forked from hashicorp/vault
/
seal_testing.go
83 lines (65 loc) · 1.54 KB
/
seal_testing.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
package seal
import (
"context"
"github.com/hashicorp/vault/helper/xor"
"github.com/hashicorp/vault/physical"
)
type TestSeal struct {
Type string
secret []byte
}
var _ Access = (*TestSeal)(nil)
func NewTestSeal(secret []byte) *TestSeal {
return &TestSeal{
Type: Test,
secret: secret,
}
}
func (s *TestSeal) Init(_ context.Context) error {
return nil
}
func (t *TestSeal) Finalize(_ context.Context) error {
return nil
}
func (t *TestSeal) SealType() string {
return t.Type
}
func (t *TestSeal) KeyID() string {
return "static-key"
}
func (t *TestSeal) Encrypt(_ context.Context, plaintext []byte) (*physical.EncryptedBlobInfo, error) {
ct, err := t.obscureBytes(plaintext)
if err != nil {
return nil, err
}
return &physical.EncryptedBlobInfo{
Ciphertext: ct,
KeyInfo: &physical.SealKeyInfo{
KeyID: t.KeyID(),
},
}, nil
}
func (t *TestSeal) Decrypt(_ context.Context, dwi *physical.EncryptedBlobInfo) ([]byte, error) {
return t.obscureBytes(dwi.Ciphertext)
}
// obscureBytes is a helper to simulate "encryption/decryption"
// on protected values.
func (t *TestSeal) obscureBytes(in []byte) ([]byte, error) {
out := make([]byte, len(in))
if len(t.secret) != 0 {
// make sure they are the same length
localSecret := make([]byte, len(in))
copy(localSecret, t.secret)
var err error
out, err = xor.XORBytes(in, localSecret)
if err != nil {
return nil, err
}
} else {
// if there is no secret, simply reverse the string
for i := 0; i < len(in); i++ {
out[i] = in[len(in)-1-i]
}
}
return out, nil
}