Crypto library movement and changes to content helper interfaces
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
This commit is contained in:
Derek McGowan
committed by
Brandon Lum
Brandon Lum
parent
bf8804c743
commit
dde436e65b
132
pkg/encryption/keywrap/pkcs7/keywrapper_pkcs7.go
Normal file
132
pkg/encryption/keywrap/pkcs7/keywrapper_pkcs7.go
Normal file
@@ -0,0 +1,132 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs7
|
||||
|
||||
import (
|
||||
"crypto"
|
||||
"crypto/x509"
|
||||
|
||||
"github.com/containerd/containerd/pkg/encryption/config"
|
||||
"github.com/containerd/containerd/pkg/encryption/keywrap"
|
||||
"github.com/containerd/containerd/pkg/encryption/utils"
|
||||
"github.com/fullsailor/pkcs7"
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
type pkcs7KeyWrapper struct {
|
||||
}
|
||||
|
||||
// NewKeyWrapper returns a new key wrapping interface using jwe
|
||||
func NewKeyWrapper() keywrap.KeyWrapper {
|
||||
return &pkcs7KeyWrapper{}
|
||||
}
|
||||
|
||||
func (kw *pkcs7KeyWrapper) GetAnnotationID() string {
|
||||
return "org.opencontainers.image.enc.keys.pkcs7"
|
||||
}
|
||||
|
||||
// WrapKeys wraps the session key for recpients and encrypts the optsData, which
|
||||
// describe the symmetric key used for encrypting the layer
|
||||
func (kw *pkcs7KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
|
||||
x509Certs, err := collectX509s(ec.Parameters["x509s"])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// no recipients is not an error...
|
||||
if len(x509Certs) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
pkcs7.ContentEncryptionAlgorithm = pkcs7.EncryptionAlgorithmAES128GCM
|
||||
return pkcs7.Encrypt(optsData, x509Certs)
|
||||
}
|
||||
|
||||
func collectX509s(x509s [][]byte) ([]*x509.Certificate, error) {
|
||||
if len(x509s) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
var x509Certs []*x509.Certificate
|
||||
for _, x509 := range x509s {
|
||||
x509Cert, err := utils.ParseCertificate(x509, "PKCS7")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
x509Certs = append(x509Certs, x509Cert)
|
||||
}
|
||||
return x509Certs, nil
|
||||
}
|
||||
|
||||
func (kw *pkcs7KeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["privkeys"]
|
||||
}
|
||||
|
||||
func (kw *pkcs7KeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["privkeys-passwords"]
|
||||
}
|
||||
|
||||
// UnwrapKey unwraps the symmetric key with which the layer is encrypted
|
||||
// This symmetric key is encrypted in the PKCS7 payload.
|
||||
func (kw *pkcs7KeyWrapper) UnwrapKey(dc *config.DecryptConfig, pkcs7Packet []byte) ([]byte, error) {
|
||||
privKeys := kw.GetPrivateKeys(dc.Parameters)
|
||||
if len(privKeys) == 0 {
|
||||
return nil, errors.New("no private keys found for PKCS7 decryption")
|
||||
}
|
||||
privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
|
||||
if len(privKeysPasswords) != len(privKeys) {
|
||||
return nil, errors.New("private key password array length must be same as that of private keys")
|
||||
}
|
||||
|
||||
x509Certs, err := collectX509s(dc.Parameters["x509s"])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if len(x509Certs) == 0 {
|
||||
return nil, errors.New("no x509 certificates found needed for PKCS7 decryption")
|
||||
}
|
||||
|
||||
p7, err := pkcs7.Parse(pkcs7Packet)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not parse PKCS7 packet")
|
||||
}
|
||||
|
||||
for idx, privKey := range privKeys {
|
||||
key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "PKCS7")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, x509Cert := range x509Certs {
|
||||
optsData, err := p7.Decrypt(x509Cert, crypto.PrivateKey(key))
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
return optsData, nil
|
||||
}
|
||||
}
|
||||
return nil, errors.New("PKCS7: No suitable private key found for decryption")
|
||||
}
|
||||
|
||||
// GetKeyIdsFromWrappedKeys converts the base64 encoded Packet to uint64 keyIds;
|
||||
// We cannot do this with pkcs7
|
||||
func (kw *pkcs7KeyWrapper) GetKeyIdsFromPacket(b64pkcs7Packets string) ([]uint64, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// GetRecipients converts the wrappedKeys to an array of recipients
|
||||
// We cannot do this with pkcs7
|
||||
func (kw *pkcs7KeyWrapper) GetRecipients(b64pkcs7Packets string) ([]string, error) {
|
||||
return []string{"[pkcs7]"}, nil
|
||||
}
|
||||
254
pkg/encryption/keywrap/pkcs7/keywrapper_pkcs7_test.go
Normal file
254
pkg/encryption/keywrap/pkcs7/keywrapper_pkcs7_test.go
Normal file
@@ -0,0 +1,254 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs7
|
||||
|
||||
import (
|
||||
"crypto/x509"
|
||||
"testing"
|
||||
|
||||
"github.com/containerd/containerd/pkg/encryption/config"
|
||||
"github.com/containerd/containerd/pkg/encryption/utils"
|
||||
)
|
||||
|
||||
var oneEmpty []byte
|
||||
|
||||
func createKeys() (*x509.Certificate, []byte, *x509.Certificate, []byte, error) {
|
||||
caKey, caCert, err := utils.CreateTestCA()
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
|
||||
pkcs7ClientPubKey, pkcs7ClientPrivKey, err := utils.CreateRSATestKey(2048, oneEmpty, true)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
