dd-vault 0.12.0

data/lib/vault/client.rb

@@ -0,0 +1,447 @@
+require "cgi"
+require "json"
+require "uri"
+
+require_relative "persistent"
+require_relative "configurable"
+require_relative "errors"
+require_relative "version"
+require_relative "encode"
+
+module Vault
+  class Client
+    # The user agent for this client.
+    USER_AGENT = "VaultRuby/#{Vault::VERSION} (+github.com/hashicorp/vault-ruby)".freeze
+
+    # The name of the header used to hold the Vault token.
+    TOKEN_HEADER = "X-Vault-Token".freeze
+
+    # The name of the header used to hold the wrapped request ttl.
+    WRAP_TTL_HEADER = "X-Vault-Wrap-TTL".freeze
+
+    # The name of the header used for redirection.
+    LOCATION_HEADER = "location".freeze
+
+    # The default headers that are sent with every request.
+    DEFAULT_HEADERS = {
+      "Content-Type" => "application/json",
+      "Accept"       => "application/json",
+      "User-Agent"   => USER_AGENT,
+    }.freeze
+
+    # The default list of options to use when parsing JSON.
+    JSON_PARSE_OPTIONS = {
+      max_nesting:      false,
+      create_additions: false,
+      symbolize_names:  true,
+    }.freeze
+
+    RESCUED_EXCEPTIONS = [].tap do |a|
+      # Failure to even open the socket (usually permissions)
+      a << SocketError
+
+      # Failed to reach the server (aka bad URL)
+      a << Errno::ECONNREFUSED
+
+      # Failed to read body or no response body given
+      a << EOFError
+
+      # Timeout (Ruby 1.9-)
+      a << Timeout::Error
+
+      # Timeout (Ruby 1.9+) - Ruby 1.9 does not define these constants so we
+      # only add them if they are defiend
+      a << Net::ReadTimeout if defined?(Net::ReadTimeout)
+      a << Net::OpenTimeout if defined?(Net::OpenTimeout)
+
+      a << PersistentHTTP::Error
+    end.freeze
+
+    # Indicates a requested operation is not possible due to security
+    # concerns.
+    class SecurityError < RuntimeError
+    end
+
+    include Vault::Configurable
+
+    # Create a new Client with the given options. Any options given take
+    # precedence over the default options.
+    #
+    # @return [Vault::Client]
+    def initialize(options = {})
+      # Use any options given, but fall back to the defaults set on the module
+      Vault::Configurable.keys.each do |key|
+        value = options.key?(key) ? options[key] : Defaults.public_send(key)
+        instance_variable_set(:"@#{key}", value)
+      end
+
+      @lock = Mutex.new
+      @nhp = nil
+    end
+
+    def pool
+      @lock.synchronize do
+        return @nhp if @nhp
+
+        @nhp = PersistentHTTP.new("vault-ruby", nil, pool_size)
+
+        if proxy_address
+          proxy_uri = URI.parse "http://#{proxy_address}"
+
+          proxy_uri.port = proxy_port if proxy_port
+
+          if proxy_username
+            proxy_uri.user = proxy_username
+            proxy_uri.password = proxy_password
+          end
+
+          @nhp.proxy = proxy_uri
+        end
+
+        # Use a custom open timeout
+        if open_timeout || timeout
+          @nhp.open_timeout = (open_timeout || timeout).to_i
+        end
+
+        # Use a custom read timeout
+        if read_timeout || timeout
+          @nhp.read_timeout = (read_timeout || timeout).to_i
+        end
+
+        @nhp.verify_mode = OpenSSL::SSL::VERIFY_PEER
+
+        # Vault requires TLS1.2
+        @nhp.ssl_version = "TLSv1_2"
+
+        # Only use secure ciphers
+        @nhp.ciphers = ssl_ciphers
+
+        # Custom pem files, no problem!
+        pem = ssl_pem_contents || (ssl_pem_file ? File.read(ssl_pem_file) : nil)
+        if pem
+          @nhp.cert = OpenSSL::X509::Certificate.new(pem)
+          @nhp.key = OpenSSL::PKey::RSA.new(pem, ssl_pem_passphrase)
+        end
+
+        # Use custom CA cert for verification
+        if ssl_ca_cert
+          @nhp.ca_file = ssl_ca_cert
+        end
+
+        # Use custom CA path that contains CA certs
+        if ssl_ca_path
+          @nhp.ca_path = ssl_ca_path
+        end
+
+        if ssl_cert_store
+          @nhp.cert_store = ssl_cert_store
+        end
+
+        # Naughty, naughty, naughty! Don't blame me when someone hops in
+        # and executes a MITM attack!
