenInternal ( ctx context . Context , id string ) ( * logical . TokenEntry , error ) {
2018-10-15 19:56:24 +03:00
// Strip the b. from the front and namespace ID from the back
2022-02-17 22:43:07 +03:00
bEntry , _ := namespace . SplitIDFromString ( ts . stripBatchPrefix ( id ) )
2018-10-15 19:56:24 +03:00
eEntry , err := base64 . RawURLEncoding . DecodeString ( bEntry )
if err != nil {
return nil , err
}
mEntry , err := ts . batchTokenEncryptor . Decrypt ( ctx , "" , eEntry )
if err != nil {
return nil , nil
}
pEntry := new ( pb . TokenEntry )
if err := proto . Unmarshal ( mEntry , pEntry ) ; err != nil {
return nil , err
}
te , err := pb . ProtoTokenEntryToLogicalTokenEntry ( pEntry )
if err != nil {
return nil , err
}
2021-04-17 00:03:22 +03:00
te . ID = id
return te , nil
}
func ( ts * TokenStore ) lookupBatchToken ( ctx context . Context , id string ) ( * logical . TokenEntry , error ) {
te , err := ts . lookupBatchTokenInternal ( ctx , id )
if err != nil {
return nil , err
}
2021-04-20 04:26:51 +03:00
if te == nil {
return nil , nil
}
2021-04-17 00:03:22 +03:00
2018-10-15 19:56:24 +03:00
if time . Now ( ) . After ( time . Unix ( te . CreationTime , 0 ) . Add ( te . TTL ) ) {
return nil , nil
}
if te . Parent != "" {
pte , err := ts . Lookup ( ctx , te . Parent )
if err != nil {
return nil , err
}
if pte == nil {
return nil , nil
}
}
return te , nil
}
2018-09-18 06:03:00 +03:00
// lookupInternal is used to find a token given its (possibly salted) ID. If
// tainted is true, entries that are in some revocation state (currently,
// indicated by num uses < 0), the entry will be returned anyways
func ( ts * TokenStore ) lookupInternal ( ctx context . Context , id string , salted , tainted bool ) ( * logical . TokenEntry , error ) {
ns , err := namespace . FromContext ( ctx )
2017-11-13 23:31:32 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to find namespace in context: %w" , err )
2017-11-13 23:31:32 +03:00
}
2022-02-17 22:43:07 +03:00
// If it starts with "b." or consts.BatchTokenPrefix it's a batch token
if IsBatchToken ( id ) {
2018-10-15 19:56:24 +03:00
return ts . lookupBatchToken ( ctx , id )
}
2022-02-17 22:43:07 +03:00
// lookupInternal is called internally with tokens that oftentimes come from request
// parameters that we cannot really guess. Most notably, these calls come from either
// validateWrappedToken and/or lookupTokenTainted, used in the wrapping token logic.
// We can't really catch all these instances of lookup token, so we have to check the
// SSC token in this function itself.
if IsSSCToken ( id ) {
internalID , err := ts . core . DecodeSSCToken ( id )
if err == nil && internalID != "" {
// A malformed token was passed in, is our best guess here. Just use id going
// forward.
id = internalID
}
}
2018-09-18 06:03:00 +03:00
var raw * logical . StorageEntry
lookupID := id
if ! salted {
// If possible, always use the token's namespace. If it doesn't match
// the request namespace, ensure the request namespace is a child
_ , nsID := namespace . SplitIDFromString ( id )
if nsID != "" {
tokenNS , err := NamespaceByID ( ctx , nsID , ts . core )
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to look up namespace from the token: %w" , err )
2018-09-18 06:03:00 +03:00
}
if tokenNS != nil {
if tokenNS . ID != ns . ID {
ns = tokenNS
ctx = namespace . ContextWithNamespace ( ctx , tokenNS )
}
}
} else {
// Any non-root-ns token should have an accessor and child
// namespaces cannot have custom IDs. If someone omits or tampers
// with it, the lookup in the root namespace simply won't work.
ns = namespace . RootNamespace
ctx = namespace . ContextWithNamespace ( ctx , ns )
}
lookupID , err = ts . SaltID ( ctx , id )
if err != nil {
return nil , err
}
}
raw , err = ts . idView ( ns ) . Get ( ctx , lookupID )
2015-03-18 23:19:19 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to read entry: %w" , err )
2015-03-18 23:19:19 +03:00
}
// Bail if not found
if raw == nil {
return nil , nil
}
// Unmarshal the token
2018-06-09 00:24:27 +03:00
entry := new ( logical . TokenEntry )
2016-07-06 19:25:40 +03:00
if err := jsonutil . DecodeJSON ( raw . Value , entry ) ; err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to decode entry: %w" , err )
2015-03-18 23:19:19 +03:00
}
2016-05-02 10:11:14 +03:00
2016-12-16 21:11:55 +03:00
// This is a token that is awaiting deferred revocation or tainted
if entry . NumUses < 0 && ! tainted {
2016-05-02 10:11:14 +03:00
return nil , nil
}
2018-09-18 06:03:00 +03:00
if entry . NamespaceID == "" {
entry . NamespaceID = namespace . RootNamespaceID
}
2018-10-15 19:56:24 +03:00
// This will be the upgrade case
if entry . Type == logical . TokenTypeDefault {
entry . Type = logical . TokenTypeService
}
2016-09-26 20:38:50 +03:00
persistNeeded := false
// Upgrade the deprecated fields
if entry . DisplayNameDeprecated != "" {
2016-09-27 01:17:50 +03:00
if entry . DisplayName == "" {
2016-09-26 20:38:50 +03:00
entry . DisplayName = entry . DisplayNameDeprecated
}
entry . DisplayNameDeprecated = ""
persistNeeded = true
}
if entry . CreationTimeDeprecated != 0 {
if entry . CreationTime == 0 {
entry . CreationTime = entry . CreationTimeDeprecated
}
entry . CreationTimeDeprecated = 0
persistNeeded = true
}
if entry . ExplicitMaxTTLDeprecated != 0 {
if entry . ExplicitMaxTTL == 0 {
entry . ExplicitMaxTTL = entry . ExplicitMaxTTLDeprecated
}
entry . ExplicitMaxTTLDeprecated = 0
persistNeeded = true
}
if entry . NumUsesDeprecated != 0 {
if entry . NumUses == 0 || entry . NumUsesDeprecated < entry . NumUses {
entry . NumUses = entry . NumUsesDeprecated
}
entry . NumUsesDeprecated = 0
persistNeeded = true
}
2018-06-10 00:39:13 +03:00
// It's a root token with unlimited creation TTL (so never had an
// expiration); this may or may not have a lease (based on when it was
// generated, for later revocation purposes) but it doesn't matter, it's
// allowed. Fast-path this.
if len ( entry . Policies ) == 1 && entry . Policies [ 0 ] == "root" && entry . TTL == 0 {
// If fields are getting upgraded, store the changes
if persistNeeded {
if err := ts . store ( ctx , entry ) ; err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to persist token upgrade: %w" , err )
2018-06-10 00:39:13 +03:00
}
}
return entry , nil
}
2018-06-04 01:14:51 +03:00
// Perform these checks on upgraded fields, but before persisting
// If we are still restoring the expiration manager, we want to ensure the
// token is not expired
if ts . expiration == nil {
2023-08-01 00:54:29 +03:00
switch ts . core . IsDRSecondary ( ) {
case true : // Bail if on DR secondary as expiration manager is nil
return nil , nil
default :
return nil , errors . New ( "expiration manager is nil on tokenstore" )
}
2018-06-04 01:14:51 +03:00
}
2023-08-01 00:54:29 +03:00
2018-09-18 06:03:00 +03:00
le , err := ts . expiration . FetchLeaseTimesByToken ( ctx , entry )
2018-06-04 01:14:51 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to fetch lease times: %w" , err )
2018-06-04 01:14:51 +03:00
}
2018-06-09 00:24:27 +03:00
var ret * logical . TokenEntry
2018-06-04 01:14:51 +03:00
switch {
// It's any kind of expiring token with no lease, immediately delete it
case le == nil :
2021-07-07 15:43:58 +03:00
if ts . core . perfStandby {
return nil , fmt . Errorf ( "no lease entry found for token that ought to have one, possible eventual consistency issue" )
}
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , entry . NamespaceID , ts . core )
if err != nil {
return nil , err
}
if tokenNS == nil {
return nil , namespace . ErrNoNamespace
}
revokeCtx := namespace . ContextWithNamespace ( ts . quitContext , tokenNS )
leaseID , err := ts . expiration . CreateOrFetchRevocationLeaseByToken ( revokeCtx , entry )
2018-06-04 01:14:51 +03:00
if err != nil {
return nil , err
}
2018-09-18 06:03:00 +03:00
err = ts . expiration . Revoke ( revokeCtx , leaseID )
2018-06-04 01:14:51 +03:00
if err != nil {
return nil , err
}
// Only return if we're not past lease expiration (or if tainted is true),
// otherwise assume expmgr is working on revocation
default :
if ! le . ExpireTime . Before ( time . Now ( ) ) || tainted {
ret = entry
}
}
2016-09-26 20:38:50 +03:00
// If fields are getting upgraded, store the changes
if persistNeeded {
2018-05-10 22:50:02 +03:00
if err := ts . store ( ctx , entry ) ; err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to persist token upgrade: %w" , err )
2016-09-26 20:38:50 +03:00
}
}
2018-06-04 01:14:51 +03:00
return ret , nil
2015-03-18 23:19:19 +03:00
}
// Revoke is used to invalidate a given token, any child tokens
// will be orphaned.
2018-05-10 22:50:02 +03:00
func ( ts * TokenStore ) revokeOrphan ( ctx context . Context , id string ) error {
2015-04-09 02:43:17 +03:00
defer metrics . MeasureSince ( [ ] string { "token" , "revoke" } , time . Now ( ) )
2015-03-18 23:21:16 +03:00
if id == "" {
return fmt . Errorf ( "cannot revoke blank token" )
}
2015-09-10 04:58:09 +03:00
2018-03-08 22:21:11 +03:00
saltedID , err := ts . SaltID ( ctx , id )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2018-09-18 06:03:00 +03:00
return ts . revokeInternal ( ctx , saltedID , false )
2015-03-18 23:19:19 +03:00
}
2018-09-18 06:03:00 +03:00
// revokeInternal is used to invalidate a given salted token, any child tokens
2018-05-18 22:14:42 +03:00
// will be orphaned unless otherwise specified. skipOrphan should be used
// whenever we are revoking the entire tree starting from a particular parent
2018-09-18 06:03:00 +03:00
// (e.g. revokeTreeInternal).
func ( ts * TokenStore ) revokeInternal ( ctx context . Context , saltedID string , skipOrphan bool ) ( ret error ) {
2018-05-10 22:50:02 +03:00
// Check and set the token deletion state. We only proceed with the deletion
// if we don't have a pending deletion (empty), or if the deletion previously
// failed (state is false)
state , loaded := ts . tokensPendingDeletion . LoadOrStore ( saltedID , true )
// If the entry was loaded and its state is true, we short-circuit
if loaded && state == true {
2016-12-16 21:11:55 +03:00
return nil
}
2018-05-10 22:50:02 +03:00
// The map check above should protect use from any concurrent revocations, so
2018-09-18 06:03:00 +03:00
// we do another lookup here to make sure we have the right state
entry , err := ts . lookupInternal ( ctx , saltedID , true , true )
2015-03-18 23:19:19 +03:00
if err != nil {
return err
}
2016-12-16 21:11:55 +03:00
if entry == nil {
return nil
}
2018-05-10 22:50:02 +03:00
if entry . NumUses != tokenRevocationPending {
entry . NumUses = tokenRevocationPending
if err := ts . store ( ctx , entry ) ; err != nil {
// The only real reason for this is an underlying storage error
// which also means that nothing else in this func or expmgr will
// really work either. So we clear revocation state so the user can
// try again.
ts . logger . Error ( "failed to mark token as revoked" )
2018-09-18 06:03:00 +03:00
ts . tokensPendingDeletion . Store ( entry . ID , false )
2018-05-10 22:50:02 +03:00
return err
}
2016-12-16 21:11:55 +03:00
}
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , entry . NamespaceID , ts . core )
if err != nil {
return err
}
if tokenNS == nil {
return namespace . ErrNoNamespace
}
2016-12-16 21:11:55 +03:00
defer func ( ) {
2018-05-10 22:50:02 +03:00
// If we succeeded in all other revocation operations after this defer and
// before we return, we can remove the token store entry
if ret == nil {
2018-09-18 06:03:00 +03:00
if err := ts . idView ( tokenNS ) . Delete ( ctx , saltedID ) ; err != nil {
2021-05-11 20:12:54 +03:00
ret = fmt . Errorf ( "failed to delete entry: %w" , err )
2016-12-16 21:11:55 +03:00
}
2018-05-10 22:50:02 +03:00
}
2016-12-16 21:11:55 +03:00
2018-05-10 22:50:02 +03:00
// Check on ret again and update the sync.Map accordingly
if ret != nil {
// If we failed on any of the calls within, we store the state as false
2018-09-18 06:03:00 +03:00
// so that the next call to revokeInternal will retry
2018-05-10 22:50:02 +03:00
ts . tokensPendingDeletion . Store ( saltedID , false )
} else {
ts . tokensPendingDeletion . Delete ( saltedID )
2016-12-16 21:11:55 +03:00
}
} ( )
// Destroy the token's cubby. This should go first as it's a
// security-sensitive item.
2018-09-18 06:03:00 +03:00
err = ts . cubbyholeDestroyer ( ctx , ts , entry )
2016-12-16 21:11:55 +03:00
if err != nil {
return err
}
2018-09-18 06:03:00 +03:00
revokeCtx := namespace . ContextWithNamespace ( ts . quitContext , tokenNS )
if err := ts . expiration . RevokeByToken ( revokeCtx , entry ) ; err != nil {
2016-12-16 21:11:55 +03:00
return err
2015-03-18 23:19:19 +03:00
}
// Clear the secondary index if any
2016-12-16 21:11:55 +03:00
if entry . Parent != "" {
2018-09-18 06:03:00 +03:00
_ , parentNSID := namespace . SplitIDFromString ( entry . Parent )
parentCtx := revokeCtx
parentNS := tokenNS
if parentNSID != tokenNS . ID {
switch {
case parentNSID == "" :
parentNS = namespace . RootNamespace
default :
parentNS , err = NamespaceByID ( ctx , parentNSID , ts . core )
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to get parent namespace: %w" , err )
2018-09-18 06:03:00 +03:00
}
if parentNS == nil {
return namespace . ErrNoNamespace
}
}
parentCtx = namespace . ContextWithNamespace ( ctx , parentNS )
}
parentSaltedID , err := ts . SaltID ( parentCtx , entry . Parent )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2018-09-18 06:03:00 +03:00
path := parentSaltedID + "/" + saltedID
if tokenNS . ID != namespace . RootNamespaceID {
path = fmt . Sprintf ( "%s.%s" , path , tokenNS . ID )
}
if err = ts . parentView ( parentNS ) . Delete ( ctx , path ) ; err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to delete entry: %w" , err )
2015-03-18 23:19:19 +03:00
}
}
2015-04-11 01:12:04 +03:00
2016-03-09 17:05:04 +03:00
// Clear the accessor index if any
2016-12-16 21:11:55 +03:00
if entry . Accessor != "" {
2018-09-18 06:03:00 +03:00
accessorSaltedID , err := ts . SaltID ( revokeCtx , entry . Accessor )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2018-09-18 06:03:00 +03:00
if err = ts . accessorView ( tokenNS ) . Delete ( ctx , accessorSaltedID ) ; err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to delete entry: %w" , err )
2016-03-08 22:04:20 +03:00
}
}
2018-05-18 22:14:42 +03:00
if ! skipOrphan {
// Mark all children token as orphan by removing
// their parent index, and clear the parent entry.
//
// Marking the token as orphan should be skipped if it's called by
2018-09-18 06:03:00 +03:00
// revokeTreeInternal to avoid unnecessary view.List operations. Since
2018-05-18 22:14:42 +03:00
// the deletion occurs in a DFS fashion we don't need to perform a delete
// on child prefixes as there will be none (as saltedID entry is a leaf node).
