Fix plaintext backup in transit (#3692)

hashicorp · Dec 15, 2017 · 13b776e · 13b776e
1 parent a401cc7
commit 13b776e
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/helper/keysutil/lock_manager.go b/helper/keysutil/lock_manager.go
@@ -43,6 +43,9 @@ type PolicyRequest struct {
 
 	// Whether to upsert
 	Upsert bool
+
+	// Whether to allow plaintext backup
+	AllowPlaintextBackup bool
 }
 
 type LockManager struct {
@@ -378,10 +381,11 @@ func (lm *LockManager) getPolicyCommon(req PolicyRequest, lockType bool) (*Polic
 		}
 
 		p = &Policy{
-			Name:       req.Name,
-			Type:       req.KeyType,
-			Derived:    req.Derived,
-			Exportable: req.Exportable,
+			Name:                 req.Name,
+			Type:                 req.KeyType,
+			Derived:              req.Derived,
+			Exportable:           req.Exportable,
+			AllowPlaintextBackup: req.AllowPlaintextBackup,
 		}
 		if req.Derived {
 			p.KDF = Kdf_hkdf_sha256