From a7984632cd1fd4da1fb54b88707a294682ba26bd Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Mon, 19 Jun 2023 11:24:07 +0200 Subject: [PATCH] Polishing. See gh-661 Original pull request: gh-793 --- .../vault/core/VaultTransitTemplate.java | 302 +++++++++--------- .../vault/support/VaultTransitKey.java | 56 ++-- .../VaultTransitKeyCreationRequest.java | 7 + 3 files changed, 194 insertions(+), 171 deletions(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java index 812d3f72..d6873fc0 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java @@ -57,6 +57,7 @@ import java.util.Objects; * @author Luander Ribeiro * @author Mikko Koli * @author My-Lan Aragon + * @author Nanne Baars */ public class VaultTransitTemplate implements VaultTransitOperations { @@ -559,13 +560,19 @@ public class VaultTransitTemplate implements VaultTransitOperations { @Nullable private String name; - @JsonProperty("cipher_mode") - private String cipherMode = ""; - @JsonProperty("type") @Nullable private String type; + @JsonProperty("allow_plaintext_backup") + private boolean allowPlaintextBackup; + + @JsonProperty("cipher_mode") + private String cipherMode = ""; + + @JsonProperty("convergent_encryption_version") + private int convergentVersion; + @JsonProperty("deletion_allowed") private boolean deletionAllowed; @@ -584,30 +591,34 @@ public class VaultTransitTemplate implements VaultTransitOperations { @JsonProperty("min_encryption_version") private int minEncryptionVersion; + @JsonProperty("convergent_encryption") + private boolean supportsConvergentEncryption; + @JsonProperty("supports_decryption") private boolean supportsDecryption; - @JsonProperty("supports_encryption") - private boolean supportsEncryption; - @JsonProperty("supports_derivation") private boolean supportsDerivation; + @JsonProperty("supports_encryption") + private boolean supportsEncryption; + @JsonProperty("supports_signing") private boolean supportsSigning; - @JsonProperty("allow_plaintext_backup") - private boolean allowPlaintextBackup; - - @JsonProperty("convergent_encryption") - private boolean supportsConvergentEncryption; - - @JsonProperty("convergent_encryption_version") - private int convergentVersion; - public VaultTransitKeyImpl() { } + @Override + @Nullable + public String getName() { + return this.name; + } + + public void setName(@Nullable String name) { + this.name = name; + } + @Override public String getType() { @@ -618,11 +629,125 @@ public class VaultTransitTemplate implements VaultTransitOperations { return this.cipherMode; } + public void setType(@Nullable String type) { + this.type = type; + } + + @Override + public boolean allowPlaintextBackup() { + return isAllowPlaintextBackup(); + } + + public boolean isAllowPlaintextBackup() { + return this.allowPlaintextBackup; + } + + public String getCipherMode() { + return this.cipherMode; + } + + public void setCipherMode(String cipherMode) { + this.cipherMode = cipherMode; + } + + @Override + public int getConvergentVersion() { + return this.convergentVersion; + } + + @Override + public boolean isDeletionAllowed() { + return this.deletionAllowed; + } + + public void setDeletionAllowed(boolean deletionAllowed) { + this.deletionAllowed = deletionAllowed; + } + + @Override + public boolean isDerived() { + return this.derived; + } + + public void setDerived(boolean derived) { + this.derived = derived; + } + + @Override + public boolean isExportable() { + return this.exportable; + } + + public void setExportable(boolean exportable) { + this.exportable = exportable; + } + + @Override + public Map getKeys() { + return this.keys; + } + + public void setKeys(Map keys) { + this.keys = keys; + } + + @Override + public int getLatestVersion() { + return this.latestVersion; + } + + public void setLatestVersion(int latestVersion) { + this.latestVersion = latestVersion; + } + + @Override + public int getMinDecryptionVersion() { + return this.minDecryptionVersion; + } + + public void setMinDecryptionVersion(int minDecryptionVersion) { + this.minDecryptionVersion = minDecryptionVersion; + } + + public void setSupportsEncryption(boolean supportsEncryption) { + this.supportsEncryption = supportsEncryption; + } + + @Override + public int getMinEncryptionVersion() { + return this.minEncryptionVersion; + } + + public void setMinEncryptionVersion(int minEncryptionVersion) { + this.minEncryptionVersion = minEncryptionVersion; + } + + public boolean isSupportsConvergentEncryption() { + return