legion-crypt 1.5.38 → 1.5.42

data/lib/legion/crypt/vault/client.rb

@@ -0,0 +1,355 @@
+# frozen_string_literal: true
+
+require 'faraday'
+require 'legion/json'
+require 'openssl'
+require 'uri'
+
+module Legion
+  module Crypt
+    module Vault
+      class HTTPError < StandardError
+        attr_reader :code, :errors, :address
+
+        def initialize(code:, errors: [], address: nil, **)
+          @code = Integer(code)
+          @errors = Array(errors)
+          @address = address
+          super("Vault HTTP #{@code}#{": #{@errors.join('; ')}" unless @errors.empty?}")
+        end
+      end
+
+      class HTTPClientError < HTTPError; end
+      class HTTPServerError < HTTPError; end
+
+      class Client
+        CONNECTION_ATTRIBUTES = %i[address ssl_verify ca cert key timeout].freeze
+
+        attr_reader(*CONNECTION_ATTRIBUTES, :logical, :sys, :auth_token, :token)
+        attr_accessor :namespace
+
+        def initialize(address:, token: nil, namespace: nil, tls: {}, timeout: 5, **)
+          @address = validate_address(address: address)
+          @timeout = validate_timeout(timeout: timeout)
+          @token = token
+          @namespace = namespace
+          @ssl_verify = tls[:verify] != false && tls[:verify].to_s != 'none'
+          @ca = tls[:ca]
+          @cert = tls[:cert]
+          @key = tls[:key]
+          @mutex = Mutex.new
+          @retired = false
+          @logical = Logical.new(client: self)
+          @sys = Sys.new(client: self)
+          @auth_token = AuthToken.new(client: self)
+        end
+
+        CONNECTION_ATTRIBUTES.each do |attribute|
+          define_method(:"#{attribute}=") do |value|
+            value = validate_address(address: value) if attribute == :address
+            value = validate_timeout(timeout: value) if attribute == :timeout
+            @mutex.synchronize do
+              return value if instance_variable_get(:"@#{attribute}") == value
+
+              previous = @connection
+              @connection = nil
+              instance_variable_set(:"@#{attribute}", value)
+              previous&.close
+            end
+            value
+          end
+        end
+
+        def token=(value)
+          @mutex.synchronize do
+            raise IOError, 'Vault client has been shut down' if @retired
+
+            @token = value
+          end
+        end
+
+        def kv(mount:, **)
+          KV.new(client: self, mount: mount)
+        end
+
+        def put(path:, body:, headers: {}, **)
+          request(method: :put, path: path, body: body, headers: headers) || {}
+        end
+
+        def request(method:, path:, body: nil, headers: {}, nil_on_not_found: false, **)
+          connection, request_headers, address = @mutex.synchronize do
+            raise IOError, 'Vault client has been shut down' if @retired
+
+            [@connection ||= build_connection, vault_headers(headers: headers), @address]
+          end
+          payload = body.is_a?(String) || body.nil? ? body : Legion::JSON.dump(body)
+          response = connection.run_request(method, request_path(path: path), payload, request_headers)
+          return nil if nil_on_not_found && response.status == 404
+
+          decode_response(response: response, address: address)
+        end
+
+        def shutdown
+          @mutex.synchronize do
+            @retired = true
+            previous = @connection
+            @connection = nil
+            previous&.close
+          end
+          nil
+        end
+
+        def inspect
+          "#<#{self.class}>"
+        end
+
+        class Logical
+          def initialize(client:, **)
+            @client = client
+          end
+
+          def read(path:, **)
+            Secret.decode(data: @client.request(method: :get, path: path, nil_on_not_found: true))
+          end
+
+          def write(path:, data:, **)
+            Secret.decode(data: @client.put(path: path, body: data))
+          end
+
+          def delete(path:, **)
+            @client.request(method: :delete, path: path)
+            true
+          end
+        end
+
+        class Sys
+          class HealthStatus
+            def initialize(data:, **)
+              @initialized = data[:initialized]
+            end
+
+            def initialized?
