Golang基于Vault实现敏感数据加解密

# 启用 Transit 引擎
$ vault secrets enable transit
# 创建专用的加解密密钥
$ vault write -f transit/keys/mykey
# 为 AppRole 绑定的权限策略 myapp-policy 添加加解密权限
$ vault policy write myapp-policy -<<EOF
#已有的权限，见《基于Vault的敏感信息保护》这篇文章
#新增加密权限：
path "transit/encrypt/mykey" {
   capabilities = [ "update" ]
}
#新增解密权限：
path "transit/decrypt/mykey" {
   capabilities = [ "update" ]
}
EOF
# 重新生成 AppRole 的 SecretID
$ vault write -f -field=secret_id auth/approle/role/myapp/secret-id >~/.secretid

func VaultInit() {
    // 创建 Vault Client
    config := vault.DefaultConfig()
    config.Address = vaultAddress
    var err error
    VaultClient, err = vault.NewClient(config)
    if err != nil {
        log.Fatalf("Failed to create vault client, err: %v", err)
    }
    // 循环：登录认证，并续租Token
    go func() {
        for {
            vaultLoginResp, err := login(VaultClient)
            if err != nil {
                log.Printf("Unable to authenticate to Vault: %v", err)
                time.Sleep(time.Second * 10)
                continue
            }
            tokenErr := renew(VaultClient, vaultLoginResp)
            if tokenErr != nil {
                log.Printf("Unable to start managing token lifecycle: %v", tokenErr)
                time.Sleep(time.Second * 10)
            }
        }
    }()
}

vault:
  address: http://x.x.x.x:8200
  transit:
    key: mykey
  auth:
    roleid-file-path: /app/role/roleid
    secretid-file-path: /app/role/secretid

func login(client *vault.Client) (*vault.Secret, error) {
    // 读取 RoleID
    bytes, err := ioutil.ReadFile(vaultRoleIdFilePath)
    if err != nil {
        return nil, fmt.Errorf("Error reading role ID file: %w", err)
    }
    roleID := strings.TrimSpace(string(bytes))
    if len(roleID) == 0 {
        return nil, errors.New("Error: role ID file exists but read empty value")
    }
    // 指定 SecretID
    secretID := &auth.SecretID{FromFile: vaultSecretIdFilePath}
    // 初始化 AppRole 认证方法，指定身份凭据
    appRoleAuth, err := auth.NewAppRoleAuth(roleID, secretID)
    if err != nil {
        return nil, fmt.Errorf("unable to initialize AppRole auth method: %w", err)
    }
    // 通过 AppRole 认证方法登录到 Vault
    authInfo, err := client.Auth().Login(context.Background(), appRoleAuth)
    if err != nil {
        return nil, fmt.Errorf("unable to login to AppRole auth method: %w", err)
    }
    if authInfo == nil {
        return nil, fmt.Errorf("no auth info was returned after login")
    }
    log.Printf("Successfully (re)logined, lease duration: %ds", authInfo.Auth.LeaseDuration)
    return authInfo, nil
}

func renew(client *vault.Client, token *vault.Secret) error {
    // 为 Token 创建一个监听器
    watcher, err := client.NewLifetimeWatcher(&vault.LifetimeWatcherInput{
        Secret: token,
        //Increment: 3600,
    })
    if err != nil {
        return fmt.Errorf("unable to initialize new lifetime watcher for renewing auth token: %w", err)
    }
    // 启动后台续租协程
    go watcher.Start()
    defer watcher.Stop()
    for {
        select {
        // 续租失败，或者无法继续续租
        case err := <-watcher.DoneCh():
            //续租失败
            if err != nil {
                log.Printf("Failed to renew token: %v. Re-attempting login.", err)
                return nil
            }
            // 无法继续续租
            log.Printf("Token can no longer be renewed. Re-attempting login.")
            return nil
        // 成功完成续租
        case renewal := <-watcher.RenewCh():
            log.Printf("Successfully renewed, lease duration: %ds", renewal.Secret.Auth.LeaseDuration)
        }
    }
}

func (t *Teacher) BeforeSave(*gorm.DB) error {
    return t.Encrypt()
}

// 此处仅展示 GORM 相关标签，省略其它标签
type Teacher struct {
    gorm.Model
    Name    string
    // ... 其余字段省略
    //密文
    IDcard string `gorm:"unique"`
    Phone  string
    //明文
    PlainIDcard string `gorm:"-"`
    PlainPhone  string `gorm:"-"`
}

func (t *Teacher) Encrypt() error {
    path := fmt.Sprintf("/transit/encrypt/%s", config.VaultTransitKey)
    ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
    defer cancel()
    // 批量加密
    resp, err := Vault.Logical().WriteWithContext(ctx, path, map[string]interface{}{
        "batch_input": []map[string]interface{}{
            {
                "plaintext": base64.StdEncoding.EncodeToString([]byte(t.PlainIDcard)),
            },
            {
                "plaintext": base64.StdEncoding.EncodeToString([]byte(t.PlainPhone)),
            },
        },
    })
    if err != nil {
        log.Printf("teacher.Encrypt failed to encrypt data")
        return err
    }
    // 拿到密文
    t.IDcard = resp.Data["batch_results"].([]interface{})[0].(map[string]interface{})["ciphertext"].(string)
    t.Phone = resp.Data["batch_results"].([]interface{})[1].(map[string]interface{})["ciphertext"].(string)
    log.Printf("teacher.Encrypt called")
    return nil
}

func (t *Teacher) Decrypt() error {
    path := fmt.Sprintf("/transit/decrypt/%s", config.VaultTransitKey)
    ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
    defer cancel()
    // 批量解密
    resp, err := Vault.Logical().WriteWithContext(ctx, path, map[string]interface{}{
        "batch_input": []map[string]interface{}{
            {
                "ciphertext": t.IDcard,
            },
            {
                "ciphertext": t.Phone,
            },
        },
    })
    if err != nil {
        log.Printf("teacher.Decrypt failed to decrypt data")
        return err
    }
    // 拿到 base64 文本
    IDcard_base64 := resp.Data["batch_results"].([]interface{})[0].(map[string]interface{})["plaintext"].(string)
    Phone_base64 := resp.Data["batch_results"].([]interface{})[1].(map[string]interface{})["plaintext"].(string)
    // 解码拿到明文
    IDcard, err1 := base64.StdEncoding.DecodeString(IDcard_base64)
    Phone, err2 := base64.StdEncoding.DecodeString(Phone_base64)
    if err1 != nil || err2 != nil {
        log.Printf("teacher.Decrypt failed to base64 decode")
        return errors.New("base64 decode error")
    }
    t.PlainIDcard = string(IDcard)
    t.PlainPhone = string(Phone)
    log.Printf("teacher.Decrypt called")
    return nil
}