|
||||
pkcs7ClientCert, err := utils.CertifyKey(pkcs7ClientPubKey, nil, caKey, caCert)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
|
||||
pkcs7ClientPubKey2, pkcs7ClientPrivKey2, err := utils.CreateRSATestKey(2048, oneEmpty, true)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
|
||||
pkcs7ClientCert2, err := utils.CertifyKey(pkcs7ClientPubKey2, nil, caKey, caCert)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
|
||||
return pkcs7ClientCert, pkcs7ClientPrivKey, pkcs7ClientCert2, pkcs7ClientPrivKey2, nil
|
||||
}
|
||||
|
||||
func createValidPkcs7Ccs() ([]*config.CryptoConfig, error) {
|
||||
pkcs7ClientCert, pkcs7ClientPrivKey, pkcs7ClientCert2, pkcs7ClientPrivKey2, err := createKeys()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
validPkcs7Ccs := []*config.CryptoConfig{
|
||||
// Client key 1
|
||||
{
|
||||
EncryptConfig: &config.EncryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
DecryptConfig: config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientPrivKey},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
DecryptConfig: &config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientPrivKey},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
// Client key 2
|
||||
{
|
||||
EncryptConfig: &config.EncryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": {pkcs7ClientCert2.Raw},
|
||||
},
|
||||
DecryptConfig: config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientPrivKey2},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert2.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
DecryptConfig: &config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientPrivKey2},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert2.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
// Client key 1 without enc private key
|
||||
{
|
||||
EncryptConfig: &config.EncryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
},
|
||||
DecryptConfig: &config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientPrivKey},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
// Client key 2 without enc private key
|
||||
{
|
||||
EncryptConfig: &config.EncryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": {pkcs7ClientCert2.Raw},
|
||||
},
|
||||
},
|
||||
DecryptConfig: &config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientPrivKey2},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert2.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
return validPkcs7Ccs, nil
|
||||
}
|
||||
|
||||
func createInvalidPkcs7Ccs() ([]*config.CryptoConfig, error) {
|
||||
pkcs7ClientCert, pkcs7ClientPrivKey, pkcs7ClientCert2, pkcs7ClientPrivKey2, err := createKeys()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
invalidPkcs7Ccs := []*config.CryptoConfig{
|
||||
// Client key 1 public with client 2 private decrypt
|
||||
{
|
||||
EncryptConfig: &config.EncryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
},
|
||||
DecryptConfig: &config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientPrivKey2},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert2.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
// Client key 1 public with no private key
|
||||
{
|
||||
EncryptConfig: &config.EncryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
},
|
||||
DecryptConfig: &config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{},
|
||||
},
|
||||
},
|
||||
|
||||
// Invalid Client key 1 private key
|
||||
{
|
||||
EncryptConfig: &config.EncryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": {pkcs7ClientPrivKey},
|
||||
},
|
||||
},
|
||||
DecryptConfig: &config.DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": {pkcs7ClientCert.Raw},
|
||||
"privkeys-passwords": {oneEmpty},
|
||||
"x509s": {pkcs7ClientCert.Raw},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
return invalidPkcs7Ccs, nil
|
||||
}
|
||||
|
||||
func TestKeyWrapPkcs7Success(t *testing.T) {
|
||||
validPkcs7Ccs, err := createValidPkcs7Ccs()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
for _, cc := range validPkcs7Ccs {
|
||||
kw := NewKeyWrapper()
|
||||
|
||||
data := []byte("This is some secret text")
|
||||
|
||||
wk, err := kw.WrapKeys(cc.EncryptConfig, data)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
ud, err := kw.UnwrapKey(cc.DecryptConfig, wk)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if string(data) != string(ud) {
|
||||
t.Fatal("Strings don't match")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestKeyWrapPkcs7Invalid(t *testing.T) {
|
||||
invalidPkcs7Ccs, err := createInvalidPkcs7Ccs()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
for _, cc := range invalidPkcs7Ccs {
|
||||
kw := NewKeyWrapper()
|
||||
|
||||
data := []byte("This is some secret text")
|
||||
|
||||
wk, err := kw.WrapKeys(cc.EncryptConfig, data)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
ud, err := kw.UnwrapKey(cc.DecryptConfig, wk)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
if string(data) != string(ud) {
|
||||
return
|
||||
}
|
||||
|
||||
t.Fatal("Successfully wrap for invalid crypto config")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user