Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make the plugin catalog endpoint roundtrip so we can use terraform to manage them. #3778

Merged
merged 3 commits into from
Jan 18, 2018
Merged

Make the plugin catalog endpoint roundtrip so we can use terraform to manage them. #3778

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9bab690
Make the plugin catalog endpoint roundtrip so we can use terraform to…
tomwilkie Jan 12, 2018
3bb07a1
Review feedback: Add bounds check.
tomwilkie Jan 12, 2018
55f6f8b
Review feedback.
tomwilkie Jan 17, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 29 additions & 4 deletions vault/logical_system.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,12 @@ import (
"errors"
"fmt"
"hash"
"path/filepath"
"strconv"
"strings"
"sync"
"time"

"github.com/fatih/structs"
uuid "github.com/hashicorp/go-uuid"
"github.com/hashicorp/vault/helper/consts"
"github.com/hashicorp/vault/helper/parseutil"
Expand Down Expand Up @@ -860,6 +860,10 @@ func NewSystemBackend(core *Core) *SystemBackend {
Type: framework.TypeString,
Description: strings.TrimSpace(sysHelp["plugin-catalog_command"][0]),
},
"args": &framework.FieldSchema{
Type: framework.TypeStringSlice,
Description: strings.TrimSpace(sysHelp["plugin-catalog_args"][0]),
},
},

Callbacks: map[logical.Operation]framework.OperationFunc{
Expand Down Expand Up @@ -1098,12 +1102,20 @@ func (b *SystemBackend) handlePluginCatalogUpdate(ctx context.Context, req *logi
return logical.ErrorResponse("missing command value"), nil
}

args := d.Get("args").([]string)
// For backwards compatibility, also accept args as part of command.
parts := strings.Split(command, " ")
if len(parts) <= 0 {
return logical.ErrorResponse("missing command value"), nil
}
args = append(parts[1:], args...)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do a length check before this line to make sure the command actually has more than one value...otherwise it'll panic.

Copy link
Contributor Author

@tomwilkie tomwilkie Jan 12, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Length >0 is assured by the check for the empty string above (as with the previous iteration of the code). But I'll add it anyway :-)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If they specify both args and put args in the command they'll end up with doubled args here. I think a better check would be to ensure that len(parts) == 1 and if args is set and the length of parts is not 1, throw an error asking them to pick one or the other.


sha256Bytes, err := hex.DecodeString(sha256)
if err != nil {
return logical.ErrorResponse("Could not decode SHA-256 value from Hex"), err
}

err = b.Core.pluginCatalog.Set(pluginName, command, sha256Bytes)
err = b.Core.pluginCatalog.Set(pluginName, parts[0], args, sha256Bytes)
if err != nil {
return nil, err
}
Expand All @@ -1124,8 +1136,17 @@ func (b *SystemBackend) handlePluginCatalogRead(ctx context.Context, req *logica
return nil, nil
}

// Create a map of data to be returned and remove sensitive information from it
data := structs.New(plugin).Map()
command, err := filepath.Rel(b.Core.pluginCatalog.directory, plugin.Command)
if err != nil {
return nil, err
}

data := map[string]interface{}{
"name": plugin.Name,
"args": plugin.Args,
"command": command,
"sha256": hex.EncodeToString(plugin.Sha256),
}

return &logical.Response{
Data: data,
Expand Down Expand Up @@ -3332,6 +3353,10 @@ executable defined in this command must exist in vault's
plugin directory.`,
"",
},
"plugin-catalog_args": {
`The args passed to plugin command.`,
"",
},
"leases": {
`View or list lease metadata.`,
`
Expand Down
10 changes: 4 additions & 6 deletions vault/plugin_catalog.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ func (c *PluginCatalog) Get(name string) (*pluginutil.PluginRunner, error) {

