2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2016-04-04 17:44:22 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
|
|
|
"bytes"
|
2018-01-19 09:44:44 +03:00
|
|
|
"context"
|
2016-04-04 17:44:22 +03:00
|
|
|
"encoding/base64"
|
|
|
|
"encoding/json"
|
2020-10-23 21:16:04 +03:00
|
|
|
"errors"
|
2016-04-04 17:44:22 +03:00
|
|
|
"fmt"
|
2022-11-29 03:01:47 +03:00
|
|
|
"strings"
|
2021-04-08 19:43:39 +03:00
|
|
|
"sync/atomic"
|
|
|
|
|
2023-05-04 21:22:30 +03:00
|
|
|
aeadwrapper "github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2"
|
|
|
|
|
2020-08-10 15:35:57 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/jsonutil"
|
|
|
|
"github.com/hashicorp/vault/sdk/physical"
|
2016-04-04 17:44:22 +03:00
|
|
|
|
2022-09-22 16:12:41 +03:00
|
|
|
"github.com/ProtonMail/go-crypto/openpgp"
|
|
|
|
"github.com/ProtonMail/go-crypto/openpgp/packet"
|
2019-10-18 21:46:00 +03:00
|
|
|
"github.com/golang/protobuf/proto"
|
2022-08-23 22:37:16 +03:00
|
|
|
wrapping "github.com/hashicorp/go-kms-wrapping/v2"
|
2018-09-18 06:03:00 +03:00
|
|
|
"github.com/hashicorp/vault/vault/seal"
|
2016-04-04 17:44:22 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
// barrierSealConfigPath is the path used to store our seal configuration.
|
|
|
|
// This value is stored in plaintext, since we must be able to read it even
|
|
|
|
// with the Vault sealed. This is required so that we know how many secret
|
2021-12-07 04:12:20 +03:00
|
|
|
// parts must be used to reconstruct the unseal key.
|
2016-04-04 17:44:22 +03:00
|
|
|
barrierSealConfigPath = "core/seal-config"
|
|
|
|
|
|
|
|
// recoverySealConfigPath is the path to the recovery key seal
|
2017-10-23 21:59:37 +03:00
|
|
|
// configuration. It lives inside the barrier.
|
|
|
|
// DEPRECATED: Use recoverySealConfigPlaintextPath instead.
|
2016-04-04 17:44:22 +03:00
|
|
|
recoverySealConfigPath = "core/recovery-seal-config"
|
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// recoverySealConfigPlaintextPath is the path to the recovery key seal
|
|
|
|
// configuration. This is stored in plaintext so that we can perform
|
|
|
|
// auto-unseal.
|
|
|
|
recoverySealConfigPlaintextPath = "core/recovery-config"
|
|
|
|
|
2016-04-04 17:44:22 +03:00
|
|
|
// recoveryKeyPath is the path to the recovery key
|
|
|
|
recoveryKeyPath = "core/recovery-key"
|
2017-10-23 21:59:37 +03:00
|
|
|
|
2018-11-05 22:06:39 +03:00
|
|
|
// StoredBarrierKeysPath is the path used for storing HSM-encrypted unseal keys
|
|
|
|
StoredBarrierKeysPath = "core/hsm/barrier-unseal-keys"
|
2017-10-23 21:59:37 +03:00
|
|
|
|
|
|
|
// hsmStoredIVPath is the path to the initialization vector for stored keys
|
|
|
|
hsmStoredIVPath = "core/hsm/iv"
|
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
RecoveryTypeUnsupported = "unsupported"
|
|
|
|
RecoveryTypeShamir = "shamir"
|
2016-04-04 17:44:22 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
type Seal interface {
|
|
|
|
SetCore(*Core)
|
2018-01-19 09:44:44 +03:00
|
|
|
Init(context.Context) error
|
|
|
|
Finalize(context.Context) error
|
2023-05-04 21:22:30 +03:00
|
|
|
StoredKeysSupported() seal.StoredKeysSupport // SealAccess
|
2019-10-18 21:46:00 +03:00
|
|
|
SealWrapable() bool
|
2018-01-19 09:44:44 +03:00
|
|
|
SetStoredKeys(context.Context, [][]byte) error
|
|
|
|
GetStoredKeys(context.Context) ([][]byte, error)
|
2023-05-04 21:22:30 +03:00
|
|
|
BarrierType() wrapping.WrapperType // SealAccess
|
|
|
|
BarrierConfig(context.Context) (*SealConfig, error) // SealAccess
|
2018-01-19 09:44:44 +03:00
|
|
|
SetBarrierConfig(context.Context, *SealConfig) error
|
2018-10-23 09:34:02 +03:00
|
|
|
SetCachedBarrierConfig(*SealConfig)
|
2023-05-04 21:22:30 +03:00
|
|
|
RecoveryKeySupported() bool // SealAccess
|
2018-01-19 11:17:36 +03:00
|
|
|
RecoveryType() string
|
