|
40 | 40 |
|
41 | 41 | @Local(value = {SystemIntegrityChecker.class}) |
42 | 42 | public class EncryptionSecretKeyChecker implements SystemIntegrityChecker { |
43 | | - |
44 | | - private static final Logger s_logger = Logger.getLogger(EncryptionSecretKeyChecker.class); |
45 | | - |
| 43 | + |
| 44 | + private static final Logger s_logger = Logger.getLogger(EncryptionSecretKeyChecker.class); |
| 45 | + |
46 | 46 | private static final String s_keyFile = "/etc/cloud/management/key"; |
47 | 47 | private static final String s_envKey = "CLOUD_SECRET_KEY"; |
48 | 48 | private static StandardPBEStringEncryptor s_encryptor = new StandardPBEStringEncryptor(); |
49 | 49 | private static boolean s_useEncryption = false; |
50 | | - |
| 50 | + |
51 | 51 | @Override |
52 | 52 | public void check() { |
53 | | - //Get encryption type from db.properties |
54 | | - final File dbPropsFile = PropertiesUtil.findConfigFile("db.properties"); |
| 53 | + //Get encryption type from db.properties |
| 54 | + final File dbPropsFile = PropertiesUtil.findConfigFile("db.properties"); |
55 | 55 | final Properties dbProps = new Properties(); |
56 | 56 | try { |
57 | | - dbProps.load(new FileInputStream(dbPropsFile)); |
58 | | - |
59 | | - final String encryptionType = dbProps.getProperty("db.cloud.encryption.type"); |
60 | | - |
61 | | - s_logger.debug("Encryption Type: "+ encryptionType); |
62 | | - |
63 | | - if(encryptionType == null || encryptionType.equals("none")){ |
64 | | - return; |
65 | | - } |
66 | | - |
67 | | - s_encryptor.setAlgorithm("PBEWithMD5AndDES"); |
68 | | - String secretKey = null; |
69 | | - |
70 | | - SimpleStringPBEConfig stringConfig = new SimpleStringPBEConfig(); |
71 | | - |
72 | | - if(encryptionType.equals("file")){ |
73 | | - try { |
74 | | - BufferedReader in = new BufferedReader(new FileReader(s_keyFile)); |
75 | | - secretKey = in.readLine(); |
76 | | - //Check for null or empty secret key |
77 | | - } catch (FileNotFoundException e) { |
78 | | - throw new CloudRuntimeException("File containing secret key not found: "+s_keyFile, e); |
79 | | - } catch (IOException e) { |
80 | | - throw new CloudRuntimeException("Error while reading secret key from: "+s_keyFile, e); |
81 | | - } |
82 | | - |
83 | | - if(secretKey == null || secretKey.isEmpty()){ |
84 | | - throw new CloudRuntimeException("Secret key is null or empty in file "+s_keyFile); |
85 | | - } |
86 | | - |
87 | | - } else if(encryptionType.equals("env")){ |
88 | | - secretKey = System.getenv(s_envKey); |
89 | | - if(secretKey == null || secretKey.isEmpty()){ |
90 | | - throw new CloudRuntimeException("Environment variable "+s_envKey+" is not set or empty"); |
91 | | - } |
92 | | - } else if(encryptionType.equals("web")){ |
93 | | - ServerSocket serverSocket = null; |
94 | | - int port = 8097; |
95 | | - try { |
| 57 | + dbProps.load(new FileInputStream(dbPropsFile)); |
| 58 | + |
| 59 | + final String encryptionType = dbProps.getProperty("db.cloud.encryption.type"); |
| 60 | + |
| 61 | + s_logger.debug("Encryption Type: "+ encryptionType); |
| 62 | + |
| 63 | + if(encryptionType == null || encryptionType.equals("none")){ |
| 64 | + return; |
| 65 | + } |
| 66 | + |
| 67 | + s_encryptor.setAlgorithm("PBEWithMD5AndDES"); |
| 68 | + String secretKey = null; |
| 69 | + |
| 70 | + SimpleStringPBEConfig stringConfig = new SimpleStringPBEConfig(); |
| 71 | + |
| 72 | + if(encryptionType.equals("file")){ |
| 73 | + try { |
| 74 | + BufferedReader in = new BufferedReader(new FileReader(s_keyFile)); |
| 75 | + secretKey = in.readLine(); |
| 76 | + //Check for null or empty secret key |
| 77 | + } catch (FileNotFoundException e) { |
| 78 | + throw new CloudRuntimeException("File containing secret key not found: "+s_keyFile, e); |
| 79 | + } catch (IOException e) { |
| 80 | + throw new CloudRuntimeException("Error while reading secret key from: "+s_keyFile, e); |
| 81 | + } |
| 82 | + |
| 83 | + if(secretKey == null || secretKey.isEmpty()){ |
| 84 | + throw new CloudRuntimeException("Secret key is null or empty in file "+s_keyFile); |
| 85 | + } |
| 86 | + |
| 87 | + } else if(encryptionType.equals("env")){ |
| 88 | + secretKey = System.getenv(s_envKey); |
