vault: github.com/hashicorp/vault/vault Index | Files | Directories

package vault

import "github.com/hashicorp/vault/vault"

Index

Package Files

acl.go acl_util.go audit.go audit_broker.go audited_headers.go auth.go barrier.go barrier_access.go barrier_aes_gcm.go barrier_view.go barrier_view_util.go capabilities.go cluster.go core.go core_util.go cors.go counters.go dynamic_system_view.go expiration.go expiration_util.go generate_root.go generate_root_recovery.go ha.go identity_lookup.go identity_store.go identity_store_aliases.go identity_store_entities.go identity_store_group_aliases.go identity_store_groups.go identity_store_oidc.go identity_store_oidc_util.go identity_store_schema.go identity_store_structs.go identity_store_upgrade.go identity_store_util.go init.go keyring.go logical_cubbyhole.go logical_passthrough.go logical_raw.go logical_system.go logical_system_helpers.go logical_system_paths.go logical_system_pprof.go logical_system_raft.go mount.go mount_util.go namespaces.go plugin_catalog.go plugin_reload.go policy.go policy_store.go policy_store_util.go policy_util.go raft.go rekey.go request_forwarding.go request_forwarding_rpc.go request_forwarding_rpc_util.go request_forwarding_service.pb.go request_handling.go request_handling_util.go rollback.go router.go router_access.go router_testing.go seal.go seal_access.go seal_autoseal.go seal_testing.go seal_testing_util.go sealunwrapper.go testing.go testing_util.go token_store.go token_store_util.go ui.go util.go wrapping.go wrapping_util.go

Constants

const (
    AESGCMVersion1 = 0x1
    AESGCMVersion2 = 0x2
)

Versions of the AESGCM storage methodology

const (
    CORSDisabled uint32 = iota
    CORSEnabled
)
const (
    DenyCapability   = "deny"
    CreateCapability = "create"
    ReadCapability   = "read"
    UpdateCapability = "update"
    DeleteCapability = "delete"
    ListCapability   = "list"
    SudoCapability   = "sudo"
    RootCapability   = "root"

    // Backwards compatibility
    OldDenyPathPolicy  = "deny"
    OldReadPathPolicy  = "read"
    OldWritePathPolicy = "write"
    OldSudoPathPolicy  = "sudo"
)
const (
    DenyCapabilityInt uint32 = 1 << iota
    CreateCapabilityInt
    ReadCapabilityInt
    UpdateCapabilityInt
    DeleteCapabilityInt
    ListCapabilityInt
    SudoCapabilityInt
)
const (
    RecoveryTypeUnsupported = "unsupported"
    RecoveryTypeShamir      = "shamir"
)
const (
    // CoreLockPath is the path used to acquire a coordinating lock
    // for a highly-available deploy.
    CoreLockPath = "core/lock"
)
const (

    // Internal so as not to log a trace message
    IntNoForwardingHeaderName = "X-Vault-Internal-No-Request-Forwarding"
)
const (

    // StoredBarrierKeysPath is the path used for storing HSM-encrypted unseal keys
    StoredBarrierKeysPath = "core/hsm/barrier-unseal-keys"
)

Variables

var (
    // ErrBarrierSealed is returned if an operation is performed on
    // a sealed barrier. No operation is expected to succeed before unsealing
    ErrBarrierSealed = errors.New("Vault is sealed")

    // ErrBarrierAlreadyInit is returned if the barrier is already
    // initialized. This prevents a re-initialization.
    ErrBarrierAlreadyInit = errors.New("Vault is already initialized")

    // ErrBarrierNotInit is returned if a non-initialized barrier
    // is attempted to be unsealed.
    ErrBarrierNotInit = errors.New("Vault is not initialized")

    // ErrBarrierInvalidKey is returned if the Unseal key is invalid
    ErrBarrierInvalidKey = errors.New("Unseal failed, invalid key")
)
var (
    ErrCannotForward          = errors.New("cannot forward request; no connection or address not known")
    ErrCannotForwardLocalOnly = errors.New("cannot forward local-only request")
)
var (
    // ErrAlreadyInit is returned if the core is already
    // initialized. This prevents a re-initialization.
    ErrAlreadyInit = errors.New("Vault is already initialized")

    // ErrNotInit is returned if a non-initialized barrier
    // is attempted to be unsealed.
    ErrNotInit = errors.New("Vault is not initialized")

    // ErrInternalError is returned when we don't want to leak
    // any information about an internal error
    ErrInternalError = errors.New("internal error")

    // ErrHANotEnabled is returned if the operation only makes sense
    // in an HA setting
    ErrHANotEnabled = errors.New("Vault is not configured for highly-available mode")

    LastWAL               = lastWALImpl
    LastPerformanceWAL    = lastPerformanceWALImpl
    PerformanceMerkleRoot = merkleRootImpl
    DRMerkleRoot          = merkleRootImpl
    LastRemoteWAL         = lastRemoteWALImpl
    WaitUntilWALShipped   = waitUntilWALShippedImpl
)
var (
    ErrDirectoryNotConfigured = errors.New("could not set plugin, plugin directory is not configured")
    ErrPluginNotFound         = errors.New("plugin not found in the catalog")
    ErrPluginBadType          = errors.New("unable to determine plugin type")
)
var (
    // DefaultMaxRequestDuration is the amount of time we'll wait for a request
    // to complete, unless overridden on a per-handler basis
    DefaultMaxRequestDuration = 90 * time.Second
)
var DefaultNumCores = 3
var (
    // KeyRotateGracePeriod is how long we allow an upgrade path
    // for standby instances before we delete the upgrade keys
    KeyRotateGracePeriod = 2 * time.Minute
)
var (
    NamespaceByID func(context.Context, string, *Core) (*namespace.Namespace, error) = namespaceByID
)
var StdAllowedHeaders = []string{
    "Content-Type",
    "X-Requested-With",
    "X-Vault-AWS-IAM-Server-ID",
    "X-Vault-MFA",
    "X-Vault-No-Request-Forwarding",
    "X-Vault-Wrap-Format",
    "X-Vault-Wrap-TTL",
    "X-Vault-Policy-Override",
    "Authorization",
    consts.AuthHeaderName,
}
var (
    // TokenLength is the size of tokens we are currently generating, without
    // any namespace information
    TokenLength = 24
)
var UpdateClusterAddrForTests uint32

This is used in tests to override the cluster address

func AddNoopAudit Uses

func AddNoopAudit(conf *CoreConfig)

func AddTestCredentialBackend Uses

func AddTestCredentialBackend(name string, factory logical.Factory) error

This adds a credential backend for the test core. This needs to be invoked before the test core is created.

func AddTestLogicalBackend Uses

func AddTestLogicalBackend(name string, factory logical.Factory) error

This adds a logical backend for the test core. This needs to be invoked before the test core is created.

func CleanupClusters Uses

func CleanupClusters(clusters []*TestCluster)

func CubbyholeBackendFactory Uses

func CubbyholeBackendFactory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error)

CubbyholeBackendFactory constructs a new cubbyhole backend

func GenerateRandBytes Uses

func GenerateRandBytes(length int) ([]byte, error)

func IsFatalError Uses

func IsFatalError(err error) bool

IsFatalError returns true if the given error is a fatal error.

func LeaseSwitchedPassthroughBackend Uses

func LeaseSwitchedPassthroughBackend(ctx context.Context, conf *logical.BackendConfig, leases bool) (logical.Backend, error)

LeaseSwitchedPassthroughBackend returns a PassthroughBackend with leases switched on or off

func LeasedPassthroughBackendFactory Uses

func LeasedPassthroughBackendFactory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error)

LeasedPassthroughBackendFactory returns a PassthroughBackend with leases switched on

func NewAutoSeal Uses

func NewAutoSeal(lowLevel seal.Access) *autoSeal

func NewMockBuiltinRegistry Uses

func NewMockBuiltinRegistry() *mockBuiltinRegistry

func NewRequestForwardingHandler Uses

func NewRequestForwardingHandler(c *Core, fws *http2.Server, perfStandbySlots chan struct{}, perfStandbyRepCluster *replication.Cluster) (*requestForwardingHandler, error)

NewRequestForwardingHandler creates a cluster handler for use with request forwarding.

func NewSealUnwrapper Uses

func NewSealUnwrapper(underlying physical.Backend, logger log.Logger) physical.Backend

NewSealUnwrapper creates a new seal unwrapper

func NoopBackendFactory Uses

func NoopBackendFactory(_ context.Context, _ *logical.BackendConfig) (logical.Backend, error)

func PassthroughBackendFactory Uses

func PassthroughBackendFactory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error)

PassthroughBackendFactory returns a PassthroughBackend with leases switched off

func RegisterRequestForwardingServer Uses

func RegisterRequestForwardingServer(s *grpc.Server, srv RequestForwardingServer)

func SetReplicationFailureMode Uses

func SetReplicationFailureMode(core *TestClusterCore, mode uint32)

func StartSSHHostTestServer Uses

func StartSSHHostTestServer() (string, error)

StartSSHHostTestServer starts the test server which responds to SSH authentication. Used to test the SSH secret backend.

func TestAddTestPlugin Uses

func TestAddTestPlugin(t testing.T, c *Core, name string, pluginType consts.PluginType, testFunc string, env []string, tempDir string)

TestAddTestPlugin registers the testFunc as part of the plugin command to the plugin catalog. If provided, uses tmpDir as the plugin directory.

func TestCoreInit Uses

func TestCoreInit(t testing.T, core *Core) ([][]byte, string)

TestCoreInit initializes the core with a single key, and returns the key that must be used to unseal the core and a root token.

func TestCoreInitClusterWrapperSetup Uses

func TestCoreInitClusterWrapperSetup(t testing.T, core *Core, handler http.Handler) ([][]byte, [][]byte, string)

func TestCoreUnseal Uses

func TestCoreUnseal(core *Core, key []byte) (bool, error)

func TestCoreUnsealWithRecoveryKeys Uses

func TestCoreUnsealWithRecoveryKeys(core *Core, key []byte) (bool, error)

func TestDynamicSystemView Uses

func TestDynamicSystemView(c *Core) *dynamicSystemView

func TestKeyCopy Uses

func TestKeyCopy(key []byte) []byte

TestKeyCopy is a silly little function to just copy the key so that it can be used with Unseal easily.

func TestWaitActive Uses

func TestWaitActive(t testing.T, core *Core)

func TestWaitActiveWithError Uses

func TestWaitActiveWithError(core *Core) error

type ACL Uses

type ACL struct {
    // contains filtered or unexported fields
}

ACL is used to wrap a set of policies to provide an efficient interface for access control.

func NewACL Uses

func NewACL(ctx context.Context, policies []*Policy) (*ACL, error)

NewACL is used to construct a policy based ACL from a set of policies.

func (*ACL) AllowOperation Uses

func (a *ACL) AllowOperation(ctx context.Context, req *logical.Request, capCheckOnly bool) (ret *ACLResults)

AllowOperation is used to check if the given operation is permitted.

func (*ACL) Capabilities Uses

func (a *ACL) Capabilities(ctx context.Context, path string) (pathCapabilities []string)

func (*ACL) CheckAllowedFromNonExactPaths Uses

func (a *ACL) CheckAllowedFromNonExactPaths(path string, bareMount bool) *ACLPermissions

CheckAllowedFromNonExactPaths returns permissions corresponding to a matching path with wildcards/globs. If bareMount is true, the path should correspond to a mount prefix, and what is returned is either a non-nil set of permissions from some allowed path underneath the mount (for use in mount access checks), or nil indicating no non-deny permissions were found.

type ACLPermissions Uses

type ACLPermissions struct {
    CapabilitiesBitmap uint32
    MinWrappingTTL     time.Duration
    MaxWrappingTTL     time.Duration
    AllowedParameters  map[string][]interface{}
    DeniedParameters   map[string][]interface{}
    RequiredParameters []string
    MFAMethods         []string
    ControlGroup       *ControlGroup
}

func (*ACLPermissions) Clone Uses

func (p *ACLPermissions) Clone() (*ACLPermissions, error)

type ACLResults Uses

type ACLResults struct {
    Allowed            bool
    RootPrivs          bool
    IsRoot             bool
    MFAMethods         []string
    ControlGroup       *ControlGroup
    CapabilitiesBitmap uint32
}

type AESGCMBarrier Uses

type AESGCMBarrier struct {
    // contains filtered or unexported fields
}

AESGCMBarrier is a SecurityBarrier implementation that uses the AES cipher core and the Galois Counter Mode block mode. It defaults to the golang NONCE default value of 12 and a key size of 256 bit. AES-GCM is high performance, and provides both confidentiality and integrity.

func NewAESGCMBarrier Uses

func NewAESGCMBarrier(physical physical.Backend) (*AESGCMBarrier, error)

NewAESGCMBarrier is used to construct a new barrier that uses the provided physical backend for storage.

func (*AESGCMBarrier) ActiveKeyInfo Uses

func (b *AESGCMBarrier) ActiveKeyInfo() (*KeyInfo, error)

ActiveKeyInfo is used to inform details about the active key

func (*AESGCMBarrier) CheckUpgrade Uses

func (b *AESGCMBarrier) CheckUpgrade(ctx context.Context) (bool, uint32, error)

CheckUpgrade looks for an upgrade to the current term and installs it

func (*AESGCMBarrier) CreateUpgrade Uses

func (b *AESGCMBarrier) CreateUpgrade(ctx context.Context, term uint32) error

CreateUpgrade creates an upgrade path key to the given term from the previous term

func (*AESGCMBarrier) Decrypt Uses

func (b *AESGCMBarrier) Decrypt(ctx context.Context, key string, ciphertext []byte) ([]byte, error)

Decrypt is used to decrypt in-memory for the BarrierEncryptor interface

func (*AESGCMBarrier) Delete Uses

func (b *AESGCMBarrier) Delete(ctx context.Context, key string) error

Delete is used to permanently delete an entry

func (*AESGCMBarrier) DestroyUpgrade Uses

func (b *AESGCMBarrier) DestroyUpgrade(ctx context.Context, term uint32) error

DestroyUpgrade destroys the upgrade path key to the given term

func (*AESGCMBarrier) Encrypt Uses

func (b *AESGCMBarrier) Encrypt(ctx context.Context, key string, plaintext []byte) ([]byte, error)

Encrypt is used to encrypt in-memory for the BarrierEncryptor interface

func (*AESGCMBarrier) GenerateKey Uses

func (b *AESGCMBarrier) GenerateKey(reader io.Reader) ([]byte, error)

GenerateKey is used to generate a new key

func (*AESGCMBarrier) Get Uses

func (b *AESGCMBarrier) Get(ctx context.Context, key string) (*logical.StorageEntry, error)

Get is used to fetch an entry

func (*AESGCMBarrier) Initialize Uses

func (b *AESGCMBarrier) Initialize(ctx context.Context, key, sealKey []byte, reader io.Reader) error

Initialize works only if the barrier has not been initialized and makes use of the given master key.

