2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2021-10-14 19:10:59 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"encoding/json"
|
|
|
|
"fmt"
|
2022-02-17 22:43:07 +03:00
|
|
|
"strings"
|
2021-10-14 19:10:59 +03:00
|
|
|
"time"
|
|
|
|
|
2022-12-14 21:06:33 +03:00
|
|
|
semver "github.com/hashicorp/go-version"
|
2022-02-17 22:43:07 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
2021-10-14 19:10:59 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2022-12-14 21:06:33 +03:00
|
|
|
"github.com/hashicorp/vault/version"
|
2021-10-14 19:10:59 +03:00
|
|
|
)
|
|
|
|
|
2022-02-17 22:43:07 +03:00
|
|
|
const (
|
|
|
|
vaultVersionPath string = "core/versions/"
|
|
|
|
)
|
2021-10-14 19:10:59 +03:00
|
|
|
|
2022-04-19 21:28:08 +03:00
|
|
|
// storeVersionEntry will store the version, timestamp, and build date to storage
|
2022-02-14 23:26:57 +03:00
|
|
|
// only if no entry for that version already exists in storage. Version
|
|
|
|
// timestamps were initially stored in local time. UTC should be used. Existing
|
|
|
|
// entries can be overwritten via the force flag. A bool will be returned
|
|
|
|
// denoting whether the entry was updated
|
2022-04-19 21:28:08 +03:00
|
|
|
func (c *Core) storeVersionEntry(ctx context.Context, vaultVersion *VaultVersion, force bool) (bool, error) {
|
|
|
|
key := vaultVersionPath + vaultVersion.Version
|
2022-02-14 23:26:57 +03:00
|
|
|
|
2022-04-19 21:28:08 +03:00
|
|
|
if vaultVersion.TimestampInstalled.Location() != time.UTC {
|
|
|
|
vaultVersion.TimestampInstalled = vaultVersion.TimestampInstalled.UTC()
|
2022-02-14 23:26:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
marshalledVaultVersion, err := json.Marshal(vaultVersion)
|
2021-10-14 19:10:59 +03:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
2022-02-14 23:26:57 +03:00
|
|
|
newEntry := &logical.StorageEntry{
|
|
|
|
Key: key,
|
|
|
|
Value: marshalledVaultVersion,
|
2021-10-14 19:10:59 +03:00
|
|
|
}
|
|
|
|
|
2022-02-14 23:26:57 +03:00
|
|
|
if force {
|
|
|
|
// avoid storage lookup and write immediately
|
|
|
|
err = c.barrier.Put(ctx, newEntry)
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
existingEntry, err := c.barrier.Get(ctx, key)
|
2021-10-14 19:10:59 +03:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
2022-02-14 23:26:57 +03:00
|
|
|
if existingEntry != nil {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
err = c.barrier.Put(ctx, newEntry)
|
2021-10-14 19:10:59 +03:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
2022-02-14 23:26:57 +03:00
|
|
|
|
2021-10-14 19:10:59 +03:00
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// FindOldestVersionTimestamp searches for the vault version with the oldest
|
2022-02-14 23:26:57 +03:00
|
|
|
// upgrade timestamp from storage. The earliest version this can be is 1.9.0.
|
2021-10-14 19:10:59 +03:00
|
|
|
func (c *Core) FindOldestVersionTimestamp() (string, time.Time, error) {
|
2022-04-19 21:28:08 +03:00
|
|
|
if c.versionHistory == nil {
|
|
|
|
return "", time.Time{}, fmt.Errorf("version history is not initialized")
|
2021-10-14 19:10:59 +03:00
|
|
|
}
|
|
|
|
|
2022-02-14 23:26:57 +03:00
|
|
|
oldestUpgradeTime := time.Now().UTC()
|
2021-10-14 19:10:59 +03:00
|
|
|
var oldestVersion string
|
2022-02-14 23:26:57 +03:00
|
|
|
|
2022-04-19 21:28:08 +03:00
|
|
|
for versionStr, versionEntry := range c.versionHistory {
|
|
|
|
if versionEntry.TimestampInstalled.Before(oldestUpgradeTime) {
|
|
|
|
oldestVersion = versionStr
|
|
|
|
oldestUpgradeTime = versionEntry.TimestampInstalled
|
2021-10-14 19:10:59 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return oldestVersion, oldestUpgradeTime, nil
|
|
|
|
}
|
|
|
|
|
2022-03-05 01:16:51 +03:00
|
|
|
func (c *Core) FindNewestVersionTimestamp() (string, time.Time, error) {
|
2022-04-19 21:28:08 +03:00
|
|
|
if c.versionHistory == nil {
|
|
|
|
return "", time.Time{}, fmt.Errorf("version history is not initialized")
|
2022-03-05 01:16:51 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
var newestUpgradeTime time.Time
|
|
|
|
var newestVersion string
|
|
|
|
|
2022-04-19 21:28:08 +03:00
|
|
|
for versionStr, versionEntry := range c.versionHistory {
|
|
|
|
if versionEntry.TimestampInstalled.After(newestUpgradeTime) {
|
|
|
|
newestVersion = versionStr
|
|
|
|
newestUpgradeTime = versionEntry.TimestampInstalled
|
2022-03-05 01:16:51 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return newestVersion, newestUpgradeTime, nil
|
|
|
|
}
|
|
|
|
|
2022-04-19 21:28:08 +03:00
|
|
|
// loadVersionHistory loads all the vault versions entries from storage.
