mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-12-08 11:01:47 +01:00
Code Issues Projects Releases Wiki Activity

vault: Simpify token checking logic

Browse Source
This commit is contained in:
Armon Dadgar 2015-04-01 14:03:17 -07:00
parent 5180daed1c
commit ceeebcb5b7
3 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
vault/core.go
View File

@ -230,8 +230,7 @@ func (c *Core) HandleRequest(req *logical.Request) (*logical.Response, error) {
func (c *Core) handleRequest(req *logical.Request) (*logical.Response, error) { func (c *Core) handleRequest(req *logical.Request) (*logical.Response, error) {
// Validate the token // Validate the token
err := c.checkToken( err := c.checkToken(req.Operation, req.Path, req.ClientToken)
req.Operation, req.Path, req.ClientToken, c.router.RootPath(req.Path))
if err != nil { if err != nil {
// If it is an internal error we return that, otherwise we // If it is an internal error we return that, otherwise we
// return invalid request so that the status codes can be correct // return invalid request so that the status codes can be correct
@ -306,7 +305,7 @@ func (c *Core) handleLoginRequest(req *logical.Request) (*logical.Response, erro
} }
func (c *Core) checkToken( func (c *Core) checkToken(
op logical.Operation, path string, token string, root bool) error { op logical.Operation, path string, token string) error {
// Ensure there is a client token // Ensure there is a client token
if token == "" { if token == "" {
return fmt.Errorf("missing client token") return fmt.Errorf("missing client token")
@ -332,7 +331,7 @@ func (c *Core) checkToken(
} }
// Check if this is a root protected path // Check if this is a root protected path
if root && !acl.RootPrivilege(path) { if c.router.RootPath(path) && !acl.RootPrivilege(path) {
return logical.ErrPermissionDenied return logical.ErrPermissionDenied
} }
@ -617,11 +616,7 @@ func (c *Core) Seal(token string) error {
} }
// Validate the token is a root token // Validate the token is a root token
err := c.checkToken( err := c.checkToken(logical.WriteOperation, "sys/seal", token)
logical.WriteOperation,
"sys/seal",
token,
true)
if err != nil { if err != nil {
return err return err
} }

1
vault/logical_system.go
View File

@ -22,6 +22,7 @@ func NewSystemBackend(core *Core) logical.Backend {
"policy/*", "policy/*",
"audit", "audit",
"audit/*", "audit/*",
"seal", // Must be set for Core.Seal() logic
}, },
}, },

1
vault/logical_system_test.go
View File

@ -18,6 +18,7 @@ func TestSystemBackend_RootPaths(t *testing.T) {
"policy/*", "policy/*",
"audit", "audit",
"audit/*", "audit/*",
"seal",
} }
b := testSystemBackend(t) b := testSystemBackend(t)