kms_encrypted 0.3.0 → 1.2.0

data/lib/kms_encrypted/log_subscriber.rb

@@ -1,17 +1,25 @@
 module KmsEncrypted
   class LogSubscriber < ActiveSupport::LogSubscriber
-    def decrypt_data_key(event)
+    def decrypt(event)
       return unless logger.debug?
 
-      name = "Decrypt Data Key (#{event.duration.round(1)}ms)"
-      debug "  #{color(name, YELLOW, true)}  Context: #{event.payload[:context].inspect}"
+      data_key = event.payload[:data_key]
+      name = data_key ? "Decrypt Data Key" : "Decrypt"
+      name += " (#{event.duration.round(1)}ms)"
+      context = event.payload[:context]
+      context = context.inspect if context.is_a?(Hash)
+      debug "  #{color(name, YELLOW, true)}  Context: #{context}"
     end
 
-    def generate_data_key(event)
+    def encrypt(event)
       return unless logger.debug?
 
-      name = "Generate Data Key (#{event.duration.round(1)}ms)"
-      debug "  #{color(name, YELLOW, true)}  Context: #{event.payload[:context].inspect}"
+      data_key = event.payload[:data_key]
+      name = data_key ? "Encrypt Data Key" : "Encrypt"
+      name += " (#{event.duration.round(1)}ms)"
+      context = event.payload[:context]
+      context = context.inspect if context.is_a?(Hash)
+      debug "  #{color(name, YELLOW, true)}  Context: #{context}"
     end
   end
 end

data/lib/kms_encrypted/model.rb

@@ -1,158 +1,173 @@
 module KmsEncrypted
   module Model
-    def has_kms_key(legacy_key_id = nil, name: nil, key_id: nil)
-      key_id ||= legacy_key_id || ENV["KMS_KEY_ID"]
+    def has_kms_key(name: nil, key_id: nil, eager_encrypt: false, version: 1, previous_versions: nil, upgrade_context: false)
+      key_id ||= ENV["KMS_KEY_ID"]
 
       key_method = name ? "kms_key_#{name}" : "kms_key"
+      key_column = "encrypted_#{key_method}"
+      context_method = name ? "kms_encryption_context_#{name}" : "kms_encryption_context"
 
       class_eval do
-        class << self
-          def kms_keys
-            @kms_keys ||= {}
-          end unless respond_to?(:kms_keys)
+        @kms_keys ||= {}
+
+        unless respond_to?(:kms_keys)
+          def self.kms_keys
+            parent_keys =
+              if superclass.respond_to?(:kms_keys)
+                superclass.kms_keys
+              else
+                {}
+              end
+
+            parent_keys.merge(@kms_keys || {})
+          end
         end
-        kms_keys[key_method.to_sym] = {key_id: key_id}
-
-        # same pattern as attr_encrypted reload
-        if method_defined?(:reload) && kms_keys.size == 1
-          alias_method :reload_without_kms_encrypted, :reload
-          def reload(*args, &block)
-            result = reload_without_kms_encrypted(*args, &block)
-            self.class.kms_keys.keys.each do |key_method|
-              instance_variable_set("@#{key_method}", nil)
+
+        @kms_keys[key_method.to_sym] = {
+          key_id: key_id,
+          name: name,
+          version: version,
+          previous_versions: previous_versions,
+          upgrade_context: upgrade_context
+        }
+
+        if @kms_keys.size == 1
+          after_save :encrypt_kms_keys
+
+          # fetch all keys together so only need to update database once
+          def encrypt_kms_keys
+            updates = {}
+            self.class.kms_keys.each do |key_method, key|
+              instance_var = "@#{key_method}"
+              key_column = "encrypted_#{key_method}"
+              plaintext_key = instance_variable_get(instance_var)
+
+              if !send(key_column) && plaintext_key
+                updates[key_column] = KmsEncrypted::Database.new(self, key_method).encrypt(plaintext_key)
+              end
+            end
+            if updates.any?
+              current_time = current_time_from_proper_timezone
+              timestamp_attributes_for_update_in_model.each do |attr|
+                updates[attr] = current_time
+              end
+              update_columns(updates)
             end
-            result
+          end
+
+          if method_defined?(:reload)
+            m = Module.new do
+              define_method(:reload) do |*args, &block|
+                result = super(*args, &block)
+                self.class.kms_keys.keys.each do |key_method|
+                  instance_variable_set("@#{key_method}", nil)
+                end
+                result
+              end
+            end
+            prepend m
           end
         end
 
         define_method(key_method) do
-          raise ArgumentError, "Missing key id" unless key_id
-
           instance_var = "@#{key_method}"
 
