Encryption: Refactor securejsondata.SecureJsonData to stop relying on global functions (#38865)

* Encryption: Add support to encrypt/decrypt sjd * Add datasources.Service as a proxy to datasources db operations * Encrypt ds.SecureJsonData before calling SQLStore * Move ds cache code into ds service * Fix tlsmanager tests * Fix pluginproxy tests * Remove some securejsondata.GetEncryptedJsonData usages * Add pluginsettings.Service as a proxy for plugin settings db operations * Add AlertNotificationService as a proxy for alert notification db operations * Remove some securejsondata.GetEncryptedJsonData usages * Remove more securejsondata.GetEncryptedJsonData usages * Fix lint errors * Minor fixes * Remove encryption global functions usages from ngalert * Fix lint errors * Minor fixes * Minor fixes * Remove securejsondata.DecryptedValue usage * Refactor the refactor * Remove securejsondata.DecryptedValue usage * Move securejsondata to migrations package * Move securejsondata to migrations package * Minor fix * Fix integration test * Fix integration tests * Undo undesired changes * Fix tests * Add context.Context into encryption methods * Fix tests * Fix tests * Fix tests * Trigger CI * Fix test * Add names to params of encryption service interface * Remove bus from CacheServiceImpl * Add logging * Add keys to logger Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * Add missing key to logger Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * Undo changes in markdown files * Fix formatting * Add context to secrets service * Rename decryptSecureJsonData to decryptSecureJsonDataFn * Name args in GetDecryptedValueFn * Add template back to NewAlertmanagerNotifier * Copy GetDecryptedValueFn to ngalert * Add logging to pluginsettings * Fix pluginsettings test Co-authored-by: Tania B <yalyna.ts@gmail.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
2021-10-07 17:33:50 +03:00
parent da813877fb
commit 722c414fef
141 changed files with 1968 additions and 1197 deletions
@@ -1,6 +1,7 @@
 package ossencryption

 import (
+	"context"
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
@@ -21,7 +22,7 @@ func ProvideService() *Service {

 const saltLength = 8

-func (s *Service) Decrypt(payload []byte, secret string) ([]byte, error) {
+func (s *Service) Decrypt(_ context.Context, payload []byte, secret string) ([]byte, error) {
 	if len(payload) < saltLength {
 		return nil, fmt.Errorf("unable to compute salt")
 	}
@@ -52,7 +53,7 @@ func (s *Service) Decrypt(payload []byte, secret string) ([]byte, error) {
 	return payloadDst, nil
 }

-func (s *Service) Encrypt(payload []byte, secret string) ([]byte, error) {
+func (s *Service) Encrypt(_ context.Context, payload []byte, secret string) ([]byte, error) {
 	salt, err := util.GetRandomString(saltLength)
 	if err != nil {
 		return nil, err
@@ -82,6 +83,45 @@ func (s *Service) Encrypt(payload []byte, secret string) ([]byte, error) {
 	return ciphertext, nil
 }

+func (s *Service) EncryptJsonData(ctx context.Context, kv map[string]string, secret string) (map[string][]byte, error) {
+	encrypted := make(map[string][]byte)
+	for key, value := range kv {
+		encryptedData, err := s.Encrypt(ctx, []byte(value), secret)
+		if err != nil {
+			return nil, err
+		}
+
+		encrypted[key] = encryptedData
+	}
+	return encrypted, nil
+}
+
+func (s *Service) DecryptJsonData(ctx context.Context, sjd map[string][]byte, secret string) (map[string]string, error) {
+	decrypted := make(map[string]string)
+	for key, data := range sjd {
+		decryptedData, err := s.Decrypt(ctx, data, secret)
+		if err != nil {
+			return nil, err
+		}
+
+		decrypted[key] = string(decryptedData)
+	}
+	return decrypted, nil
+}
+
+func (s *Service) GetDecryptedValue(ctx context.Context, sjd map[string][]byte, key, fallback, secret string) string {
+	if value, ok := sjd[key]; ok {
+		decryptedData, err := s.Decrypt(ctx, value, secret)
+		if err != nil {
+			return fallback
+		}
+
+		return string(decryptedData)
+	}
+
+	return fallback
+}
+
 // Key needs to be 32bytes
 func encryptionKeyToBytes(secret, salt string) ([]byte, error) {
 	return pbkdf2.Key([]byte(secret), []byte(salt), 10000, 32, sha256.New), nil
@@ -1,6 +1,7 @@
 package ossencryption

 import (
+	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -21,17 +22,19 @@ func TestEncryption(t *testing.T) {
 	})

 	t.Run("decrypting basic payload", func(t *testing.T) {
-		encrypted, err := svc.Encrypt([]byte("grafana"), "1234")
+		ctx := context.Background()
+
+		encrypted, err := svc.Encrypt(ctx, []byte("grafana"), "1234")
 		require.NoError(t, err)

-		decrypted, err := svc.Decrypt(encrypted, "1234")
+		decrypted, err := svc.Decrypt(ctx, encrypted, "1234")
 		require.NoError(t, err)

 		assert.Equal(t, []byte("grafana"), decrypted)
 	})

 	t.Run("decrypting empty payload should return error", func(t *testing.T) {
-		_, err := svc.Decrypt([]byte(""), "1234")
+		_, err := svc.Decrypt(context.Background(), []byte(""), "1234")
 		require.Error(t, err)

 		assert.Equal(t, "unable to compute salt", err.Error())