chef 10.34.6-x86-mingw32 → 11.6.2-x86-mingw32

data/spec/unit/encrypted_data_bag_item_spec.rb

@@ -32,262 +32,302 @@ module Version0Encryptor
   end
 end
 
-# Encryption/serialization code from Chef 11.
-class Version1Encryptor
-  ALGORITHM = "aes-256-cbc"
-
-  attr_reader :key
-  attr_reader :plaintext_data
-
-  # Create a new Encryptor for +data+, which will be encrypted with the given
-  # +key+.
-  #
-  # === Arguments:
-  # * data: An object of any type that can be serialized to json
-  # * key: A String representing the desired passphrase
-  # * iv: The optional +iv+ parameter is intended for testing use only. When
-  # *not* supplied, Encryptor will use OpenSSL to generate a secure random
-  # IV, which is what you want.
-  def initialize(plaintext_data, key, iv=nil)
-    @plaintext_data = plaintext_data
-    @key = key
-    @iv = iv && Base64.decode64(iv)
-  end
+describe Chef::EncryptedDataBagItem::Encryptor  do
+
+  subject(:encryptor) { described_class.new(plaintext_data, key) }
+  let(:plaintext_data) { {"foo" => "bar"} }
+  let(:key) { "passwd" }
 
-  # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
-  # using as the value in an encrypted data bag item.
-  def for_encrypted_item
-    {
-      "encrypted_data" => encrypted_data,
-      "iv" => Base64.encode64(iv),
-      "version" => 1,
-      "cipher" => ALGORITHM
-    }
+  it "encrypts to format version 1 by default" do
+    encryptor.should be_a_kind_of(Chef::EncryptedDataBagItem::Encryptor::Version1Encryptor)
   end
 
-  # Generates or returns the IV.
-  def iv
-    # Generated IV comes from OpenSSL::Cipher::Cipher#random_iv
-    # This gets generated when +openssl_encryptor+ gets created.
-    openssl_encryptor if @iv.nil?
-    @iv
+  describe "generating a random IV" do
+    it "generates a new IV for each encryption pass" do
+      encryptor2 = Chef::EncryptedDataBagItem::Encryptor.new(plaintext_data, key)
+
+      # No API in ruby OpenSSL to get the iv it used for the encryption back
+      # out. Instead we test if the encrypted data is the same. If it *is* the
+      # same, we assume the IV was the same each time.
+      encryptor.encrypted_data.should_not eq encryptor2.encrypted_data
+    end
   end
 
-  # Generates (and memoizes) an OpenSSL::Cipher::Cipher object and configures
-  # it for the specified iv and encryption key.
-  def openssl_encryptor
-    @openssl_encryptor ||= begin
-      encryptor = OpenSSL::Cipher::Cipher.new(ALGORITHM)
-      encryptor.encrypt
-      @iv ||= encryptor.random_iv
-      encryptor.iv = @iv
-      encryptor.key = Digest::SHA256.digest(key)
-      encryptor
+  describe "when encrypting a non-hash non-array value" do
+    let(:plaintext_data) { 5 }
+    it "serializes the value in a de-serializable way" do
+      Chef::JSONCompat.from_json(subject.serialized_data)["json_wrapper"].should eq 5
     end
+
   end
 
-  # Encrypts and Base64 encodes +serialized_data+
-  def encrypted_data
-    @encrypted_data ||= begin
-      enc_data = openssl_encryptor.update(serialized_data)
-      enc_data << openssl_encryptor.final
-      Base64.encode64(enc_data)
+  describe "wrapping secret values in an envelope" do
+    it "wraps the encrypted data in an envelope with the iv and version" do
+      final_data = encryptor.for_encrypted_item
+      final_data["encrypted_data"].should eq encryptor.encrypted_data
+      final_data["iv"].should eq Base64.encode64(encryptor.iv)
+      final_data["version"].should eq 1
+      final_data["cipher"].should eq"aes-256-cbc"
     end
   end
 
-  # Wraps the data in a single key Hash (JSON Object) and converts to JSON.
-  # The wrapper is required because we accept values (such as Integers or
-  # Strings) that do not produce valid JSON when serialized without the
-  # wrapper.
-  def serialized_data
-    Chef::JSONCompat.to_json(:json_wrapper => plaintext_data)
+  describe "when using version 2 format" do
+
+    before do
+      @original_config = Chef::Config.hash_dup
+      Chef::Config[:data_bag_encrypt_version] = 2
+    end
+
+    after do
+      Chef::Config.configuration = @original_config
+    end
+
+    it "creates a version 2 encryptor" do
+      encryptor.should be_a_kind_of(Chef::EncryptedDataBagItem::Encryptor::Version2Encryptor)
+    end
+
+    it "generates an hmac based on ciphertext including iv" do
+      encryptor2 = Chef::EncryptedDataBagItem::Encryptor.new(plaintext_data, key)
+      encryptor.hmac.should_not eq(encryptor2.hmac)
+    end
+
+    it "includes the hmac in the envelope" do
+      final_data = encryptor.for_encrypted_item
+      final_data["hmac"].should eq(encryptor.hmac)
+    end
   end
-end
 