2018-09-18 06:03:00 +03:00
children , err := ts . parentView ( tokenNS ) . List ( ctx , saltedID + "/" )
2018-03-27 18:12:06 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to scan for children: %w" , err )
2018-03-27 18:12:06 +03:00
}
2018-05-18 22:14:42 +03:00
for _ , child := range children {
2018-09-18 06:03:00 +03:00
var childNSID string
childCtx := revokeCtx
child , childNSID = namespace . SplitIDFromString ( child )
if childNSID != "" {
childNS , err := NamespaceByID ( ctx , childNSID , ts . core )
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to get child token: %w" , err )
2018-09-18 06:03:00 +03:00
}
if childNS == nil {
return namespace . ErrNoNamespace
}
childCtx = namespace . ContextWithNamespace ( ctx , childNS )
}
entry , err := ts . lookupInternal ( childCtx , child , true , true )
2018-05-18 22:14:42 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to get child token: %w" , err )
2018-05-18 22:14:42 +03:00
}
2018-09-18 06:03:00 +03:00
if entry == nil {
// Seems it's already revoked, so nothing to do here except delete the index
err = ts . parentView ( tokenNS ) . Delete ( ctx , child )
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to delete child entry: %w" , err )
2018-09-18 06:03:00 +03:00
}
continue
}
2018-05-18 22:14:42 +03:00
lock := locksutil . LockForKey ( ts . tokenLocks , entry . ID )
lock . Lock ( )
2018-03-27 18:12:06 +03:00
2018-05-18 22:14:42 +03:00
entry . Parent = ""
2018-09-18 06:03:00 +03:00
err = ts . store ( childCtx , entry )
2018-05-18 22:14:42 +03:00
if err != nil {
lock . Unlock ( )
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to update child token: %w" , err )
2018-05-18 22:14:42 +03:00
}
2018-03-27 18:12:06 +03:00
lock . Unlock ( )
2018-05-18 22:14:42 +03:00
2024-03-14 12:37:10 +03:00
// Delete the child storage entry after we update the token entry Since
2018-05-18 22:14:42 +03:00
// paths are not deeply nested (i.e. they are simply
// parenPrefix/<parentID>/<childID>), we can simply call view.Delete instead
// of logical.ClearView
2018-09-18 06:03:00 +03:00
err = ts . parentView ( tokenNS ) . Delete ( ctx , child )
2018-05-18 22:14:42 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to delete child entry: %w" , err )
2018-05-18 22:14:42 +03:00
}
2018-03-27 18:12:06 +03:00
}
}
2015-03-18 23:19:19 +03:00
return nil
}
2018-05-10 22:50:02 +03:00
// revokeTree is used to invalidate a given token and all
2015-03-18 23:19:19 +03:00
// child tokens.
2018-09-18 06:03:00 +03:00
func ( ts * TokenStore ) revokeTree ( ctx context . Context , le * leaseEntry ) error {
2015-04-09 02:43:17 +03:00
defer metrics . MeasureSince ( [ ] string { "token" , "revoke-tree" } , time . Now ( ) )
2015-03-18 23:21:16 +03:00
// Verify the token is not blank
2018-09-18 06:03:00 +03:00
if le . ClientToken == "" {
2017-04-26 21:06:45 +03:00
return fmt . Errorf ( "cannot tree-revoke blank token" )
2015-03-18 23:21:16 +03:00
}
2018-09-18 06:03:00 +03:00
// In case lookup fails for some reason for the token itself, set the
// context for the next call from the lease entry's NS. This function is
// only called when a lease for a given token is expiring, so it should run
// in the context of the token namespace
revCtx := namespace . ContextWithNamespace ( ctx , le . namespace )
saltedID , err := ts . SaltID ( revCtx , le . ClientToken )
2017-07-18 19:02:03 +03:00
if err != nil {
return err
}
2015-03-18 23:19:19 +03:00
2015-04-11 01:06:54 +03:00
// Nuke the entire tree recursively
2018-09-18 06:03:00 +03:00
return ts . revokeTreeInternal ( revCtx , saltedID )
2015-03-18 23:19:19 +03:00
}
2018-09-18 06:03:00 +03:00
// revokeTreeInternal is used to invalidate a given token and all
// child tokens.
2017-12-12 00:51:37 +03:00
// Updated to be non-recursive and revoke child tokens
// before parent tokens(DFS).
2018-09-18 06:03:00 +03:00
func ( ts * TokenStore ) revokeTreeInternal ( ctx context . Context , id string ) error {
2018-09-21 00:56:38 +03:00
dfs := [ ] string { id }
seenIDs := make ( map [ string ] struct { } )
2018-09-18 06:03:00 +03:00
var ns * namespace . Namespace
te , err := ts . lookupInternal ( ctx , id , true , true )
if err != nil {
return err
}
if te == nil {
ns , err = namespace . FromContext ( ctx )
if err != nil {
return err
}
} else {
ns , err = NamespaceByID ( ctx , te . NamespaceID , ts . core )
if err != nil {
return err
}
}
if ns == nil {
return fmt . Errorf ( "failed to find namespace for token revocation" )
}
2015-03-18 23:19:19 +03:00
2017-12-12 00:51:37 +03:00
for l := len ( dfs ) ; l > 0 ; l = len ( dfs ) {
2018-09-21 00:56:38 +03:00
id := dfs [ len ( dfs ) - 1 ]
seenIDs [ id ] = struct { } { }
2018-09-18 06:03:00 +03:00
saltedCtx := ctx
saltedNS := ns
saltedID , saltedNSID := namespace . SplitIDFromString ( id )
if saltedNSID != "" {
saltedNS , err = NamespaceByID ( ctx , saltedNSID , ts . core )
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to find namespace for token revocation: %w" , err )
2018-09-18 06:03:00 +03:00
}
2021-10-19 03:29:47 +03:00
if saltedNS == nil {
return errors . New ( "failed to find namespace for token revocation" )
}
2018-09-18 06:03:00 +03:00
saltedCtx = namespace . ContextWithNamespace ( ctx , saltedNS )
}
path := saltedID + "/"
2018-09-21 00:56:38 +03:00
childrenRaw , err := ts . parentView ( saltedNS ) . List ( saltedCtx , path )
2017-12-12 00:51:37 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to scan for children: %w" , err )
2017-12-12 00:51:37 +03:00
}
2018-09-18 06:03:00 +03:00
2018-09-21 00:56:38 +03:00
// Filter the child list to remove any items that have ever been in the dfs stack.
// This is a robustness check, as a parent/child cycle can lead to an OOM crash.
children := make ( [ ] string , 0 , len ( childrenRaw ) )
for _ , child := range childrenRaw {
if _ , seen := seenIDs [ child ] ; ! seen {
children = append ( children , child )
} else {
if err = ts . parentView ( saltedNS ) . Delete ( saltedCtx , path + child ) ; err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to delete entry: %w" , err )
2018-09-21 00:56:38 +03:00
}
ts . Logger ( ) . Warn ( "token cycle found" , "token" , child )
}
}
2017-12-12 00:51:37 +03:00
// If the length of the children array is zero,
// then we are at a leaf node.
if len ( children ) == 0 {
2018-09-18 06:03:00 +03:00
// Whenever revokeInternal is called, the token will be removed immediately and
2018-05-10 22:50:02 +03:00
// any underlying secrets will be handed off to the expiration manager which will
// take care of expiring them. If Vault is restarted, any revoked tokens
// would have been deleted, and any pending leases for deletion will be restored
// by the expiration manager.
2018-09-18 06:03:00 +03:00
if err := ts . revokeInternal ( saltedCtx , saltedID , true ) ; err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to revoke entry: %w" , err )
2017-12-12 00:51:37 +03:00
}
// If the length of l is equal to 1, then the last token has been deleted
if l == 1 {
return nil
}
2018-09-21 00:56:38 +03:00
dfs = dfs [ : len ( dfs ) - 1 ]
2017-12-12 00:51:37 +03:00
} else {
2018-09-21 00:56:38 +03:00
// If we make it here, there are children and they must be appended.
dfs = append ( dfs , children ... )
2015-03-18 23:19:19 +03:00
}
}
return nil
}
2016-03-01 23:30:37 +03:00
// handleCreateAgainstRole handles the auth/token/create path for a role
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleCreateAgainstRole ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2016-02-29 21:27:31 +03:00
name := d . Get ( "role_name" ) . ( string )
2018-01-19 09:44:44 +03:00
roleEntry , err := ts . tokenStoreRole ( ctx , name )
2016-02-29 21:27:31 +03:00
if err != nil {
return nil , err
}
if roleEntry == nil {
return logical . ErrorResponse ( fmt . Sprintf ( "unknown role %s" , name ) ) , nil
}
2018-01-19 09:44:44 +03:00
return ts . handleCreateCommon ( ctx , req , d , false , roleEntry )
2016-02-29 21:27:31 +03:00
}
2022-01-18 14:56:38 +03:00
func ( ts * TokenStore ) lookupByAccessor ( ctx context . Context , id string , salted , tainted bool ) ( * accessorEntry , error ) {
2018-09-18 06:03:00 +03:00
var aEntry accessorEntry
ns , err := namespace . FromContext ( ctx )
2017-07-18 19:02:03 +03:00
if err != nil {
2022-01-18 14:56:38 +03:00
return nil , err
2017-07-18 19:02:03 +03:00
}
2016-07-30 01:20:38 +03:00
2018-09-18 06:03:00 +03:00
lookupID := id
if ! salted {
_ , nsID := namespace . SplitIDFromString ( id )
if nsID != "" {
accessorNS , err := NamespaceByID ( ctx , nsID , ts . core )
if err != nil {
2022-01-18 14:56:38 +03:00
return nil , err
2018-09-18 06:03:00 +03:00
}
if accessorNS != nil {
if accessorNS . ID != ns . ID {
ns = accessorNS
ctx = namespace . ContextWithNamespace ( ctx , accessorNS )
}
}
} else {
// Any non-root-ns token should have an accessor and child
// namespaces cannot have custom IDs. If someone omits or tampers
// with it, the lookup in the root namespace simply won't work.
ns = namespace . RootNamespace
ctx = namespace . ContextWithNamespace ( ctx , ns )
}
lookupID , err = ts . SaltID ( ctx , id )
if err != nil {
2022-01-18 14:56:38 +03:00
return nil , err
2018-09-18 06:03:00 +03:00
}
}
entry , err := ts . accessorView ( ns ) . Get ( ctx , lookupID )
2016-03-09 02:07:27 +03:00
if err != nil {
2022-01-18 14:56:38 +03:00
return nil , fmt . Errorf ( "failed to read index using accessor: %w" , err )
2016-03-09 02:07:27 +03:00
}
if entry == nil {
2022-01-18 14:56:38 +03:00
return nil , nil
2016-07-30 01:20:38 +03:00
}
err = jsonutil . DecodeJSON ( entry . Value , & aEntry )
// If we hit an error, assume it's a pre-struct straight token ID
if err != nil {
2018-09-18 06:03:00 +03:00
te , err := ts . lookupInternal ( ctx , string ( entry . Value ) , false , tainted )
2016-07-30 01:20:38 +03:00
if err != nil {
2022-01-18 14:56:38 +03:00
return nil , fmt . Errorf ( "failed to look up token using accessor index: %w" , err )
2016-07-30 01:20:38 +03:00
}
2018-09-18 06:03:00 +03:00
// It's hard to reason about what to do here if te is nil -- it may be
// that the token was revoked async, or that it's an old accessor index
// entry that was somehow not cleared up, or or or. A nonexistent token
// entry on lookup is nil, not an error, so we keep that behavior here
// to be safe...the token ID is simply not filled in.
2016-08-01 20:07:41 +03:00
if te != nil {
2017-05-03 19:36:10 +03:00
aEntry . TokenID = te . ID
2016-08-01 20:07:41 +03:00
aEntry . AccessorID = te . Accessor
2018-09-18 06:03:00 +03:00
aEntry . NamespaceID = te . NamespaceID
2016-08-01 20:07:41 +03:00
}
2016-03-09 02:07:27 +03:00
}
2018-09-18 06:03:00 +03:00
if aEntry . NamespaceID == "" {
aEntry . NamespaceID = namespace . RootNamespaceID
}
2022-01-18 14:56:38 +03:00
return & aEntry , nil
2016-03-09 02:07:27 +03:00
}
2016-12-16 23:29:27 +03:00
// handleTidy handles the cleaning up of leaked accessor storage entries and
// cleaning up of leases that are associated to tokens that are expired.
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleTidy ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2018-06-17 01:21:33 +03:00
if ! atomic . CompareAndSwapUint32 ( ts . tidyLock , 0 , 1 ) {
resp := & logical . Response { }
resp . AddWarning ( "Tidy operation already in progress." )
return resp , nil
2017-04-27 20:48:29 +03:00
}
2016-12-16 23:29:27 +03:00
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to get namespace from context: %w" , err )
2018-09-18 06:03:00 +03:00
}
2018-06-17 01:21:33 +03:00
go func ( ) {
defer atomic . StoreUint32 ( ts . tidyLock , 0 )
2017-04-27 18:20:36 +03:00
2018-06-17 01:21:33 +03:00
logger := ts . logger . Named ( "tidy" )
2017-04-27 18:41:33 +03:00
2018-06-17 01:21:33 +03:00
var tidyErrors * multierror . Error
2018-03-27 18:12:06 +03:00
2018-06-17 01:21:33 +03:00
doTidy := func ( ) error {
ts . logger . Info ( "beginning tidy operation on tokens" )
defer ts . logger . Info ( "finished tidy operation on tokens" )
2018-03-27 18:12:06 +03:00
2018-09-18 06:03:00 +03:00
quitCtx := namespace . ContextWithNamespace ( ts . quitContext , ns )
2018-06-17 01:21:33 +03:00
// List out all the accessors
2018-09-18 06:03:00 +03:00
saltedAccessorList , err := ts . accessorView ( ns ) . List ( quitCtx , "" )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to fetch accessor index entries: %w" , err )
2016-12-16 23:29:27 +03:00
}
2018-06-17 01:21:33 +03:00
// First, clean up secondary index entries that are no longer valid
2018-09-18 06:03:00 +03:00
parentList , err := ts . parentView ( ns ) . List ( quitCtx , "" )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to fetch secondary index entries: %w" , err )
2018-03-27 18:12:06 +03:00
}
2018-06-17 01:21:33 +03:00
2019-01-09 21:53:41 +03:00
// List all the cubbyhole storage keys
2023-10-16 14:38:11 +03:00
view := ts . core . router . MatchingStorageByAPIPath ( ctx , mountPathCubbyhole )
2021-04-20 00:28:04 +03:00
if view == nil {
return fmt . Errorf ( "no cubby mount entry" )
}
bview := view . ( * BarrierView )
cubbyholeKeys , err := bview . List ( quitCtx , "" )
2019-01-09 21:53:41 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return fmt . Errorf ( "failed to fetch cubbyhole storage keys: %w" , err )
2019-01-09 21:53:41 +03:00
}
2018-06-17 01:21:33 +03:00
var countParentEntries , deletedCountParentEntries , countParentList , deletedCountParentList int64
// Scan through the secondary index entries; if there is an entry
// with the token's salt ID at the end, remove it
for _ , parent := range parentList {
countParentEntries ++
// Get the children
2018-09-18 06:03:00 +03:00
children , err := ts . parentView ( ns ) . List ( quitCtx , parent )
2017-04-27 18:41:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to read secondary index: %w" , err ) )
2018-03-27 18:12:06 +03:00
continue
2017-04-27 18:41:33 +03:00
}
2018-06-17 01:21:33 +03:00
// First check if the salt ID of the parent exists, and if not mark this so
// that deletion of children later with this loop below applies to all
// children
originalChildrenCount := int64 ( len ( children ) )
2018-09-18 06:03:00 +03:00
exists , _ := ts . lookupInternal ( quitCtx , strings . TrimSuffix ( parent , "/" ) , true , true )
2018-06-17 01:21:33 +03:00
if exists == nil {
ts . logger . Debug ( "deleting invalid parent prefix entry" , "index" , parentPrefix + parent )
}
2017-04-27 18:41:33 +03:00
2018-06-17 01:21:33 +03:00
var deletedChildrenCount int64
2020-06-26 22:44:45 +03:00
for index , child := range children {
2018-06-17 01:21:33 +03:00
countParentList ++
if countParentList % 500 == 0 {
2020-07-14 22:28:11 +03:00
percentComplete := float64 ( index ) / float64 ( len ( children ) ) * 100
2020-06-26 22:44:45 +03:00
ts . logger . Info ( "checking validity of tokens in secondary index list" , "progress" , countParentList , "percent_complete" , percentComplete )
2018-06-17 01:21:33 +03:00
}
// Look up tainted entries so we can be sure that if this isn't
// found, it doesn't exist. Doing the following without locking
// since appropriate locks cannot be held with salted token IDs.
