encrypt ak/sk in config file

lib/command.go

@@ -127,7 +127,7 @@ func (cmd *Command) loadConfig(configFile string, cmder interface{}) error {
 }
 
 func (cmd *Command) needConfigFile() bool {
-	for _, name := range []string{OptionEndpoint, OptionAccessKeyID, OptionAccessKeySecret, OptionSTSToken} {
+	for _, name := range []string{OptionEndpoint, OptionAccessKeyID, OptionAccessKeySecret, OptionSTSToken, OptionAesKey} {
 		val, _ := GetString(name, cmd.options)
 		if val != "" {
 			return false

lib/command_test.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"encoding/base64"
 	"fmt"
 	"io/ioutil"
 	"log"
@@ -186,8 +187,13 @@ func (s *OssutilCommandSuite) SetUpPayerEnv(c *C) {
 	}`
 	s.putBucketPolicy(payerBucket, policy, c)
 
+	aesKey := AesKey
+	entAccessKeyID, _ := EncryptSecret(strings.TrimSpace(payerAccessKeyID), aesKey)
+	entAccessKeySecret, _ := EncryptSecret(strings.TrimSpace(payerAccessKeySecret), aesKey)
+	aesKeyBase64 := base64.StdEncoding.EncodeToString([]byte(AesKey))
+
 	//set payerConfigfile
-	data := fmt.Sprintf("[Credentials]\nlanguage=EN\nendpoint=%s\naccessKeyID=%s\naccessKeySecret=%s\n", payerBucketEndPoint, payerAccessKeyID, payerAccessKeySecret)
+	data := fmt.Sprintf("[Credentials]\nlanguage=EN\nendpoint=%s\naccessKeyID=%s\naccessKeySecret=%s\naesKey=%s\n", payerBucketEndPoint, entAccessKeyID, entAccessKeySecret, aesKeyBase64)
 	s.createFile(payerConfigFile, data, c)
 }
 
@@ -278,10 +284,13 @@ func (s *OssutilCommandSuite) AppendObject(bucketName string, object string, bod
 func (s *OssutilCommandSuite) configNonInteractive(c *C) {
 	command := "config"
 	var args []string
+	aesKey := AesKey
+
 	options := OptionMapType{
 		"endpoint":        &endpoint,
 		"accessKeyID":     &accessKeyID,
 		"accessKeySecret": &accessKeySecret,
+		"aesKey":          &aesKey,
 		"configFile":      &configFile,
 	}
 	showElapse, err := cm.RunCommand(command, args, options)
@@ -290,11 +299,12 @@ func (s *OssutilCommandSuite) configNonInteractive(c *C) {
 
 	opts, err := LoadConfig(configFile)
 	c.Assert(err, IsNil)
-	c.Assert(len(opts), Equals, 4)
+	c.Assert(len(opts), Equals, 5)
 	c.Assert(opts[OptionLanguage], Equals, DefaultLanguage)
 	c.Assert(opts[OptionEndpoint], Equals, endpoint)
 	c.Assert(opts[OptionAccessKeyID], Equals, accessKeyID)
 	c.Assert(opts[OptionAccessKeySecret], Equals, accessKeySecret)
+	c.Assert(opts[OptionAesKey], Equals, aesKey)
 }
 
 func (s *OssutilCommandSuite) createFile(fileName, content string, c *C) {
@@ -2796,8 +2806,13 @@ func (s *OssutilCommandSuite) TestFilterObjectFromChanWithPatterns(c *C) {
 func (s *OssutilCommandSuite) TestCommandLoglevel(c *C) {
 	cfile := "ossutil-config" + randLowStr(8)
 	level := "info"
-	data := "[Credentials]" + "\n" + "language=" + DefaultLanguage + "\n" + "accessKeyID=" + accessKeyID + "\n" + "accessKeySecret=" + accessKeySecret + "\n" + "endpoint=" +
-		endpoint + "\n" + "[Default]" + "\n" + "loglevel=" + level + "\n"
+	aesKey := AesKey
+	entAccessKeyID, _ := EncryptSecret(strings.TrimSpace(accessKeyID), aesKey)
+	entAccessKeySecret, _ := EncryptSecret(strings.TrimSpace(accessKeySecret), aesKey)
+	aesKeyBase64 := base64.StdEncoding.EncodeToString([]byte(AesKey))
+	data := "[Credentials]" + "\n" + "language=" + DefaultLanguage + "\n" + "accessKeyID=" + entAccessKeyID + "\n" + "accessKeySecret=" + entAccessKeySecret + "\n" + "endpoint=" +
+		endpoint + "\n" + "aesKey=" +
+		aesKeyBase64 + "\n" + "[Default]" + "\n" + "loglevel=" + level + "\n"
 	s.createFile(cfile, data, c)
 
 	f, err := os.Stat(cfile)

lib/config.go

@@ -2,6 +2,7 @@ package lib
 
 import (
 	"bufio"
+	"encoding/base64"
 	"fmt"
 	"os"
 	"runtime"
@@ -323,10 +324,13 @@ var configCommand = ConfigCommand{
 			OptionSTSToken,
 			OptionOutputDir,
 			OptionLanguage,
+			OptionAesKey,
 		},
 	},
 }
 