// Set registers a new external plugin with the catalog, or updates an existing
// external plugin. It takes the name, command and SHA256 of the plugin.
func (c *PluginCatalog) Set(name, command string, sha256 []byte) error {
func (c *PluginCatalog) Set(name, command string, args []string, sha256 []byte) error {
if c.directory == "" {
return ErrDirectoryNotConfigured
}
Expand All @@ -100,11 +100,9 @@ func (c *PluginCatalog) Set(name, command string, sha256 []byte) error {
c.lock.Lock()
defer c.lock.Unlock()

parts := strings.Split(command, " ")

// Best effort check to make sure the command isn't breaking out of the
// configured plugin directory.
commandFull := filepath.Join(c.directory, parts[0])
commandFull := filepath.Join(c.directory, command)
sym, err := filepath.EvalSymlinks(commandFull)
if err != nil {
return fmt.Errorf("error while validating the command path: %v", err)
Expand All @@ -120,8 +118,8 @@ func (c *PluginCatalog) Set(name, command string, sha256 []byte) error {

entry := &pluginutil.PluginRunner{
Name: name,
Command: parts[0],
Args: parts[1:],
Command: command,
Args: args,
Sha256: sha256,
Builtin: false,
}
Expand Down
10 changes: 5 additions & 5 deletions vault/plugin_catalog_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,8 +50,8 @@ func TestPluginCatalog_CRUD(t *testing.T) {
}
defer file.Close()

command := fmt.Sprintf("%s --test", filepath.Base(file.Name()))
err = core.pluginCatalog.Set("mysql-database-plugin", command, []byte{'1'})
command := fmt.Sprintf("%s", filepath.Base(file.Name()))
err = core.pluginCatalog.Set("mysql-database-plugin", command, []string{"--test"}, []byte{'1'})
Copy link
Member

@jefferai jefferai Jan 12, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also add a check to verify correct behavior if both args and command-with-args are given (after fixing above)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added the test to logical_system_test.go, as the logic to ensure only command or args is specified is in logical_system.go - hope thats okay!

if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -139,14 +139,14 @@ func TestPluginCatalog_List(t *testing.T) {
}
defer file.Close()

command := fmt.Sprintf("%s --test", filepath.Base(file.Name()))
err = core.pluginCatalog.Set("mysql-database-plugin", command, []byte{'1'})
command := filepath.Base(file.Name())
err = core.pluginCatalog.Set("mysql-database-plugin", command, []string{"--test"}, []byte{'1'})
if err != nil {
t.Fatal(err)
}

// Set another plugin
err = core.pluginCatalog.Set("aaaaaaa", command, []byte{'1'})
err = core.pluginCatalog.Set("aaaaaaa", command, []string{"--test"}, []byte{'1'})
if err != nil {
t.Fatal(err)
}
Expand Down
10 changes: 6 additions & 4 deletions vault/testing.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,8 +409,9 @@ func TestAddTestPlugin(t testing.T, c *Core, name, testFunc string) {
c.pluginDirectory = directoryPath
c.pluginCatalog.directory = directoryPath

command := fmt.Sprintf("%s --test.run=%s", filepath.Base(os.Args[0]), testFunc)
err = c.pluginCatalog.Set(name, command, sum)
command := fmt.Sprintf("%s", filepath.Base(os.Args[0]))
args := []string{fmt.Sprintf("--test.run=%s", testFunc)}
err = c.pluginCatalog.Set(name, command, args, sum)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -472,8 +473,9 @@ func TestAddTestPluginTempDir(t testing.T, c *Core, name, testFunc, tempDir stri
c.pluginDirectory = fullPath
c.pluginCatalog.directory = fullPath

command := fmt.Sprintf("%s --test.run=%s", filepath.Base(os.Args[0]), testFunc)
err = c.pluginCatalog.Set(name, command, sum)
command := fmt.Sprintf("%s", filepath.Base(os.Args[0]))
args := []string{fmt.Sprintf("--test.run=%s", testFunc)}
err = c.pluginCatalog.Set(name, command, args, sum)
if err != nil {
t.Fatal(err)
}
Expand Down