Skip to content

Commit e1f86b5

Browse files
anienanien
authored
CORE-20093: Use one crypto worker to read default master wrapping key tag (#6029)
Retrieve default master wrapping key alias only in rekey bus processor. Use IndividualKeyRotationRequest kafka message to pass the default master wrapping key alias to rewrap bus processor. When retrieving the status of key rotation, show the default master wrapping key alias instead of the hardcoded 'master' value. API PR: #1607
1 parent 4b9dc6a commit e1f86b5

File tree

7 files changed

+111
-13
lines changed

7 files changed

+111
-13
lines changed

‎components/crypto/crypto-rest/src/main/kotlin/net/corda/crypto/rest/impl/KeyRotationRestResourceImpl.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ class KeyRotationRestResourceImpl @Activate constructor(
221221
val deserializedValueOfOneRecord =
222222
checkNotNull(unmanagedKeyStatusDeserializer.deserialize(records.first().value))
223223
return KeyRotationStatusResponse(
224-
MASTER_WRAPPING_KEY_ROTATION_IDENTIFIER,
224+
records.first().metadata[KeyRotationMetadataValues.DEFAULT_MASTER_KEY_ALIAS].toString(),
225225
rotationStatus,
226226
deserializedValueOfOneRecord.createdTimestamp,
227227
getLatestTimestamp(records),

‎components/crypto/crypto-rest/src/test/kotlin/net/corda/crypto/rest/impl/KeyRotationRestResourceTest.kt

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import net.corda.configuration.read.ConfigChangedEvent
88
import net.corda.configuration.read.ConfigurationReadService
99
import net.corda.crypto.config.impl.CryptoHSMConfig
1010
import net.corda.crypto.config.impl.HSM
11+
import net.corda.crypto.core.KeyRotationMetadataValues
1112
import net.corda.crypto.core.KeyRotationStatus
1213
import net.corda.crypto.core.MASTER_WRAPPING_KEY_ROTATION_IDENTIFIER
1314
import net.corda.crypto.rest.KeyRotationRestResource
@@ -99,7 +100,12 @@ class KeyRotationRestResourceTest {
99100
"random",
100101
"random".toByteArray(),
101102
0,
102-
Metadata(mapOf("status" to "In Progress"))
103+
Metadata(
104+
mapOf(
105+
KeyRotationMetadataValues.STATUS to "In Progress",
106+
KeyRotationMetadataValues.DEFAULT_MASTER_KEY_ALIAS to MASTER_WRAPPING_KEY_ROTATION_IDENTIFIER
107+
)
108+
)
103109
)
104110
)
105111
}

‎components/crypto/crypto-service-impl/src/main/kotlin/net/corda/crypto/service/impl/bus/CryptoRekeyBusProcessor.kt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,7 @@ class CryptoRekeyBusProcessor(
297297
IndividualKeyRotationRequest(
298298
request.requestId,
299299
tenantId,
300+
defaultUnmanagedWrappingKeyName,
300301
alias,
301302
null, // keyUuid not used in unmanaged key rotation
302303
KeyType.UNMANAGED
@@ -319,6 +320,7 @@ class CryptoRekeyBusProcessor(
319320
request.requestId,
320321
request.tenantId,
321322
null,
323+
null,
322324
it.toString(),
323325
KeyType.MANAGED
324326
)

‎components/crypto/crypto-service-impl/src/main/kotlin/net/corda/crypto/service/impl/bus/CryptoRewrapBusProcessor.kt

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ class CryptoRewrapBusProcessor(
3131
val cryptoService: CryptoService,
3232
private val stateManager: StateManager,
3333
private val cordaAvroSerializationFactory: CordaAvroSerializationFactory,
34-
private val defaultUnmanagedWrappingKeyName: String,
3534
) : DurableProcessor<String, IndividualKeyRotationRequest> {
3635

3736
companion object {
@@ -74,6 +73,10 @@ class CryptoRewrapBusProcessor(
7473
logger.info("targetKeyAlias missing from unmanaged IndividualKeyRotationRequest, ignoring.")
7574
return
7675
}
76+
if (request.masterWrappingKeyAlias.isNullOrEmpty()) {
77+
logger.info("masterWrappingKeyAlias missing from unmanaged IndividualKeyRotationRequest, ignoring.")
78+
return
79+
}
7780
if (request.keyUuid != null) {
7881
logger.info("keyUuid provided for unmanaged IndividualKeyRotationRequest, ignoring.")
7982
return
@@ -83,7 +86,7 @@ class CryptoRewrapBusProcessor(
8386
cryptoService.rewrapWrappingKey(
8487
request.tenantId,
8588
request.targetKeyAlias,
86-
defaultUnmanagedWrappingKeyName
89+
request.masterWrappingKeyAlias,
8790
)
8891
}
8992