this.supportsConvergentEncryption; + } + + @Override + public boolean supportsConvergentEncryption() { + return isSupportsConvergentEncryption(); + } + + public boolean isSupportsDecryption() { + return this.supportsDecryption; + } + @Override public boolean supportsDecryption() { return isSupportsDecryption(); } + public void setSupportsDecryption(boolean supportsDecryption) { + this.supportsDecryption = supportsDecryption; + } + + public boolean isSupportsEncryption() { + return this.supportsEncryption; + } + @Override public boolean supportsEncryption() { return isSupportsEncryption(); @@ -633,143 +758,27 @@ public class VaultTransitTemplate implements VaultTransitOperations { return isSupportsDerivation(); } - @Override - public boolean supportsSigning() { - return isSupportsSigning(); - } - - @Override - public boolean allowPlaintextBackup() { - return isAllowPlaintextBackup(); - } - - @Override - public boolean supportsConvergentEncryption() { - return isSupportsConvergentEncryption(); - } - - @Override - public int getConvergentVersion() { - return this.convergentVersion; - } - - @Nullable - public String getName() { - return this.name; - } - - public String getCipherMode() { - return this.cipherMode; - } - - public boolean isDeletionAllowed() { - return this.deletionAllowed; - } - - public boolean isDerived() { - return this.derived; - } - - public boolean isExportable() { - return this.exportable; - } - - public Map getKeys() { - return this.keys; - } - - public int getLatestVersion() { - return this.latestVersion; - } - - public int getMinDecryptionVersion() { - return this.minDecryptionVersion; - } - - public int getMinEncryptionVersion() { - return this.minEncryptionVersion; - } - - public boolean isAllowPlaintextBackup() { - return this.allowPlaintextBackup; - } - - public boolean isSupportsDecryption() { - return this.supportsDecryption; - } - - public boolean isSupportsEncryption() { - return this.supportsEncryption; - } - public boolean isSupportsDerivation() { return this.supportsDerivation; } - public boolean isSupportsSigning() { - return this.supportsSigning; - } - - public boolean isSupportsConvergentEncryption() { - return this.supportsConvergentEncryption; - } - - public void setName(@Nullable String name) { - this.name = name; - } - - public void setCipherMode(String cipherMode) { - this.cipherMode = cipherMode; - } - - public void setType(@Nullable String type) { - this.type = type; - } - - public void setDeletionAllowed(boolean deletionAllowed) { - this.deletionAllowed = deletionAllowed; - } - - public void setDerived(boolean derived) { - this.derived = derived; - } - - public void setExportable(boolean exportable) { - this.exportable = exportable; - } - - public void setKeys(Map keys) { - this.keys = keys; - } - - public void setLatestVersion(int latestVersion) { - this.latestVersion = latestVersion; - } - - public void setMinDecryptionVersion(int minDecryptionVersion) { - this.minDecryptionVersion = minDecryptionVersion; - } - - public void setMinEncryptionVersion(int minEncryptionVersion) { - this.minEncryptionVersion = minEncryptionVersion; - } - - public void setSupportsDecryption(boolean supportsDecryption) { - this.supportsDecryption = supportsDecryption; - } - - public void setSupportsEncryption(boolean supportsEncryption) { - this.supportsEncryption = supportsEncryption; - } - public void setSupportsDerivation(boolean supportsDerivation) { this.supportsDerivation = supportsDerivation; } + public boolean isSupportsSigning() { + return this.supportsSigning; + } + public void setSupportsSigning(boolean supportsSigning) { this.supportsSigning = supportsSigning; } + @Override + public boolean supportsSigning() { + return isSupportsSigning(); + } + @Override public boolean equals(Object o) { if (this == o) @@ -777,7 +786,8 @@ public class VaultTransitTemplate implements VaultTransitOperations { if (!