Extract common server encryption logic (#65)

* refactor: extract common message encryption logic
* refactor: move letsencrypt logic to common
* refactor: rename common package to encryption
* test: add encryption tests

management/management_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	pb "github.com/golang/protobuf/proto" //nolint
 	log "github.com/sirupsen/logrus"
-	"github.com/wiretrustee/wiretrustee/signal"
+	"github.com/wiretrustee/wiretrustee/encryption"
 	"io"
 	"io/ioutil"
 	"math/rand"
@@ -94,7 +94,7 @@ var _ = Describe("Management service", func() {
 
 				messageBytes, err := pb.Marshal(&mgmtProto.SyncRequest{})
 				Expect(err).NotTo(HaveOccurred())
-				encryptedBytes, err := signal.Encrypt(messageBytes, serverPubKey, key)
+				encryptedBytes, err := encryption.Encrypt(messageBytes, serverPubKey, key)
 				Expect(err).NotTo(HaveOccurred())
 
 				sync, err := client.Sync(context.TODO(), &mgmtProto.EncryptedMessage{
@@ -106,7 +106,7 @@ var _ = Describe("Management service", func() {
 				encryptedResponse := &mgmtProto.EncryptedMessage{}
 				err = sync.RecvMsg(encryptedResponse)
 				Expect(err).NotTo(HaveOccurred())
-				decryptedBytes, err := signal.Decrypt(encryptedResponse.Body, serverPubKey, key)
+				decryptedBytes, err := encryption.Decrypt(encryptedResponse.Body, serverPubKey, key)
 				Expect(err).NotTo(HaveOccurred())
 
 				resp := &mgmtProto.SyncResponse{}
@@ -127,7 +127,7 @@ var _ = Describe("Management service", func() {
 
 				messageBytes, err := pb.Marshal(&mgmtProto.SyncRequest{})
 				Expect(err).NotTo(HaveOccurred())
-				encryptedBytes, err := signal.Encrypt(messageBytes, serverPubKey, key)
+				encryptedBytes, err := encryption.Encrypt(messageBytes, serverPubKey, key)
 				Expect(err).NotTo(HaveOccurred())
 
 				sync, err := client.Sync(context.TODO(), &mgmtProto.EncryptedMessage{
@@ -140,7 +140,7 @@ var _ = Describe("Management service", func() {
 				encryptedResponse := &mgmtProto.EncryptedMessage{}
 				err = sync.RecvMsg(encryptedResponse)
 				Expect(err).NotTo(HaveOccurred())
-				decryptedBytes, err := signal.Decrypt(encryptedResponse.Body, serverPubKey, key)
+				decryptedBytes, err := encryption.Decrypt(encryptedResponse.Body, serverPubKey, key)
 				Expect(err).NotTo(HaveOccurred())
 				resp := &mgmtProto.SyncResponse{}
 				err = pb.Unmarshal(decryptedBytes, resp)
@@ -153,7 +153,7 @@ var _ = Describe("Management service", func() {
 				go func() {
 					err = sync.RecvMsg(encryptedResponse)
 
-					decryptedBytes, err = signal.Decrypt(encryptedResponse.Body, serverPubKey, key)
+					decryptedBytes, err = encryption.Decrypt(encryptedResponse.Body, serverPubKey, key)
 					Expect(err).NotTo(HaveOccurred())
 					resp = &mgmtProto.SyncResponse{}
 					err = pb.Unmarshal(decryptedBytes, resp)
@@ -240,7 +240,7 @@ var _ = Describe("Management service", func() {
 				for _, peer := range peers {
 					messageBytes, err := pb.Marshal(&mgmtProto.SyncRequest{})
 					Expect(err).NotTo(HaveOccurred())
-					encryptedBytes, err := signal.Encrypt(messageBytes, serverPubKey, peer)
+					encryptedBytes, err := encryption.Encrypt(messageBytes, serverPubKey, peer)
 					Expect(err).NotTo(HaveOccurred())
 
