vault

Aug 21, 2016

Changes in this version

+ const IntNoForwardingHeaderName

+ const TestClusterCACert

+ const TestClusterCAKey

+ const TestClusterServerCert

+ const TestClusterServerKey

+ var ErrCannotForward = errors.New("cannot forward request; no connection or address not known")

+ func RegisterRequestForwardingServer(s *grpc.Server, srv RequestForwardingServer)

+ func TestCoreInitClusterWrapperSetup(t *testing.T, core *Core, clusterAddrs []*net.TCPAddr, ...) ([]byte, string)

+ func TestCoreUnseal(core *Core, key []byte) (bool, error)

+ func TestWaitActive(t *testing.T, core *Core)

+ func WrapHandlerForClustering(handler http.Handler, logger log.Logger) func() (http.Handler, http.Handler)

+ func WrapListenersForClustering(addrs []string, logger log.Logger) func() ([]net.Listener, error)

+ type Cluster struct

+ ID string

+ Name string

type Core

+ func (c *Core) BarrierKeyLength() (min, max int)

+ func (c *Core) Cluster() (*Cluster, error)

+ func (c *Core) ClusterTLSConfig() (*tls.Config, error)

+ func (c *Core) ForwardRequest(req *http.Request) (int, []byte, error)

+ func (c *Core) Logger() log.Logger

+ func (c *Core) SetClusterListenerAddrs(addrs []*net.TCPAddr)

+ func (c *Core) SetClusterSetupFuncs(handler func() (http.Handler, http.Handler))

type CoreConfig

+ ClusterAddr string

+ ClusterName string

+ RedirectAddr string

+ type RequestForwardingClient interface

+ HandleRequest func(ctx context.Context, in *forwarding.Request, opts ...grpc.CallOption) (*forwarding.Response, error)

+ func NewRequestForwardingClient(cc *grpc.ClientConn) RequestForwardingClient

+ type RequestForwardingServer interface

+ HandleRequest func(context.Context, *forwarding.Request) (*forwarding.Response, error)

+ type TestClusterCore struct

+ CACert *x509.Certificate

+ CACertBytes []byte

+ Key []byte

+ Listeners []*TestListener

+ Root string

+ TLSConfig *tls.Config

+ func TestCluster(t *testing.T, handlers []http.Handler, base *CoreConfig, unsealStandbys bool) []*TestClusterCore

+ func (t *TestClusterCore) CloseListeners()

+ type TestListener struct

+ Address *net.TCPAddr

type TokenEntry

+ Period time.Duration

Jun 14, 2016

Changes in this version

type Core

+ func TestCoreWithSeal(t *testing.T, testSeal Seal) *Core

+ func (c *Core) BarrierRekeyInit(config *SealConfig) error

+ func (c *Core) BarrierRekeyUpdate(key []byte, nonce string) (*RekeyResult, error)

+ func (c *Core) RecoveryRekeyInit(config *SealConfig) error

+ func (c *Core) RecoveryRekeyUpdate(key []byte, nonce string) (*RekeyResult, error)

+ func (c *Core) RekeyThreshold(recovery bool) (int, error)

+ func (c *Core) SealAccess() *SealAccess

+ func (c *Core) SealWithRequest(req *logical.Request) error

+ func (c *Core) UnsealWithStoredKeys() error

type CoreConfig

+ Seal Seal

+ type DefaultSeal struct

+ func (d *DefaultSeal) BarrierConfig() (*SealConfig, error)

+ func (d *DefaultSeal) BarrierType() string

+ func (d *DefaultSeal) Finalize() error

+ func (d *DefaultSeal) GetStoredKeys() ([][]byte, error)

+ func (d *DefaultSeal) Init() error

+ func (d *DefaultSeal) RecoveryConfig() (*SealConfig, error)

