blob: 4cb166631940caeb329647fbe19621d7f050c9c7 [file] [log] [blame]
James E. Blairc49e5e72017-03-16 14:56:32 -07001#!/usr/bin/env python
2
3# Licensed under the Apache License, Version 2.0 (the "License"); you may
4# not use this file except in compliance with the License. You may obtain
5# a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
11# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
12# License for the specific language governing permissions and limitations
13# under the License.
14
15import argparse
Tobias Henkel39d6dcd2017-06-24 21:26:57 +020016import base64
James E. Blair9118c012017-08-03 11:19:16 -070017import math
James E. Blairc49e5e72017-03-16 14:56:32 -070018import os
James E. Blair9118c012017-08-03 11:19:16 -070019import re
James E. Blairc49e5e72017-03-16 14:56:32 -070020import subprocess
21import sys
22import tempfile
James E. Blair9118c012017-08-03 11:19:16 -070023import textwrap
Tobias Henkel39d6dcd2017-06-24 21:26:57 +020024
25# we to import Request and urlopen differently for python 2 and 3
26try:
27 from urllib.request import Request
28 from urllib.request import urlopen
29except ImportError:
30 from urllib2 import Request
31 from urllib2 import urlopen
James E. Blairc49e5e72017-03-16 14:56:32 -070032
33DESCRIPTION = """Encrypt a secret for Zuul.
34
35This program fetches a project-specific public key from a Zuul server and
36uses that to encrypt a secret. The only pre-requisite is an installed
37OpenSSL binary.
38"""
39
40
41def main():
42 parser = argparse.ArgumentParser(description=DESCRIPTION)
43 parser.add_argument('url',
44 help="The base URL of the zuul server and tenant. "
45 "E.g., https://zuul.example.com/tenant-name")
James E. Blairc49e5e72017-03-16 14:56:32 -070046 # TODO(jeblair): Throw a fit if SSL is not used.
James E. Blairc49e5e72017-03-16 14:56:32 -070047 parser.add_argument('project',
48 help="The name of the project.")
Clint Byrum04bcbe12017-12-30 06:20:39 -080049 parser.add_argument('--strip', action='store_true', default=False,
50 help="Strip whitespace from beginning/end of input.")
James E. Blairc49e5e72017-03-16 14:56:32 -070051 parser.add_argument('--infile',
52 default=None,
53 help="A filename whose contents will be encrypted. "
54 "If not supplied, the value will be read from "
55 "standard input.")
56 parser.add_argument('--outfile',
57 default=None,
58 help="A filename to which the encrypted value will be "
59 "written. If not supplied, the value will be written "
60 "to standard output.")
61 args = parser.parse_args()
62
Fabien Boucherbf331d42017-09-21 17:40:26 +020063 req = Request("%s/%s.pub" % (args.url.rstrip('/'), args.project))
Tobias Henkel39d6dcd2017-06-24 21:26:57 +020064 pubkey = urlopen(req)
James E. Blairc49e5e72017-03-16 14:56:32 -070065
66 if args.infile:
67 with open(args.infile) as f:
68 plaintext = f.read()
69 else:
70 plaintext = sys.stdin.read()
71
James E. Blair9118c012017-08-03 11:19:16 -070072 plaintext = plaintext.encode("utf-8")
Clint Byrum04bcbe12017-12-30 06:20:39 -080073 if args.strip:
74 plaintext = plaintext.strip()
James E. Blair9118c012017-08-03 11:19:16 -070075
James E. Blairc49e5e72017-03-16 14:56:32 -070076 pubkey_file = tempfile.NamedTemporaryFile(delete=False)
77 try:
78 pubkey_file.write(pubkey.read())
79 pubkey_file.close()
80
James E. Blair9118c012017-08-03 11:19:16 -070081 p = subprocess.Popen(['openssl', 'rsa', '-text',
82 '-pubin', '-in',
James E. Blairc49e5e72017-03-16 14:56:32 -070083 pubkey_file.name],
James E. Blairc49e5e72017-03-16 14:56:32 -070084 stdout=subprocess.PIPE)
James E. Blair9118c012017-08-03 11:19:16 -070085 (stdout, stderr) = p.communicate()
James E. Blairc49e5e72017-03-16 14:56:32 -070086 if p.returncode != 0:
87 raise Exception("Return code %s from openssl" % p.returncode)
James E. Blair9118c012017-08-03 11:19:16 -070088 output = stdout.decode('utf-8')
Clint Byrum2dc31dd2017-11-01 16:49:28 -070089 openssl_version = subprocess.check_output(
90 ['openssl', 'version']).split()[1]
91 if openssl_version.startswith(b'0.'):
92 m = re.match(r'^Modulus \((\d+) bit\):$', output, re.MULTILINE)
93 else:
94 m = re.match(r'^Public-Key: \((\d+) bit\)$', output, re.MULTILINE)
James E. Blair9118c012017-08-03 11:19:16 -070095 nbits = int(m.group(1))
96 nbytes = int(nbits / 8)
97 max_bytes = nbytes - 42 # PKCS1-OAEP overhead
98 chunks = int(math.ceil(float(len(plaintext)) / max_bytes))
99
100 ciphertext_chunks = []
101
102 print("Public key length: {} bits ({} bytes)".format(nbits, nbytes))
103 print("Max plaintext length per chunk: {} bytes".format(max_bytes))
104 print("Input plaintext length: {} bytes".format(len(plaintext)))
105 print("Number of chunks: {}".format(chunks))
106
107 for count in range(chunks):
108 chunk = plaintext[int(count * max_bytes):
109 int((count + 1) * max_bytes)]
110 p = subprocess.Popen(['openssl', 'rsautl', '-encrypt',
111 '-oaep', '-pubin', '-inkey',
112 pubkey_file.name],
113 stdin=subprocess.PIPE,
114 stdout=subprocess.PIPE)
115 (stdout, stderr) = p.communicate(chunk)
116 if p.returncode != 0:
117 raise Exception("Return code %s from openssl" % p.returncode)
118 ciphertext_chunks.append(base64.b64encode(stdout).decode('utf-8'))
119
James E. Blairc49e5e72017-03-16 14:56:32 -0700120 finally:
121 os.unlink(pubkey_file.name)
122
James E. Blair9118c012017-08-03 11:19:16 -0700123 output = textwrap.dedent(
124 '''
125 - secret:
126 name: <name>
127 data:
128 <fieldname>: !encrypted/pkcs1-oaep
129 ''')
130
131 twrap = textwrap.TextWrapper(width=79,
132 initial_indent=' ' * 8,
133 subsequent_indent=' ' * 10)
134 for chunk in ciphertext_chunks:
135 chunk = twrap.fill('- ' + chunk)
136 output += chunk + '\n'
137
James E. Blairc49e5e72017-03-16 14:56:32 -0700138 if args.outfile:
James E. Blair9118c012017-08-03 11:19:16 -0700139 with open(args.outfile, "w") as f:
140 f.write(output)
James E. Blairc49e5e72017-03-16 14:56:32 -0700141 else:
James E. Blair9118c012017-08-03 11:19:16 -0700142 print(output)
James E. Blairc49e5e72017-03-16 14:56:32 -0700143
144
145if __name__ == '__main__':
146 main()