Fix unexpected behavior when multiple file sinks used with agent

[dbellinghoven]

As I was trying out the auto_auth feature of the agent, I noticed there was some strange behavior with the file sinks. Specifically, I used the agent with the following configuration file:

pid_file = "./pidfile"

auto_auth {
        method "aws" {
                mount_path = "auth/aws"
                config = {
                        role = "dev-role-iam"
			type = "iam"
                }
        }

	sink "file" {
		wrap_ttl = "5m"
		aad      = "foobar"
		dh_type  = "curve25519"
		dh_path  = "/tmp/test/file-foo-dhpath"
                config   = {
                        path = "/tmp/test/file-foo"
                }
	}

	sink "file" {
                config   = {
                        path = "/tmp/test/file-bar"
                }
        }        
}

One would expect that this would create two file sinks: one file named file-foo that is encrypted, and another named file-bar with just a token in plain text. file-bar was indeed just a plain text token, as expected. However, file-foo looked like this:

{
    "token": "e5b0c789-e93d-b403-3c4c-8427743637db",
    "accessor": "4ee05d7e-30ec-111b-0365-543337ebf075",
    "ttl": 300,
    "creation_time": "2018-10-25T13:26:24.795673261-04:00",
    "creation_path": "sys/wrapping/wrap",
    "wrapped_accessor": ""
}

In other words, it was TTL-wrapped, but not encrypted. However, when I reverse the order of the file sinks in the configuration file so that it now looks as shown below, things were equally weird.

pid_file = "./pidfile"

auto_auth {
        method "aws" {
                mount_path = "auth/aws"
                config = {
                        role = "dev-role-iam"
			type = "iam"
                }
        }

	sink "file" {
                config   = {
                        path = "/tmp/test/file-bar"
                }
        }  

	sink "file" {
		wrap_ttl = "5m"
		aad      = "foobar"
		dh_type  = "curve25519"
		dh_path  = "/tmp/test/file-foo-dhpath"
                config   = {
                        path = "/tmp/test/file-foo"
                }
	}      
}

After restarting the agent with this config file, file-foo now looks like this:

{
    "curve25519_public_key": "Q7coLblOzb9gzo6qxgvC9/0m31b390MjcnZZw2rVEVs=",
    "nonce": "GK8I526qdmIapLfK",
    "encrypted_payload": "DrXN1E/2DMrAF1aGIrejqcwTAQxFRwX6ZzyOU5UYVNmgEGu4cCfgt7JGIkPeuS3sq5W1o1YHzAR65Ty/fv4GKA4XsrGVpoFJcKrWHDMyYJMhbRwR0e/0uujkp8ZLMHvswA8cnJIYpJwX273hUsPnffSiTcTshFJx/T+vFK24vIWIx/UO8iXiUe9zMDytkj8XxPdtIYAvLBnL06iST4mz6m8MEEUTzCM/fA4Ddlp5e53b3okmAkykxd1hov7GjZPL0UgeHR5BEY81rTNFx94hi7VTepbrqHYXQCK2tmT7XxuFSLARfJb3rFBn6Wcx"
}

while file-bar looks like this:

{
    "curve25519_public_key": "Q7coLblOzb9gzo6qxgvC9/0m31b390MjcnZZw2rVEVs=",
    "nonce": "a13jXzxRNkkPMJGY",
    "encrypted_payload": "KZU1DnbXR5eA5WAqITbeebTa1hTNqrxnX+YeWk6mWi/ZSZ+YAV4RgwzQpMXAlEwWnSUIqw=="
}

It appeared to me that the nature of this issue lie in this block so I fixed it to reference only the first argument to the sinkFunc rather than the s. With this change, it seems that the agent writes to sinks as expected - file-bar will be plain-text client token, while file-foo will be an encrypted token, regardless of the order in which they appear in the config file.

[dbellinghoven]

Any updates on this? Was anybody able to reproduce this issue?

[briankassouf]

Looks good, thanks for the fix!