2023-05-04 21:22:30 +03:00
|
|
|
RecoveryConfig(context.Context) (*SealConfig, error) // SealAccess
|
2019-02-01 22:29:55 +03:00
|
|
|
RecoveryKey(context.Context) ([]byte, error)
|
2018-01-19 09:44:44 +03:00
|
|
|
SetRecoveryConfig(context.Context, *SealConfig) error
|
2018-10-23 09:34:02 +03:00
|
|
|
SetCachedRecoveryConfig(*SealConfig)
|
2018-01-19 09:44:44 +03:00
|
|
|
SetRecoveryKey(context.Context, []byte) error
|
2023-05-04 21:22:30 +03:00
|
|
|
VerifyRecoveryKey(context.Context, []byte) error // SealAccess
|
|
|
|
GetAccess() seal.Access // SealAccess
|
|
|
|
GetShamirWrapper() (*aeadwrapper.ShamirWrapper, error)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
type defaultSeal struct {
|
2023-05-04 21:22:30 +03:00
|
|
|
access seal.Access
|
2023-02-01 22:34:53 +03:00
|
|
|
config atomic.Value
|
|
|
|
core *Core
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2023-05-04 21:22:30 +03:00
|
|
|
var _ Seal = (*defaultSeal)(nil)
|
|
|
|
|
|
|
|
func NewDefaultSeal(lowLevel seal.Access) Seal {
|
2019-06-20 22:14:58 +03:00
|
|
|
ret := &defaultSeal{
|
2023-02-01 22:34:53 +03:00
|
|
|
access: lowLevel,
|
2019-06-20 22:14:58 +03:00
|
|
|
}
|
2018-02-24 01:18:48 +03:00
|
|
|
ret.config.Store((*SealConfig)(nil))
|
|
|
|
return ret
|
|
|
|
}
|
|
|
|
|
2019-10-18 21:46:00 +03:00
|
|
|
func (d *defaultSeal) SealWrapable() bool {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) checkCore() error {
|
2016-04-04 17:44:22 +03:00
|
|
|
if d.core == nil {
|
|
|
|
return fmt.Errorf("seal does not have a core set")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-05-04 21:22:30 +03:00
|
|
|
func (d *defaultSeal) GetAccess() seal.Access {
|
2019-06-20 22:14:58 +03:00
|
|
|
return d.access
|
|
|
|
}
|
|
|
|
|
2023-05-04 21:22:30 +03:00
|
|
|
func (d *defaultSeal) SetAccess(access seal.Access) {
|
2019-06-20 22:14:58 +03:00
|
|
|
d.access = access
|
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) SetCore(core *Core) {
|
2016-04-04 17:44:22 +03:00
|
|
|
d.core = core
|
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) Init(ctx context.Context) error {
|
2016-04-04 17:44:22 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) Finalize(ctx context.Context) error {
|
2016-04-14 23:36:20 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-08-23 22:37:16 +03:00
|
|
|
func (d *defaultSeal) BarrierType() wrapping.WrapperType {
|
|
|
|
return wrapping.WrapperTypeShamir
|
2016-04-16 01:16:48 +03:00
|
|
|
}
|
|
|
|
|
2020-01-11 04:39:52 +03:00
|
|
|
func (d *defaultSeal) StoredKeysSupported() seal.StoredKeysSupport {
|
2019-10-18 21:46:00 +03:00
|
|
|
switch {
|
2020-08-10 15:35:57 +03:00
|
|
|
case d.LegacySeal():
|
2020-01-11 04:39:52 +03:00
|
|
|
return seal.StoredKeysNotSupported
|
2019-10-18 21:46:00 +03:00
|
|
|
default:
|
2021-12-07 04:12:20 +03:00
|
|
|
return seal.StoredKeysSupportedShamirRoot
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) RecoveryKeySupported() bool {
|
2019-10-18 21:46:00 +03:00
|
|
|
return false
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) SetStoredKeys(ctx context.Context, keys [][]byte) error {
|
2020-08-10 15:35:57 +03:00
|
|
|
if d.LegacySeal() {
|
2019-10-18 21:46:00 +03:00
|
|
|
return fmt.Errorf("stored keys are not supported")
|
|
|
|
}
|
2023-02-01 22:34:53 +03:00
|
|
|
return writeStoredKeys(ctx, d.core.physical, d.access, keys)
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
2020-08-10 15:35:57 +03:00
|
|
|
func (d *defaultSeal) LegacySeal() bool {
|
2019-10-18 21:46:00 +03:00
|
|
|
cfg := d.config.Load().(*SealConfig)
|
|
|
|
if cfg == nil {
|
2020-08-10 15:35:57 +03:00
|
|
|
return false
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
2020-08-10 15:35:57 +03:00
|
|
|
return cfg.StoredShares == 0
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) GetStoredKeys(ctx context.Context) ([][]byte, error) {