// Also perform deletion if the parent doesn't exist any more.
2018-09-18 06:03:00 +03:00
te , _ := ts . lookupInternal ( quitCtx , child , true , true )
2018-06-17 01:21:33 +03:00
// If the child entry is not nil, but the parent doesn't exist, then turn
// that child token into an orphan token. Theres no deletion in this case.
if te != nil && exists == nil {
lock := locksutil . LockForKey ( ts . tokenLocks , te . ID )
lock . Lock ( )
te . Parent = ""
2018-09-18 06:03:00 +03:00
err = ts . store ( quitCtx , te )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to convert child token into an orphan token: %w" , err ) )
2018-06-17 01:21:33 +03:00
}
lock . Unlock ( )
continue
}
// Otherwise, if the entry doesn't exist, or if the parent doesn't exist go
// on with the delete on the secondary index
if te == nil || exists == nil {
2018-09-18 06:03:00 +03:00
index := parent + child
2018-06-17 01:21:33 +03:00
ts . logger . Debug ( "deleting invalid secondary index" , "index" , index )
2018-09-18 06:03:00 +03:00
err = ts . parentView ( ns ) . Delete ( quitCtx , index )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to delete secondary index: %w" , err ) )
2018-06-17 01:21:33 +03:00
continue
}
deletedChildrenCount ++
}
}
// Add current children deleted count to the total count
deletedCountParentList += deletedChildrenCount
// N.B.: We don't call delete on the parent prefix since physical.Backend.Delete
// implementations should be in charge of deleting empty prefixes.
// If we deleted all the children, then add that to our deleted parent entries count.
if originalChildrenCount == deletedChildrenCount {
deletedCountParentEntries ++
}
2017-04-27 20:48:29 +03:00
}
2017-04-27 18:41:33 +03:00
2018-06-17 01:21:33 +03:00
var countAccessorList ,
2019-07-03 06:29:42 +03:00
countCubbyholeKeys ,
deletedCountAccessorEmptyToken ,
deletedCountAccessorInvalidToken ,
deletedCountInvalidTokenInAccessor ,
deletedCountInvalidCubbyholeKey int64
2019-01-09 21:53:41 +03:00
validCubbyholeKeys := make ( map [ string ] bool )
2018-06-17 01:21:33 +03:00
// For each of the accessor, see if the token ID associated with it is
// a valid one. If not, delete the leases associated with that token
// and delete the accessor as well.
2020-06-26 22:44:45 +03:00
for index , saltedAccessor := range saltedAccessorList {
2018-06-17 01:21:33 +03:00
countAccessorList ++
if countAccessorList % 500 == 0 {
2020-07-14 22:28:11 +03:00
percentComplete := float64 ( index ) / float64 ( len ( saltedAccessorList ) ) * 100
2020-06-26 22:44:45 +03:00
ts . logger . Info ( "checking if accessors contain valid tokens" , "progress" , countAccessorList , "percent_complete" , percentComplete )
2018-06-17 01:21:33 +03:00
}
2017-04-27 20:48:29 +03:00
2018-09-18 06:03:00 +03:00
accessorEntry , err := ts . lookupByAccessor ( quitCtx , saltedAccessor , true , true )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to read the accessor index: %w" , err ) )
2018-06-17 01:21:33 +03:00
continue
}
2022-01-18 14:56:38 +03:00
if accessorEntry == nil {
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to read the accessor index: invalid accessor" ) )
continue
}
2017-07-26 19:15:54 +03:00
2018-06-17 01:21:33 +03:00
// A valid accessor storage entry should always have a token ID
// in it. If not, it is an invalid accessor entry and needs to
// be deleted.
if accessorEntry . TokenID == "" {
// If deletion of accessor fails, move on to the next
// item since this is just a best-effort operation
2018-09-18 06:03:00 +03:00
err = ts . accessorView ( ns ) . Delete ( quitCtx , saltedAccessor )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to delete the accessor index: %w" , err ) )
2018-06-17 01:21:33 +03:00
continue
}
deletedCountAccessorEmptyToken ++
}
2017-04-27 20:48:29 +03:00
2018-06-17 01:21:33 +03:00
lock := locksutil . LockForKey ( ts . tokenLocks , accessorEntry . TokenID )
lock . RLock ( )
2017-04-27 20:48:29 +03:00
2018-06-17 01:21:33 +03:00
// Look up tainted variants so we only find entries that truly don't
// exist
2018-09-18 06:03:00 +03:00
te , err := ts . lookupInternal ( quitCtx , accessorEntry . TokenID , false , true )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to lookup tainted ID: %w" , err ) )
2018-06-17 01:21:33 +03:00
lock . RUnlock ( )
continue
}
2017-04-27 18:41:33 +03:00
2018-06-17 01:21:33 +03:00
lock . RUnlock ( )
2019-01-09 21:53:41 +03:00
switch {
case te == nil :
// If token entry is not found assume that the token is not valid any
// more and conclude that accessor, leases, and secondary index entries
// for this token should not exist as well.
2018-09-18 06:03:00 +03:00
ts . logger . Info ( "deleting token with nil entry referenced by accessor" , "salted_accessor" , saltedAccessor )
2018-06-17 01:21:33 +03:00
// RevokeByToken expects a '*logical.TokenEntry'. For the
// purposes of tidying, it is sufficient if the token
// entry only has ID set.
tokenEntry := & logical . TokenEntry {
2018-09-18 06:03:00 +03:00
ID : accessorEntry . TokenID ,
NamespaceID : accessorEntry . NamespaceID ,
2018-06-17 01:21:33 +03:00
}
// Attempt to revoke the token. This will also revoke
// the leases associated with the token.
2018-09-18 06:03:00 +03:00
err = ts . expiration . RevokeByToken ( quitCtx , tokenEntry )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to revoke leases of expired token: %w" , err ) )
2018-06-17 01:21:33 +03:00
continue
}
deletedCountInvalidTokenInAccessor ++
// If deletion of accessor fails, move on to the next item since
// this is just a best-effort operation. We do this last so that on
// next run if something above failed we still have the accessor
// entry to try again.
2018-09-18 06:03:00 +03:00
err = ts . accessorView ( ns ) . Delete ( quitCtx , saltedAccessor )
2018-06-17 01:21:33 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to delete accessor entry: %w" , err ) )
2018-06-17 01:21:33 +03:00
continue
}
deletedCountAccessorInvalidToken ++
2019-01-09 21:53:41 +03:00
default :
// Cache the cubbyhole storage key when the token is valid
switch {
2022-02-17 22:43:07 +03:00
case te . NamespaceID == namespace . RootNamespaceID && ! IsServiceToken ( te . ID ) :
2019-01-09 21:53:41 +03:00
saltedID , err := ts . SaltID ( quitCtx , te . ID )
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to create salted token id: %w" , err ) )
2019-01-09 21:53:41 +03:00
continue
}
validCubbyholeKeys [ salt . SaltID ( ts . cubbyholeBackend . saltUUID , saltedID , salt . SHA1Hash ) ] = true
default :
if te . CubbyholeID == "" {
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "missing cubbyhole ID for a valid token" ) )
continue
}
validCubbyholeKeys [ te . CubbyholeID ] = true
}
}
}
// Revoke invalid cubbyhole storage keys
2020-06-26 22:44:45 +03:00
for index , key := range cubbyholeKeys {
2019-01-09 21:53:41 +03:00
countCubbyholeKeys ++
if countCubbyholeKeys % 500 == 0 {
2020-07-14 22:28:11 +03:00
percentComplete := float64 ( index ) / float64 ( len ( cubbyholeKeys ) ) * 100
2020-06-26 22:44:45 +03:00
ts . logger . Info ( "checking if there are invalid cubbyholes" , "progress" , countCubbyholeKeys , "percent_complete" , percentComplete )
2019-01-09 21:53:41 +03:00
}
key := strings . TrimSuffix ( key , "/" )
if ! validCubbyholeKeys [ key ] {
ts . logger . Info ( "deleting invalid cubbyhole" , "key" , key )
2021-04-20 00:28:04 +03:00
err = ts . cubbyholeBackend . revoke ( quitCtx , bview , key )
2019-01-09 21:53:41 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
tidyErrors = multierror . Append ( tidyErrors , fmt . Errorf ( "failed to revoke cubbyhole key %q: %w" , key , err ) )
2019-01-09 21:53:41 +03:00
}
deletedCountInvalidCubbyholeKey ++
2018-06-17 01:21:33 +03:00
}
2017-04-27 20:48:29 +03:00
}
2017-04-27 18:41:33 +03:00
2018-06-17 01:21:33 +03:00
ts . logger . Info ( "number of entries scanned in parent prefix" , "count" , countParentEntries )
ts . logger . Info ( "number of entries deleted in parent prefix" , "count" , deletedCountParentEntries )
ts . logger . Info ( "number of tokens scanned in parent index list" , "count" , countParentList )
ts . logger . Info ( "number of tokens revoked in parent index list" , "count" , deletedCountParentList )
ts . logger . Info ( "number of accessors scanned" , "count" , countAccessorList )
ts . logger . Info ( "number of deleted accessors which had empty tokens" , "count" , deletedCountAccessorEmptyToken )
ts . logger . Info ( "number of revoked tokens which were invalid but present in accessors" , "count" , deletedCountInvalidTokenInAccessor )
ts . logger . Info ( "number of deleted accessors which had invalid tokens" , "count" , deletedCountAccessorInvalidToken )
2019-01-09 21:53:41 +03:00
ts . logger . Info ( "number of deleted cubbyhole keys that were invalid" , "count" , deletedCountInvalidCubbyholeKey )
2017-04-27 20:48:29 +03:00
2018-06-17 01:21:33 +03:00
return tidyErrors . ErrorOrNil ( )
2016-12-16 23:29:27 +03:00
}
2018-06-17 01:21:33 +03:00
if err := doTidy ( ) ; err != nil {
logger . Error ( "error running tidy" , "error" , err )
return
}
} ( )
2017-05-03 17:54:07 +03:00
2018-06-17 01:21:33 +03:00
resp := & logical . Response { }
resp . AddWarning ( "Tidy operation successfully started. Any information from the operation will be printed to Vault's server logs." )
2018-07-11 22:45:09 +03:00
return logical . RespondWithStatusCode ( resp , req , http . StatusAccepted )
2016-12-16 23:29:27 +03:00
}
2016-03-09 17:48:32 +03:00
// handleUpdateLookupAccessor handles the auth/token/lookup-accessor path for returning
2016-03-09 17:05:04 +03:00
// the properties of the token associated with the accessor
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleUpdateLookupAccessor ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2016-03-09 14:23:31 +03:00
accessor := data . Get ( "accessor" ) . ( string )
if accessor == "" {
2018-11-20 00:58:19 +03:00
return nil , & logical . StatusBadRequest { Err : "missing accessor" }
2016-03-09 01:38:19 +03:00
}
2018-09-18 06:03:00 +03:00
aEntry , err := ts . lookupByAccessor ( ctx , accessor , false , false )
2016-03-09 01:38:19 +03:00
if err != nil {
2016-03-09 02:07:27 +03:00
return nil , err
2016-03-09 01:38:19 +03:00
}
2022-01-18 14:56:38 +03:00
if aEntry == nil {
return nil , & logical . StatusBadRequest { Err : "invalid accessor" }
}
2016-03-09 01:38:19 +03:00
// Prepare the field data required for a lookup call
d := & framework . FieldData {
Raw : map [ string ] interface { } {
2016-07-30 01:20:38 +03:00
"token" : aEntry . TokenID ,
2016-03-09 01:38:19 +03:00
} ,
Schema : map [ string ] * framework . FieldSchema {
2021-04-08 19:43:39 +03:00
"token" : {
2016-03-09 01:38:19 +03:00
Type : framework . TypeString ,
Description : "Token to lookup" ,
} ,
} ,
}
2018-01-08 21:31:38 +03:00
resp , err := ts . handleLookup ( ctx , req , d )
2016-03-09 01:38:19 +03:00
if err != nil {
return nil , err
}
if resp == nil {
return nil , fmt . Errorf ( "failed to lookup the token" )
}
if resp . IsError ( ) {
return resp , nil
}
// Remove the token ID from the response
2016-03-09 17:05:04 +03:00
if resp . Data != nil {
2016-03-09 01:38:19 +03:00
resp . Data [ "id" ] = ""
}
return resp , nil
2016-03-08 23:13:29 +03:00
}
2019-11-08 19:32:01 +03:00
func ( ts * TokenStore ) handleUpdateRenewAccessor ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
accessor := data . Get ( "accessor" ) . ( string )
if accessor == "" {
return nil , & logical . StatusBadRequest { Err : "missing accessor" }
}
aEntry , err := ts . lookupByAccessor ( ctx , accessor , false , false )
if err != nil {
return nil , err
}
2022-01-18 14:56:38 +03:00
if aEntry == nil {
return nil , & logical . StatusBadRequest { Err : "invalid accessor" }
}
2019-11-08 19:32:01 +03:00
// Prepare the field data required for a lookup call
d := & framework . FieldData {
Raw : map [ string ] interface { } {
"token" : aEntry . TokenID ,
} ,
Schema : map [ string ] * framework . FieldSchema {
"token" : {
Type : framework . TypeString ,
} ,
"increment" : {
Type : framework . TypeDurationSecond ,
} ,
} ,
}
if inc , ok := data . GetOk ( "increment" ) ; ok {
d . Raw [ "increment" ] = inc
}
resp , err := ts . handleRenew ( ctx , req , d )
if err != nil {
return nil , err
}
if resp == nil {
return nil , fmt . Errorf ( "failed to lookup the token" )
}
if resp . IsError ( ) {
return resp , nil
}
// Remove the token ID from the response
if resp . Auth != nil {
resp . Auth . ClientToken = ""
}
return resp , nil
}
2016-03-09 17:48:32 +03:00
// handleUpdateRevokeAccessor handles the auth/token/revoke-accessor path for revoking
2016-03-09 17:05:04 +03:00
// the token associated with the accessor
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleUpdateRevokeAccessor ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2016-03-09 14:23:31 +03:00
accessor := data . Get ( "accessor" ) . ( string )
if accessor == "" {
2018-11-20 00:58:19 +03:00
return nil , & logical . StatusBadRequest { Err : "missing accessor" }
2016-03-09 02:07:27 +03:00
}
2018-09-18 06:03:00 +03:00
aEntry , err := ts . lookupByAccessor ( ctx , accessor , false , true )
2016-03-09 02:07:27 +03:00
if err != nil {
return nil , err
}
2022-01-18 14:56:38 +03:00
if aEntry == nil {
resp := & logical . Response { }
resp . AddWarning ( "No token found with this accessor" )
return resp , nil
}
2016-03-09 02:07:27 +03:00
2018-05-10 22:50:02 +03:00
te , err := ts . Lookup ( ctx , aEntry . TokenID )
if err != nil {
return nil , err
}
if te == nil {
return logical . ErrorResponse ( "token not found" ) , logical . ErrInvalidRequest
}
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , te . NamespaceID , ts . core )
if err != nil {
return nil , err
}
if tokenNS == nil {
return nil , namespace . ErrNoNamespace
}
revokeCtx := namespace . ContextWithNamespace ( ts . quitContext , tokenNS )
leaseID , err := ts . expiration . CreateOrFetchRevocationLeaseByToken ( revokeCtx , te )
2018-05-10 22:50:02 +03:00
if err != nil {
return nil , err
}
2018-09-18 06:03:00 +03:00
err = ts . expiration . Revoke ( revokeCtx , leaseID )
2018-05-10 22:50:02 +03:00
if err != nil {
return nil , err
2016-03-09 02:07:27 +03:00
}
2016-08-29 22:15:57 +03:00
2016-03-08 23:13:29 +03:00
return nil , nil
}
2015-11-03 23:10:46 +03:00
// handleCreate handles the auth/token/create path for creation of new orphan
// tokens
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleCreateOrphan ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2018-01-19 09:44:44 +03:00
return ts . handleCreateCommon ( ctx , req , d , true , nil )
2015-11-03 23:10:46 +03:00
}
// handleCreate handles the auth/token/create path for creation of new non-orphan
// tokens
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleCreate ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2018-01-19 09:44:44 +03:00
return ts . handleCreateCommon ( ctx , req , d , false , nil )
2015-11-03 23:10:46 +03:00
}
// handleCreateCommon handles the auth/token/create path for creation of new tokens
2018-01-19 09:44:44 +03:00
func ( ts * TokenStore ) handleCreateCommon ( ctx context . Context , req * logical . Request , d * framework . FieldData , orphan bool , role * tsRoleEntry ) ( * logical . Response , error ) {
2015-03-25 01:10:46 +03:00
// Read the parent policy
2018-01-19 09:44:44 +03:00
parent , err := ts . Lookup ( ctx , req . ClientToken )
2018-05-18 19:30:03 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "parent token lookup failed: %w" , err )
2018-05-18 19:30:03 +03:00
}
if parent == nil {
return logical . ErrorResponse ( "parent token lookup failed: no parent found" ) , logical . ErrInvalidRequest
2015-03-25 01:10:46 +03:00
}
2018-10-15 19:56:24 +03:00
if parent . Type == logical . TokenTypeBatch {
return logical . ErrorResponse ( "batch tokens cannot create more tokens" ) , nil
}
2015-03-25 01:10:46 +03:00
2015-04-17 21:34:25 +03:00
// A token with a restricted number of uses cannot create a new token
// otherwise it could escape the restriction count.