           unless instance_variable_get(instance_var)
-            key_column = "encrypted_#{key_method}"
-            context_method = name ? "kms_encryption_context_#{name}" : "kms_encryption_context"
-            context = respond_to?(context_method, true) ? send(context_method) : {}
-            default_encoding = "m"
-
-            unless send(key_column)
-              plaintext_key = nil
-              encrypted_key = nil
-
-              event = {
-                key_id: key_id,
-                context: context
-              }
-              ActiveSupport::Notifications.instrument("generate_data_key.kms_encrypted", event) do
-                if key_id == "insecure-test-key"
-                  plaintext_key = "00000000000000000000000000000000"
-                  encrypted_key = "insecure-data-key-#{rand(1_000_000_000_000)}"
-                elsif key_id.start_with?("projects/")
-                  # generate random AES-256 key
-                  plaintext_key = OpenSSL::Random.random_bytes(32)
-
-                  # encrypt it
-                  # load client first to ensure namespace is loaded
-                  client = KmsEncrypted.google_client
-                  request = ::Google::Apis::CloudkmsV1::EncryptRequest.new(
-                    plaintext: plaintext_key,
-                    additional_authenticated_data: context.to_json
-                  )
-                  response = client.encrypt_crypto_key(key_id, request)
-                  key_version = response.name
-
-                  # shorten key to save space
-                  short_key_id = Base64.encode64(key_version.split("/").select.with_index { |_, i| i.odd? }.join("/"))
-
-                  # build encrypted key
-                  # we reference the key in the field for easy rotation
-                  encrypted_key = "$gc$#{short_key_id}$#{[response.ciphertext].pack(default_encoding)}"
-                elsif key_id.start_with?("vault/")
-                  # generate random AES-256 key
-                  plaintext_key = OpenSSL::Random.random_bytes(32)
-
-                  # encrypt it
-                  response = KmsEncrypted.vault_client.logical.write(
-                    "transit/encrypt/#{key_id.sub("vault/", "")}",
-                    plaintext: Base64.encode64(plaintext_key),
-                    context: Base64.encode64(context.to_json)
-                  )
-
-                  encrypted_key = response.data[:ciphertext]
-                else
-                  # generate data key from API
-                  resp = KmsEncrypted.aws_client.generate_data_key(
-                    key_id: key_id,
-                    encryption_context: context,
-                    key_spec: "AES_256"
-                  )
-                  plaintext_key = resp.plaintext
-                  encrypted_key = [resp.ciphertext_blob].pack(default_encoding)
+            encrypted_key = send(key_column)
+            plaintext_key =
+              if encrypted_key
+                KmsEncrypted::Database.new(self, key_method).decrypt(encrypted_key)
+              else
+                key = SecureRandom.random_bytes(32)
+
+                if eager_encrypt == :fetch_id
+                  raise ArgumentError, ":fetch_id only works with Postgres" unless self.class.connection.adapter_name =~ /postg/i
+                  self.id ||= self.class.connection.execute("select nextval('#{self.class.sequence_name}')").first["nextval"]
                 end
-              end
 
-              instance_variable_set(instance_var, plaintext_key)
-              self.send("#{key_column}=", encrypted_key)
-            end
-
-            unless instance_variable_get(instance_var)
-              encrypted_key = send(key_column)
-              plaintext_key = nil
-
-              event = {
-                key_id: key_id,
-                context: context
-              }
-              ActiveSupport::Notifications.instrument("decrypt_data_key.kms_encrypted", event) do
-                if encrypted_key.start_with?("insecure-data-key-")
-                  plaintext_key = "00000000000000000000000000000000".encode("BINARY")
-                elsif encrypted_key.start_with?("$gc$")
-                  _, _, short_key_id, ciphertext = encrypted_key.split("$", 4)
-
-                  # restore key, except for cryptoKeyVersion
-                  stored_key_id = Base64.decode64(short_key_id).split("/")[0..3]
-                  stored_key_id.insert(0, "projects")
-                  stored_key_id.insert(2, "locations")
-                  stored_key_id.insert(4, "keyRings")
-                  stored_key_id.insert(6, "cryptoKeys")
-                  stored_key_id = stored_key_id.join("/")
-
-                  # load client first to ensure namespace is loaded
-                  client = KmsEncrypted.google_client
-                  request = ::Google::Apis::CloudkmsV1::DecryptRequest.new(
-                    ciphertext: ciphertext.unpack(default_encoding).first,
-                    additional_authenticated_data: context.to_json
-                  )
-                  plaintext_key = client.decrypt_crypto_key(stored_key_id, request).plaintext
-                elsif encrypted_key.start_with?("vault:")
-                  response = KmsEncrypted.vault_client.logical.write(
-                    "transit/decrypt/#{key_id.sub("vault/", "")}",
-                    ciphertext: encrypted_key,
-                    context: Base64.encode64(context.to_json)
-                  )
-
-                  plaintext_key = Base64.decode64(response.data[:plaintext])
-                else
-                  plaintext_key = KmsEncrypted.aws_client.decrypt(
-                    ciphertext_blob: encrypted_key.unpack(default_encoding).first,
-                    encryption_context: context
-                  ).plaintext
+                if eager_encrypt == true || ([:try, :fetch_id].include?(eager_encrypt) && id)
+                  encrypted_key = KmsEncrypted::Database.new(self, key_method).encrypt(key)
+                  send("#{key_column}=", encrypted_key)
                 end
-              end
 