func (*AESGCMBarrier) Initialized Uses

func (b *AESGCMBarrier) Initialized(ctx context.Context) (bool, error)

Initialized checks if the barrier has been initialized and has a master key set.

func (*AESGCMBarrier) KeyLength Uses

func (b *AESGCMBarrier) KeyLength() (int, int)

KeyLength is used to sanity check a key

func (*AESGCMBarrier) Keyring Uses

func (b *AESGCMBarrier) Keyring() (*Keyring, error)

func (*AESGCMBarrier) List Uses

func (b *AESGCMBarrier) List(ctx context.Context, prefix string) ([]string, error)

List is used ot list all the keys under a given prefix, up to the next prefix.

func (*AESGCMBarrier) Put Uses

func (b *AESGCMBarrier) Put(ctx context.Context, entry *logical.StorageEntry) error

Put is used to insert or update an entry

func (*AESGCMBarrier) Rekey Uses

func (b *AESGCMBarrier) Rekey(ctx context.Context, key []byte) error

Rekey is used to change the master key used to protect the keyring

func (*AESGCMBarrier) ReloadKeyring Uses

func (b *AESGCMBarrier) ReloadKeyring(ctx context.Context) error

ReloadKeyring is used to re-read the underlying keyring. This is used for HA deployments to ensure the latest keyring is present in the leader.

func (*AESGCMBarrier) ReloadMasterKey Uses

func (b *AESGCMBarrier) ReloadMasterKey(ctx context.Context) error

ReloadMasterKey is used to re-read the underlying masterkey. This is used for HA deployments to ensure the latest master key is available for keyring reloading.

func (*AESGCMBarrier) Rotate Uses

func (b *AESGCMBarrier) Rotate(ctx context.Context, reader io.Reader) (uint32, error)

Rotate is used to create a new encryption key. All future writes should use the new key, while old values should still be decryptable.

func (*AESGCMBarrier) Seal Uses

func (b *AESGCMBarrier) Seal() error

Seal is used to re-seal the barrier. This requires the barrier to be unsealed again to perform any further operations.

func (*AESGCMBarrier) Sealed Uses

func (b *AESGCMBarrier) Sealed() (bool, error)

Sealed checks if the barrier has been unlocked yet. The Barrier is not expected to be able to perform any CRUD until it is unsealed.

func (*AESGCMBarrier) SetMasterKey Uses

func (b *AESGCMBarrier) SetMasterKey(key []byte) error

SetMasterKey updates the keyring's in-memory master key but does not persist anything to storage

func (*AESGCMBarrier) Unseal Uses

func (b *AESGCMBarrier) Unseal(ctx context.Context, key []byte) error

Unseal is used to provide the master key which permits the barrier to be unsealed. If the key is not correct, the barrier remains sealed.

func (*AESGCMBarrier) VerifyMaster Uses

func (b *AESGCMBarrier) VerifyMaster(key []byte) error

VerifyMaster is used to check if the given key matches the master key

type APIMountConfig Uses

type APIMountConfig struct {
    DefaultLeaseTTL           string                `json:"default_lease_ttl" structs:"default_lease_ttl" mapstructure:"default_lease_ttl"`
    MaxLeaseTTL               string                `json:"max_lease_ttl" structs:"max_lease_ttl" mapstructure:"max_lease_ttl"`
    ForceNoCache              bool                  `json:"force_no_cache" structs:"force_no_cache" mapstructure:"force_no_cache"`
    AuditNonHMACRequestKeys   []string              `json:"audit_non_hmac_request_keys,omitempty" structs:"audit_non_hmac_request_keys" mapstructure:"audit_non_hmac_request_keys"`
    AuditNonHMACResponseKeys  []string              `json:"audit_non_hmac_response_keys,omitempty" structs:"audit_non_hmac_response_keys" mapstructure:"audit_non_hmac_response_keys"`
    ListingVisibility         ListingVisibilityType `json:"listing_visibility,omitempty" structs:"listing_visibility" mapstructure:"listing_visibility"`
    PassthroughRequestHeaders []string              `json:"passthrough_request_headers,omitempty" structs:"passthrough_request_headers" mapstructure:"passthrough_request_headers"`
    AllowedResponseHeaders    []string              `json:"allowed_response_headers,omitempty" structs:"allowed_response_headers" mapstructure:"allowed_response_headers"`
    TokenType                 string                `json:"token_type" structs:"token_type" mapstructure:"token_type"`

    // PluginName is the name of the plugin registered in the catalog.
    //
    // Deprecated: MountEntry.Type should be used instead for Vault 1.0.0 and beyond.
    PluginName string `json:"plugin_name,omitempty" structs:"plugin_name,omitempty" mapstructure:"plugin_name"`
}

APIMountConfig is an embedded struct of api.MountConfigInput

type ActiveEntities Uses

type ActiveEntities struct {
    // Entities contains information about the number of active entities.
    Entities EntityCounter `json:"entities"`
}

ActiveEntities contains the number of active entities.

type ActiveTokens Uses

type ActiveTokens struct {
    // ServiceTokens contains information about the number of active service
    // tokens.
    ServiceTokens TokenCounter `json:"service_tokens"`
}

ActiveTokens contains the number of active tokens.

type AuditBroker Uses

type AuditBroker struct {
    sync.RWMutex
    // contains filtered or unexported fields
}

AuditBroker is used to provide a single ingest interface to auditable events given that multiple backends may be configured.

func NewAuditBroker Uses

func NewAuditBroker(log log.Logger) *AuditBroker

NewAuditBroker creates a new audit broker

func (*AuditBroker) Deregister Uses

func (a *AuditBroker) Deregister(name string)

Deregister is used to remove an audit backend from the broker

func (*AuditBroker) GetHash Uses

func (a *AuditBroker) GetHash(ctx context.Context, name string, input string) (string, error)

GetHash returns a hash using the salt of the given backend

func (*AuditBroker) Invalidate Uses

func (a *AuditBroker) Invalidate(ctx context.Context, key string)

func (*AuditBroker) IsLocal Uses

func (a *AuditBroker) IsLocal(name string) (bool, error)

IsLocal is used to check if a given audit backend is registered

func (*AuditBroker) IsRegistered Uses

func (a *AuditBroker) IsRegistered(name string) bool

IsRegistered is used to check if a given audit backend is registered

func (*AuditBroker) LogRequest Uses

func (a *AuditBroker) LogRequest(ctx context.Context, in *logical.LogInput, headersConfig *AuditedHeadersConfig) (ret error)

LogRequest is used to ensure all the audit backends have an opportunity to log the given request and that *at least one* succeeds.

func (*AuditBroker) LogResponse Uses

func (a *AuditBroker) LogResponse(ctx context.Context, in *logical.LogInput, headersConfig *AuditedHeadersConfig) (ret error)

LogResponse is used to ensure all the audit backends have an opportunity to log the given response and that *at least one* succeeds.

func (*AuditBroker) Register Uses

func (a *AuditBroker) Register(name string, b audit.Backend, v *BarrierView, local bool)

Register is used to add new audit backend to the broker

type AuditedHeadersConfig Uses

type AuditedHeadersConfig struct {
    Headers map[string]*auditedHeaderSettings

    sync.RWMutex
    // contains filtered or unexported fields
}

AuditedHeadersConfig is used by the Audit Broker to write only approved headers to the audit logs. It uses a BarrierView to persist the settings.

func (*AuditedHeadersConfig) ApplyConfig Uses

func (a *AuditedHeadersConfig) ApplyConfig(ctx context.Context, headers map[string][]string, hashFunc func(context.Context, string) (string, error)) (result map[string][]string, retErr error)

ApplyConfig returns a map of approved headers and their values, either hmac'ed or plaintext

type AuthResults Uses

type AuthResults struct {
    ACLResults  *ACLResults
    Allowed     bool
    RootPrivs   bool
    DeniedError bool
    Error       *multierror.Error
}

type BarrierEncryptor Uses

type BarrierEncryptor interface {
    Encrypt(ctx context.Context, key string, plaintext []byte) ([]byte, error)
    Decrypt(ctx context.Context, key string, ciphertext []byte) ([]byte, error)
}

BarrierEncryptor is the in memory only interface that does not actually use the underlying barrier. It is used for lower level modules like the Write-Ahead-Log and Merkle index to allow them to use the barrier.

type BarrierEncryptorAccess Uses

type BarrierEncryptorAccess struct {
    // contains filtered or unexported fields
}

BarrierEncryptorAccess is a wrapper around BarrierEncryptor that allows Core to expose its barrier encrypt/decrypt operations through BarrierEncryptorAccess() while restricting the ability to modify Core.barrier itself.

func NewBarrierEncryptorAccess Uses

func NewBarrierEncryptorAccess(barrierEncryptor BarrierEncryptor) *BarrierEncryptorAccess

func (*BarrierEncryptorAccess) Decrypt Uses

func (b *BarrierEncryptorAccess) Decrypt(ctx context.Context, key string, ciphertext []byte) ([]byte, error)

func (*BarrierEncryptorAccess) Encrypt Uses

func (b *BarrierEncryptorAccess) Encrypt(ctx context.Context, key string, plaintext []byte) ([]byte, error)

type BarrierStorage Uses

type BarrierStorage interface {
    // Put is used to insert or update an entry
    Put(ctx context.Context, entry *logical.StorageEntry) error

    // Get is used to fetch an entry
    Get(ctx context.Context, key string) (*logical.StorageEntry, error)

    // Delete is used to permanently delete an entry
    Delete(ctx context.Context, key string) error

    // List is used ot list all the keys under a given
    // prefix, up to the next prefix.
    List(ctx context.Context, prefix string) ([]string, error)
}

BarrierStorage is the storage only interface required for a Barrier.

type BarrierView Uses

type BarrierView struct {
    // contains filtered or unexported fields
}

BarrierView wraps a SecurityBarrier and ensures all access is automatically prefixed. This is used to prevent anyone with access to the view to access any data in the durable storage outside of their prefix. Conceptually this is like a "chroot" into the barrier.

BarrierView implements logical.Storage so it can be passed in as the durable storage mechanism for logical views.

func NewBarrierView Uses

func NewBarrierView(barrier logical.Storage, prefix string) *BarrierView

NewBarrierView takes an underlying security barrier and returns a view of it that can only operate with the given prefix.

func (*BarrierView) Delete Uses

func (v *BarrierView) Delete(ctx context.Context, key string) error

logical.Storage impl.

func (*BarrierView) Get Uses

func (v *BarrierView) Get(ctx context.Context, key string) (*logical.StorageEntry, error)

func (*BarrierView) List Uses

func (v *BarrierView) List(ctx context.Context, prefix string) ([]string, error)

func (*BarrierView) Prefix Uses

func (v *BarrierView) Prefix() string

func (*BarrierView) Put Uses

func (v *BarrierView) Put(ctx context.Context, entry *logical.StorageEntry) error

Put differs from List/Get because it checks read-only errors

func (*BarrierView) SubView Uses

func (v *BarrierView) SubView(prefix string) *BarrierView

SubView constructs a nested sub-view using the given prefix

type BuiltinRegistry Uses

type BuiltinRegistry interface {
    Contains(name string, pluginType consts.PluginType) bool
    Get(name string, pluginType consts.PluginType) (func() (interface{}, error), bool)
    Keys(pluginType consts.PluginType) []string
}

BuiltinRegistry is an interface that allows the "vault" package to use the registry of builtin plugins without getting an import cycle. It also allows for mocking the registry easily.

type CORSConfig Uses

type CORSConfig struct {
    sync.RWMutex `json:"-"`

    Enabled        *uint32  `json:"enabled"`
    AllowedOrigins []string `json:"allowed_origins,omitempty"`
    AllowedHeaders []string `json:"allowed_headers,omitempty"`
    // contains filtered or unexported fields
}

CORSConfig stores the state of the CORS configuration.

func (*CORSConfig) Disable Uses

func (c *CORSConfig) Disable(ctx context.Context) error

Disable sets CORS to disabled and clears the allowed origins & headers.

func (*CORSConfig) Enable Uses

func (c *CORSConfig) Enable(ctx context.Context, urls []string, headers []string) error

Enable takes either a '*' or a comma-separated list of URLs that can make cross-origin requests to Vault.

func (*CORSConfig) IsEnabled Uses

func (c *CORSConfig) IsEnabled() bool

IsEnabled returns the value of CORSConfig.isEnabled

func (*CORSConfig) IsValidOrigin Uses

func (c *CORSConfig) IsValidOrigin(origin string) bool

IsValidOrigin determines if the origin of the request is allowed to make cross-origin requests based on the CORSConfig.

type ClientKey Uses

type ClientKey struct {
    Type                 string   `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
    X                    []byte   `protobuf:"bytes,2,opt,name=x,proto3" json:"x,omitempty"`
    Y                    []byte   `protobuf:"bytes,3,opt,name=y,proto3" json:"y,omitempty"`
    D                    []byte   `protobuf:"bytes,4,opt,name=d,proto3" json:"d,omitempty"`
    XXX_NoUnkeyedLiteral struct{} `json:"-"`
    XXX_unrecognized     []byte   `json:"-"`
    XXX_sizecache        int32    `json:"-"`
}

func (*ClientKey) Descriptor Uses

func (*ClientKey) Descriptor() ([]byte, []int)

func (*ClientKey) GetD Uses

func (m *ClientKey) GetD() []byte

func (*ClientKey) GetType Uses

func (m *ClientKey) GetType() string

func (*ClientKey) GetX Uses

func (m *ClientKey) GetX() []byte

func (*ClientKey) GetY Uses

func (m *ClientKey) GetY() []byte

func (*ClientKey) ProtoMessage Uses

func (*ClientKey) ProtoMessage()

func (*ClientKey) Reset Uses

func (m *ClientKey) Reset()

func (*ClientKey) String Uses

func (m *ClientKey) String() string

func (*ClientKey) XXX_DiscardUnknown Uses

func (m *ClientKey) XXX_DiscardUnknown()

func (*ClientKey) XXX_Marshal Uses

func (m *ClientKey) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ClientKey) XXX_Merge Uses

func (m *ClientKey) XXX_Merge(src proto.Message)

func (*ClientKey) XXX_Size Uses

func (m *ClientKey) XXX_Size() int

func (*ClientKey) XXX_Unmarshal Uses

func (m *ClientKey) XXX_Unmarshal(b []byte) error

type Cluster Uses

type Cluster struct {
    // Name of the cluster
    Name string `json:"name" structs:"name" mapstructure:"name"`

    // Identifier of the cluster
    ID  string `json:"id" structs:"id" mapstructure:"id"`
}