if parent . NumUses > 0 {
return logical . ErrorResponse ( "restricted use token cannot generate child tokens" ) ,
logical . ErrInvalidRequest
}
2015-09-21 17:04:03 +03:00
// Check if the client token has sudo/root privileges for the requested path
2019-08-26 17:23:46 +03:00
isSudo := ts . System ( ) . ( extendedSystemView ) . SudoPrivilege ( ctx , req . MountPoint + req . Path , req . ClientToken )
2015-03-25 01:10:46 +03:00
2023-07-11 00:34:10 +03:00
policies := d . Get ( "policies" ) . ( [ ] string )
2015-03-25 01:10:46 +03:00
2018-09-18 06:03:00 +03:00
// If the context's namespace is different from the parent and this is an
// orphan token creation request, then this is an admin token generation for
// the namespace
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
if ns . ID != parent . NamespaceID {
parentNS , err := NamespaceByID ( ctx , parent . NamespaceID , ts . core )
if err != nil {
ts . logger . Error ( "error looking up parent namespace" , "error" , err , "parent_namespace" , parent . NamespaceID )
return nil , ErrInternalError
}
if parentNS == nil {
ts . logger . Error ( "could not find information for parent namespace" , "parent_namespace" , parent . NamespaceID )
return nil , ErrInternalError
}
if ! isSudo {
2019-03-18 16:33:01 +03:00
return logical . ErrorResponse ( "root or sudo privileges required to directly generate a token in a child namespace" ) , logical . ErrInvalidRequest
2018-09-18 06:03:00 +03:00
}
2023-07-11 00:34:10 +03:00
if strutil . StrListContains ( policies , "root" ) {
2018-09-18 06:03:00 +03:00
return logical . ErrorResponse ( "root tokens may not be created from a parent namespace" ) , logical . ErrInvalidRequest
}
}
2018-10-15 19:56:24 +03:00
tokenType := logical . TokenTypeService
2023-07-11 00:34:10 +03:00
tokenTypeStr := d . Get ( "type" ) . ( string )
2018-10-15 19:56:24 +03:00
if role != nil {
switch role . TokenType {
2018-11-07 17:45:09 +03:00
case logical . TokenTypeDefault , logical . TokenTypeDefaultService :
// Use the user-given value, but fall back to service
case logical . TokenTypeDefaultBatch :
// Use the user-given value, but fall back to batch
if tokenTypeStr == "" {
tokenTypeStr = logical . TokenTypeBatch . String ( )
}
case logical . TokenTypeService :
2018-10-15 19:56:24 +03:00
tokenTypeStr = logical . TokenTypeService . String ( )
case logical . TokenTypeBatch :
tokenTypeStr = logical . TokenTypeBatch . String ( )
default :
return logical . ErrorResponse ( fmt . Sprintf ( "role being used for token creation contains invalid token type %q" , role . TokenType . String ( ) ) ) , nil
}
}
2023-07-11 00:34:10 +03:00
renewable := d . Get ( "renewable" ) . ( bool )
explicitMaxTTL := d . Get ( "explicit_max_ttl" ) . ( string )
numUses := d . Get ( "num_uses" ) . ( int )
period := d . Get ( "period" ) . ( string )
2018-10-15 19:56:24 +03:00
switch tokenTypeStr {
case "" , "service" :
case "batch" :
var badReason string
switch {
2023-07-11 00:34:10 +03:00
case explicitMaxTTL != "" :
dur , err := parseutil . ParseDurationSecond ( explicitMaxTTL )
2018-10-15 19:56:24 +03:00
if err != nil {
return logical . ErrorResponse ( ` "explicit_max_ttl" value could not be parsed ` ) , nil
}
if dur != 0 {
badReason = "explicit_max_ttl"
}
2023-07-11 00:34:10 +03:00
case numUses != 0 :
2018-10-15 19:56:24 +03:00
badReason = "num_uses"
2023-07-11 00:34:10 +03:00
case period != "" :
dur , err := parseutil . ParseDurationSecond ( period )
2018-10-15 19:56:24 +03:00
if err != nil {
return logical . ErrorResponse ( ` "period" value could not be parsed ` ) , nil
}
if dur != 0 {
badReason = "period"
}
}
if badReason != "" {
return logical . ErrorResponse ( fmt . Sprintf ( "batch tokens cannot have %q set" , badReason ) ) , nil
}
tokenType = logical . TokenTypeBatch
renewable = false
default :
return logical . ErrorResponse ( "invalid 'token_type' value" ) , logical . ErrInvalidRequest
}
2015-04-17 21:34:25 +03:00
// Verify the number of uses is positive
2023-07-11 00:34:10 +03:00
if numUses < 0 {
2015-04-17 21:34:25 +03:00
return logical . ErrorResponse ( "number of uses cannot be negative" ) ,
logical . ErrInvalidRequest
}
2019-07-01 12:39:54 +03:00
// Verify the entity alias
var explicitEntityID string
2023-07-11 00:34:10 +03:00
if entityAliasRaw := d . Get ( "entity_alias" ) . ( string ) ; entityAliasRaw != "" {
2019-07-01 12:39:54 +03:00
// Parameter is only allowed in combination with token role
if role == nil {
return logical . ErrorResponse ( "'entity_alias' is only allowed in combination with token role" ) , logical . ErrInvalidRequest
}
2021-01-27 20:56:54 +03:00
// Convert entity alias to lowercase to match the fact that role.AllowedEntityAliases
// has also been lowercased. An entity alias will keep its case formatting, but be
2023-07-11 00:34:10 +03:00
// treated as lowercase during any value check anywhere.
entityAlias := strings . ToLower ( entityAliasRaw )
2021-01-27 20:56:54 +03:00
2019-07-01 12:39:54 +03:00
// Check if there is a concrete match
2021-01-27 20:56:54 +03:00
if ! strutil . StrListContains ( role . AllowedEntityAliases , entityAlias ) &&
! strutil . StrListContainsGlob ( role . AllowedEntityAliases , entityAlias ) {
2019-07-01 12:39:54 +03:00
return logical . ErrorResponse ( "invalid 'entity_alias' value" ) , logical . ErrInvalidRequest
}
// Get mount accessor which is required to lookup entity alias
mountValidationResp := ts . core . router . MatchingMountByAccessor ( req . MountAccessor )
if mountValidationResp == nil {
return logical . ErrorResponse ( "auth token mount accessor not found" ) , nil
}
// Create alias for later processing
alias := & logical . Alias {
2023-07-11 00:34:10 +03:00
Name : entityAliasRaw ,
2019-07-01 12:39:54 +03:00
MountAccessor : mountValidationResp . Accessor ,
MountType : mountValidationResp . Type ,
}
2023-06-13 17:21:51 +03:00
// Create or fetch entity from entity alias. Note that we might be on a perf
// standby so a create would return a ReadOnly error which would cause an
// RPC-based redirect. That path doesn't register leases since the code that
// calls RegisterAuth is in the http layer... So be careful to catch and
// handle readonly ourselves.
2022-05-18 19:16:13 +03:00
entity , _ , err := ts . core . identityStore . CreateOrFetchEntity ( ctx , alias )
2019-07-01 12:39:54 +03:00
if err != nil {
2023-06-13 17:21:51 +03:00
auth := & logical . Auth {
Alias : alias ,
}
entity , _ , err = possiblyForwardAliasCreation ( ctx , ts . core , err , auth , entity )
if err != nil {
return nil , err
}
2019-07-01 12:39:54 +03:00
}
if entity == nil {
return nil , errors . New ( "failed to create or fetch entity from given entity alias" )
}
// Validate that the entity is not disabled
if entity . Disabled {
return logical . ErrorResponse ( "entity from given entity alias is disabled" ) , logical . ErrPermissionDenied
}
// Set new entity id
explicitEntityID = entity . ID
}
2023-07-11 00:34:10 +03:00
// GetOk is used here solely to preserve the distinction between an absent/nil map and an empty map, to match the
// behaviour of previous Vault versions - rather than introducing a potential slight compatibility issue for users.
meta , ok := d . GetOk ( "meta" )
var metaMap map [ string ] string
if ok {
metaMap = meta . ( map [ string ] string )
}
// Set up the token entry
2018-06-09 00:24:27 +03:00
te := logical . TokenEntry {
2016-04-07 18:39:46 +03:00
Parent : req . ClientToken ,
// The mount point is always the same since we have only one token
// store; using req.MountPoint causes trouble in tests since they don't
// have an official mount
Path : fmt . Sprintf ( "auth/token/%s" , req . Path ) ,
2023-07-11 00:34:10 +03:00
Meta : metaMap ,
2015-09-18 23:33:52 +03:00
DisplayName : "token" ,
2023-07-11 00:34:10 +03:00
NumUses : numUses ,
2015-09-18 23:33:52 +03:00
CreationTime : time . Now ( ) . Unix ( ) ,
2018-09-18 06:03:00 +03:00
NamespaceID : ns . ID ,
2018-10-15 19:56:24 +03:00
Type : tokenType ,
2016-06-08 18:14:30 +03:00
}
2016-03-07 18:07:04 +03:00
// If the role is not nil, we add the role name as part of the token's
// path. This makes it much easier to later revoke tokens that were issued
// by a role (using revoke-prefix). Users can further specify a PathSuffix
// in the role; that way they can use something like "v1", "v2" to indicate
// role revisions, and revoke only tokens issued with a previous revision.
2016-02-29 21:27:31 +03:00
if role != nil {
te . Role = role . Name
2016-06-08 22:17:22 +03:00
// If renewable hasn't been disabled in the call and the role has
// renewability disabled, set renewable false
if renewable && ! role . Renewable {
renewable = false
}
2019-06-14 17:17:04 +03:00
// Update te.NumUses which is equal to req.Data["num_uses"] at this point
// 0 means unlimited so 1 is actually less than 0
switch {
case role . TokenNumUses == 0 :
case te . NumUses == 0 :
te . NumUses = role . TokenNumUses
case role . TokenNumUses < te . NumUses :
te . NumUses = role . TokenNumUses
}
2016-03-01 23:30:37 +03:00
if role . PathSuffix != "" {
te . Path = fmt . Sprintf ( "%s/%s" , te . Path , role . PathSuffix )
2016-02-29 21:27:31 +03:00
}
}
2015-04-16 00:24:07 +03:00
// Attach the given display name if any
2023-07-11 00:34:10 +03:00
if displayName := d . Get ( "display_name" ) . ( string ) ; displayName != "" {
full := "token-" + displayName
2015-04-16 00:24:07 +03:00
full = displayNameSanitize . ReplaceAllString ( full , "-" )
full = strings . TrimSuffix ( full , "-" )
te . DisplayName = full
2015-03-25 01:10:46 +03:00
}
2015-09-19 02:59:06 +03:00
// Allow specifying the ID of the token if the client has root or sudo privileges
2023-07-11 00:34:10 +03:00
if id := d . Get ( "id" ) . ( string ) ; id != "" {
2015-09-19 02:59:06 +03:00
if ! isSudo {
return logical . ErrorResponse ( "root or sudo privileges required to specify token id" ) ,
2015-03-25 01:10:46 +03:00
logical . ErrInvalidRequest
}
2018-09-18 06:03:00 +03:00
if ns . ID != namespace . RootNamespaceID {
return logical . ErrorResponse ( "token IDs can only be manually specified in the root namespace" ) ,
logical . ErrInvalidRequest
}
2023-07-11 00:34:10 +03:00
te . ID = id
2015-03-25 01:10:46 +03:00
}
2016-08-02 17:33:50 +03:00
resp := & logical . Response { }
2016-12-16 08:36:39 +03:00
var addDefault bool
// N.B.: The logic here uses various calculations as to whether default
// should be added. In the end we decided that if NoDefaultPolicy is set it
// should be stripped out regardless, *but*, the logic of when it should
// and shouldn't be added is kept because we want to do subset comparisons
// based on adding default when it's correct to do so.
2023-07-11 00:34:10 +03:00
noDefaultPolicy := d . Get ( "no_default_policy" ) . ( bool )
2016-02-29 21:27:31 +03:00
switch {
2021-09-21 18:25:06 +03:00
case role != nil && ( len ( role . AllowedPolicies ) > 0 || len ( role . DisallowedPolicies ) > 0 ||
len ( role . AllowedPoliciesGlob ) > 0 || len ( role . DisallowedPoliciesGlob ) > 0 ) :
2016-12-16 08:36:39 +03:00
// Holds the final set of policies as they get munged
var finalPolicies [ ] string
// We don't make use of the global one because roles with allowed or
// disallowed set do their own policy rules
var localAddDefault bool
// If the request doesn't say not to add "default" and if "default"
// isn't in the disallowed list, add it. This is in line with the idea
// that roles, when allowed/disallowed ar set, allow a subset of
// policies to be set disjoint from the parent token's policies.
2023-07-11 00:34:10 +03:00
if ! noDefaultPolicy && ! role . TokenNoDefaultPolicy &&
2021-09-21 18:25:06 +03:00
! strutil . StrListContains ( role . DisallowedPolicies , "default" ) &&
! strutil . StrListContainsGlob ( role . DisallowedPoliciesGlob , "default" ) {
2016-12-16 08:36:39 +03:00
localAddDefault = true
2016-08-02 17:33:50 +03:00
}
2016-05-11 23:51:18 +03:00
2016-12-16 08:36:39 +03:00
// Start with passed-in policies as a baseline, if they exist
2023-07-11 00:34:10 +03:00
if len ( policies ) > 0 {
finalPolicies = policyutil . SanitizePolicies ( policies , localAddDefault )
2016-02-29 21:27:31 +03:00
}
2021-09-21 18:25:06 +03:00
var sanitizedRolePolicies , sanitizedRolePoliciesGlob [ ] string
2016-12-16 08:36:39 +03:00
// First check allowed policies; if policies are specified they will be
// checked, otherwise if an allowed set exists that will be the set
// that is used
2021-09-21 18:25:06 +03:00
if len ( role . AllowedPolicies ) > 0 || len ( role . AllowedPoliciesGlob ) > 0 {
2016-12-16 08:36:39 +03:00
// Note that if "default" is already in allowed, and also in
// disallowed, this will still result in an error later since this
// doesn't strip out default
sanitizedRolePolicies = policyutil . SanitizePolicies ( role . AllowedPolicies , localAddDefault )
if len ( finalPolicies ) == 0 {
finalPolicies = sanitizedRolePolicies
} else {
2021-09-21 18:25:06 +03:00
sanitizedRolePoliciesGlob = policyutil . SanitizePolicies ( role . AllowedPoliciesGlob , false )
for _ , finalPolicy := range finalPolicies {
if ! strutil . StrListContains ( sanitizedRolePolicies , finalPolicy ) &&
! strutil . StrListContainsGlob ( sanitizedRolePoliciesGlob , finalPolicy ) {
return logical . ErrorResponse ( fmt . Sprintf ( "token policies (%q) must be subset of the role's allowed policies (%q) or glob policies (%q)" , finalPolicies , sanitizedRolePolicies , sanitizedRolePoliciesGlob ) ) , logical . ErrInvalidRequest
}
2016-12-16 08:36:39 +03:00
}
}
} else {
2017-01-19 00:11:25 +03:00
// Assign parent policies if none have been requested. As this is a
// role, add default unless explicitly disabled.