|
2020-08-10 15:35:57 +03:00
|
|
|
if d.LegacySeal() {
|
2019-10-18 21:46:00 +03:00
|
|
|
return nil, fmt.Errorf("stored keys are not supported")
|
|
|
|
}
|
2023-02-01 22:34:53 +03:00
|
|
|
keys, err := readStoredKeys(ctx, d.core.physical, d.access)
|
2019-10-18 21:46:00 +03:00
|
|
|
return keys, err
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) BarrierConfig(ctx context.Context) (*SealConfig, error) {
|
2019-10-18 21:46:00 +03:00
|
|
|
cfg := d.config.Load().(*SealConfig)
|
|
|
|
if cfg != nil {
|
|
|
|
return cfg.Clone(), nil
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if err := d.checkCore(); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Fetch the core configuration
|
2018-01-19 09:44:44 +03:00
|
|
|
pe, err := d.core.physical.Get(ctx, barrierSealConfigPath)
|
2016-04-04 17:44:22 +03:00
|
|
|
if err != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
d.core.logger.Error("failed to read seal configuration", "error", err)
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to check seal configuration: %w", err)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// If the seal configuration is missing, we are not initialized
|
|
|
|
if pe == nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
d.core.logger.Info("seal configuration missing, not initialized")
|
2016-04-04 17:44:22 +03:00
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
var conf SealConfig
|
|
|
|
|
|
|
|
// Decode the barrier entry
|
2016-07-06 19:25:40 +03:00
|
|
|
if err := jsonutil.DecodeJSON(pe.Value, &conf); err != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
d.core.logger.Error("failed to decode seal configuration", "error", err)
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to decode seal configuration: %w", err)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2016-04-16 01:16:48 +03:00
|
|
|
switch conf.Type {
|
|
|
|
// This case should not be valid for other types as only this is the default
|
|
|
|
case "":
|
2022-08-23 22:37:16 +03:00
|
|
|
conf.Type = d.BarrierType().String()
|
|
|
|
case d.BarrierType().String():
|
2016-04-16 01:16:48 +03:00
|
|
|
default:
|
2023-02-01 22:34:53 +03:00
|
|
|
d.core.logger.Error("barrier seal type does not match expected type", "barrier_seal_type", conf.Type, "loaded_seal_type", d.BarrierType())
|
|
|
|
return nil, fmt.Errorf("barrier seal type of %q does not match expected type of %q", conf.Type, d.BarrierType())
|
2016-04-16 01:16:48 +03:00
|
|
|
}
|
|
|
|
|
2016-04-04 17:44:22 +03:00
|
|
|
// Check for a valid seal configuration
|
|
|
|
if err := conf.Validate(); err != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
d.core.logger.Error("invalid seal configuration", "error", err)
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("seal validation failed: %w", err)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2020-08-10 15:35:57 +03:00
|
|
|
d.SetCachedBarrierConfig(&conf)
|
2018-02-24 01:18:48 +03:00
|
|
|
return conf.Clone(), nil
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) SetBarrierConfig(ctx context.Context, config *SealConfig) error {
|
2016-04-04 17:44:22 +03:00
|
|
|
if err := d.checkCore(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-01-17 23:43:10 +03:00
|
|
|
// Provide a way to wipe out the cached value (also prevents actually
|
|
|
|
// saving a nil config)
|
|
|
|
if config == nil {
|
2018-02-24 01:18:48 +03:00
|
|
|
d.config.Store((*SealConfig)(nil))
|
2017-01-17 23:43:10 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-08-23 22:37:16 +03:00
|
|
|
config.Type = d.BarrierType().String()
|
2016-04-16 01:16:48 +03:00
|
|
|
|
2019-10-18 21:46:00 +03:00
|
|
|
// If we are doing a raft unseal we do not want to persist the barrier config
|
2019-06-20 22:14:58 +03:00
|
|
|
// because storage isn't setup yet.