Structure representing the storage entry that holds cluster information

type ClusterLeaderParams Uses

type ClusterLeaderParams struct {
    LeaderUUID         string
    LeaderRedirectAddr string
    LeaderClusterAddr  string
}

type ControlGroup Uses

type ControlGroup struct {
    TTL     time.Duration
    Factors []*ControlGroupFactor
}

type ControlGroupFactor Uses

type ControlGroupFactor struct {
    Name     string
    Identity *IdentityFactor `hcl:"identity"`
}

type ControlGroupHCL Uses

type ControlGroupHCL struct {
    TTL     interface{}                    `hcl:"ttl"`
    Factors map[string]*ControlGroupFactor `hcl:"factor"`
}

type Core Uses

type Core struct {
    // contains filtered or unexported fields
}

Core is used as the central manager of Vault activity. It is the primary point of interface for API handlers and is responsible for managing the logical and physical backends, router, security barrier, and audit trails.

func NewCore Uses

func NewCore(conf *CoreConfig) (*Core, error)

NewCore is used to construct a new core

func TestCore Uses

func TestCore(t testing.T) *Core

TestCore returns a pure in-memory, uninitialized core for testing.

func TestCoreNewSeal Uses

func TestCoreNewSeal(t testing.T) *Core

TestCoreNewSeal returns a pure in-memory, uninitialized core with the new seal configuration.

func TestCoreRaw Uses

func TestCoreRaw(t testing.T) *Core

TestCoreRaw returns a pure in-memory, uninitialized core for testing. The raw storage endpoints are enabled with this core.

func TestCoreUI Uses

func TestCoreUI(t testing.T, enableUI bool) *Core

func TestCoreUnsealed Uses

func TestCoreUnsealed(t testing.T) (*Core, [][]byte, string)

TestCoreUnsealed returns a pure in-memory core that is already initialized and unsealed.

func TestCoreUnsealedBackend Uses

func TestCoreUnsealedBackend(t testing.T, backend physical.Backend) (*Core, [][]byte, string)

func TestCoreUnsealedRaw Uses

func TestCoreUnsealedRaw(t testing.T) (*Core, [][]byte, string)

TestCoreUnsealedRaw returns a pure in-memory core that is already initialized, unsealed, and with raw endpoints enabled.

func TestCoreUnsealedWithConfig Uses

func TestCoreUnsealedWithConfig(t testing.T, conf *CoreConfig) (*Core, [][]byte, string)

TestCoreUnsealedWithConfig returns a pure in-memory core that is already initialized, unsealed, with the any provided core config values overridden.

func TestCoreUnsealedWithConfigSealOpts Uses

func TestCoreUnsealedWithConfigSealOpts(t testing.T, barrierConf, recoveryConf *SealConfig, sealOpts *TestSealOpts) (*Core, [][]byte, [][]byte, string)

func TestCoreUnsealedWithConfigs Uses

func TestCoreUnsealedWithConfigs(t testing.T, barrierConf, recoveryConf *SealConfig) (*Core, [][]byte, [][]byte, string)

func TestCoreWithConfig Uses

func TestCoreWithConfig(t testing.T, conf *CoreConfig) *Core

TestCoreWithConfig returns a pure in-memory, uninitialized core with the specified core configurations overridden for testing.

func TestCoreWithSeal Uses

func TestCoreWithSeal(t testing.T, testSeal Seal, enableRaw bool) *Core

TestCoreWithSeal returns a pure in-memory, uninitialized core with the specified seal for testing.

func TestCoreWithSealAndUI Uses

func TestCoreWithSealAndUI(t testing.T, opts *CoreConfig) *Core

func (*Core) ActiveNodeReplicationState Uses

func (c *Core) ActiveNodeReplicationState() consts.ReplicationState

func (*Core) AddLogger Uses

func (c *Core) AddLogger(logger log.Logger)

func (*Core) AuditedHeadersConfig Uses

func (c *Core) AuditedHeadersConfig() *AuditedHeadersConfig

func (*Core) BarrierEncryptorAccess Uses

func (c *Core) BarrierEncryptorAccess() *BarrierEncryptorAccess

func (*Core) BarrierKeyLength Uses

func (c *Core) BarrierKeyLength() (min, max int)

func (*Core) BarrierRekeyInit Uses

func (c *Core) BarrierRekeyInit(config *SealConfig) logical.HTTPCodedError

BarrierRekeyInit is used to initialize the rekey settings for the barrier key

func (*Core) BarrierRekeyUpdate Uses

func (c *Core) BarrierRekeyUpdate(ctx context.Context, key []byte, nonce string) (*RekeyResult, logical.HTTPCodedError)

BarrierRekeyUpdate is used to provide a new key part. Barrier rekey can be done with unseal keys, or recovery keys if that's supported and we are storing the barrier key.

N.B.: If recovery keys are used to rekey, the new barrier key shares are not returned.

func (*Core) CORSConfig Uses

func (c *Core) CORSConfig() *CORSConfig

CORSConfig returns the current CORS configuration

func (*Core) Capabilities Uses

func (c *Core) Capabilities(ctx context.Context, token, path string) ([]string, error)

Capabilities is used to fetch the capabilities of the given token on the given path

func (*Core) Cluster Uses

func (c *Core) Cluster(ctx context.Context) (*Cluster, error)

Cluster fetches the details of the local cluster. This method errors out when Vault is sealed.

func (*Core) ClusterAddr Uses

func (c *Core) ClusterAddr() string

func (*Core) Features Uses

func (c *Core) Features() license.Features

func (*Core) ForwardRequest Uses

func (c *Core) ForwardRequest(req *http.Request) (int, http.Header, []byte, error)

ForwardRequest forwards a given request to the active node and returns the response.

func (*Core) GenerateRootCancel Uses

func (c *Core) GenerateRootCancel() error

GenerateRootCancel is used to cancel an in-progress root generation

func (*Core) GenerateRootConfiguration Uses

func (c *Core) GenerateRootConfiguration() (*GenerateRootConfig, error)

GenerateRootConfiguration is used to read the root generation configuration It stubbornly refuses to return the OTP if one is there.

func (*Core) GenerateRootInit Uses

func (c *Core) GenerateRootInit(otp, pgpKey string, strategy GenerateRootStrategy) error

GenerateRootInit is used to initialize the root generation settings

func (*Core) GenerateRootProgress Uses

func (c *Core) GenerateRootProgress() (int, error)

GenerateRootProgress is used to return the root generation progress (num shares)

func (*Core) GenerateRootUpdate Uses

func (c *Core) GenerateRootUpdate(ctx context.Context, key []byte, nonce string, strategy GenerateRootStrategy) (*GenerateRootResult, error)

GenerateRootUpdate is used to provide a new key part

func (*Core) GetContext Uses

func (c *Core) GetContext() (context.Context, context.CancelFunc)

func (*Core) HandleRequest Uses

func (c *Core) HandleRequest(httpCtx context.Context, req *logical.Request) (resp *logical.Response, err error)

HandleRequest is used to handle a new incoming request

func (*Core) HasFeature Uses

func (c *Core) HasFeature(license.Features) bool

func (*Core) IdentityStore Uses

func (c *Core) IdentityStore() *IdentityStore

func (*Core) Initialize Uses

func (c *Core) Initialize(ctx context.Context, initParams *InitParams) (*InitResult, error)

Initialize is used to initialize the Vault with the given configurations.

func (*Core) InitializeRecovery Uses

func (c *Core) InitializeRecovery(ctx context.Context) error

func (*Core) Initialized Uses

func (c *Core) Initialized(ctx context.Context) (bool, error)

Initialized checks if the Vault is already initialized

func (*Core) IsBatchTokenCreationRequest Uses

func (c *Core) IsBatchTokenCreationRequest(ctx context.Context, path string) (bool, error)

func (*Core) IsDRSecondary Uses

func (c *Core) IsDRSecondary() bool

IsDRSecondary returns if the current cluster state is a DR secondary.

func (*Core) IsInSealMigration Uses

func (c *Core) IsInSealMigration() bool

func (*Core) JoinRaftCluster Uses

func (c *Core) JoinRaftCluster(ctx context.Context, leaderAddr string, tlsConfig *tls.Config, retry, nonVoter bool) (bool, error)

func (*Core) Leader Uses

func (c *Core) Leader() (isLeader bool, leaderAddr, clusterAddr string, err error)

Leader is used to get the current active leader

func (*Core) Logger Uses

func (c *Core) Logger() log.Logger

func (*Core) LookupToken Uses

func (c *Core) LookupToken(ctx context.Context, token string) (*logical.TokenEntry, error)

LookupToken returns the properties of the token from the token store. This is particularly useful to fetch the accessor of the client token and get it populated in the logical request along with the client token. The accessor of the client token can get audit logged.

func (*Core) MetricsHelper Uses

func (c *Core) MetricsHelper() *metricsutil.MetricsHelper

MetricsHelper returns the global metrics helper which allows external packages to access Vault's internal metrics.

func (*Core) PerfStandby Uses

func (c *Core) PerfStandby() bool

PerfStandby checks if the vault is a performance standby

func (*Core) PhysicalAccess Uses

func (c *Core) PhysicalAccess() *physical.PhysicalAccess

func (*Core) PhysicalSealConfigs Uses

func (c *Core) PhysicalSealConfigs(ctx context.Context) (*SealConfig, *SealConfig, error)

func (*Core) RecoveryRekeyInit Uses

func (c *Core) RecoveryRekeyInit(config *SealConfig) logical.HTTPCodedError

RecoveryRekeyInit is used to initialize the rekey settings for the recovery key

func (*Core) RecoveryRekeyUpdate Uses

func (c *Core) RecoveryRekeyUpdate(ctx context.Context, key []byte, nonce string) (*RekeyResult, logical.HTTPCodedError)

RecoveryRekeyUpdate is used to provide a new key part

func (*Core) RegisterAuth Uses

func (c *Core) RegisterAuth(ctx context.Context, tokenTTL time.Duration, path string, auth *logical.Auth) error

RegisterAuth uses a logical.Auth object to create a token entry in the token store, and registers a corresponding token lease to the expiration manager.

func (*Core) RekeyCancel Uses

func (c *Core) RekeyCancel(recovery bool) logical.HTTPCodedError

RekeyCancel is used to cancel an in-progress rekey

func (*Core) RekeyConfig Uses

func (c *Core) RekeyConfig(recovery bool) (*SealConfig, logical.HTTPCodedError)

RekeyConfig is used to read the rekey configuration

func (*Core) RekeyDeleteBackup Uses

func (c *Core) RekeyDeleteBackup(ctx context.Context, recovery bool) logical.HTTPCodedError

RekeyDeleteBackup is used to delete any backed-up PGP-encrypted unseal keys

func (*Core) RekeyInit Uses

func (c *Core) RekeyInit(config *SealConfig, recovery bool) logical.HTTPCodedError

RekeyInit will either initialize the rekey of barrier or recovery key. recovery determines whether this is a rekey on the barrier or recovery key.

func (*Core) RekeyProgress Uses

func (c *Core) RekeyProgress(recovery, verification bool) (bool, int, logical.HTTPCodedError)

RekeyProgress is used to return the rekey progress (num shares).

func (*Core) RekeyRetrieveBackup Uses

func (c *Core) RekeyRetrieveBackup(ctx context.Context, recovery bool) (*RekeyBackup, logical.HTTPCodedError)

RekeyRetrieveBackup is used to retrieve any backed-up PGP-encrypted unseal keys

func (*Core) RekeyThreshold Uses

func (c *Core) RekeyThreshold(ctx context.Context, recovery bool) (int, logical.HTTPCodedError)

RekeyThreshold returns the secret threshold for the current seal config. This threshold can either be the barrier key threshold or the recovery key threshold, depending on whether rekey is being performed on the recovery key, or whether the seal supports recovery keys.

func (*Core) RekeyUpdate Uses

func (c *Core) RekeyUpdate(ctx context.Context, key []byte, nonce string, recovery bool) (*RekeyResult, logical.HTTPCodedError)

RekeyUpdate is used to provide a new key part for the barrier or recovery key.

func (*Core) RekeyVerify Uses

func (c *Core) RekeyVerify(ctx context.Context, key []byte, nonce string, recovery bool) (ret *RekeyVerifyResult, retErr logical.HTTPCodedError)

func (*Core) RekeyVerifyRestart Uses

func (c *Core) RekeyVerifyRestart(recovery bool) logical.HTTPCodedError

RekeyVerifyRestart is used to start the verification process over

func (*Core) ReplicationState Uses

func (c *Core) ReplicationState() consts.ReplicationState

func (*Core) ResetUnsealProcess Uses

func (c *Core) ResetUnsealProcess()

ResetUnsealProcess removes the current unlock parts from memory, to reset the unsealing process

func (*Core) RouterAccess Uses

func (c *Core) RouterAccess() *RouterAccess

func (*Core) SanitizedConfig Uses

func (c *Core) SanitizedConfig() map[string]interface{}

SanitizedConfig returns a sanitized version of the current config. See server.Config.Sanitized for specific values omitted.

func (*Core) Seal Uses

func (c *Core) Seal(token string) error

Seal takes in a token and creates a logical.Request, acquires the lock, and passes through to sealInternal

func (*Core) SealAccess Uses

func (c *Core) SealAccess() *SealAccess

func (*Core) SealWithRequest Uses

func (c *Core) SealWithRequest(httpCtx context.Context, req *logical.Request) error

SealWithRequest takes in a logical.Request, acquires the lock, and passes through to sealInternal

func (*Core) Sealed Uses

func (c *Core) Sealed() bool

Sealed checks if the Vault is current sealed

func (*Core) SecretProgress Uses

func (c *Core) SecretProgress() (int, string)

SecretProgress returns the number of keys provided so far

func (*Core) SetClusterHandler Uses

func (c *Core) SetClusterHandler(handler http.Handler)

func (*Core) SetClusterListenerAddrs Uses

func (c *Core) SetClusterListenerAddrs(addrs []*net.TCPAddr)

func (*Core) SetConfig Uses

func (c *Core) SetConfig(conf *server.Config)

SetConfig sets core's config object to the newly provided config.

func (*Core) SetLoadCaseSensitiveIdentityStore Uses

func (c *Core) SetLoadCaseSensitiveIdentityStore(caseSensitive bool)

func (*Core) SetLogLevel Uses

func (c *Core) SetLogLevel(level log.Level)

func (*Core) SetNeverBecomeActive Uses

func (c *Core) SetNeverBecomeActive(on bool)

func (*Core) SetSealsForMigration Uses

func (c *Core) SetSealsForMigration(migrationSeal, newSeal, unwrapSeal Seal)

func (*Core) Shutdown Uses

func (c *Core) Shutdown() error

Shutdown is invoked when the Vault instance is about to be terminated. It should not be accessible as part of an API call as it will cause an availability problem. It is only used to gracefully quit in the case of HA so that failover happens as quickly as possible.

func (*Core) Standby Uses

func (c *Core) Standby() (bool, error)

Standby checks if the Vault is in standby mode

func (*Core) StepDown Uses

func (c *Core) StepDown(httpCtx context.Context, req *logical.Request) (retErr error)

StepDown is used to step down from leadership

func (*Core) StorageType Uses

func (c *Core) StorageType() string

StorageType returns a string equal to the storage configuration's type.

func (*Core) UIEnabled Uses

func (c *Core) UIEnabled() bool

UIEnabled returns if the UI is enabled

func (*Core) UIHeaders Uses

func (c *Core) UIHeaders() (http.Header, error)

UIHeaders returns configured UI headers

func (*Core) Unseal Uses

func (c *Core) Unseal(key []byte) (bool, error)

Unseal is used to provide one of the key parts to unseal the Vault.