2016-12-16 08:36:39 +03:00
if len ( finalPolicies ) == 0 {
finalPolicies = policyutil . SanitizePolicies ( parent . Policies , localAddDefault )
}
2016-08-02 17:33:50 +03:00
}
2021-09-21 18:25:06 +03:00
if len ( role . DisallowedPolicies ) > 0 || len ( role . DisallowedPoliciesGlob ) > 0 {
2016-12-16 08:36:39 +03:00
// We don't add the default here because we only want to disallow it if it's explicitly set
2017-04-04 18:54:18 +03:00
sanitizedRolePolicies = strutil . RemoveDuplicates ( role . DisallowedPolicies , true )
2021-09-21 18:25:06 +03:00
sanitizedRolePoliciesGlob = strutil . RemoveDuplicates ( role . DisallowedPoliciesGlob , true )
2016-08-02 17:33:50 +03:00
2016-12-16 08:36:39 +03:00
for _ , finalPolicy := range finalPolicies {
2021-09-21 18:25:06 +03:00
if strutil . StrListContains ( sanitizedRolePolicies , finalPolicy ) ||
strutil . StrListContainsGlob ( sanitizedRolePoliciesGlob , finalPolicy ) {
2016-12-16 08:36:39 +03:00
return logical . ErrorResponse ( fmt . Sprintf ( "token policy %q is disallowed by this role" , finalPolicy ) ) , logical . ErrInvalidRequest
}
2016-08-02 17:33:50 +03:00
}
}
2023-07-11 00:34:10 +03:00
policies = finalPolicies
2016-12-16 08:36:39 +03:00
2018-09-18 06:03:00 +03:00
// We are creating a token from a parent namespace. We should only use the input
// policies.
case ns . ID != parent . NamespaceID :
2023-07-11 00:34:10 +03:00
addDefault = ! noDefaultPolicy
2018-09-18 06:03:00 +03:00
2016-12-16 08:36:39 +03:00
// No policies specified, inherit parent
2023-07-11 00:34:10 +03:00
case len ( policies ) == 0 :
2016-12-16 08:36:39 +03:00
// Only inherit "default" if the parent already has it, so don't touch addDefault here
2023-07-11 00:34:10 +03:00
policies = policyutil . SanitizePolicies ( parent . Policies , policyutil . DoNotAddDefaultPolicy )
2016-02-29 21:27:31 +03:00
2016-12-16 08:36:39 +03:00
// When a role is not in use or does not specify allowed/disallowed, only
// permit policies to be a subset unless the client has root or sudo
// privileges. Default is added in this case if the parent has it, unless
// the client specified for it not to be added.
2016-05-11 23:51:18 +03:00
case ! isSudo :
// Sanitize passed-in and parent policies before comparison
2023-07-11 00:34:10 +03:00
sanitizedInputPolicies := policyutil . SanitizePolicies ( policies , policyutil . DoNotAddDefaultPolicy )
2016-12-16 08:36:39 +03:00
sanitizedParentPolicies := policyutil . SanitizePolicies ( parent . Policies , policyutil . DoNotAddDefaultPolicy )
2016-05-11 23:51:18 +03:00
if ! strutil . StrListSubset ( sanitizedParentPolicies , sanitizedInputPolicies ) {
return logical . ErrorResponse ( "child policies must be subset of parent" ) , logical . ErrInvalidRequest
}
2016-12-16 08:36:39 +03:00
// If the parent has default, and they haven't requested not to get it,
// add it. Note that if they have explicitly put "default" in
// data.Policies it will still be added because NoDefaultPolicy
// controls *automatic* adding.
2023-07-11 00:34:10 +03:00
if ! noDefaultPolicy && strutil . StrListContains ( parent . Policies , "default" ) {
2016-12-16 08:36:39 +03:00
addDefault = true
}
// Add default by default in this case unless requested not to
case isSudo :
2023-07-11 00:34:10 +03:00
addDefault = ! noDefaultPolicy
2015-03-25 01:10:46 +03:00
}
2015-12-30 23:18:30 +03:00
2023-07-11 00:34:10 +03:00
te . Policies = policyutil . SanitizePolicies ( policies , addDefault )
2016-12-16 08:36:39 +03:00
// Yes, this is a little inefficient to do it like this, but meh
2023-07-11 00:34:10 +03:00
if noDefaultPolicy {
2016-12-16 08:36:39 +03:00
te . Policies = strutil . StrListDelete ( te . Policies , "default" )
}
2015-03-25 01:10:46 +03:00
2016-08-13 04:01:30 +03:00
// Prevent internal policies from being assigned to tokens
for _ , policy := range te . Policies {
if strutil . StrListContains ( nonAssignablePolicies , policy ) {
2016-09-29 07:01:28 +03:00
return logical . ErrorResponse ( fmt . Sprintf ( "cannot assign policy %q" , policy ) ) , nil
2016-08-13 04:01:30 +03:00
}
}
2018-10-15 19:56:24 +03:00
if strutil . StrListContains ( te . Policies , "root" ) {
// Prevent attempts to create a root token without an actual root token as parent.
// This is to thwart privilege escalation by tokens having 'sudo' privileges.
if ! strutil . StrListContains ( parent . Policies , "root" ) {
return logical . ErrorResponse ( "root tokens may not be created without parent token being root" ) , logical . ErrInvalidRequest
}
if te . Type == logical . TokenTypeBatch {
// Batch tokens cannot be revoked so we should never have root batch tokens
return logical . ErrorResponse ( "batch tokens cannot be root tokens" ) , nil
}
2016-08-13 04:01:30 +03:00
}
//
// NOTE: Do not modify policies below this line. We need the checks above
// to be the last checks as they must look at the final policy set.
//
2016-02-29 21:27:31 +03:00
switch {
case role != nil :
if role . Orphan {
te . Parent = ""
}
2019-06-14 17:17:04 +03:00
if len ( role . TokenBoundCIDRs ) > 0 {
te . BoundCIDRs = role . TokenBoundCIDRs
2018-04-21 17:49:16 +03:00
}
2023-07-11 00:34:10 +03:00
case d . Get ( "no_parent" ) . ( bool ) :
2016-02-29 21:27:31 +03:00
// Only allow an orphan token if the client has sudo policy
2015-09-19 02:59:06 +03:00
if ! isSudo {
return logical . ErrorResponse ( "root or sudo privileges required to create orphan token" ) ,
2015-03-25 01:10:46 +03:00
logical . ErrInvalidRequest
}
2015-04-08 00:16:35 +03:00
te . Parent = ""
2016-02-29 21:27:31 +03:00
default :
2015-11-03 23:10:46 +03:00
// This comes from create-orphan, which can be properly ACLd
if orphan {
te . Parent = ""
}
2015-03-25 01:10:46 +03:00
}
2017-10-11 20:21:20 +03:00
// At this point, it is clear whether the token is going to be an orphan or
2019-07-01 12:39:54 +03:00
// not. If setEntityID is set, the entity identifier will be overwritten.
// Otherwise, if the token is not going to be an orphan, inherit the parent's
2019-01-15 18:55:36 +03:00
// entity identifier into the child token.
2019-07-01 12:39:54 +03:00
switch {
case explicitEntityID != "" :
// Overwrite the entity identifier
te . EntityID = explicitEntityID
case te . Parent != "" :
2017-10-11 20:21:20 +03:00
te . EntityID = parent . EntityID
2019-01-15 18:55:36 +03:00
// If the parent has bound CIDRs, copy those into the child. We don't
// do this if role is not nil because then we always use the role's
// bound CIDRs; roles allow escalation of privilege in proper
// circumstances.
if role == nil {
te . BoundCIDRs = parent . BoundCIDRs
}
2017-10-11 20:21:20 +03:00
}
2018-04-03 19:20:20 +03:00
var explicitMaxTTLToUse time . Duration
2023-07-11 00:34:10 +03:00
if explicitMaxTTL != "" {
dur , err := parseutil . ParseDurationSecond ( explicitMaxTTL )
2016-06-08 21:49:48 +03:00
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
2015-03-25 01:10:46 +03:00
}
2016-06-08 21:49:48 +03:00
if dur < 0 {
return logical . ErrorResponse ( "explicit_max_ttl must be positive" ) , logical . ErrInvalidRequest
2016-02-29 21:27:31 +03:00
}
2016-06-08 21:49:48 +03:00
te . ExplicitMaxTTL = dur
2018-04-03 19:20:20 +03:00
explicitMaxTTLToUse = dur
2016-06-08 21:49:48 +03:00
}
2015-09-18 23:33:52 +03:00
2016-08-16 23:47:46 +03:00
var periodToUse time . Duration
2023-07-11 00:34:10 +03:00
if period != "" {
dur , err := parseutil . ParseDurationSecond ( period )
2016-08-13 04:01:30 +03:00
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
2018-02-01 20:01:46 +03:00
switch {
case dur < 0 :
2016-08-13 04:01:30 +03:00
return logical . ErrorResponse ( "period must be positive" ) , logical . ErrInvalidRequest
2018-02-01 20:01:46 +03:00
case dur == 0 :
default :
if ! isSudo {
return logical . ErrorResponse ( "root or sudo privileges required to create periodic token" ) ,
logical . ErrInvalidRequest
}
te . Period = dur
periodToUse = dur
2016-08-13 04:01:30 +03:00
}
}
2016-06-08 21:49:48 +03:00
// Parse the TTL/lease if any
2023-07-11 00:34:10 +03:00
if ttl := d . Get ( "ttl" ) . ( string ) ; ttl != "" {
dur , err := parseutil . ParseDurationSecond ( ttl )
2016-06-08 21:49:48 +03:00
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
if dur < 0 {
return logical . ErrorResponse ( "ttl must be positive" ) , logical . ErrInvalidRequest
}
te . TTL = dur
2023-07-11 00:34:10 +03:00
} else if lease := d . Get ( "lease" ) . ( string ) ; lease != "" {
2016-06-08 21:49:48 +03:00
// This block is compatibility
2023-07-11 00:34:10 +03:00
dur , err := parseutil . ParseDurationSecond ( lease )
2016-06-08 21:49:48 +03:00
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
if dur < 0 {
return logical . ErrorResponse ( "lease must be positive" ) , logical . ErrInvalidRequest
2016-02-29 21:27:31 +03:00
}
2016-06-08 21:49:48 +03:00
te . TTL = dur
2015-03-25 01:10:46 +03:00
}
2018-10-15 19:56:24 +03:00
// Set the lesser period/explicit max TTL if defined both in arguments and
// in role. Batch tokens will error out if not set via role, but here we
// need to explicitly check
if role != nil && te . Type != logical . TokenTypeBatch {
2019-06-14 17:17:04 +03:00
if role . TokenExplicitMaxTTL != 0 {
2016-08-13 04:01:30 +03:00
switch {
2018-04-03 19:20:20 +03:00
case explicitMaxTTLToUse == 0 :
2019-06-14 17:17:04 +03:00
explicitMaxTTLToUse = role . TokenExplicitMaxTTL
2016-08-13 04:01:30 +03:00
default :
2019-06-14 17:17:04 +03:00
if role . TokenExplicitMaxTTL < explicitMaxTTLToUse {
explicitMaxTTLToUse = role . TokenExplicitMaxTTL
2016-08-13 04:01:30 +03:00
}
2018-04-03 19:20:20 +03:00
resp . AddWarning ( fmt . Sprintf ( "Explicit max TTL specified both during creation call and in role; using the lesser value of %d seconds" , int64 ( explicitMaxTTLToUse . Seconds ( ) ) ) )
2016-08-13 04:01:30 +03:00
}
}
2019-06-14 17:17:04 +03:00
if role . TokenPeriod != 0 {
2016-08-13 04:01:30 +03:00
switch {
2016-08-16 23:47:46 +03:00
case periodToUse == 0 :
2019-06-14 17:17:04 +03:00
periodToUse = role . TokenPeriod
2016-08-13 04:01:30 +03:00
default :
2019-06-14 17:17:04 +03:00
if role . TokenPeriod < periodToUse {
periodToUse = role . TokenPeriod
2016-08-13 04:01:30 +03:00
}
2016-08-16 23:47:46 +03:00
resp . AddWarning ( fmt . Sprintf ( "Period specified both during creation call and in role; using the lesser value of %d seconds" , int64 ( periodToUse . Seconds ( ) ) ) )
2016-06-08 21:49:48 +03:00
}
}
}
2016-05-11 23:51:18 +03:00
2019-08-26 17:23:46 +03:00
sysView := ts . System ( ) . ( extendedSystemView )
2016-06-08 21:49:48 +03:00
2018-04-03 19:20:20 +03:00
// Only calculate a TTL if you are A) periodic, B) have a TTL, C) do not have a TTL and are not a root token
if periodToUse > 0 || te . TTL > 0 || ( te . TTL == 0 && ! strutil . StrListContains ( te . Policies , "root" ) ) {
ttl , warnings , err := framework . CalculateTTL ( sysView , 0 , te . TTL , periodToUse , 0 , explicitMaxTTLToUse , time . Unix ( te . CreationTime , 0 ) )
if err != nil {
return nil , err
2016-08-13 04:01:30 +03:00
}
2018-04-03 19:20:20 +03:00
for _ , warning := range warnings {
resp . AddWarning ( warning )
2016-08-13 04:01:30 +03:00
}
2018-04-03 19:20:20 +03:00
te . TTL = ttl
2016-08-13 04:01:30 +03:00
}
2018-04-03 19:20:20 +03:00
// Root tokens are still bound by explicit max TTL
if te . TTL == 0 && explicitMaxTTLToUse > 0 {
te . TTL = explicitMaxTTLToUse
2016-06-08 21:49:48 +03:00
}
2016-05-11 23:51:18 +03:00
2018-04-21 17:49:16 +03:00
// Don't advertise non-expiring root tokens as renewable, as attempts to
// renew them are denied. Don't CIDR-restrict these either.
2016-08-05 18:15:25 +03:00
if te . TTL == 0 {
2016-08-10 03:32:40 +03:00
if parent . TTL != 0 {
return logical . ErrorResponse ( "expiring root tokens cannot create non-expiring root tokens" ) , logical . ErrInvalidRequest
}
2016-08-05 18:15:25 +03:00
renewable = false
2018-04-21 17:49:16 +03:00
te . BoundCIDRs = nil
2016-08-05 18:15:25 +03:00
}
2018-10-17 23:23:04 +03:00
if te . ID != "" {
resp . AddWarning ( "Supplying a custom ID for the token uses the weaker SHA1 hashing instead of the more secure SHA2-256 HMAC for token obfuscation. SHA1 hashed tokens on the wire leads to less secure lookups." )
}
2023-01-24 22:00:27 +03:00
// check if we are perfStandby, and if so forward the service token
// creation to the active node
var roleName string
if role != nil {
roleName = role . Name
}
if te . Type == logical . TokenTypeService && ts . core . perfStandby {
forwardedTokenEntry , err := forwardCreateTokenRegisterAuth ( ctx , ts . core , & te , roleName , renewable , periodToUse , explicitMaxTTLToUse )
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , ErrInternalError
}
te = * forwardedTokenEntry
} else {
if err := ts . create ( ctx , & te ) ; err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
2016-08-08 23:44:29 +03:00
}
2020-06-02 21:40:54 +03:00
// Count the successful token creation.
ttl_label := metricsutil . TTLBucket ( te . TTL )
2020-07-14 22:28:11 +03:00
mountPointWithoutNs := ns . TrimmedPath ( req . MountPoint )
2020-06-02 21:40:54 +03:00
ts . core . metricSink . IncrCounterWithLabels (
[ ] string { "token" , "creation" } ,
1 ,
[ ] metrics . Label {
2020-10-14 02:38:21 +03:00
metricsutil . NamespaceLabel ( ns ) ,
2020-06-02 21:40:54 +03:00
{ "auth_method" , "token" } ,
2020-07-14 22:28:11 +03:00
{ "mount_point" , mountPointWithoutNs } , // path, not accessor
2020-06-02 21:40:54 +03:00
{ "creation_ttl" , ttl_label } ,
{ "token_type" , tokenType . String ( ) } ,
} ,
)
2015-03-25 01:10:46 +03:00
// Generate the response
2016-05-11 23:51:18 +03:00
resp . Auth = & logical . Auth {
2017-03-09 01:36:50 +03:00
NumUses : te . NumUses ,
2016-05-11 23:51:18 +03:00
DisplayName : te . DisplayName ,
Policies : te . Policies ,
Metadata : te . Meta ,
LeaseOptions : logical . LeaseOptions {
TTL : te . TTL ,
2016-06-08 18:14:30 +03:00
Renewable : renewable ,
2015-03-25 01:10:46 +03:00
} ,
2018-04-03 19:20:20 +03:00
ClientToken : te . ID ,
Accessor : te . Accessor ,
EntityID : te . EntityID ,
Period : periodToUse ,
ExplicitMaxTTL : explicitMaxTTLToUse ,
2018-06-04 01:14:51 +03:00
CreationPath : te . Path ,
2018-10-15 19:56:24 +03:00
TokenType : te . Type ,
2019-03-02 02:55:58 +03:00
Orphan : te . Parent == "" ,
2015-03-25 01:10:46 +03:00
}
2015-03-31 06:26:39 +03:00
2023-01-24 22:00:27 +03:00
// We have registered the auth at this point if the token is of service
// type and core is perfStandby.
if te . Type == logical . TokenTypeService && ts . core . perfStandby && te . ExternalID != "" {
resp . Auth . ClientToken = te . ExternalID
}
2018-09-18 06:03:00 +03:00
for _ , p := range te . Policies {
policy , err := ts . core . policyStore . GetPolicy ( ctx , p , PolicyTypeToken )
if err != nil {
return logical . ErrorResponse ( fmt . Sprintf ( "could not look up policy %s" , p ) ) , nil
}
if policy == nil {
resp . AddWarning ( fmt . Sprintf ( "Policy %q does not exist" , p ) )
2015-10-07 22:30:54 +03:00
}
}
2015-03-25 01:10:46 +03:00
return resp , nil
}
2015-09-17 20:22:30 +03:00
// handleRevokeSelf handles the auth/token/revoke-self path for revocation of tokens
// in a way that revokes all child tokens. Normally, using sys/revoke/leaseID will revoke
// the token and all children anyways, but that is only available when there is a lease.
