Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-08-02 12:06:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Generate random salt for key derivation on init (#309)

Browse source 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße 2022-07-29 09:52:47 +02:00 • committed by GitHub
parent e0ce2e8a51
commit 9a3bd38912
25 changed files with 342 additions and 317 deletions
Download patch file Download diff file Expand all files Collapse all files

15
kms/setup/setup.go
View file

@ -2,6 +2,7 @@ package setup
import (
"context"
"encoding/base64"
"fmt"
"net/url"
"strconv"
@ -123,7 +124,11 @@ func getKMS(ctx context.Context, kmsURI string, store kms.Storage) (kms.CloudKMS
return gcp.New(ctx, project, location, keyRing, store, kmspb.ProtectionLevel(protectionLvl))
case "cluster-kms":
return &cluster.ClusterKMS{}, nil
salt, err := getClusterKMSConfig(uri)
if err != nil {
return nil, err
}
return cluster.New(salt), nil
default:
return nil, fmt.Errorf("unknown KMS type: %s", uri.Host)
@ -186,6 +191,14 @@ func getGCPStorageConfig(uri *url.URL) (string, string, error) {
return r[0], r[1], err
}
func getClusterKMSConfig(uri *url.URL) ([]byte, error) {
r, err := getConfig(uri.Query(), []string{"salt"})
if err != nil {
return nil, err
}
return base64.URLEncoding.DecodeString(r[0])
}
// getConfig parses url query values, returning a map of the requested values.
// Returns an error if a key has no value.
// This function MUST always return a slice of the same length as len(keys).

24
kms/setup/setup_test.go
View file

@ -2,6 +2,7 @@ package setup
import (
"context"
"encoding/base64"
"fmt"
"net/url"
"testing"
@ -73,7 +74,7 @@ func TestGetKMS(t *testing.T) {
wantErr bool
}{
"cluster kms": {
uri: ClusterKMSURI,
uri: fmt.Sprintf("%s?salt=%s", ClusterKMSURI, base64.URLEncoding.EncodeToString([]byte("salt"))),
wantErr: false,
},
"aws kms": {
@ -124,11 +125,11 @@ func TestGetKMS(t *testing.T) {
func TestSetUpKMS(t *testing.T) {
assert := assert.New(t)
kms, err := SetUpKMS(context.TODO(), "storage://unknown", "kms://unknown")
kms, err := SetUpKMS(context.Background(), "storage://unknown", "kms://unknown")
assert.Error(err)
assert.Nil(kms)
kms, err = SetUpKMS(context.Background(), "storage://no-store", "kms://cluster-kms")
kms, err = SetUpKMS(context.Background(), "storage://no-store", "kms://cluster-kms?salt="+base64.URLEncoding.EncodeToString([]byte("salt")))
assert.NoError(err)
assert.NotNil(kms)
}
@ -186,6 +187,23 @@ func TestGetGCPKMSConfig(t *testing.T) {
assert.Error(err)
}
func TestGetClusterKMSConfig(t *testing.T) {
assert := assert.New(t)
require := require.New(t)
expectedSalt := []byte{
0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf,
0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf,
}
uri, err := url.Parse(ClusterKMSURI + "?salt=" + base64.URLEncoding.EncodeToString(expectedSalt))
require.NoError(err)
salt, err := getClusterKMSConfig(uri)
assert.NoError(err)
assert.Equal(expectedSalt, salt)
}
func TestGetConfig(t *testing.T) {
const testURI = "test://config?name=test-name&data=test-data&value=test-value"