|
|
|
|
if d.core.isRaftUnseal() {
|
|
|
|
d.config.Store(config.Clone())
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-04-04 17:44:22 +03:00
|
|
|
// Encode the seal configuration
|
|
|
|
buf, err := json.Marshal(config)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to encode seal configuration: %w", err)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Store the seal configuration
|
|
|
|
pe := &physical.Entry{
|
|
|
|
Key: barrierSealConfigPath,
|
|
|
|
Value: buf,
|
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
if err := d.core.physical.Put(ctx, pe); err != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
d.core.logger.Error("failed to write seal configuration", "error", err)
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to write seal configuration: %w", err)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
2020-08-10 15:35:57 +03:00
|
|
|
d.SetCachedBarrierConfig(config.Clone())
|
2016-04-04 17:44:22 +03:00
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2018-10-23 09:34:02 +03:00
|
|
|
func (d *defaultSeal) SetCachedBarrierConfig(config *SealConfig) {
|
|
|
|
d.config.Store(config)
|
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) RecoveryType() string {
|
2017-10-23 21:59:37 +03:00
|
|
|
return RecoveryTypeUnsupported
|
2016-04-16 01:16:48 +03:00
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) RecoveryConfig(ctx context.Context) (*SealConfig, error) {
|
2016-04-04 17:44:22 +03:00
|
|
|
return nil, fmt.Errorf("recovery not supported")
|
|
|
|
}
|
|
|
|
|
2019-02-01 22:29:55 +03:00
|
|
|
func (d *defaultSeal) RecoveryKey(ctx context.Context) ([]byte, error) {
|
|
|
|
return nil, fmt.Errorf("recovery not supported")
|
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) SetRecoveryConfig(ctx context.Context, config *SealConfig) error {
|
2016-04-04 17:44:22 +03:00
|
|
|
return fmt.Errorf("recovery not supported")
|
|
|
|
}
|
|
|
|
|
2018-10-23 09:34:02 +03:00
|
|
|
func (d *defaultSeal) SetCachedRecoveryConfig(config *SealConfig) {
|
|
|
|
}
|
|
|
|
|
2018-05-21 00:49:37 +03:00
|
|
|
func (d *defaultSeal) VerifyRecoveryKey(ctx context.Context, key []byte) error {
|
2016-04-04 17:44:22 +03:00
|
|
|
return fmt.Errorf("recovery not supported")
|
|
|
|
}
|
|
|
|
|
2018-02-24 01:18:48 +03:00
|
|
|
func (d *defaultSeal) SetRecoveryKey(ctx context.Context, key []byte) error {
|
2016-04-04 17:44:22 +03:00
|
|
|
return fmt.Errorf("recovery not supported")
|
|
|
|
}
|
|
|
|
|
2023-05-04 21:22:30 +03:00
|
|
|
func (d *defaultSeal) GetShamirWrapper() (*aeadwrapper.ShamirWrapper, error) {
|
|
|
|
// defaultSeal is meant to be for Shamir seals, so it should always have a ShamirWrapper.
