Skip to content

Commit 62e342c

Browse files
weizhouapacheweizhouapache
authored
utils,framework/db: Introduce new database encryption cipher based on AesGcmJce (apache#7003)
1 parent 75a3005 commit 62e342c

File tree

34 files changed

+1543
-524
lines changed

34 files changed

+1543
-524
lines changed

‎client/conf/db.properties.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ db.cloud.trustStorePassword=
5151
# Encryption Settings
5252
db.cloud.encryption.type=none
5353
db.cloud.encrypt.secret=
54+
db.cloud.encryptor.version=
5455

5556
# usage database settings
5657
db.usage.username=@DBUSER@

‎debian/rules‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,7 @@ override_dh_auto_install:
135135
install -D systemvm/dist/* $(DESTDIR)/usr/share/$(PACKAGE)-common/vms/
136136
# We need jasypt for cloud-install-sys-tmplt, so this is a nasty hack to get it into the right place
137137
install -D agent/target/dependencies/jasypt-1.9.3.jar $(DESTDIR)/usr/share/$(PACKAGE)-common/lib
138+
install -D utils/target/cloud-utils-$(VERSION).jar $(DESTDIR)/usr/share/$(PACKAGE)-common/lib/$(PACKAGE)-utils.jar
138139

139140
# cloudstack-python
140141
mkdir -p $(DESTDIR)/usr/share/pyshared

‎engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
import java.io.InputStream;
2424
import java.io.InputStreamReader;
2525
import java.sql.Connection;
26+
import java.sql.PreparedStatement;
27+
import java.sql.ResultSet;
2628
import java.sql.SQLException;
2729
import java.util.Arrays;
2830
import java.util.Date;
@@ -109,6 +111,7 @@
109111
import com.cloud.upgrade.dao.VersionVO;
110112
import com.cloud.upgrade.dao.VersionVO.Step;
111113
import com.cloud.utils.component.SystemIntegrityChecker;
114+
import com.cloud.utils.crypt.DBEncryptionUtil;
112115
import com.cloud.utils.db.GlobalLock;
113116
import com.cloud.utils.db.ScriptRunner;
114117
import com.cloud.utils.db.TransactionLegacy;
@@ -369,6 +372,7 @@ public void check() {
369372
}
370373

371374
try {
375+
initializeDatabaseEncryptors();
372376

373377
final CloudStackVersion dbVersion = CloudStackVersion.parse(_dao.getCurrentVersion());
374378
final String currentVersionValue = this.getClass().getPackage().getImplementationVersion();
@@ -403,6 +407,40 @@ public void check() {
403407
}
404408
}
405409

410+
private void initializeDatabaseEncryptors() {
411+
TransactionLegacy txn = TransactionLegacy.open("initializeDatabaseEncryptors");
412+
txn.start();
413+
String errorMessage = "Unable to get the database connections";
414+
try {
415+
Connection conn = txn.getConnection();
416+
errorMessage = "Unable to get the 'init' value from 'configuration' table in the 'cloud' database";
417+
decryptInit(conn);
418+
txn.commit();
419+
} catch (CloudRuntimeException e) {
420+
s_logger.error(e.getMessage());
421+
errorMessage = String.format("Unable to initialize the database encryptors due to %s. " +
422+
"Please check if database encryption key and database encryptor version are correct.", errorMessage);
423+
s_logger.error(errorMessage);
424+
throw new CloudRuntimeException(errorMessage, e);
425+
} catch (SQLException e) {
426+
s_logger.error(errorMessage, e);
427+
throw new CloudRuntimeException(errorMessage, e);
428+
} finally {
429+
txn.close();
430+
}
431+
}
432+
433+
private void decryptInit(Connection conn) throws SQLException {
434+
String sql = "SELECT value from configuration WHERE name = 'init'";
435+
try (PreparedStatement pstmt = conn.prepareStatement(sql);
436+
ResultSet result = pstmt.executeQuery()) {
437+
if (result.next()) {
438+
String init = result.getString(1);
439+
s_logger.info("init = " + DBEncryptionUtil.decrypt(init));
440+
}
441+
}
442+
}
443+
406444
@VisibleForTesting
407445
protected static final class NoopDbUpgrade implements DbUpgrade {
408446

‎engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade450to451.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
import java.util.List;
2828

2929
import org.apache.log4j.Logger;
30-
import org.jasypt.exceptions.EncryptionOperationNotPossibleException;
3130

3231
import com.cloud.utils.crypt.DBEncryptionUtil;
3332
import com.cloud.utils.exception.CloudRuntimeException;
@@ -111,7 +110,7 @@ private void encryptIpSecPresharedKeysOfRemoteAccessVpn(Connection conn) {
111110
String preSharedKey = resultSet.getString(2);
112111
try {
113112
preSharedKey = DBEncryptionUtil.decrypt(preSharedKey);
114-
} catch (EncryptionOperationNotPossibleException ignored) {
113+
} catch (CloudRuntimeException ignored) {
115114
s_logger.debug("The ipsec_psk preshared key id=" + rowId + "in remote_access_vpn is not encrypted, encrypting it.");
116115
}
117116
try (PreparedStatement updateStatement = conn.prepareStatement("UPDATE `cloud`.`remote_access_vpn` SET ipsec_psk=? WHERE id=?");) {

‎engine/schema/src/main/resources/META-INF/db/schema-41720to41800.sql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ BEGIN
214214
-- Add passphrase table
215215
CREATE TABLE IF NOT EXISTS `cloud`.`passphrase` (
216216
`id` bigint unsigned NOT NULL auto_increment,
217-
`passphrase` varchar(64) DEFAULT NULL,
217+
`passphrase` varchar(255) DEFAULT NULL,
218218
PRIMARY KEY (`id`)
219219
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
220220

‎framework/db/src/main/java/com/cloud/utils/crypt/DBEncryptionFinderCLI.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
//
2+
// Licensed to the Apache Software Foundation (ASF) under one
3+
// or more contributor license agreements. See the NOTICE file
4+
// distributed with this work for additional information
5+
// regarding copyright ownership. The ASF licenses this file
6+
// to you under the Apache License, Version 2.0 (the
7+
// "License"); you may not use this file except in compliance
8+
// with the License. You may obtain a copy of the License at
9+
//
10+
// http://www.apache.org/licenses/LICENSE-2.0
11+
//
12+
// Unless required by applicable law or agreed to in writing,
13+
// software distributed under the License is distributed on an
14+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
// KIND, either express or implied. See the License for the
16+
// specific language governing permissions and limitations
17+
// under the License.
18+
//
19+
20+
package com.cloud.utils.crypt;
21+
22+
import java.util.Map;
23+
import java.util.Set;
24+
25+
public class DBEncryptionFinderCLI {
26+
public static void main(String[] args) {
27+
Map<String, Set<String>> encryptedTableCols = EncryptionSecretKeyChanger.findEncryptedTableColumns();
28+
encryptedTableCols.forEach((table, cols) -> System.out.printf("Table %s has encrypted columns %s%n", table, cols));
29+
}
30+
}

0 commit comments

Comments
 (0)