Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make sys/wrapping/lookup unauthenticated. #3084

Merged
merged 1 commit into from
Jul 31, 2017
Merged

Make sys/wrapping/lookup unauthenticated. #3084

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions vault/logical_system.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ func NewSystemBackend(core *Core) *SystemBackend {
},

Unauthenticated: []string{
"wrapping/lookup",
"wrapping/pubkey",
"replication/status",
},
Expand Down Expand Up @@ -725,6 +726,7 @@ func NewSystemBackend(core *Core) *SystemBackend {

Callbacks: map[logical.Operation]framework.OperationFunc{
logical.UpdateOperation: b.handleWrappingLookup,
logical.ReadOperation: b.handleWrappingLookup,
},

HelpSynopsis: strings.TrimSpace(sysHelp["wraplookup"][0]),
Expand Down Expand Up @@ -2171,10 +2173,14 @@ func (b *SystemBackend) handleWrappingUnwrap(

func (b *SystemBackend) handleWrappingLookup(
req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
// This ordering of lookups has been validated already in the wrapping
// validation func, we're just doing this for a safety check
token := data.Get("token").(string)

if token == "" {
return logical.ErrorResponse("missing \"token\" value in input"), logical.ErrInvalidRequest
token = req.ClientToken
if token == "" {
return logical.ErrorResponse("missing \"token\" value in input"), logical.ErrInvalidRequest
}
}

cubbyReq := &logical.Request{
Expand Down
4 changes: 1 addition & 3 deletions vault/policy_store.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,7 @@ const (
responseWrappingPolicyName = "response-wrapping"

// responseWrappingPolicy is the policy that ensures cubbyhole response
// wrapping can always succeed. Note that sys/wrapping/lookup isn't
// contained here because using it would revoke the token anyways, so there
// isn't much point.
// wrapping can always succeed.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add sys/wrapping/lookup to this policy now?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You don't need it! Because it's unauthenticated.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doh!

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The wrapping validation function tests the validity of the token itself, but we then bypass the policy checks because it's an unauth endpoint. That's how we get around the use count decrementing.

We could make it an auth endpoint and add that policy but then we need to hard code exclusions from use count decrementing. Which doesn't seem great either.

responseWrappingPolicy = `
path "cubbyhole/response" {
capabilities = ["create", "read"]
Expand Down