|
|
|
|
@ -1,37 +1,46 @@
|
|
|
|
|
package command |
|
|
|
|
|
|
|
|
|
import ( |
|
|
|
|
"flag" |
|
|
|
|
"fmt" |
|
|
|
|
"strings" |
|
|
|
|
|
|
|
|
|
consulapi "github.com/hashicorp/consul/api" |
|
|
|
|
"github.com/hashicorp/consul/command/agent" |
|
|
|
|
"github.com/hashicorp/consul/command/base" |
|
|
|
|
"github.com/mitchellh/cli" |
|
|
|
|
) |
|
|
|
|
|
|
|
|
|
// KeyringCommand is a Command implementation that handles querying, installing,
|
|
|
|
|
// and removing gossip encryption keys from a keyring.
|
|
|
|
|
type KeyringCommand struct { |
|
|
|
|
Ui cli.Ui |
|
|
|
|
base.Command |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
func (c *KeyringCommand) Run(args []string) int { |
|
|
|
|
var installKey, useKey, removeKey, token string |
|
|
|
|
var installKey, useKey, removeKey string |
|
|
|
|
var listKeys bool |
|
|
|
|
var relay int |
|
|
|
|
|
|
|
|
|
cmdFlags := flag.NewFlagSet("keys", flag.ContinueOnError) |
|
|
|
|
cmdFlags.Usage = func() { c.Ui.Output(c.Help()) } |
|
|
|
|
|
|
|
|
|
cmdFlags.StringVar(&installKey, "install", "", "install key") |
|
|
|
|
cmdFlags.StringVar(&useKey, "use", "", "use key") |
|
|
|
|
cmdFlags.StringVar(&removeKey, "remove", "", "remove key") |
|
|
|
|
cmdFlags.BoolVar(&listKeys, "list", false, "list keys") |
|
|
|
|
cmdFlags.StringVar(&token, "token", "", "acl token") |
|
|
|
|
cmdFlags.IntVar(&relay, "relay-factor", 0, "relay factor") |
|
|
|
|
|
|
|
|
|
rpcAddr := RPCAddrFlag(cmdFlags) |
|
|
|
|
if err := cmdFlags.Parse(args); err != nil { |
|
|
|
|
f := c.Command.NewFlagSet(c) |
|
|
|
|
|
|
|
|
|
f.StringVar(&installKey, "install", "", |
|
|
|
|
"Install a new encryption key. This will broadcast the new key to "+ |
|
|
|
|
"all members in the cluster.") |
|
|
|
|
f.StringVar(&useKey, "use", "", |
|
|
|
|
"Change the primary encryption key, which is used to encrypt "+ |
|
|
|
|
"messages. The key must already be installed before this operation "+ |
|
|
|
|
"can succeed.") |
|
|
|
|
f.StringVar(&removeKey, "remove", "", |
|
|
|
|
"Remove the given key from the cluster. This operation may only be "+ |
|
|
|
|
"performed on keys which are not currently the primary key.") |
|
|
|
|
f.BoolVar(&listKeys, "list", false, |
|
|
|
|
"List all keys currently in use within the cluster.") |
|
|
|
|
f.IntVar(&relay, "relay-factor", 0, |
|
|
|
|
"Added in Consul 0.7.4, setting this to a non-zero value will cause nodes "+ |
|
|
|
|
"to relay their response to the operation through this many randomly-chosen "+ |
|
|
|
|
"other nodes in the cluster. The maximum allowed value is 5.") |
|
|
|
|
|
|
|
|
|
if err := c.Command.Parse(args); err != nil { |
|
|
|
|
return 1 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@ -66,124 +75,69 @@ func (c *KeyringCommand) Run(args []string) int {
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// All other operations will require a client connection
|
|
|
|
|
client, err := RPCClient(*rpcAddr) |
|
|
|
|
client, err := c.Command.HTTPClient() |
|
|
|
|
if err != nil { |
|
|
|
|
c.Ui.Error(fmt.Sprintf("Error connecting to Consul agent: %s", err)) |
|
|
|
|
return 1 |
|
|
|
|
} |
|
|
|
|
defer client.Close() |
|
|
|
|
|
|
|
|
|
if listKeys { |
|
|
|
|
c.Ui.Info("Gathering installed encryption keys...") |
|
|
|
|
r, err := client.ListKeys(token, relayFactor) |
|
|
|
|
responses, err := client.Operator().KeyringList(&consulapi.QueryOptions{RelayFactor: relayFactor}) |
|
|
|
|
if err != nil { |
|
|
|
|
c.Ui.Error(fmt.Sprintf("error: %s", err)) |
|
|
|
|
return 1 |
|
|
|
|
} |
|
|
|
|
if rval := c.handleResponse(r.Info, r.Messages); rval != 0 { |
|
|
|
|
return rval |
|
|
|
|
} |
|
|
|
|
c.handleList(r.Info, r.Keys) |
|
|
|
|
c.handleList(responses) |
|
|
|
|
return 0 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
opts := &consulapi.WriteOptions{RelayFactor: relayFactor} |
|
|
|
|
if installKey != "" { |
|
|
|
|
c.Ui.Info("Installing new gossip encryption key...") |
|
|
|
|
r, err := client.InstallKey(installKey, token, relayFactor) |
|
|
|
|
err := client.Operator().KeyringInstall(installKey, opts) |
|
|
|
|
if err != nil { |
|
|
|
|
c.Ui.Error(fmt.Sprintf("error: %s", err)) |
|
|
|
|
return 1 |
|
|
|
|
} |
|
|
|
|
return c.handleResponse(r.Info, r.Messages) |
|
|
|
|
return 0 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if useKey != "" { |
|
|
|
|
c.Ui.Info("Changing primary gossip encryption key...") |
|
|
|
|
r, err := client.UseKey(useKey, token, relayFactor) |
|
|
|
|
err := client.Operator().KeyringUse(useKey, opts) |
|
