scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 02:02:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use go-secure-stdlib's RSA key generator backed by a DRBG (#29020)

Browse Source 
* Use DRBG based RSA key generation everywhere

* switch to the conditional generator

* Use DRBG based RSA key generation everywhere

* switch to the conditional generator

* Add an ENV var to disable the DRBG in a pinch

* update go.mod

* Use DRBG based RSA key generation everywhere

* switch to the conditional generator

* Add an ENV var to disable the DRBG in a pinch

* Use DRBG based RSA key generation everywhere

* update go.mod

* fix import

* Remove rsa2 alias, remove test code

* move cryptoutil/rsa.go to sdk

* move imports too

* remove makefile change

* rsa2->rsa

* more rsa2->rsa, remove test code

* fix some overzelous search/replace

* Update to a real tag

* changelog

* copyright

* work around copyright check

* work around copyright check pt2

* bunch of dupe imports

* missing import

* wrong license

* fix go.mod conflict

* missed a spot

* dupe import
This commit is contained in:
Scott Miller
2024-12-05 15:39:16 -06:00
committed by GitHub
parent d8482b008a
commit 86ba0dbdeb
28 changed files with 132 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sdk/go.mod
View File

@@ -26,6 +26,7 @@ require (
github.com/hashicorp/go-plugin v1.6.1
github.com/hashicorp/go-retryablehttp v0.7.7
github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.0
github.com/hashicorp/go-secure-stdlib/mlock v0.1.2
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
github.com/hashicorp/go-secure-stdlib/password v0.1.1
@@ -58,6 +59,7 @@ require (
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/go-jose/go-jose/v4 v4.0.1 // indirect
github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 // indirect
github.com/kr/pretty v0.3.1 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect

4
sdk/go.sum
View File

@@ -237,6 +237,8 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 h1:kBoJV4Xl5FLtBfnBjDvBxeNSy2IRITSGs73HQsFUEjY=
github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6/go.mod h1:y+HSOcOGB48PkUxNyLAiCiY6rEENu+E+Ss4LG8QHwf4=
github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
@@ -255,6 +257,8 @@ github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5O
github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.0 h1:4B46+S65WqQUlp0rX2F7TX6/p0HmUZsDD+cVzFTwztw=
github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.0/go.mod h1:hH8rgXHh9fPSDPerG6WzABHsHF+9ZpLhRI1LPk4JZ8c=
github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 h1:p4AKXPPS24tO8Wc8i1gLvSKdmkiSY5xuju57czJ/IJQ=
github.com/hashicorp/go-secure-stdlib/mlock v0.1.2/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 h1:iBt4Ew4XEGLfh6/bPk4rSYmuZJGizr6/x/AEizP0CQc=

11
sdk/helper/certutil/certutil_test.go
View File

@@ -26,6 +26,7 @@ import (
"time"
"github.com/fatih/structs"
"github.com/hashicorp/vault/sdk/helper/cryptoutil"
)
// Tests converting back and forth between a CertBundle and a ParsedCertBundle.
@@ -465,7 +466,7 @@ vitin0L6nprauWkKO38XgM4T75qKZpqtiOcT
}
func TestGetPublicKeySize(t *testing.T) {
rsa, err := rsa.GenerateKey(rand.Reader, 3072)
rsa, err := cryptoutil.GenerateRSAKey(rand.Reader, 3072)
if err != nil {
t.Fatal(err)
}
@@ -735,7 +736,7 @@ func setCerts() {
// RSA generation
{
key, err := rsa.GenerateKey(rand.Reader, 2048)
key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
panic(err)
}
@@ -864,7 +865,7 @@ func setCerts() {
func TestComparePublicKeysAndType(t *testing.T) {
rsa1 := genRsaKey(t).Public()
rsa2 := genRsaKey(t).Public()
rsa := genRsaKey(t).Public()
eddsa1 := genEdDSA(t).Public()
eddsa2 := genEdDSA(t).Public()
ed25519_1, _ := genEd25519Key(t)
@@ -881,7 +882,7 @@ func TestComparePublicKeysAndType(t *testing.T) {
wantErr bool
}{
{name: "RSA_Equal", args: args{key1Iface: rsa1, key2Iface: rsa1}, want: true, wantErr: false},
{name: "RSA_NotEqual", args: args{key1Iface: rsa1, key2Iface: rsa2}, want: false, wantErr: false},
{name: "RSA_NotEqual", args: args{key1Iface: rsa1, key2Iface: rsa}, want: false, wantErr: false},
{name: "EDDSA_Equal", args: args{key1Iface: eddsa1, key2Iface: eddsa1}, want: true, wantErr: false},
{name: "EDDSA_NotEqual", args: args{key1Iface: eddsa1, key2Iface: eddsa2}, want: false, wantErr: false},
{name: "ED25519_Equal", args: args{key1Iface: ed25519_1, key2Iface: ed25519_1}, want: true, wantErr: false},
@@ -1106,7 +1107,7 @@ func TestIgnoreCSRSigning(t *testing.T) {
}
func genRsaKey(t *testing.T) *rsa.PrivateKey {
key, err := rsa.GenerateKey(rand.Reader, 2048)
key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
t.Fatal(err)
}