+end
 
 describe Chef::EncryptedDataBagItem::Decryptor do
+
+  subject(:decryptor) { described_class.for(encrypted_value, decryption_key) }
+  let(:plaintext_data) { {"foo" => "bar"} }
+  let(:encryption_key) { "passwd" }
+  let(:decryption_key) { encryption_key }
+
+  context "when decrypting a version 2 (JSON+aes-256-cbc+hmac-sha256+random iv) encrypted value" do
+    let(:encrypted_value) do
+      Chef::EncryptedDataBagItem::Encryptor::Version2Encryptor.new(plaintext_data, encryption_key).for_encrypted_item
+    end
+
+    let(:bogus_hmac) do
+      digest = OpenSSL::Digest::Digest.new("sha256")
+      raw_hmac = OpenSSL::HMAC.digest(digest, "WRONG", encrypted_value["encrypted_data"])
+      Base64.encode64(raw_hmac)
+    end
+
+    it "rejects the data if the hmac is wrong" do
+      encrypted_value["hmac"] = bogus_hmac
+      lambda { decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::DecryptionFailure)
+    end
+
+    it "rejects the data if the hmac is missing" do
+      encrypted_value.delete("hmac")
+      lambda { decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::DecryptionFailure)
+    end
+
+  end
+
   context "when decrypting a version 1 (JSON+aes-256-cbc+random iv) encrypted value" do
-    before do
-      @encryptor = Version1Encryptor.new({"foo" => "bar"}, "passwd")
-      @encrypted_value = @encryptor.for_encrypted_item
 
-      @decryptor = Chef::EncryptedDataBagItem::Decryptor.for(@encrypted_value, "passwd")
+    let(:encrypted_value) do
+      Chef::EncryptedDataBagItem::Encryptor.new(plaintext_data, encryption_key).for_encrypted_item
     end
 
     it "selects the correct strategy for version 1" do
-      @decryptor.should be_a_kind_of Chef::EncryptedDataBagItem::Decryptor::Version1Decryptor
+      decryptor.should be_a_kind_of Chef::EncryptedDataBagItem::Decryptor::Version1Decryptor
     end
 
     it "decrypts the encrypted value" do
-      @decryptor.decrypted_data.should == {"json_wrapper" => {"foo" => "bar"}}.to_json
+      decryptor.decrypted_data.should eq({"json_wrapper" => plaintext_data}.to_json)
     end
 
     it "unwraps the encrypted data and returns it" do
-      @decryptor.for_decrypted_item.should == {"foo" => "bar"}
+      decryptor.for_decrypted_item.should eq plaintext_data
     end
 
-    context "and the provided key is incorrect" do
-      before do
-        @decryptor = Chef::EncryptedDataBagItem::Decryptor.for(@encrypted_value, "wrong-passwd")
+    describe "and the decryption step returns invalid data" do
+      it "raises a decryption failure error" do
+        # Over a large number of tests on a variety of systems, we occasionally
+        # see the decryption step "succeed" but return invalid data (e.g., not
+        # the original plain text) [CHEF-3858]
+        decryptor.should_receive(:decrypted_data).and_return("lksajdf")
+        lambda { decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::DecryptionFailure)
       end
+    end
+
+    context "and the provided key is incorrect" do
+      let(:decryption_key) { "wrong-passwd" }
 
       it "raises a sensible error" do
-        lambda { @decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::DecryptionFailure)
+        lambda { decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::DecryptionFailure)
       end
     end
 
     context "and the cipher is not supported" do
-      before do
-        @encrypted_value["cipher"] = "aes-256-foo"
+      let(:encrypted_value) do
+        ev = Chef::EncryptedDataBagItem::Encryptor.new(plaintext_data, encryption_key).for_encrypted_item
+        ev["cipher"] = "aes-256-foo"
+        ev
       end
 
       it "raises a sensible error" do
-        lambda { @decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::UnsupportedCipher)
+        lambda { decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::UnsupportedCipher)
       end
     end
 