-              instance_variable_set(instance_var, plaintext_key)
-            end
+                key
+              end
+            instance_variable_set(instance_var, plaintext_key)
           end
 
           instance_variable_get(instance_var)
         end
 
+        define_method(context_method) do
+          raise KmsEncrypted::Error, "id needed for encryption context" unless id
+
+          {
+            model_name: model_name.to_s,
+            model_id: id
+          }
+        end
+
+        # automatically detects attributes and files where the encryption key is:
+        # 1. a symbol that matches kms key method exactly
+        # does not detect attributes and files where the encryption key is:
+        # 1. callable (warns)
+        # 2. a symbol that internally calls kms key method
+        # it could try to get the exact key and compare
+        # (there's a very small chance this could have false positives)
+        # but bias towards simplicity for now
+        # TODO possibly raise error for callable keys in 2.0
+        # with option to override/specify attributes
         define_method("rotate_#{key_method}!") do
           # decrypt
           plaintext_attributes = {}
-          self.class.encrypted_attributes.select { |_, v| v[:key] == key_method.to_sym }.keys.each do |key|
-            plaintext_attributes[key] = send(key)
+
+          # attr_encrypted
+          if self.class.respond_to?(:encrypted_attributes)
+            self.class.encrypted_attributes.each do |key, v|
+              if v[:key] == key_method.to_sym
+                plaintext_attributes[key] = send(key)
+              elsif v[:key].respond_to?(:call)
+                warn "[kms_encrypted] Can't detect if encrypted attribute uses this key"
+              end
+            end
+          end
+
+          # lockbox attributes
+          # only checks key, not previous versions
+          if self.class.respond_to?(:lockbox_attributes)
+            self.class.lockbox_attributes.each do |key, v|
+              if v[:key] == key_method.to_sym
+                plaintext_attributes[key] = send(key)
+              elsif v[:key].respond_to?(:call)
+                warn "[kms_encrypted] Can't detect if encrypted attribute uses this key"
+              end
+            end
+          end
+
+          # lockbox attachments
+          # only checks key, not previous versions
+          if self.class.respond_to?(:lockbox_attachments)
+            self.class.lockbox_attachments.each do |key, v|
+              if v[:key] == key_method.to_sym
+                # can likely add support at some point, but may be complicated
+                # ideally use rotate_encryption! from Lockbox
+                # but needs access to both old and new keys
+                # also need to update database atomically
+                raise KmsEncrypted::Error, "Can't rotate key used for encrypted files"
+              elsif v[:key].respond_to?(:call)
+                warn "[kms_encrypted] Can't detect if encrypted attachment uses this key"
+              end
+            end
+          end
+
+          # CarrierWave uploaders
+          if self.class.respond_to?(:uploaders)
+            self.class.uploaders.each do |_, uploader|
+              # for simplicity, only checks if key is callable
+              if uploader.respond_to?(:lockbox_options) && uploader.lockbox_options[:key].respond_to?(:call)
+                warn "[kms_encrypted] Can't detect if encrypted uploader uses this key"
+              end
+            end
           end
 
           # reset key

data/lib/kms_encrypted/version.rb

@@ -1,3 +1,3 @@
 module KmsEncrypted
-  VERSION = "0.3.0"
+  VERSION = "1.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kms_encrypted
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
-bindir: exe
+bindir: bin
 cert_chain: []
-date: 2018-11-11 00:00:00.000000000 Z
+date: 2020-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -108,6 +108,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: lockbox
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.4.7
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.4.7
 - !ruby/object:Gem::Dependency
   name: aws-sdk-kms
   requirement: !ruby/object:Gem::Requirement
@@ -150,25 +164,38 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: carrierwave
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: 
-email:
-- andrew@chartkick.com
+email: andrew@chartkick.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".travis.yml"
 - CHANGELOG.md
-- Gemfile
 - LICENSE.txt
 - README.md
-- Rakefile
-- guides/Amazon.md
-- guides/Google.md
-- guides/Vault.md
-- kms_encrypted.gemspec
 - lib/kms_encrypted.rb
+- lib/kms_encrypted/box.rb
+- lib/kms_encrypted/client.rb
+- lib/kms_encrypted/clients/aws.rb
+- lib/kms_encrypted/clients/base.rb
+- lib/kms_encrypted/clients/google.rb
+- lib/kms_encrypted/clients/test.rb
+- lib/kms_encrypted/clients/vault.rb
+- lib/kms_encrypted/database.rb
 - lib/kms_encrypted/log_subscriber.rb
 - lib/kms_encrypted/model.rb
 - lib/kms_encrypted/version.rb
@@ -184,16 +211,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.7
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
-summary: Simple, secure key management for attr_encrypted
+summary: Simple, secure key management for Lockbox and attr_encrypted
 test_files: []