Skip to content

Commit 21f5760

Browse files
anienanien
committed
Retrieve default master wrapping key only in rekey bus processor
1 parent 25da6cf commit 21f5760

File tree

6 files changed

+104
-12
lines changed

6 files changed

+104
-12
lines changed

‎components/crypto/crypto-rest/src/main/kotlin/net/corda/crypto/rest/impl/KeyRotationRestResourceImpl.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ class KeyRotationRestResourceImpl @Activate constructor(
221221
val deserializedValueOfOneRecord =
222222
checkNotNull(unmanagedKeyStatusDeserializer.deserialize(records.first().value))
223223
return KeyRotationStatusResponse(
224-
MASTER_WRAPPING_KEY_ROTATION_IDENTIFIER,
224+
records.first().metadata[KeyRotationMetadataValues.DEFAULT_MASTER_KEY_ALIAS].toString(),
225225
rotationStatus,
226226
deserializedValueOfOneRecord.createdTimestamp,
227227
getLatestTimestamp(records),

‎components/crypto/crypto-service-impl/src/main/kotlin/net/corda/crypto/service/impl/bus/CryptoRekeyBusProcessor.kt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,7 @@ class CryptoRekeyBusProcessor(
297297
IndividualKeyRotationRequest(
298298
request.requestId,
299299
tenantId,
300+
defaultUnmanagedWrappingKeyName,
300301
alias,
301302
null, // keyUuid not used in unmanaged key rotation
302303
KeyType.UNMANAGED
@@ -319,6 +320,7 @@ class CryptoRekeyBusProcessor(
319320
request.requestId,
320321
request.tenantId,
321322
null,
323+
null,
322324
it.toString(),
323325
KeyType.MANAGED
324326
)

‎components/crypto/crypto-service-impl/src/main/kotlin/net/corda/crypto/service/impl/bus/CryptoRewrapBusProcessor.kt

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ class CryptoRewrapBusProcessor(
3131
val cryptoService: CryptoService,
3232
private val stateManager: StateManager,
3333
private val cordaAvroSerializationFactory: CordaAvroSerializationFactory,
34-
private val defaultUnmanagedWrappingKeyName: String,
3534
) : DurableProcessor<String, IndividualKeyRotationRequest> {
3635

3736
companion object {
@@ -74,6 +73,10 @@ class CryptoRewrapBusProcessor(
7473
logger.info("targetKeyAlias missing from unmanaged IndividualKeyRotationRequest, ignoring.")
7574
return
7675
}
76+
if (request.masterWrappingKeyAlias.isNullOrEmpty()) {
77+
logger.info("masterWrappingKeyAlias missing from unmanaged IndividualKeyRotationRequest, ignoring.")
78+
return
79+
}
7780
if (request.keyUuid != null) {
7881
logger.info("keyUuid provided for unmanaged IndividualKeyRotationRequest, ignoring.")
7982
return
@@ -83,7 +86,7 @@ class CryptoRewrapBusProcessor(
8386
cryptoService.rewrapWrappingKey(
8487
request.tenantId,
8588
request.targetKeyAlias,
86-
defaultUnmanagedWrappingKeyName
89+
request.masterWrappingKeyAlias,
8790
)
8891
}
8992

@@ -95,6 +98,10 @@ class CryptoRewrapBusProcessor(
9598
logger.info("targetKeyAlias provided for managed IndividualKeyRotationRequest, ignoring.")
9699
return
97100
}
101+
if (request.masterWrappingKeyAlias != null) {
102+
logger.info("masterWrappingKeyAlias provided for managed IndividualKeyRotationRequest, ignoring.")
103+
return
104+
}
98105
if (request.keyUuid.isNullOrEmpty()) {
99106
logger.info("keyUuid missing from managed IndividualKeyRotationRequest, ignoring.")
100107
return
@@ -183,14 +190,14 @@ class CryptoRewrapBusProcessor(
183190
stateManager.get(
184191
listOf(
185192
getKeyRotationStatusRecordKey(
186-
defaultUnmanagedWrappingKeyName,
193+
request.masterWrappingKeyAlias,
187194
request.tenantId
188195
)
189196
)
190197
)
191198
check(tenantIdWrappingKeysRecords.size == 1) {
192199
"Found none or more than 1 ${request.tenantId} record " +
193-
"in the database for new master wrapping key $defaultUnmanagedWrappingKeyName. " +
200+
"in the database for new master wrapping key ${request.masterWrappingKeyAlias}. " +
194201
"Found records $tenantIdWrappingKeysRecords."
195202
}
196203