+ func (d *DefaultSeal) RecoveryKeySupported() bool

+ func (d *DefaultSeal) RecoveryType() string

+ func (d *DefaultSeal) SetBarrierConfig(config *SealConfig) error

+ func (d *DefaultSeal) SetCore(core *Core)

+ func (d *DefaultSeal) SetRecoveryConfig(config *SealConfig) error

+ func (d *DefaultSeal) SetRecoveryKey(key []byte) error

+ func (d *DefaultSeal) SetStoredKeys(keys [][]byte) error

+ func (d *DefaultSeal) StoredKeysSupported() bool

+ func (d *DefaultSeal) VerifyRecoveryKey([]byte) error

type InitResult

+ RecoveryShares [][]byte

type Keyring

+ func (k *Keyring) Zeroize(keysToo bool)

type MountEntry

+ Table string

type MountTable

+ Type string

+ type NonFatalError struct

+ Err error

+ func (e *NonFatalError) Error() string

+ func (e *NonFatalError) WrappedErrors() []error

type RekeyResult

+ RecoveryKey bool

+ type Seal interface

+ BarrierConfig func() (*SealConfig, error)

+ BarrierType func() string

+ Finalize func() error

+ GetStoredKeys func() ([][]byte, error)

+ Init func() error

+ RecoveryConfig func() (*SealConfig, error)

+ RecoveryKeySupported func() bool

+ RecoveryType func() string

+ SetBarrierConfig func(*SealConfig) error

+ SetCore func(*Core)

+ SetRecoveryConfig func(*SealConfig) error

+ SetRecoveryKey func([]byte) error

+ SetStoredKeys func([][]byte) error

+ StoredKeysSupported func() bool

+ VerifyRecoveryKey func([]byte) error

+ type SealAccess struct

+ func (s *SealAccess) BarrierConfig() (*SealConfig, error)

+ func (s *SealAccess) RecoveryConfig() (*SealConfig, error)

+ func (s *SealAccess) RecoveryKeySupported() bool

+ func (s *SealAccess) SetSeal(seal Seal)

+ func (s *SealAccess) StoredKeysSupported() bool

type SealConfig

+ StoredShares int

+ Type string

+ func (s *SealConfig) Clone() *SealConfig

type TokenEntry

+ ExplicitMaxTTL time.Duration

Mar 16, 2016

Changes in this version

+ const RootCapability

type ACL

+ func (a *ACL) Capabilities(path string) (pathCapabilities []string)

type Core

+ func (c *Core) Capabilities(token, path string) ([]string, error)

+ func (c *Core) CapabilitiesAccessor(accessor, path string) ([]string, error)

+ func (c *Core) StepDown(token string) error

type ExpirationManager

+ func (m *ExpirationManager) RevokeForce(prefix string) error

+ type StatusBadRequest struct

+ Err string

+ func (s *StatusBadRequest) Error() string

type TokenEntry

+ Accessor string

+ Role string

Feb 10, 2016

Changes in this version

+ const CreateCapability

+ const CreateCapabilityInt

+ const DeleteCapability

+ const DeleteCapabilityInt

+ const DenyCapability

+ const DenyCapabilityInt

+ const ListCapability

+ const ListCapabilityInt

+ const OldDenyPathPolicy

+ const OldReadPathPolicy

+ const OldSudoPathPolicy

+ const OldWritePathPolicy

+ const ReadCapability

+ const ReadCapabilityInt

+ const SudoCapability

+ const SudoCapabilityInt

+ const UpdateCapability

+ const UpdateCapabilityInt

+ func GenerateRandBytes(length int) ([]byte, error)

+ func TestCoreWithTokenStore(t *testing.T) (*Core, *TokenStore, []byte, string)

type Core

+ func (c *Core) GenerateRootCancel() error

+ func (c *Core) GenerateRootConfiguration() (*GenerateRootConfig, error)

+ func (c *Core) GenerateRootInit(otp, pgpKey string) error

+ func (c *Core) GenerateRootProgress() (int, error)