+        if !ssl_verify
+          @nhp.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        end
+
+        # Use custom timeout for connecting and verifying via SSL
+        if ssl_timeout || timeout
+          @nhp.ssl_timeout = (ssl_timeout || timeout).to_i
+        end
+
+        @nhp
+      end
+    end
+
+    private :pool
+
+    # Shutdown any open pool connections. Pool will be recreated upon next request.
+    def shutdown
+      @nhp.shutdown()
+      @nhp = nil
+    end
+
+    # Creates and yields a new client object with the given token. This may be
+    # used safely in a threadsafe manner because the original client remains
+    # unchanged. The value of the block is returned.
+    #
+    # @yield [Vault::Client]
+    def with_token(token)
+      client = self.dup
+      client.token = token
+      return yield client if block_given?
+      return nil
+    end
+
+    # Determine if the given options are the same as ours.
+    # @return [true, false]
+    def same_options?(opts)
+      options.hash == opts.hash
+    end
+
+    # Perform a GET request.
+    # @see Client#request
+    def get(path, params = {}, headers = {})
+      request(:get, path, params, headers)
+    end
+
+    # Perform a LIST request.
+    # @see Client#request
+    def list(path, params = {}, headers = {})
+      params = params.merge(list: true)
+      request(:get, path, params, headers)
+    end
+
+    # Perform a POST request.
+    # @see Client#request
+    def post(path, data = {}, headers = {})
+      request(:post, path, data, headers)
+    end
+
+    # Perform a PUT request.
+    # @see Client#request
+    def put(path, data, headers = {})
+      request(:put, path, data, headers)
+    end
+
+    # Perform a PATCH request.
+    # @see Client#request
+    def patch(path, data, headers = {})
+      request(:patch, path, data, headers)
+    end
+
+    # Perform a DELETE request.
+    # @see Client#request
+    def delete(path, params = {}, headers = {})
+      request(:delete, path, params, headers)
+    end
+
+    # Make an HTTP request with the given verb, data, params, and headers. If
+    # the response has a return type of JSON, the JSON is automatically parsed
+    # and returned as a hash; otherwise it is returned as a string.
+    #
+    # @raise [HTTPError]
+    #   if the request is not an HTTP 200 OK
+    #
+    # @param [Symbol] verb
+    #   the lowercase symbol of the HTTP verb (e.g. :get, :delete)
+    # @param [String] path
+    #   the absolute or relative path from {Defaults.address} to make the
+    #   request against
+    # @param [#read, Hash, nil] data
+    #   the data to use (varies based on the +verb+)
+    # @param [Hash] headers
+    #   the list of headers to use
+    #
+    # @return [String, Hash]
+    #   the response body
+    def request(verb, path, data = {}, headers = {})
+      # Build the URI and request object from the given information
+      uri = build_uri(verb, path, data)
+      request = class_for_request(verb).new(uri.request_uri)
+      if uri.userinfo()
+        request.basic_auth uri.user, uri.password
+      end
+
+      if proxy_address and uri.scheme.downcase == "https"
+        raise SecurityError, "no direct https connection to vault"
+      end
+
+      # Get a list of headers
+      headers = DEFAULT_HEADERS.merge(headers)
+
+      # Add the Vault token header - users could still override this on a
+      # per-request basis
+      if !token.nil?
+        headers[TOKEN_HEADER] ||= token
+      end
+
+      # Add headers
+      headers.each do |key, value|
+        request.add_field(key, value)
+      end
+
+      # Setup PATCH/POST/PUT
+      if [:patch, :post, :put].include?(verb)
+        if data.respond_to?(:read)
+          request.content_length = data.size
+          request.body_stream = data
+        elsif data.is_a?(Hash)
+          request.form_data = data
+        else
+          request.body = data
+        end
+      end
+
+      begin
+        # Create a connection using the block form, which will ensure the socket
+        # is properly closed in the event of an error.
+        response = pool.request(uri, request)
+
+        case response
+        when Net::HTTPRedirection
+          # On a redirect of a GET or HEAD request, the URL already contains
+          # the data as query string parameters.