+              @initialized == true
+            end
+          end
+
+          def initialize(client:, **)
+            @client = client
+          end
+
+          def health_status
+            HealthStatus.new(data: @client.request(method: :get, path: 'sys/health'))
+          end
+
+          def mounts
+            @client.request(method: :get, path: 'sys/mounts').fetch(:data)
+          end
+
+          def renew(lease_id:, **)
+            Secret.decode(data: @client.put(path: 'sys/leases/renew', body: { lease_id: lease_id }))
+          end
+
+          def revoke(lease_id:, **)
+            @client.put(path: 'sys/leases/revoke', body: { lease_id: lease_id })
+            true
+          end
+        end
+
+        class AuthToken
+          def initialize(client:, **)
+            @client = client
+          end
+
+          def renew_self
+            Secret.decode(data: @client.put(path: 'auth/token/renew-self', body: {}))
+          end
+
+          def revoke_self
+            @client.put(path: 'auth/token/revoke-self', body: {})
+            true
+          end
+        end
+
+        class KV
+          def initialize(client:, mount:, **)
+            @client = client
+            mount = mount.to_s
+            first = mount.index(%r{[^/]})
+            @mount = first ? mount[first..mount.rindex(%r{[^/]})] : ''
+          end
+
+          def read(path:, **)
+            response = @client.request(method: :get, path: "#{@mount}/data/#{path}", nil_on_not_found: true)
+            return nil if response.nil?
+
+            Secret.decode(data: response.merge(data: response.dig(:data, :data)))
+          end
+
+          def write(path:, data:, **)
+            Secret.decode(data: @client.put(path: "#{@mount}/data/#{path}", body: { data: data }))
+          end
+
+          def read_metadata(path:, **)
+            Secret.decode(data: @client.request(method: :get, path: "#{@mount}/metadata/#{path}", nil_on_not_found: true))
+          end
+        end
+
+        class Secret
+          attr_reader :data, :auth, :lease_id, :lease_duration
+
+          def self.decode(data:, **)
+            return nil if data.nil? || data.empty?
+
+            new(data: data)
+          end
+
+          def initialize(data:, **)
+            @data = data[:data]
+            @auth = Auth.new(data: data[:auth]) unless data[:auth].nil?
+            @lease_id = data[:lease_id]
+            @lease_duration = data[:lease_duration]
+            @renewable = data[:renewable]
+          end
+
+          def renewable?
+            @renewable == true
+          end
+
+          def inspect
+            "#<#{self.class}>"
+          end
+        end
+
+        class Auth
+          attr_reader :client_token, :lease_duration, :policies, :metadata
+
+          def initialize(data:, **)
+            @client_token = data[:client_token]
+            @lease_duration = data[:lease_duration]
+            @policies = data[:policies]
+            @metadata = data[:metadata]
+            @renewable = data[:renewable]
+          end
+
+          def renewable?
+            @renewable == true
+          end
+
+          def inspect
+            "#<#{self.class}>"
+          end
+        end
+
+        private
+
+        def validate_address(address:, **)
+          uri = URI.parse(address.to_s)
+          unless uri.is_a?(URI::HTTP) && uri.host && !uri.userinfo && !uri.query && !uri.fragment
+            raise ArgumentError, 'Vault address must be an HTTP(S) URL without credentials, query, or fragment'
+          end
+
+          uri.to_s.freeze
+        rescue URI::InvalidURIError
+          raise ArgumentError, 'Vault address must be a valid HTTP(S) URL'
+        end
+
+        def validate_timeout(timeout:, **)
+          seconds = Float(timeout)
+          raise ArgumentError, 'Vault timeout must be positive and finite' unless seconds.positive? && seconds.finite?
+
+          seconds
+        end
+
+        def vault_headers(headers:, **)
+          result = Faraday::Utils::Headers.new('Accept' => 'application/json', 'Content-Type' => 'application/json')
+          result.update(headers)
+          result.delete('X-Vault-Token')
+          result.delete('X-Vault-Namespace')
+          result['X-Vault-Token'] = @token unless @token.nil?
