import (
uuid "github.com/hashicorp/go-uuid"
vaultapi "github.com/hashicorp/vault/api"
+ smslogger "sms/log"
"errors"
"fmt"
vaultCFG.Address = v.vaultAddress
client, err := vaultapi.NewClient(vaultCFG)
if err != nil {
- return err
+ smslogger.WriteError(err.Error())
+ return errors.New("Unable to create new vault client")
}
v.engineType = "kv"
err = v.initRole()
if err != nil {
- //print error message and try to initrole later
+ smslogger.WriteError(err.Error())
+ smslogger.WriteInfo("InitRole will try again later")
}
return nil
sys := v.vaultClient.Sys()
sealStatus, err := sys.SealStatus()
if err != nil {
- return false, err
+ smslogger.WriteError(err.Error())
+ return false, errors.New("Error getting status")
}
return sealStatus.Sealed, nil
sys := v.vaultClient.Sys()
_, err := sys.Unseal(shard)
if err != nil {
- return err
+ smslogger.WriteError(err.Error())
+ return errors.New("Unable to execute unseal operation with specified shard")
}
return nil
func (v *Vault) GetSecret(dom string, name string) (Secret, error) {
err := v.checkToken()
if err != nil {
- return Secret{}, errors.New("Token check returned error: " + err.Error())
+ smslogger.WriteError(err.Error())
+ return Secret{}, errors.New("Token check failed")
}
dom = v.vaultMount + "/" + dom
sec, err := v.vaultClient.Logical().Read(dom + "/" + name)
if err != nil {
+ smslogger.WriteError(err.Error())
return Secret{}, errors.New("Unable to read Secret at provided path")
}
// sec and err are nil in the case where a path does not exist
if sec == nil {
+ smslogger.WriteWarn("Vault read was empty. Invalid Path")
return Secret{}, errors.New("Secret not found at the provided path")
}
func (v *Vault) ListSecret(dom string) ([]string, error) {
err := v.checkToken()
if err != nil {
- return nil, errors.New("Token check returned error: " + err.Error())
+ smslogger.WriteError(err.Error())
+ return nil, errors.New("Token check failed")
}
dom = v.vaultMount + "/" + dom
sec, err := v.vaultClient.Logical().List(dom)
if err != nil {
+ smslogger.WriteError(err.Error())
return nil, errors.New("Unable to read Secret at provided path")
}
// sec and err are nil in the case where a path does not exist
if sec == nil {
+ smslogger.WriteWarn("Vaultclient returned empty data")
return nil, errors.New("Secret not found at the provided path")
}
val, ok := sec.Data["keys"].([]interface{})
if !ok {
+ smslogger.WriteError("Secret not found at the provided path")
return nil, errors.New("Secret not found at the provided path")
}
// Check if token is still valid
err := v.checkToken()
if err != nil {
- return SecretDomain{}, err
+ smslogger.WriteError(err.Error())
+ return SecretDomain{}, errors.New("Token Check failed")
}
name = strings.TrimSpace(name)
err = v.vaultClient.Sys().Mount(mountPath, mountInput)
if err != nil {
- return SecretDomain{}, err
+ smslogger.WriteError(err.Error())
+ return SecretDomain{}, errors.New("Unable to create Secret Domain")
}
uuid, _ := uuid.GenerateUUID()
func (v *Vault) CreateSecret(dom string, sec Secret) error {
err := v.checkToken()
if err != nil {
- return errors.New("Token checking returned an error" + err.Error())
+ smslogger.WriteError(err.Error())
+ return errors.New("Token check failed")
}
dom = v.vaultMount + "/" + dom
// TODO: Check if values is not empty
_, err = v.vaultClient.Logical().Write(dom+"/"+sec.Name, sec.Values)
if err != nil {
+ smslogger.WriteError(err.Error())
return errors.New("Unable to create Secret at provided path")
}
func (v *Vault) DeleteSecretDomain(name string) error {
err := v.checkToken()
if err != nil {
- return err
+ smslogger.WriteError(err.Error())
+ return errors.New("Token Check Failed")
}
name = strings.TrimSpace(name)
err = v.vaultClient.Sys().Unmount(mountPath)
if err != nil {
+ smslogger.WriteError(err.Error())
