veyron/security: make loadPEMKey support nil encrypted passwords.
Backward compatibility for nil encrypted passwords from old loadPEMKey
function.
Change-Id: Ic0eb4fb082dea33cc1b408ce5b2233668f101da7
diff --git a/security/agent/agentd/main.go b/security/agent/agentd/main.go
index 4ae6e0a..bcabd77 100644
--- a/security/agent/agentd/main.go
+++ b/security/agent/agentd/main.go
@@ -83,8 +83,8 @@
if os.IsNotExist(err) {
return handleDoesNotExist(dir)
}
- if err == vsecurity.MissingPassphraseErr {
- return handleMissingPassphrase(dir)
+ if err == vsecurity.PassphraseErr {
+ return handlePassphrase(dir)
}
return p, err
}
@@ -99,7 +99,7 @@
return p, err
}
-func handleMissingPassphrase(dir string) (security.Principal, error) {
+func handlePassphrase(dir string) (security.Principal, error) {
fmt.Println("Private key file is encrypted. Please enter passphrase.")
pass, err := gopass.GetPass("Enter passphrase: ")
if err != nil {
diff --git a/security/principal.go b/security/principal.go
index ab23b09..2b1f211 100644
--- a/security/principal.go
+++ b/security/principal.go
@@ -47,8 +47,7 @@
// LoadPersistentPrincipal reads state for a principal (private key, BlessingRoots, BlessingStore)
// from the provided directory 'dir' and commits all state changes to the same directory.
// If private key file does not exist then an error 'err' is returned such that os.IsNotExist(err) is true.
-// If private key file exists then 'passphrase' must be non-nil if the contents of the file are encrypted,
-// otherwise a MissingPassphraseErr is returned.
+// If private key file exists then 'passphrase' must be correct, otherwise PassphraseErr will be returned.
func LoadPersistentPrincipal(dir string, passphrase []byte) (security.Principal, error) {
key, err := loadKeyFromDir(dir, passphrase)
if err != nil {
diff --git a/security/principal_test.go b/security/principal_test.go
index 467d37a..fd6d05d 100644
--- a/security/principal_test.go
+++ b/security/principal_test.go
@@ -34,9 +34,9 @@
if _, err = LoadPersistentPrincipal(dir, incorrect_passphrase); err == nil {
t.Errorf("encrypted LoadPersistentPrincipal with incorrect passphrase should fail")
}
- // and return MissingPassphraseError if the passphrase is nil.
- if _, err = LoadPersistentPrincipal(dir, nil); err != MissingPassphraseErr {
- t.Errorf("encrypted LoadPersistentPrincipal with nil passphrase should return MissingPassphraseErr: %v", err)
+ // and return PassphraseError if the passphrase is nil.
+ if _, err = LoadPersistentPrincipal(dir, nil); err != PassphraseErr {
+ t.Errorf("encrypted LoadPersistentPrincipal with nil passphrase should return PassphraseErr: %v", err)
}
os.RemoveAll(dir)
}
diff --git a/security/util.go b/security/util.go
index 175d49f..b33d7fd 100644
--- a/security/util.go
+++ b/security/util.go
@@ -28,10 +28,9 @@
return acl
}
-var MissingPassphraseErr = errors.New("passphrase required for decrypting private key")
+var PassphraseErr = errors.New("passphrase incorrect for decrypting private key")
-// loadPEMKey loads a key from 'r'. passphrase should be non-nil if the key held in 'r' is
-// encrypted, otherwise a MissingPassphraseErr will be returned.
+// loadPEMKey loads a key from 'r'. returns PassphraseErr for incorrect Passphrase.
// If the key held in 'r' is unencrypted, 'passphrase' will be ignored.
func loadPEMKey(r io.Reader, passphrase []byte) (interface{}, error) {
pemBlockBytes, err := ioutil.ReadAll(r)
@@ -44,12 +43,9 @@
}
var data []byte
if x509.IsEncryptedPEMBlock(pemBlock) {
- if passphrase == nil {
- return nil, MissingPassphraseErr
- }
data, err = x509.DecryptPEMBlock(pemBlock, passphrase)
if err != nil {
- return nil, err
+ return nil, PassphraseErr
}
} else {
data = pemBlock.Bytes
@@ -57,7 +53,11 @@
switch pemBlock.Type {
case ecPrivateKeyPEMType:
- return x509.ParseECPrivateKey(data)
+ key, err := x509.ParseECPrivateKey(data)
+ if err != nil {
+ return nil, PassphraseErr
+ }
+ return key, nil
}
return nil, fmt.Errorf("PEM key block has an unrecognized type: %v", pemBlock.Type)
}
diff --git a/security/util_test.go b/security/util_test.go
index 117ee68..356f98c 100644
--- a/security/util_test.go
+++ b/security/util_test.go
@@ -61,8 +61,8 @@
if err := savePEMKey(&buf, key, pass); err != nil {
t.Fatalf("Failed to save ECDSA private key: %v", err)
}
- if loadedKey, err = loadPEMKey(&buf, nil); loadedKey != nil || err != MissingPassphraseErr {
- t.Fatalf("expected(nil, MissingPassphraseError), instead got (%v, %v)", loadedKey, err)
+ if loadedKey, err = loadPEMKey(&buf, nil); loadedKey != nil || err != PassphraseErr {
+ t.Fatalf("expected(nil, PassphraseError), instead got (%v, %v)", loadedKey, err)
}
}