+          result['X-Vault-Namespace'] = @namespace unless @namespace.nil?
+          result
+        end
+
+        def request_path(path:, **)
+          relative = path.to_s.sub(%r{\A/v1(?:/|\z)}, '').sub(%r{\A/+}, '')
+          encoded = relative.split('/', -1).map do |segment|
+            if ['.', '..'].include?(segment)
+              segment.gsub('.', '%2E')
+            else
+              URI.encode_www_form_component(segment).gsub('+', '%20')
+            end
+          end
+          "/v1/#{encoded.join('/')}"
+        end
+
+        def build_connection
+          Faraday.new(url: @address, ssl: tls_options) do |connection|
+            connection.options.timeout = @timeout
+            connection.options.open_timeout = @timeout
+            connection.options.read_timeout = @timeout
+            connection.options.write_timeout = @timeout
+            connection.adapter :net_http
+          end
+        end
+
+        def tls_options
+          options = { verify: @ssl_verify != false && @ssl_verify.to_s != 'none' }
+          if @ca
+            if @ca.include?('-----BEGIN')
+              store = OpenSSL::X509::Store.new
+              certificates = @ca.scan(/-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m)
+              raise ArgumentError, 'Vault CA PEM contains no certificates' if certificates.empty?
+
+              certificates.each { |certificate| store.add_cert(OpenSSL::X509::Certificate.new(certificate)) }
+              options[:cert_store] = store
+            else
+              options[:ca_file] = @ca
+            end
+          end
+          options[:client_cert] = tls_certificate(certificate: @cert) if @cert
+          options[:client_key] = tls_key(key: @key) if @key
+          options
+        end
+
+        def tls_certificate(certificate:, **)
+          return certificate if certificate.is_a?(OpenSSL::X509::Certificate)
+
+          pem = certificate.include?('-----BEGIN') ? certificate : File.read(certificate)
+          certificates = pem.scan(/-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m)
+          return OpenSSL::X509::Certificate.new(pem) if certificates.length < 2
+
+          certificates.map { |entry| OpenSSL::X509::Certificate.new(entry) }
+        end
+
+        def tls_key(key:, **)
+          return key if key.is_a?(OpenSSL::PKey::PKey)
+
+          OpenSSL::PKey.read(key.include?('-----BEGIN') ? key : File.read(key))
+        end
+
+        def decode_response(response:, address:, **)
+          status = response.status
+          unless (200..299).cover?(status)
+            error_class = if (400..499).cover?(status)
+                            Legion::Crypt::Vault::HTTPClientError
+                          elsif (500..599).cover?(status)
+                            Legion::Crypt::Vault::HTTPServerError
+                          else
+                            Legion::Crypt::Vault::HTTPError
+                          end
+            begin
+              decoded = response.body.nil? || response.body.empty? ? {} : Legion::JSON.load(response.body)
+            rescue Legion::JSON::ParseError
+              raise error_class.new(code: status, errors: [response.body.to_s], address: address)
+            end
+            errors = decoded.is_a?(Hash) ? decoded[:errors] : [response.body.to_s]
+            raise error_class.new(code: status, errors: errors, address: address)
+          end
+          return nil if status == 204 || response.body.nil? || response.body.empty?
