Skip to content

Commit 37b9f7a

Browse files
committed
Support WEBSITE_AUTH_ENCRYPTION_KEY and fix SA warning
1 parent 0900746 commit 37b9f7a

17 files changed

+59
-33
lines changed

build.cmd

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
@ECHO Off
2-
3-
SET Config=%1
4-
IF "%1"=="" (
5-
SET Config="Release"
6-
)
7-
8-
msbuild WebJobs.Script.proj /p:Configuration=%Config%;SolutionDir=%~dp0 /flp:LogFile=msbuild.log;Verbosity=Normal
2+
REM call dotnet --version
3+
call dotnet restore WebJobs.Script.sln
4+
call dotnet build WebJobs.Script.sln
5+
REM call dotnet test WebJobs.Script.sln --no-build

src/WebJobs.Script.Scaling/AppServiceSettings.cs

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
using System;
55
using System.Diagnostics.CodeAnalysis;
6+
using System.Linq;
67
using Microsoft.Win32;
78

89
namespace Microsoft.Azure.WebJobs.Script.Scaling
@@ -259,19 +260,31 @@ public static byte[] RuntimeEncryptionKey
259260
{
260261
if (_runtimeEncryptionKey == null)
261262
{
262-
var value = Environment.GetEnvironmentVariable("WEBSITE_ENCRYPTION_KEY");
263+
var value = Environment.GetEnvironmentVariable("WEBSITE_AUTH_ENCRYPTION_KEY");
263264
if (string.IsNullOrEmpty(value))
264265
{
265-
throw new InvalidOperationException("MIssing WEBSITE_ENCRYPTION_KEY environment variable");
266+
throw new InvalidOperationException("Missing WEBSITE_AUTH_ENCRYPTION_KEY environment variable");
266267
}
267268

268269
try
269270
{
270-
_runtimeEncryptionKey = Convert.FromBase64String(value);
271+
// only support 32 bytes (256 bits) key length
272+
// either hex or base64 string format
273+
if (value.Length == 64)
274+
{
275+
_runtimeEncryptionKey = Enumerable.Range(0, value.Length)
276+
.Where(x => x % 2 == 0)
277+
.Select(x => Convert.ToByte(value.Substring(x, 2), 16))
278+
.ToArray();
279+
}
280+
else
281+
{
282+
_runtimeEncryptionKey = Convert.FromBase64String(value);
283+
}
271284
}
272285
catch (Exception ex)
273286
{
274-
throw new InvalidOperationException(string.Format("Invalid base64 WEBSITE_ENCRYPTION_KEY environment variable '{0}'.", value), ex);
287+
throw new InvalidOperationException(string.Format("Invalid base64 WEBSITE_AUTH_ENCRYPTION_KEY environment variable '{0}'.", value), ex);
275288
}
276289
}
277290

src/WebJobs.Script.Scaling/ScaleUtils.cs

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,24 +109,32 @@ public static string GetToken(DateTime expiredUtc)
109109
cs.FlushFinalBlock();
110110
}
111111

112-
return string.Format("{0}.{1}", iv, Convert.ToBase64String(ms.ToArray()));
112+
return string.Format("{0}.{1}.{2}", iv, Convert.ToBase64String(ms.ToArray()), GetSHA256Base64String(aes.Key));
113113
}
114114
}
115115
}
116116

117117
public static void ValidateToken(string token)
118118
{
119119
var parts = token.Split(new[] { '.' }, StringSplitOptions.RemoveEmptyEntries);
120-
if (parts.Length != 2)
120+
if (parts.Length != 2 && parts.Length != 3)
121121
{
122122
throw new ArgumentException("Malform encrypted data.");
123123
}
124124

125125
var iv = Convert.FromBase64String(parts[0]);
126126
var data = Convert.FromBase64String(parts[1]);
127+
var base64KeyHash = parts.Length == 3 ? parts[2] : null;
128+
129+
var encryptionKey = AppServiceSettings.RuntimeEncryptionKey;
130+
if (!string.IsNullOrEmpty(base64KeyHash) && !string.Equals(GetSHA256Base64String(encryptionKey), base64KeyHash))
131+
{
132+
throw new InvalidOperationException(string.Format("Key with hash {0} does not exist.", base64KeyHash));
133+
}
134+
127135
using (var aes = new AesManaged())
128136
{
129-
aes.Key = AppServiceSettings.RuntimeEncryptionKey;
137+
aes.Key = encryptionKey;
130138

131139
using (var decrypter = aes.CreateDecryptor(aes.Key, iv))
132140
using (var ms = new MemoryStream())
@@ -152,5 +160,13 @@ public static void ValidateToken(string token)
152160
}
153161
}
154162
}
163+
164+
private static string GetSHA256Base64String(byte[] key)
165+
{
166+
using (var sha256 = new SHA256Managed())
167+
{
168+
return Convert.ToBase64String(sha256.ComputeHash(key));
169+
}
170+
}
155171
}
156172
}

test/WebJobs.Script.Scaling.Tests/AppServiceScaleManagerTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ namespace Microsoft.Azure.WebJobs.Script.Scaling.Tests
1414
[Collection("Azure Test Collection")]
1515
public class AppServiceScaleManagerTests
1616
{
17-
[Theory, MemberData("SupportedData")]
17+
[Theory, MemberData(nameof(SupportedData))]
1818
public void SupportedTests(bool runtimeScaleEnabled, string storageConnectionString, string sku, bool expected)
1919
{
2020
AppServiceSettings.RuntimeScalingEnabled = runtimeScaleEnabled;

