forked from lf-edge/eve
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathcipherdata.go
More file actions
133 lines (116 loc) · 4.04 KB
/
Copy pathcipherdata.go
File metadata and controls
133 lines (116 loc) · 4.04 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
// Copyright (c) 2026 Zededa, Inc.
// SPDX-License-Identifier: Apache-2.0
package evetest
import (
"bytes"
"fmt"
"github.com/lf-edge/eve-api/go/evecommon"
"github.com/lf-edge/eve/evetest/utils"
)
// encryptCipherData creates a CipherBlock from an EncryptionBlock.
func (th *TestHarness) encryptCipherData(
devName string, encBlock *evecommon.EncryptionBlock) (*evecommon.CipherBlock, error) {
th.devicesM.Lock()
devState, found := th.devices[devName]
if !found {
th.devicesM.Unlock()
return nil, fmt.Errorf("unknown device %q", devName)
}
devECDHCert := devState.ecdhCert
th.devicesM.Unlock()
ctrlECDHCert, ctrlECDHKey := th.adamClient.GetECDHCertAndKey()
cryptoConfig, err := utils.NewCryptoConfig(devECDHCert, ctrlECDHCert, ctrlECDHKey)
if err != nil {
return nil, fmt.Errorf("failed to create crypto config: %w", err)
}
cipherCtx, err := utils.CreateCipherCtx(cryptoConfig)
if err != nil {
return nil, fmt.Errorf("failed to create cipher context: %w", err)
}
cipherCtx, err = th.addCipherCtxToDevice(devName, cipherCtx)
if err != nil {
return nil, fmt.Errorf("failed to add cipher context: %w", err)
}
return utils.EncryptBlock(encBlock, cryptoConfig, cipherCtx)
}
// addCipherCtxToDevice associates or de-duplicates a cipher context for a device.
func (th *TestHarness) addCipherCtxToDevice(devName string,
cipherCtx *evecommon.CipherContext) (*evecommon.CipherContext, error) {
th.devicesM.Lock()
defer th.devicesM.Unlock()
devState, found := th.devices[devName]
if !found {
th.devicesM.Unlock()
return nil, fmt.Errorf("unknown device %q", devName)
}
if devState.config == nil {
devState.config = NewEdgeDeviceConfig(devName)
}
// Check if we already have cipherCtx with the same certificates.
for _, existingCtx := range devState.config.GetCipherContexts() {
sameCipherCtx :=
bytes.Equal(existingCtx.DeviceCertHash, cipherCtx.DeviceCertHash) &&
bytes.Equal(existingCtx.ControllerCertHash, cipherCtx.ControllerCertHash)
if sameCipherCtx {
return existingCtx, nil
}
}
devState.config.CipherContexts = append(devState.config.CipherContexts, cipherCtx)
return cipherCtx, nil
}
/*
// reEncryptCipherData re-encrypts all cipher blocks in an EdgeDevConfig using a new signing cert.
func (th *TestHarness) reEncryptCipherData(devName string, edgeDevConfig *eveconfig.EdgeDevConfig,
newCtrlECDHCert *x509.Certificate) error {
th.devicesM.Lock()
devState, found := th.devices[devName]
if !found {
th.devicesM.Unlock()
return nil, fmt.Errorf("unknown device %q", devName)
}
devECDHCert := devState.ecdhCert
th.devicesM.Unlock()
oldCtrlECDHCert, ctrlECDHKey := th.adamClient.GetECDHCertAndKey()
oldCfg, err := utils.NewCryptoConfig(devCert, oldCtrlECDHCert, ctrlECDHKey)
if err != nil {
return fmt.Errorf("getCommonCryptoConfig (old): %w", err)
}
newCfg, err := utils.NewCryptoConfig(devCert, newCtrlECDHCert, ctrlECDHKey)
if err != nil {
return fmt.Errorf("getCommonCryptoConfig (new): %w", err)
}
cipherCtx, err := utils.CreateCipherCtx(newCfg)
if err != nil {
return fmt.Errorf("createCipherCtx: %w", err)
}
cipherCtx = addCipherCtxToDevice(devName, cipherCtx)
for _, cfg := range edgeDevConfig.Apps {
if err := utils.ReEncryptCipherData(cfg, oldCfg, newCfg, cipherCtx); err != nil {
return fmt.Errorf("reencrypt app config: %w", err)
}
}
for _, cfg := range edgeDevConfig.Datastores {
if err := utils.ReEncryptCipherData(cfg, oldCfg, newCfg, cipherCtx); err != nil {
return fmt.Errorf("reencrypt datastore config: %w", err)
}
}
for _, netCfg := range edgeDevConfig.GetNetworks() {
if netCfg.Wireless == nil {
continue
}
for _, cell := range netCfg.Wireless.CellularCfg {
for _, ap := range cell.AccessPoints {
if err := utils.ReEncryptCipherData(ap, oldCfg, newCfg, cipherCtx); err != nil {
return fmt.Errorf("reencrypt cellular config: %w", err)
}
}
}
for _, wifi := range netCfg.Wireless.WifiCfg {
if err := utils.ReEncryptCipherData(wifi, oldCfg, newCfg, cipherCtx); err != nil {
return fmt.Errorf("reencrypt wifi config: %w", err)
}
}
}
return nil
}
*/