Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Only use entropy augmentation for root token creation [VAULT-670] #10487

Merged
merged 4 commits into from
Dec 4, 2020
Merged

Only use entropy augmentation for root token creation [VAULT-670] #10487

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4e72fe4
Only use entropy augmentation for root token creation
Dec 2, 2020
b3bfb56
changelog
Dec 2, 2020
0282088
change wording of changelog entry
Dec 4, 2020
8508f4a
Merge branch 'master' into VAULT-670
Dec 4, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions changelog/10487.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
core (enterprise): Limit entropy augmentation during token generation to root tokens.
```
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,7 @@ require (
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0
golang.org/x/net v0.0.0-20200625001655-4c5254603344
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
golang.org/x/sys v0.0.0-20200828194041-157a740278f4
golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a
golang.org/x/tools v0.0.0-20200521155704-91d71f6c2f04
google.golang.org/api v0.29.0
google.golang.org/grpc v1.29.1
Expand Down
8 changes: 7 additions & 1 deletion vault/token_store.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -806,7 +806,9 @@ func (ts *TokenStore) create(ctx context.Context, entry *logical.TokenEntry) err
}

entry.Policies = policyutil.SanitizePolicies(entry.Policies, policyutil.DoNotAddDefaultPolicy)
var createRootTokenFlag bool
if len(entry.Policies) == 1 && entry.Policies[0] == "root" {
createRootTokenFlag = true
metrics.IncrCounter([]string{"token", "create_root"}, 1)
}

Expand All @@ -820,7 +822,11 @@ func (ts *TokenStore) create(ctx context.Context, entry *logical.TokenEntry) err
if entry.ID == "" {
userSelectedID = false
var err error
entry.ID, err = base62.RandomWithReader(TokenLength, ts.core.secureRandomReader)
if createRootTokenFlag {
entry.ID, err = base62.RandomWithReader(TokenLength, ts.core.secureRandomReader)
} else {
entry.ID, err = base62.Random(TokenLength)
}
if err != nil {
return err
}
Expand Down