They key given as a parameter will automatically be zerod after this method is done with it. If you want to keep the key around, a copy should be made.

func (*Core) UnsealWithRecoveryKeys Uses

func (c *Core) UnsealWithRecoveryKeys(key []byte) (bool, error)

func (*Core) UnsealWithStoredKeys Uses

func (c *Core) UnsealWithStoredKeys(ctx context.Context) error

UnsealWithStoredKeys performs auto-unseal using stored keys. An error return value of "nil" implies the Vault instance is unsealed.

Callers should attempt to retry any NonFatalErrors. Callers should not re-attempt fatal errors.

func (*Core) ValidateWrappingToken Uses

func (c *Core) ValidateWrappingToken(ctx context.Context, req *logical.Request) (valid bool, err error)

validateWrappingToken checks whether a token is a wrapping token. The passed in logical request will be updated if the wrapping token was provided within a JWT token.

type CoreConfig Uses

type CoreConfig struct {
    DevToken string `json:"dev_token" structs:"dev_token" mapstructure:"dev_token"`

    BuiltinRegistry BuiltinRegistry `json:"builtin_registry" structs:"builtin_registry" mapstructure:"builtin_registry"`

    LogicalBackends map[string]logical.Factory `json:"logical_backends" structs:"logical_backends" mapstructure:"logical_backends"`

    CredentialBackends map[string]logical.Factory `json:"credential_backends" structs:"credential_backends" mapstructure:"credential_backends"`

    AuditBackends map[string]audit.Factory `json:"audit_backends" structs:"audit_backends" mapstructure:"audit_backends"`

    Physical physical.Backend `json:"physical" structs:"physical" mapstructure:"physical"`

    StorageType string `json:"storage_type" structs:"storage_type" mapstructure:"storage_type"`

    // May be nil, which disables HA operations
    HAPhysical physical.HABackend `json:"ha_physical" structs:"ha_physical" mapstructure:"ha_physical"`

    Seal Seal `json:"seal" structs:"seal" mapstructure:"seal"`

    SecureRandomReader io.Reader `json:"secure_random_reader" structs:"secure_random_reader" mapstructure:"secure_random_reader"`

    Logger log.Logger `json:"logger" structs:"logger" mapstructure:"logger"`

    // Disables the LRU cache on the physical backend
    DisableCache bool `json:"disable_cache" structs:"disable_cache" mapstructure:"disable_cache"`

    // Disables mlock syscall
    DisableMlock bool `json:"disable_mlock" structs:"disable_mlock" mapstructure:"disable_mlock"`

    // Custom cache size for the LRU cache on the physical backend, or zero for default
    CacheSize int `json:"cache_size" structs:"cache_size" mapstructure:"cache_size"`

    // Set as the leader address for HA
    RedirectAddr string `json:"redirect_addr" structs:"redirect_addr" mapstructure:"redirect_addr"`

    // Set as the cluster address for HA
    ClusterAddr string `json:"cluster_addr" structs:"cluster_addr" mapstructure:"cluster_addr"`

    DefaultLeaseTTL time.Duration `json:"default_lease_ttl" structs:"default_lease_ttl" mapstructure:"default_lease_ttl"`

    MaxLeaseTTL time.Duration `json:"max_lease_ttl" structs:"max_lease_ttl" mapstructure:"max_lease_ttl"`

    ClusterName string `json:"cluster_name" structs:"cluster_name" mapstructure:"cluster_name"`

    ClusterCipherSuites string `json:"cluster_cipher_suites" structs:"cluster_cipher_suites" mapstructure:"cluster_cipher_suites"`

    EnableUI bool `json:"ui" structs:"ui" mapstructure:"ui"`

    // Enable the raw endpoint
    EnableRaw bool `json:"enable_raw" structs:"enable_raw" mapstructure:"enable_raw"`

    PluginDirectory string `json:"plugin_directory" structs:"plugin_directory" mapstructure:"plugin_directory"`

    DisableSealWrap bool `json:"disable_sealwrap" structs:"disable_sealwrap" mapstructure:"disable_sealwrap"`

    RawConfig *server.Config

    ReloadFuncs     *map[string][]reload.ReloadFunc
    ReloadFuncsLock *sync.RWMutex

    // Licensing
    LicensingConfig *LicensingConfig
    // Don't set this unless in dev mode, ideally only when using inmem
    DevLicenseDuration time.Duration

    DisablePerformanceStandby bool
    DisableIndexing           bool
    DisableKeyEncodingChecks  bool

    AllLoggers []log.Logger

    // Telemetry objects
    MetricsHelper *metricsutil.MetricsHelper

    CounterSyncInterval time.Duration

    RecoveryMode bool
}

CoreConfig is used to parameterize a core

func (*CoreConfig) Clone Uses

func (c *CoreConfig) Clone() *CoreConfig

type CubbyholeBackend Uses

type CubbyholeBackend struct {
    *framework.Backend
    // contains filtered or unexported fields
}

CubbyholeBackend is used for storing secrets directly into the physical backend. The secrets are encrypted in the durable storage. This differs from kv in that every token has its own private storage view. The view is removed when the token expires.

type DatedRequestCounter Uses

type DatedRequestCounter struct {
    // StartTime is when the period starts.
    StartTime time.Time `json:"start_time"`
    // RequestCounter counts requests.
    RequestCounter
}

DatedRequestCounter holds request counters from a single period of time.

type EchoReply Uses

type EchoReply struct {
    Message              string   `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
    ClusterAddrs         []string `protobuf:"bytes,2,rep,name=cluster_addrs,json=clusterAddrs,proto3" json:"cluster_addrs,omitempty"`
    ReplicationState     uint32   `protobuf:"varint,3,opt,name=replication_state,json=replicationState,proto3" json:"replication_state,omitempty"`
    RaftAppliedIndex     uint64   `protobuf:"varint,4,opt,name=raft_applied_index,json=raftAppliedIndex,proto3" json:"raft_applied_index,omitempty"`
    RaftNodeID           string   `protobuf:"bytes,5,opt,name=raft_node_id,json=raftNodeId,proto3" json:"raft_node_id,omitempty"`
    XXX_NoUnkeyedLiteral struct{} `json:"-"`
    XXX_unrecognized     []byte   `json:"-"`
    XXX_sizecache        int32    `json:"-"`
}

func (*EchoReply) Descriptor Uses

func (*EchoReply) Descriptor() ([]byte, []int)

func (*EchoReply) GetClusterAddrs Uses

func (m *EchoReply) GetClusterAddrs() []string

func (*EchoReply) GetMessage Uses

func (m *EchoReply) GetMessage() string

func (*EchoReply) GetRaftAppliedIndex Uses

func (m *EchoReply) GetRaftAppliedIndex() uint64

func (*EchoReply) GetRaftNodeID Uses

func (m *EchoReply) GetRaftNodeID() string

func (*EchoReply) GetReplicationState Uses

func (m *EchoReply) GetReplicationState() uint32

func (*EchoReply) ProtoMessage Uses

func (*EchoReply) ProtoMessage()

func (*EchoReply) Reset Uses

func (m *EchoReply) Reset()

func (*EchoReply) String Uses

func (m *EchoReply) String() string

func (*EchoReply) XXX_DiscardUnknown Uses

func (m *EchoReply) XXX_DiscardUnknown()

func (*EchoReply) XXX_Marshal Uses

func (m *EchoReply) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*EchoReply) XXX_Merge Uses

func (m *EchoReply) XXX_Merge(src proto.Message)

func (*EchoReply) XXX_Size Uses

func (m *EchoReply) XXX_Size() int

func (*EchoReply) XXX_Unmarshal Uses

func (m *EchoReply) XXX_Unmarshal(b []byte) error

type EchoRequest Uses

type EchoRequest struct {
    Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
    // ClusterAddr is used to send up a standby node's address to the active
    // node upon heartbeat
    ClusterAddr string `protobuf:"bytes,2,opt,name=cluster_addr,json=clusterAddr,proto3" json:"cluster_addr,omitempty"`
    // ClusterAddrs is used to send up a list of cluster addresses to a dr
    // primary from a dr secondary
    ClusterAddrs         []string `protobuf:"bytes,3,rep,name=cluster_addrs,json=clusterAddrs,proto3" json:"cluster_addrs,omitempty"`
    RaftAppliedIndex     uint64   `protobuf:"varint,4,opt,name=raft_applied_index,json=raftAppliedIndex,proto3" json:"raft_applied_index,omitempty"`
    RaftNodeID           string   `protobuf:"bytes,5,opt,name=raft_node_id,json=raftNodeId,proto3" json:"raft_node_id,omitempty"`
    XXX_NoUnkeyedLiteral struct{} `json:"-"`
    XXX_unrecognized     []byte   `json:"-"`
    XXX_sizecache        int32    `json:"-"`
}

func (*EchoRequest) Descriptor Uses

func (*EchoRequest) Descriptor() ([]byte, []int)

func (*EchoRequest) GetClusterAddr Uses

func (m *EchoRequest) GetClusterAddr() string

func (*EchoRequest) GetClusterAddrs Uses

func (m *EchoRequest) GetClusterAddrs() []string

func (*EchoRequest) GetMessage Uses

func (m *EchoRequest) GetMessage() string

func (*EchoRequest) GetRaftAppliedIndex Uses

func (m *EchoRequest) GetRaftAppliedIndex() uint64

func (*EchoRequest) GetRaftNodeID Uses

func (m *EchoRequest) GetRaftNodeID() string

func (*EchoRequest) ProtoMessage Uses

func (*EchoRequest) ProtoMessage()

func (*EchoRequest) Reset Uses

func (m *EchoRequest) Reset()

func (*EchoRequest) String Uses

func (m *EchoRequest) String() string

func (*EchoRequest) XXX_DiscardUnknown Uses

func (m *EchoRequest) XXX_DiscardUnknown()

func (*EchoRequest) XXX_Marshal Uses

func (m *EchoRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*EchoRequest) XXX_Merge Uses

func (m *EchoRequest) XXX_Merge(src proto.Message)

func (*EchoRequest) XXX_Size Uses

func (m *EchoRequest) XXX_Size() int

func (*EchoRequest) XXX_Unmarshal Uses

func (m *EchoRequest) XXX_Unmarshal(b []byte) error

type EncodedKeyring Uses

type EncodedKeyring struct {
    MasterKey []byte
    Keys      []*Key
}

EncodedKeyring is used for serialization of the keyring

type EntityCounter Uses

type EntityCounter struct {
    // Total is the total number of entities
    Total int `json:"total"`
}

EntityCounter counts the number of entities

type ErrInvalidKey Uses

type ErrInvalidKey struct {
    Reason string
}

ErrInvalidKey is returned if there is a user-based error with a provided unseal key. This will be shown to the user, so should not contain information that is sensitive.

func (*ErrInvalidKey) Error Uses

func (e *ErrInvalidKey) Error() string

type ExpirationManager Uses

type ExpirationManager struct {
    // contains filtered or unexported fields
}

ExpirationManager is used by the Core to manage leases. Secrets can provide a lease, meaning that they can be renewed or revoked. If a secret is not renewed in timely manner, it may be expired, and the ExpirationManager will handle doing automatic revocation.

func NewExpirationManager Uses

func NewExpirationManager(c *Core, view *BarrierView, e ExpireLeaseStrategy, logger log.Logger) *ExpirationManager

NewExpirationManager creates a new ExpirationManager that is backed using a given view, and uses the provided router for revocation.

func (*ExpirationManager) CreateOrFetchRevocationLeaseByToken Uses

func (m *ExpirationManager) CreateOrFetchRevocationLeaseByToken(ctx context.Context, te *logical.TokenEntry) (string, error)

CreateOrFetchRevocationLeaseByToken is used to create or fetch the matching leaseID for a particular token. The lease is set to expire immediately after it's created.

func (*ExpirationManager) FetchLeaseTimes Uses

func (m *ExpirationManager) FetchLeaseTimes(ctx context.Context, leaseID string) (*leaseEntry, error)

FetchLeaseTimes is used to fetch the issue time, expiration time, and last renewed time of a lease entry. It returns a leaseEntry itself, but with only those values copied over.

func (*ExpirationManager) FetchLeaseTimesByToken Uses

func (m *ExpirationManager) FetchLeaseTimesByToken(ctx context.Context, te *logical.TokenEntry) (*leaseEntry, error)

FetchLeaseTimesByToken is a helper function to use token values to compute the leaseID, rather than pushing that logic back into the token store. As a special case, for a batch token it simply returns the information encoded on it.

func (*ExpirationManager) LazyRevoke Uses

func (m *ExpirationManager) LazyRevoke(ctx context.Context, leaseID string) error

LazyRevoke is used to queue revocation for a secret named by the given LeaseID. If the lease was not found it returns nil; if the lease was found it triggers a return of a 202.

func (*ExpirationManager) Register Uses

func (m *ExpirationManager) Register(ctx context.Context, req *logical.Request, resp *logical.Response) (id string, retErr error)

Register is used to take a request and response with an associated lease. The secret gets assigned a LeaseID and the management of of lease is assumed by the expiration manager.

func (*ExpirationManager) RegisterAuth Uses

func (m *ExpirationManager) RegisterAuth(ctx context.Context, te *logical.TokenEntry, auth *logical.Auth) error

RegisterAuth is used to take an Auth response with an associated lease. The token does not get a LeaseID, but the lease management is handled by the expiration manager.

func (*ExpirationManager) Renew Uses

func (m *ExpirationManager) Renew(ctx context.Context, leaseID string, increment time.Duration) (*logical.Response, error)

Renew is used to renew a secret using the given leaseID and a renew interval. The increment may be ignored.

func (*ExpirationManager) RenewToken Uses

func (m *ExpirationManager) RenewToken(ctx context.Context, req *logical.Request, te *logical.TokenEntry,
    increment time.Duration) (*logical.Response, error)

RenewToken is used to renew a token which does not need to invoke a logical backend.

func (*ExpirationManager) Restore Uses

func (m *ExpirationManager) Restore(errorFunc func()) (retErr error)

Restore is used to recover the lease states when starting. This is used after starting the vault.

func (*ExpirationManager) Revoke Uses

func (m *ExpirationManager) Revoke(ctx context.Context, leaseID string) error

Revoke is used to revoke a secret named by the given LeaseID

func (*ExpirationManager) RevokeByToken Uses

func (m *ExpirationManager) RevokeByToken(ctx context.Context, te *logical.TokenEntry) error

RevokeByToken is used to revoke all the secrets issued with a given token. This is done by using the secondary index. It also removes the lease entry for the token itself. As a result it should *ONLY* ever be called from the token store's revokeSalted function.

