mirror of
https://github.com/cloudflare/redoctober.git
synced 2026-08-15 19:56:17 +00:00
Kyle Isom
9f39413adb
This change addresses several points: 1. The integration tests didn't verify that delegations could be used for decryption following a restore. The integration tests now verify this. 2. There was no functionality for clearing persisted delegations if needed. The vault admin can now do this via the command line tool. 3. Restoring active delegations wasn't storing the key with the delegation. Keys are now serialised properly. 4. [Minor] The MSP package now reports the name of the offending user when it can't find a user name in the database.
92 lines
2.5 KiB
Go
92 lines
2.5 KiB
Go
// Package persist implements delegation persistence. It is primarily
|
|
// concerned with configuration and serialisation; encryption and
|
|
// decryption is done by the cryptor package.
|
|
package persist
|
|
|
|
import (
|
|
"errors"
|
|
|
|
"github.com/cloudflare/redoctober/config"
|
|
"github.com/cloudflare/redoctober/keycache"
|
|
"github.com/cloudflare/redoctober/passvault"
|
|
)
|
|
|
|
var defaultStore Store = &File{}
|
|
|
|
// Labels are the labels that the keycache should be encrypted with.
|
|
var Labels = []string{"restore"}
|
|
|
|
const (
|
|
// Disabled indicates that the persistence store will never
|
|
// persist active delegations.
|
|
Disabled = "disabled"
|
|
|
|
// Inactive indicates that the persistence store requires
|
|
// more delegations to unlock, and isn't currently persisting
|
|
// the store.
|
|
Inactive = "inactive"
|
|
|
|
// Active indicates that the persistence store is
|
|
// actively persisting delegations.
|
|
Active = "active"
|
|
)
|
|
|
|
// Status contains information on the current status of a persistence
|
|
// store.
|
|
type Status struct {
|
|
State string `json:"state"`
|
|
Summary map[string]keycache.ActiveUser
|
|
}
|
|
|
|
// Store is a persistence store interface that handles delegations,
|
|
// serialising the persistence store, and writing the store to disk.
|
|
type Store interface {
|
|
Blob() []byte
|
|
Policy() string
|
|
Users() []string
|
|
Store([]byte) error
|
|
Load() error
|
|
Status() *Status
|
|
// Persist tells the Store to start actively persisting.
|
|
Persist()
|
|
Delegate(record passvault.PasswordRecord, name, password string, users, labels []string, uses int, slot, durationString string) error
|
|
// This is not the main keycache. This is the keycache for
|
|
// users that can decrypt the store.
|
|
Cache() *keycache.Cache
|
|
// Purge clears the persisted keys.
|
|
Purge() error
|
|
}
|
|
|
|
// FileMechanism indicates that the persistence mechanism is a file.
|
|
const FileMechanism = "file"
|
|
|
|
type mechanism func(*config.Delegations) (Store, error)
|
|
|
|
var stores = map[string]mechanism{
|
|
"": newNull,
|
|
FileMechanism: newFile,
|
|
}
|
|
|
|
// New attempts to create a new persistence store from the
|
|
// configuration.
|
|
func New(config *config.Delegations) (Store, error) {
|
|
if config == nil {
|
|
return nil, errors.New("persist: nil configuration")
|
|
}
|
|
|
|
if !config.Persist {
|
|
return newNull(config)
|
|
}
|
|
|
|
constructor, ok := stores[config.Mechanism]
|
|
if !ok {
|
|
return nil, errors.New("persist: invalid persistence mechanism")
|
|
}
|
|
|
|
return constructor(config)
|
|
}
|
|
|
|
// ErrInvalidConfig is returned when the configuration is invalid for
|
|
// the type of persistence store in use.
|
|
var ErrInvalidConfig = errors.New("persist: invalid configuration")
|