+ func (c *Core) GenerateRootUpdate(key []byte, nonce string) (*GenerateRootResult, error)

+ func (c *Core) RekeyDeleteBackup() error

+ func (c *Core) RekeyRetrieveBackup() (*RekeyBackup, error)

type CoreConfig

+ HAPhysical physical.HABackend

type ExpirationManager

+ func (m *ExpirationManager) FetchLeaseTimes(leaseID string) (*leaseEntry, error)

+ func (m *ExpirationManager) FetchLeaseTimesByToken(source, token string) (*leaseEntry, error)

+ type GenerateRootConfig struct

+ Nonce string

+ OTP string

+ PGPFingerprint string

+ PGPKey string

+ type GenerateRootResult struct

+ EncodedRootToken string

+ PGPFingerprint string

+ Progress int

+ Required int

+ type PathCapabilities struct

+ Capabilities []string

+ CapabilitiesBitmap uint32

+ Glob bool

+ Policy string

+ Prefix string

+ type RekeyBackup struct

+ Keys map[string][]string

+ Nonce string

type RekeyResult

+ Backup bool

+ PGPFingerprints []string

type Router

+ func (r *Router) RouteExistenceCheck(req *logical.Request) (bool, bool, error)

type SealConfig

+ Backup bool

+ Nonce string

Dec 10, 2015

Changes in this version

type AuditBroker

+ func (a *AuditBroker) GetHash(name string, input string) (string, error)

type Core

+ func (c *Core) ResetUnsealProcess()

Sep 28, 2015

Changes in this version

+ const AESGCMVersion1

+ const AESGCMVersion2

+ func AddTestLogicalBackend(name string, factory logical.Factory) error

+ func CubbyholeBackendFactory(conf *logical.BackendConfig) (logical.Backend, error)

+ func LeaseSwitchedPassthroughBackend(conf *logical.BackendConfig, leases bool) (logical.Backend, error)

+ func LeasedPassthroughBackendFactory(conf *logical.BackendConfig) (logical.Backend, error)

+ func StartSSHHostTestServer() (string, error)

type CoreConfig

+ DefaultLeaseTTL time.Duration

+ MaxLeaseTTL time.Duration

+ type CubbyholeBackend struct

+ type MountConfig struct

+ DefaultLeaseTTL time.Duration

+ MaxLeaseTTL time.Duration

type MountEntry

+ Config MountConfig

type MountTable

+ func (t *MountTable) ShallowClone() *MountTable

type PassthroughBackend

+ func (b *PassthroughBackend) GeneratesLeases() bool

type Router

+ func (r *Router) MatchingBackend(path string) logical.Backend

+ func (r *Router) MatchingMountEntry(path string) *MountEntry

+ func (r *Router) MatchingStorageView(path string) *BarrierView

+ func (r *Router) MatchingSystemView(path string) logical.SystemView

type SealConfig

+ PGPKeys []string

type TokenEntry

+ CreationTime int64

+ TTL time.Duration

Jul 13, 2015

Changes in this version

type AESGCMBarrier

+ func (b *AESGCMBarrier) ActiveKeyInfo() (*KeyInfo, error)

+ func (b *AESGCMBarrier) CheckUpgrade() (bool, uint32, error)

+ func (b *AESGCMBarrier) CreateUpgrade(term uint32) error

+ func (b *AESGCMBarrier) DestroyUpgrade(term uint32) error

+ func (b *AESGCMBarrier) Rekey(key []byte) error

+ func (b *AESGCMBarrier) ReloadKeyring() error

+ func (b *AESGCMBarrier) ReloadMasterKey() error

+ func (b *AESGCMBarrier) Rotate() (uint32, error)

+ func (b *AESGCMBarrier) VerifyMaster(key []byte) error

type Core

+ func (c *Core) RekeyCancel() error

+ func (c *Core) RekeyConfig() (*SealConfig, error)