func (*ExpirationManager) RevokeForce Uses

func (m *ExpirationManager) RevokeForce(ctx context.Context, prefix string) error

RevokeForce works similarly to RevokePrefix but continues in the case of a revocation error; this is mostly meant for recovery operations

func (*ExpirationManager) RevokePrefix Uses

func (m *ExpirationManager) RevokePrefix(ctx context.Context, prefix string, sync bool) error

RevokePrefix is used to revoke all secrets with a given prefix. The prefix maps to that of the mount table to make this simpler to reason about.

func (*ExpirationManager) Stop Uses

func (m *ExpirationManager) Stop() error

Stop is used to prevent further automatic revocations. This must be called before sealing the view.

func (*ExpirationManager) Tidy Uses

func (m *ExpirationManager) Tidy(ctx context.Context) error

Tidy cleans up the dangling storage entries for leases. It scans the storage view to find all the available leases, checks if the token embedded in it is either empty or invalid and in both the cases, it revokes them. It also uses a token cache to avoid multiple lookups of the same token ID. It is normally not required to use the API that invokes this. This is only intended to clean up the corrupt storage due to bugs.

type ExpireLeaseStrategy Uses

type ExpireLeaseStrategy func(context.Context, *ExpirationManager, *leaseEntry)

type GenerateRootConfig Uses

type GenerateRootConfig struct {
    Nonce          string
    PGPKey         string
    PGPFingerprint string
    OTP            string
    Strategy       GenerateRootStrategy
}

GenerateRootConfig holds the configuration for a root generation command.

type GenerateRootResult Uses

type GenerateRootResult struct {
    Progress       int
    Required       int
    EncodedToken   string
    PGPFingerprint string
}

GenerateRootResult holds the result of a root generation update command

type GenerateRootStrategy Uses

type GenerateRootStrategy interface {
    // contains filtered or unexported methods
}

GenerateRootStrategy allows us to swap out the strategy we want to use to create a token upon completion of the generate root process.

var (
    // GenerateStandardRootTokenStrategy is the strategy used to generate a
    // typical root token
    GenerateStandardRootTokenStrategy GenerateRootStrategy = generateStandardRootToken{}

    // GenerateDROperationTokenStrategy is the strategy used to generate a
    // DR operational token
    GenerateDROperationTokenStrategy GenerateRootStrategy = generateStandardRootToken{}
)

func GenerateRecoveryTokenStrategy Uses

func GenerateRecoveryTokenStrategy(token *atomic.String) GenerateRootStrategy

GenerateRecoveryTokenStrategy is the strategy used to generate a recovery token

type HandlerProperties Uses

type HandlerProperties struct {
    Core                         *Core
    MaxRequestSize               int64
    MaxRequestDuration           time.Duration
    DisablePrintableCheck        bool
    RecoveryMode                 bool
    RecoveryToken                *uberAtomic.String
    UnauthenticatedMetricsAccess bool
}

HandlerProperties is used to seed configuration into a vaulthttp.Handler. It's in this package to avoid a circular dependency

type IdentityFactor Uses

type IdentityFactor struct {
    GroupIDs          []string `hcl:"group_ids"`
    GroupNames        []string `hcl:"group_names"`
    ApprovalsRequired int      `hcl:"approvals"`
}

type IdentityStore Uses

type IdentityStore struct {
    // IdentityStore is a secret backend in Vault
    *framework.Backend
    // contains filtered or unexported fields
}

IdentityStore is composed of its own storage view and a MemDB which maintains active in-memory replicas of the storage contents indexed by multiple fields.

func NewIdentityStore Uses

func NewIdentityStore(ctx context.Context, core *Core, config *logical.BackendConfig, logger log.Logger) (*IdentityStore, error)

func (*IdentityStore) CreateOrFetchEntity Uses

func (i *IdentityStore) CreateOrFetchEntity(ctx context.Context, alias *logical.Alias) (*identity.Entity, error)

CreateOrFetchEntity creates a new entity. This is used by core to associate each login attempt by an alias to a unified entity in Vault.

func (*IdentityStore) Invalidate Uses

func (i *IdentityStore) Invalidate(ctx context.Context, key string)

Invalidate is a callback wherein the backend is informed that the value at the given key is updated. In identity store's case, it would be the entity storage entries that get updated. The value needs to be read and MemDB needs to be updated accordingly.

func (*IdentityStore) MemDBAliasByFactors Uses

func (i *IdentityStore) MemDBAliasByFactors(mountAccessor, aliasName string, clone bool, groupAlias bool) (*identity.Alias, error)

func (*IdentityStore) MemDBAliasByFactorsInTxn Uses

func (i *IdentityStore) MemDBAliasByFactorsInTxn(txn *memdb.Txn, mountAccessor, aliasName string, clone bool, groupAlias bool) (*identity.Alias, error)

func (*IdentityStore) MemDBAliasByID Uses

func (i *IdentityStore) MemDBAliasByID(aliasID string, clone bool, groupAlias bool) (*identity.Alias, error)

func (*IdentityStore) MemDBAliasByIDInTxn Uses

func (i *IdentityStore) MemDBAliasByIDInTxn(txn *memdb.Txn, aliasID string, clone bool, groupAlias bool) (*identity.Alias, error)

func (*IdentityStore) MemDBAliases Uses

func (i *IdentityStore) MemDBAliases(ws memdb.WatchSet, groupAlias bool) (memdb.ResultIterator, error)

func (*IdentityStore) MemDBDeleteAliasByIDInTxn Uses

func (i *IdentityStore) MemDBDeleteAliasByIDInTxn(txn *memdb.Txn, aliasID string, groupAlias bool) error

func (*IdentityStore) MemDBDeleteEntityByID Uses

func (i *IdentityStore) MemDBDeleteEntityByID(entityID string) error

func (*IdentityStore) MemDBDeleteEntityByIDInTxn Uses

func (i *IdentityStore) MemDBDeleteEntityByIDInTxn(txn *memdb.Txn, entityID string) error

func (*IdentityStore) MemDBDeleteGroupByIDInTxn Uses

func (i *IdentityStore) MemDBDeleteGroupByIDInTxn(txn *memdb.Txn, groupID string) error

func (*IdentityStore) MemDBEntitiesByBucketKeyInTxn Uses

func (i *IdentityStore) MemDBEntitiesByBucketKeyInTxn(txn *memdb.Txn, bucketKey string) ([]*identity.Entity, error)

func (*IdentityStore) MemDBEntityByAliasID Uses

func (i *IdentityStore) MemDBEntityByAliasID(aliasID string, clone bool) (*identity.Entity, error)

func (*IdentityStore) MemDBEntityByAliasIDInTxn Uses

func (i *IdentityStore) MemDBEntityByAliasIDInTxn(txn *memdb.Txn, aliasID string, clone bool) (*identity.Entity, error)

func (*IdentityStore) MemDBEntityByID Uses

func (i *IdentityStore) MemDBEntityByID(entityID string, clone bool) (*identity.Entity, error)

func (*IdentityStore) MemDBEntityByIDInTxn Uses

func (i *IdentityStore) MemDBEntityByIDInTxn(txn *memdb.Txn, entityID string, clone bool) (*identity.Entity, error)

func (*IdentityStore) MemDBEntityByMergedEntityID Uses

func (i *IdentityStore) MemDBEntityByMergedEntityID(mergedEntityID string, clone bool) (*identity.Entity, error)

func (*IdentityStore) MemDBEntityByName Uses

func (i *IdentityStore) MemDBEntityByName(ctx context.Context, entityName string, clone bool) (*identity.Entity, error)

func (*IdentityStore) MemDBEntityByNameInTxn Uses

func (i *IdentityStore) MemDBEntityByNameInTxn(ctx context.Context, txn *memdb.Txn, entityName string, clone bool) (*identity.Entity, error)

func (*IdentityStore) MemDBGroupByAliasID Uses

func (i *IdentityStore) MemDBGroupByAliasID(aliasID string, clone bool) (*identity.Group, error)

func (*IdentityStore) MemDBGroupByAliasIDInTxn Uses

func (i *IdentityStore) MemDBGroupByAliasIDInTxn(txn *memdb.Txn, aliasID string, clone bool) (*identity.Group, error)

func (*IdentityStore) MemDBGroupByID Uses

func (i *IdentityStore) MemDBGroupByID(groupID string, clone bool) (*identity.Group, error)

func (*IdentityStore) MemDBGroupByIDInTxn Uses

func (i *IdentityStore) MemDBGroupByIDInTxn(txn *memdb.Txn, groupID string, clone bool) (*identity.Group, error)

func (*IdentityStore) MemDBGroupByName Uses

func (i *IdentityStore) MemDBGroupByName(ctx context.Context, groupName string, clone bool) (*identity.Group, error)

func (*IdentityStore) MemDBGroupByNameInTxn Uses

func (i *IdentityStore) MemDBGroupByNameInTxn(ctx context.Context, txn *memdb.Txn, groupName string, clone bool) (*identity.Group, error)

func (*IdentityStore) MemDBGroupsByBucketKeyInTxn Uses

func (i *IdentityStore) MemDBGroupsByBucketKeyInTxn(txn *memdb.Txn, bucketKey string) ([]*identity.Group, error)

func (*IdentityStore) MemDBGroupsByMemberEntityID Uses

func (i *IdentityStore) MemDBGroupsByMemberEntityID(entityID string, clone bool, externalOnly bool) ([]*identity.Group, error)

func (*IdentityStore) MemDBGroupsByMemberEntityIDInTxn Uses

func (i *IdentityStore) MemDBGroupsByMemberEntityIDInTxn(txn *memdb.Txn, entityID string, clone bool, externalOnly bool) ([]*identity.Group, error)

func (*IdentityStore) MemDBGroupsByParentGroupID Uses

func (i *IdentityStore) MemDBGroupsByParentGroupID(memberGroupID string, clone bool) ([]*identity.Group, error)

func (*IdentityStore) MemDBGroupsByParentGroupIDInTxn Uses

func (i *IdentityStore) MemDBGroupsByParentGroupIDInTxn(txn *memdb.Txn, memberGroupID string, clone bool) ([]*identity.Group, error)

func (*IdentityStore) MemDBUpsertAliasInTxn Uses

func (i *IdentityStore) MemDBUpsertAliasInTxn(txn *memdb.Txn, alias *identity.Alias, groupAlias bool) error

func (*IdentityStore) MemDBUpsertEntityInTxn Uses

func (i *IdentityStore) MemDBUpsertEntityInTxn(txn *memdb.Txn, entity *identity.Entity) error

func (*IdentityStore) MemDBUpsertGroupInTxn Uses

func (i *IdentityStore) MemDBUpsertGroupInTxn(txn *memdb.Txn, group *identity.Group) error

func (*IdentityStore) UpsertGroup Uses

func (i *IdentityStore) UpsertGroup(ctx context.Context, group *identity.Group, persist bool) error

func (*IdentityStore) UpsertGroupInTxn Uses

func (i *IdentityStore) UpsertGroupInTxn(ctx context.Context, txn *memdb.Txn, group *identity.Group, persist bool) error

type InitParams Uses

type InitParams struct {
    BarrierConfig   *SealConfig
    RecoveryConfig  *SealConfig
    RootTokenPGPKey string
    // LegacyShamirSeal should only be used in test code, we don't want to
    // give the user a way to create legacy shamir seals.
    LegacyShamirSeal bool
}

InitParams keeps the init function from being littered with too many params, that's it!

type InitResult Uses

type InitResult struct {
    SecretShares   [][]byte
    RecoveryShares [][]byte
    RootToken      string
}

InitResult is used to provide the key parts back after they are generated as part of the initialization.

type InitializableBackend Uses

type InitializableBackend struct {
    *NoopBackend
    // contains filtered or unexported fields
}

InitializableBackend is a backend that knows whether it has been initialized properly.

func (*InitializableBackend) Initialize Uses

func (b *InitializableBackend) Initialize(ctx context.Context, req *logical.InitializationRequest) error

type Key Uses

type Key struct {
    Term        uint32
    Version     int
    Value       []byte
    InstallTime time.Time
}

Key represents a single term, along with the key used.

func DeserializeKey Uses

func DeserializeKey(buf []byte) (*Key, error)

DeserializeKey is used to deserialize and return a new key

func (*Key) Serialize Uses

func (k *Key) Serialize() ([]byte, error)

Serialize is used to create a byte encoded key

type KeyInfo Uses

type KeyInfo struct {
    Term        int
    InstallTime time.Time
}

KeyInfo is used to convey information about the encryption key

type Keyring Uses

type Keyring struct {
    // contains filtered or unexported fields
}

Keyring is used to manage multiple encryption keys used by the barrier. New keys can be installed and each has a sequential term. The term used to encrypt a key is prefixed to the key written out. All data is encrypted with the latest key, but storing the old keys allows for decryption of keys written previously. Along with the encryption keys, the keyring also tracks the master key. This is necessary so that when a new key is added to the keyring, we can encrypt with the master key and write out the new keyring.

func DeserializeKeyring Uses

func DeserializeKeyring(buf []byte) (*Keyring, error)

DeserializeKeyring is used to deserialize and return a new keyring

func NewKeyring Uses

func NewKeyring() *Keyring

NewKeyring creates a new keyring

func (*Keyring) ActiveKey Uses

func (k *Keyring) ActiveKey() *Key

ActiveKey returns the active encryption key, or nil

func (*Keyring) ActiveTerm Uses

func (k *Keyring) ActiveTerm() uint32

ActiveTerm returns the currently active term

func (*Keyring) AddKey Uses

func (k *Keyring) AddKey(key *Key) (*Keyring, error)

AddKey adds a new key to the keyring

func (*Keyring) Clone Uses

func (k *Keyring) Clone() *Keyring

Clone returns a new copy of the keyring

func (*Keyring) MasterKey Uses

func (k *Keyring) MasterKey() []byte

MasterKey returns the master key

func (*Keyring) RemoveKey Uses

func (k *Keyring) RemoveKey(term uint32) (*Keyring, error)

RemoveKey removes a key from the keyring

func (*Keyring) Serialize Uses

func (k *Keyring) Serialize() ([]byte, error)

Serialize is used to create a byte encoded keyring

func (*Keyring) SetMasterKey Uses

func (k *Keyring) SetMasterKey(val []byte) *Keyring

SetMasterKey is used to update the master key

func (*Keyring) TermKey Uses

func (k *Keyring) TermKey(term uint32) *Key

TermKey returns the key for the given term, or nil

func (*Keyring) Zeroize Uses

func (k *Keyring) Zeroize(keysToo bool)

N.B.: Since Go 1.5 these are not reliable; see the documentation around the memzero function. These are best-effort.

type LicensingConfig Uses

type LicensingConfig struct {
    AdditionalPublicKeys []interface{}
}

type ListingVisibilityType Uses

type ListingVisibilityType string

ListingVisibilityType represents the types for listing visibility

const (
    // ListingVisibilityDefault is the default value for listing visibility
    ListingVisibilityDefault ListingVisibilityType = ""
    // ListingVisibilityHidden is the hidden type for listing visibility
    ListingVisibilityHidden ListingVisibilityType = "hidden"
    // ListingVisibilityUnauth is the unauth type for listing visibility
    ListingVisibilityUnauth ListingVisibilityType = "unauth"

