scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 10:12:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Only use entropy augmentation for root token creation [VAULT-670] (#10487)

Browse Source 
* Only use entropy augmentation for root token creation

* changelog

* change wording of changelog entry
This commit is contained in:
Hridoy Roy
2020-12-04 09:44:04 -08:00
committed by GitHub
parent 403b94eb34
commit bbe77aa034
3 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
changelog/10487.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
core (enterprise): Limit entropy augmentation during token generation to root tokens.
```

2
go.mod
View File

@@ -149,7 +149,7 @@ require (
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0
golang.org/x/net v0.0.0-20200625001655-4c5254603344
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
golang.org/x/sys v0.0.0-20200828194041-157a740278f4
golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a
golang.org/x/tools v0.0.0-20200521155704-91d71f6c2f04
google.golang.org/api v0.29.0
google.golang.org/grpc v1.29.1

8
vault/token_store.go
View File

@@ -806,7 +806,9 @@ func (ts *TokenStore) create(ctx context.Context, entry *logical.TokenEntry) err
}
entry.Policies = policyutil.SanitizePolicies(entry.Policies, policyutil.DoNotAddDefaultPolicy)
var createRootTokenFlag bool
if len(entry.Policies) == 1 && entry.Policies[0] == "root" {
createRootTokenFlag = true
metrics.IncrCounter([]string{"token", "create_root"}, 1)
}
@@ -820,7 +822,11 @@ func (ts *TokenStore) create(ctx context.Context, entry *logical.TokenEntry) err
if entry.ID == "" {
userSelectedID = false
var err error
entry.ID, err = base62.RandomWithReader(TokenLength, ts.core.secureRandomReader)
if createRootTokenFlag {
entry.ID, err = base62.RandomWithReader(TokenLength, ts.core.secureRandomReader)
} else {
entry.ID, err = base62.Random(TokenLength)
}
if err != nil {
return err
}