+ func (c *Core) RekeyInit(config *SealConfig) error

+ func (c *Core) RekeyProgress() (int, error)

+ func (c *Core) RekeyUpdate(key []byte) (*RekeyResult, error)

+ func (c *Core) Shutdown() error

+ type EncodedKeyring struct

+ Keys []*Key

+ MasterKey []byte

+ type Key struct

+ InstallTime time.Time

+ Term uint32

+ Value []byte

+ Version int

+ func DeserializeKey(buf []byte) (*Key, error)

+ func (k *Key) Serialize() ([]byte, error)

+ type KeyInfo struct

+ InstallTime time.Time

+ Term int

+ type Keyring struct

+ func DeserializeKeyring(buf []byte) (*Keyring, error)

+ func NewKeyring() *Keyring

+ func (k *Keyring) ActiveKey() *Key

+ func (k *Keyring) ActiveTerm() uint32

+ func (k *Keyring) AddKey(key *Key) (*Keyring, error)

+ func (k *Keyring) Clone() *Keyring

+ func (k *Keyring) MasterKey() []byte

+ func (k *Keyring) RemoveKey(term uint32) (*Keyring, error)

+ func (k *Keyring) Serialize() ([]byte, error)

+ func (k *Keyring) SetMasterKey(val []byte) *Keyring

+ func (k *Keyring) TermKey(term uint32) *Key

type PathPolicy

+ Glob bool

+ func (p *PathPolicy) TakesPrecedence(other *PathPolicy) bool

+ type PolicyEntry struct

+ Raw string

+ Version int

+ type RekeyResult struct

+ SecretShares [][]byte

type SecurityBarrier

+ ActiveKeyInfo func() (*KeyInfo, error)

+ CheckUpgrade func() (bool, uint32, error)

+ CreateUpgrade func(term uint32) error

+ DestroyUpgrade func(term uint32) error

+ Rekey func([]byte) error

+ ReloadKeyring func() error

+ ReloadMasterKey func() error

+ Rotate func() (uint32, error)

+ VerifyMaster func(key []byte) error

type SystemBackend

+ Backend *framework.Backend

Apr 28, 2015

Changes in this version

+ const PathPolicyDeny

+ const PathPolicyRead

+ const PathPolicySudo

+ const PathPolicyWrite

+ var ErrAlreadyInit = errors.New("Vault is already initialized")

+ var ErrBarrierAlreadyInit = errors.New("Vault is already initialized")

+ var ErrBarrierInvalidKey = errors.New("Unseal failed, invalid key")

+ var ErrBarrierNotInit = errors.New("Vault is not initialized")

+ var ErrBarrierSealed = errors.New("Vault is sealed")

+ var ErrHANotEnabled = errors.New("Vault is not configured for highly-available mode")

+ var ErrInternalError = errors.New("internal error")

+ var ErrNotInit = errors.New("Vault is not initialized")

+ var ErrSealed = errors.New("Vault is sealed")

+ var ErrStandby = errors.New("Vault is in standby mode")

+ func ClearView(view *BarrierView) error

+ func CollectKeys(view *BarrierView) ([]string, error)

+ func LockMemory() error — darwin/amd64, linux/amd64, windows/amd64

+ func NewSystemBackend(core *Core) logical.Backend

+ func PassthroughBackendFactory(map[string]string) (logical.Backend, error)

+ func ScanView(view *BarrierView, cb func(path string)) error

+ func TestCoreInit(t *testing.T, core *Core) ([]byte, string)

+ func TestKeyCopy(key []byte) []byte

+ type ACL struct

+ func NewACL(policies []*Policy) (*ACL, error)

+ func (a *ACL) AllowOperation(op logical.Operation, path string) bool

+ func (a *ACL) RootPrivilege(path string) bool

+ type AESGCMBarrier struct

+ func NewAESGCMBarrier(physical physical.Backend) (*AESGCMBarrier, error)