‎components/crypto/crypto-service-impl/src/test/kotlin/net/corda/crypto/service/impl/bus/CryptoRewrapBusProcessorTests.kt

Lines changed: 89 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ class CryptoRewrapBusProcessorTests {
4848

4949
companion object {
5050
private val tenantId = UUID.randomUUID().toString()
51-
private const val OLD_PARENT_KEY_ALIAS = "alias1"
5251
private const val WRAPPING_KEY_ALIAS = "alias"
5352
private const val DEFAULT_MASTER_WRAP_KEY_ALIAS = "defaultKeyAlias"
5453
}
@@ -117,14 +116,12 @@ class CryptoRewrapBusProcessorTests {
117116
cryptoService,
118117
stateManager,
119118
unmanagedCordaAvroSerializationFactory,
120-
DEFAULT_MASTER_WRAP_KEY_ALIAS
121119
)
122120

123121
managedCryptoRewrapBusProcessor = CryptoRewrapBusProcessor(
124122
cryptoService,
125123
stateManager,
126124
managedCordaAvroSerializationFactory,
127-
DEFAULT_MASTER_WRAP_KEY_ALIAS
128125
)
129126
}
130127

@@ -138,6 +135,7 @@ class CryptoRewrapBusProcessorTests {
138135
IndividualKeyRotationRequest(
139136
UUID.randomUUID().toString(),
140137
tenantId,
138+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
141139
"alias1",
142140
null,
143141
KeyType.UNMANAGED
@@ -160,6 +158,7 @@ class CryptoRewrapBusProcessorTests {
160158
IndividualKeyRotationRequest(
161159
UUID.randomUUID().toString(),
162160
null,
161+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
163162
"alias1",
164163
null,
165164
KeyType.UNMANAGED
@@ -184,6 +183,57 @@ class CryptoRewrapBusProcessorTests {
184183
IndividualKeyRotationRequest(
185184
UUID.randomUUID().toString(),
186185
"",
186+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
187+
"alias1",
188+
null,
189+
KeyType.UNMANAGED
190+
)
191+
)
192+
)
193+
).isEmpty()
194+
)
195+
196+
verify(cryptoService, never()).rewrapWrappingKey(any(), any(), any())
197+
verify(stateManager, never()).update(any())
198+
}
199+
200+
@Test
201+
fun `unmanaged rewrap with null master wrapping key should be ignored`() {
202+
assertTrue(
203+
unmanagedCryptoRewrapBusProcessor.onNext(
204+
listOf(
205+
Record(
206+
"TBC",
207+
UUID.randomUUID().toString(),
208+
IndividualKeyRotationRequest(
209+
UUID.randomUUID().toString(),
210+
tenantId,
211+
null,
212+
"alias1",
213+
null,
214+
KeyType.UNMANAGED
215+
)
216+
)
217+
)
218+
).isEmpty()
219+
)
220+
221+
verify(cryptoService, never()).rewrapWrappingKey(any(), any(), any())
222+
verify(stateManager, never()).update(any())
223+
}
224+
225+
@Test
226+
fun `unmanaged rewrap with empty master wrapping key should be ignored`() {
227+
assertTrue(
228+
unmanagedCryptoRewrapBusProcessor.onNext(
229+
listOf(
230+
Record(
231+
"TBC",
232+
UUID.randomUUID().toString(),
233+
IndividualKeyRotationRequest(
234+
UUID.randomUUID().toString(),
235+
tenantId,
236+
"",
187237
"alias1",
188238
null,
189239
KeyType.UNMANAGED
@@ -208,6 +258,7 @@ class CryptoRewrapBusProcessorTests {
208258
IndividualKeyRotationRequest(
209259
UUID.randomUUID().toString(),
210260
tenantId,
261+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
211262
null,
212263
null,
213264
KeyType.UNMANAGED
@@ -232,6 +283,7 @@ class CryptoRewrapBusProcessorTests {
232283
IndividualKeyRotationRequest(
233284
UUID.randomUUID().toString(),
234285
tenantId,
286+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
235287
"",
236288
"",
237289
KeyType.UNMANAGED
@@ -256,6 +308,7 @@ class CryptoRewrapBusProcessorTests {
256308
IndividualKeyRotationRequest(
257309
UUID.randomUUID().toString(),
258310
tenantId,
311+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
259312
"alias1",
260313
UUID.randomUUID().toString(),
261314
KeyType.UNMANAGED
@@ -281,6 +334,7 @@ class CryptoRewrapBusProcessorTests {
281334
UUID.randomUUID().toString(),
282335
tenantId,
283336
null,
337+
null,
284338
uuid.toString(),
285339
KeyType.MANAGED
286340
)
@@ -302,6 +356,7 @@ class CryptoRewrapBusProcessorTests {
302356
UUID.randomUUID().toString(),
303357
null,
304358
null,
359+
null,
305360
UUID.randomUUID().toString(),
306361
KeyType.MANAGED
307362
)
@@ -326,6 +381,32 @@ class CryptoRewrapBusProcessorTests {
326381
UUID.randomUUID().toString(),
327382
"",
328383
null,
384+
null,
385+
UUID.randomUUID().toString(),
386+
KeyType.MANAGED
387+
)
388+
)
389+
)
390+
).isEmpty()
391+
)
392+
393+
verify(cryptoService, never()).rewrapWrappingKey(any(), any(), any())
394+
verify(stateManager, never()).update(any())
395+
}
396+
397+
@Test
398+
fun `managed rewrap with master wrapping key set should be ignored`() {
399+
assertTrue(
400+
managedCryptoRewrapBusProcessor.onNext(
401+
listOf(
402+
Record(
403+
"TBC",
404+
UUID.randomUUID().toString(),
405+
IndividualKeyRotationRequest(
406+
UUID.randomUUID().toString(),
407+
tenantId,
408+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
409+
"alias1",
329410
UUID.randomUUID().toString(),
330411
KeyType.MANAGED
331412
)
@@ -349,6 +430,7 @@ class CryptoRewrapBusProcessorTests {
349430
IndividualKeyRotationRequest(
350431
UUID.randomUUID().toString(),
351432
tenantId,
433+
null,
352434
"alias1",
353435
UUID.randomUUID().toString(),
354436
KeyType.MANAGED
@@ -375,6 +457,7 @@ class CryptoRewrapBusProcessorTests {
375457
tenantId,
376458
null,
377459
null,
460+
null,
378461
KeyType.MANAGED
379462
)
380463
)
@@ -398,6 +481,7 @@ class CryptoRewrapBusProcessorTests {
398481
UUID.randomUUID().toString(),
399482
tenantId,
400483
null,
484+
null,
401485
"",
402486
KeyType.MANAGED
403487
)
@@ -422,6 +506,7 @@ class CryptoRewrapBusProcessorTests {
422506
UUID.randomUUID().toString(),
423507
tenantId,
424508
null,
509+
null,
425510
"invalid uuid",
426511
KeyType.MANAGED
427512
)
@@ -446,6 +531,7 @@ class CryptoRewrapBusProcessorTests {
446531
UUID.randomUUID().toString(),
447532
tenantId,
448533
null,
534+
null,
449535
uuid.toString(),
450536
KeyType.MANAGED
451537
)