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleRevokeSelf ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2018-10-15 19:56:24 +03:00
return ts . revokeCommon ( ctx , req , data , req . ClientToken )
2015-09-17 20:22:30 +03:00
}
2015-03-25 01:30:09 +03:00
// handleRevokeTree handles the auth/token/revoke/id path for revocation of tokens
2015-04-08 23:35:32 +03:00
// in a way that revokes all child tokens. Normally, using sys/revoke/leaseID will revoke
2015-03-25 01:30:09 +03:00
// the token and all children anyways, but that is only available when there is a lease.
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleRevokeTree ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2015-03-31 22:48:19 +03:00
id := data . Get ( "token" ) . ( string )
2015-03-25 01:30:09 +03:00
if id == "" {
2018-11-20 00:58:19 +03:00
return logical . ErrorResponse ( "missing token ID" ) , logical . ErrInvalidRequest
2015-03-25 01:30:09 +03:00
}
2018-10-15 19:56:24 +03:00
if resp , err := ts . revokeCommon ( ctx , req , data , id ) ; resp != nil || err != nil {
return resp , err
}
return nil , nil
}
func ( ts * TokenStore ) revokeCommon ( ctx context . Context , req * logical . Request , data * framework . FieldData , id string ) ( * logical . Response , error ) {
2018-05-10 22:50:02 +03:00
te , err := ts . Lookup ( ctx , id )
if err != nil {
return nil , err
}
if te == nil {
2018-09-18 06:03:00 +03:00
return nil , nil
2018-05-10 22:50:02 +03:00
}
2018-10-15 19:56:24 +03:00
if te . Type == logical . TokenTypeBatch {
return logical . ErrorResponse ( "batch tokens cannot be revoked" ) , nil
}
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , te . NamespaceID , ts . core )
2018-05-10 22:50:02 +03:00
if err != nil {
return nil , err
}
2018-09-18 06:03:00 +03:00
if tokenNS == nil {
return nil , namespace . ErrNoNamespace
}
2018-05-10 22:50:02 +03:00
2018-09-18 06:03:00 +03:00
revokeCtx := namespace . ContextWithNamespace ( ts . quitContext , tokenNS )
leaseID , err := ts . expiration . CreateOrFetchRevocationLeaseByToken ( revokeCtx , te )
if err != nil {
return nil , err
}
err = ts . expiration . Revoke ( revokeCtx , leaseID )
2018-05-10 22:50:02 +03:00
if err != nil {
return nil , err
2015-03-25 01:30:09 +03:00
}
2016-08-29 22:15:57 +03:00
2015-03-25 01:30:09 +03:00
return nil , nil
}
2015-03-25 01:10:46 +03:00
// handleRevokeOrphan handles the auth/token/revoke-orphan/id path for revocation of tokens
2015-04-08 23:35:32 +03:00
// in a way that leaves child tokens orphaned. Normally, using sys/revoke/leaseID will revoke
2015-03-25 01:10:46 +03:00
// the token and all children.
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleRevokeOrphan ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2015-03-25 01:30:09 +03:00
// Parse the id
2015-03-31 22:48:19 +03:00
id := data . Get ( "token" ) . ( string )
2015-03-25 01:30:09 +03:00
if id == "" {
2018-11-20 00:58:19 +03:00
return logical . ErrorResponse ( "missing token ID" ) , logical . ErrInvalidRequest
2015-03-25 01:30:09 +03:00
}
2015-09-21 17:04:03 +03:00
// Check if the client token has sudo/root privileges for the requested path
2019-08-26 17:23:46 +03:00
isSudo := ts . System ( ) . ( extendedSystemView ) . SudoPrivilege ( ctx , req . MountPoint + req . Path , req . ClientToken )
2015-09-16 16:22:15 +03:00
2015-09-19 02:59:06 +03:00
if ! isSudo {
return logical . ErrorResponse ( "root or sudo privileges required to revoke and orphan" ) ,
2015-09-16 16:22:15 +03:00
logical . ErrInvalidRequest
}
2018-09-18 06:03:00 +03:00
// Do a lookup. Among other things, that will ensure that this is either
// running in the same namespace or a parent.
te , err := ts . Lookup ( ctx , id )
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "error when looking up token to revoke: %w" , err )
2018-09-18 06:03:00 +03:00
}
if te == nil {
return logical . ErrorResponse ( "token to revoke not found" ) , logical . ErrInvalidRequest
}
2018-10-15 19:56:24 +03:00
if te . Type == logical . TokenTypeBatch {
return logical . ErrorResponse ( "batch tokens cannot be revoked" ) , nil
}
2015-03-25 01:30:09 +03:00
// Revoke and orphan
2018-05-10 22:50:02 +03:00
if err := ts . revokeOrphan ( ctx , id ) ; err != nil {
2015-03-25 01:30:09 +03:00
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
2016-08-29 22:15:57 +03:00
2015-03-20 23:54:57 +03:00
return nil , nil
}
2015-03-25 01:10:46 +03:00
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleLookupSelf ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2016-04-28 22:15:37 +03:00
data . Raw [ "token" ] = req . ClientToken
2018-01-08 21:31:38 +03:00
return ts . handleLookup ( ctx , req , data )
2016-04-28 22:15:37 +03:00
}
2015-03-25 01:39:33 +03:00
// handleLookup handles the auth/token/lookup/id path for querying information about
// a particular token. This can be used to see which policies are applicable.
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleLookup ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2015-03-31 22:48:19 +03:00
id := data . Get ( "token" ) . ( string )
2015-03-31 22:50:07 +03:00
if id == "" {
id = req . ClientToken
}
2015-03-25 01:39:33 +03:00
if id == "" {
return logical . ErrorResponse ( "missing token ID" ) , logical . ErrInvalidRequest
}
2017-03-07 19:21:32 +03:00
lock := locksutil . LockForKey ( ts . tokenLocks , id )
2016-12-16 21:11:55 +03:00
lock . RLock ( )
defer lock . RUnlock ( )
2018-09-18 06:03:00 +03:00
out , err := ts . lookupInternal ( ctx , id , false , true )
2015-03-25 01:39:33 +03:00
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
if out == nil {
2015-06-19 04:30:18 +03:00
return logical . ErrorResponse ( "bad token" ) , logical . ErrPermissionDenied
2015-03-25 01:39:33 +03:00
}
// Generate a response. We purposely omit the parent reference otherwise
2015-10-02 20:33:19 +03:00
// you could escalate your privileges.
2015-03-25 01:39:33 +03:00
resp := & logical . Response {
Data : map [ string ] interface { } {
2016-05-11 23:51:18 +03:00
"id" : out . ID ,
"accessor" : out . Accessor ,
"policies" : out . Policies ,
"path" : out . Path ,
"meta" : out . Meta ,
"display_name" : out . DisplayName ,
"num_uses" : out . NumUses ,
"orphan" : false ,
"creation_time" : int64 ( out . CreationTime ) ,
"creation_ttl" : int64 ( out . TTL . Seconds ( ) ) ,
2017-05-04 05:03:42 +03:00
"expire_time" : nil ,
2016-05-11 23:51:18 +03:00
"ttl" : int64 ( 0 ) ,
"explicit_max_ttl" : int64 ( out . ExplicitMaxTTL . Seconds ( ) ) ,
2017-10-11 20:21:20 +03:00
"entity_id" : out . EntityID ,
2018-10-15 19:56:24 +03:00
"type" : out . Type . String ( ) ,
2015-03-25 01:39:33 +03:00
} ,
}
2015-11-09 21:19:59 +03:00
if out . Parent == "" {
resp . Data [ "orphan" ] = true
}
2016-08-13 04:01:30 +03:00
if out . Role != "" {
resp . Data [ "role" ] = out . Role
2016-08-16 23:47:46 +03:00
}
2018-04-21 17:49:16 +03:00
2016-08-16 23:47:46 +03:00
if out . Period != 0 {
2016-08-13 04:01:30 +03:00
resp . Data [ "period" ] = int64 ( out . Period . Seconds ( ) )
}
2018-04-21 17:49:16 +03:00
if len ( out . BoundCIDRs ) > 0 {
resp . Data [ "bound_cidrs" ] = out . BoundCIDRs
}
2018-09-18 06:03:00 +03:00
tokenNS , err := NamespaceByID ( ctx , out . NamespaceID , ts . core )
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
if tokenNS == nil {
return nil , namespace . ErrNoNamespace
}
if out . NamespaceID != namespace . RootNamespaceID {
resp . Data [ "namespace_path" ] = tokenNS . Path
}
2016-01-05 00:43:07 +03:00
// Fetch the last renewal time
2018-09-18 06:03:00 +03:00
leaseTimes , err := ts . expiration . FetchLeaseTimesByToken ( ctx , out )
2016-01-05 00:43:07 +03:00
if err != nil {
return logical . ErrorResponse ( err . Error ( ) ) , logical . ErrInvalidRequest
}
2016-02-01 19:16:32 +03:00
if leaseTimes != nil {
if ! leaseTimes . LastRenewalTime . IsZero ( ) {
resp . Data [ "last_renewal_time" ] = leaseTimes . LastRenewalTime . Unix ( )
2017-05-04 05:03:42 +03:00
resp . Data [ "last_renewal" ] = leaseTimes . LastRenewalTime
2016-02-01 19:16:32 +03:00
}
if ! leaseTimes . ExpireTime . IsZero ( ) {
2017-05-04 05:03:42 +03:00
resp . Data [ "expire_time" ] = leaseTimes . ExpireTime
resp . Data [ "ttl" ] = leaseTimes . ttl ( )
2016-06-02 00:30:31 +03:00
}
2017-05-04 05:03:42 +03:00
renewable , _ := leaseTimes . renewable ( )
resp . Data [ "renewable" ] = renewable
resp . Data [ "issue_time" ] = leaseTimes . IssueTime
2016-01-05 00:43:07 +03:00
}
2018-04-17 18:16:26 +03:00
if out . EntityID != "" {
2021-10-07 20:36:22 +03:00
_ , identityPolicies , err := ts . core . fetchEntityAndDerivedPolicies ( ctx , tokenNS , out . EntityID , out . NoIdentityPolicies )
2018-04-17 18:16:26 +03:00
if err != nil {
return nil , err
}
if len ( identityPolicies ) != 0 {
2018-09-18 06:03:00 +03:00
resp . Data [ "identity_policies" ] = identityPolicies [ out . NamespaceID ]
delete ( identityPolicies , out . NamespaceID )
resp . Data [ "external_namespace_policies" ] = identityPolicies
2018-04-17 18:16:26 +03:00
}
}
2015-03-25 01:39:33 +03:00
return resp , nil
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleRenewSelf ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2015-10-07 19:49:13 +03:00
data . Raw [ "token" ] = req . ClientToken
2018-01-08 21:31:38 +03:00
return ts . handleRenew ( ctx , req , data )
2015-10-07 19:49:13 +03:00
}
2015-04-03 22:11:49 +03:00
// handleRenew handles the auth/token/renew/id path for renewal of tokens.
// This is used to prevent token expiration and revocation.
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) handleRenew ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2015-04-03 22:11:49 +03:00
id := data . Get ( "token" ) . ( string )
if id == "" {
2018-11-20 00:58:19 +03:00
return logical . ErrorResponse ( "missing token ID" ) , logical . ErrInvalidRequest
2015-04-03 22:11:49 +03:00
}
2015-04-10 00:23:37 +03:00
incrementRaw := data . Get ( "increment" ) . ( int )
// Convert the increment
increment := time . Duration ( incrementRaw ) * time . Second
2015-04-03 22:11:49 +03:00
// Lookup the token
2018-01-19 09:44:44 +03:00
te , err := ts . Lookup ( ctx , id )
2015-04-03 22:11:49 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "error looking up token to renew: %w" , err )
2015-04-03 22:11:49 +03:00
}
2015-12-30 22:30:02 +03:00
if te == nil {
2015-04-03 22:11:49 +03:00
return logical . ErrorResponse ( "token not found" ) , logical . ErrInvalidRequest
}
2018-10-15 19:56:24 +03:00
var resp * logical . Response
if te . Type == logical . TokenTypeBatch {
return logical . ErrorResponse ( "batch tokens cannot be renewed" ) , nil
}
2015-10-10 00:11:31 +03:00
// Renew the token and its children
2018-10-15 19:56:24 +03:00
resp , err = ts . expiration . RenewToken ( ctx , req , te , increment )
2016-08-29 22:15:57 +03:00
return resp , err
2015-04-03 22:11:49 +03:00
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) authRenew ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2016-02-29 21:27:31 +03:00
if req . Auth == nil {
return nil , fmt . Errorf ( "request auth is nil" )
}
2016-01-30 01:44:09 +03:00
2018-01-19 09:44:44 +03:00
te , err := ts . Lookup ( ctx , req . Auth . ClientToken )
2016-02-29 21:27:31 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "error looking up token: %w" , err )
2016-02-29 21:27:31 +03:00
}
if te == nil {
return nil , fmt . Errorf ( "no token entry found during lookup" )
}
if te . Role == "" {
2018-04-03 19:20:20 +03:00
req . Auth . Period = te . Period
req . Auth . ExplicitMaxTTL = te . ExplicitMaxTTL
return & logical . Response { Auth : req . Auth } , nil
2016-02-29 21:27:31 +03:00
}
2018-01-19 09:44:44 +03:00
role , err := ts . tokenStoreRole ( ctx , te . Role )
2016-02-29 21:27:31 +03:00
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "error looking up role %q: %w" , te . Role , err )
2016-02-29 21:27:31 +03:00
}
if role == nil {
2018-04-05 18:49:21 +03:00
return nil , fmt . Errorf ( "original token role %q could not be found, not renewing" , te . Role )
2016-02-29 21:27:31 +03:00
}
2019-06-14 17:17:04 +03:00
req . Auth . Period = role . TokenPeriod
req . Auth . ExplicitMaxTTL = role . TokenExplicitMaxTTL
2018-04-03 19:20:20 +03:00
return & logical . Response { Auth : req . Auth } , nil
2016-01-30 01:44:09 +03:00
}
2018-01-19 09:44:44 +03:00
func ( ts * TokenStore ) tokenStoreRole ( ctx context . Context , name string ) ( * tsRoleEntry , error ) {
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
entry , err := ts . rolesView ( ns ) . Get ( ctx , name )
2016-02-29 21:27:31 +03:00
if err != nil {
return nil , err
}
if entry == nil {
return nil , nil
}
var result tsRoleEntry
if err := entry . DecodeJSON ( & result ) ; err != nil {
return nil , err
}
2018-11-07 17:45:09 +03:00
if result . TokenType == logical . TokenTypeDefault {
result . TokenType = logical . TokenTypeDefaultService
}
2019-06-14 17:17:04 +03:00
// Token field upgrades. We preserve the original value for read
// compatibility.