+ func (b *AESGCMBarrier) Delete(key string) error

+ func (b *AESGCMBarrier) GenerateKey() ([]byte, error)

+ func (b *AESGCMBarrier) Get(key string) (*Entry, error)

+ func (b *AESGCMBarrier) Initialize(key []byte) error

+ func (b *AESGCMBarrier) Initialized() (bool, error)

+ func (b *AESGCMBarrier) KeyLength() (int, int)

+ func (b *AESGCMBarrier) List(prefix string) ([]string, error)

+ func (b *AESGCMBarrier) Put(entry *Entry) error

+ func (b *AESGCMBarrier) Seal() error

+ func (b *AESGCMBarrier) Sealed() (bool, error)

+ func (b *AESGCMBarrier) Unseal(key []byte) error

+ type AuditBroker struct

+ func NewAuditBroker(log *log.Logger) *AuditBroker

+ func (a *AuditBroker) Deregister(name string)

+ func (a *AuditBroker) IsRegistered(name string) bool

+ func (a *AuditBroker) LogRequest(auth *logical.Auth, req *logical.Request) error

+ func (a *AuditBroker) LogResponse(auth *logical.Auth, req *logical.Request, resp *logical.Response, err error) error

+ func (a *AuditBroker) Register(name string, b audit.Backend, v *BarrierView)

+ type BarrierStorage interface

+ Delete func(key string) error

+ Get func(key string) (*Entry, error)

+ List func(prefix string) ([]string, error)

+ Put func(entry *Entry) error

+ type BarrierView struct

+ func NewBarrierView(barrier BarrierStorage, prefix string) *BarrierView

+ func (v *BarrierView) Delete(key string) error

+ func (v *BarrierView) Get(key string) (*logical.StorageEntry, error)

+ func (v *BarrierView) List(prefix string) ([]string, error)

+ func (v *BarrierView) Put(entry *logical.StorageEntry) error

+ func (v *BarrierView) SubView(prefix string) *BarrierView

+ type Core struct

+ func NewCore(conf *CoreConfig) (*Core, error)

+ func TestCore(t *testing.T) *Core

+ func TestCoreUnsealed(t *testing.T) (*Core, []byte, string)

+ func (c *Core) HandleRequest(req *logical.Request) (*logical.Response, error)

+ func (c *Core) Initialize(config *SealConfig) (*InitResult, error)

+ func (c *Core) Initialized() (bool, error)

+ func (c *Core) Leader() (bool, string, error)

+ func (c *Core) Seal(token string) error

+ func (c *Core) SealConfig() (*SealConfig, error)

+ func (c *Core) Sealed() (bool, error)

+ func (c *Core) SecretProgress() int

+ func (c *Core) Standby() (bool, error)

+ func (c *Core) Unseal(key []byte) (bool, error)

+ type CoreConfig struct

+ AdvertiseAddr string

+ AuditBackends map[string]audit.Factory

+ CacheSize int

+ CredentialBackends map[string]logical.Factory

+ DisableCache bool

+ DisableMlock bool

+ Logger *log.Logger

+ LogicalBackends map[string]logical.Factory

+ Physical physical.Backend

+ type Entry struct

+ Key string

+ Value []byte

+ func (e *Entry) Logical() *logical.StorageEntry

+ type ErrInvalidKey struct

+ Reason string

+ func (e *ErrInvalidKey) Error() string

+ type ExpirationManager struct

+ func NewExpirationManager(router *Router, view *BarrierView, ts *TokenStore, logger *log.Logger) *ExpirationManager

+ func (m *ExpirationManager) Register(req *logical.Request, resp *logical.Response) (string, error)

+ func (m *ExpirationManager) RegisterAuth(source string, auth *logical.Auth) error

+ func (m *ExpirationManager) Renew(leaseID string, increment time.Duration) (*logical.Response, error)

+ func (m *ExpirationManager) RenewToken(source string, token string, increment time.Duration) (*logical.Auth, error)

