Skip to content

Commit

Permalink
Fix barrier key autoration config edge cases (#11541)
Browse files Browse the repository at this point in the history
* Add an Int64 type

* Use the new Int64 type so that even 32 bit builds can specify max_operations above 2^31

* Missed a spot

* go mod vendor

* fix cast

* changelog

* Update unit test to ensure this works on both 32 and 64-bit archs
  • Loading branch information
sgmiller committed May 5, 2021
1 parent 3c0762d commit f538631
Show file tree
Hide file tree
Showing 10 changed files with 30 additions and 20 deletions.
3 changes: 3 additions & 0 deletions changelog/11541.txt
@@ -0,0 +1,3 @@
```release-note:bug
core: Fix edge cases in the configuration endpoint for barrier key autorotation.
```
2 changes: 1 addition & 1 deletion go.mod
Expand Up @@ -104,7 +104,7 @@ require (
github.com/hashicorp/vault-plugin-secrets-openldap v0.4.0
github.com/hashicorp/vault-plugin-secrets-terraform v0.1.0
github.com/hashicorp/vault/api v1.0.5-0.20210210214158-405eced08457
github.com/hashicorp/vault/sdk v0.1.14-0.20210204230556-cf85a862b7c6
github.com/hashicorp/vault/sdk v0.1.14-0.20210505171055-299f311fa707
github.com/influxdata/influxdb v0.0.0-20190411212539-d24b7ba8c4c4
github.com/jcmturner/gokrb5/v8 v8.0.0
github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f
Expand Down
11 changes: 9 additions & 2 deletions sdk/framework/field_data.go
Expand Up @@ -38,7 +38,7 @@ func (d *FieldData) Validate() error {
}

switch schema.Type {
case TypeBool, TypeInt, TypeMap, TypeDurationSecond, TypeSignedDurationSecond, TypeString,
case TypeBool, TypeInt, TypeInt64, TypeMap, TypeDurationSecond, TypeSignedDurationSecond, TypeString,
TypeLowerCaseString, TypeNameString, TypeSlice, TypeStringSlice, TypeCommaStringSlice,
TypeKVPairs, TypeCommaIntSlice, TypeHeader, TypeFloat, TypeTime:
_, _, err := d.getPrimitive(field, schema)
Expand Down Expand Up @@ -131,7 +131,7 @@ func (d *FieldData) GetOkErr(k string) (interface{}, bool, error) {
}

switch schema.Type {
case TypeBool, TypeInt, TypeMap, TypeDurationSecond, TypeSignedDurationSecond, TypeString,
case TypeBool, TypeInt, TypeInt64, TypeMap, TypeDurationSecond, TypeSignedDurationSecond, TypeString,
TypeLowerCaseString, TypeNameString, TypeSlice, TypeStringSlice, TypeCommaStringSlice,
TypeKVPairs, TypeCommaIntSlice, TypeHeader, TypeFloat, TypeTime:
return d.getPrimitive(k, schema)
Expand Down Expand Up @@ -162,6 +162,13 @@ func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bo
}
return result, true, nil

case TypeInt64:
var result int64
if err := mapstructure.WeakDecode(raw, &result); err != nil {
return nil, false, err
}
return result, true, nil

case TypeFloat:
var result float64
if err := mapstructure.WeakDecode(raw, &result); err != nil {
Expand Down
1 change: 1 addition & 0 deletions sdk/framework/field_type.go
Expand Up @@ -7,6 +7,7 @@ const (
TypeInvalid FieldType = 0
TypeString FieldType = iota
TypeInt
TypeInt64
TypeBool
TypeMap

Expand Down
4 changes: 2 additions & 2 deletions vault/logical_system.go
Expand Up @@ -2566,7 +2566,7 @@ func (b *SystemBackend) handleKeyRotationConfigUpdate(ctx context.Context, req *
return nil, err
}
if ok {
rotConfig.MaxOperations = int64(maxOps.(int))
rotConfig.MaxOperations = maxOps.(int64)
}
interval, ok, err := data.GetOkErr("interval")
if err != nil {
Expand All @@ -2585,7 +2585,7 @@ func (b *SystemBackend) handleKeyRotationConfigUpdate(ctx context.Context, req *
}

// Reject out of range settings
if rotConfig.Interval < minimumRotationInterval {
if rotConfig.Interval < minimumRotationInterval && rotConfig.Interval != 0 {
return logical.ErrorResponse("interval must be greater or equal to %s", minimumRotationInterval.String()), logical.ErrInvalidRequest
}

Expand Down
2 changes: 1 addition & 1 deletion vault/logical_system_paths.go
Expand Up @@ -610,7 +610,7 @@ func (b *SystemBackend) sealPaths() []*framework.Path {
Description: strings.TrimSpace(sysHelp["rotation-enabled"][0]),
},
"max_operations": {
Type: framework.TypeInt, // 64?
Type: framework.TypeInt64,
Description: strings.TrimSpace(sysHelp["rotation-max-operations"][0]),
},
"interval": {
Expand Down
13 changes: 2 additions & 11 deletions vault/logical_system_test.go
Expand Up @@ -2066,7 +2066,7 @@ func TestSystemBackend_rotateConfig(t *testing.T) {
}

req2 := logical.TestRequest(t, logical.UpdateOperation, "rotate/config")
req2.Data["max_operations"] = 123456789
req2.Data["max_operations"] = int64(3221225472)
req2.Data["interval"] = "5432h0m0s"
req2.Data["enabled"] = false

Expand All @@ -2081,20 +2081,11 @@ func TestSystemBackend_rotateConfig(t *testing.T) {
}

exp = map[string]interface{}{
"max_operations": 123456789,
"max_operations": int64(3221225472),
"interval": "5432h0m0s",
"enabled": false,
}

// Not pretty, but on a 64-bit machine, the response value is 64-bit, while on a 32 bit machine it'll be an int
// DeepEqual rejects it due to the type difference
if d, ok := resp.Data["max_operations"]; ok {
v, ok := d.(int64)
if ok {
resp.Data["max_operations"] = int(v)
}
}

if !reflect.DeepEqual(resp.Data, exp) {
t.Fatalf("got: %#v expect: %#v", resp.Data, exp)
}
Expand Down
11 changes: 9 additions & 2 deletions vendor/github.com/hashicorp/vault/sdk/framework/field_data.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion vendor/modules.txt
Expand Up @@ -709,7 +709,7 @@ github.com/hashicorp/vault-plugin-secrets-terraform
# github.com/hashicorp/vault/api v1.0.5-0.20210210214158-405eced08457 => ./api
## explicit
github.com/hashicorp/vault/api
# github.com/hashicorp/vault/sdk v0.1.14-0.20210204230556-cf85a862b7c6 => ./sdk
# github.com/hashicorp/vault/sdk v0.1.14-0.20210505171055-299f311fa707 => ./sdk
## explicit
github.com/hashicorp/vault/sdk/database/dbplugin
github.com/hashicorp/vault/sdk/database/dbplugin/v5
Expand Down

0 comments on commit f538631

Please sign in to comment.