+var strArray = []string{OptionAccessKeyID, OptionAccessKeySecret, OptionSTSToken}
+
 // function for RewriteLoadConfiger interface
 func (cc *ConfigCommand) rewriteLoadConfig(configFile string) error {
 	// read config file, if error exist, do not print error
@@ -375,14 +379,17 @@ func (cc *ConfigCommand) RunCommand() error {
 	language, _ := GetString(OptionLanguage, cc.command.options)
 	delete(cc.command.options, OptionLanguage)
 
+	aesKey, _ := GetString(OptionAesKey, cc.command.options)
+	delete(cc.command.options, OptionAesKey)
+
 	// filter user input options
 	cc.filterNonInputOptions()
 
 	var err error
 	if len(cc.command.options) == 0 {
-		err = cc.runCommandInteractive(configFile, language)
+		err = cc.runCommandInteractive(configFile, language, aesKey)
 	} else {
-		err = cc.runCommandNonInteractive(configFile, language)
+		err = cc.runCommandNonInteractive(configFile, language, aesKey)
 	}
 	return err
 }
@@ -395,7 +402,7 @@ func (cc *ConfigCommand) filterNonInputOptions() {
 	}
 }
 
-func (cc *ConfigCommand) runCommandInteractive(configFile, language string) error {
+func (cc *ConfigCommand) runCommandInteractive(configFile, language, aesKey string) error {
 	llanguage := strings.ToLower(language)
 	if llanguage == LEnglishLanguage {
 		fmt.Println("The command creates a configuration file and stores credentials.")
@@ -419,27 +426,46 @@ func (cc *ConfigCommand) runCommandInteractive(configFile, language string) erro
 		}
 	}
 
+	if aesKey == "" {
+		if llanguage == LEnglishLanguage {
+			fmt.Printf("\nPlease enter the AES key of encrypt ak/sk:")
+		} else {
+			fmt.Printf("\n请输入加密ak/sk的公钥：")
+		}
+		if _, err := fmt.Scanln(&aesKey); err != nil {
+			if llanguage == LEnglishLanguage {
+				fmt.Println("No aes key entered, will use the default value " + AesKey + ".")
+			} else {
+				fmt.Println("未输入加密ak/sk的公钥，将使用默认值：" + AesKey + "。")
+			}
+		}
+	}
+
 	configFile = DecideConfigFile(configFile)
 	if llanguage == LEnglishLanguage {
 		fmt.Println("For the following settings, carriage return means skip the configuration. Please try \"help config\" to see the meaning of the settings")
 	} else {
 		fmt.Println("对于下述配置，回车将跳过相关配置项的设置，配置项的具体含义，请使用\"help config\"命令查看。")
 	}
 
-	if err := cc.configInteractive(configFile, language); err != nil {
+	if aesKey == "" {
+		aesKey = AesKey
+	}
+
+	if err := cc.configInteractive(configFile, language, aesKey); err != nil {
 		return err
 	}
 	return nil
 }
 
-func (cc *ConfigCommand) configInteractive(configFile, language string) error {
+func (cc *ConfigCommand) configInteractive(configFile, language, aesKey string) error {
 	var val string
 	config := configparser.NewConfiguration()
 	section := config.NewSection(CREDSection)
-
 	// if config file not exist, config Language
 	llanguage := strings.ToLower(language)
 	section.Add(OptionLanguage, language)
+	section.Add(OptionAesKey, base64.StdEncoding.EncodeToString([]byte(aesKey)))
 	if _, err := os.Stat(configFile); err != nil {
 		if llanguage == LEnglishLanguage {
 			fmt.Printf("Please enter language(%s, default is:%s, the configuration will go into effect after the command successfully executed):", OptionMap[OptionLanguage].minVal, DefaultLanguage)
@@ -483,7 +509,12 @@ func (cc *ConfigCommand) configInteractive(configFile, language string) error {
 		}
 
 		if len(val) > 0 {
-			section.Add(name, val)
+			if name == OptionAccessKeyID || name == OptionAccessKeySecret || name == OptionSTSToken {
+				encryptStr, _ := EncryptSecret(val, aesKey)
+				section.Add(name, encryptStr)
+			} else {
+				section.Add(name, val)
+			}
 		} else if OptionMap[name].def != "" {
 			section.Add(name, OptionMap[name].def)
 		}
@@ -495,14 +526,23 @@ func (cc *ConfigCommand) configInteractive(configFile, language string) error {
 	return nil
 }
 