+          if [:head, :get].include?(verb)
+            data = {}
+          end
+          request(verb, response[LOCATION_HEADER], data, headers)
+        when Net::HTTPSuccess
+          success(response)
+        else
+          error(response)
+        end
+      rescue *RESCUED_EXCEPTIONS => e
+        raise HTTPConnectionError.new(address, e)
+      end
+    end
+
+    # Construct a URL from the given verb and path. If the request is a GET or
+    # DELETE request, the params are assumed to be query params are are
+    # converted as such using {Client#to_query_string}.
+    #
+    # If the path is relative, it is merged with the {Defaults.address}
+    # attribute. If the path is absolute, it is converted to a URI object and
+    # returned.
+    #
+    # @param [Symbol] verb
+    #   the lowercase HTTP verb (e.g. :+get+)
+    # @param [String] path
+    #   the absolute or relative HTTP path (url) to get
+    # @param [Hash] params
+    #   the list of params to build the URI with (for GET and DELETE requests)
+    #
+    # @return [URI]
+    def build_uri(verb, path, params = {})
+      # Add any query string parameters
+      if [:delete, :get].include?(verb)
+        path = [path, to_query_string(params)].compact.join("?")
+      end
+
+      # Parse the URI
+      uri = URI.parse(path)
+
+      # Don't merge absolute URLs
+      uri = URI.parse(File.join(address, path)) unless uri.absolute?
+
+      # Return the URI object
+      uri
+    end
+
+    # Helper method to get the corresponding {Net::HTTP} class from the given
+    # HTTP verb.
+    #
+    # @param [#to_s] verb
+    #   the HTTP verb to create a class from
+    #
+    # @return [Class]
+    def class_for_request(verb)
+      Net::HTTP.const_get(verb.to_s.capitalize)
+    end
+
+    # Convert the given hash to a list of query string parameters. Each key and
+    # value in the hash is URI-escaped for safety.
+    #
+    # @param [Hash] hash
+    #   the hash to create the query string from
+    #
+    # @return [String, nil]
+    #   the query string as a string, or +nil+ if there are no params
+    def to_query_string(hash)
+      hash.map do |key, value|
+        "#{CGI.escape(key.to_s)}=#{CGI.escape(value.to_s)}"
+      end.join('&')[/.+/]
+    end
+
+    # Parse the response object and manipulate the result based on the given
+    # +Content-Type+ header. For now, this method only parses JSON, but it
+    # could be expanded in the future to accept other content types.
+    #
+    # @param [HTTP::Message] response
+    #   the response object from the request
+    #
+    # @return [String, Hash]
+    #   the parsed response, as an object
+    def success(response)
+      if response.body && (response.content_type || '').include?("json")
+        JSON.parse(response.body, JSON_PARSE_OPTIONS)
+      else
+        response.body
+      end
+    end
+
+    # Raise a response error, extracting as much information from the server's
+    # response as possible.
+    #
+    # @raise [HTTPError]
+    #
+    # @param [HTTP::Message] response
+    #   the response object from the request
+    def error(response)
+      if response.body && response.body.match("missing client token")
+        raise MissingTokenError
+      end
+
+      # Use the correct exception class
+      case response
+      when Net::HTTPClientError
+        klass = HTTPClientError
+      when Net::HTTPServerError
+        klass = HTTPServerError
+      else
+        klass = HTTPError
+      end
+
+      if (response.content_type || '').include?("json")
+        # Attempt to parse the error as JSON
+        begin
+          json = JSON.parse(response.body, JSON_PARSE_OPTIONS)
+
+          if json[:errors]
+            raise klass.new(address, response, json[:errors])
+          end
+        rescue JSON::ParserError; end
+      end
+
+      raise klass.new(address, response, [response.body])
+    end
+
+    # Execute the given block with retries and exponential backoff.
+    #
+    # @param [Array<Exception>] rescued
+    #   the list of exceptions to rescue
+    def with_retries(*rescued, &block)
+      options      = rescued.last.is_a?(Hash) ? rescued.pop : {}
+      exception    = nil
+      retries      = 0
+
+      rescued = Defaults::RETRIED_EXCEPTIONS if rescued.empty?
+
+      max_attempts = options[:attempts] || Defaults::RETRY_ATTEMPTS
+      backoff_base = options[:base]     || Defaults::RETRY_BASE
+      backoff_max  = options[:max_wait] || Defaults::RETRY_MAX_WAIT
+
+      begin
+        return yield retries, exception
+      rescue *rescued => e
+        exception = e
+
+        retries += 1
+        raise if retries > max_attempts
+
+        # Calculate the exponential backoff combined with an element of
+        # randomness.