+
+          Legion::JSON.load(response.body)
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/vault/cluster.rb

@@ -0,0 +1,330 @@
+# frozen_string_literal: true
+
+require 'legion/logging/helper'
+require 'uri'
+require 'legion/crypt/vault/client'
+require 'legion/crypt/tls'
+require 'legion/crypt/vault/operation'
+
+module Legion
+  module Crypt
+    module Vault
+      module Cluster
+        include Legion::Logging::Helper
+
+        def vault_client(name = nil)
+          name = resolve_cluster_name(name)
+          loop do
+            candidate = accepted = nil
+            signature, generation = vault_clients_mutex.synchronize do
+              return @vault_clients&.dig(name, :client) if Legion::Crypt.respond_to?(:stopping) && Legion::Crypt.stopping
+
+              @vault_clients ||= {}
+              entry = @vault_clients[name]
+              signature = vault_client_signature(config: name.nil? ? Legion::Settings[:crypt][:vault] : clusters[name])
+              cached = cached_vault_client(entry: entry, signature: signature)
+              return cached if cached
+
+              unless signature
+                (@retired_vault_clients ||= ObjectSpace::WeakMap.new)[entry[:client]] = true if entry
+                @vault_clients.delete(name)
+                return nil
+              end
+              signature.transform_values! { |value| value.is_a?(String) ? value.dup.freeze : value }
+              [signature, @vault_client_generation || 0]
+            end
+            candidate = build_vault_client(signature, name: name)
+            accepted = install_vault_client(name: name, signature: signature, client: candidate, generation: generation)
+            return accepted if accepted
+          ensure
+            retire_vault_client(client: candidate) unless accepted.equal?(candidate)
+          end
+        end
+
+        def publish_vault_grant(client:, config:, grant:, auth_method:, issued_at: Time.now, **)
+          token = grant.fetch(:token)
+          ttl = grant[:lease_duration].to_f
+          expires_at = issued_at + ttl if ttl.positive?
+          vault_clients_mutex.synchronize do
+            pair = @vault_clients&.find { |_name, entry| entry[:client].equal?(client) }
+            raise IOError, 'Vault client replaced during authentication' if @retired_vault_clients&.key?(client)
+
+            if pair
+              name, entry = pair
+              current_config = name.nil? ? Legion::Settings[:crypt][:vault] : clusters[name]
+              unless config.equal?(current_config) && current_vault_client?(entry: entry, signature: vault_client_signature(config: current_config))
+                raise IOError, 'Vault client configuration changed during authentication'
+              end
+            end
+            client.token = token
+            connected = expires_at.nil? || expires_at > Time.now
+            config.merge!(token: token, lease_duration: grant[:lease_duration], renewable: grant[:renewable],
+                          expires_at: expires_at, connected: connected, relogin_required: !connected, auth_method: auth_method)
+            entry[:signature][:token] = token&.dup&.freeze if entry
+          end
+        end
+
+        def clear_vault_clients(deadline: nil, **)
+          deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::Vault::Operation::SHUTDOWN_TIMEOUT
+          clients = vault_clients_mutex.synchronize do
+            @vault_client_generation = (@vault_client_generation || 0) + 1
+            previous = (@vault_clients || {}).values.map { |entry| entry[:client] }
+            previous.concat(@retired_vault_clients.keys) if @retired_vault_clients
+            @vault_clients = {}
+            @retired_vault_clients = nil
+            previous.uniq
+          end
+          clients.each { |client| retire_vault_client(client: client, deadline: deadline) }
+        end
+
+        def cluster(name = nil)
+          name = resolve_cluster_name(name)
+          clusters[name]
+        end
+
+        def default_cluster_name
+          name = Legion::Settings[:crypt][:vault][:default]
+          name ? name.to_sym : clusters.keys.first
+        end
+
+        def clusters
+          Legion::Settings[:crypt][:vault][:clusters]
+        end
+
+        def connected_clusters
+          vault_clients_mutex.synchronize do
+            now = Time.now
+            clusters.select do |_, config|
+              config[:token] && config[:connected] && !config[:relogin_required] &&
+                (!config[:expires_at] || config[:expires_at] > now)
+            end
+          end
+        end
+
+        def connect_all_clusters
+          log.info "Vault cluster connect requested configured_clusters=#{clusters.size}"
+          log_vault_debug("connect_all_clusters: #{clusters.size} cluster(s) configured")
+          results = {}
+          clusters.each do |name, config|
+            log_vault_debug("connect_all_clusters: #{name} (auth_method=#{config[:auth_method].inspect})")
+            case config[:auth_method]&.to_s
+            when 'kerberos'
+              results[name] = connect_kerberos_cluster(name, config)
+            when 'ldap'
+              next # handled by ldap_login_all
+            else
+              next unless config[:token]
+
+              client = vault_client(name)
+              config[:connected] = cluster_healthy?(client)
+              results[name] = config[:connected]
+              log_cluster_connected(name, config) if config[:connected]
+            end
+          rescue StandardError => e
+            config[:connected] = false
+            results[name] = false
+            log_vault_error(name, e, operation: 'crypt.vault_cluster.connect_all_clusters')
+          end
+
+          connected = results.select { |_, v| v }
+          log.info "Vault cluster connect complete connected=#{connected.size} attempted=#{results.size}"
+          log_vault_debug("connect_all_clusters: #{connected.size}/#{results.size} connected")
+          sync_vault_connected(connected.any?)
