Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
bd87a68
wip: queue item signing via asymm keys
plyr4 Oct 21, 2022
41a1bba
revert: docker-compose local changes
plyr4 Oct 21, 2022
70e9b23
wip: queue item signing via asymm keys
plyr4 Oct 21, 2022
2fcaf0c
wip: queue signing cleanup
plyr4 Oct 21, 2022
bae5946
fix: generate example keys
plyr4 May 11, 2023
203bdb7
tweak: env var naming
plyr4 May 11, 2023
43141ee
enhance: key validations
plyr4 May 11, 2023
ae70584
chore: comment wording
plyr4 May 11, 2023
ca19837
chore: merge with main
plyr4 May 11, 2023
e48fa44
chore: go mod tidy
plyr4 May 11, 2023
683e0a3
wip: nil return to allow read-only setup
plyr4 May 22, 2023
b1c4c48
chore: merge with main
plyr4 Jul 20, 2023
d9d7364
chore: add base64 encoded comment
plyr4 Jul 20, 2023
fc52931
chore: merge with main
plyr4 Aug 8, 2023
96f7bd5
fix: adding keys to redis test mocks
plyr4 Aug 9, 2023
67f4416
Merge branch 'main' into feat/queue-signing
plyr4 Aug 9, 2023
1324f55
Merge branch 'main' of github.com:go-vela/server into feat/queue-signing
plyr4 Aug 16, 2023
4786391
fix: do not allow empty signing keys
plyr4 Aug 17, 2023
448a95d
Merge branch 'main' into feat/queue-signing
plyr4 Aug 17, 2023
2c9d166
fix: lint
plyr4 Aug 17, 2023
346df6c
fix: lint
plyr4 Aug 17, 2023
00507fb
chore: add middleware tests
plyr4 Aug 17, 2023
0328180
Merge branch 'main' into feat/queue-signing
plyr4 Aug 17, 2023
7935fe5
Merge branch 'main' into feat/queue-signing
plyr4 Aug 23, 2023
c28b5d6
Merge branch 'main' into feat/queue-signing
ecrupper Aug 23, 2023
37926a5
tweak: queue/redis/pop.go suggestion
plyr4 Aug 23, 2023
5815fe9
tweak: variable naming for queue keys
plyr4 Aug 23, 2023
5bf066b
tweak: cli variable naming for queue keys
plyr4 Aug 23, 2023
f24894c
Merge branch 'main' into feat/queue-signing
plyr4 Aug 23, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
tweak: variable naming for queue keys
  • Loading branch information
plyr4 committed Aug 23, 2023
commit 5815fe9a9ba1f685b3e0fffa3971e3e421d62259
12 changes: 6 additions & 6 deletions cmd/vela-server/queue.go
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ func setupQueue(c *cli.Context) (queue.Service, error) {

// queue configuration
_setup := &queue.Setup{
Driver: c.String("queue.driver"),
Address: c.String("queue.addr"),
Cluster: c.Bool("queue.cluster"),
Routes: c.StringSlice("queue.routes"),
Timeout: c.Duration("queue.pop.timeout"),
EncodedSigningPrivateKey: c.String("queue.signing.private-key"),
Driver: c.String("queue.driver"),
Address: c.String("queue.addr"),
Cluster: c.Bool("queue.cluster"),
Routes: c.StringSlice("queue.routes"),
Timeout: c.Duration("queue.pop.timeout"),
PrivateKey: c.String("queue.signing.private-key"),
}

