-
Notifications
You must be signed in to change notification settings - Fork 92
Encrypt instance secrets at rest #515
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
GOLDKUN
wants to merge
3
commits into
chaitin:main
Choose a base branch
from
GOLDKUN:security/encrypt-instance-secrets
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from 1 commit
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,164 @@ | ||
| package store | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/aes" | ||
| "crypto/cipher" | ||
| "crypto/rand" | ||
| "encoding/base64" | ||
| "errors" | ||
| "fmt" | ||
| "io" | ||
| "os" | ||
| ) | ||
|
|
||
| const ( | ||
| encryptedSecretPrefix = "octobus-secret-v1:" | ||
| secretKeyEnv = "OCTOBUS_SECRET_ENCRYPTION_KEY" | ||
| secretKeyBytes = 32 | ||
| ) | ||
|
|
||
| func loadSecretKey(dbPath string) ([]byte, error) { | ||
| if encoded := os.Getenv(secretKeyEnv); encoded != "" { | ||
| key, err := base64.StdEncoding.DecodeString(encoded) | ||
| if err != nil || len(key) != secretKeyBytes { | ||
| return nil, fmt.Errorf("%s must be base64-encoded %d-byte key", secretKeyEnv, secretKeyBytes) | ||
| } | ||
| return key, nil | ||
| } | ||
| if dbPath == ":memory:" { | ||
| return randomSecretKey() | ||
| } | ||
|
|
||
| keyPath := dbPath + ".secret-key" | ||
| key, err := os.ReadFile(keyPath) | ||
| if err == nil { | ||
| if len(key) != secretKeyBytes { | ||
| return nil, fmt.Errorf("secret key file %q has invalid length", keyPath) | ||
| } | ||
| return key, nil | ||
| } | ||
| if !errors.Is(err, os.ErrNotExist) { | ||
| return nil, err | ||
| } | ||
| key, err = randomSecretKey() | ||
|
monkeyscan[bot] marked this conversation as resolved.
|
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| file, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600) | ||
| if err == nil { | ||
| if _, writeErr := file.Write(key); writeErr != nil { | ||
| _ = file.Close() | ||
| _ = os.Remove(keyPath) | ||
| return nil, writeErr | ||
| } | ||
| if closeErr := file.Close(); closeErr != nil { | ||
| return nil, closeErr | ||
| } | ||
| return key, nil | ||
|
monkeyscan[bot] marked this conversation as resolved.
|
||
| } | ||
| if !errors.Is(err, os.ErrExist) { | ||
| return nil, err | ||
| } | ||
| key, err = os.ReadFile(keyPath) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if len(key) != secretKeyBytes { | ||
| return nil, fmt.Errorf("secret key file %q has invalid length", keyPath) | ||
| } | ||
| return key, nil | ||
| } | ||
|
|
||
| func randomSecretKey() ([]byte, error) { | ||
| key := make([]byte, secretKeyBytes) | ||
| if _, err := io.ReadFull(rand.Reader, key); err != nil { | ||
| return nil, err | ||
| } | ||
| return key, nil | ||
| } | ||
|
|
||
| func encryptSecret(key, plaintext []byte) (string, error) { | ||
| block, err := aes.NewCipher(key) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| gcm, err := cipher.NewGCM(block) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| nonce := make([]byte, gcm.NonceSize()) | ||
| if _, err := io.ReadFull(rand.Reader, nonce); err != nil { | ||
| return "", err | ||
| } | ||
| ciphertext := gcm.Seal(nonce, nonce, plaintext, nil) | ||
| return encryptedSecretPrefix + base64.RawStdEncoding.EncodeToString(ciphertext), nil | ||
| } | ||
|
|
||
| func decryptSecret(key []byte, encoded string) ([]byte, error) { | ||
| if len(encoded) < len(encryptedSecretPrefix) || encoded[:len(encryptedSecretPrefix)] != encryptedSecretPrefix { | ||
| return []byte(encoded), nil | ||
| } | ||
| payload, err := base64.RawStdEncoding.DecodeString(encoded[len(encryptedSecretPrefix):]) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("decode encrypted instance secret: %w", err) | ||
| } | ||
| block, err := aes.NewCipher(key) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| gcm, err := cipher.NewGCM(block) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if len(payload) < gcm.NonceSize() { | ||
| return nil, errors.New("encrypted instance secret is truncated") | ||
| } | ||
| return gcm.Open(nil, payload[:gcm.NonceSize()], payload[gcm.NonceSize():], nil) | ||
| } | ||
|
|
||
| func (s *Store) encryptLegacySecrets(ctx context.Context) error { | ||
| rows, err := s.db.QueryContext(ctx, `SELECT id, secret_json FROM instances WHERE secret_json <> '' AND substr(secret_json, 1, ?) <> ?`, len(encryptedSecretPrefix), encryptedSecretPrefix) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| type legacySecret struct { | ||
| id string | ||
| data string | ||
| } | ||