    MountTableUpdateStorage   = true
    MountTableNoUpdateStorage = false
)

type MountConfig Uses

type MountConfig struct {
    DefaultLeaseTTL           time.Duration         `json:"default_lease_ttl" structs:"default_lease_ttl" mapstructure:"default_lease_ttl"` // Override for global default
    MaxLeaseTTL               time.Duration         `json:"max_lease_ttl" structs:"max_lease_ttl" mapstructure:"max_lease_ttl"`             // Override for global default
    ForceNoCache              bool                  `json:"force_no_cache" structs:"force_no_cache" mapstructure:"force_no_cache"`          // Override for global default
    AuditNonHMACRequestKeys   []string              `json:"audit_non_hmac_request_keys,omitempty" structs:"audit_non_hmac_request_keys" mapstructure:"audit_non_hmac_request_keys"`
    AuditNonHMACResponseKeys  []string              `json:"audit_non_hmac_response_keys,omitempty" structs:"audit_non_hmac_response_keys" mapstructure:"audit_non_hmac_response_keys"`
    ListingVisibility         ListingVisibilityType `json:"listing_visibility,omitempty" structs:"listing_visibility" mapstructure:"listing_visibility"`
    PassthroughRequestHeaders []string              `json:"passthrough_request_headers,omitempty" structs:"passthrough_request_headers" mapstructure:"passthrough_request_headers"`
    AllowedResponseHeaders    []string              `json:"allowed_response_headers,omitempty" structs:"allowed_response_headers" mapstructure:"allowed_response_headers"`
    TokenType                 logical.TokenType     `json:"token_type" structs:"token_type" mapstructure:"token_type"`

    // PluginName is the name of the plugin registered in the catalog.
    //
    // Deprecated: MountEntry.Type should be used instead for Vault 1.0.0 and beyond.
    PluginName string `json:"plugin_name,omitempty" structs:"plugin_name,omitempty" mapstructure:"plugin_name"`
}

MountConfig is used to hold settable options

type MountEntry Uses

type MountEntry struct {
    Table                 string            `json:"table"`                   // The table it belongs to
    Path                  string            `json:"path"`                    // Mount Path
    Type                  string            `json:"type"`                    // Logical backend Type
    Description           string            `json:"description"`             // User-provided description
    UUID                  string            `json:"uuid"`                    // Barrier view UUID
    BackendAwareUUID      string            `json:"backend_aware_uuid"`      // UUID that can be used by the backend as a helper when a consistent value is needed outside of storage.
    Accessor              string            `json:"accessor"`                // Unique but more human-friendly ID. Does not change, not used for any sensitive things (like as a salt, which the UUID sometimes is).
    Config                MountConfig       `json:"config"`                  // Configuration related to this mount (but not backend-derived)
    Options               map[string]string `json:"options"`                 // Backend options
    Local                 bool              `json:"local"`                   // Local mounts are not replicated or affected by replication
    SealWrap              bool              `json:"seal_wrap"`               // Whether to wrap CSPs
    ExternalEntropyAccess bool              `json:"external_entropy_access"` // Whether to allow external entropy source access
    Tainted               bool              `json:"tainted,omitempty"`       // Set as a Write-Ahead flag for unmount/remount
    NamespaceID           string            `json:"namespace_id"`
    // contains filtered or unexported fields
}

MountEntry is used to represent a mount table entry

func (*MountEntry) APIPath Uses

func (e *MountEntry) APIPath() string

APIPath returns the full API Path for the given mount entry

func (*MountEntry) Clone Uses

func (e *MountEntry) Clone() (*MountEntry, error)

Clone returns a deep copy of the mount entry

func (*MountEntry) Namespace Uses

func (e *MountEntry) Namespace() *namespace.Namespace

Namespace returns the namespace for the mount entry

func (*MountEntry) SyncCache Uses

func (e *MountEntry) SyncCache()

SyncCache syncs tunable configuration values to the cache. In the case of cached values, they should be retrieved via synthesizedConfigCache.Load() instead of accessing them directly through MountConfig.

func (*MountEntry) ViewPath Uses

func (e *MountEntry) ViewPath() string

ViewPath returns storage prefix for the view

type MountTable Uses

type MountTable struct {
    Type    string        `json:"type"`
    Entries []*MountEntry `json:"entries"`
}

MountTable is used to represent the internal mount table

type NonFatalError Uses

type NonFatalError struct {
    Err error
}

NonFatalError is an error that can be returned during NewCore that should be displayed but not cause a program exit

func NewNonFatalError Uses

func NewNonFatalError(err error) *NonFatalError

NewNonFatalError returns a new non-fatal error.

func (*NonFatalError) Error Uses

func (e *NonFatalError) Error() string

func (*NonFatalError) WrappedErrors Uses

func (e *NonFatalError) WrappedErrors() []error

type NoopAudit Uses

type NoopAudit struct {
    Config         *audit.BackendConfig
    ReqErr         error
    ReqAuth        []*logical.Auth
    Req            []*logical.Request
    ReqHeaders     []map[string][]string
    ReqNonHMACKeys []string
    ReqErrs        []error

    RespErr            error
    RespAuth           []*logical.Auth
    RespReq            []*logical.Request
    Resp               []*logical.Response
    RespNonHMACKeys    []string
    RespReqNonHMACKeys []string
    RespErrs           []error
    // contains filtered or unexported fields
}

func (*NoopAudit) GetHash Uses

func (n *NoopAudit) GetHash(ctx context.Context, data string) (string, error)

func (*NoopAudit) Invalidate Uses

func (n *NoopAudit) Invalidate(ctx context.Context)

func (*NoopAudit) LogRequest Uses

func (n *NoopAudit) LogRequest(ctx context.Context, in *logical.LogInput) error

func (*NoopAudit) LogResponse Uses

func (n *NoopAudit) LogResponse(ctx context.Context, in *logical.LogInput) error

func (*NoopAudit) Reload Uses

func (n *NoopAudit) Reload(ctx context.Context) error

func (*NoopAudit) Salt Uses

func (n *NoopAudit) Salt(ctx context.Context) (*salt.Salt, error)

type NoopBackend Uses

type NoopBackend struct {
    sync.Mutex

    Root            []string
    Login           []string
    Paths           []string
    Requests        []*logical.Request
    Response        *logical.Response
    RequestHandler  RouterTestHandlerFunc
    Invalidations   []string
    DefaultLeaseTTL time.Duration
    MaxLeaseTTL     time.Duration
    BackendType     logical.BackendType
}

func (*NoopBackend) Cleanup Uses

func (n *NoopBackend) Cleanup(ctx context.Context)

func (*NoopBackend) HandleExistenceCheck Uses

func (n *NoopBackend) HandleExistenceCheck(ctx context.Context, req *logical.Request) (bool, bool, error)

func (*NoopBackend) HandleRequest Uses

func (n *NoopBackend) HandleRequest(ctx context.Context, req *logical.Request) (*logical.Response, error)

func (*NoopBackend) Initialize Uses

func (n *NoopBackend) Initialize(ctx context.Context, req *logical.InitializationRequest) error

func (*NoopBackend) InvalidateKey Uses

func (n *NoopBackend) InvalidateKey(ctx context.Context, k string)

func (*NoopBackend) Logger Uses

func (n *NoopBackend) Logger() log.Logger

func (*NoopBackend) Setup Uses

func (n *NoopBackend) Setup(ctx context.Context, config *logical.BackendConfig) error

func (*NoopBackend) SpecialPaths Uses

func (n *NoopBackend) SpecialPaths() *logical.Paths

func (*NoopBackend) System Uses

func (n *NoopBackend) System() logical.SystemView

func (*NoopBackend) Type Uses

func (n *NoopBackend) Type() logical.BackendType

type PassthroughBackend Uses

type PassthroughBackend struct {
    *framework.Backend
    // contains filtered or unexported fields
}

PassthroughBackend is used storing secrets directly into the physical backend. The secrets are encrypted in the durable storage and custom TTL information can be specified, but otherwise this backend doesn't do anything fancy.

func (*PassthroughBackend) GeneratesLeases Uses

func (b *PassthroughBackend) GeneratesLeases() bool

type PathRules Uses

type PathRules struct {
    Path                string
    Policy              string
    Permissions         *ACLPermissions
    IsPrefix            bool
    HasSegmentWildcards bool
    Capabilities        []string

    // These keys are used at the top level to make the HCL nicer; we store in
    // the ACLPermissions object though
    MinWrappingTTLHCL     interface{}              `hcl:"min_wrapping_ttl"`
    MaxWrappingTTLHCL     interface{}              `hcl:"max_wrapping_ttl"`
    AllowedParametersHCL  map[string][]interface{} `hcl:"allowed_parameters"`
    DeniedParametersHCL   map[string][]interface{} `hcl:"denied_parameters"`
    RequiredParametersHCL []string                 `hcl:"required_parameters"`
    MFAMethodsHCL         []string                 `hcl:"mfa_methods"`
    ControlGroupHCL       *ControlGroupHCL         `hcl:"control_group"`
}

PathRules represents a policy for a path in the namespace.

type PerfStandbyElectionInput Uses

type PerfStandbyElectionInput struct {
    XXX_NoUnkeyedLiteral struct{} `json:"-"`
    XXX_unrecognized     []byte   `json:"-"`
    XXX_sizecache        int32    `json:"-"`
}

func (*PerfStandbyElectionInput) Descriptor Uses

func (*PerfStandbyElectionInput) Descriptor() ([]byte, []int)

func (*PerfStandbyElectionInput) ProtoMessage Uses

func (*PerfStandbyElectionInput) ProtoMessage()

func (*PerfStandbyElectionInput) Reset Uses

func (m *PerfStandbyElectionInput) Reset()

func (*PerfStandbyElectionInput) String Uses

func (m *PerfStandbyElectionInput) String() string

func (*PerfStandbyElectionInput) XXX_DiscardUnknown Uses

func (m *PerfStandbyElectionInput) XXX_DiscardUnknown()

func (*PerfStandbyElectionInput) XXX_Marshal Uses

func (m *PerfStandbyElectionInput) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*PerfStandbyElectionInput) XXX_Merge Uses

func (m *PerfStandbyElectionInput) XXX_Merge(src proto.Message)

func (*PerfStandbyElectionInput) XXX_Size Uses

func (m *PerfStandbyElectionInput) XXX_Size() int

func (*PerfStandbyElectionInput) XXX_Unmarshal Uses

func (m *PerfStandbyElectionInput) XXX_Unmarshal(b []byte) error

type PerfStandbyElectionResponse Uses

type PerfStandbyElectionResponse struct {
    ID                   string     `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
    ClusterID            string     `protobuf:"bytes,2,opt,name=cluster_id,json=clusterId,proto3" json:"cluster_id,omitempty"`
    PrimaryClusterAddr   string     `protobuf:"bytes,3,opt,name=primary_cluster_addr,json=primaryClusterAddr,proto3" json:"primary_cluster_addr,omitempty"`
    CaCert               []byte     `protobuf:"bytes,4,opt,name=ca_cert,json=caCert,proto3" json:"ca_cert,omitempty"`
    ClientCert           []byte     `protobuf:"bytes,5,opt,name=client_cert,json=clientCert,proto3" json:"client_cert,omitempty"`
    ClientKey            *ClientKey `protobuf:"bytes,6,opt,name=client_key,json=clientKey,proto3" json:"client_key,omitempty"`
    XXX_NoUnkeyedLiteral struct{}   `json:"-"`
    XXX_unrecognized     []byte     `json:"-"`
    XXX_sizecache        int32      `json:"-"`
}

func (*PerfStandbyElectionResponse) Descriptor Uses

func (*PerfStandbyElectionResponse) Descriptor() ([]byte, []int)

func (*PerfStandbyElectionResponse) GetCaCert Uses

func (m *PerfStandbyElectionResponse) GetCaCert() []byte

func (*PerfStandbyElectionResponse) GetClientCert Uses

func (m *PerfStandbyElectionResponse) GetClientCert() []byte

func (*PerfStandbyElectionResponse) GetClientKey Uses

func (m *PerfStandbyElectionResponse) GetClientKey() *ClientKey

func (*PerfStandbyElectionResponse) GetClusterID Uses

func (m *PerfStandbyElectionResponse) GetClusterID() string

func (*PerfStandbyElectionResponse) GetID Uses

func (m *PerfStandbyElectionResponse) GetID() string

func (*PerfStandbyElectionResponse) GetPrimaryClusterAddr Uses

func (m *PerfStandbyElectionResponse) GetPrimaryClusterAddr() string

func (*PerfStandbyElectionResponse) ProtoMessage Uses

func (*PerfStandbyElectionResponse) ProtoMessage()

func (*PerfStandbyElectionResponse) Reset Uses

func (m *PerfStandbyElectionResponse) Reset()

func (*PerfStandbyElectionResponse) String Uses

func (m *PerfStandbyElectionResponse) String() string

func (*PerfStandbyElectionResponse) XXX_DiscardUnknown Uses

func (m *PerfStandbyElectionResponse) XXX_DiscardUnknown()

func (*PerfStandbyElectionResponse) XXX_Marshal Uses

func (m *PerfStandbyElectionResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*PerfStandbyElectionResponse) XXX_Merge Uses

func (m *PerfStandbyElectionResponse) XXX_Merge(src proto.Message)

func (*PerfStandbyElectionResponse) XXX_Size Uses

func (m *PerfStandbyElectionResponse) XXX_Size() int

func (*PerfStandbyElectionResponse) XXX_Unmarshal Uses

func (m *PerfStandbyElectionResponse) XXX_Unmarshal(b []byte) error

type PhysicalBackendBundle Uses

type PhysicalBackendBundle struct {
    Backend   physical.Backend
    HABackend physical.HABackend
    Cleanup   func()
}

type PluginCatalog Uses

type PluginCatalog struct {
    // contains filtered or unexported fields
}

PluginCatalog keeps a record of plugins known to vault. External plugins need to be registered to the catalog before they can be used in backends. Builtin plugins are automatically detected and included in the catalog.

func (*PluginCatalog) Delete Uses

func (c *PluginCatalog) Delete(ctx context.Context, name string, pluginType consts.PluginType) error

Delete is used to remove an external plugin from the catalog. Builtin plugins can not be deleted.

func (*PluginCatalog) Get Uses

func (c *PluginCatalog) Get(ctx context.Context, name string, pluginType consts.PluginType) (*pluginutil.PluginRunner, error)

Get retrieves a plugin with the specified name from the catalog. It first looks for external plugins with this name and then looks for builtin plugins. It returns a PluginRunner or an error if no plugin was found.

func (*PluginCatalog) List Uses

func (c *PluginCatalog) List(ctx context.Context, pluginType consts.PluginType) ([]string, error)

