mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-06-24 22:20:40 -04:00
f16ccf5679
keyservice joinservice upgrade-agent measurement-reader debugd disk-mapper rewrote joinservice main rewrote some unit tests rewrote upgrade-agent + some grpc functions rewrote measurement-reader rewrote debugd removed unused import removed forgotten zap reference in measurements reader rewrote disk-mapper + tests rewrote packages verify disk-mapper malicious join bootstrapper attestationconfigapi versionapi internal/cloud/azure disk-mapper tests image/upload/internal/cmd rewrote verify (WIP with loglevel increase) rewrote forgotten zap references in disk-mapper rewrote malicious join rewrote bootstrapper rewrote parts of internal/ rewrote attestationconfigapi (WIP) rewrote versionapi cli rewrote internal/cloud/azure rewrote disk-mapper tests (untested by me rn) rewrote image/upload/internal/cmd removed forgotten zap references in verify/cmd rewrote packages hack/oci-pin hack/qemu-metadata-api debugd/internal/debugd/deploy hack/bazel-deps-mirror cli/internal/cmd cli-k8s-compatibility rewrote hack/qemu-metadata-api/server rewrote debugd/internal/debugd/deploy rewrote hack/bazel-deps-mirror rewrote rest of hack/qemu-metadata-api rewrote forgotten zap references in joinservice server rewrote cli/internal/cmd rewrote cli-k8s-compatibility rewrote packages internal/staticupload e2d/internal/upgrade internal/constellation/helm internal/attestation/aws/snp internal/attestation/azure/trustedlaunch joinservice/internal/certcache/amkds some missed unit tests rewrote e2e/internal/upgrade rewrote internal/constellation/helm internal/attestation/aws/snp internal/attestation/azure/trustedlaunch joinservice/internal/certcache/amkds search and replace test logging over all left *_test.go
84 lines
2.6 KiB
Go
84 lines
2.6 KiB
Go
/*
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
// Package server implements an API to manage encryption keys.
|
|
package server
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"log/slog"
|
|
"net"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/crypto"
|
|
"github.com/edgelesssys/constellation/v2/internal/grpc/grpclog"
|
|
"github.com/edgelesssys/constellation/v2/internal/kms/kms"
|
|
"github.com/edgelesssys/constellation/v2/internal/logger"
|
|
"github.com/edgelesssys/constellation/v2/keyservice/keyserviceproto"
|
|
"go.uber.org/zap/zapcore"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
)
|
|
|
|
// Server implements an encryption key management server.
|
|
// The server serves aTLS for cluster external requests
|
|
// and plain gRPC for cluster internal requests.
|
|
type Server struct {
|
|
log *slog.Logger
|
|
conKMS kms.CloudKMS
|
|
keyserviceproto.UnimplementedAPIServer
|
|
}
|
|
|
|
// New creates a new Server.
|
|
func New(log *slog.Logger, conKMS kms.CloudKMS) *Server {
|
|
return &Server{
|
|
log: log,
|
|
conKMS: conKMS,
|
|
}
|
|
}
|
|
|
|
// Run starts the gRPC server.
|
|
func (s *Server) Run(port string) error {
|
|
// set up listener
|
|
listener, err := net.Listen("tcp", net.JoinHostPort("", port))
|
|
if err != nil {
|
|
return fmt.Errorf("failed to listen on port %s: %v", port, err)
|
|
}
|
|
|
|
server := grpc.NewServer(logger.GetServerUnaryInterceptor(s.log.WithGroup("gRPC")))
|
|
keyserviceproto.RegisterAPIServer(server, s)
|
|
// TODO(miampf): Find out a good way to pass an increased Level to slog
|
|
s.log.WithGroup("gRPC").WithIncreasedLevel(zapcore.WarnLevel).ReplaceGRPCLogger()
|
|
|
|
// start the server
|
|
s.log.Info("Starting Constellation key management service on %s", listener.Addr().String())
|
|
return server.Serve(listener)
|
|
}
|
|
|
|
// GetDataKey returns a data key.
|
|
func (s *Server) GetDataKey(ctx context.Context, in *keyserviceproto.GetDataKeyRequest) (*keyserviceproto.GetDataKeyResponse, error) {
|
|
log := s.log.With("peerAddress", grpclog.PeerAddrFromContext(ctx))
|
|
|
|
// Error on 0 key length
|
|
if in.Length == 0 {
|
|
log.Error("Requested key length is zero")
|
|
return nil, status.Error(codes.InvalidArgument, "can't derive key with length zero")
|
|
}
|
|
|
|
// Error on empty DataKeyId
|
|
if in.DataKeyId == "" {
|
|
log.Error("No data key ID specified")
|
|
return nil, status.Error(codes.InvalidArgument, "no data key ID specified")
|
|
}
|
|
|
|
key, err := s.conKMS.GetDEK(ctx, crypto.DEKPrefix+in.DataKeyId, int(in.Length))
|
|
if err != nil {
|
|
log.With(slog.Any("error", err)).Error("Failed to get data key")
|
|
return nil, status.Errorf(codes.Internal, "%v", err)
|
|
}
|
|
return &keyserviceproto.GetDataKeyResponse{DataKey: key}, nil
|
|
}
|