mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-08-31 19:41:12 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #2284 from hashicorp/disallowed_policies_root

Browse Source 
Don't sanitize disallowed_policies on token role
This commit is contained in:
Vishal Nayak 2017-01-18 10:23:48 -05:00 committed by GitHub
commit aaf6194e4b
3 changed files with 36 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
helper/strutil/strutil.go
View File

@ -34,7 +34,7 @@ func StrListSubset(super, sub []string) bool {
// empty items. The values will be converted to lower case.
func ParseDedupAndSortStrings(input string, sep string) []string {
input = strings.TrimSpace(input)
var parsed []string
parsed := []string{}
if input == "" {
// Don't return nil
return parsed

6
vault/token_store.go
View File

@ -1485,7 +1485,7 @@ func (ts *TokenStore) handleCreateCommon(
if len(role.DisallowedPolicies) > 0 {
// We don't add the default here because we only want to disallow it if it's explicitly set
sanitizedRolePolicies = policyutil.SanitizePolicies(role.DisallowedPolicies, policyutil.DoNotAddDefaultPolicy)
sanitizedRolePolicies = strutil.RemoveDuplicates(role.DisallowedPolicies)
for _, finalPolicy := range finalPolicies {
if strutil.StrListContains(sanitizedRolePolicies, finalPolicy) {
@ -2218,9 +2218,9 @@ func (ts *TokenStore) tokenStoreRoleCreateUpdate(
disallowedPoliciesStr, ok := data.GetOk("disallowed_policies")
if ok {
entry.DisallowedPolicies = policyutil.SanitizePolicies(strings.Split(disallowedPoliciesStr.(string), ","), policyutil.DoNotAddDefaultPolicy)
entry.DisallowedPolicies = strutil.ParseDedupAndSortStrings(disallowedPoliciesStr.(string), ",")
} else if req.Operation == logical.CreateOperation {
entry.DisallowedPolicies = policyutil.SanitizePolicies(strings.Split(data.Get("disallowed_policies").(string), ","), policyutil.DoNotAddDefaultPolicy)
entry.DisallowedPolicies = strutil.ParseDedupAndSortStrings(data.Get("disallowed_policies").(string), ",")
}
// Store it

32
vault/token_store_test.go
View File

@ -1792,6 +1792,38 @@ func TestTokenStore_RoleCRUD(t *testing.T) {
}
}
func TestTokenStore_RoleDisallowedPoliciesWithRoot(t *testing.T) {
var resp *logical.Response
var err error
_, ts, _, root := TestCoreWithTokenStore(t)
// Don't set disallowed_policies. Verify that a read on the role does return a non-nil value.
roleReq := &logical.Request{
Operation: logical.UpdateOperation,
Path: "roles/role1",
Data: map[string]interface{}{
"disallowed_policies": "root,testpolicy",
},
ClientToken: root,
}
resp, err = ts.HandleRequest(roleReq)
if err != nil || (resp != nil && resp.IsError()) {
t.Fatalf("err:%v resp:%v", err, resp)
}
roleReq.Operation = logical.ReadOperation
resp, err = ts.HandleRequest(roleReq)
if err != nil || (resp != nil && resp.IsError()) {
t.Fatalf("err:%v resp:%v", err, resp)
}
expected := []string{"root", "testpolicy"}
if !reflect.DeepEqual(resp.Data["disallowed_policies"], expected) {
t.Fatalf("bad: expected: %#v, actual: %#v", expected, resp.Data["disallowed_policies"])
}
}
func TestTokenStore_RoleDisallowedPolicies(t *testing.T) {
var req *logical.Request
var resp *logical.Response