+          results
+        end
+
+        private
+
+        def cluster_healthy?(client)
+          client.sys.health_status.initialized?
+        rescue Legion::Crypt::Vault::HTTPError => e
+          return true if [429, 472, 473].include?(e.code)
+
+          handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.cluster_healthy')
+          raise
+        end
+
+        def sync_vault_connected(connected)
+          Legion::Settings[:crypt][:vault][:connected] = connected
+        end
+
+        def selected_connected_cluster_name(name = nil)
+          active_clusters = connected_clusters
+          return nil if active_clusters.empty?
+
+          if name
+            cluster_name = name.to_sym
+            raise ArgumentError, "Vault cluster not connected: #{cluster_name}" unless active_clusters.key?(cluster_name)
+
+            return cluster_name
+          end
+
+          default_name = Legion::Settings[:crypt][:vault][:default]&.to_sym
+          return default_name if default_name && active_clusters.key?(default_name)
+
+          active_clusters.keys.first
+        end
+
+        def resolve_cluster_name(name)
+          return name.to_sym if name
+
+          default_cluster_name
+        end
+
+        def vault_clients_mutex
+          @vault_clients_mutex ||= Mutex.new
+        end
+
+        def current_vault_client?(entry:, signature:, **)
+          return false unless entry && signature
+          return false unless entry[:signature].all? { |key, value| key == :token || value == signature[key] }
+
+          entry[:signature][:token] == signature[:token] || entry[:client].token == signature[:token]
+        end
+
+        def cached_vault_client(entry:, signature:, **)
+          return unless current_vault_client?(entry: entry, signature: signature)
+
+          entry[:signature][:token] = signature[:token]&.dup if entry[:signature][:token] != signature[:token]
+          entry[:client]
+        end
+
+        def install_vault_client(name:, signature:, client:, generation:, **)
+          vault_clients_mutex.synchronize do
+            raise IOError, 'Vault clients cleared during construction' unless generation == (@vault_client_generation || 0)
+            raise IOError, 'Crypt stopped during client construction' if Legion::Crypt.respond_to?(:stopping) && Legion::Crypt.stopping
+
+            entry = @vault_clients[name]
+            current_signature = vault_client_signature(config: name.nil? ? Legion::Settings[:crypt][:vault] : clusters[name])
+            cached = cached_vault_client(entry: entry, signature: current_signature)
+            return cached if cached
+            return unless signature == current_signature
+
+            (@retired_vault_clients ||= ObjectSpace::WeakMap.new)[entry[:client]] = true if entry
+            @vault_clients[name] = { client: client, signature: signature }
+            client
+          end
+        end
+
+        def resolve_vault_address(vault_settings:, **)
+          protocol = vault_settings[:protocol] || 'http'
+          address  = vault_settings[:address] || 'localhost'
+          port     = vault_settings[:port] || 8200
+
+          if address.match?(%r{\Ahttps?://})
+            uri = URI.parse(address)
+            protocol = uri.scheme
+            address  = uri.host
+            port     = uri.port if vault_settings[:port].nil?