+    context "and version 2 format is required" do
+      before do
+        @original_config = Chef::Config.hash_dup
+        Chef::Config[:data_bag_decrypt_minimum_version] = 2
+      end
+
+      after do
+        Chef::Config.configuration = @original_config
+      end
+
+      it "raises an error attempting to decrypt" do
+        lambda { decryptor }.should raise_error(Chef::EncryptedDataBagItem::UnacceptableEncryptedDataBagItemFormat)
+      end
+
+    end
+
   end
 
   context "when decrypting a version 0 (YAML+aes-256-cbc+no iv) encrypted value" do
-    before do
-      @encrypted_value = Version0Encryptor.encrypt_value({"foo" => "bar"}, "passwd")
-
-      @decryptor = Chef::EncryptedDataBagItem::Decryptor.for(@encrypted_value, "passwd")
+    let(:encrypted_value) do
+      Version0Encryptor.encrypt_value(plaintext_data, encryption_key)
     end
 
     it "selects the correct strategy for version 0" do
-      @decryptor.should be_a_kind_of(Chef::EncryptedDataBagItem::Decryptor::Version0Decryptor)
+      decryptor.should be_a_kind_of(Chef::EncryptedDataBagItem::Decryptor::Version0Decryptor)
     end
 
     it "decrypts the encrypted value" do
-      @decryptor.for_decrypted_item.should == {"foo" => "bar"}
+      decryptor.for_decrypted_item.should eq plaintext_data
+    end
+
+    context "and version 1 format is required" do
+      before do
+        @original_config = Chef::Config.hash_dup
+        Chef::Config[:data_bag_decrypt_minimum_version] = 1
+      end
+
+      after do
+        Chef::Config.configuration = @original_config
+      end
+
+      it "raises an error attempting to decrypt" do
+        lambda { decryptor }.should raise_error(Chef::EncryptedDataBagItem::UnacceptableEncryptedDataBagItemFormat)
+      end
+
     end
+
   end
 end
 
 describe Chef::EncryptedDataBagItem do
-  before(:each) do
-    @secret = "abc123SECRET"
-    @plain_data = {
+  subject { described_class }
+  let(:encrypted_data_bag_item) { subject.new(encoded_data, secret) }
+  let(:plaintext_data) {{
       "id" => "item_name",
       "greeting" => "hello",
       "nested" => { "a1" => [1, 2, 3], "a2" => { "b1" => true }}
-    }
-    @enc_data = Chef::EncryptedDataBagItem.encrypt_data_bag_item(@plain_data,
-                                                                 @secret)
-  end
+  }}
+  let(:secret) { "abc123SECRET" }
+  let(:encoded_data) { subject.encrypt_data_bag_item(plaintext_data, secret) }
 
   describe "encrypting" do
 
-    it "uses version 0 encryption/serialization" do
-      @enc_data["greeting"].should == Version0Encryptor.encrypt_value(@plain_data["greeting"], @secret)
+    it "doesn't encrypt the 'id' key" do
+      encoded_data["id"].should eq "item_name"
     end
 
-    it "should not encrypt the 'id' key" do
-      @enc_data["id"].should == "item_name"
-    end
+    it "encrypts non-collection objects" do
+      encoded_data["greeting"]["version"].should eq 1
+      encoded_data["greeting"].should have_key("iv")
 
-    it "should encrypt 'greeting'" do
-      @enc_data["greeting"].should_not == @plain_data["greeting"]
-    end
+      iv = encoded_data["greeting"]["iv"]
+      encryptor = Chef::EncryptedDataBagItem::Encryptor.new("hello", secret, iv)
 
-    it "should encrypt 'nested'" do
-      nested = @enc_data["nested"]
-      nested.class.should == String
-      nested.should_not == @plain_data["nested"]
+      encoded_data["greeting"]["encrypted_data"].should eq(encryptor.for_encrypted_item["encrypted_data"])
     end
 
-    it "from_plain_hash" do
-      eh1 = Chef::EncryptedDataBagItem.from_plain_hash(@plain_data, @secret)
-      eh1.class.should == Chef::EncryptedDataBagItem
+    it "encrypts nested values" do
+      encoded_data["nested"]["version"].should eq 1
+      encoded_data["nested"].should have_key("iv")
+
+      iv = encoded_data["nested"]["iv"]
+      encryptor = Chef::EncryptedDataBagItem::Encryptor.new(plaintext_data["nested"], secret, iv)
+
+      encoded_data["nested"]["encrypted_data"].should eq(encryptor.for_encrypted_item["encrypted_data"])
     end
+
   end
 
