mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-08-20 06:01:10 +02:00
Code Issues Projects Releases Wiki Activity

vault: Improve error when unseal key is wrong

Browse Source
This commit is contained in:
Armon Dadgar 2015-03-12 11:27:32 -07:00
parent e3fbe54a04
commit 6c88eae73e
3 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
vault/barrier.go
View File

@ -14,6 +14,9 @@ var (
// ErrBarrierNotInit is returned if a non-initialized barrier // ErrBarrierNotInit is returned if a non-initialized barrier
// is attempted to be unsealed. // is attempted to be unsealed.
ErrBarrierNotInit = errors.New("Vault is not initialized") ErrBarrierNotInit = errors.New("Vault is not initialized")
// ErrBarrierInvalidKey is returned if the Unseal key is invalid
ErrBarrierInvalidKey = errors.New("Unseal failed, invalid key")
) )
const ( const (

4
vault/barrier_aes_gcm.go
View File

@ -6,6 +6,7 @@ import (
"crypto/rand" "crypto/rand"
"encoding/json" "encoding/json"
"fmt" "fmt"
"strings"
"sync" "sync"
"github.com/hashicorp/vault/physical" "github.com/hashicorp/vault/physical"
@ -163,6 +164,9 @@ func (b *AESGCMBarrier) Unseal(key []byte) error {
// Decrypt the barrier init key // Decrypt the barrier init key
plain, err := b.decrypt(gcm, out.Value) plain, err := b.decrypt(gcm, out.Value)
if err != nil { if err != nil {
if strings.Contains(err.Error(), "message authentication failed") {
return ErrBarrierInvalidKey
}
return err return err
} }
defer memzero(plain) defer memzero(plain)

13
vault/barrier_test.go
View File

@ -219,4 +219,17 @@ func testBarrier(t *testing.T, b SecurityBarrier) {
if err != nil { if err != nil {
t.Fatalf("err: %v", err) t.Fatalf("err: %v", err)
} }
// Reseal should prevent any updates
if err := b.Seal(); err != nil {
t.Fatalf("err: %v", err)
}
// Modify the key
key[0]++
// Unseal should fail
if err := b.Unseal(key); err != ErrBarrierInvalidKey {
t.Fatalf("err: %v", err)
}
} }