return errors.New("Unable to delete domain specified")
}
func (v *Vault) DeleteSecret(dom string, name string) error {
err := v.checkToken()
if err != nil {
- return errors.New("Token checking returned an error" + err.Error())
+ smslogger.WriteError(err.Error())
+ return errors.New("Token check failed")
}
dom = v.vaultMount + "/" + dom
// Vault return is empty on successful delete
_, err = v.vaultClient.Logical().Delete(dom + "/" + name)
if err != nil {
+ smslogger.WriteError(err.Error())
return errors.New("Unable to delete Secret at provided path")
}
path "sys/mounts/sms*" { capabilities = ["update","delete","create"] }`
err := v.vaultClient.Sys().PutPolicy(v.policyName, rules)
if err != nil {
+ smslogger.WriteError(err.Error())
return errors.New("Unable to create policy for approle creation")
}
//Check if applrole is mounted
authMounts, err := v.vaultClient.Sys().ListAuth()
if err != nil {
+ smslogger.WriteError(err.Error())
return errors.New("Unable to get mounted auth backends")
}
v.vaultClient.Logical().Write("auth/approle/role/"+rName, data)
sec, err := v.vaultClient.Logical().Read("auth/approle/role/" + rName + "/role-id")
if err != nil {
+ smslogger.WriteError(err.Error())
return errors.New("Unable to create role ID for approle")
}
v.roleID = sec.Data["role_id"].(string)
sec, err = v.vaultClient.Logical().Write("auth/approle/role/"+rName+"/secret-id",
map[string]interface{}{})
if err != nil {
+ smslogger.WriteError(err.Error())
return errors.New("Unable to create secret ID for role")
}
if v.initRoleDone == false {
err := v.initRole()
if err != nil {
- return err
+ smslogger.WriteError(err.Error())
+ return errors.New("Unable to initRole in checkToken")
}
}
out, err := v.vaultClient.Logical().Write("auth/approle/login",
map[string]interface{}{"role_id": v.roleID, "secret_id": v.secretID})
if err != nil {
- return err
+ smslogger.WriteError(err.Error())
+ return errors.New("Unable to create Temporary Token for Role")
}
tok, err := out.TokenID()
"net/http"
smsbackend "sms/backend"
+ smslogger "sms/log"
)
// handler stores two interface implementations that implement
err := json.NewDecoder(r.Body).Decode(&d)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
dom, err := h.secretBackend.CreateSecretDomain(d.Name)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
err = json.NewEncoder(w).Encode(dom)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
err := h.secretBackend.DeleteSecretDomain(domName)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
var b smsbackend.Secret
err := json.NewDecoder(r.Body).Decode(&b)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
err = h.secretBackend.CreateSecret(domName, b)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
sec, err := h.secretBackend.GetSecret(domName, secName)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
err = json.NewEncoder(w).Encode(sec)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
sec, err := h.secretBackend.ListSecret(domName)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
err = json.NewEncoder(w).Encode(sec)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
err := h.secretBackend.DeleteSecret(domName, secName)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
func (h handler) statusHandler(w http.ResponseWriter, r *http.Request) {
s, err := h.secretBackend.GetStatus()
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
status := backendStatus{Seal: s}
err = json.NewEncoder(w).Encode(status)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
decoder.DisallowUnknownFields()
err := decoder.Decode(&inp)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, "Bad input JSON", http.StatusBadRequest)
return
}
err = h.secretBackend.Unseal(inp.UnsealShard)
if err != nil {
+ smslogger.WriteError(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}