Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[EasyEncryption] Fixes some bugs in AwsPkcs11Encryptor #1345

Merged
merged 3 commits into from
Jan 28, 2024
Merged

[EasyEncryption] Fixes some bugs in AwsPkcs11Encryptor #1345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c87af89
[EasyEncryption] Fixes some bugs in `AwsPkcs11Encryptor`.
itorgov Jan 25, 2024
890cdeb
[EasyEncryption] Fixes some bugs in `AwsPkcs11Encryptor`.
itorgov Jan 25, 2024
ab00043
[EasyEncryption] Fixes some bugs in `AwsPkcs11Encryptor`.
itorgov Jan 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 31 additions & 29 deletions packages/EasyEncryption/src/AwsPkcs11Encryptor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,6 @@ protected function doEncrypt(
private function configureAwsCloudHsmSdk(): void
{
$filesystem = new Filesystem();
$cmd = [self::AWS_CLOUDHSM_CONFIGURE_TOOL];
$options = $this->awsCloudHsmSdkOptions ?? [];
$isSetHsmIpAddress = $this->isNonEmptyString($this->hsmIpAddress);
$isSetCloudHsmClusterId = $this->isNonEmptyString($this->cloudHsmClusterId);
$isSetServerClientCertFile = $this->isNonEmptyString($this->serverClientCertFile);
Expand All @@ -114,7 +112,6 @@ private function configureAwsCloudHsmSdk(): void
$this->hsmCaCert
));
}

if ($isSetHsmIpAddress === false && $isSetCloudHsmClusterId === false) {
throw new InvalidConfigurationException(
'At least HSM IP address or CloudHSM cluster id has to be set'
Expand All @@ -125,6 +122,11 @@ private function configureAwsCloudHsmSdk(): void
'Both HSM IP address and CloudHSM cluster id options cannot be set at the same time'
);
}
if ($isSetServerClientCertFile !== $isSetServerClientKeyFile) {
throw new InvalidConfigurationException('Both Server Client Cert and Key must be set at the same time');
}

$options = $this->awsCloudHsmSdkOptions ?? [];

if ($isSetHsmIpAddress) {
$options['-a'] = $this->hsmIpAddress;
Expand All @@ -136,33 +138,32 @@ private function configureAwsCloudHsmSdk(): void
$options['--hsm-ca-cert'] = $this->hsmCaCert;
$options['--region'] = $this->awsRegion;

if (($isSetServerClientCertFile && $isSetServerClientKeyFile === false)
|| ($isSetServerClientKeyFile && $isSetServerClientCertFile === false)) {
throw new InvalidConfigurationException('Both Server Client Cert and Key must be set at the same time');
}

$sslFiles = [
'--server-client-cert-file' => $this->serverClientCertFile,
'--server-client-key-file' => $this->serverClientKeyFile,
];

/** @var string $filename */
foreach ($sslFiles as $option => $filename) {
if ($filesystem->exists($filename) === false) {
throw new InvalidConfigurationException(\sprintf(
'Filename "%s" for option "%s" does not exist',
$filename,
$option
));
if ($isSetServerClientCertFile && $isSetServerClientKeyFile) {
$sslFiles = [
'--server-client-cert-file' => $this->serverClientCertFile,
'--server-client-key-file' => $this->serverClientKeyFile,
];

/** @var string $filename */
foreach ($sslFiles as $option => $filename) {
if ($filesystem->exists($filename) === false) {
throw new InvalidConfigurationException(\sprintf(
'Filename "%s" for option "%s" does not exist',
$filename,
$option
));
}

$options[$option] = $filename;
}

$options[$option] = $filename;
}

if ($this->disableKeyAvailabilityCheck) {
$options[] = '--disable-key-availability-check';
}

$cmd = [self::AWS_CLOUDHSM_CONFIGURE_TOOL];

foreach ($options as $option => $value) {
\is_string($option)
? \array_push($cmd, $option, $value)
Expand Down Expand Up @@ -204,7 +205,7 @@ private function findKey(?string $keyName = null): object
\Pkcs11\CKA_LABEL => $keyName,
]) ?? [];

if (\is_array($objects) || \count($objects) > 0) {
if (\is_array($objects) && \count($objects) > 0) {
return $this->keys[$keyName] = $objects[0];
}

Expand Down Expand Up @@ -235,18 +236,19 @@ private function init(): void

$this->module ??= new Module(self::AWS_CLOUDHSM_EXTENSION);

$this->session = $this->module->openSession($this->module->getSlotList()[0], \Pkcs11\CKF_RW_SESSION);
$this->session->login(\Pkcs11\CKU_USER, $this->userPin);
$session = $this->module->openSession($this->module->getSlotList()[0], \Pkcs11\CKF_RW_SESSION);
$session->login(\Pkcs11\CKU_USER, $this->userPin);

$this->session = $session;
}

private function isNonEmptyString(mixed $string): bool
{
return \is_string($string) && $string !== '';
}

private function validateKey(
EncryptionKey|EncryptionKeyPair|array|string|null $key = null,
): void {
private function validateKey(EncryptionKey|EncryptionKeyPair|array|string|null $key = null): void
{
if ($key !== null && $this->isNonEmptyString($key) === false) {
throw new InvalidEncryptionKeyException(\sprintf(
'Encryption key must be either null or string for %s',
Expand Down
1 change: 1 addition & 0 deletions packages/EasyEncryption/src/Interfaces/AwsPkcs11EncryptorInterface.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,5 @@

interface AwsPkcs11EncryptorInterface extends EncryptorInterface
{
public function reset(): void;
}
Loading