|
|
|
|
// Version timestamps were originally stored in local time. A timestamp
|
|
|
|
// that is not in UTC will be rewritten to storage as UTC.
|
|
|
|
func (c *Core) loadVersionHistory(ctx context.Context) error {
|
2021-10-14 19:10:59 +03:00
|
|
|
vaultVersions, err := c.barrier.List(ctx, vaultVersionPath)
|
|
|
|
if err != nil {
|
2022-02-14 23:26:57 +03:00
|
|
|
return fmt.Errorf("unable to retrieve vault versions from storage: %w", err)
|
2021-10-14 19:10:59 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, versionPath := range vaultVersions {
|
|
|
|
version, err := c.barrier.Get(ctx, vaultVersionPath+versionPath)
|
|
|
|
if err != nil {
|
2022-02-14 23:26:57 +03:00
|
|
|
return fmt.Errorf("unable to read vault version at path %s: err %w", versionPath, err)
|
2021-10-14 19:10:59 +03:00
|
|
|
}
|
|
|
|
if version == nil {
|
|
|
|
return fmt.Errorf("nil version stored at path %s", versionPath)
|
|
|
|
}
|
|
|
|
var vaultVersion VaultVersion
|
|
|
|
err = json.Unmarshal(version.Value, &vaultVersion)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("unable to unmarshal vault version for path %s: err %w", versionPath, err)
|
|
|
|
}
|
|
|
|
if vaultVersion.Version == "" || vaultVersion.TimestampInstalled.IsZero() {
|
|
|
|
return fmt.Errorf("found empty serialized vault version at path %s", versionPath)
|
|
|
|
}
|
2022-02-14 23:26:57 +03:00
|
|
|
|
|
|
|
// self-heal entries that were not stored in UTC
|
2022-04-19 21:28:08 +03:00
|
|
|
if vaultVersion.TimestampInstalled.Location() != time.UTC {
|
|
|
|
vaultVersion.TimestampInstalled = vaultVersion.TimestampInstalled.UTC()
|
|
|
|
|
|
|
|
isUpdated, err := c.storeVersionEntry(ctx, &vaultVersion, true)
|
2022-02-14 23:26:57 +03:00
|
|
|
if err != nil {
|
|
|
|
c.logger.Warn("failed to rewrite vault version timestamp as UTC", "error", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if isUpdated {
|
|
|
|
c.logger.Info("self-healed pre-existing vault version in UTC",
|
2022-04-19 21:28:08 +03:00
|
|
|
"vault version", vaultVersion.Version, "UTC time", vaultVersion.TimestampInstalled)
|
2022-02-14 23:26:57 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-04-19 21:28:08 +03:00
|
|
|
c.versionHistory[vaultVersion.Version] = vaultVersion
|
2021-10-14 19:10:59 +03:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2022-02-17 22:43:07 +03:00
|
|
|
|
2022-12-14 21:06:33 +03:00
|
|
|
// isMajorVersionFirstMount checks the current running version of Vault against
|
|
|
|
// the newest version in the version store to see if this major version has
|
|
|
|
// already been mounted.
|
|
|
|
func (c *Core) isMajorVersionFirstMount(ctx context.Context) bool {
|
|
|
|
// Grab the most recent previous version from the version store
|
|
|
|
prevMounted, _, err := c.FindNewestVersionTimestamp()
|
|
|
|
if err != nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get versions into comparable form. Errors should be treated as the first
|
|
|
|
// unseal with this major version.
|
|
|
|
prev, err := semver.NewSemver(prevMounted)
|
|
|
|
if err != nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
curr, err := semver.NewSemver(version.Version)
|
|
|
|
if err != nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check for milestone or major version upgrade
|
|
|
|
isMilestoneUpdate := curr.Segments()[0] > prev.Segments()[0]
|
|
|
|
isMajorVersionUpdate := curr.Segments()[1] > prev.Segments()[1]
|
|
|
|
|
|
|
|
return isMilestoneUpdate || isMajorVersionUpdate
|
|
|
|
}
|
|
|
|
|
2022-02-17 22:43:07 +03:00
|
|
|
func IsJWT(token string) bool {
|
|
|
|
return len(token) > 3 && strings.Count(token, ".") == 2 &&
|
|
|
|
(token[3] != '.' && token[1] != '.')
|
|
|
|
}
|
|
|
|
|
|
|
|
func IsSSCToken(token string) bool {
|
|
|
|
return len(token) > MaxNsIdLength+TokenLength+TokenPrefixLength &&
|
|
|
|
strings.HasPrefix(token, consts.ServiceTokenPrefix)
|
|
|
|
}
|
|
|
|
|
|
|
|
func IsServiceToken(token string) bool {
|
|
|
|
return strings.HasPrefix(token, consts.ServiceTokenPrefix) ||
|
|
|
|
strings.HasPrefix(token, consts.LegacyServiceTokenPrefix)
|
|
|
|
}
|
|
|
|
|
|
|
|
func IsBatchToken(token string) bool {
|
|
|
|
return strings.HasPrefix(token, consts.LegacyBatchTokenPrefix) ||
|
|
|
|
strings.HasPrefix(token, consts.BatchTokenPrefix)
|
|
|
|
}
|