test/WebJobs.Script.Scaling.Tests/AppServiceWorkerTableTests.cs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ namespace Microsoft.Azure.WebJobs.Script.Scaling.Tests
1212
[Collection("Azure Test Collection")]
1313
public class AppServiceWorkerTableTests
1414
{
15-
[Theory, MemberData("TestStorageConnectionString")]
15+
[Theory, MemberData(nameof(TestStorageConnectionString))]
1616
public async Task CRUDTests(string storageConnectionString, string siteName)
1717
{
1818
if (string.IsNullOrEmpty(storageConnectionString))
@@ -81,7 +81,7 @@ public async Task CRUDTests(string storageConnectionString, string siteName)
8181
}
8282
}
8383

84-
[Theory, MemberData("TestStorageConnectionString")]
84+
[Theory, MemberData(nameof(TestStorageConnectionString))]
8585
public async Task GetSetManagerTests(string storageConnectionString, string siteName)
8686
{
8787
if (string.IsNullOrEmpty(storageConnectionString))
@@ -132,7 +132,7 @@ public async Task GetSetManagerTests(string storageConnectionString, string site
132132
}
133133
}
134134

135-
[Theory, MemberData("TestStorageConnectionString")]
135+
[Theory, MemberData(nameof(TestStorageConnectionString))]
136136
public async Task LeaseBasicTests(string storageConnectionString, string siteName)
137137
{
138138
if (string.IsNullOrEmpty(storageConnectionString))
@@ -173,7 +173,7 @@ public async Task LeaseBasicTests(string storageConnectionString, string siteNam
173173
}
174174
}
175175

176-
[Theory, MemberData("TestStorageConnectionString")]
176+
[Theory, MemberData(nameof(TestStorageConnectionString))]
177177
public async Task LeaseConflictTests(string storageConnectionString, string siteName)
178178
{
179179
if (string.IsNullOrEmpty(storageConnectionString))

test/WebJobs.Script.Scaling.Tests/EnsureManagerTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ namespace Microsoft.Azure.WebJobs.Script.Scaling.Tests
1111
{
1212
public class EnsureManagerTests
1313
{
14-
[Theory, MemberData("EnsureManagerData")]
14+
[Theory, MemberData(nameof(EnsureManagerData))]
1515
public async Task BasicTests(IWorkerInfo worker, IWorkerInfo current, IEnumerable<IWorkerInfo> workers, IWorkerInfo expected)
1616
{
1717
var activityId = Guid.NewGuid().ToString();

test/WebJobs.Script.Scaling.Tests/ProcessWorkItemTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ namespace Microsoft.Azure.WebJobs.Script.Scaling.Tests
1111
{
1212
public class ProcessWorkItemTests
1313
{
14-
[Theory, MemberData("BasicData")]
14+
[Theory, MemberData(nameof(BasicData))]
1515
public async Task BasicTests(IWorkerInfo worker, IWorkerInfo current)
1616
{
1717
var activityId = Guid.NewGuid().ToString();

test/WebJobs.Script.Scaling.Tests/RequestAddWorkerTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ namespace Microsoft.Azure.WebJobs.Script.Scaling.Tests
1212
{
1313
public class RequestAddWorkerTests
1414
{
15-
[Theory, MemberData("BasicData")]
15+
[Theory, MemberData(nameof(BasicData))]
1616
public async Task BasicTests(int maxWorkers, IEnumerable<IWorkerInfo> workers, IWorkerInfo manager, bool force, bool expected)
1717
{
1818
var activityId = Guid.NewGuid().ToString();

test/WebJobs.Script.Scaling.Tests/RequestRemoveWorkerTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ namespace Microsoft.Azure.WebJobs.Script.Scaling.Tests
1111
{
1212
public class RequestRemoveWorkerTests
1313
{
14-
[Theory, MemberData("BasicData")]
14+
[Theory, MemberData(nameof(BasicData))]
1515
public async Task BasicTests(IWorkerInfo manager, IWorkerInfo toRemove)
1616
{
1717
var activityId = Guid.NewGuid().ToString();

test/WebJobs.Script.Scaling.Tests/ScaleUtilsTests.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ namespace Microsoft.Azure.WebJobs.Script.Scaling.Tests
1313
{
1414
public class ScaleUtilsTests
1515
{
16-
[Theory, MemberData("WorkerEqualsData")]
16+
[Theory, MemberData(nameof(WorkerEqualsData))]
1717
public void WorkerEqualsTests(IWorkerInfo src, IWorkerInfo dst, bool expected)
1818
{
1919
var actual = ScaleUtils.WorkerEquals(src, dst);
@@ -119,7 +119,7 @@ public void WorkersToDisplayStringTests()
119119
public void GetAndValidateTokenTests(DateTime expiredUtc, bool expected)
120120
{
121121
var encryptionKey = GenerateEncryptionKey();
122-
using (new TestScopedEnvironmentVariable("WEBSITE_ENCRYPTION_KEY", Convert.ToBase64String(encryptionKey)))
122+
using (new TestScopedEnvironmentVariable("WEBSITE_AUTH_ENCRYPTION_KEY", Convert.ToBase64String(encryptionKey)))
123123
{
124124
var token = ScaleUtils.GetToken(expiredUtc);
125125

0 commit comments

Comments
 (0)