‎gradle.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ commonsLangVersion = 3.12.0
3939
commonsTextVersion = 1.10.0
4040
# Corda API libs revision (change in 4th digit indicates a breaking change)
4141
# Change to 5.3.0.xx-SNAPSHOT to pick up maven local published copy
42-
cordaApiVersion=5.3.0.9-beta+
42+
cordaApiVersion=5.3.0.9-alpha-1713274170118
4343

4444
disruptorVersion=3.4.4
4545
felixConfigAdminVersion=1.9.26

‎processors/crypto-processor/src/main/kotlin/net/corda/processors/crypto/internal/CryptoProcessorImpl.kt

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -407,7 +407,6 @@ class CryptoProcessorImpl @Activate constructor(
407407
messagingConfig,
408408
stateManager,
409409
cordaAvroSerializationFactory,
410-
defaultUnmanagedWrappingKeyName,
411410
cryptoService
412411
)
413412
createSessionEncryptionSubscription(coordinator, retryingConfig, cryptoService)
@@ -468,14 +467,12 @@ class CryptoProcessorImpl @Activate constructor(
468467
messagingConfig: SmartConfig,
469468
stateManager: StateManager,
470469
cordaAvroSerializationFactory: CordaAvroSerializationFactory,
471-
defaultUnmanagedWrappingKeyName: String,
472470
cryptoService: CryptoService
473471
) {
474472
val rewrapProcessor = CryptoRewrapBusProcessor(
475473
cryptoService,
476474
stateManager,
477475
cordaAvroSerializationFactory,
478-
defaultUnmanagedWrappingKeyName,
479476
)
480477
val rewrapGroupName = "crypto.key.rotation.individual"
481478
coordinator.createManagedResource(REWRAP_SUBSCRIPTION) {

0 commit comments

Comments
 (0)