(o instanceof VaultTransitKeyImpl)) return false; VaultTransitKeyImpl that = (VaultTransitKeyImpl) o; - return this.deletionAllowed == that.deletionAllowed && this.derived == that.derived + return this.allowPlaintextBackup == that.allowPlaintextBackup + && this.deletionAllowed == that.deletionAllowed && this.derived == that.derived && this.exportable == that.exportable && this.latestVersion == that.latestVersion && this.minDecryptionVersion == that.minDecryptionVersion && this.minEncryptionVersion == that.minEncryptionVersion @@ -786,17 +796,15 @@ public class VaultTransitTemplate implements VaultTransitOperations { && this.supportsDerivation == that.supportsDerivation && this.supportsSigning == that.supportsSigning && Objects.equals(this.name, that.name) && this.cipherMode.equals(that.cipherMode) && Objects.equals(this.type, that.type) - && this.allowPlaintextBackup == that.allowPlaintextBackup && this.supportsConvergentEncryption == that.supportsConvergentEncryption; } @Override public int hashCode() { - return Objects.hash(this.name, this.cipherMode, this.type, this.deletionAllowed, this.derived, - this.exportable, this.keys, this.latestVersion, this.minDecryptionVersion, + return Objects.hash(this.allowPlaintextBackup, this.name, this.cipherMode, this.type, this.deletionAllowed, + this.derived, this.exportable, this.keys, this.latestVersion, this.minDecryptionVersion, this.minEncryptionVersion, this.supportsDecryption, this.supportsEncryption, - this.supportsDerivation, this.supportsSigning, this.allowPlaintextBackup, - this.supportsConvergentEncryption); + this.supportsDerivation, this.supportsSigning, this.supportsConvergentEncryption); } } @@ -811,10 +819,12 @@ public class VaultTransitTemplate implements VaultTransitOperations { public RawTransitKeyImpl() { } + @Override public Map getKeys() { return this.keys; } + @Override @Nullable public String getName() { return this.name; diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java index ad0b9048..13dac4cd 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java @@ -22,6 +22,7 @@ import java.util.Map; * * @author Mark Paluch * @author Sven Schürmann + * @author Nanne Baars */ public interface VaultTransitKey { @@ -35,6 +36,22 @@ public interface VaultTransitKey { */ String getType(); + /** + * @return whether the key can be backed up in the plaintext format. Once set, this + * cannot be disabled. + * @since 3.0.3 + */ + boolean allowPlaintextBackup(); + + /** + * @return the version of the convergent nonce to use. Note: since version 3 the + * algorithm used in {@code transit} convergent encryption returns {@code -1} as the + * version is stored with the key. For backwards compatability this field might be + * useful. + * @since 3.0.3 + */ + int getConvergentVersion(); + /** * @return {@literal true} if deletion of the key is allowed. Key deletion must be * turned on to make keys deletable. @@ -72,47 +89,36 @@ public interface VaultTransitKey { */ int getMinEncryptionVersion(); + /** + * @return whether the key supports convergent encryption (i.e where the same + * plaintext creates the same ciphertext). Requires {@link #isDerived()} to be set to + * {@code true}. + * @since 3.0.3 + */ + boolean supportsConvergentEncryption(); + /** * @return whether the key supports decryption. * @since 1.1 */ boolean supportsDecryption(); - /** - * @return whether the key supports encryption. - * @since 1.1 - */ - boolean supportsEncryption(); - /** * @return whether the key supports derivation. * @since 1.1 */ boolean supportsDerivation(); + /** + * @return whether the key supports encryption. + * @since 1.1 + */ + boolean supportsEncryption(); + /** * @return whether the key supports signing. * @since 1.1 */ boolean supportsSigning(); - /** - * @return if set, enables taking backup of named key in the plaintext format. Once - * set, this cannot be disabled. - */ - boolean allowPlaintextBackup(); - - /** - * @return If enabled, the key will support convergent encryption, where the same - * plaintext creates the same ciphertext. This requires 'derived' to be set to true. - */ - boolean supportsConvergentEncryption(); - - /** - * @return the version of the convergent nonce to use. Note: since version 3 the - * algorithm used in `transit`'s convergent encryption returns -1 since the version is - * stored with the key. For backwards compatability this field might be interesting. - */ - int getConvergentVersion(); - } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java index ca275bba..2cb80df5 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java @@ -166,6 +166,13 @@ public class VaultTransitKeyCreationRequest { return this; } + /** + * Configure if the key supports plaintext backups. + * @param allowPlaintextBackup {@literal true} the key supports plaintext backups. + * Defaults to {@literal false}. + * @return {@code this} {@link VaultTransitKeyCreationRequestBuilder}. + * @since 3.0.3 + */ public VaultTransitKeyCreationRequestBuilder allowPlaintextBackup(boolean allowPlaintextBackup) { this.allowPlaintextBackup = allowPlaintextBackup;