Skip to content

Commit 49fdb9e

Browse files
estespestesp
authored
Merge pull request #3430 from lumjjb/encgcfix
Made fixes and optimizations to encryption GC
2 parents e14cc99 + d531e78 commit 49fdb9e

4 files changed

Lines changed: 43 additions & 99 deletions

File tree

‎cmd/ctr/commands/images/crypt_utils.go‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,10 @@ import (
2424
"os"
2525
"strconv"
2626
"strings"
27-
"time"
2827

2928
"github.com/containerd/containerd"
3029
"github.com/containerd/containerd/images"
3130
imgenc "github.com/containerd/containerd/images/encryption"
32-
"github.com/containerd/containerd/leases"
3331
"github.com/containerd/containerd/pkg/encryption"
3432
encconfig "github.com/containerd/containerd/pkg/encryption/config"
3533
encutils "github.com/containerd/containerd/pkg/encryption/utils"
@@ -254,17 +252,16 @@ func cryptImage(client *containerd.Client, ctx gocontext.Context, name, newName
254252
newSpec ocispec.Descriptor
255253
)
256254

257-
ls := client.LeasesService()
258-
l, err := ls.Create(ctx, leases.WithRandomID(), leases.WithExpiration(5*time.Minute))
255+
ctx, done, err := client.WithLease(ctx)
259256
if err != nil {
260257
return images.Image{}, err
261258
}
262-
defer ls.Delete(ctx, l, leases.SynchronousDelete)
259+
defer done(ctx)
263260

264261
if encrypt {
265-
newSpec, modified, err = imgenc.EncryptImage(ctx, client.ContentStore(), ls, l, image.Target, cc, lf)
262+
newSpec, modified, err = imgenc.EncryptImage(ctx, client.ContentStore(), image.Target, cc, lf)
266263
} else {
267-
newSpec, modified, err = imgenc.DecryptImage(ctx, client.ContentStore(), ls, l, image.Target, cc, lf)
264+
newSpec, modified, err = imgenc.DecryptImage(ctx, client.ContentStore(), image.Target, cc, lf)
268265
}
269266
if err != nil {
270267
return image, err

‎docs/encryption.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,10 @@ The current draft of exposed interfaces we believe will be used by consumers are
7575
/* Functions */
7676
7777
// EncryptImage encrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
78-
func EncryptImage(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf *LayerFilter) (ocispec.Descriptor, bool, error)
78+
func EncryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf *LayerFilter) (ocispec.Descriptor, bool, error)
7979
8080
// DecryptImage decrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
81-
func DecryptImage(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf *LayerFilter) (ocispec.Descriptor, bool, error)
81+
func DecryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf *LayerFilter) (ocispec.Descriptor, bool, error)
8282
8383
// CheckAuthorization checks whether a user has the right keys to be allowed to access an image (every layer)
8484
// It takes decrypting of the layers only as far as decrypting the asymmetrically encrypted data

‎image_enc_test.go‎

Lines changed: 19 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -20,25 +20,23 @@ import (
2020
"context"
2121
"runtime"
2222
"testing"
23-
"time"
2423

2524
"github.com/containerd/containerd/content"
2625
"github.com/containerd/containerd/errdefs"
2726
"github.com/containerd/containerd/images"
2827
imgenc "github.com/containerd/containerd/images/encryption"
29-
"github.com/containerd/containerd/leases"
3028
encconfig "github.com/containerd/containerd/pkg/encryption/config"
3129
"github.com/containerd/containerd/pkg/encryption/utils"
3230
"github.com/containerd/containerd/platforms"
3331
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
3432
)
3533

36-
func setupBusyboxImage(t *testing.T) {
34+
func setupNginxImage(t *testing.T) {
3735
if runtime.GOOS == "windows" {
3836
t.Skip()
3937
}
4038

41-
const imageName = "docker.io/library/busybox:latest"
39+
const imageName = "docker.io/library/nginx:latest"
4240
ctx, cancel := testContext(t)
4341
defer cancel()
4442

@@ -67,15 +65,15 @@ func setupBusyboxImage(t *testing.T) {
6765
}
6866

6967
func TestImageEncryption(t *testing.T) {
70-
setupBusyboxImage(t)
68+
setupNginxImage(t)
7169

7270
publicKey, privateKey, err := utils.CreateRSATestKey(2048, nil, true)
7371
if err != nil {
7472
t.Fatal(err)
7573
}
7674

77-
const imageName = "docker.io/library/busybox:latest"
78-
const encImageName = "docker.io/library/busybox:enc"
75+
const imageName = "docker.io/library/nginx:latest"
76+
const encImageName = "docker.io/library/nginx:enc"
7977
ctx, cancel := testContext(t)
8078
defer cancel()
8179