List returns a list of all the known plugin names. If an external and builtin plugin share the same name, only one instance of the name will be returned.

func (*PluginCatalog) Set Uses

func (c *PluginCatalog) Set(ctx context.Context, name string, pluginType consts.PluginType, command string, args []string, env []string, sha256 []byte) error

Set registers a new external plugin with the catalog, or updates an existing external plugin. It takes the name, command and SHA256 of the plugin.

func (*PluginCatalog) UpgradePlugins Uses

func (c *PluginCatalog) UpgradePlugins(ctx context.Context, logger log.Logger) error

UpdatePlugins will loop over all the plugins of unknown type and attempt to upgrade them to typed plugins

type Policy Uses

type Policy struct {
    Name      string       `hcl:"name"`
    Paths     []*PathRules `hcl:"-"`
    Raw       string
    Type      PolicyType
    Templated bool
    // contains filtered or unexported fields
}

Policy is used to represent the policy specified by an ACL configuration.

func ParseACLPolicy Uses

func ParseACLPolicy(ns *namespace.Namespace, rules string) (*Policy, error)

ParseACLPolicy is used to parse the specified ACL rules into an intermediary set of policies, before being compiled into the ACL

func (*Policy) ShallowClone Uses

func (p *Policy) ShallowClone() *Policy

ShallowClone returns a shallow clone of the policy. This should not be used if any of the reference-typed fields are going to be modified

type PolicyCheckOpts Uses

type PolicyCheckOpts struct {
    RootPrivsRequired bool
    Unauth            bool
}

type PolicyEntry Uses

type PolicyEntry struct {
    Version   int
    Raw       string
    Templated bool
    Type      PolicyType
    // contains filtered or unexported fields
}

PolicyEntry is used to store a policy by name

type PolicyStore Uses

type PolicyStore struct {
    // contains filtered or unexported fields
}

PolicyStore is used to provide durable storage of policy, and to manage ACLs associated with them.

func NewPolicyStore Uses

func NewPolicyStore(ctx context.Context, core *Core, baseView *BarrierView, system logical.SystemView, logger log.Logger) (*PolicyStore, error)

NewPolicyStore creates a new PolicyStore that is backed using a given view. It used used to durable store and manage named policy.

func (*PolicyStore) ACL Uses

func (ps *PolicyStore) ACL(ctx context.Context, entity *identity.Entity, policyNames map[string][]string) (*ACL, error)

ACL is used to return an ACL which is built using the named policies.

func (*PolicyStore) DeletePolicy Uses

func (ps *PolicyStore) DeletePolicy(ctx context.Context, name string, policyType PolicyType) error

DeletePolicy is used to delete the named policy

func (*PolicyStore) GetPolicy Uses

func (ps *PolicyStore) GetPolicy(ctx context.Context, name string, policyType PolicyType) (*Policy, error)

GetPolicy is used to fetch the named policy

func (*PolicyStore) ListPolicies Uses

func (ps *PolicyStore) ListPolicies(ctx context.Context, policyType PolicyType) ([]string, error)

ListPolicies is used to list the available policies

func (*PolicyStore) SetPolicy Uses

func (ps *PolicyStore) SetPolicy(ctx context.Context, p *Policy) error

SetPolicy is used to create or update the given policy

type PolicyType Uses

type PolicyType uint32
const (
    PolicyTypeACL PolicyType = iota
    PolicyTypeRGP
    PolicyTypeEGP

    // Triggers a lookup in the map to figure out if ACL or RGP
    PolicyTypeToken
)

func (PolicyType) String Uses

func (p PolicyType) String() string

type RawBackend Uses

type RawBackend struct {
    *framework.Backend
    // contains filtered or unexported fields
}

func NewRawBackend Uses

func NewRawBackend(core *Core) *RawBackend

type RegisterAuthFunc Uses

type RegisterAuthFunc func(context.Context, time.Duration, string, *logical.Auth) error

type RekeyBackup Uses

type RekeyBackup struct {
    Nonce string
    Keys  map[string][]string
}

RekeyBackup stores the backup copy of PGP-encrypted keys

type RekeyResult Uses

type RekeyResult struct {
    SecretShares         [][]byte
    PGPFingerprints      []string
    Backup               bool
    RecoveryKey          bool
    VerificationRequired bool
    VerificationNonce    string
}

RekeyResult is used to provide the key parts back after they are generated as part of the rekey.

type RekeyVerifyResult Uses

type RekeyVerifyResult struct {
    Complete bool
    Nonce    string
}

type ReplicationTokenInfo Uses

type ReplicationTokenInfo struct{}

type RequestCounter Uses

type RequestCounter struct {
    // Total is the number of requests seen during a given period.
    Total *uint64 `json:"total"`
}

RequestCounter stores the state of request counters for a single unspecified period.

type RequestForwardingClient Uses

type RequestForwardingClient interface {
    ForwardRequest(ctx context.Context, in *forwarding.Request, opts ...grpc.CallOption) (*forwarding.Response, error)
    Echo(ctx context.Context, in *EchoRequest, opts ...grpc.CallOption) (*EchoReply, error)
    PerformanceStandbyElectionRequest(ctx context.Context, in *PerfStandbyElectionInput, opts ...grpc.CallOption) (RequestForwarding_PerformanceStandbyElectionRequestClient, error)
}

RequestForwardingClient is the client API for RequestForwarding service.

For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.

func NewRequestForwardingClient Uses

func NewRequestForwardingClient(cc *grpc.ClientConn) RequestForwardingClient

type RequestForwardingServer Uses

type RequestForwardingServer interface {
    ForwardRequest(context.Context, *forwarding.Request) (*forwarding.Response, error)
    Echo(context.Context, *EchoRequest) (*EchoReply, error)
    PerformanceStandbyElectionRequest(*PerfStandbyElectionInput, RequestForwarding_PerformanceStandbyElectionRequestServer) error
}

RequestForwardingServer is the server API for RequestForwarding service.

type RequestForwarding_PerformanceStandbyElectionRequestClient Uses

type RequestForwarding_PerformanceStandbyElectionRequestClient interface {
    Recv() (*PerfStandbyElectionResponse, error)
    grpc.ClientStream
}

type RequestForwarding_PerformanceStandbyElectionRequestServer Uses

type RequestForwarding_PerformanceStandbyElectionRequestServer interface {
    Send(*PerfStandbyElectionResponse) error
    grpc.ServerStream
}

type RollbackManager Uses

type RollbackManager struct {
    // contains filtered or unexported fields
}

RollbackManager is responsible for performing rollbacks of partial secrets within logical backends.

During normal operations, it is possible for logical backends to error partially through an operation. These are called "partial secrets": they are never sent back to a user, but they do need to be cleaned up. This manager handles that by periodically (on a timer) requesting that the backends clean up.

The RollbackManager periodically initiates a logical.RollbackOperation on every mounted logical backend. It ensures that only one rollback operation is in-flight at any given time within a single seal/unseal phase.

func NewRollbackManager Uses

func NewRollbackManager(ctx context.Context, logger log.Logger, backendsFunc func() []*MountEntry, router *Router, core *Core) *RollbackManager

NewRollbackManager is used to create a new rollback manager

func (*RollbackManager) Rollback Uses

func (m *RollbackManager) Rollback(ctx context.Context, path string) error

Rollback is used to trigger an immediate rollback of the path, or to join an existing rollback operation if in flight. Caller should have core's statelock held (write OR read). If an already inflight rollback is happening this function will simply wait for it to complete

func (*RollbackManager) Start Uses

func (m *RollbackManager) Start()

Start starts the rollback manager

func (*RollbackManager) Stop Uses

func (m *RollbackManager) Stop()

Stop stops the running manager. This will wait for any in-flight rollbacks to complete.

type Router Uses

type Router struct {
    // contains filtered or unexported fields
}

Router is used to do prefix based routing of a request to a logical backend

func NewRouter Uses

func NewRouter() *Router

NewRouter returns a new router

func (*Router) LoginPath Uses

func (r *Router) LoginPath(ctx context.Context, path string) bool

LoginPath checks if the given path is used for logins

func (*Router) MatchingAPIPrefixByStoragePath Uses

func (r *Router) MatchingAPIPrefixByStoragePath(ctx context.Context, path string) (*namespace.Namespace, string, string, bool)

MatchingAPIPrefixByStoragePath the api path information for the given storage path

func (*Router) MatchingBackend Uses

func (r *Router) MatchingBackend(ctx context.Context, path string) logical.Backend

MatchingBackend returns the backend used for a path

func (*Router) MatchingMount Uses

func (r *Router) MatchingMount(ctx context.Context, path string) string

MatchingMount returns the mount prefix that would be used for a path

func (*Router) MatchingMountByAccessor Uses

func (r *Router) MatchingMountByAccessor(mountAccessor string) *MountEntry

MatchingMountByAccessor returns the MountEntry by accessor lookup

func (*Router) MatchingMountByUUID Uses

func (r *Router) MatchingMountByUUID(mountID string) *MountEntry

func (*Router) MatchingMountEntry Uses

func (r *Router) MatchingMountEntry(ctx context.Context, path string) *MountEntry

MatchingMountEntry returns the MountEntry used for a path

func (*Router) MatchingStorageByAPIPath Uses

func (r *Router) MatchingStorageByAPIPath(ctx context.Context, path string) logical.Storage

MatchingStorageByAPIPath/StoragePath returns the storage used for API/Storage paths respectively

func (*Router) MatchingStorageByStoragePath Uses

func (r *Router) MatchingStorageByStoragePath(ctx context.Context, path string) logical.Storage

func (*Router) MatchingStoragePrefixByAPIPath Uses

func (r *Router) MatchingStoragePrefixByAPIPath(ctx context.Context, path string) (string, bool)

MatchingStoragePrefixByAPIPath the storage prefix for the given api path

func (*Router) MatchingSystemView Uses

func (r *Router) MatchingSystemView(ctx context.Context, path string) logical.SystemView

MatchingSystemView returns the SystemView used for a path

func (*Router) Mount Uses

func (r *Router) Mount(backend logical.Backend, prefix string, mountEntry *MountEntry, storageView *BarrierView) error

Mount is used to expose a logical backend at a given prefix, using a unique salt, and the barrier view for that path.

func (*Router) MountConflict Uses

func (r *Router) MountConflict(ctx context.Context, path string) string

MountConflict determines if there are potential path conflicts

func (*Router) Remount Uses

func (r *Router) Remount(ctx context.Context, src, dst string) error

Remount is used to change the mount location of a logical backend

func (*Router) RootPath Uses

func (r *Router) RootPath(ctx context.Context, path string) bool

RootPath checks if the given path requires root privileges

func (*Router) Route Uses

func (r *Router) Route(ctx context.Context, req *logical.Request) (*logical.Response, error)

Route is used to route a given request

func (*Router) RouteExistenceCheck Uses

func (r *Router) RouteExistenceCheck(ctx context.Context, req *logical.Request) (*logical.Response, bool, bool, error)

RouteExistenceCheck is used to route a given existence check request

func (*Router) Taint Uses

func (r *Router) Taint(ctx context.Context, path string) error

Taint is used to mark a path as tainted. This means only RollbackOperation RevokeOperation requests are allowed to proceed

func (*Router) Unmount Uses

func (r *Router) Unmount(ctx context.Context, prefix string) error

Unmount is used to remove a logical backend from a given prefix

func (*Router) Untaint Uses

func (r *Router) Untaint(ctx context.Context, path string) error

Untaint is used to unmark a path as tainted.

type RouterAccess Uses

type RouterAccess struct {
    // contains filtered or unexported fields
}

RouterAccess provides access into some things necessary for testing

func NewRouterAccess Uses

func NewRouterAccess(c *Core) *RouterAccess

func (*RouterAccess) StoragePrefixByAPIPath Uses

func (r *RouterAccess) StoragePrefixByAPIPath(ctx context.Context, path string) (string, bool)

type RouterTestHandlerFunc Uses

type RouterTestHandlerFunc func(context.Context, *logical.Request) (*logical.Response, error)

type Seal Uses

type Seal interface {
    SetCore(*Core)
    Init(context.Context) error
    Finalize(context.Context) error

    StoredKeysSupported() StoredKeysSupport
    SealWrapable() bool
    SetStoredKeys(context.Context, [][]byte) error
    GetStoredKeys(context.Context) ([][]byte, error)

    BarrierType() string
    BarrierConfig(context.Context) (*SealConfig, error)
    SetBarrierConfig(context.Context, *SealConfig) error
    SetCachedBarrierConfig(*SealConfig)

    RecoveryKeySupported() bool
    RecoveryType() string
    RecoveryConfig(context.Context) (*SealConfig, error)
    RecoveryKey(context.Context) ([]byte, error)
    SetRecoveryConfig(context.Context, *SealConfig) error
    SetCachedRecoveryConfig(*SealConfig)
    SetRecoveryKey(context.Context, []byte) error
    VerifyRecoveryKey(context.Context, []byte) error

    GetAccess() seal.Access
}

func NewDefaultSeal Uses

func NewDefaultSeal(lowLevel seal.Access) Seal

func NewTestSeal Uses

func NewTestSeal(t testing.T, opts *TestSealOpts) Seal

type SealAccess Uses

type SealAccess struct {
    // contains filtered or unexported fields
}

SealAccess is a wrapper around Seal that exposes accessor methods through Core.SealAccess() while restricting the ability to modify Core.seal itself.

func NewSealAccess Uses

func NewSealAccess(seal Seal) *SealAccess

func (*SealAccess) BarrierConfig Uses

func (s *SealAccess) BarrierConfig(ctx context.Context) (*SealConfig, error)

func (*SealAccess) BarrierType Uses

func (s *SealAccess) BarrierType() string

func (*SealAccess) ClearCaches Uses

func (s *SealAccess) ClearCaches(ctx context.Context)

func (*SealAccess) RecoveryConfig Uses

func (s *SealAccess) RecoveryConfig(ctx context.Context) (*SealConfig, error)

func (*SealAccess) RecoveryKeySupported Uses

func (s *SealAccess) RecoveryKeySupported() bool

func (*SealAccess) StoredKeysSupported Uses

func (s *SealAccess) StoredKeysSupported() StoredKeysSupport

func (*SealAccess) VerifyRecoveryKey Uses

func (s *SealAccess) VerifyRecoveryKey(ctx context.Context, key []byte) error

type SealConfig Uses

type SealConfig struct {
    // The type, for sanity checking
    Type string `json:"type" mapstructure:"type"`

    // SecretShares is the number of shares the secret is split into. This is
    // the N value of Shamir.
    SecretShares int `json:"secret_shares" mapstructure:"secret_shares"`

    // SecretThreshold is the number of parts required to open the vault. This
    // is the T value of Shamir.
    SecretThreshold int `json:"secret_threshold" mapstructure:"secret_threshold"`