+ func (m *ExpirationManager) Restore() error

+ func (m *ExpirationManager) Revoke(leaseID string) error

+ func (m *ExpirationManager) RevokeByToken(token string) error

+ func (m *ExpirationManager) RevokePrefix(prefix string) error

+ func (m *ExpirationManager) Stop() error

+ type InitResult struct

+ RootToken string

+ SecretShares [][]byte

+ type MountEntry struct

+ Description string

+ Options map[string]string

+ Path string

+ Tainted bool

+ Type string

+ UUID string

+ func (e *MountEntry) Clone() *MountEntry

+ type MountTable struct

+ Entries []*MountEntry

+ func (t *MountTable) Clone() *MountTable

+ func (t *MountTable) Find(path string) *MountEntry

+ func (t *MountTable) Hash() ([]byte, error)

+ func (t *MountTable) Remove(path string) bool

+ func (t *MountTable) SetTaint(path string, value bool) bool

+ type PassthroughBackend struct

+ type PathPolicy struct

+ Policy string

+ Prefix string

+ type Policy struct

+ Name string

+ Paths []*PathPolicy

+ Raw string

+ func Parse(rules string) (*Policy, error)

+ type PolicyStore struct

+ func NewPolicyStore(view *BarrierView) *PolicyStore

+ func (ps *PolicyStore) ACL(names ...string) (*ACL, error)

+ func (ps *PolicyStore) DeletePolicy(name string) error

+ func (ps *PolicyStore) GetPolicy(name string) (*Policy, error)

+ func (ps *PolicyStore) ListPolicies() ([]string, error)

+ func (ps *PolicyStore) SetPolicy(p *Policy) error

+ type RollbackManager struct

+ func NewRollbackManager(logger *log.Logger, mounts *MountTable, router *Router) *RollbackManager

+ func (m *RollbackManager) Rollback(path string) error

+ func (m *RollbackManager) Start()

+ func (m *RollbackManager) Stop()

+ type Router struct

+ func NewRouter() *Router

+ func (r *Router) LoginPath(path string) bool

+ func (r *Router) MatchingMount(path string) string

+ func (r *Router) MatchingView(path string) *BarrierView

+ func (r *Router) Mount(backend logical.Backend, prefix, salt string, view *BarrierView) error

+ func (r *Router) Remount(src, dst string) error

+ func (r *Router) RootPath(path string) bool

+ func (r *Router) Route(req *logical.Request) (*logical.Response, error)

+ func (r *Router) Taint(path string) error

+ func (r *Router) Unmount(prefix string) error

+ func (r *Router) Untaint(path string) error

+ type SealConfig struct

+ SecretShares int

+ SecretThreshold int

+ func (s *SealConfig) Validate() error

+ type SecurityBarrier interface

+ GenerateKey func() ([]byte, error)

+ Initialize func([]byte) error

+ Initialized func() (bool, error)

+ KeyLength func() (int, int)

+ Seal func() error

+ Sealed func() (bool, error)

+ Unseal func(key []byte) error

+ type SystemBackend struct

+ Core *Core

+ type TokenEntry struct

+ DisplayName string

+ ID string

+ Meta map[string]string

+ NumUses int

+ Parent string

+ Path string

+ Policies []string

+ type TokenStore struct

+ func NewTokenStore(c *Core) (*TokenStore, error)

+ func (t *TokenStore) SetExpirationManager(exp *ExpirationManager)

+ func (ts *TokenStore) Create(entry *TokenEntry) error

+ func (ts *TokenStore) Lookup(id string) (*TokenEntry, error)

+ func (ts *TokenStore) Revoke(id string) error

+ func (ts *TokenStore) RevokeTree(id string) error

+ func (ts *TokenStore) RootToken() (*TokenEntry, error)

+ func (ts *TokenStore) SaltID(id string) string

+ func (ts *TokenStore) UseToken(te *TokenEntry) error