mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-11-29 06:31:10 +01:00
Code Issues Projects Releases Wiki Activity

secret/mysql: fixing mysql oddities

Browse Source
This commit is contained in:
Armon Dadgar 2015-04-25 12:56:11 -07:00
parent cc69073b37
commit c237c8c258
2 changed files with 11 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
builtin/logical/mysql/path_role_create.go
View File

@ -2,7 +2,6 @@ package mysql
import ( import (
"fmt" "fmt"
"math/rand"
"time" "time"
"github.com/hashicorp/vault/logical" "github.com/hashicorp/vault/logical"
@ -51,10 +50,15 @@ func (b *backend) pathRoleCreateRead(
lease = &configLease{Lease: 1 * time.Hour} lease = &configLease{Lease: 1 * time.Hour}
} }
// Generate our username and password // Generate our username and password. MySQL limits user to 16 characters
username := fmt.Sprintf( displayName := req.DisplayName
"vault-%s-%d-%d", if len(displayName) > 10 {
req.DisplayName, time.Now().Unix(), rand.Int31n(10000)) displayName = displayName[:10]
}
username := fmt.Sprintf("%s-%s", displayName, generateUUID())
if len(username) > 16 {
username = username[:16]
}
password := generateUUID() password := generateUUID()
// Get our connection // Get our connection

10
builtin/logical/mysql/secret_creds.go
View File

@ -74,23 +74,17 @@ func (b *backend) secretCredsRevoke(
// drop, because MySQL explicitly documents that open user connections // drop, because MySQL explicitly documents that open user connections
// will not be closed. By revoking all grants, at least we ensure // will not be closed. By revoking all grants, at least we ensure
// that the open connection is useless. // that the open connection is useless.
stmt, err := tx.Prepare("REVOKE ALL PRIVILEGES, GRANT OPTION FROM ?") _, err = tx.Exec("REVOKE ALL PRIVILEGES, GRANT OPTION FROM '" + username + "'@'%'")
if err != nil { if err != nil {
return nil, err return nil, err
} }
if _, err := stmt.Exec(username); err != nil {
return nil, err
}
// Drop this user. This only affects the next connection, which is // Drop this user. This only affects the next connection, which is
// why we do the revoke initially. // why we do the revoke initially.
stmt, err = db.Prepare("DROP USER ?") _, err = tx.Exec("DROP USER '" + username + "'@'%'")
if err != nil { if err != nil {
return nil, err return nil, err
} }
if _, err := stmt.Exec(username); err != nil {
return nil, err
}
// Commit the transaction // Commit the transaction
if err := tx.Commit(); err != nil { if err := tx.Commit(); err != nil {