luxolus
/
open-nomad
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

Log AES-128 and AES-192 key sizes during keyring initialization

This commit is contained in:
Kent 'picat' Gruber 2020-10-01 11:12:14 -04:00
parent ef36bcfc43
commit b98bb99dfe
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
command/agent/agent.go
View File

@ -807,7 +807,7 @@ func (a *Agent) setupKeyrings(config *nomad.Config) error {
goto LOAD
}
if _, err := os.Stat(file); err != nil {
if err := initKeyring(file, a.config.Server.EncryptKey); err != nil {
if err := initKeyring(file, a.config.Server.EncryptKey, a.logger); err != nil {
return err
}
}

16
command/agent/keyring.go
View File

@ -8,6 +8,7 @@ import (
"os"
"path/filepath"
log "github.com/hashicorp/go-hclog"
"github.com/hashicorp/memberlist"
"github.com/hashicorp/serf/serf"
)
@ -17,7 +18,7 @@ const (
)
// initKeyring will create a keyring file at a given path.
func initKeyring(path, key string) error {
func initKeyring(path, key string, l log.Logger) error {
var keys []string
if keyBytes, err := base64.StdEncoding.DecodeString(key); err != nil {
@ -26,6 +27,19 @@ func initKeyring(path, key string) error {
return fmt.Errorf("Invalid key: %s", err)
}
// Check for AES-256 key size (32-bytes)
if len(key) < 32 {
var encMethod string
switch len(key) {
case 16:
encMethod = "AES-128"
case 24:
encMethod = "AES-192"
}
msg := fmt.Sprintf("given %d-byte gossip key enables %s encryption, generate a 32-byte key to enable AES-256", len(key), encMethod)
l.Info(msg)
}
// Just exit if the file already exists.
if _, err := os.Stat(path); err == nil {
return nil