 					// receive stream
@@ -261,7 +261,7 @@ var _ = Describe("Management service", func() {
 							} else if err != nil {
 								Expect(err).NotTo(HaveOccurred())
 							}
-							decryptedBytes, err := signal.Decrypt(encryptedResponse.Body, serverPubKey, peer)
+							decryptedBytes, err := encryption.Decrypt(encryptedResponse.Body, serverPubKey, peer)
 							Expect(err).NotTo(HaveOccurred())
 
 							resp := &mgmtProto.SyncResponse{}

management/message.go

@@ -1,44 +0,0 @@
-package management
-
-import (
-	pb "github.com/golang/protobuf/proto" //nolint
-	log "github.com/sirupsen/logrus"
-	"github.com/wiretrustee/wiretrustee/management/proto"
-	"github.com/wiretrustee/wiretrustee/signal"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-// EncryptMessage encrypts a body of the given pn.Message and wraps into proto.EncryptedMessage
-func EncryptMessage(peerKey wgtypes.Key, serverPrivateKey wgtypes.Key, message pb.Message) (*proto.EncryptedMessage, error) {
-	byteResp, err := pb.Marshal(message)
-	if err != nil {
-		log.Errorf("failed marshalling message %v", err)
-		return nil, err
-	}
-
-	encryptedBytes, err := signal.Encrypt(byteResp, peerKey, serverPrivateKey)
-	if err != nil {
-		log.Errorf("failed encrypting SyncResponse %v", err)
-		return nil, err
-	}
-
-	return &proto.EncryptedMessage{
-		WgPubKey: serverPrivateKey.PublicKey().String(),
-		Body:     encryptedBytes}, nil
-}
-
-//DecryptMessage decrypts an encrypted message (proto.EncryptedMessage)
-func DecryptMessage(peerKey wgtypes.Key, serverPrivateKey wgtypes.Key, encryptedMessage *proto.EncryptedMessage, message pb.Message) error {
-	decrypted, err := signal.Decrypt(encryptedMessage.Body, peerKey, serverPrivateKey)
-	if err != nil {
-		log.Warnf("error while decrypting Sync request message from peer %s", peerKey.String())
-		return err
-	}
-
-	err = pb.Unmarshal(decrypted, message)
-	if err != nil {
-		log.Warnf("error while umarshalling Sync request message from peer %s", peerKey.String())
-		return err
-	}
-	return nil
-}

management/server.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"github.com/golang/protobuf/ptypes/timestamp"
 	log "github.com/sirupsen/logrus"
+	"github.com/wiretrustee/wiretrustee/encryption"
 	"github.com/wiretrustee/wiretrustee/management/proto"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc/codes"
@@ -76,7 +77,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	}
 
 	syncReq := &proto.SyncRequest{}
-	err = DecryptMessage(peerKey, s.wgKey, req, syncReq)
+	err = encryption.DecryptMessage(peerKey, s.wgKey, req.Body, syncReq)
 	if err != nil {
 		return status.Errorf(codes.InvalidArgument, "invalid request message")
 	}
@@ -99,12 +100,15 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 			}
 			log.Debugf("recevied an update for peer %s", peerKey.String())
 
-			encryptedResp, err := EncryptMessage(peerKey, s.wgKey, update.Update)
+			encryptedResp, err := encryption.EncryptMessage(peerKey, s.wgKey, update.Update)
 			if err != nil {
 				return status.Errorf(codes.Internal, "failed processing update message")
 			}
 
-			err = srv.SendMsg(encryptedResp)
+			err = srv.SendMsg(&proto.EncryptedMessage{
+				WgPubKey: s.wgKey.PublicKey().String(),
+				Body:     encryptedResp,
+			})
 			if err != nil {
 				return status.Errorf(codes.Internal, "failed sending update message")
 			}
@@ -200,12 +204,15 @@ func (s *Server) sendInitialSync(peerKey wgtypes.Key, srv proto.ManagementServic
 		Peers: peers,
 	}
 
-	encryptedResp, err := EncryptMessage(peerKey, s.wgKey, plainResp)
+	encryptedResp, err := encryption.EncryptMessage(peerKey, s.wgKey, plainResp)
 	if err != nil {
 		return status.Errorf(codes.Internal, "error handling request")
 	}
 
-	err = srv.Send(encryptedResp)
+	err = srv.Send(&proto.EncryptedMessage{
+		WgPubKey: s.wgKey.PublicKey().String(),
+		Body:     encryptedResp,
+	})
 
 	if err != nil {
 		log.Errorf("failed sending SyncResponse %v", err)