    // PGPKeys is the array of public PGP keys used, if requested, to encrypt
    // the output unseal tokens. If provided, it sets the value of
    // SecretShares. Ordering is important.
    PGPKeys []string `json:"pgp_keys" mapstructure:"pgp_keys"`

    // Nonce is a nonce generated by Vault used to ensure that when unseal keys
    // are submitted for a rekey operation, the rekey operation itself is the
    // one intended. This prevents hijacking of the rekey operation, since it
    // is unauthenticated.
    Nonce string `json:"nonce" mapstructure:"nonce"`

    // Backup indicates whether or not a backup of PGP-encrypted unseal keys
    // should be stored at coreUnsealKeysBackupPath after successful rekeying.
    Backup bool `json:"backup" mapstructure:"backup"`

    // How many keys to store, for seals that support storage.  Always 0 or 1.
    StoredShares int `json:"stored_shares" mapstructure:"stored_shares"`

    // Stores the progress of the rekey operation (key shares)
    RekeyProgress [][]byte `json:"-"`

    // VerificationRequired indicates that after a rekey validation must be
    // performed (via providing shares from the new key) before the new key is
    // actually installed. This is omitted from JSON as we don't persist the
    // new key, it lives only in memory.
    VerificationRequired bool `json:"-"`

    // VerificationKey is the new key that we will roll to after successful
    // validation
    VerificationKey []byte `json:"-"`

    // VerificationNonce stores the current operation nonce for verification
    VerificationNonce string `json:"-"`

    // Stores the progress of the verification operation (key shares)
    VerificationProgress [][]byte `json:"-"`
}

SealConfig is used to describe the seal configuration

func (*SealConfig) Clone Uses

func (s *SealConfig) Clone() *SealConfig

func (*SealConfig) Validate Uses

func (s *SealConfig) Validate() error

Validate is used to sanity check the seal configuration

type SecurityBarrier Uses

type SecurityBarrier interface {
    // Initialized checks if the barrier has been initialized
    // and has a master key set.
    Initialized(ctx context.Context) (bool, error)

    // Initialize works only if the barrier has not been initialized
    // and makes use of the given master key.  When sealKey is provided
    // it's because we're using a new-style Shamir seal, and masterKey
    // is to be stored using sealKey to encrypt it.
    Initialize(ctx context.Context, masterKey []byte, sealKey []byte, random io.Reader) error

    // GenerateKey is used to generate a new key
    GenerateKey(io.Reader) ([]byte, error)

    // KeyLength is used to sanity check a key
    KeyLength() (int, int)

    // Sealed checks if the barrier has been unlocked yet. The Barrier
    // is not expected to be able to perform any CRUD until it is unsealed.
    Sealed() (bool, error)

    // Unseal is used to provide the master key which permits the barrier
    // to be unsealed. If the key is not correct, the barrier remains sealed.
    Unseal(ctx context.Context, key []byte) error

    // VerifyMaster is used to check if the given key matches the master key
    VerifyMaster(key []byte) error

    // SetMasterKey is used to directly set a new master key. This is used in
    // replicated scenarios due to the chicken and egg problem of reloading the
    // keyring from disk before we have the master key to decrypt it.
    SetMasterKey(key []byte) error

    // ReloadKeyring is used to re-read the underlying keyring.
    // This is used for HA deployments to ensure the latest keyring
    // is present in the leader.
    ReloadKeyring(ctx context.Context) error

    // ReloadMasterKey is used to re-read the underlying masterkey.
    // This is used for HA deployments to ensure the latest master key
    // is available for keyring reloading.
    ReloadMasterKey(ctx context.Context) error

    // Seal is used to re-seal the barrier. This requires the barrier to
    // be unsealed again to perform any further operations.
    Seal() error

    // Rotate is used to create a new encryption key. All future writes
    // should use the new key, while old values should still be decryptable.
    Rotate(ctx context.Context, reader io.Reader) (uint32, error)

    // CreateUpgrade creates an upgrade path key to the given term from the previous term
    CreateUpgrade(ctx context.Context, term uint32) error

    // DestroyUpgrade destroys the upgrade path key to the given term
    DestroyUpgrade(ctx context.Context, term uint32) error

    // CheckUpgrade looks for an upgrade to the current term and installs it
    CheckUpgrade(ctx context.Context) (bool, uint32, error)

    // ActiveKeyInfo is used to inform details about the active key
    ActiveKeyInfo() (*KeyInfo, error)

    // Rekey is used to change the master key used to protect the keyring
    Rekey(context.Context, []byte) error

    // For replication we must send over the keyring, so this must be available
    Keyring() (*Keyring, error)

    // SecurityBarrier must provide the storage APIs
    logical.Storage

    // SecurityBarrier must provide the encryption APIs
    BarrierEncryptor
}

SecurityBarrier is a critical component of Vault. It is used to wrap an untrusted physical backend and provide a single point of encryption, decryption and checksum verification. The goal is to ensure that any data written to the barrier is confidential and that integrity is preserved. As a real-world analogy, this is the steel and concrete wrapper around a Vault. The barrier should only be Unlockable given its key.

type StoredKeysSupport Uses

type StoredKeysSupport int
const (
    // The 0 value of StoredKeysSupport is an invalid option
    StoredKeysInvalid StoredKeysSupport = iota
    StoredKeysNotSupported
    StoredKeysSupportedGeneric
    StoredKeysSupportedShamirMaster
)

func (StoredKeysSupport) String Uses

func (s StoredKeysSupport) String() string

type SystemBackend Uses

type SystemBackend struct {
    *framework.Backend
    Core *Core
    // contains filtered or unexported fields
}

SystemBackend implements logical.Backend and is used to interact with the core of the system. This backend is hardcoded to exist at the "sys" prefix. Conceptually it is similar to procfs on Linux.

func NewSystemBackend Uses

func NewSystemBackend(core *Core, logger log.Logger) *SystemBackend

type TemplateError Uses

type TemplateError struct {
    Err error
}

func (*TemplateError) Error Uses

func (t *TemplateError) Error() string

func (*TemplateError) WrappedErrors Uses

func (t *TemplateError) WrappedErrors() []error

type TestCluster Uses

type TestCluster struct {
    BarrierKeys        [][]byte
    RecoveryKeys       [][]byte
    CACert             *x509.Certificate
    CACertBytes        []byte
    CACertPEM          []byte
    CACertPEMFile      string
    CAKey              *ecdsa.PrivateKey
    CAKeyPEM           []byte
    Cores              []*TestClusterCore
    ID                 string
    RootToken          string
    RootCAs            *x509.CertPool
    TempDir            string
    ClientAuthRequired bool
    Logger             log.Logger
    CleanupFunc        func()
    SetupFunc          func()
}

func NewTestCluster Uses

func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *TestCluster

NewTestCluster creates a new test cluster based on the provided core config and test cluster options.

N.B. Even though a single base CoreConfig is provided, NewTestCluster will instantiate a core config for each core it creates. If separate seal per core is desired, opts.SealFunc can be provided to generate a seal for each one. Otherwise, the provided base.Seal will be shared among cores. NewCore's default behavior is to generate a new DefaultSeal if the provided Seal in coreConfig (i.e. base.Seal) is nil.

If opts.Logger is provided, it takes precedence and will be used as the cluster logger and will be the basis for each core's logger. If no opts.Logger is given, one will be generated based on t.Name() for the cluster logger, and if no base.Logger is given will also be used as the basis for each core's logger.

func (*TestCluster) Cleanup Uses

func (c *TestCluster) Cleanup()

func (*TestCluster) EnsureCoresSealed Uses

func (c *TestCluster) EnsureCoresSealed(t testing.T)

func (*TestCluster) Start Uses

func (c *TestCluster) Start()

func (*TestCluster) UnsealCore Uses

func (c *TestCluster) UnsealCore(t testing.T, core *TestClusterCore)

func (*TestCluster) UnsealCores Uses

func (c *TestCluster) UnsealCores(t testing.T)

UnsealCores uses the cluster barrier keys to unseal the test cluster cores

func (*TestCluster) UnsealCoresWithError Uses

func (c *TestCluster) UnsealCoresWithError(useStoredKeys bool) error

type TestClusterCore Uses

type TestClusterCore struct {
    *Core
    CoreConfig           *CoreConfig
    Client               *api.Client
    Handler              http.Handler
    Listeners            []*TestListener
    ReloadFuncs          *map[string][]reload.ReloadFunc
    ReloadFuncsLock      *sync.RWMutex
    Server               *http.Server
    ServerCert           *x509.Certificate
    ServerCertBytes      []byte
    ServerCertPEM        []byte
    ServerKey            *ecdsa.PrivateKey
    ServerKeyPEM         []byte
    TLSConfig            *tls.Config
    UnderlyingStorage    physical.Backend
    UnderlyingRawStorage physical.Backend
    Barrier              SecurityBarrier
    NodeID               string
}

func (*TestClusterCore) Seal Uses

func (c *TestClusterCore) Seal(t testing.T)

type TestClusterOptions Uses

type TestClusterOptions struct {
    KeepStandbysSealed       bool
    SkipInit                 bool
    HandlerFunc              func(*HandlerProperties) http.Handler
    DefaultHandlerProperties HandlerProperties
    BaseListenAddress        string
    NumCores                 int
    SealFunc                 func() Seal
    Logger                   log.Logger
    TempDir                  string
    CACert                   []byte
    CAKey                    *ecdsa.PrivateKey
    // PhysicalFactory is used to create backends.
    // The int argument is the index of the core within the cluster, i.e. first
    // core in cluster will have 0, second 1, etc.
    // If the backend is shared across the cluster (i.e. is not Raft) then it
    // should return nil when coreIdx != 0.
    PhysicalFactory func(t testing.T, coreIdx int, logger hclog.Logger) *PhysicalBackendBundle
    // FirstCoreNumber is used to assign a unique number to each core within
    // a multi-cluster setup.
    FirstCoreNumber   int
    RequireClientAuth bool
    // SetupFunc is called after the cluster is started.
    SetupFunc func(t testing.T, c *TestCluster)
}

type TestListener Uses

type TestListener struct {
    net.Listener
    Address *net.TCPAddr
}

type TestSealOpts Uses

type TestSealOpts struct {
    Logger     log.Logger
    StoredKeys StoredKeysSupport
    Secret     []byte
}

type TokenCounter Uses

type TokenCounter struct {
    // Total is the total number of tokens
    Total int `json:"total"`
}

TokenCounter counts the number of tokens

type TokenStore Uses

type TokenStore struct {
    *framework.Backend
    // contains filtered or unexported fields
}

TokenStore is used to manage client tokens. Tokens are used for clients to authenticate, and each token is mapped to an applicable set of policy which is used for authorization.

func NewTokenStore Uses

func NewTokenStore(ctx context.Context, logger log.Logger, core *Core, config *logical.BackendConfig) (*TokenStore, error)

NewTokenStore is used to construct a token store that is backed by the given barrier view.

func (*TokenStore) Invalidate Uses

func (ts *TokenStore) Invalidate(ctx context.Context, key string)

func (*TokenStore) Lookup Uses

func (ts *TokenStore) Lookup(ctx context.Context, id string) (*logical.TokenEntry, error)

Lookup is used to find a token given its ID. It acquires a read lock, then calls lookupInternal.

func (*TokenStore) Salt Uses

func (ts *TokenStore) Salt(ctx context.Context) (*salt.Salt, error)

func (*TokenStore) SaltID Uses

func (ts *TokenStore) SaltID(ctx context.Context, id string) (string, error)

SaltID is used to apply a salt and hash to an ID to make sure its not reversible

func (*TokenStore) SetExpirationManager Uses

func (ts *TokenStore) SetExpirationManager(exp *ExpirationManager)

SetExpirationManager is used to provide the token store with an expiration manager. This is used to manage prefix based revocation of tokens and to tidy entries when removed from the token store.

func (*TokenStore) UseToken Uses

func (ts *TokenStore) UseToken(ctx context.Context, te *logical.TokenEntry) (*logical.TokenEntry, error)

UseToken is used to manage restricted use tokens and decrement their available uses. Returns two values: a potentially updated entry or, if the token has been revoked, nil; and whether an error was encountered. The locking here isn't perfect, as other parts of the code may update an entry, but usually none after the entry is already created...so this is pretty good.

func (*TokenStore) UseTokenByID Uses

func (ts *TokenStore) UseTokenByID(ctx context.Context, id string) (*logical.TokenEntry, error)

type UIConfig Uses

type UIConfig struct {
    // contains filtered or unexported fields
}

UIConfig contains UI configuration. This takes both a physical view and a barrier view because it is stored in both plaintext and encrypted to allow for getting the header values before the barrier is unsealed

func NewUIConfig Uses

func NewUIConfig(enabled bool, physicalStorage physical.Backend, barrierStorage logical.Storage) *UIConfig

NewUIConfig creates a new UI config

func (*UIConfig) DeleteHeader Uses

func (c *UIConfig) DeleteHeader(ctx context.Context, header string) error

DeleteHeader deletes the header configuration for the given header

func (*UIConfig) Enabled Uses

func (c *UIConfig) Enabled() bool

Enabled returns if the UI is enabled

func (*UIConfig) GetHeader Uses

func (c *UIConfig) GetHeader(ctx context.Context, header string) (string, error)

GetHeader retrieves the configured value for the given header

func (*UIConfig) HeaderKeys Uses

func (c *UIConfig) HeaderKeys(ctx context.Context) ([]string, error)

HeaderKeys returns the list of the configured headers

func (*UIConfig) Headers Uses

func (c *UIConfig) Headers(ctx context.Context) (http.Header, error)

Headers returns the response headers that should be returned in the UI

func (*UIConfig) SetHeader Uses

func (c *UIConfig) SetHeader(ctx context.Context, header, value string) error

SetHeader sets the value for the given header

type UnimplementedRequestForwardingServer Uses

type UnimplementedRequestForwardingServer struct {
}

UnimplementedRequestForwardingServer can be embedded to have forward compatible implementations.

func (*UnimplementedRequestForwardingServer) Echo Uses

func (*UnimplementedRequestForwardingServer) Echo(ctx context.Context, req *EchoRequest) (*EchoReply, error)

func (*UnimplementedRequestForwardingServer) ForwardRequest Uses

func (*UnimplementedRequestForwardingServer) ForwardRequest(ctx context.Context, req *forwarding.Request) (*forwarding.Response, error)

func (*UnimplementedRequestForwardingServer) PerformanceStandbyElectionRequest Uses

func (*UnimplementedRequestForwardingServer) PerformanceStandbyElectionRequest(req *PerfStandbyElectionInput, srv RequestForwarding_PerformanceStandbyElectionRequestServer) error

type UnsealStrategy Uses

type UnsealStrategy interface {
    // contains filtered or unexported methods
}

Directories

PathSynopsis
cluster
replication
seal
seal/alicloudkms
seal/awskms
seal/azurekeyvault
seal/gcpckms
seal/ocikms
seal/shamir
seal/transit

Package vault imports 124 packages (graph) and is imported by 77 packages. Updated 2019-11-13. Refresh now. Tools for package owners.