@@ -95,6 +98,10 @@ class CryptoRewrapBusProcessor(
9598
logger.info("targetKeyAlias provided for managed IndividualKeyRotationRequest, ignoring.")
9699
return
97100
}
101+
if (request.masterWrappingKeyAlias != null) {
102+
logger.info("masterWrappingKeyAlias provided for managed IndividualKeyRotationRequest, ignoring.")
103+
return
104+
}
98105
if (request.keyUuid.isNullOrEmpty()) {
99106
logger.info("keyUuid missing from managed IndividualKeyRotationRequest, ignoring.")
100107
return
@@ -183,14 +190,14 @@ class CryptoRewrapBusProcessor(
183190
stateManager.get(
184191
listOf(
185192
getKeyRotationStatusRecordKey(
186-
defaultUnmanagedWrappingKeyName,
193+
request.masterWrappingKeyAlias,
187194
request.tenantId
188195
)
189196
)
190197
)
191198
check(tenantIdWrappingKeysRecords.size == 1) {
192199
"Found none or more than 1 ${request.tenantId} record " +
193-
"in the database for new master wrapping key $defaultUnmanagedWrappingKeyName. " +
200+
"in the database for new master wrapping key ${request.masterWrappingKeyAlias}. " +
194201
"Found records $tenantIdWrappingKeysRecords."
195202
}
196203

‎components/crypto/crypto-service-impl/src/test/kotlin/net/corda/crypto/service/impl/bus/CryptoRewrapBusProcessorTests.kt

Lines changed: 89 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ class CryptoRewrapBusProcessorTests {
4848

4949
companion object {
5050
private val tenantId = UUID.randomUUID().toString()
51-
private const val OLD_PARENT_KEY_ALIAS = "alias1"
5251
private const val WRAPPING_KEY_ALIAS = "alias"
5352
private const val DEFAULT_MASTER_WRAP_KEY_ALIAS = "defaultKeyAlias"
5453
}
@@ -117,14 +116,12 @@ class CryptoRewrapBusProcessorTests {
117116
cryptoService,
118117
stateManager,
119118
unmanagedCordaAvroSerializationFactory,
120-
DEFAULT_MASTER_WRAP_KEY_ALIAS
121119
)
122120

123121
managedCryptoRewrapBusProcessor = CryptoRewrapBusProcessor(
124122
cryptoService,
125123
stateManager,
126124
managedCordaAvroSerializationFactory,
127-
DEFAULT_MASTER_WRAP_KEY_ALIAS
128125
)
129126
}
130127