|
|
|
|
// Nonetheless, NewDefaultSeal does not check, so let's play it safe.
|
|
|
|
w, ok := d.GetAccess().GetWrapper().(*aeadwrapper.ShamirWrapper)
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("expected defaultSeal to have a ShamirWrapper, but found a %T instead", d.GetAccess().GetWrapper())
|
|
|
|
}
|
|
|
|
return w, nil
|
|
|
|
}
|
|
|
|
|
2016-04-04 17:44:22 +03:00
|
|
|
// SealConfig is used to describe the seal configuration
|
|
|
|
type SealConfig struct {
|
2016-04-16 01:16:48 +03:00
|
|
|
// The type, for sanity checking
|
2019-06-20 22:14:58 +03:00
|
|
|
Type string `json:"type" mapstructure:"type"`
|
2016-04-16 01:16:48 +03:00
|
|
|
|
2016-04-04 17:44:22 +03:00
|
|
|
// SecretShares is the number of shares the secret is split into. This is
|
|
|
|
// the N value of Shamir.
|
2019-06-20 22:14:58 +03:00
|
|
|
SecretShares int `json:"secret_shares" mapstructure:"secret_shares"`
|
2016-04-04 17:44:22 +03:00
|
|
|
|
|
|
|
// SecretThreshold is the number of parts required to open the vault. This
|
|
|
|
// is the T value of Shamir.
|
2019-06-20 22:14:58 +03:00
|
|
|
SecretThreshold int `json:"secret_threshold" mapstructure:"secret_threshold"`
|
2016-04-04 17:44:22 +03:00
|
|
|
|
|
|
|
// PGPKeys is the array of public PGP keys used, if requested, to encrypt
|
|
|
|
// the output unseal tokens. If provided, it sets the value of
|
|
|
|
// SecretShares. Ordering is important.
|
2019-06-20 22:14:58 +03:00
|
|
|
PGPKeys []string `json:"pgp_keys" mapstructure:"pgp_keys"`
|
2016-04-04 17:44:22 +03:00
|
|
|
|
|
|
|
// Nonce is a nonce generated by Vault used to ensure that when unseal keys
|
|
|
|
// are submitted for a rekey operation, the rekey operation itself is the
|
|
|
|
// one intended. This prevents hijacking of the rekey operation, since it
|
|
|
|
// is unauthenticated.
|
2019-06-20 22:14:58 +03:00
|
|
|
Nonce string `json:"nonce" mapstructure:"nonce"`
|
2016-04-04 17:44:22 +03:00
|
|
|
|
|
|
|
// Backup indicates whether or not a backup of PGP-encrypted unseal keys
|
|
|
|
// should be stored at coreUnsealKeysBackupPath after successful rekeying.
|
2019-06-20 22:14:58 +03:00
|
|
|
Backup bool `json:"backup" mapstructure:"backup"`
|
2016-04-04 17:44:22 +03:00
|
|
|
|
2019-10-18 21:46:00 +03:00
|
|
|
// How many keys to store, for seals that support storage. Always 0 or 1.
|
2019-06-20 22:14:58 +03:00
|
|
|
StoredShares int `json:"stored_shares" mapstructure:"stored_shares"`
|
2018-05-18 04:17:52 +03:00
|
|
|
|
2018-05-22 00:46:32 +03:00
|
|
|
// Stores the progress of the rekey operation (key shares)
|
|
|
|
RekeyProgress [][]byte `json:"-"`
|
|
|
|
|
2018-05-18 04:17:52 +03:00
|
|
|
// VerificationRequired indicates that after a rekey validation must be
|
|
|
|
// performed (via providing shares from the new key) before the new key is
|
2018-05-21 23:13:38 +03:00
|
|
|
// actually installed. This is omitted from JSON as we don't persist the
|
2018-05-18 04:17:52 +03:00
|
|
|
// new key, it lives only in memory.