|
|
|
if err != nil { |
|
|
|
|
c.Ui.Error(fmt.Sprintf("error: %s", err)) |
|
|
|
|
return 1 |
|
|
|
|
} |
|
|
|
|
return c.handleResponse(r.Info, r.Messages) |
|
|
|
|
return 0 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if removeKey != "" { |
|
|
|
|
c.Ui.Info("Removing gossip encryption key...") |
|
|
|
|
r, err := client.RemoveKey(removeKey, token, relayFactor) |
|
|
|
|
err := client.Operator().KeyringRemove(removeKey, opts) |
|
|
|
|
if err != nil { |
|
|
|
|
c.Ui.Error(fmt.Sprintf("error: %s", err)) |
|
|
|
|
return 1 |
|
|
|
|
} |
|
|
|
|
return c.handleResponse(r.Info, r.Messages) |
|
|
|
|
return 0 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Should never make it here
|
|
|
|
|
return 0 |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
func (c *KeyringCommand) handleResponse( |
|
|
|
|
info []agent.KeyringInfo, |
|
|
|
|
messages []agent.KeyringMessage) int { |
|
|
|
|
|
|
|
|
|
var rval int |
|
|
|
|
|
|
|
|
|
for _, i := range info { |
|
|
|
|
if i.Error != "" { |
|
|
|
|
pool := i.Pool |
|
|
|
|
if pool != "WAN" { |
|
|
|
|
pool = i.Datacenter + " (LAN)" |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
c.Ui.Error("") |
|
|
|
|
c.Ui.Error(fmt.Sprintf("%s error: %s", pool, i.Error)) |
|
|
|
|
|
|
|
|
|
for _, msg := range messages { |
|
|
|
|
if msg.Datacenter != i.Datacenter || msg.Pool != i.Pool { |
|
|
|
|
continue |
|
|
|
|
} |
|
|
|
|
c.Ui.Error(fmt.Sprintf(" %s: %s", msg.Node, msg.Message)) |
|
|
|
|
} |
|
|
|
|
rval = 1 |
|
|
|
|
func (c *KeyringCommand) handleList(responses []*consulapi.KeyringResponse) { |
|
|
|
|
for _, response := range responses { |
|
|
|
|
pool := response.Datacenter + " (LAN)" |
|
|
|
|
if response.WAN { |
|
|
|
|
pool = "WAN" |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if rval == 0 { |
|
|
|
|
c.Ui.Info("Done!") |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
return rval |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
func (c *KeyringCommand) handleList( |
|
|
|
|
info []agent.KeyringInfo, |
|
|
|
|
keys []agent.KeyringEntry) { |
|
|
|
|
|
|
|
|
|
installed := make(map[string]map[string][]int) |
|
|
|
|
for _, key := range keys { |
|
|
|
|
var nodes int |
|
|
|
|
for _, i := range info { |
|
|
|
|
if i.Datacenter == key.Datacenter && i.Pool == key.Pool { |
|
|
|
|
nodes = i.NumNodes |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
pool := key.Pool |
|
|
|
|
if pool != "WAN" { |
|
|
|
|
pool = key.Datacenter + " (LAN)" |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if _, ok := installed[pool]; !ok { |
|
|
|
|
installed[pool] = map[string][]int{key.Key: []int{key.Count, nodes}} |
|
|
|
|
} else { |
|
|
|
|
installed[pool][key.Key] = []int{key.Count, nodes} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
for pool, keys := range installed { |
|
|
|
|
c.Ui.Output("") |
|
|
|
|
c.Ui.Output(pool + ":") |
|
|
|
|
for key, num := range keys { |
|
|
|
|
c.Ui.Output(fmt.Sprintf(" %s [%d/%d]", key, num[0], num[1])) |
|
|
|
|
for key, num := range response.Keys { |
|
|
|
|
c.Ui.Output(fmt.Sprintf(" %s [%d/%d]", key, num, response.NumNodes)) |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
@ -205,26 +159,8 @@ Usage: consul keyring [options]
|
|
|
|
|
are no errors. If any node fails to reply or reports failure, the exit code |
|
|
|
|
will be 1. |
|
|
|
|
|
|
|
|
|
Options: |
|
|
|
|
|
|
|
|
|
-install=<key> Install a new encryption key. This will broadcast |
|
|
|
|
the new key to all members in the cluster. |
|
|
|
|
-list List all keys currently in use within the cluster. |
|
|
|
|
-remove=<key> Remove the given key from the cluster. This |
|
|
|
|
operation may only be performed on keys which are |
|
|
|
|
not currently the primary key. |
|
|
|
|
-token="" ACL token to use during requests. Defaults to that |
|
|
|
|
of the agent. |
|
|
|
|
-relay-factor Added in Consul 0.7.4, setting this to a non-zero |
|
|
|
|
value will cause nodes to relay their response to |
|
|
|
|
the operation through this many randomly-chosen |
|
|
|
|
other nodes in the cluster. The maximum allowed |
|
|
|
|
value is 5. |
|
|
|
|
-use=<key> Change the primary encryption key, which is used to |
|
|
|
|
encrypt messages. The key must already be installed |
|
|
|
|
before this operation can succeed. |
|
|
|
|
-rpc-addr=127.0.0.1:8400 RPC address of the Consul agent. |
|
|
|
|
` |
|
|
|
|
` + c.Command.Help() |
|
|
|
|
|
|
|
|
|
return strings.TrimSpace(helpText) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
Kyle Havlovitz
8 years ago