if result . Period > 0 && result . TokenPeriod == 0 {
result . TokenPeriod = result . Period
}
if result . ExplicitMaxTTL > 0 && result . TokenExplicitMaxTTL == 0 {
result . TokenExplicitMaxTTL = result . ExplicitMaxTTL
}
if len ( result . BoundCIDRs ) > 0 && len ( result . TokenBoundCIDRs ) == 0 {
result . TokenBoundCIDRs = result . BoundCIDRs
}
2016-02-29 21:27:31 +03:00
return & result , nil
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) tokenStoreRoleList ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
entries , err := ts . rolesView ( ns ) . List ( ctx , "" )
2016-02-29 21:27:31 +03:00
if err != nil {
return nil , err
}
2016-02-29 22:13:09 +03:00
ret := make ( [ ] string , len ( entries ) )
for i , entry := range entries {
2016-03-01 20:33:35 +03:00
ret [ i ] = strings . TrimPrefix ( entry , rolesPrefix )
2016-02-29 22:13:09 +03:00
}
return logical . ListResponse ( ret ) , nil
2016-02-29 21:27:31 +03:00
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) tokenStoreRoleDelete ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
err = ts . rolesView ( ns ) . Delete ( ctx , data . Get ( "role_name" ) . ( string ) )
2016-02-29 21:27:31 +03:00
if err != nil {
return nil , err
}
return nil , nil
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) tokenStoreRoleRead ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2018-01-19 09:44:44 +03:00
role , err := ts . tokenStoreRole ( ctx , data . Get ( "role_name" ) . ( string ) )
2016-02-29 21:27:31 +03:00
if err != nil {
return nil , err
}
if role == nil {
return nil , nil
}
2019-06-14 17:17:04 +03:00
// TODO (1.4): Remove "period" and "explicit_max_ttl" if they're zero
2016-02-29 21:27:31 +03:00
resp := & logical . Response {
2016-05-11 23:51:18 +03:00
Data : map [ string ] interface { } {
2021-09-21 18:25:06 +03:00
"period" : int64 ( role . Period . Seconds ( ) ) ,
"token_period" : int64 ( role . TokenPeriod . Seconds ( ) ) ,
"explicit_max_ttl" : int64 ( role . ExplicitMaxTTL . Seconds ( ) ) ,
"token_explicit_max_ttl" : int64 ( role . TokenExplicitMaxTTL . Seconds ( ) ) ,
"disallowed_policies" : role . DisallowedPolicies ,
"allowed_policies" : role . AllowedPolicies ,
"disallowed_policies_glob" : role . DisallowedPoliciesGlob ,
"allowed_policies_glob" : role . AllowedPoliciesGlob ,
"name" : role . Name ,
"orphan" : role . Orphan ,
"path_suffix" : role . PathSuffix ,
"renewable" : role . Renewable ,
"token_type" : role . TokenType . String ( ) ,
"allowed_entity_aliases" : role . AllowedEntityAliases ,
2021-09-21 19:53:08 +03:00
"token_no_default_policy" : role . TokenNoDefaultPolicy ,
2016-05-11 23:51:18 +03:00
} ,
2016-04-14 13:10:22 +03:00
}
2019-06-14 17:17:04 +03:00
if len ( role . TokenBoundCIDRs ) > 0 {
resp . Data [ "token_bound_cidrs" ] = role . TokenBoundCIDRs
}
2018-04-21 17:49:16 +03:00
if len ( role . BoundCIDRs ) > 0 {
resp . Data [ "bound_cidrs" ] = role . BoundCIDRs
}
2019-06-14 17:17:04 +03:00
if role . TokenNumUses > 0 {
resp . Data [ "token_num_uses" ] = role . TokenNumUses
}
2018-04-21 17:49:16 +03:00
2016-02-29 21:27:31 +03:00
return resp , nil
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) tokenStoreRoleExistenceCheck ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( bool , error ) {
2016-03-09 19:59:54 +03:00
name := data . Get ( "role_name" ) . ( string )
if name == "" {
return false , fmt . Errorf ( "role name cannot be empty" )
}
2018-01-19 09:44:44 +03:00
role , err := ts . tokenStoreRole ( ctx , name )
2016-03-09 19:59:54 +03:00
if err != nil {
return false , err
}
return role != nil , nil
}
2018-01-08 21:31:38 +03:00
func ( ts * TokenStore ) tokenStoreRoleCreateUpdate ( ctx context . Context , req * logical . Request , data * framework . FieldData ) ( * logical . Response , error ) {
2016-02-29 21:27:31 +03:00
name := data . Get ( "role_name" ) . ( string )
if name == "" {
return logical . ErrorResponse ( "role name cannot be empty" ) , nil
}
2018-01-19 09:44:44 +03:00
entry , err := ts . tokenStoreRole ( ctx , name )
2016-03-09 19:59:54 +03:00
if err != nil {
return nil , err
}
2016-02-29 21:27:31 +03:00
2016-03-09 19:59:54 +03:00
// Due to the existence check, entry will only be nil if it's a create
// operation, so just create a new one
if entry == nil {
entry = & tsRoleEntry {
Name : name ,
2016-02-29 21:27:31 +03:00
}
}
2019-06-14 17:17:04 +03:00
// First parse fields not duplicated by the token helper
{
orphanInt , ok := data . GetOk ( "orphan" )
if ok {
entry . Orphan = orphanInt . ( bool )
} else if req . Operation == logical . CreateOperation {
entry . Orphan = data . Get ( "orphan" ) . ( bool )
}
2016-02-29 21:27:31 +03:00
2019-06-14 17:17:04 +03:00
renewableInt , ok := data . GetOk ( "renewable" )
if ok {
entry . Renewable = renewableInt . ( bool )
} else if req . Operation == logical . CreateOperation {
entry . Renewable = data . Get ( "renewable" ) . ( bool )
}
2016-06-08 22:17:22 +03:00
2019-06-14 17:17:04 +03:00
pathSuffixInt , ok := data . GetOk ( "path_suffix" )
if ok {
pathSuffix := pathSuffixInt . ( string )
switch {
case pathSuffix != "" :
matched := pathSuffixSanitize . MatchString ( pathSuffix )
if ! matched {
return logical . ErrorResponse ( fmt . Sprintf (
"given role path suffix contains invalid characters; must match %s" ,
pathSuffixSanitize . String ( ) ) ) , nil
2018-04-21 17:49:16 +03:00
}
}
2019-06-14 17:17:04 +03:00
entry . PathSuffix = pathSuffix
} else if req . Operation == logical . CreateOperation {
entry . PathSuffix = data . Get ( "path_suffix" ) . ( string )
2018-04-21 17:49:16 +03:00
}
2019-06-14 17:17:04 +03:00
if strings . Contains ( entry . PathSuffix , ".." ) {
return logical . ErrorResponse ( fmt . Sprintf ( "error registering path suffix: %s" , consts . ErrPathContainsParentReferences ) ) , nil
}
2016-05-11 23:51:18 +03:00
2019-06-14 17:17:04 +03:00
allowedPoliciesRaw , ok := data . GetOk ( "allowed_policies" )
if ok {
entry . AllowedPolicies = policyutil . SanitizePolicies ( allowedPoliciesRaw . ( [ ] string ) , policyutil . DoNotAddDefaultPolicy )
} else if req . Operation == logical . CreateOperation {
entry . AllowedPolicies = policyutil . SanitizePolicies ( data . Get ( "allowed_policies" ) . ( [ ] string ) , policyutil . DoNotAddDefaultPolicy )
}
disallowedPoliciesRaw , ok := data . GetOk ( "disallowed_policies" )
if ok {
entry . DisallowedPolicies = strutil . RemoveDuplicates ( disallowedPoliciesRaw . ( [ ] string ) , true )
} else if req . Operation == logical . CreateOperation {
entry . DisallowedPolicies = strutil . RemoveDuplicates ( data . Get ( "disallowed_policies" ) . ( [ ] string ) , true )
}
2021-09-21 18:25:06 +03:00
allowedPoliciesGlobRaw , ok := data . GetOk ( "allowed_policies_glob" )
if ok {
entry . AllowedPoliciesGlob = policyutil . SanitizePolicies ( allowedPoliciesGlobRaw . ( [ ] string ) , policyutil . DoNotAddDefaultPolicy )
} else if req . Operation == logical . CreateOperation {
entry . AllowedPoliciesGlob = policyutil . SanitizePolicies ( data . Get ( "allowed_policies_glob" ) . ( [ ] string ) , policyutil . DoNotAddDefaultPolicy )
}
disallowedPoliciesGlobRaw , ok := data . GetOk ( "disallowed_policies_glob" )
if ok {
entry . DisallowedPoliciesGlob = strutil . RemoveDuplicates ( disallowedPoliciesGlobRaw . ( [ ] string ) , true )
} else if req . Operation == logical . CreateOperation {
entry . DisallowedPoliciesGlob = strutil . RemoveDuplicates ( data . Get ( "disallowed_policies_glob" ) . ( [ ] string ) , true )
}
2016-05-11 23:51:18 +03:00
}
2019-07-03 06:29:42 +03:00
// We handle token type a bit differently than tokenutil does so we need to
// cache and handle it after
var tokenTypeStr * string
2019-07-03 07:11:51 +03:00
oldEntryTokenType := entry . TokenType
2019-07-03 06:29:42 +03:00
if tokenTypeRaw , ok := data . Raw [ "token_type" ] ; ok {
tokenTypeStr = new ( string )
2021-12-06 20:38:53 +03:00
if tokenTypeRaw == nil {
return logical . ErrorResponse ( "Invalid 'token_type' value: null" ) , nil
}
2019-07-03 06:29:42 +03:00
* tokenTypeStr = tokenTypeRaw . ( string )
delete ( data . Raw , "token_type" )
2019-07-03 07:11:51 +03:00
entry . TokenType = logical . TokenTypeDefault
2019-07-03 06:29:42 +03:00
}
2019-06-14 17:17:04 +03:00
// Next parse token fields from the helper
if err := entry . ParseTokenFields ( req , data ) ; err != nil {
2021-05-11 20:12:54 +03:00
return logical . ErrorResponse ( fmt . Errorf ( "error parsing role fields: %w" , err ) . Error ( ) ) , nil
2019-06-14 17:17:04 +03:00
}
2019-07-03 07:11:51 +03:00
entry . TokenType = oldEntryTokenType
if entry . TokenType == logical . TokenTypeDefault {
entry . TokenType = logical . TokenTypeDefaultService
2019-07-03 06:29:42 +03:00
}
if tokenTypeStr != nil {
switch * tokenTypeStr {
case "service" :
entry . TokenType = logical . TokenTypeService
case "batch" :
entry . TokenType = logical . TokenTypeBatch
case "default-service" :
entry . TokenType = logical . TokenTypeDefaultService
case "default-batch" :
entry . TokenType = logical . TokenTypeDefaultBatch
default :
return logical . ErrorResponse ( fmt . Sprintf ( "invalid 'token_type' value %q" , * tokenTypeStr ) ) , nil
}
}
2019-06-14 17:17:04 +03:00
var resp * logical . Response
// Now handle backwards compat. Prefer token_ fields over others if both
// are set. We set the original fields here so that on read of token role
// we can return the same values that were set. We clear out the Token*
// values because otherwise when we read the role back we'll read stale
// data since if they're not emptied they'll take precedence.
periodRaw , ok := data . GetOk ( "token_period" )
if ! ok {
periodRaw , ok = data . GetOk ( "period" )
if ok {
entry . Period = time . Second * time . Duration ( periodRaw . ( int ) )
2019-06-30 21:24:41 +03:00
entry . TokenPeriod = entry . Period
2019-06-14 17:17:04 +03:00
}
} else {
_ , ok = data . GetOk ( "period" )
if ok {
2016-05-11 23:51:18 +03:00
if resp == nil {
resp = & logical . Response { }
}
2019-06-14 17:17:04 +03:00
resp . AddWarning ( "Both 'token_period' and deprecated 'period' value supplied, ignoring the deprecated value" )
2016-05-11 23:51:18 +03:00
}
2019-06-14 17:17:04 +03:00
entry . Period = 0
2016-05-11 23:51:18 +03:00
}
2019-06-14 17:17:04 +03:00
boundCIDRsRaw , ok := data . GetOk ( "token_bound_cidrs" )
if ! ok {
boundCIDRsRaw , ok = data . GetOk ( "bound_cidrs" )
if ok {
boundCIDRs , err := parseutil . ParseAddrs ( boundCIDRsRaw . ( [ ] string ) )
if err != nil {
2021-05-11 20:12:54 +03:00
return logical . ErrorResponse ( fmt . Errorf ( "error parsing bound_cidrs: %w" , err ) . Error ( ) ) , nil
2016-03-09 19:59:54 +03:00
}
2019-06-14 17:17:04 +03:00
entry . BoundCIDRs = boundCIDRs
2019-06-30 21:24:41 +03:00
entry . TokenBoundCIDRs = entry . BoundCIDRs
2016-03-09 19:59:54 +03:00
}
2019-06-14 17:17:04 +03:00
} else {
_ , ok = data . GetOk ( "bound_cidrs" )
if ok {
if resp == nil {
resp = & logical . Response { }
}
resp . AddWarning ( "Both 'token_bound_cidrs' and deprecated 'bound_cidrs' value supplied, ignoring the deprecated value" )
}
entry . BoundCIDRs = nil
2017-05-12 20:52:33 +03:00
}
2019-06-14 17:17:04 +03:00
finalExplicitMaxTTL := entry . TokenExplicitMaxTTL
explicitMaxTTLRaw , ok := data . GetOk ( "token_explicit_max_ttl" )
if ! ok {
explicitMaxTTLRaw , ok = data . GetOk ( "explicit_max_ttl" )
if ok {
entry . ExplicitMaxTTL = time . Second * time . Duration ( explicitMaxTTLRaw . ( int ) )
2019-06-30 21:24:41 +03:00
entry . TokenExplicitMaxTTL = entry . ExplicitMaxTTL
2019-06-14 17:17:04 +03:00
}
finalExplicitMaxTTL = entry . ExplicitMaxTTL
} else {
_ , ok = data . GetOk ( "explicit_max_ttl" )
if ok {
if resp == nil {
resp = & logical . Response { }
}
resp . AddWarning ( "Both 'token_explicit_max_ttl' and deprecated 'explicit_max_ttl' value supplied, ignoring the deprecated value" )
}
entry . ExplicitMaxTTL = 0
2016-08-02 17:33:50 +03:00
}
2019-06-14 17:17:04 +03:00
if finalExplicitMaxTTL != 0 {
sysView := ts . System ( )
2016-08-02 17:33:50 +03:00
2019-06-14 17:17:04 +03:00
if sysView . MaxLeaseTTL ( ) != time . Duration ( 0 ) && finalExplicitMaxTTL > sysView . MaxLeaseTTL ( ) {
if resp == nil {
resp = & logical . Response { }
}
resp . AddWarning ( fmt . Sprintf (
"Given explicit max TTL of %d is greater than system/mount allowed value of %d seconds; until this is fixed attempting to create tokens against this role will result in an error" ,
int64 ( finalExplicitMaxTTL . Seconds ( ) ) , int64 ( sysView . MaxLeaseTTL ( ) . Seconds ( ) ) ) )
}
2016-02-29 21:27:31 +03:00
}
2019-06-14 17:17:04 +03:00
// no legacy version without the token_ prefix to check for
tokenNumUses , ok := data . GetOk ( "token_num_uses" )
2018-10-15 19:56:24 +03:00
if ok {
2019-06-14 17:17:04 +03:00
entry . TokenNumUses = tokenNumUses . ( int )
2018-10-15 19:56:24 +03:00
}
2019-06-14 17:17:04 +03:00
// Run validity checks on token type
2018-10-15 19:56:24 +03:00
if entry . TokenType == logical . TokenTypeBatch {
if ! entry . Orphan {
return logical . ErrorResponse ( "'token_type' cannot be 'batch' when role is set to generate non-orphan tokens" ) , nil
}
2019-06-14 17:17:04 +03:00
if entry . Period != 0 || entry . TokenPeriod != 0 {
2018-10-15 19:56:24 +03:00
return logical . ErrorResponse ( "'token_type' cannot be 'batch' when role is set to generate periodic tokens" ) , nil
}
if entry . Renewable {
return logical . ErrorResponse ( "'token_type' cannot be 'batch' when role is set to generate renewable tokens" ) , nil
}
2019-06-14 17:17:04 +03:00
if entry . ExplicitMaxTTL != 0 || entry . TokenExplicitMaxTTL != 0 {
2018-10-15 19:56:24 +03:00
return logical . ErrorResponse ( "'token_type' cannot be 'batch' when role is set to generate tokens with an explicit max TTL" ) , nil
}
}
2019-07-01 12:39:54 +03:00
allowedEntityAliasesRaw , ok := data . GetOk ( "allowed_entity_aliases" )
if ok {
entry . AllowedEntityAliases = strutil . RemoveDuplicates ( allowedEntityAliasesRaw . ( [ ] string ) , true )
}
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
2016-02-29 21:27:31 +03:00
// Store it
2018-09-18 06:03:00 +03:00
jsonEntry , err := logical . StorageEntryJSON ( name , entry )
2016-02-29 21:27:31 +03:00
if err != nil {
return nil , err
}
2018-09-18 06:03:00 +03:00
if err := ts . rolesView ( ns ) . Put ( ctx , jsonEntry ) ; err != nil {
2016-02-29 21:27:31 +03:00
return nil , err
}
2016-05-11 23:51:18 +03:00
return resp , nil
2016-02-29 21:27:31 +03:00
}
2020-06-24 02:36:24 +03:00
func suppressRestoreModeError ( err error ) error {
if err != nil {
if strings . Contains ( err . Error ( ) , ErrInRestoreMode . Error ( ) ) {
return nil
}
}
return err
}
2020-06-16 02:54:36 +03:00
// gaugeCollector is responsible for counting the number of tokens by
// namespace. Separate versions cover the other two counts; this is somewhat
// less efficient than doing just one pass over the tokens and can
// be fixed later.