@@ -138,6 +135,7 @@ class CryptoRewrapBusProcessorTests {
138135
IndividualKeyRotationRequest(
139136
UUID.randomUUID().toString(),
140137
tenantId,
138+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
141139
"alias1",
142140
null,
143141
KeyType.UNMANAGED
@@ -160,6 +158,7 @@ class CryptoRewrapBusProcessorTests {
160158
IndividualKeyRotationRequest(
161159
UUID.randomUUID().toString(),
162160
null,
161+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
163162
"alias1",
164163
null,
165164
KeyType.UNMANAGED
@@ -184,6 +183,57 @@ class CryptoRewrapBusProcessorTests {
184183
IndividualKeyRotationRequest(
185184
UUID.randomUUID().toString(),
186185
"",
186+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
187+
"alias1",
188+
null,
189+
KeyType.UNMANAGED
190+
)
191+
)
192+
)
193+
).isEmpty()
194+
)
195+
196+
verify(cryptoService, never()).rewrapWrappingKey(any(), any(), any())
197+
verify(stateManager, never()).update(any())
198+
}
199+
200+
@Test
201+
fun `unmanaged rewrap with null master wrapping key should be ignored`() {
202+
assertTrue(
203+
unmanagedCryptoRewrapBusProcessor.onNext(
204+
listOf(
205+
Record(
206+
"TBC",
207+
UUID.randomUUID().toString(),
208+
IndividualKeyRotationRequest(
209+
UUID.randomUUID().toString(),
210+
tenantId,
211+
null,
212+
"alias1",
213+
null,
214+
KeyType.UNMANAGED
215+
)
216+
)
217+
)
218+
).isEmpty()
219+
)
220+
221+
verify(cryptoService, never()).rewrapWrappingKey(any(), any(), any())
222+
verify(stateManager, never()).update(any())
223+
}
224+
225+
@Test
226+
fun `unmanaged rewrap with empty master wrapping key should be ignored`() {
227+
assertTrue(
228+
unmanagedCryptoRewrapBusProcessor.onNext(
229+
listOf(
230+
Record(
231+
"TBC",
232+
UUID.randomUUID().toString(),
233+
IndividualKeyRotationRequest(
234+
UUID.randomUUID().toString(),
235+
tenantId,
236+
"",
187237
"alias1",
188238
null,
189239
KeyType.UNMANAGED
@@ -208,6 +258,7 @@ class CryptoRewrapBusProcessorTests {
208258
IndividualKeyRotationRequest(
209259
UUID.randomUUID().toString(),
210260
tenantId,
261+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
211262
null,
212263
null,
213264
KeyType.UNMANAGED
@@ -232,6 +283,7 @@ class CryptoRewrapBusProcessorTests {
232283
IndividualKeyRotationRequest(
233284
UUID.randomUUID().toString(),
234285
tenantId,
286+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
235287
"",
236288
"",
237289
KeyType.UNMANAGED
@@ -256,6 +308,7 @@ class CryptoRewrapBusProcessorTests {
256308
IndividualKeyRotationRequest(
257309
UUID.randomUUID().toString(),
258310
tenantId,
311+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
259312
"alias1",
260313
UUID.randomUUID().toString(),
261314
KeyType.UNMANAGED
@@ -281,6 +334,7 @@ class CryptoRewrapBusProcessorTests {
281334
UUID.randomUUID().toString(),
282335
tenantId,
283336
null,
337+
null,
284338
uuid.toString(),
285339
KeyType.MANAGED
286340
)
@@ -302,6 +356,7 @@ class CryptoRewrapBusProcessorTests {
302356
UUID.randomUUID().toString(),
303357
null,
304358
null,
359+
null,
305360
UUID.randomUUID().toString(),
306361
KeyType.MANAGED
307362
)
@@ -326,6 +381,32 @@ class CryptoRewrapBusProcessorTests {
326381
UUID.randomUUID().toString(),
327382
"",
328383
null,
384+
null,
385+
UUID.randomUUID().toString(),
386+
KeyType.MANAGED
387+
)
388+
)
389+
)
390+
).isEmpty()
391+
)
392+
393+
verify(cryptoService, never()).rewrapWrappingKey(any(), any(), any())
394+
verify(stateManager, never()).update(any())
395+
}
396+
397+
@Test
398+
fun `managed rewrap with master wrapping key set should be ignored`() {
399+
assertTrue(
400+
managedCryptoRewrapBusProcessor.onNext(
401+
listOf(
402+
Record(
403+
"TBC",
404+
UUID.randomUUID().toString(),
405+
IndividualKeyRotationRequest(
406+
UUID.randomUUID().toString(),
407+
tenantId,
408+
DEFAULT_MASTER_WRAP_KEY_ALIAS,
409+
"alias1",
329410
UUID.randomUUID().toString(),
330411
KeyType.MANAGED
331412
)
@@ -349,6 +430,7 @@ class CryptoRewrapBusProcessorTests {
349430
IndividualKeyRotationRequest(
350431
UUID.randomUUID().toString(),
351432
tenantId,
433+
null,
352434
"alias1",
353435
UUID.randomUUID().toString(),
354436
KeyType.MANAGED
@@ -375,6 +457,7 @@ class CryptoRewrapBusProcessorTests {
375457
tenantId,
376458
null,
377459
null,
460+
null,
378461
KeyType.MANAGED
379462
)
380463
)
@@ -398,6 +481,7 @@ class CryptoRewrapBusProcessorTests {
398481
UUID.randomUUID().toString(),
399482
tenantId,
400483
null,
484+
null,
401485
"",
402486
KeyType.MANAGED
403487
)
@@ -422,6 +506,7 @@ class CryptoRewrapBusProcessorTests {
422506
UUID.randomUUID().toString(),
423507
tenantId,
424508
null,
509+
null,
425510
"invalid uuid",
426511
KeyType.MANAGED
427512
)
@@ -446,6 +531,7 @@ class CryptoRewrapBusProcessorTests {
446531
UUID.randomUUID().toString(),
447532
tenantId,
448533
null,
534+
null,
449535
uuid.toString(),
450536
KeyType.MANAGED
451537
)

‎gradle.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ commonsLangVersion = 3.12.0
3939
commonsTextVersion = 1.10.0
4040
# Corda API libs revision (change in 4th digit indicates a breaking change)
4141
# Change to 5.3.0.xx-SNAPSHOT to pick up maven local published copy
42-
cordaApiVersion=5.3.0.11-beta+
42+
cordaApiVersion=5.3.0.12-beta+
4343

4444
disruptorVersion=3.4.4
4545
felixConfigAdminVersion=1.9.26

‎processors/crypto-processor/src/main/kotlin/net/corda/processors/crypto/internal/CryptoProcessorImpl.kt

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -407,7 +407,6 @@ class CryptoProcessorImpl @Activate constructor(
407407
messagingConfig,
408408
stateManager,
409409
cordaAvroSerializationFactory,
410-
defaultUnmanagedWrappingKeyName,
411410
cryptoService
412411
)
413412
createSessionEncryptionSubscription(coordinator, retryingConfig, cryptoService)
@@ -468,14 +467,12 @@ class CryptoProcessorImpl @Activate constructor(
468467
messagingConfig: SmartConfig,
469468
stateManager: StateManager,
470469
cordaAvroSerializationFactory: CordaAvroSerializationFactory,
471-
defaultUnmanagedWrappingKeyName: String,
472470
cryptoService: CryptoService
473471
) {
474472
val rewrapProcessor = CryptoRewrapBusProcessor(
475473
cryptoService,
476474
stateManager,
477475
cordaAvroSerializationFactory,
478-
defaultUnmanagedWrappingKeyName,
479476
)
480477
val rewrapGroupName = "crypto.key.rotation.individual"
481478
coordinator.createManagedResource(REWRAP_SUBSCRIPTION) {

0 commit comments

Comments
 (0)