Encryption: Refactor securejsondata.SecureJsonData to stop relying on global functions (#38865)

* Encryption: Add support to encrypt/decrypt sjd * Add datasources.Service as a proxy to datasources db operations * Encrypt ds.SecureJsonData before calling SQLStore * Move ds cache code into ds service * Fix tlsmanager tests * Fix pluginproxy tests * Remove some securejsondata.GetEncryptedJsonData usages * Add pluginsettings.Service as a proxy for plugin settings db operations * Add AlertNotificationService as a proxy for alert notification db operations * Remove some securejsondata.GetEncryptedJsonData usages * Remove more securejsondata.GetEncryptedJsonData usages * Fix lint errors * Minor fixes * Remove encryption global functions usages from ngalert * Fix lint errors * Minor fixes * Minor fixes * Remove securejsondata.DecryptedValue usage * Refactor the refactor * Remove securejsondata.DecryptedValue usage * Move securejsondata to migrations package * Move securejsondata to migrations package * Minor fix * Fix integration test * Fix integration tests * Undo undesired changes * Fix tests * Add context.Context into encryption methods * Fix tests * Fix tests * Fix tests * Trigger CI * Fix test * Add names to params of encryption service interface * Remove bus from CacheServiceImpl * Add logging * Add keys to logger Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * Add missing key to logger Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * Undo changes in markdown files * Fix formatting * Add context to secrets service * Rename decryptSecureJsonData to decryptSecureJsonDataFn * Name args in GetDecryptedValueFn * Add template back to NewAlertmanagerNotifier * Copy GetDecryptedValueFn to ngalert * Add logging to pluginsettings * Fix pluginsettings test Co-authored-by: Tania B <yalyna.ts@gmail.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
2021-10-07 17:33:50 +03:00
parent da813877fb
commit 722c414fef
141 changed files with 1968 additions and 1197 deletions
@@ -8,23 +8,21 @@ import (
 	"sort"
 	"strings"

-	"github.com/prometheus/alertmanager/pkg/labels"
-
-	"github.com/grafana/grafana/pkg/components/securejsondata"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/grafana/grafana/pkg/util"
+	"github.com/prometheus/alertmanager/pkg/labels"
 )

 type notificationChannel struct {
-	ID                    int64                         `xorm:"id"`
-	OrgID                 int64                         `xorm:"org_id"`
-	Uid                   string                        `xorm:"uid"`
-	Name                  string                        `xorm:"name"`
-	Type                  string                        `xorm:"type"`
-	DisableResolveMessage bool                          `xorm:"disable_resolve_message"`
-	IsDefault             bool                          `xorm:"is_default"`
-	Settings              *simplejson.Json              `xorm:"settings"`
-	SecureSettings        securejsondata.SecureJsonData `xorm:"secure_settings"`
+	ID                    int64            `xorm:"id"`
+	OrgID                 int64            `xorm:"org_id"`
+	Uid                   string           `xorm:"uid"`
+	Name                  string           `xorm:"name"`
+	Type                  string           `xorm:"type"`
+	DisableResolveMessage bool             `xorm:"disable_resolve_message"`
+	IsDefault             bool             `xorm:"is_default"`
+	Settings              *simplejson.Json `xorm:"settings"`
+	SecureSettings        SecureJsonData   `xorm:"secure_settings"`
 }

 // channelsPerOrg maps notification channels per organisation
@@ -332,7 +330,7 @@ func (m *migration) generateChannelUID() (string, bool) {
 // Some settings were migrated from settings to secure settings in between.
 // See https://grafana.com/docs/grafana/latest/installation/upgrading/#ensure-encryption-of-existing-alert-notification-channel-secrets.
 // migrateSettingsToSecureSettings takes care of that.
-func migrateSettingsToSecureSettings(chanType string, settings *simplejson.Json, secureSettings securejsondata.SecureJsonData) (*simplejson.Json, map[string]string, error) {
+func migrateSettingsToSecureSettings(chanType string, settings *simplejson.Json, secureSettings SecureJsonData) (*simplejson.Json, map[string]string, error) {
 	keys := []string{}
 	switch chanType {
 	case "slack":
@@ -413,7 +411,7 @@ type amConfigsPerOrg = map[int64]*PostableUserConfig
 func (c *PostableUserConfig) EncryptSecureSettings() error {
 	for _, r := range c.AlertmanagerConfig.Receivers {
 		for _, gr := range r.GrafanaManagedReceivers {
-			encryptedData := securejsondata.GetEncryptedJsonData(gr.SecureSettings)
+			encryptedData := GetEncryptedJsonData(gr.SecureSettings)
 			for k, v := range encryptedData {
 				gr.SecureSettings[k] = base64.StdEncoding.EncodeToString(v)
 			}
@@ -0,0 +1,53 @@
+package ualert
+
+import (
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/util"
+)
+
+// SecureJsonData is used to store encrypted data (for example in data_source table). Only values are separately
+// encrypted.
+type SecureJsonData map[string][]byte
+
+// DecryptedValue returns single decrypted value from SecureJsonData. Similar to normal map access second return value
+// is true if the key exists and false if not.
+func (s SecureJsonData) DecryptedValue(key string) (string, bool) {
+	if value, ok := s[key]; ok {
+		decryptedData, err := util.Decrypt(value, setting.SecretKey)
+		if err != nil {
+			log.Fatalf(4, err.Error())
+		}
+		return string(decryptedData), true
+	}
+	return "", false
+}
+
+// Decrypt returns map of the same type but where the all the values are decrypted. Opposite of what
+// GetEncryptedJsonData is doing.
+func (s SecureJsonData) Decrypt() map[string]string {
+	decrypted := make(map[string]string)
+	for key, data := range s {
+		decryptedData, err := util.Decrypt(data, setting.SecretKey)
+		if err != nil {
+			log.Fatalf(4, err.Error())
+		}
+
+		decrypted[key] = string(decryptedData)
+	}
+	return decrypted
+}
+
+// GetEncryptedJsonData returns map where all keys are encrypted.
+func GetEncryptedJsonData(sjd map[string]string) SecureJsonData {
+	encrypted := make(SecureJsonData)
+	for key, data := range sjd {
+		encryptedData, err := util.Encrypt([]byte(data), setting.SecretKey)
+		if err != nil {
+			log.Fatalf(4, err.Error())
+		}
+
+		encrypted[key] = encryptedData
+	}
+	return encrypted
+}