| OLD | NEW |
| 1 // Copyright 2015 The LUCI Authors. All rights reserved. | 1 // Copyright 2015 The LUCI Authors. All rights reserved. |
| 2 // Use of this source code is governed under the Apache License, Version 2.0 | 2 // Use of this source code is governed under the Apache License, Version 2.0 |
| 3 // that can be found in the LICENSE file. | 3 // that can be found in the LICENSE file. |
| 4 | 4 |
| 5 // Package gaesecrets implements storage of secret blobs on top of datastore. | 5 // Package gaesecrets implements storage of secret blobs on top of datastore. |
| 6 // | 6 // |
| 7 // It is not super secure, but we have what we have: there's no other better | 7 // It is not super secure, but we have what we have: there's no other better |
| 8 // mechanism to persistently store non-static secrets on GAE. | 8 // mechanism to persistently store non-static secrets on GAE. |
| 9 // | 9 // |
| 10 // All secrets are global (live in default GAE namespace). | 10 // All secrets are global (live in default GAE namespace). |
| 11 package gaesecrets | 11 package gaesecrets |
| 12 | 12 |
| 13 import ( | 13 import ( |
| 14 "crypto/rand" | 14 "crypto/rand" |
| 15 "fmt" | 15 "fmt" |
| 16 "io" | 16 "io" |
| 17 "strings" | 17 "strings" |
| 18 "time" | 18 "time" |
| 19 | 19 |
| 20 "golang.org/x/net/context" | 20 "golang.org/x/net/context" |
| 21 | 21 |
| 22 ds "github.com/luci/gae/service/datastore" | 22 ds "github.com/luci/gae/service/datastore" |
| 23 "github.com/luci/gae/service/info" | 23 "github.com/luci/gae/service/info" |
| 24 "github.com/luci/luci-go/common/clock" | 24 "github.com/luci/luci-go/common/clock" |
| 25 "github.com/luci/luci-go/common/data/caching/proccache" | 25 "github.com/luci/luci-go/common/data/caching/proccache" |
| 26 » "github.com/luci/luci-go/common/errors" | 26 » "github.com/luci/luci-go/common/retry" |
| 27 "github.com/luci/luci-go/server/secrets" | 27 "github.com/luci/luci-go/server/secrets" |
| 28 ) | 28 ) |
| 29 | 29 |
| 30 // TODO(vadimsh): Add secrets rotation. | 30 // TODO(vadimsh): Add secrets rotation. |
| 31 | 31 |
| 32 // procCacheExp is how long to cache secrets in the process memory. | 32 // procCacheExp is how long to cache secrets in the process memory. |
| 33 const procCacheExp = time.Minute * 5 | 33 const procCacheExp = time.Minute * 5 |
| 34 | 34 |
| 35 // Config can be used to tweak parameters of the store. It is fine to use | 35 // Config can be used to tweak parameters of the store. It is fine to use |
| 36 // default values. | 36 // default values. |
| (...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 91 c, err := info.Namespace(s.ctx, "") | 91 c, err := info.Namespace(s.ctx, "") |
| 92 if err != nil { | 92 if err != nil { |
| 93 panic(err) // should not happen, Namespace errors only on bad na
mespace name | 93 panic(err) // should not happen, Namespace errors only on bad na
mespace name |
| 94 } | 94 } |
| 95 c = ds.WithoutTransaction(c) | 95 c = ds.WithoutTransaction(c) |
| 96 | 96 |
| 97 // Grab existing. | 97 // Grab existing. |
| 98 ent := secretEntity{ID: s.cfg.Prefix + ":" + string(k)} | 98 ent := secretEntity{ID: s.cfg.Prefix + ":" + string(k)} |