| 89 | + if(secretKey == null || secretKey.isEmpty()){ |
| 90 | + throw new CloudRuntimeException("Environment variable "+s_envKey+" is not set or empty"); |
| 91 | + } |
| 92 | + } else if(encryptionType.equals("web")){ |
| 93 | + ServerSocket serverSocket = null; |
| 94 | + int port = 8097; |
| 95 | + try { |
96 | 96 | serverSocket = new ServerSocket(port); |
97 | 97 | } catch (IOException ioex) { |
98 | | - throw new CloudRuntimeException("Error initializing secret key reciever", ioex); |
| 98 | + throw new CloudRuntimeException("Error initializing secret key reciever", ioex); |
| 99 | + } |
| 100 | + s_logger.info("Waiting for admin to send secret key on port "+port); |
| 101 | + Socket clientSocket = null; |
| 102 | + try { |
| 103 | + clientSocket = serverSocket.accept(); |
| 104 | + } catch (IOException e) { |
| 105 | + throw new CloudRuntimeException("Accept failed on "+port); |
99 | 106 | } |
100 | | - s_logger.info("Waiting for admin to send secret key on port "+port); |
101 | | - Socket clientSocket = null; |
102 | | - try { |
103 | | - clientSocket = serverSocket.accept(); |
104 | | - } catch (IOException e) { |
105 | | - throw new CloudRuntimeException("Accept failed on "+port); |
106 | | - } |
107 | | - PrintWriter out = new PrintWriter(clientSocket.getOutputStream(), true); |
108 | | - BufferedReader in = new BufferedReader(new InputStreamReader(clientSocket.getInputStream())); |
109 | | - String inputLine, outputLine; |
110 | | - if ((inputLine = in.readLine()) != null) { |
111 | | - secretKey = inputLine; |
112 | | - } |
113 | | - out.close(); |
114 | | - in.close(); |
115 | | - clientSocket.close(); |
116 | | - serverSocket.close(); |
117 | | - } else { |
118 | | - throw new CloudRuntimeException("Invalid encryption type: "+encryptionType); |
119 | | - } |
120 | | - |
121 | | - stringConfig.setPassword(secretKey); |
122 | | - s_encryptor.setConfig(stringConfig); |
123 | | - s_useEncryption = true; |
| 107 | + PrintWriter out = new PrintWriter(clientSocket.getOutputStream(), true); |
| 108 | + BufferedReader in = new BufferedReader(new InputStreamReader(clientSocket.getInputStream())); |
| 109 | + String inputLine; |
| 110 | + if ((inputLine = in.readLine()) != null) { |
| 111 | + secretKey = inputLine; |
| 112 | + } |
| 113 | + out.close(); |
| 114 | + in.close(); |
| 115 | + clientSocket.close(); |
| 116 | + serverSocket.close(); |
| 117 | + } else { |
| 118 | + throw new CloudRuntimeException("Invalid encryption type: "+encryptionType); |
| 119 | + } |
| 120 | + |
| 121 | + stringConfig.setPassword(secretKey); |
| 122 | + s_encryptor.setConfig(stringConfig); |
| 123 | + s_useEncryption = true; |
124 | 124 | } catch (FileNotFoundException e) { |
125 | | - throw new CloudRuntimeException("File db.properties not found", e); |
| 125 | + throw new CloudRuntimeException("File db.properties not found", e); |
126 | 126 | } catch (IOException e) { |
127 | | - throw new CloudRuntimeException("Error while reading db.properties", e); |
| 127 | + throw new CloudRuntimeException("Error while reading db.properties", e); |
128 | 128 | } |
129 | 129 | } |
130 | | - |
| 130 | + |
131 | 131 | public static StandardPBEStringEncryptor getEncryptor() { |
132 | 132 | return s_encryptor; |
133 | 133 | } |
134 | | - |
| 134 | + |
135 | 135 | public static boolean useEncryption(){ |
136 | | - return s_useEncryption; |
| 136 | + return s_useEncryption; |
137 | 137 | } |
138 | | - |
| 138 | + |
139 | 139 | //Initialize encryptor for migration during secret key change |
140 | 140 | public static void initEncryptorForMigration(String secretKey){ |
141 | | - s_encryptor.setAlgorithm("PBEWithMD5AndDES"); |
142 | | - SimpleStringPBEConfig stringConfig = new SimpleStringPBEConfig(); |
143 | | - stringConfig.setPassword(secretKey); |
144 | | - s_encryptor.setConfig(stringConfig); |
145 | | - s_useEncryption = true; |
| 141 | + s_encryptor.setAlgorithm("PBEWithMD5AndDES"); |
| 142 | + SimpleStringPBEConfig stringConfig = new SimpleStringPBEConfig(); |
| 143 | + stringConfig.setPassword(secretKey); |
| 144 | + s_encryptor.setConfig(stringConfig); |
| 145 | + s_useEncryption = true; |
146 | 146 | } |
147 | 147 | } |
0 commit comments