| var legacy []legacySecret | ||
| for rows.Next() { | ||
| var item legacySecret | ||
| if err := rows.Scan(&item.id, &item.data); err != nil { | ||
| _ = rows.Close() | ||
| return err | ||
| } | ||
| legacy = append(legacy, item) | ||
| } | ||
| if err := rows.Err(); err != nil { | ||
| _ = rows.Close() | ||
| return err | ||
| } | ||
| if err := rows.Close(); err != nil { | ||
| return err | ||
| } | ||
| if len(legacy) == 0 { | ||
| return nil | ||
| } | ||
|
|
||
| tx, err := s.db.BeginTx(ctx, nil) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer tx.Rollback() | ||
| for _, item := range legacy { | ||
| encrypted, err := encryptSecret(s.secretKey, []byte(item.data)) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if _, err := tx.ExecContext(ctx, `UPDATE instances SET secret_json = ? WHERE id = ?`, encrypted, item.id); err != nil { | ||
| return err | ||
| } | ||
| } | ||
| return tx.Commit() | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| package store | ||
|
|
||
| import ( | ||
| "context" | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "octobus/internal/domain" | ||
| ) | ||
|
|
||
| func TestInstanceSecretsAreEncryptedAtRestAndReadableAcrossReopen(t *testing.T) { | ||
| dbPath := t.TempDir() + "/octobus.db" | ||
| ctx := context.Background() | ||
| st, err := Open(dbPath) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if err := st.UpsertService(ctx, domain.Service{ID: "secret-service", Name: "Secret Service"}); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| plain := []byte(`{"apiToken":"do-not-store-plaintext"}`) | ||
| if err := st.UpsertInstance(ctx, domain.Instance{ID: "secret-instance", ServiceID: "secret-service", Name: "Instance", SecretJSON: plain}); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| var stored string | ||
| if err := st.DB().QueryRowContext(ctx, `SELECT secret_json FROM instances WHERE id = ?`, "secret-instance").Scan(&stored); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if strings.Contains(stored, "do-not-store-plaintext") || !strings.HasPrefix(stored, encryptedSecretPrefix) { | ||
| t.Fatalf("secret at rest is not encrypted: %q", stored) | ||
| } | ||
| if err := st.Close(); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
|
|
||
| st, err = Open(dbPath) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| defer st.Close() | ||
| got, err := st.GetInstance(ctx, "secret-instance") | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if string(got.SecretJSON) != string(plain) { | ||
| t.Fatalf("decrypted secret = %s", got.SecretJSON) | ||
| } | ||
| } | ||
|
|
||
| func TestLegacyInstanceSecretsAreEncryptedDuringMigration(t *testing.T) { | ||
| dbPath := t.TempDir() + "/octobus.db" | ||
| ctx := context.Background() | ||
| st, err := Open(dbPath) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if err := st.UpsertService(ctx, domain.Service{ID: "legacy-service", Name: "Legacy Service"}); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if err := st.UpsertInstance(ctx, domain.Instance{ID: "legacy-instance", ServiceID: "legacy-service", Name: "Instance", SecretJSON: []byte(`{}`)}); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if _, err := st.DB().ExecContext(ctx, `UPDATE instances SET secret_json = ? WHERE id = ?`, `{"legacy":"secret"}`, "legacy-instance"); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if err := st.Close(); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
|
|
||
| st, err = Open(dbPath) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| defer st.Close() | ||
| var stored string | ||
| if err := st.DB().QueryRowContext(ctx, `SELECT secret_json FROM instances WHERE id = ?`, "legacy-instance").Scan(&stored); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if strings.Contains(stored, "legacy") || !strings.HasPrefix(stored, encryptedSecretPrefix) { | ||
| t.Fatalf("legacy secret was not migrated: %q", stored) | ||
| } | ||
| got, err := st.GetInstance(ctx, "legacy-instance") | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if string(got.SecretJSON) != `{"legacy":"secret"}` { | ||
| t.Fatalf("migrated secret = %s", got.SecretJSON) | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
默认密钥与数据库同目录明文存放，削弱静态加密保护效果
默认（未设置 OCTOBUS_SECRET_ENCRYPTION_KEY）时，AES-256-GCM 密钥以明文写入与数据库同目录的 .secret-key 文件（仅 0600）。能读取数据库文件的一方（备份导出、目录拷贝、同一 OS 用户下的其他进程/恶意软件）通常也能读取该密钥，导致“静态加密”退化为仅防随意查看的混淆，无法满足常见的威胁模型（数据库文件脱离密钥环境泄露时仍不可读）。
Problem code:
Recommendation:
在生产环境中将环境变量/密钥管理服务作为加载密钥的强制路径，并明确密钥文件自动生成仅用于开发或本机使用；若保留密钥文件方案，建议与数据库分目录存放并收紧目录权限，同时在文档中明确其威胁模型与局限。