+        backoff = [backoff_base * (2 ** (retries - 1)), backoff_max].min
+        backoff = backoff * (0.5 * (1 + Kernel.rand))
+
+        # Ensure we are sleeping at least the minimum interval.
+        backoff = [backoff_base, backoff].max
+
+        # Exponential backoff.
+        Kernel.sleep(backoff)
+
+        # Now retry
+        retry
+      end
+    end
+  end
+end

data/lib/vault/configurable.rb

@@ -0,0 +1,48 @@
+require_relative "defaults"
+
+module Vault
+  module Configurable
+    def self.keys
+      @keys ||= [
+        :address,
+        :token,
+        :hostname,
+        :open_timeout,
+        :proxy_address,
+        :proxy_password,
+        :proxy_port,
+        :proxy_username,
+        :pool_size,
+        :read_timeout,
+        :ssl_ciphers,
+        :ssl_pem_contents,
+        :ssl_pem_file,
+        :ssl_pem_passphrase,
+        :ssl_ca_cert,
+        :ssl_ca_path,
+        :ssl_cert_store,
+        :ssl_verify,
+        :ssl_timeout,
+        :timeout,
+      ]
+    end
+
+    Vault::Configurable.keys.each(&method(:attr_accessor))
+
+    # Configure yields self for block-style configuration.
+    #
+    # @yield [self]
+    def configure
+      yield self
+    end
+
+    # The list of options for this configurable.
+    #
+    # @return [Hash<Symbol, Object>]
+    def options
+      Hash[*Vault::Configurable.keys.map do |key|
+        [key, instance_variable_get(:"@#{key}")]
+      end.flatten]
+    end
+  end
+end

data/lib/vault/defaults.rb

@@ -0,0 +1,197 @@
+require "pathname"
+require "base64"
+
+module Vault
+  module Defaults
+    # The default vault address.
+    # @return [String]
+    VAULT_ADDRESS = "https://127.0.0.1:8200".freeze
+
+    # The path to the vault token on disk.
+    # @return [String]
+    VAULT_DISK_TOKEN = Pathname.new("#{ENV["HOME"]}/.vault-token").expand_path.freeze
+
+    # The list of SSL ciphers to allow. You should not change this value unless
+    # you absolutely know what you are doing!
+    # @return [String]
+    SSL_CIPHERS = "TLSv1.2:!aNULL:!eNULL".freeze
+
+    # The default number of attempts.
+    # @return [Fixnum]
+    RETRY_ATTEMPTS = 2
+
+    # The default backoff interval.
+    # @return [Fixnum]
+    RETRY_BASE = 0.05
+
+    # The maximum amount of time for a single exponential backoff to sleep.
+    RETRY_MAX_WAIT = 2.0
+
+    # The default size of the connection pool
+    DEFAULT_POOL_SIZE = 16
+
+    # The set of exceptions that are detect and retried by default
+    # with `with_retries`
+    RETRIED_EXCEPTIONS = [HTTPServerError]
+
+    class << self
+      # The list of calculated options for this configurable.
+      # @return [Hash]
+      def options
+        Hash[*Configurable.keys.map { |key| [key, public_send(key)] }.flatten]
+      end
+
+      # The address to communicate with Vault.
+      # @return [String]
+      def address
+        ENV["VAULT_ADDR"] || VAULT_ADDRESS
+      end
+
+      # The vault token to use for authentiation.
+      # @return [String, nil]
+      def token
+        if !ENV["VAULT_TOKEN"].nil?
+          return ENV["VAULT_TOKEN"]
+        end
+
+        if VAULT_DISK_TOKEN.exist? && VAULT_DISK_TOKEN.readable?
+          return VAULT_DISK_TOKEN.read.chomp
+        end
+
+        nil
+      end
+
+      # The SNI host to use when connecting to Vault via TLS.