+          end
+
+          "#{protocol}://#{address}:#{port}"
+        end
+
+        def vault_client_signature(config:, **)
+          return unless config.is_a?(Hash)
+
+          tls = Legion::Crypt::TLS.migrate_legacy(config[:tls] || {})
+          verify = %w[none mutual].include?(tls[:verify].to_s) ? tls[:verify].to_s : 'peer'
+
+          namespace =
+            if config.key?(:namespace)
+              config[:namespace]
+            else
+              Legion::Settings[:crypt][:vault][:vault_namespace]
+            end
+          {
+            address: resolve_vault_address(vault_settings: config), namespace: namespace, token: config[:token],
+            verify: verify, ca: tls[:ca], cert: tls[:cert], key: tls[:key],
+            timeout: Legion::Settings[:crypt][:vault][:operation_timeout]
+          }
+        end
+
+        def build_vault_client(signature, name:)
+          building = Thread.current[:legion_vault_clients_building] ||= []
+          build_key = [self, name]
+          raise IOError, 'Circular Vault TLS material dependency' if building.include?(build_key)
+
+          building << build_key
+          begin
+            tls = Legion::Crypt::TLS.resolve(signature.slice(:verify, :ca, :cert, :key))
+            %i[ca cert key].each do |attribute|
+              raise IOError, "Configured Vault TLS #{attribute} could not be resolved" if signature[attribute] && tls[attribute].nil?
+            end
+            options = signature.slice(:address, :namespace, :token, :timeout).merge(tls: tls)
+            log.info "Building Vault client address=#{options[:address]} namespace=#{options[:namespace].inspect} tls_verify=#{tls[:verify]}"
+            Legion::Crypt::Vault::Client.new(**options)
+          ensure
+            building.delete(build_key)
+          end
+        end
+
+        def retire_vault_client(client:, deadline: nil, **)
+          return unless client.respond_to?(:shutdown)
+
+          Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) do
+            client.shutdown
+          end
+        rescue StandardError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.retire_vault_client')
+        end
+
+        def log_vault_error(name, error, operation: 'crypt.vault_cluster.error')
+          handle_exception(error, level: :error, operation: operation, cluster_name: name)
+        end
+
+        def connect_kerberos_cluster(name, config)
+          krb_config = config[:kerberos] || {}
+          spn = krb_config[:service_principal]
+          auth_path = krb_config[:auth_path] || Legion::Crypt::KerberosAuth::DEFAULT_AUTH_PATH
+
+          log_vault_debug("connect_kerberos_cluster[#{name}]: SPN=#{spn}, auth_path=#{auth_path}, namespace=#{config[:namespace].inspect}")
+
+          unless spn
+            log_vault_warn(name, 'Kerberos auth missing service_principal, skipping')
+            config[:connected] = false
+            return false
+          end
+
+          require 'legion/crypt/kerberos_auth'
+          client = vault_client(name)
+          log_vault_debug("connect_kerberos_cluster[#{name}]: client.namespace=#{client.respond_to?(:namespace) ? client.namespace.inspect : 'n/a'}")
+          log.info "Connecting Vault cluster #{name} via Kerberos auth_path=#{auth_path}"
+
+          result = Legion::Crypt::KerberosAuth.login(
+            vault_client:      client,
+            service_principal: spn,
+            auth_path:         auth_path
+          )
+
+          publish_vault_grant(client: client, config: config, grant: result, auth_method: 'kerberos')
+          log_vault_debug("connect_kerberos_cluster[#{name}]: policies=#{result[:policies].inspect}")
+          log_cluster_connected(name, config)
+          true
+        rescue Legion::Crypt::KerberosAuth::GemMissingError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.connect_kerberos_cluster', cluster_name: name)
+          log_vault_warn(name, e.message)
+          config[:connected] = false
+          false
+        rescue Legion::Crypt::KerberosAuth::AuthError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.connect_kerberos_cluster', cluster_name: name)
+          log_vault_warn(name, "Kerberos auth failed: #{e.message}")
+          config[:connected] = false
+          false
+        end
+
+        def log_cluster_connected(name, config)
+          log.info "Vault cluster connected: #{name} at #{config[:address]}"
+        end
+
+        def log_vault_warn(name, message)
+          log.warn("Vault cluster #{name}: #{message}")
+        end
+
+        def log_vault_debug(message)
+          log.debug(message)
+        end
+      end
+    end
+  end
+end