| 99 err = ds.Get(c, &ent) | 99 err = ds.Get(c, &ent) |
| 100 if err != nil && err != ds.ErrNoSuchEntity { | 100 if err != nil && err != ds.ErrNoSuchEntity { |
| 101 » » return secrets.Secret{}, errors.WrapTransient(err) | 101 » » return secrets.Secret{}, retry.Tag.Apply(err) |
| 102 } | 102 } |
| 103 | 103 |
| 104 // Autogenerate and put into the datastore. | 104 // Autogenerate and put into the datastore. |
| 105 if err == ds.ErrNoSuchEntity { | 105 if err == ds.ErrNoSuchEntity { |
| 106 if s.cfg.NoAutogenerate { | 106 if s.cfg.NoAutogenerate { |
| 107 return secrets.Secret{}, secrets.ErrNoSuchSecret | 107 return secrets.Secret{}, secrets.ErrNoSuchSecret |
| 108 } | 108 } |
| 109 ent.Created = clock.Now(s.ctx).UTC() | 109 ent.Created = clock.Now(s.ctx).UTC() |
| 110 if ent.Secret, err = s.generateSecret(); err != nil { | 110 if ent.Secret, err = s.generateSecret(); err != nil { |
| 111 » » » return secrets.Secret{}, errors.WrapTransient(err) | 111 » » » return secrets.Secret{}, retry.Tag.Apply(err) |
| 112 } | 112 } |
| 113 if ent.SecretID, err = s.generateSecretID(ent.Created); err != n
il { | 113 if ent.SecretID, err = s.generateSecretID(ent.Created); err != n
il { |
| 114 » » » return secrets.Secret{}, errors.WrapTransient(err) | 114 » » » return secrets.Secret{}, retry.Tag.Apply(err) |
| 115 } | 115 } |
| 116 err = ds.RunInTransaction(c, func(c context.Context) error { | 116 err = ds.RunInTransaction(c, func(c context.Context) error { |
| 117 newOne := secretEntity{ID: ent.ID} | 117 newOne := secretEntity{ID: ent.ID} |
| 118 switch err := ds.Get(c, &newOne); err { | 118 switch err := ds.Get(c, &newOne); err { |
| 119 case nil: | 119 case nil: |
| 120 ent = newOne | 120 ent = newOne |
| 121 return nil | 121 return nil |
| 122 case ds.ErrNoSuchEntity: | 122 case ds.ErrNoSuchEntity: |
| 123 return ds.Put(c, &ent) | 123 return ds.Put(c, &ent) |
| 124 default: | 124 default: |
| 125 return err | 125 return err |
| 126 } | 126 } |
| 127 }, nil) | 127 }, nil) |
| 128 if err != nil { | 128 if err != nil { |
| 129 » » » return secrets.Secret{}, errors.WrapTransient(err) | 129 » » » return secrets.Secret{}, retry.Tag.Apply(err) |
| 130 } | 130 } |
| 131 } | 131 } |
| 132 | 132 |
| 133 return secrets.Secret{ | 133 return secrets.Secret{ |
| 134 Current: secrets.NamedBlob{ | 134 Current: secrets.NamedBlob{ |
| 135 ID: ent.SecretID, | 135 ID: ent.SecretID, |
| 136 Blob: ent.Secret, | 136 Blob: ent.Secret, |
| 137 }, | 137 }, |
| 138 }, nil | 138 }, nil |
| 139 } | 139 } |
| (...skipping 21 matching lines...) Expand all Loading... |
| 161 | 161 |
| 162 type secretEntity struct { | 162 type secretEntity struct { |
| 163 _kind string `gae:"$kind,gaesecrets.Secret"` | 163 _kind string `gae:"$kind,gaesecrets.Secret"` |
| 164 | 164 |
| 165 ID string `gae:"$id"` | 165 ID string `gae:"$id"` |
| 166 | 166 |
| 167 Secret []byte `gae:",noindex"` // blob with the secret | 167 Secret []byte `gae:",noindex"` // blob with the secret |
| 168 SecretID string `gae:",noindex"` // ID of the Secret blob | 168 SecretID string `gae:",noindex"` // ID of the Secret blob |
| 169 Created time.Time | 169 Created time.Time |
| 170 } | 170 } |
| OLD | NEW |