kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-01 16:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

Log AES-128 and AES-192 key sizes during keyring initialization

Browse Source
This commit is contained in:
Kent 'picat' Gruber
2020-10-01 11:12:14 -04:00
parent e461ba01a9
commit 2ae72441b5
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
command/agent/agent.go
View File

@@ -807,7 +807,7 @@ func (a *Agent) setupKeyrings(config *nomad.Config) error {
goto LOAD
}
if _, err := os.Stat(file); err != nil {
if err := initKeyring(file, a.config.Server.EncryptKey); err != nil {
if err := initKeyring(file, a.config.Server.EncryptKey, a.logger); err != nil {
return err
}
}

16
command/agent/keyring.go
View File

@@ -8,6 +8,7 @@ import (
"os"
"path/filepath"
log "github.com/hashicorp/go-hclog"
"github.com/hashicorp/memberlist"
"github.com/hashicorp/serf/serf"
)
@@ -17,7 +18,7 @@ const (
)
// initKeyring will create a keyring file at a given path.
func initKeyring(path, key string) error {
func initKeyring(path, key string, l log.Logger) error {
var keys []string
if keyBytes, err := base64.StdEncoding.DecodeString(key); err != nil {
@@ -26,6 +27,19 @@ func initKeyring(path, key string) error {
return fmt.Errorf("Invalid key: %s", err)
}
// Check for AES-256 key size (32-bytes)
if len(key) < 32 {
var encMethod string
switch len(key) {
case 16:
encMethod = "AES-128"
case 24:
encMethod = "AES-192"
}
msg := fmt.Sprintf("given %d-byte gossip key enables %s encryption, generate a 32-byte key to enable AES-256", len(key), encMethod)
l.Info(msg)
}
// Just exit if the file already exists.
if _, err := os.Stat(path); err == nil {
return nil