// setup the queue
Expand Down
32 changes: 16 additions & 16 deletions queue/redis/opts.go
Original file line number Diff line number Diff line change
Expand Up @@ -75,32 +75,32 @@ func WithTimeout(timeout time.Duration) ClientOpt {
// WithPrivateKey sets the private key in the queue client for Redis.
//
//nolint:dupl // ignore similar code
func WithPrivateKey(privateKeyEncoded string) ClientOpt {
func WithPrivateKey(key string) ClientOpt {
return func(c *client) error {
c.Logger.Trace("configuring private key in redis queue client")

if len(privateKeyEncoded) == 0 {
if len(key) == 0 {
c.Logger.Warn("unable to base64 decode private key, provided key is empty. queue service will be unable to sign items")
return nil
}

privateKeyDecoded, err := base64.StdEncoding.DecodeString(privateKeyEncoded)
decoded, err := base64.StdEncoding.DecodeString(key)
if err != nil {
return err
}

if len(privateKeyDecoded) == 0 {
if len(decoded) == 0 {
return errors.New("unable to base64 decode private key, decoded key is empty")
}

c.config.SigningPrivateKey = new([64]byte)
copy(c.config.SigningPrivateKey[:], privateKeyDecoded)
c.config.PrivateKey = new([64]byte)
copy(c.config.PrivateKey[:], decoded)

if c.config.SigningPrivateKey == nil {
if c.config.PrivateKey == nil {
return errors.New("unable to copy decoded queue signing private key, copied key is nil")
}

if len(c.config.SigningPrivateKey) == 0 {
if len(c.config.PrivateKey) == 0 {
return errors.New("unable to copy decoded queue signing private key, copied key is empty")
}

Expand All @@ -111,32 +111,32 @@ func WithPrivateKey(privateKeyEncoded string) ClientOpt {
// WithPublicKey sets the public key in the queue client for Redis.
//
//nolint:dupl // ignore similar code
func WithPublicKey(publicKeyEncoded string) ClientOpt {
func WithPublicKey(key string) ClientOpt {
return func(c *client) error {
c.Logger.Tracef("configuring public key in redis queue client")

if len(publicKeyEncoded) == 0 {
if len(key) == 0 {
c.Logger.Warn("unable to base64 decode public key, provided key is empty. queue service will be unable to open items")
return nil
}

publicKeyDecoded, err := base64.StdEncoding.DecodeString(publicKeyEncoded)
decoded, err := base64.StdEncoding.DecodeString(key)
if err != nil {
return err
}

if len(publicKeyDecoded) == 0 {
if len(decoded) == 0 {
return errors.New("unable to base64 decode public key, decoded key is empty")
}

c.config.SigningPublicKey = new([32]byte)
copy(c.config.SigningPublicKey[:], publicKeyDecoded)
c.config.PublicKey = new([32]byte)
copy(c.config.PublicKey[:], decoded)

if c.config.SigningPublicKey == nil {
if c.config.PublicKey == nil {
return errors.New("unable to copy decoded queue signing public key, copied key is nil")
}

if len(c.config.SigningPublicKey) == 0 {
if len(c.config.PublicKey) == 0 {
return errors.New("unable to copy decoded queue signing public key, copied key is empty")
}

Expand Down
8 changes: 4 additions & 4 deletions queue/redis/opts_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -235,8 +235,8 @@ func TestRedis_ClientOpt_WithSigningPrivateKey(t *testing.T) {
}

got := ""
if _service.config.SigningPrivateKey != nil {
got = fmt.Sprintf("%s", *_service.config.SigningPrivateKey)
if _service.config.PrivateKey != nil {
got = fmt.Sprintf("%s", *_service.config.PrivateKey)
} else {
got = ""
}
Expand Down Expand Up @@ -303,8 +303,8 @@ func TestRedis_ClientOpt_WithSigningPublicKey(t *testing.T) {
}

got := ""
if _service.config.SigningPublicKey != nil {
got = fmt.Sprintf("%s", *_service.config.SigningPublicKey)
if _service.config.PublicKey != nil {
got = fmt.Sprintf("%s", *_service.config.PublicKey)
} else {
got = ""
}
Expand Down
4 changes: 2 additions & 2 deletions queue/redis/pop.go
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ func (c *client) Pop(ctx context.Context) (*types.Item, error) {
}

