Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return the partial success code override for all batch error types #18310

Merged
merged 6 commits into from
Dec 12, 2022
Merged

Return the partial success code override for all batch error types #18310

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4b52702
Return the partial success code override for all batch error types
sgmiller Dec 12, 2022
2b574f0
changelog
sgmiller Dec 12, 2022
c4e58bc
docs
sgmiller Dec 12, 2022
19d6bac
Lost the actual override logic. :)
sgmiller Dec 12, 2022
716c212
And don't hardcode 400
sgmiller Dec 12, 2022
6fe08ac
gate on success
sgmiller Dec 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 14 additions & 12 deletions builtin/logical/transit/path_encrypt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -509,21 +509,23 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
// that user errors are non-retryable without making changes to the request, and should be surfaced
// to the user first.
func batchRequestResponse(d *framework.FieldData, resp *logical.Response, req *logical.Request, successesInBatch, userErrorInBatch, internalErrorInBatch bool) (*logical.Response, error) {
switch {
case userErrorInBatch:
code := http.StatusBadRequest
if successesInBatch {
if codeRaw, ok := d.GetOk("partial_failure_response_code"); ok {
code = codeRaw.(int)
if code < 1 || code > 599 {
resp.AddWarning("invalid HTTP response code override from partial_failure_response_code, reverting to HTTP 400")
code = http.StatusBadRequest
}
if userErrorInBatch || internalErrorInBatch {
var code int
switch {
case userErrorInBatch:
code = http.StatusBadRequest
case internalErrorInBatch:
code = http.StatusInternalServerError
}
if codeRaw, ok := d.GetOk("partial_failure_response_code"); ok && successesInBatch {
newCode := codeRaw.(int)
if newCode < 1 || newCode > 599 {
resp.AddWarning(fmt.Sprintf("invalid HTTP response code override from partial_failure_response_code, reverting to %d", code))
} else {
code = newCode
}
}
return logical.RespondWithStatusCode(resp, req, code)
case internalErrorInBatch:
return logical.RespondWithStatusCode(resp, req, http.StatusInternalServerError)
}

return resp, nil
Expand Down
3 changes: 3 additions & 0 deletions changelog/18310.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
secrets/transit: Honor `partial_success_response_code` on decryption failures.
```
22 changes: 14 additions & 8 deletions website/content/api-docs/secret/transit.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -661,10 +661,13 @@ will be returned.
impact the ciphertext's security.

- `partial_failure_response_code` `(int: 400)` Ordinarily, if a batch item fails
to encrypt due to a bad input, but other batch items succeed, the HTTP response
code is 400 (Bad Request). Some applications may want to treat partial failures
differently. Providing the parameter returns the given response code integer
instead of a 400 in this case. If all values fail HTTP 400 is still returned.
to encrypt due to a bad input, but other batch items succeed, the HTTP response
code is 400 (Bad Request). Some applications may want to treat partial failures
differently. Providing the parameter returns the given response code integer
instead of a failed status code in this case. If all values fail an error
code is still returned. Be warned that some failures (such as failure to
decrypt) could be indicative of a security breach and should not be
ignored.

~>**NOTE:** All plaintext data **must be base64-encoded**. The reason for this
requirement is that Vault does not require that the plaintext is "text". It
Expand Down Expand Up @@ -756,10 +759,13 @@ This endpoint decrypts the provided ciphertext using the named key.
]
```
- `partial_failure_response_code` `(int: 400)` Ordinarily, if a batch item fails
to encrypt due to a bad input, but other batch items succeed, the HTTP response
code is 400 (Bad Request). Some applications may want to treat partial failures
differently. Providing the parameter returns the given response code integer
instead of a 400 in this case. If all values fail HTTP 400 is still returned.
to encrypt due to a bad input, but other batch items succeed, the HTTP response
code is 400 (Bad Request). Some applications may want to treat partial failures
differently. Providing the parameter returns the given response code integer
instead of a failed status code in this case. If all values fail an error
code is still returned. Be warned that some failures (such as failure to
decrypt) could be indicative of a security breach and should not be
ignored.

### Sample Payload

Expand Down