126 lines
3.5 KiB
Go
126 lines
3.5 KiB
Go
package models
|
|
|
|
import (
|
|
"crypto/aes"
|
|
"crypto/cipher"
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
)
|
|
|
|
type Secret struct {
|
|
SecretId int `db:"SecretId"`
|
|
RoleId int `db:"RoleId"`
|
|
DeviceName string `db:"DeviceName"`
|
|
DeviceCategory string `db:"DeviceCategory"`
|
|
UserName string `db:"UserName"`
|
|
Secret string `db:"Secret"`
|
|
}
|
|
|
|
func (s *Secret) SaveSecret() (*Secret, error) {
|
|
|
|
var err error
|
|
|
|
fmt.Printf("SaveSecret storing values '%v'\n", s)
|
|
result, err := db.NamedExec((`INSERT INTO secrets (RoleId, DeviceName, DeviceCategory, UserName, Secret) VALUES (:RoleId, :DeviceName, :DeviceCategory, :UserName, :Secret)`), s)
|
|
|
|
if err != nil {
|
|
fmt.Printf("StoreSecret error executing sql record : '%s'\n", err)
|
|
return &Secret{}, err
|
|
} else {
|
|
affected, _ := result.RowsAffected()
|
|
id, _ := result.LastInsertId()
|
|
fmt.Printf("StoreSecret insert returned result id '%d' affecting %d row(s).\n", id, affected)
|
|
}
|
|
|
|
return s, nil
|
|
}
|
|
|
|
func (s *Secret) EncryptSecret() (*Secret, error) {
|
|
|
|
keyString := os.Getenv("SECRETS_KEY")
|
|
// The key argument should be the AES key, either 16 or 32 bytes
|
|
// to select AES-128 or AES-256.
|
|
key := []byte(keyString)
|
|
//key := []byte("ECB518652A170880555136EA1F9752D6")
|
|
plaintext := []byte(s.Secret)
|
|
|
|
fmt.Printf("EncryptSecret applying key '%v' of length '%d' to plaintext secret '%s'\n", key, len(key), s.Secret)
|
|
|
|
block, err := aes.NewCipher(key)
|
|
if err != nil {
|
|
fmt.Printf("EncryptSecret NewCipher error '%s'\n", err)
|
|
return s, err
|
|
}
|
|
|
|
// Never use more than 2^32 random nonces with a given key because of the risk of a repeat.
|
|
nonce := make([]byte, 12)
|
|
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
|
fmt.Printf("EncryptSecret nonce generation error '%s'\n", err)
|
|
return s, err
|
|
}
|
|
fmt.Printf("EncryptSecret random nonce value is '%x'\n", nonce)
|
|
|
|
aesgcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
fmt.Printf("EncryptSecret NewGCM error '%s'\n", err)
|
|
return s, err
|
|
}
|
|
|
|
ciphertext := aesgcm.Seal(nil, nonce, plaintext, nil)
|
|
fmt.Printf("EncryptSecret generated ciphertext '%x''\n", ciphertext)
|
|
|
|
// Create a new slice to store nonce at the start and then the resulting ciphertext
|
|
// Nonce is always 12 bytes
|
|
combinedText := append(nonce, ciphertext...)
|
|
fmt.Printf("EncryptSecret combined secret value is now '%x'\n", combinedText)
|
|
|
|
// Store the value back into the struct ready for database operations
|
|
s.Secret = hex.EncodeToString(combinedText)
|
|
|
|
return s, nil
|
|
|
|
//return string(ciphertext[:]), nil
|
|
}
|
|
|
|
func (s *Secret) DecryptSecret() (*Secret, error) {
|
|
|
|
keyString := os.Getenv("SECRETS_KEY")
|
|
key := []byte(keyString)
|
|
// The key argument should be the AES key, either 16 or 32 bytes
|
|
// to select AES-128 or AES-256.
|
|
//key := []byte("ECB518652A170880555136EA1F9752D6")
|
|
|
|
crypted, _ := hex.DecodeString(s.Secret)
|
|
|
|
//nonce, _ := hex.DecodeString("64a9433eae7ccceee2fc0eda")
|
|
// The nonce is the first 12 bytes from the ciphertext
|
|
nonce := crypted[:12]
|
|
ciphertext := crypted[12:]
|
|
|
|
fmt.Printf("DecryptSecret applying key '%v' and nonce '%x' to ciphertext '%x'\n", key, nonce, ciphertext)
|
|
|
|
block, err := aes.NewCipher(key)
|
|
if err != nil {
|
|
fmt.Printf("DecryptSecret NewCipher error '%s'\n", err)
|
|
return s, err
|
|
}
|
|
|
|
aesgcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
fmt.Printf("DecryptSecret NewGCM error '%s'\n", err)
|
|
return s, err
|
|
}
|
|
|
|
plaintext, err := aesgcm.Open(nil, nonce, ciphertext, nil)
|
|
if err != nil {
|
|
fmt.Printf("DecryptSecret Open error '%s'\n", err)
|
|
return s, err
|
|
}
|
|
|
|
fmt.Printf("DecryptSecret plaintext is '%s'\n", plaintext)
|
|
return s, nil
|
|
}
|