-  shared_examples_for "a decrypted data bag item" do
+  describe "decrypting" do
 
     it "doesn't try to decrypt 'id'" do
-      @eh["id"].should == @plain_data["id"]
+      encrypted_data_bag_item["id"].should eq(plaintext_data["id"])
     end
 
     it "decrypts 'greeting'" do
-      @eh["greeting"].should == @plain_data["greeting"]
+      encrypted_data_bag_item["greeting"].should eq(plaintext_data["greeting"])
     end
 
     it "decrypts 'nested'" do
-      @eh["nested"].should == @plain_data["nested"]
+      encrypted_data_bag_item["nested"].should eq(plaintext_data["nested"])
     end
 
     it "decrypts everyting via to_hash" do
-      @eh.to_hash.should == @plain_data
+      encrypted_data_bag_item.to_hash.should eq(plaintext_data)
     end
 
     it "handles missing keys gracefully" do
-      @eh["no-such-key"].should be_nil
+      encrypted_data_bag_item["no-such-key"].should be_nil
     end
   end
 
-  describe "decrypting" do
-    before(:each) do
-      @enc_data = Chef::EncryptedDataBagItem.encrypt_data_bag_item(@plain_data,
-                                                                   @secret)
-      @eh = Chef::EncryptedDataBagItem.new(@enc_data, @secret)
+  describe "loading" do
+    it "should defer to Chef::DataBagItem.load" do
+      Chef::DataBagItem.stub(:load).with(:the_bag, "my_codes").and_return(encoded_data)
+      edbi = Chef::EncryptedDataBagItem.load(:the_bag, "my_codes", secret)
+      edbi["greeting"].should eq(plaintext_data["greeting"])
     end
-
-    it_behaves_like "a decrypted data bag item"
   end
 
-  describe "when decrypting a version 1 (Chef 11.x) data bag item" do
+  describe ".load_secret" do
+    subject(:loaded_secret) { Chef::EncryptedDataBagItem.load_secret(path) }
+    let(:path) { "/var/mysecret" }
+    let(:secret) { "opensesame" }
+    let(:stubbed_path) { path }
     before do
-      @enc_data = @plain_data.inject({}) do |encrypted, (key, value)|
-        if key == "id"
-          encrypted["id"] = value
-        else
-          encrypted[key] = Version1Encryptor.new(value, @secret).for_encrypted_item
-        end
-        encrypted
-      end
-      @eh = Chef::EncryptedDataBagItem.new(@enc_data, @secret)
+      ::File.stub(:exist?).with(stubbed_path).and_return(true)
+      IO.stub(:read).with(stubbed_path).and_return(secret)
+      Kernel.stub(:open).with(path).and_return(StringIO.new(secret))
     end
 
-    it_behaves_like "a decrypted data bag item"
-  end
-
-  describe "loading" do
-    it "should defer to Chef::DataBagItem.load" do
-      Chef::DataBagItem.stub(:load).with(:the_bag, "my_codes").and_return(@enc_data)
-      edbi = Chef::EncryptedDataBagItem.load(:the_bag, "my_codes", @secret)
-      edbi["greeting"].should == @plain_data["greeting"]
+    it "reads from a specified path" do
+      loaded_secret.should eq secret
     end
-  end
 
-  describe "load_secret" do
-    it "should read from the default path" do
-      default_path = "/etc/chef/encrypted_data_bag_secret"
-      ::File.stub(:exists?).with(default_path).and_return(true)
-      IO.stub(:read).with(default_path).and_return("opensesame")
-      Chef::EncryptedDataBagItem.load_secret().should == "opensesame"
-    end
+    context "path argument is nil" do
+      let(:path) { nil }
+      let(:stubbed_path) { "/etc/chef/encrypted_data_bag_secret" }
 
-    it "should read from Chef::Config[:encrypted_data_bag_secret]" do
-      path = "/var/mysecret"
-      Chef::Config[:encrypted_data_bag_secret] = path
-      ::File.stub(:exists?).with(path).and_return(true)
-      IO.stub(:read).with(path).and_return("opensesame")
-      Chef::EncryptedDataBagItem.load_secret().should == "opensesame"
+      it "reads from Chef::Config[:encrypted_data_bag_secret]" do
+        Chef::Config[:encrypted_data_bag_secret] = stubbed_path
+        loaded_secret.should eq secret
+      end
     end
 
-    it "should read from a specified path" do
-      path = "/var/mysecret"
-      ::File.stub(:exists?).with(path).and_return(true)
-      IO.stub(:read).with(path).and_return("opensesame")
-      Chef::EncryptedDataBagItem.load_secret(path).should == "opensesame"
-    end
+    context "path argument is a URL" do
+      let(:path) { "http://www.opscode.com/" }
 
-    it "should read from a URL" do
-      path = "http://www.opscode.com/"
-      fake_file = StringIO.new("opensesame")
-      Kernel.stub(:open).with(path).and_return(fake_file)
-      Chef::EncryptedDataBagItem.load_secret(path).should == "opensesame"
+      it "reads the URL" do
+        loaded_secret.should eq secret
+      end
     end
   end
 end