// this should already be validated on startup
if c.config.SigningPublicKey == nil || len(*c.config.SigningPublicKey) != 32 {
if c.config.PublicKey == nil || len(*c.config.PublicKey) != 32 {
return nil, errors.New("no valid signing public key provided")
}

Expand All @@ -49,7 +49,7 @@ func (c *client) Pop(ctx context.Context) (*types.Item, error) {
// open the item using the public key generated using sign
//
// https://pkg.go.dev/golang.org/x/[email protected]/nacl/sign
opened, ok := sign.Open(out, signed, c.config.SigningPublicKey)
opened, ok := sign.Open(out, signed, c.config.PublicKey)
if !ok {
return nil, errors.New("unable to open signed item")
}
Expand Down
4 changes: 2 additions & 2 deletions queue/redis/pop_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ func TestRedis_Pop(t *testing.T) {
t.Errorf("unable to create queue service: %v", err)
}

signed = sign.Sign(out, bytes, _redis.config.SigningPrivateKey)
signed = sign.Sign(out, bytes, _redis.config.PrivateKey)

// push item to queue
err = _redis.Redis.RPush(context.Background(), "vela", signed).Err()
Expand All @@ -63,7 +63,7 @@ func TestRedis_Pop(t *testing.T) {
// overwrite channel to be invalid
badChannel.config.Channels = nil

signed = sign.Sign(out, bytes, badChannel.config.SigningPrivateKey)
signed = sign.Sign(out, bytes, badChannel.config.PrivateKey)

// push something to badChannel queue
err = badChannel.Redis.RPush(context.Background(), "vela", signed).Err()
Expand Down
4 changes: 2 additions & 2 deletions queue/redis/push.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ func (c *client) Push(ctx context.Context, channel string, item []byte) error {
var out []byte

// this should already be validated on startup
if c.config.SigningPrivateKey == nil || len(*c.config.SigningPrivateKey) != 64 {
if c.config.PrivateKey == nil || len(*c.config.PrivateKey) != 64 {
return errors.New("no valid signing private key provided")
}

Expand All @@ -37,7 +37,7 @@ func (c *client) Push(ctx context.Context, channel string, item []byte) error {
// sign the item using the private key generated using sign
//
// https://pkg.go.dev/golang.org/x/[email protected]/nacl/sign
signed = sign.Sign(out, item, c.config.SigningPrivateKey)
signed = sign.Sign(out, item, c.config.PrivateKey)

// build a redis queue command to push an item to queue
//
Expand Down
4 changes: 2 additions & 2 deletions queue/redis/redis.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,9 +26,9 @@ type config struct {
// specifies the timeout to use for the Redis client
Timeout time.Duration
// key for signing items pushed to the Redis client
SigningPrivateKey *[64]byte
PrivateKey *[64]byte
// key for opening items popped from the Redis client
SigningPublicKey *[32]byte
PublicKey *[32]byte
}

type client struct {
Expand Down
12 changes: 6 additions & 6 deletions queue/setup.go
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@ type Setup struct {
Routes []string
// specifies the timeout for pop requests for the queue client
Timeout time.Duration
// encoded key used for signing items pushed to the queue
EncodedSigningPrivateKey string
// encoded key used for opening items popped from the queue
EncodedSigningPublicKey string
// private key in base64 used for signing items pushed to the queue
PrivateKey string
// public key in base64 used for opening items popped from the queue
PublicKey string
}

// Redis creates and returns a Vela service capable
Expand All @@ -49,8 +49,8 @@ func (s *Setup) Redis() (Service, error) {
redis.WithChannels(s.Routes...),
redis.WithCluster(s.Cluster),
redis.WithTimeout(s.Timeout),
redis.WithPrivateKey(s.EncodedSigningPrivateKey),
redis.WithPublicKey(s.EncodedSigningPublicKey),
redis.WithPrivateKey(s.PrivateKey),
redis.WithPublicKey(s.PublicKey),
)
}

Expand Down