github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Wrap creation of CryptoConfig in constructors

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2019-07-23 19:00:34 -04:00
parent f7761411b8
commit 364de4c35d
5 changed files with 32 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
cmd/ctr/commands/images/decrypt.go
View File

@ -88,11 +88,8 @@ var decryptCommand = cli.Command{
return err
}
cc := &encconfig.CryptoConfig{
DecryptConfig: &encconfig.DecryptConfig{
Parameters: dcparameters,
},
}
cc := encconfig.InitDecryption(dcparameters)
_, err = decryptImage(client, ctx, local, newName, cc, layers32, context.StringSlice("platform"))
return err

10
cmd/ctr/commands/images/encrypt.go
View File

@ -133,14 +133,8 @@ var encryptCommand = cli.Command{
dcparameters["privkeys-passwords"] = privKeysPasswords
dcparameters["x509s"] = decX509s
cc := &encconfig.CryptoConfig{
EncryptConfig: &encconfig.EncryptConfig{
Parameters: parameters,
DecryptConfig: encconfig.DecryptConfig{
Parameters: dcparameters,
},
},
}
cc := encconfig.InitEncryption(parameters, dcparameters)
_, err = encryptImage(client, ctx, local, newName, cc, layers32, context.StringSlice("platform"))
return err

16
image_enc_test.go
View File

@ -129,14 +129,7 @@ func TestImageEncryption(t *testing.T) {
dcparameters["privkeys"] = [][]byte{privateKey}
dcparameters["privkeys-passwords"] = [][]byte{{}}
cc := &encconfig.CryptoConfig{
EncryptConfig: &encconfig.EncryptConfig{
Parameters: parameters,
DecryptConfig: encconfig.DecryptConfig{
Parameters: dcparameters,
},
},
}
cc := encconfig.InitEncryption(parameters, dcparameters)
// Perform encryption of image
encSpec, modified, err := imgenc.EncryptImage(ctx, client.ContentStore(), image.Target, cc, lf)
@ -156,11 +149,8 @@ func TestImageEncryption(t *testing.T) {
t.Fatalf("Unable to create image: %v", err)
}
cc = &encconfig.CryptoConfig{
DecryptConfig: &encconfig.DecryptConfig{
Parameters: dcparameters,
},
}
cc = encconfig.InitDecryption(dcparameters)
// Clean up function cancels lease before deleting the image so the images are
// properly deleted
defer func() {

6
images/encryption/encryption.go
View File

@ -415,15 +415,13 @@ func DecryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor
// It takes decrypting of the layers only as far as decrypting the asymmetrically encrypted data
// The decryption is only done for the current platform
func CheckAuthorization(ctx context.Context, cs content.Store, desc ocispec.Descriptor, dc *encconfig.DecryptConfig) error {
cc := encconfig.CryptoConfig{
DecryptConfig: dc,
}
cc := encconfig.InitDecryption(dc.Parameters)
lf := func(desc ocispec.Descriptor) bool {
return true
}
_, _, err := cryptImage(ctx, cs, desc, &cc, lf, cryptoOpUnwrapOnly)
_, _, err := cryptImage(ctx, cs, desc, cc, lf, cryptoOpUnwrapOnly)
if err != nil {
return errors.Wrapf(err, "you are not authorized to use this image")
}

23
pkg/encryption/config/config.go
View File

@ -38,3 +38,26 @@ type CryptoConfig struct {
EncryptConfig *EncryptConfig
DecryptConfig *DecryptConfig
}
// InitDecryption initialized a CryptoConfig object with parameters used for decryption
func InitDecryption(dcparameters map[string][][]byte) *CryptoConfig {
return &CryptoConfig{
DecryptConfig: &DecryptConfig{
Parameters: dcparameters,
},
}
}
// InitEncryption initializes a CryptoConfig object with parameters used for encryption
// It also takes dcparameters that may be needed for decryption when adding a recipient
// to an already encrypted image
func InitEncryption(parameters, dcparameters map[string][][]byte) *CryptoConfig {
return &CryptoConfig{
EncryptConfig: &EncryptConfig{
Parameters: parameters,
DecryptConfig: DecryptConfig{
Parameters: dcparameters,
},
},
}
}