upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-03 20:40:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Honor nonce use warning in non-FIPS modes

Browse source
This commit is contained in:
Scott G. Miller 2023-08-31 14:24:00 -05:00
parent 428d55b4c8
commit 2aee3dbdc1
3 changed files with 8 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
builtin/logical/transit/path_datakey.go
View file

@ -9,7 +9,6 @@ import (
"encoding/base64"
"fmt"
"github.com/hashicorp/vault/helper/constants"
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/helper/errutil"
"github.com/hashicorp/vault/sdk/helper/keysutil"
@ -170,8 +169,8 @@ func (b *backend) pathDatakeyWrite(ctx context.Context, req *logical.Request, d
},
}
if constants.IsFIPS() && shouldWarnAboutNonceUsage(p, nonce) {
resp.AddWarning("A provided nonce value was used within FIPS mode, this violates FIPS 140 compliance.")
if shouldWarnAboutNonceUsage(p, nonce) {
resp.AddWarning("A provided nonce value was ignored where a user supplied nonce cannot be specified.")
}
if plaintextAllowed {

7
builtin/logical/transit/path_encrypt.go
View file

@ -12,8 +12,6 @@ import (
"net/http"
"reflect"
"github.com/hashicorp/vault/helper/constants"
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/helper/errutil"
"github.com/hashicorp/vault/sdk/helper/keysutil"
@ -473,6 +471,7 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
if !warnAboutNonceUsage && shouldWarnAboutNonceUsage(p, item.DecodedNonce) {
warnAboutNonceUsage = true
item.DecodedNonce = nil
}
var factory interface{}
@ -555,8 +554,8 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
}
}
if constants.IsFIPS() && warnAboutNonceUsage {
resp.AddWarning("A provided nonce value was used within FIPS mode, this violates FIPS 140 compliance.")
if warnAboutNonceUsage {
resp.AddWarning("A provided nonce value was ignored where a user supplied nonce cannot be specified.")
}
if req.Operation == logical.CreateOperation && !upserted {

6
builtin/logical/transit/path_rewrap.go
View file

@ -8,7 +8,6 @@ import (
"encoding/base64"
"fmt"
"github.com/hashicorp/vault/helper/constants"
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/helper/errutil"
"github.com/hashicorp/vault/sdk/helper/keysutil"
@ -166,6 +165,7 @@ func (b *backend) pathRewrapWrite(ctx context.Context, req *logical.Request, d *
if !warnAboutNonceUsage && shouldWarnAboutNonceUsage(p, item.DecodedNonce) {
warnAboutNonceUsage = true
item.DecodedNonce = nil
}
ciphertext, err := p.Encrypt(item.KeyVersion, item.DecodedContext, item.DecodedNonce, plaintext)
@ -217,8 +217,8 @@ func (b *backend) pathRewrapWrite(ctx context.Context, req *logical.Request, d *
}
}
if constants.IsFIPS() && warnAboutNonceUsage {
resp.AddWarning("A provided nonce value was used within FIPS mode, this violates FIPS 140 compliance.")
if warnAboutNonceUsage {
resp.AddWarning("A provided nonce value was ignored where a user supplied nonce cannot be specified.")
}
p.Unlock()