|
3 | 3 |
|
4 | 4 | using System; |
5 | 5 | using System.Collections.Generic; |
| 6 | +using System.Xml.Linq; |
6 | 7 | using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption; |
7 | 8 | using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel; |
| 9 | +using Microsoft.AspNetCore.DataProtection.KeyManagement.Internal; |
| 10 | +using Microsoft.AspNetCore.DataProtection.XmlEncryption; |
8 | 11 |
|
9 | 12 | namespace Microsoft.AspNetCore.DataProtection.KeyManagement; |
10 | 13 |
|
11 | 14 | /// <summary> |
12 | | -/// The basic implementation of <see cref="IKey"/>, where the <see cref="IAuthenticatedEncryptorDescriptor"/> |
13 | | -/// has already been created. |
| 15 | +/// The basic implementation of <see cref="IKey"/>. |
14 | 16 | /// </summary> |
15 | | -internal sealed class Key : KeyBase |
| 17 | +internal sealed class Key : IKey |
16 | 18 | { |
| 19 | + private readonly Lazy<IAuthenticatedEncryptorDescriptor> _lazyDescriptor; |
| 20 | + private readonly IEnumerable<IAuthenticatedEncryptorFactory> _encryptorFactories; |
| 21 | + |
| 22 | + private IAuthenticatedEncryptor? _encryptor; |
| 23 | + |
| 24 | + /// <summary> |
| 25 | + /// The basic implementation of <see cref="IKey"/>, where the <see cref="IAuthenticatedEncryptorDescriptor"/> |
| 26 | + /// has already been created. |
| 27 | + /// </summary> |
17 | 28 | public Key( |
18 | 29 | Guid keyId, |
19 | 30 | DateTimeOffset creationDate, |
20 | 31 | DateTimeOffset activationDate, |
21 | 32 | DateTimeOffset expirationDate, |
22 | 33 | IAuthenticatedEncryptorDescriptor descriptor, |
23 | 34 | IEnumerable<IAuthenticatedEncryptorFactory> encryptorFactories) |
24 | | - : base(keyId, |
| 35 | + : this(keyId, |
25 | 36 | creationDate, |
26 | 37 | activationDate, |
27 | 38 | expirationDate, |
28 | 39 | new Lazy<IAuthenticatedEncryptorDescriptor>(() => descriptor), |
29 | 40 | encryptorFactories) |
30 | 41 | { |
31 | 42 | } |
| 43 | + |
| 44 | + /// <summary> |
| 45 | + /// The basic implementation of <see cref="IKey"/>, where the incoming XML element |
| 46 | + /// hasn't yet been fully processed. |
| 47 | + /// </summary> |
| 48 | + public Key( |
| 49 | + Guid keyId, |
| 50 | + DateTimeOffset creationDate, |
| 51 | + DateTimeOffset activationDate, |
| 52 | + DateTimeOffset expirationDate, |
| 53 | + IInternalXmlKeyManager keyManager, |
| 54 | + XElement keyElement, |
| 55 | + IEnumerable<IAuthenticatedEncryptorFactory> encryptorFactories) |
| 56 | + : this(keyId, |
| 57 | + creationDate, |
| 58 | + activationDate, |
| 59 | + expirationDate, |
| 60 | + new Lazy<IAuthenticatedEncryptorDescriptor>(GetLazyDescriptorDelegate(keyManager, keyElement)), |
| 61 | + encryptorFactories) |
| 62 | + { |
| 63 | + } |
| 64 | + |
| 65 | + private Key( |
| 66 | + Guid keyId, |
| 67 | + DateTimeOffset creationDate, |
| 68 | + DateTimeOffset activationDate, |
| 69 | + DateTimeOffset expirationDate, |
| 70 | + Lazy<IAuthenticatedEncryptorDescriptor> lazyDescriptor, |
| 71 | + IEnumerable<IAuthenticatedEncryptorFactory> encryptorFactories) |
| 72 | + { |
| 73 | + KeyId = keyId; |
| 74 | + CreationDate = creationDate; |
| 75 | + ActivationDate = activationDate; |
| 76 | + ExpirationDate = expirationDate; |
| 77 | + _lazyDescriptor = lazyDescriptor; |
| 78 | + _encryptorFactories = encryptorFactories; |
| 79 | + } |
| 80 | + |
| 81 | + public DateTimeOffset ActivationDate { get; } |
| 82 | + |
| 83 | + public DateTimeOffset CreationDate { get; } |
| 84 | + |
| 85 | + public DateTimeOffset ExpirationDate { get; } |
| 86 | + |
| 87 | + public bool IsRevoked { get; private set; } |
| 88 | + |
| 89 | + public Guid KeyId { get; } |
| 90 | + |
| 91 | + public IAuthenticatedEncryptorDescriptor Descriptor |
| 92 | + { |
| 93 | + get |
| 94 | + { |
| 95 | + return _lazyDescriptor.Value; |
| 96 | + } |
| 97 | + } |
| 98 | + |
| 99 | + public IAuthenticatedEncryptor? CreateEncryptor() |
| 100 | + { |
| 101 | + if (_encryptor == null) |
| 102 | + { |
| 103 | + foreach (var factory in _encryptorFactories) |
| 104 | + { |
| 105 | + var encryptor = factory.CreateEncryptorInstance(this); |
| 106 | + if (encryptor != null) |
| 107 | + { |
| 108 | + _encryptor = encryptor; |
| 109 | + break; |
| 110 | + } |
| 111 | + } |
| 112 | + } |
| 113 | + |
| 114 | + return _encryptor; |
| 115 | + } |
| 116 | + |
| 117 | + internal void SetRevoked() |
| 118 | + { |
| 119 | + IsRevoked = true; |
| 120 | + } |
| 121 | + |
| 122 | + internal Key Clone() |
| 123 | + { |
| 124 | + return new Key( |
| 125 | + keyId: KeyId, |
| 126 | + creationDate: CreationDate, |
| 127 | + activationDate: ActivationDate, |
| 128 | + expirationDate: ExpirationDate, |
| 129 | + lazyDescriptor: _lazyDescriptor, |
| 130 | + encryptorFactories: _encryptorFactories) |
| 131 | + { |
| 132 | + IsRevoked = IsRevoked, |
| 133 | + }; |
| 134 | + } |
| 135 | + |
| 136 | + private static Func<IAuthenticatedEncryptorDescriptor> GetLazyDescriptorDelegate(IInternalXmlKeyManager keyManager, XElement keyElement) |
| 137 | + { |
| 138 | + // The <key> element will be held around in memory for a potentially lengthy period |
| 139 | + // of time. Since it might contain sensitive information, we should protect it. |
| 140 | + var encryptedKeyElement = keyElement.ToSecret(); |
| 141 | + |
| 142 | + try |
| 143 | + { |
| 144 | + return GetLazyDescriptorDelegate; |
| 145 | + } |
| 146 | + finally |
| 147 | + { |
| 148 | + // It's important that the lambda above doesn't capture 'descriptorElement'. Clearing the reference here |
| 149 | + // helps us detect if we've done this by causing a null ref at runtime. |
| 150 | + keyElement = null!; |
| 151 | + } |
| 152 | + |
| 153 | + IAuthenticatedEncryptorDescriptor GetLazyDescriptorDelegate() |
| 154 | + { |
| 155 | + return keyManager.DeserializeDescriptorFromKeyElement(encryptedKeyElement.ToXElement()); |
| 156 | + } |
| 157 | + } |
32 | 158 | } |
0 commit comments