mirror of
https://github.com/cloudflare/redoctober.git
synced 2026-09-19 14:14:13 +00:00
Kyle IsomandGitHub
510b7ba9f6
This is a rather large change. It consists of the following changes: + Direct access to the keycache has been removed from the core package. This forces all interaction with the cache to go through the Cryptor, which is required for persistence. The Cryptor needs to know when the cache has changed, and the only way to do this effectively is to make the Cryptor responsible for managing the keycache. + A new persist package has been added. This provides a Store interface, for which two implementations are provided. The first is a null persister: this is used when no persistence is configured. The second is a file-backed persistence store. + The Cryptor now persists the cache every time it changes. Additionally, a number of missing returns in a function in the core package have been added.
123 lines
2.2 KiB
Go
123 lines
2.2 KiB
Go
package persist
|
|
|
|
import (
|
|
"io/ioutil"
|
|
"os"
|
|
|
|
"github.com/cloudflare/redoctober/config"
|
|
"github.com/cloudflare/redoctober/keycache"
|
|
"github.com/cloudflare/redoctober/passvault"
|
|
)
|
|
|
|
// File implements a file-backed persistence store.
|
|
type File struct {
|
|
config *config.Delegations
|
|
cache *keycache.Cache
|
|
state string
|
|
blob []byte
|
|
}
|
|
|
|
// Valid ensures the configuration is valid for a file store. Note
|
|
// that it won't validate the policy, it will just ensure that one
|
|
// is present.
|
|
func (f *File) Valid() bool {
|
|
if f.config.Persist == false {
|
|
return false
|
|
}
|
|
|
|
if f.config.Policy == "" {
|
|
return false
|
|
}
|
|
|
|
if len(f.config.Users) == 0 {
|
|
return false
|
|
}
|
|
|
|
if f.config.Mechanism != FileMechanism {
|
|
return false
|
|
}
|
|
|
|
if f.config.Location == "" {
|
|
return false
|
|
}
|
|
|
|
return true
|
|
}
|
|
|
|
// newFile returns a new file-backed persistence store.
|
|
func newFile(config *config.Delegations) (Store, error) {
|
|
cache := keycache.NewCache()
|
|
file := &File{
|
|
config: config,
|
|
cache: &cache,
|
|
state: Inactive,
|
|
}
|
|
|
|
if !file.Valid() {
|
|
return nil, ErrInvalidConfig
|
|
}
|
|
|
|
err := file.Load()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return file, nil
|
|
}
|
|
|
|
func (f *File) Blob() []byte {
|
|
return f.blob
|
|
}
|
|
|
|
func (f *File) Policy() string {
|
|
return f.config.Policy
|
|
}
|
|
|
|
func (f *File) Users() []string {
|
|
return f.config.Users
|
|
}
|
|
|
|
func (f *File) Store(blob []byte) error {
|
|
if f.state == Active {
|
|
f.blob = blob
|
|
return ioutil.WriteFile(f.config.Location, blob, 0644)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (f *File) Load() error {
|
|
in, err := ioutil.ReadFile(f.config.Location)
|
|
if err != nil {
|
|
// If the file doesn't exist, it can be persisted
|
|
// immediately.
|
|
if os.IsNotExist(err) {
|
|
f.state = Active
|
|
return nil
|
|
}
|
|
|
|
return err
|
|
}
|
|
|
|
f.state = Inactive
|
|
f.blob = in
|
|
return nil
|
|
}
|
|
|
|
func (f *File) Persist() {
|
|
f.state = Active
|
|
}
|
|
|
|
func (f *File) Cache() *keycache.Cache {
|
|
return f.cache
|
|
}
|
|
|
|
func (f *File) Delegate(record passvault.PasswordRecord, name, password string, users, labels []string, uses int, slot, durationString string) error {
|
|
return f.cache.AddKeyFromRecord(record, name, password, users, labels, uses, slot, durationString)
|
|
}
|
|
|
|
func (f *File) Status() *Status {
|
|
return &Status{
|
|
State: f.state,
|
|
Summary: f.cache.GetSummary(),
|
|
}
|
|
}
|