Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix missing plaintext in bulk decrypt response #9991

Merged
merged 5 commits into from
Sep 22, 2020
Merged

fix missing plaintext in bulk decrypt response #9991

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d5f6e8c
fix missing plaintext in bulk decrypt response
ins0 Sep 18, 2020
193392e
improving test for batch decrypt item results
ins0 Sep 18, 2020
b4260a7
improving test for batch decrypt item results
ins0 Sep 18, 2020
7427b0d
rename BatchResponseItem to EncryptBatchResponseItem
ins0 Sep 22, 2020
db5a926
remove obsolete BatchResponseItem.Plaintext in encrypt response struct
ins0 Sep 22, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion builtin/logical/transit/path_decrypt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,16 @@ import (
"github.com/hashicorp/vault/sdk/logical"
)

type DecryptBatchResponseItem struct {
// Plaintext for the ciphertext present in the corresponding batch
// request item
Plaintext string `json:"plaintext" structs:"plaintext" mapstructure:"plaintext"`

// Error, if set represents a failure encountered while encrypting a
// corresponding batch request item
Error string `json:"error,omitempty" structs:"error" mapstructure:"error"`
}

func (b *backend) pathDecrypt() *framework.Path {
return &framework.Path{
Pattern: "decrypt/" + framework.GenericNameRegex("name"),
Expand Down Expand Up @@ -78,7 +88,7 @@ func (b *backend) pathDecryptWrite(ctx context.Context, req *logical.Request, d
}
}

batchResponseItems := make([]BatchResponseItem, len(batchInputItems))
batchResponseItems := make([]DecryptBatchResponseItem, len(batchInputItems))
contextSet := len(batchInputItems[0].Context) != 0

for i, item := range batchInputItems {
Expand Down
2 changes: 1 addition & 1 deletion builtin/logical/transit/path_decrypt_bench_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ func BTransit_BatchDecryption(b *testing.B, bsize int) {
b.Fatalf("err:%v resp:%#v", err, resp)
}

batchResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)
batchDecryptionInput := make([]interface{}, len(batchResponseItems))
for i, item := range batchResponseItems {
batchDecryptionInput[i] = map[string]interface{}{"ciphertext": item.Ciphertext}
Expand Down
25 changes: 12 additions & 13 deletions builtin/logical/transit/path_decrypt_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ package transit

import (
"context"
"testing"

"encoding/json"
"github.com/hashicorp/vault/sdk/logical"
"testing"
)

func TestTransit_BatchDecryption(t *testing.T) {
Expand All @@ -14,7 +14,8 @@ func TestTransit_BatchDecryption(t *testing.T) {
b, s := createBackendWithStorage(t)

batchEncryptionInput := []interface{}{
map[string]interface{}{"plaintext": "Cg=="},
map[string]interface{}{"plaintext": ""}, // empty string
map[string]interface{}{"plaintext": "Cg=="}, // newline
map[string]interface{}{"plaintext": "dGhlIHF1aWNrIGJyb3duIGZveA=="},
}
batchEncryptionData := map[string]interface{}{
Expand All @@ -32,7 +33,7 @@ func TestTransit_BatchDecryption(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)
batchDecryptionInput := make([]interface{}, len(batchResponseItems))
for i, item := range batchResponseItems {
batchDecryptionInput[i] = map[string]interface{}{"ciphertext": item.Ciphertext}
Expand All @@ -52,14 +53,12 @@ func TestTransit_BatchDecryption(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchDecryptionResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchDecryptionResponseItems := resp.Data["batch_results"].([]DecryptBatchResponseItem)
expectedResult := "[{\"plaintext\":\"\"},{\"plaintext\":\"Cg==\"},{\"plaintext\":\"dGhlIHF1aWNrIGJyb3duIGZveA==\"}]"

plaintext1 := "dGhlIHF1aWNrIGJyb3duIGZveA=="
plaintext2 := "Cg=="
for _, item := range batchDecryptionResponseItems {
if item.Plaintext != plaintext1 && item.Plaintext != plaintext2 {
t.Fatalf("bad: plaintext: %q", item.Plaintext)
}
jsonResponse, err := json.Marshal(batchDecryptionResponseItems)
if err != nil || err == nil && string(jsonResponse) != expectedResult {
t.Fatalf("bad: expected json response [%s]", jsonResponse)
}
}