@@ -86,7 +84,11 @@ func TestImageEncryption(t *testing.T) {
8684
defer client.Close()
8785

8886
s := client.ImageService()
89-
ls := client.LeasesService()
87+
ctx, done, err := client.WithLease(ctx)
88+
if err != nil {
89+
t.Fatal(err)
90+
}
91+
defer done(ctx)
9092

9193
image, err := s.Get(ctx, imageName)
9294
if err != nil {
@@ -136,14 +138,8 @@ func TestImageEncryption(t *testing.T) {
136138
},
137139
}
138140

139-
l, err := ls.Create(ctx, leases.WithRandomID(), leases.WithExpiration(5*time.Minute))
140-
if err != nil {
141-
t.Fatal("Unable to create lease for encryption")
142-
}
143-
defer ls.Delete(ctx, l, leases.SynchronousDelete)
144-
145141
// Perform encryption of image
146-
encSpec, modified, err := imgenc.EncryptImage(ctx, client.ContentStore(), ls, l, image.Target, cc, lf)
142+
encSpec, modified, err := imgenc.EncryptImage(ctx, client.ContentStore(), image.Target, cc, lf)
147143
if err != nil {
148144
t.Fatal(err)
149145
}
@@ -159,29 +155,26 @@ func TestImageEncryption(t *testing.T) {
159155
if _, err := s.Create(ctx, image); err != nil {
160156
t.Fatalf("Unable to create image: %v", err)
161157
}
162-
// Force deletion of lease early to check for proper referencing
163-
ls.Delete(ctx, l, leases.SynchronousDelete)
164158

165159
cc = &encconfig.CryptoConfig{
166160
DecryptConfig: &encconfig.DecryptConfig{
167161
Parameters: dcparameters,
168162
},
169163
}
164+
// Clean up function cancels lease before deleting the image so the images are
165+
// properly deleted
166+
defer func() {
167+
done(ctx)
168+
client.ImageService().Delete(ctx, imageName)
169+
client.ImageService().Delete(ctx, encImageName, images.SynchronousDelete())
170+
}()
170171

171172
// Perform decryption of image
172-
defer client.ImageService().Delete(ctx, imageName, images.SynchronousDelete())
173-
defer client.ImageService().Delete(ctx, encImageName, images.SynchronousDelete())
174173
lf = func(desc ocispec.Descriptor) bool {
175174
return true
176175
}
177176

178-
l, err = ls.Create(ctx, leases.WithRandomID(), leases.WithExpiration(5*time.Minute))
179-
if err != nil {
180-
t.Fatal("Unable to create lease for decryption")
181-
}
182-
defer ls.Delete(ctx, l, leases.SynchronousDelete)
183-
184-
decSpec, modified, err := imgenc.DecryptImage(ctx, client.ContentStore(), ls, l, encSpec, cc, lf)
177+
decSpec, modified, err := imgenc.DecryptImage(ctx, client.ContentStore(), encSpec, cc, lf)
185178
if err != nil {
186179
t.Fatal(err)
187180
}

‎images/encryption/encryption.go‎

Lines changed: 18 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ import (
3030

3131
"github.com/containerd/containerd/content"
3232
"github.com/containerd/containerd/errdefs"
33-
"github.com/containerd/containerd/leases"
3433
"github.com/containerd/containerd/platforms"
3534
digest "github.com/opencontainers/go-digest"
3635
specs "github.com/opencontainers/image-spec/specs-go"
@@ -149,7 +148,7 @@ func decryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc
149148
}
150149

151150
// cryptLayer handles the changes due to encryption or decryption of a layer
152-
func cryptLayer(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, cryptoOp cryptoOp) (ocispec.Descriptor, error) {
151+
func cryptLayer(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, cryptoOp cryptoOp) (ocispec.Descriptor, error) {
153152
var (
154153
resultReader io.Reader
155154
newDesc ocispec.Descriptor
@@ -171,33 +170,13 @@ func cryptLayer(ctx context.Context, cs content.Store, ls leases.Manager, l leas
171170
}
172171
// some operations, such as changing recipients, may not touch the layer at all
173172
if resultReader != nil {
174-
if ls == nil {
175-
return ocispec.Descriptor{}, errors.New("Unexpected write to object without lease")
176-
}
177-
178-
var rsrc leases.Resource
179173
var ref string
180-
181174
// If we have the digest, write blob with checks
182175
haveDigest := newDesc.Digest.String() != ""
183176
if haveDigest {
184177
ref = fmt.Sprintf("layer-%s", newDesc.Digest.String())
185-
rsrc = leases.Resource{
186-
ID: newDesc.Digest.String(),
187-
Type: "content",
188-
}
189178
} else {
190179
ref = fmt.Sprintf("blob-%d-%d", rand.Int(), rand.Int())
191-
rsrc = leases.Resource{
192-
ID: ref,
193-
Type: "ingests",
194-
}
195-
196-
}
197-
198-
// Add resource to lease and write blob
199-
if err := ls.AddResource(ctx, l, rsrc); err != nil {
200-
return ocispec.Descriptor{}, errors.Wrap(err, "Unable to add resource to lease")
201180
}
202181