4
sdk/helper/certutil/helpers.go
View File

@@ -29,6 +29,8 @@ import (
"strings"
"time"
"github.com/hashicorp/vault/sdk/helper/cryptoutil"
"github.com/hashicorp/errwrap"
"github.com/hashicorp/vault/sdk/helper/errutil"
"github.com/hashicorp/vault/sdk/helper/jsonutil"
@@ -368,7 +370,7 @@ func generatePrivateKey(keyType string, keyBits int, container ParsedPrivateKeyC
return errutil.InternalError{Err: fmt.Sprintf("insecure bit length for RSA private key: %d", keyBits)}
}
privateKeyType = RSAPrivateKey
privateKey, err = rsa.GenerateKey(randReader, keyBits)
privateKey, err = cryptoutil.GenerateRSAKey(randReader, keyBits)
if err != nil {
return errutil.InternalError{Err: fmt.Sprintf("error generating RSA private key: %v", err)}
}

5
sdk/helper/certutil/types_test.go
View File

@@ -9,12 +9,13 @@ import (
"crypto/ed25519"
"crypto/elliptic"
"crypto/rand"
"crypto/rsa"
"testing"
"github.com/hashicorp/vault/sdk/helper/cryptoutil"
)
func TestGetPrivateKeyTypeFromPublicKey(t *testing.T) {
rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
rsaKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
t.Fatalf("error generating rsa key: %s", err)
}

34
sdk/helper/cryptoutil/rsa.go Normal file
View File

@@ -0,0 +1,34 @@
// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0
package cryptoutil
import (
"crypto/rsa"
"io"
"os"
"github.com/hashicorp/go-secure-stdlib/cryptoutil"
"github.com/hashicorp/vault/sdk/helper/parseutil"
)
var disabled bool
func init() {
s := os.Getenv("VAULT_DISABLE_RSA_DRBG")
var err error
disabled, err = parseutil.ParseBool(s)
if err != nil {
// Assume it's a typo and disable
disabled = true
}
}
// Uses go-secure-stdlib's GenerateRSAKey routine conditionally. This exists to be able to disable the feature
// via an ENV var in a pinch
func GenerateRSAKey(randomSource io.Reader, bits int) (*rsa.PrivateKey, error) {
if disabled {
return rsa.GenerateKey(randomSource, bits)
}
return cryptoutil.GenerateRSAKey(randomSource, bits)
}

3
sdk/helper/keysutil/policy.go
View File

@@ -35,6 +35,7 @@ import (
"github.com/hashicorp/errwrap"
"github.com/hashicorp/go-uuid"
"github.com/hashicorp/vault/sdk/helper/cryptoutil"
"github.com/hashicorp/vault/sdk/helper/errutil"
"github.com/hashicorp/vault/sdk/helper/jsonutil"
"github.com/hashicorp/vault/sdk/helper/kdf"
@@ -1825,7 +1826,7 @@ func (p *Policy) RotateInMemory(randReader io.Reader) (retErr error) {
bitSize = 4096
}
entry.RSAKey, err = rsa.GenerateKey(randReader, bitSize)
entry.RSAKey, err = cryptoutil.GenerateRSAKey(randReader, bitSize)
if err != nil {
return err
}

7
sdk/helper/keysutil/policy_test.go
View File

@@ -22,6 +22,7 @@ import (
"testing"
"time"
"github.com/hashicorp/vault/sdk/helper/cryptoutil"
"github.com/hashicorp/vault/sdk/helper/errutil"
"github.com/hashicorp/vault/sdk/helper/jsonutil"
"github.com/hashicorp/vault/sdk/logical"
@@ -810,7 +811,7 @@ func Test_Import(t *testing.T) {
func generateTestKeys() (map[KeyType][]byte, error) {
keyMap := make(map[KeyType][]byte)
rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
rsaKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
if err != nil {
return nil, err
}
@@ -820,7 +821,7 @@ func generateTestKeys() (map[KeyType][]byte, error) {
}
keyMap[KeyType_RSA2048] = rsaKeyBytes
rsaKey, err = rsa.GenerateKey(rand.Reader, 3072)
rsaKey, err = cryptoutil.GenerateRSAKey(rand.Reader, 3072)
if err != nil {
return nil, err
}
@@ -830,7 +831,7 @@ func generateTestKeys() (map[KeyType][]byte, error) {
}
keyMap[KeyType_RSA3072] = rsaKeyBytes
rsaKey, err = rsa.GenerateKey(rand.Reader, 4096)
rsaKey, err = cryptoutil.GenerateRSAKey(rand.Reader, 4096)
if err != nil {
return nil, err
}