Expand Down Expand Up @@ -104,7 +103,7 @@ func TestTransit_BatchDecryption_DerivedKey(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchDecryptionInputItems := resp.Data["batch_results"].([]BatchResponseItem)
batchDecryptionInputItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)

batchDecryptionInput := make([]interface{}, len(batchDecryptionInputItems))
for i, item := range batchDecryptionInputItems {
Expand All @@ -126,7 +125,7 @@ func TestTransit_BatchDecryption_DerivedKey(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchDecryptionResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchDecryptionResponseItems := resp.Data["batch_results"].([]DecryptBatchResponseItem)

plaintext := "dGhlIHF1aWNrIGJyb3duIGZveA=="
for _, item := range batchDecryptionResponseItems {
Expand Down
10 changes: 3 additions & 7 deletions builtin/logical/transit/path_encrypt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,19 +37,15 @@ type BatchRequestItem struct {
DecodedNonce []byte
}

// BatchResponseItem represents a response item for batch processing
type BatchResponseItem struct {
// EncryptBatchResponseItem represents a response item for batch processing
type EncryptBatchResponseItem struct {
// Ciphertext for the plaintext present in the corresponding batch
// request item
Ciphertext string `json:"ciphertext,omitempty" structs:"ciphertext" mapstructure:"ciphertext"`

// KeyVersion defines the key version used to encrypt plaintext.
KeyVersion int `json:"key_version,omitempty" structs:"key_version" mapstructure:"key_version"`

// Plaintext for the ciphertext present in the corresponding batch
// request item
Plaintext string `json:"plaintext,omitempty" structs:"plaintext" mapstructure:"plaintext"`

// Error, if set represents a failure encountered while encrypting a
// corresponding batch request item
Error string `json:"error,omitempty" structs:"error" mapstructure:"error"`
Expand Down Expand Up @@ -250,7 +246,7 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
}
}

batchResponseItems := make([]BatchResponseItem, len(batchInputItems))
batchResponseItems := make([]EncryptBatchResponseItem, len(batchInputItems))
contextSet := len(batchInputItems[0].Context) != 0

// Before processing the batch request items, get the policy. If the
Expand Down
10 changes: 5 additions & 5 deletions builtin/logical/transit/path_encrypt_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ func TestTransit_BatchEncryptionCase4(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)

decReq := &logical.Request{
Operation: logical.UpdateOperation,
Expand Down Expand Up @@ -264,7 +264,7 @@ func TestTransit_BatchEncryptionCase5(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)

decReq := &logical.Request{
Operation: logical.UpdateOperation,
Expand Down Expand Up @@ -320,7 +320,7 @@ func TestTransit_BatchEncryptionCase6(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)

decReq := &logical.Request{
Operation: logical.UpdateOperation,
Expand All @@ -331,7 +331,7 @@ func TestTransit_BatchEncryptionCase6(t *testing.T) {
plaintext := "dGhlIHF1aWNrIGJyb3duIGZveA=="

for _, responseItem := range batchResponseItems {
var item BatchResponseItem
var item EncryptBatchResponseItem
if err := mapstructure.Decode(responseItem, &item); err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -380,7 +380,7 @@ func TestTransit_BatchEncryptionCase7(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)

decReq := &logical.Request{
Operation: logical.UpdateOperation,
Expand Down
2 changes: 1 addition & 1 deletion builtin/logical/transit/path_hmac.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ import (
// A map type allows us to distinguish between empty and missing values.
type batchRequestHMACItem map[string]string

// BatchResponseItem represents a response item for batch processing
// batchResponseHMACItem represents a response item for batch processing
type batchResponseHMACItem struct {
// HMAC for the input present in the corresponding batch request item
HMAC string `json:"hmac,omitempty" mapstructure:"hmac"`
Expand Down
2 changes: 1 addition & 1 deletion builtin/logical/transit/path_rewrap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ func (b *backend) pathRewrapWrite(ctx context.Context, req *logical.Request, d *
}
}

batchResponseItems := make([]BatchResponseItem, len(batchInputItems))
batchResponseItems := make([]EncryptBatchResponseItem, len(batchInputItems))
contextSet := len(batchInputItems[0].Context) != 0

for i, item := range batchInputItems {
Expand Down
4 changes: 2 additions & 2 deletions builtin/logical/transit/path_rewrap_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,7 @@ func TestTransit_BatchRewrapCase3(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchEncryptionResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchEncryptionResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)

batchRewrapInput := make([]interface{}, len(batchEncryptionResponseItems))
for i, item := range batchEncryptionResponseItems {
Expand Down Expand Up @@ -274,7 +274,7 @@ func TestTransit_BatchRewrapCase3(t *testing.T) {
t.Fatalf("err:%v resp:%#v", err, resp)
}

batchRewrapResponseItems := resp.Data["batch_results"].([]BatchResponseItem)
batchRewrapResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)

if len(batchRewrapResponseItems) != len(batchEncryptionResponseItems) {
t.Fatalf("bad: length of input and output or rewrap are not matching; expected: %d, actual: %d", len(batchEncryptionResponseItems), len(batchRewrapResponseItems))
Expand Down