mirrors/redoctober
1
0
Fork 0
mirror of https://github.com/cloudflare/redoctober.git synced 2026-01-08 15:21:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix "invalid key size 0" when decrypting after a delegation expires

Browse Source 
The keycache does not remove active delegations when uses drops to zero;
rather it only removes these when Refresh is called.

So Valid returns true even if the user's delegation has expired,
so fullMatch is not set to false in unwrapKey,
so DecryptKey fails since the keycache refreshes and finds the delegation has expired,
so tmpKeyValue is left empty and decryptErr is set.

Since decryptErr is only used to break out of the inner loop, and
fullMatch wasn't set to false, no error is returned from unwrapKey.
So aesKey in DecryptKey is an empty string, causing an error when
passed to aes.NewCipher.

This commit actively removes a delegation from the keycache when it
is used for the last time, and properly handles errors thrown by
DecryptKey in unwrapKey.
This commit is contained in:
Andrew Buss
2015-12-04 01:30:18 -08:00
parent d89bb05295
commit 24fc3bb7d8
3 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
keycache/keycache.go
View File

@@ -133,7 +133,11 @@ func (cache *Cache) MatchUser(name, user string, labels []string) (ActiveUser, s
func (cache *Cache) useKey(name, user, slot string, labels []string) {
if val, slot, present := cache.MatchUser(name, user, labels); present {
val.Usage.Uses -= 1
cache.setUser(val, name, slot)
if val.Usage.Uses <= 0 {
delete(cache.UserKeys, DelegateIndex{name, slot})
} else {
cache.setUser(val, name, slot)
}
}
}
@@ -160,7 +164,7 @@ func (cache *Cache) FlushCache() {
// Refresh purges all expired or used up keys.
func (cache *Cache) Refresh() {
for d, active := range cache.UserKeys {
if active.Usage.Expiry.Before(time.Now()) || active.Usage.Uses <= 0 {
if active.Usage.Expiry.Before(time.Now()) {
log.Println("Record expired", d.Name, d.Slot, active.Usage.Users, active.Usage.Labels, active.Usage.Expiry)
delete(cache.UserKeys, d)
}