+      # @return [String, nil]
+      def hostname
+        ENV["VAULT_TLS_SERVER_NAME"]
+      end
+
+      # The number of seconds to wait when trying to open a connection before
+      # timing out
+      # @return [String, nil]
+      def open_timeout
+        ENV["VAULT_OPEN_TIMEOUT"]
+      end
+
+      # The size of the connection pool to communicate with Vault
+      # @return Integer
+      def pool_size
+        if var = ENV["VAULT_POOL_SIZE"]
+          return var.to_i
+        else
+          DEFAULT_POOL_SIZE
+        end
+      end
+
+      # The HTTP Proxy server address as a string
+      # @return [String, nil]
+      def proxy_address
+        ENV["VAULT_PROXY_ADDRESS"]
+      end
+
+      # The HTTP Proxy server username as a string
+      # @return [String, nil]
+      def proxy_username
+        ENV["VAULT_PROXY_USERNAME"]
+      end
+
+      # The HTTP Proxy user password as a string
+      # @return [String, nil]
+      def proxy_password
+        ENV["VAULT_PROXY_PASSWORD"]
+      end
+
+      # The HTTP Proxy server port as a string
+      # @return [String, nil]
+      def proxy_port
+        ENV["VAULT_PROXY_PORT"]
+      end
+
+      # The number of seconds to wait when reading a response before timing out
+      # @return [String, nil]
+      def read_timeout
+        ENV["VAULT_READ_TIMEOUT"]
+      end
+
+      # The ciphers that will be used when communicating with vault over ssl
+      # You should only change the defaults if the ciphers are not available on
+      # your platform and you know what you are doing
+      # @return [String]
+      def ssl_ciphers
+        ENV["VAULT_SSL_CIPHERS"] || SSL_CIPHERS
+      end
+
+      # The raw contents (as a string) for the pem file. To specify the path to
+      # the pem file, use {#ssl_pem_file} instead. This value is preferred over
+      # the value for {#ssl_pem_file}, if set.
+      # @return [String, nil]
+      def ssl_pem_contents
+        if ENV["VAULT_SSL_PEM_CONTENTS_BASE64"]
+          Base64.decode64(ENV["VAULT_SSL_PEM_CONTENTS_BASE64"])
+        else
+          ENV["VAULT_SSL_PEM_CONTENTS"]
+        end
+      end
+
+      # The path to a pem on disk to use with custom SSL verification
+      # @return [String, nil]
+      def ssl_pem_file
+        ENV["VAULT_SSL_CERT"] || ENV["VAULT_SSL_PEM_FILE"]
+      end
+
+      # Passphrase to the pem file on disk to use with custom SSL verification
+      # @return [String, nil]
+      def ssl_pem_passphrase
+        ENV["VAULT_SSL_CERT_PASSPHRASE"]
+      end
+
+      # The path to the CA cert on disk to use for certificate verification
+      # @return [String, nil]
+      def ssl_ca_cert
+        ENV["VAULT_CACERT"]
+      end
+
+      # The CA cert store to use for certificate verification
+      # @return [OpenSSL::X509::Store, nil]
+      def ssl_cert_store
+        nil
+      end
+
+      # The path to the directory on disk holding CA certs to use
+      # for certificate verification
+      # @return [String, nil]
+      def ssl_ca_path
+        ENV["VAULT_CAPATH"]
+      end
+
+      # Verify SSL requests (default: true)
+      # @return [true, false]
+      def ssl_verify
+        # Vault CLI uses this envvar, so accept it by precedence
+        if !ENV["VAULT_SKIP_VERIFY"].nil?
+          return false
+        end
+
+        if ENV["VAULT_SSL_VERIFY"].nil?
+          true
+        else
+          %w[t y].include?(ENV["VAULT_SSL_VERIFY"].downcase[0])
+        end
+      end
+
+      # The number of seconds to wait for connecting and verifying SSL
+      # @return [String, nil]
+      def ssl_timeout
+        ENV["VAULT_SSL_TIMEOUT"]
+      end
+
+      # A default meta-attribute to set all timeout values - individually set
+      # timeout values will take precedence
+      # @return [String, nil]
+      def timeout
+        ENV["VAULT_TIMEOUT"]
+      end
+    end
+  end
+end

data/lib/vault/encode.rb

@@ -0,0 +1,19 @@
+module Vault
+  module EncodePath
+
+    # Encodes a string according to the rules for URL paths. This is
+    # used as opposed to CGI.escape because in a URL path, space
+    # needs to be escaped as %20 and CGI.escapes a space as +.
+    #
+    # @param [String]
+    #
+    # @return [String]
+    def encode_path(path)
+      path.b.gsub(%r!([^a-zA-Z0-9_.-/]+)!) { |m|
+        '%' + m.unpack('H2' * m.bytesize).join('%').upcase
+      }
+    end
+
+    module_function :encode_path
+  end
+end