-func (cc *ConfigCommand) runCommandNonInteractive(configFile, language string) error {
+func (cc *ConfigCommand) runCommandNonInteractive(configFile, language, aesKey string) error {
 	configFile = DecideConfigFile(configFile)
 	config := configparser.NewConfiguration()
 	section := config.NewSection(CREDSection)
 	section.Add(OptionLanguage, language)
+	if aesKey == "" {
+		aesKey = AesKey
+	}
+	section.Add(OptionAesKey, base64.StdEncoding.EncodeToString([]byte(aesKey)))
 	for name := range CredOptionMap {
 		if val, _ := GetString(name, cc.command.options); val != "" {
-			section.Add(name, val)
+			if name == OptionAccessKeyID || name == OptionAccessKeySecret || name == OptionSTSToken {
+				encryptStr, _ := EncryptSecret(strings.TrimSpace(val), aesKey)
+				section.Add(name, encryptStr)
+			} else {
+				section.Add(name, val)
+			}
 		}
 	}
 	if err := configparser.Save(config, configFile); err != nil {

lib/config_helper.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"encoding/base64"
 	"fmt"
 	"os"
 	"strconv"
@@ -56,6 +57,7 @@ var CredOptionList = []string{
 // name, allow to show in screen
 var CredOptionMap = map[string]configOption{
 	OptionLanguage:        configOption{[]string{"language", "Language"}, false, true, "", ""},
+	OptionAesKey:          configOption{[]string{"aesKey", "aeskey", "aes-key", "aes_key"}, false, true, "", ""},
 	OptionEndpoint:        configOption{[]string{"endpoint", "host"}, true, true, "", ""},
 	OptionAccessKeyID:     configOption{[]string{"accessKeyID", "accessKeyId", "AccessKeyID", "AccessKeyId", "access_key_id", "access_id", "accessid", "access-key-id", "access-id"}, true, false, "", ""},
 	OptionAccessKeySecret: configOption{[]string{"accessKeySecret", "AccessKeySecret", "access_key_secret", "access_key", "accesskey", "access-key-secret", "access-key"}, true, false, "", ""},
@@ -114,6 +116,10 @@ func LoadConfig(configFile string) (OptionMapType, error) {
 func readConfigFromFile(configFile string) (OptionMapType, error) {
 	configFile = DecideConfigFile(configFile)
 
+	aesKeyBase64, _ := readOptionValueFromFile(configFile, OptionAesKey)
+	aesKeyByte, _ := base64.StdEncoding.DecodeString(aesKeyBase64)
+	aesKey := string(aesKeyByte)
+
 	config, err := configparser.Read(configFile)
 	if err != nil {
 		return nil, err
@@ -142,10 +148,21 @@ func readConfigFromFile(configFile string) (OptionMapType, error) {
 
 	//added
 	//configMap[CREDSection] = map[string]string{}
-
 	for name, option := range credOptions {
 		if opName, ok := getOptionNameByStr(strings.TrimSpace(name)); ok {
-			configMap[strings.TrimSpace(opName)] = strings.TrimSpace(option)
+			if opName == OptionAccessKeyID || opName == OptionAccessKeySecret || opName == OptionSTSToken {
+				if aesKey == "" {
+					return nil, fmt.Errorf("aesKey is empty")
+				}
+				decryptStr, _ := DecryptSecret(strings.TrimSpace(option), aesKey)
+				configMap[strings.TrimSpace(opName)] = decryptStr
+			} else {
+				if opName == OptionAesKey {
+					configMap[OptionAesKey] = aesKey
+				} else {
+					configMap[strings.TrimSpace(opName)] = strings.TrimSpace(option)
+				}
+			}
 		} else {
 			configMap[strings.TrimSpace(name)] = strings.TrimSpace(option)
 		}
@@ -199,6 +216,30 @@ func readLoglevelFromFile(configFile string) (string, error) {
 	return "", nil
 }
 
+// get option val from config file
+func readOptionValueFromFile(configFile, optionName string) (string, error) {
+	configFile = DecideConfigFile(configFile)
+	config, err := configparser.Read(configFile)
+	if err != nil {
+		return "", err
+	}
+	sectionNameList := []string{CREDSection, DefaultSection}
+	logConfig := CredOptionMap[optionName]
+	for _, sectionName := range sectionNameList {
+		section, err := config.Section(sectionName)
+		if err != nil {
+			continue
+		}
+		for _, name := range logConfig.showNames {
+			val := section.ValueOf(name)
+			if val != "" {
+				return val, nil
+			}
+		}
+	}
+	return "", nil
+}
+
 func getOptionNameByStr(name string) (string, bool) {
 	for optionName, option := range CredOptionMap {
 		for _, val := range option.showNames {