-
Notifications
You must be signed in to change notification settings - Fork 42
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat!: terraform login protocol (#424)
Breaking change: secret must be a hex-encoded 16 byte array. Tokens will very likely therefore need to be re-created, and users will need to re-authenticate.
- Loading branch information
Showing
39 changed files
with
810 additions
and
161 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| package internal | ||
|
|
||
| import ( | ||
| "crypto/aes" | ||
| "crypto/cipher" | ||
| "crypto/rand" | ||
| "encoding/base64" | ||
| "fmt" | ||
| "io" | ||
| ) | ||
|
|
||
| // Encrypt plaintext using secret key. The returned string is | ||
| // base64-url-encoded. | ||
| func Encrypt(plaintext, secret []byte) (string, error) { | ||
| block, err := aes.NewCipher(secret) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| // Never use more than 2^32 random nonces with a given key because of the risk of a repeat. | ||
| nonce := make([]byte, 12) | ||
| if _, err := io.ReadFull(rand.Reader, nonce); err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| aesgcm, err := cipher.NewGCM(block) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| ciphertext := aesgcm.Seal(nil, nonce, plaintext, nil) | ||
|
|
||
| // Prefix string with nonce | ||
| return base64.URLEncoding.EncodeToString(append(nonce, ciphertext...)), nil | ||
| } | ||
|
|
||
| // Decrypt encrypted string using secret key. The encrypted string must be | ||
| // base64-url-encoded. | ||
| func Decrypt(encrypted string, secret []byte) ([]byte, error) { | ||
| block, err := aes.NewCipher(secret) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| aesgcm, err := cipher.NewGCM(block) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| decoded, err := base64.URLEncoding.DecodeString(encrypted) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| // Nonce is first 12 bytes, so decoding should at least be that length (plus | ||
| // a multiple of 32 bytes for the ciphertext, but we'll let aesgcm.Open | ||
| // check that). | ||
| if len(decoded) < 12 { | ||
| return nil, fmt.Errorf("size of decoded encrypted string is incorrect: %d", len(decoded)) | ||
| } | ||
|
|
||
| return aesgcm.Open(nil, decoded[:12], decoded[12:], nil) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| package internal | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestCrypto(t *testing.T) { | ||
| secret := []byte(GenerateRandomString(32)) | ||
| encrypted, err := Encrypt([]byte("exampleplaintext"), secret) | ||
| require.NoError(t, err) | ||
|
|
||
| decrypted, err := Decrypt(encrypted, secret) | ||
| require.NoError(t, err, encrypted) | ||
| assert.Equal(t, "exampleplaintext", string(decrypted)) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.