-
Notifications
You must be signed in to change notification settings - Fork 16
/
disk.go
142 lines (116 loc) · 3 KB
/
disk.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
package keymanager
import (
"context"
"crypto"
"crypto/ecdsa"
"crypto/rsa"
"crypto/x509"
"encoding/json"
"encoding/pem"
"errors"
"fmt"
"os"
"github.com/HewlettPackard/galadriel/pkg/common/cryptoutil"
"github.com/HewlettPackard/galadriel/pkg/common/diskutil"
)
// Disk extends the base KeyManager to store keys in disk.
type Disk struct {
base
keysFilePath string
}
// NewDiskKeyManager creates a new Disk that stores keys in disk.
func NewDiskKeyManager(generator Generator, keysFilePath string) (*Disk, error) {
c := &Config{
Generator: generator,
}
base := newBase(c)
diskKeyManager := &Disk{
base: *base,
keysFilePath: keysFilePath,
}
err := diskKeyManager.loadKeysFromDisk()
if err != nil {
return nil, err
}
return diskKeyManager, nil
}
// GenerateKey generates a new key and stores it in disk.
func (d *Disk) GenerateKey(ctx context.Context, keyID string, keyType cryptoutil.KeyType) (Key, error) {
key, err := d.base.GenerateKey(ctx, keyID, keyType)
if err != nil {
return nil, err
}
err = d.saveKeysToDisk()
if err != nil {
return nil, err
}
return key, nil
}
func (d *Disk) loadKeysFromDisk() error {
data, err := os.ReadFile(d.keysFilePath)
if err != nil {
return nil // No keys file exists, no error
}
keys := make(map[string]string)
if err := json.Unmarshal(data, &keys); err != nil {
return fmt.Errorf("failed to unmarshal keys from disk: %w", err)
}
d.mu.RLock()
defer d.mu.RUnlock()
for id, keyBytes := range keys {
signer, err := convertToSigner([]byte(keyBytes))
if err != nil {
return fmt.Errorf("failed to create key entry: %w", err)
}
d.entries[id] = &KeyEntry{
PrivateKey: signer,
PublicKey: signer.Public(),
id: id,
}
}
return nil
}
// saveKeysToDisk saves the keys in the key manager to disk.
func (d *Disk) saveKeysToDisk() error {
d.mu.Lock()
defer d.mu.Unlock()
keys := make(map[string]string)
for id, entry := range d.entries {
keyBytes, err := x509.MarshalPKCS8PrivateKey(entry.PrivateKey)
if err != nil {
return fmt.Errorf("failed to marshal private key: %w", err)
}
// Encode PEM block as string
keyPEM := pem.EncodeToMemory(&pem.Block{
Type: "PRIVATE KEY",
Bytes: keyBytes,
})
keys[id] = string(keyPEM)
}
data, err := json.Marshal(keys)
if err != nil {
return fmt.Errorf("failed to serialize keys: %w", err)
}
if err := diskutil.AtomicWritePrivateFile(d.keysFilePath, data); err != nil {
return fmt.Errorf("failed to write keys to disk: %w", err)
}
return nil
}
func convertToSigner(keyBytes []byte) (crypto.Signer, error) {
block, _ := pem.Decode(keyBytes)
if block == nil {
return nil, errors.New("failed to decode PEM block containing private key")
}
key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
if err != nil {
return nil, fmt.Errorf("failed to parse private key: %w", err)
}
switch key := key.(type) {
case *rsa.PrivateKey:
return key, nil
case *ecdsa.PrivateKey:
return key, nil
default:
return nil, errors.New("unsupported private key type")
}
}