|
|
|
|
VerificationRequired bool `json:"-"`
|
|
|
|
|
|
|
|
// VerificationKey is the new key that we will roll to after successful
|
|
|
|
// validation
|
|
|
|
VerificationKey []byte `json:"-"`
|
|
|
|
|
|
|
|
// VerificationNonce stores the current operation nonce for verification
|
|
|
|
VerificationNonce string `json:"-"`
|
2018-05-22 00:46:32 +03:00
|
|
|
|
|
|
|
// Stores the progress of the verification operation (key shares)
|
|
|
|
VerificationProgress [][]byte `json:"-"`
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Validate is used to sanity check the seal configuration
|
|
|
|
func (s *SealConfig) Validate() error {
|
|
|
|
if s.SecretShares < 1 {
|
|
|
|
return fmt.Errorf("shares must be at least one")
|
|
|
|
}
|
|
|
|
if s.SecretThreshold < 1 {
|
|
|
|
return fmt.Errorf("threshold must be at least one")
|
|
|
|
}
|
|
|
|
if s.SecretShares > 1 && s.SecretThreshold == 1 {
|
|
|
|
return fmt.Errorf("threshold must be greater than one for multiple shares")
|
|
|
|
}
|
|
|
|
if s.SecretShares > 255 {
|
|
|
|
return fmt.Errorf("shares must be less than 256")
|
|
|
|
}
|
|
|
|
if s.SecretThreshold > 255 {
|
|
|
|
return fmt.Errorf("threshold must be less than 256")
|
|
|
|
}
|
|
|
|
if s.SecretThreshold > s.SecretShares {
|
|
|
|
return fmt.Errorf("threshold cannot be larger than shares")
|
|
|
|
}
|
2019-10-18 21:46:00 +03:00
|
|
|
if s.StoredShares > 1 {
|
|
|
|
return fmt.Errorf("stored keys cannot be larger than 1")
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
2019-10-18 21:46:00 +03:00
|
|
|
if len(s.PGPKeys) > 0 && len(s.PGPKeys) != s.SecretShares {
|
2016-04-04 17:44:22 +03:00
|
|
|
return fmt.Errorf("count mismatch between number of provided PGP keys and number of shares")
|
|
|
|
}
|
|
|
|
if len(s.PGPKeys) > 0 {
|
|
|
|
for _, keystring := range s.PGPKeys {
|
|
|
|
data, err := base64.StdEncoding.DecodeString(keystring)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("error decoding given PGP key: %w", err)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
_, err = openpgp.ReadEntity(packet.NewReader(bytes.NewBuffer(data)))
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("error parsing given PGP key: %w", err)
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *SealConfig) Clone() *SealConfig {
|
|
|
|
ret := &SealConfig{
|
2018-05-18 04:17:52 +03:00
|
|
|
Type: s.Type,
|
|
|
|
SecretShares: s.SecretShares,
|
|
|
|
SecretThreshold: s.SecretThreshold,
|
|
|
|
Nonce: s.Nonce,
|
|
|
|
Backup: s.Backup,
|
|
|
|
StoredShares: s.StoredShares,
|
|
|
|
VerificationRequired: s.VerificationRequired,
|
2018-05-20 09:42:15 +03:00
|
|
|
VerificationNonce: s.VerificationNonce,
|
2016-04-04 17:44:22 +03:00
|
|
|
}
|
|
|
|
if len(s.PGPKeys) > 0 {
|
|
|
|
ret.PGPKeys = make([]string, len(s.PGPKeys))
|
|
|
|
copy(ret.PGPKeys, s.PGPKeys)
|
|
|
|
}
|
2018-05-18 04:17:52 +03:00
|
|
|
if len(s.VerificationKey) > 0 {
|
|
|
|
ret.VerificationKey = make([]byte, len(s.VerificationKey))
|
|
|
|
copy(ret.VerificationKey, s.VerificationKey)
|
|
|
|
}
|
2016-04-04 17:44:22 +03:00
|
|
|
return ret
|
|
|
|
}
|
2019-10-18 21:46:00 +03:00
|
|
|
|
2020-10-23 21:16:04 +03:00
|
|
|
type ErrEncrypt struct {
|
|
|
|
Err error
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ error = &ErrEncrypt{}
|
|
|
|
|
|
|
|
func (e *ErrEncrypt) Error() string {
|
|
|
|
return e.Err.Error()
|
|
|
|
}
|
|
|
|
|
|
|
|
func (e *ErrEncrypt) Is(target error) bool {
|
|
|
|
_, ok := target.(*ErrEncrypt)
|
|
|
|
return ok || errors.Is(e.Err, target)
|
|
|
|
}
|
|
|
|
|
|
|
|
type ErrDecrypt struct {