func ( ts * TokenStore ) gaugeCollector ( ctx context . Context ) ( [ ] metricsutil . GaugeLabelValues , error ) {
if ts . expiration == nil {
return [ ] metricsutil . GaugeLabelValues { } , errors . New ( "expiration manager is nil" )
}
allNamespaces := ts . core . collectNamespaces ( )
values := make ( [ ] metricsutil . GaugeLabelValues , len ( allNamespaces ) )
namespacePosition := make ( map [ string ] int )
// If we increment the float32 value by 1.0 each time, then we cap out
// at around 16 million. So, we should keep a separate integer array
// to potentially handle a larger number of tokens.
intValues := make ( [ ] int , len ( allNamespaces ) )
for i , ns := range allNamespaces {
2020-10-14 02:38:21 +03:00
values [ i ] . Labels = [ ] metrics . Label { metricsutil . NamespaceLabel ( ns ) }
2020-06-16 02:54:36 +03:00
namespacePosition [ ns . ID ] = i
}
2020-06-24 02:36:24 +03:00
err := ts . expiration . WalkTokens ( func ( leaseID string , auth * logical . Auth , path string ) bool {
2020-06-16 02:54:36 +03:00
select {
// Abort and return empty collection if it's taking too much time, nonblocking check.
case <- ctx . Done ( ) :
return false
default :
_ , nsID := namespace . SplitIDFromString ( leaseID )
if nsID == "" {
nsID = namespace . RootNamespaceID
}
// A new namespace could be created while
// we're counting, ignore it until the next iteration.
pos , ok := namespacePosition [ nsID ]
if ok {
intValues [ pos ] += 1
}
return true
}
} )
2020-06-24 02:36:24 +03:00
if err != nil {
return [ ] metricsutil . GaugeLabelValues { } , suppressRestoreModeError ( err )
}
2020-06-16 02:54:36 +03:00
// If collection was cancelled, return an empty array.
select {
case <- ctx . Done ( ) :
return [ ] metricsutil . GaugeLabelValues { } , nil
2020-06-24 02:36:24 +03:00
default :
break
2020-06-16 02:54:36 +03:00
}
for i := range values {
values [ i ] . Value = float32 ( intValues [ i ] )
}
return values , nil
}
2020-06-24 02:36:24 +03:00
func ( ts * TokenStore ) gaugeCollectorByPolicy ( ctx context . Context ) ( [ ] metricsutil . GaugeLabelValues , error ) {
if ts . expiration == nil {
return [ ] metricsutil . GaugeLabelValues { } , errors . New ( "expiration manager is nil" )
}
allNamespaces := ts . core . collectNamespaces ( )
byNsAndPolicy := make ( map [ string ] map [ string ] int )
err := ts . expiration . WalkTokens ( func ( leaseID string , auth * logical . Auth , path string ) bool {
select {
// Abort and return empty collection if it's taking too much time, nonblocking check.
case <- ctx . Done ( ) :
return false
default :
_ , nsID := namespace . SplitIDFromString ( leaseID )
if nsID == "" {
nsID = namespace . RootNamespaceID
}
policyMap , ok := byNsAndPolicy [ nsID ]
if ! ok {
policyMap = make ( map [ string ] int )
byNsAndPolicy [ nsID ] = policyMap
}
for _ , policy := range auth . Policies {
policyMap [ policy ] = policyMap [ policy ] + 1
}
return true
}
} )
if err != nil {
return [ ] metricsutil . GaugeLabelValues { } , suppressRestoreModeError ( err )
}
// If collection was cancelled, return an empty array.
select {
case <- ctx . Done ( ) :
return [ ] metricsutil . GaugeLabelValues { } , nil
default :
break
}
// TODO: can we estimate the needed size?
flattenedResults := make ( [ ] metricsutil . GaugeLabelValues , 0 )
for _ , ns := range allNamespaces {
for policy , count := range byNsAndPolicy [ ns . ID ] {
flattenedResults = append ( flattenedResults ,
metricsutil . GaugeLabelValues {
Labels : [ ] metrics . Label {
2020-10-14 02:38:21 +03:00
metricsutil . NamespaceLabel ( ns ) ,
2020-06-24 02:36:24 +03:00
{ "policy" , policy } ,
} ,
Value : float32 ( count ) ,
} )
}
}
return flattenedResults , nil
}
func ( ts * TokenStore ) gaugeCollectorByTtl ( ctx context . Context ) ( [ ] metricsutil . GaugeLabelValues , error ) {
if ts . expiration == nil {
return [ ] metricsutil . GaugeLabelValues { } , errors . New ( "expiration manager is nil" )
}
allNamespaces := ts . core . collectNamespaces ( )
byNsAndBucket := make ( map [ string ] map [ string ] int )
err := ts . expiration . WalkTokens ( func ( leaseID string , auth * logical . Auth , path string ) bool {
select {
// Abort and return empty collection if it's taking too much time, nonblocking check.
case <- ctx . Done ( ) :
return false
default :
if auth == nil {
return true
}
_ , nsID := namespace . SplitIDFromString ( leaseID )
if nsID == "" {
nsID = namespace . RootNamespaceID
}
bucketMap , ok := byNsAndBucket [ nsID ]
if ! ok {
bucketMap = make ( map [ string ] int )
byNsAndBucket [ nsID ] = bucketMap
}
bucket := metricsutil . TTLBucket ( auth . TTL )
// Zero is a special value in this context
if auth . TTL == time . Duration ( 0 ) {
bucket = metricsutil . OverflowBucket
}
bucketMap [ bucket ] = bucketMap [ bucket ] + 1
return true
}
} )
if err != nil {
return [ ] metricsutil . GaugeLabelValues { } , suppressRestoreModeError ( err )
}
// If collection was cancelled, return an empty array.
select {
case <- ctx . Done ( ) :
return [ ] metricsutil . GaugeLabelValues { } , nil
default :
break
}
// 10 different time buckets, at the moment, though many should
// be unused.
flattenedResults := make ( [ ] metricsutil . GaugeLabelValues , 0 , len ( allNamespaces ) * 10 )
for _ , ns := range allNamespaces {
for bucket , count := range byNsAndBucket [ ns . ID ] {
flattenedResults = append ( flattenedResults ,
metricsutil . GaugeLabelValues {
Labels : [ ] metrics . Label {
2020-10-14 02:38:21 +03:00
metricsutil . NamespaceLabel ( ns ) ,
2020-06-24 02:36:24 +03:00
{ "creation_ttl" , bucket } ,
} ,
Value : float32 ( count ) ,
} )
}
}
return flattenedResults , nil
}
func ( ts * TokenStore ) gaugeCollectorByMethod ( ctx context . Context ) ( [ ] metricsutil . GaugeLabelValues , error ) {
if ts . expiration == nil {
return [ ] metricsutil . GaugeLabelValues { } , errors . New ( "expiration manager is nil" )
}
rootContext := namespace . RootContext ( ctx )
allNamespaces := ts . core . collectNamespaces ( )
byNsAndMethod := make ( map [ string ] map [ string ] int )
// Cache the prefixes that we find locally rather than
// hitting the shared mount table every time
prefixTree := radix . New ( )
pathToPrefix := func ( nsID string , path string ) string {
ns , err := NamespaceByID ( rootContext , nsID , ts . core )
if ns == nil || err != nil {
return "unknown"
}
ctx := namespace . ContextWithNamespace ( rootContext , ns )
key := ns . Path + path
_ , method , ok := prefixTree . LongestPrefix ( key )
if ok {
return method . ( string )
}
// Look up the path from the lease within the correct namespace
// Need to hold stateLock while accessing the router.
ts . core . stateLock . RLock ( )
defer ts . core . stateLock . RUnlock ( )
mountEntry := ts . core . router . MatchingMountEntry ( ctx , path )
if mountEntry == nil {
return "unknown"
}
// mountEntry.Path lacks the "auth/" prefix; perhaps we should
// refactor router to provide a method that returns both the matching
2024-03-14 12:37:10 +03:00
// path *and* the mount entry?
2020-06-24 02:36:24 +03:00
// Or we could just always add "auth/"?
matchingMount := ts . core . router . MatchingMount ( ctx , path )
if matchingMount == "" {
// Shouldn't happen, but a race is possible?
return mountEntry . Type
}
key = ns . Path + matchingMount
prefixTree . Insert ( key , mountEntry . Type )
return mountEntry . Type
}
err := ts . expiration . WalkTokens ( func ( leaseID string , auth * logical . Auth , path string ) bool {
select {
// Abort and return empty collection if it's taking too much time, nonblocking check.
case <- ctx . Done ( ) :
return false
default :
_ , nsID := namespace . SplitIDFromString ( leaseID )
if nsID == "" {
nsID = namespace . RootNamespaceID
}
methodMap , ok := byNsAndMethod [ nsID ]
if ! ok {
methodMap = make ( map [ string ] int )
byNsAndMethod [ nsID ] = methodMap
}
method := pathToPrefix ( nsID , path )
methodMap [ method ] = methodMap [ method ] + 1
return true
}
} )
if err != nil {
return [ ] metricsutil . GaugeLabelValues { } , suppressRestoreModeError ( err )
}
// If collection was cancelled, return an empty array.
select {
case <- ctx . Done ( ) :
return [ ] metricsutil . GaugeLabelValues { } , nil
default :
break
}
// TODO: how can we estimate the needed size?
flattenedResults := make ( [ ] metricsutil . GaugeLabelValues , 0 )
for _ , ns := range allNamespaces {
for method , count := range byNsAndMethod [ ns . ID ] {
flattenedResults = append ( flattenedResults ,
metricsutil . GaugeLabelValues {
Labels : [ ] metrics . Label {
2020-10-14 02:38:21 +03:00
metricsutil . NamespaceLabel ( ns ) ,
2020-06-24 02:36:24 +03:00
{ "auth_method" , method } ,
} ,
Value : float32 ( count ) ,
} )
}
}
return flattenedResults , nil
}
2015-03-25 01:10:46 +03:00
const (
2016-12-16 23:29:27 +03:00
tokenTidyHelp = `
This endpoint performs cleanup tasks that can be run if certain error
conditions have occurred .
`
tokenTidyDesc = `
This endpoint performs cleanup tasks that can be run to clean up token and
lease entries after certain error conditions . Usually running this is not
necessary , and is only required if upgrade notes or support personnel suggest
it .
`
2015-03-25 01:10:46 +03:00
tokenBackendHelp = ` The token credential backend is always enabled and builtin to Vault .
Client tokens are used to identify a client and to allow Vault to associate policies and ACLs
which are enforced on every request . This backend also allows for generating sub - tokens as well
2015-09-12 04:08:32 +03:00
as revocation of tokens . The tokens are renewable if associated with a lease . `
2016-03-03 19:04:05 +03:00
tokenCreateHelp = ` The token create path is used to create new tokens. `
tokenCreateOrphanHelp = ` The token create path is used to create new orphan tokens. `
tokenCreateRoleHelp = ` This token create path is used to create new tokens adhering to the given role. `
tokenListRolesHelp = ` This endpoint lists configured roles. `
2016-03-10 01:23:34 +03:00
tokenLookupAccessorHelp = ` This endpoint will lookup a token associated with the given accessor and its properties. Response will not contain the token ID. `
2019-11-08 19:32:01 +03:00
tokenRenewAccessorHelp = ` This endpoint will renew a token associated with the given accessor and its properties. Response will not contain the token ID. `
2016-03-03 19:04:05 +03:00
tokenLookupHelp = ` This endpoint will lookup a token and its properties. `
tokenPathRolesHelp = ` This endpoint allows creating, reading, and deleting roles. `
2016-03-10 01:23:34 +03:00
tokenRevokeAccessorHelp = ` This endpoint will delete the token associated with the accessor and all of its child tokens. `
2016-03-03 19:04:05 +03:00
tokenRevokeHelp = ` This endpoint will delete the given token and all of its child tokens. `
tokenRevokeSelfHelp = ` This endpoint will delete the token used to call it and all of its child tokens. `
tokenRevokeOrphanHelp = ` This endpoint will delete the token and orphan its child tokens. `
tokenRenewHelp = ` This endpoint will renew the given token and prevent expiration. `
tokenRenewSelfHelp = ` This endpoint will renew the token used to call it and prevent expiration. `
2016-08-02 23:33:22 +03:00
tokenAllowedPoliciesHelp = ` If set , tokens can be created with any subset of the policies in this
list , rather than the normal semantics of tokens being a subset of the
calling token ' s policies . The parameter is a comma - delimited string of
2016-12-16 08:36:39 +03:00
policy names . `
2016-08-02 23:33:22 +03:00
tokenDisallowedPoliciesHelp = ` If set , successful token creation via this role will require that
2016-12-16 08:36:39 +03:00
no policies in the given list are requested . The parameter is a comma - delimited string of policy names . `
2021-09-21 18:25:06 +03:00
tokenAllowedPoliciesGlobHelp = ` If set , tokens can be created with any subset of glob matched policies in this
list , rather than the normal semantics of tokens being a subset of the
calling token ' s policies . The parameter is a comma - delimited string of
policy name globs . `
tokenDisallowedPoliciesGlobHelp = ` If set , successful token creation via this role will require that
no requested policies glob match any of policies in this list .
The parameter is a comma - delimited string of policy name globs . `
2016-03-07 18:07:04 +03:00
tokenOrphanHelp = ` If true , tokens created via this role
will be orphan tokens ( have no parent ) `
2016-03-03 19:04:05 +03:00
tokenPeriodHelp = ` If set , tokens created via this role
will have no max lifetime ; instead , their
renewal period will be fixed to this value .
This takes an integer number of seconds ,
or a string duration ( e . g . "24h" ) . `
tokenPathSuffixHelp = ` If set , tokens created via this role
will contain the given suffix as a part of
their path . This can be used to assist use
of the ' revoke - prefix ' endpoint later on .
The given suffix must match the regular
2016-05-11 23:51:18 +03:00
expression . `
tokenExplicitMaxTTLHelp = ` If set , tokens created via this role
carry an explicit maximum TTL . During renewal ,
the current maximum TTL values of the role
and the mount are not checked for changes ,
and any updates to these values will have
no effect on the token being renewed . `
2016-06-08 22:17:22 +03:00
tokenRenewableHelp = ` Tokens created via this role will be
renewable or not according to this value .
Defaults to "true" . `
2016-08-01 20:07:41 +03:00
tokenListAccessorsHelp = ` List token accessors , which can then be
2018-03-20 21:54:10 +03:00
be used to iterate and discover their properties
2016-08-01 20:07:41 +03:00
or revoke them . Because this can be used to
cause a denial of service , this endpoint
requires ' sudo ' capability in addition to
' list ' . `
2015-03-25 01:10:46 +03:00
)