203182
if haveDigest {
@@ -240,7 +219,7 @@ func ingestReader(ctx context.Context, cs content.Ingester, ref string, r io.Rea
240219
}
241220

242221
// Encrypt or decrypt all the Children of a given descriptor
243-
func cryptChildren(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp, thisPlatform *ocispec.Platform) (ocispec.Descriptor, bool, error) {
222+
func cryptChildren(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp, thisPlatform *ocispec.Platform) (ocispec.Descriptor, bool, error) {
244223
children, err := images.Children(ctx, cs, desc)
245224
if err != nil {
246225
if errdefs.IsNotFound(err) {
@@ -261,7 +240,7 @@ func cryptChildren(ctx context.Context, cs content.Store, ls leases.Manager, l l
261240
case images.MediaTypeDockerSchema2LayerGzip, images.MediaTypeDockerSchema2Layer,
262241
ocispec.MediaTypeImageLayerGzip, ocispec.MediaTypeImageLayer:
263242
if cryptoOp == cryptoOpEncrypt && lf(child) {
264-
nl, err := cryptLayer(ctx, cs, ls, l, child, cc, cryptoOp)
243+
nl, err := cryptLayer(ctx, cs, child, cc, cryptoOp)
265244
if err != nil {
266245
return ocispec.Descriptor{}, false, err
267246
}
@@ -273,7 +252,7 @@ func cryptChildren(ctx context.Context, cs content.Store, ls leases.Manager, l l
273252
case images.MediaTypeDockerSchema2LayerGzipEnc, images.MediaTypeDockerSchema2LayerEnc:
274253
// this one can be decrypted but also its recipients list changed
275254
if lf(child) {
276-
nl, err := cryptLayer(ctx, cs, ls, l, child, cc, cryptoOp)
255+
nl, err := cryptLayer(ctx, cs, child, cc, cryptoOp)
277256
if err != nil || cryptoOp == cryptoOpUnwrapOnly {
278257
return ocispec.Descriptor{}, false, err
279258
}
@@ -319,19 +298,6 @@ func cryptChildren(ctx context.Context, cs content.Store, ls leases.Manager, l l
319298

320299
ref := fmt.Sprintf("manifest-%s", newDesc.Digest.String())
321300

322-
if ls == nil {
323-
return ocispec.Descriptor{}, false, errors.New("Unexpected write to object without lease")
324-
}
325-
326-
rsrc := leases.Resource{
327-
ID: desc.Digest.String(),
328-
Type: "content",
329-
}
330-
331-
if err := ls.AddResource(ctx, l, rsrc); err != nil {
332-
return ocispec.Descriptor{}, false, errors.Wrap(err, "Unable to add resource to lease")
333-
}
334-
335301
if err := content.WriteBlob(ctx, cs, ref, bytes.NewReader(mb), newDesc, content.WithLabels(labels)); err != nil {
336302
return ocispec.Descriptor{}, false, errors.Wrap(err, "failed to write config")
337303
}
@@ -342,7 +308,7 @@ func cryptChildren(ctx context.Context, cs content.Store, ls leases.Manager, l l
342308
}
343309

344310
// cryptManifest encrypts or decrypts the children of a top level manifest
345-
func cryptManifest(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
311+
func cryptManifest(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
346312
p, err := content.ReadBlob(ctx, cs, desc)
347313
if err != nil {
348314
return ocispec.Descriptor{}, false, err
@@ -352,15 +318,15 @@ func cryptManifest(ctx context.Context, cs content.Store, ls leases.Manager, l l
352318
return ocispec.Descriptor{}, false, err
353319
}
354320
platform := platforms.DefaultSpec()
355-
newDesc, modified, err := cryptChildren(ctx, cs, ls, l, desc, cc, lf, cryptoOp, &platform)
321+
newDesc, modified, err := cryptChildren(ctx, cs, desc, cc, lf, cryptoOp, &platform)
356322
if err != nil || cryptoOp == cryptoOpUnwrapOnly {
357323
return ocispec.Descriptor{}, false, err
358324
}
359325
return newDesc, modified, nil
360326
}
361327