|
|
|
|
Err error
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ error = &ErrDecrypt{}
|
|
|
|
|
|
|
|
func (e *ErrDecrypt) Error() string {
|
|
|
|
return e.Err.Error()
|
|
|
|
}
|
|
|
|
|
|
|
|
func (e *ErrDecrypt) Is(target error) bool {
|
|
|
|
_, ok := target.(*ErrDecrypt)
|
|
|
|
return ok || errors.Is(e.Err, target)
|
|
|
|
}
|
|
|
|
|
2023-05-04 21:22:30 +03:00
|
|
|
func writeStoredKeys(ctx context.Context, storage physical.Backend, encryptor seal.Access, keys [][]byte) error {
|
2019-10-18 21:46:00 +03:00
|
|
|
if keys == nil {
|
|
|
|
return fmt.Errorf("keys were nil")
|
|
|
|
}
|
|
|
|
if len(keys) == 0 {
|
|
|
|
return fmt.Errorf("no keys provided")
|
|
|
|
}
|
|
|
|
|
|
|
|
buf, err := json.Marshal(keys)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to encode keys for storage: %w", err)
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Encrypt and marshal the keys
|
2020-01-11 04:39:52 +03:00
|
|
|
blobInfo, err := encryptor.Encrypt(ctx, buf, nil)
|
2019-10-18 21:46:00 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return &ErrEncrypt{Err: fmt.Errorf("failed to encrypt keys for storage: %w", err)}
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
value, err := proto.Marshal(blobInfo)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to marshal value for storage: %w", err)
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Store the seal configuration.
|
|
|
|
pe := &physical.Entry{
|
2023-05-04 21:22:30 +03:00
|
|
|
Key: StoredBarrierKeysPath, // TODO(SEALHA): will we need to store more than one set of keys?
|
2019-10-18 21:46:00 +03:00
|
|
|
Value: value,
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := storage.Put(ctx, pe); err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to write keys to storage: %w", err)
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-05-04 21:22:30 +03:00
|
|
|
func readStoredKeys(ctx context.Context, storage physical.Backend, encryptor seal.Access) ([][]byte, error) {
|
2023-02-01 22:34:53 +03:00
|
|
|
pe, err := storage.Get(ctx, StoredBarrierKeysPath)
|
2019-10-18 21:46:00 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to fetch stored keys: %w", err)
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// This is not strictly an error; we may not have any stored keys, for
|
|
|
|
// instance, if we're not initialized
|
|
|
|
if pe == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2023-02-01 22:34:53 +03:00
|
|
|
blobInfo := &wrapping.BlobInfo{}
|
|
|
|
if err := proto.Unmarshal(pe.Value, blobInfo); err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to proto decode stored keys: %w", err)
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
2023-02-01 22:34:53 +03:00
|
|
|
pt, err := encryptor.Decrypt(ctx, blobInfo, nil)
|
2019-10-18 21:46:00 +03:00
|
|
|
if err != nil {
|
2022-11-29 03:01:47 +03:00
|
|
|
if strings.Contains(err.Error(), "message authentication failed") {
|
2023-02-01 22:34:53 +03:00
|
|
|
return nil, &ErrInvalidKey{Reason: fmt.Sprintf("failed to decrypt keys from storage: %v", err)}
|
2022-11-29 03:01:47 +03:00
|
|
|
}
|
2023-02-01 22:34:53 +03:00
|
|
|
return nil, &ErrDecrypt{Err: fmt.Errorf("failed to decrypt keys from storage: %w", err)}
|
2019-10-18 21:46:00 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Decode the barrier entry
|
|
|
|
var keys [][]byte
|
|
|
|
if err := json.Unmarshal(pt, &keys); err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to decode stored keys: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return keys, nil
|
|
|
|
}
|