362328
// cryptManifestList encrypts or decrypts the children of a top level manifest list
363-
func cryptManifestList(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
329+
func cryptManifestList(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
364330
// read the index; if any layer is encrypted and any manifests change we will need to rewrite it
365331
b, err := content.ReadBlob(ctx, cs, desc)
366332
if err != nil {
@@ -375,7 +341,7 @@ func cryptManifestList(ctx context.Context, cs content.Store, ls leases.Manager,
375341
var newManifests []ocispec.Descriptor
376342
modified := false
377343
for _, manifest := range index.Manifests {
378-
newManifest, m, err := cryptChildren(ctx, cs, ls, l, manifest, cc, lf, cryptoOp, manifest.Platform)
344+
newManifest, m, err := cryptChildren(ctx, cs, manifest, cc, lf, cryptoOp, manifest.Platform)
379345
if err != nil || cryptoOp == cryptoOpUnwrapOnly {
380346
return ocispec.Descriptor{}, false, err
381347
}
@@ -410,19 +376,6 @@ func cryptManifestList(ctx context.Context, cs content.Store, ls leases.Manager,
410376

411377
ref := fmt.Sprintf("index-%s", newDesc.Digest.String())
412378

413-
if ls == nil {
414-
return ocispec.Descriptor{}, false, errors.New("Unexpected write to object without lease")
415-
}
416-
417-
rsrc := leases.Resource{
418-
ID: desc.Digest.String(),
419-
Type: "content",
420-
}
421-
422-
if err := ls.AddResource(ctx, l, rsrc); err != nil {
423-
return ocispec.Descriptor{}, false, errors.Wrap(err, "Unable to add resource to lease")
424-
}
425-
426379
if err = content.WriteBlob(ctx, cs, ref, bytes.NewReader(mb), newDesc, content.WithLabels(labels)); err != nil {
427380
return ocispec.Descriptor{}, false, errors.Wrap(err, "failed to write index")
428381
}
@@ -434,28 +387,28 @@ func cryptManifestList(ctx context.Context, cs content.Store, ls leases.Manager,
434387

435388
// cryptImage is the dispatcher to encrypt/decrypt an image; it accepts either an OCI descriptor
436389
// representing a manifest list or a single manifest
437-
func cryptImage(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
390+
func cryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
438391
if cc == nil {
439392
return ocispec.Descriptor{}, false, errors.Wrapf(errdefs.ErrInvalidArgument, "CryptoConfig must not be nil")
440393
}
441394
switch desc.MediaType {
442395
case ocispec.MediaTypeImageIndex, images.MediaTypeDockerSchema2ManifestList:
443-
return cryptManifestList(ctx, cs, ls, l, desc, cc, lf, cryptoOp)
396+
return cryptManifestList(ctx, cs, desc, cc, lf, cryptoOp)
444397
case ocispec.MediaTypeImageManifest, images.MediaTypeDockerSchema2Manifest:
445-
return cryptManifest(ctx, cs, ls, l, desc, cc, lf, cryptoOp)
398+
return cryptManifest(ctx, cs, desc, cc, lf, cryptoOp)
446399
default:
447400
return ocispec.Descriptor{}, false, errors.Errorf("CryptImage: Unhandled media type: %s", desc.MediaType)
448401
}
449402
}
450403

451404
// EncryptImage encrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
452-
func EncryptImage(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
453-
return cryptImage(ctx, cs, ls, l, desc, cc, lf, cryptoOpEncrypt)
405+
func EncryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
406+
return cryptImage(ctx, cs, desc, cc, lf, cryptoOpEncrypt)
454407
}
455408

456409
// DecryptImage decrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
457-
func DecryptImage(ctx context.Context, cs content.Store, ls leases.Manager, l leases.Lease, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
458-
return cryptImage(ctx, cs, ls, l, desc, cc, lf, cryptoOpDecrypt)
410+
func DecryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
411+
return cryptImage(ctx, cs, desc, cc, lf, cryptoOpDecrypt)
459412
}
460413

461414
// CheckAuthorization checks whether a user has the right keys to be allowed to access an image (every layer)
@@ -465,11 +418,12 @@ func CheckAuthorization(ctx context.Context, cs content.Store, desc ocispec.Desc
465418
cc := encconfig.CryptoConfig{
466419
DecryptConfig: dc,
467420
}
421+
468422
lf := func(desc ocispec.Descriptor) bool {
469423
return true
470424
}
471-
// We shouldn't need to create any objects in CheckAuthorization, so no lease required.
472-
_, _, err := cryptImage(ctx, cs, nil, leases.Lease{}, desc, &cc, lf, cryptoOpUnwrapOnly)
425+
426+
_, _, err := cryptImage(ctx, cs, desc, &cc, lf, cryptoOpUnwrapOnly)
473427
if err != nil {
474428
return errors.Wrapf(err, "you are not authorized to use this image")
475429
}

0 commit comments

Comments
 (0)