awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: wait for session wrapper

Browse Source
This commit is contained in:
Daniel Hougaard
2024-11-05 01:04:45 +04:00
parent abdf8f46a3
commit 5e068cd8a0
3 changed files with 177 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/server/routes/index.ts
View File

@@ -1278,11 +1278,13 @@ export const registerRoutes = async (
});
await superAdminService.initServerCfg();
//
// setup the communication with license key server
await licenseService.init();
hsmService.startService();
// Start HSM service if it's configured/enabled.
await hsmService.startService();
await telemetryQueue.startTelemetryCheck();
await dailyResourceCleanUp.startCleanUp();
await dailyExpiringPkiItemAlert.startSendingAlerts();

351
backend/src/services/hsm/hsm-service.ts
View File

@@ -8,105 +8,80 @@ import { HsmModule, RequiredMechanisms } from "./hsm-types";
type THsmServiceFactoryDep = {
hsmModule: HsmModule;
};
const SESSION_TIMEOUT = 5 * 60 * 1000; // 5 minutes
const USER_ALREADY_LOGGED_IN_ERROR = "CKR_USER_ALREADY_LOGGED_IN";
const WRAPPED_KEY_LENGTH = 32 + 8; // AES-256 key + padding
export type THsmServiceFactory = ReturnType<typeof hsmServiceFactory>;
class HsmSessionManager {
private session: grapheneLib.Session | null = null;
type SyncOrAsync<T> = T | Promise<T>;
type SessionCallback<T> = (session: grapheneLib.Session) => SyncOrAsync<T>;
private lastUsed: number = 0;
export const withSession = async <T>(
{ module, graphene }: HsmModule,
callbackWithSession: SessionCallback<T>
): Promise<T> => {
const appCfg = getConfig();
private module: grapheneLib.Module;
private graphene: typeof grapheneLib;
private sessionCheckInterval: NodeJS.Timeout | null = null;
private startSessionMonitoring() {
// Check session health every minute
this.sessionCheckInterval = setInterval(() => {
this.checkAndRefreshSession();
}, 60 * 1000); // 1 minute
}
private checkAndRefreshSession() {
if (!this.session) return;
const now = Date.now();
if (now - this.lastUsed > SESSION_TIMEOUT) {
logger.info("Session expired, cleaning up...");
this.cleanup();
}
}
private cleanup() {
if (this.session) {
try {
this.session.logout();
this.session.close();
} catch (error) {
logger.error("Error during session cleanup:", error);
}
this.session = null;
}
if (this.sessionCheckInterval) {
clearInterval(this.sessionCheckInterval);
this.sessionCheckInterval = null;
}
}
getSession(): grapheneLib.Session {
const appCfg = getConfig();
// If we have a valid session, update its last used time and return it
if (this.session) {
try {
// Try a simple operation to verify session is still valid
this.session.generateRandom(16);
this.lastUsed = Date.now();
return this.session;
} catch (error) {
logger.info("HSM Session validation failed, creating new session...");
this.cleanup();
}
let session: grapheneLib.Session | null = null;
try {
if (!module) {
throw new Error("PKCS#11 module is not initialized");
}
// Create new session
const slot = this.module.getSlots(appCfg.HSM_SLOT);
const slot = module.getSlots(appCfg.HSM_SLOT);
// eslint-disable-next-line no-bitwise
if (!(slot.flags & this.graphene.SlotFlag.TOKEN_PRESENT)) {
if (!(slot.flags & graphene.SlotFlag.TOKEN_PRESENT)) {
throw new Error("Slot is not initialized");
}
// eslint-disable-next-line no-bitwise
const session = slot.open(this.graphene.SessionFlag.RW_SESSION | this.graphene.SessionFlag.SERIAL_SESSION);
try {
session.login(appCfg.HSM_PIN!);
// eslint-disable-next-line @typescript-eslint/no-explicit-any
} catch (error: any) {
// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access -- The error is of type `Pkcs11Error`, but this error is not exported by graphene. And we don't want to install another library just for an error assertion.
if (error.message !== USER_ALREADY_LOGGED_IN_ERROR) {
throw error;
for (let i = 0; i < 10; i += 1) {
try {
// eslint-disable-next-line no-bitwise
session = slot.open(graphene.SessionFlag.RW_SESSION | graphene.SessionFlag.SERIAL_SESSION);
session.login(appCfg.HSM_PIN!);
} catch (error) {
if ((error as Error)?.message !== USER_ALREADY_LOGGED_IN_ERROR) {
throw error;
}
logger.warn("HSM session already logged in");
session = null;
}
if (session) {
break;
}
logger.warn("Waiting for session to be available...");
// eslint-disable-next-line no-await-in-loop
await new Promise((resolve) => {
let sleepAmount = 1_500 * (i + 1);
if (sleepAmount > 5000) sleepAmount = 5000;
setTimeout(resolve, sleepAmount);
});
}
this.session = session;
this.lastUsed = Date.now();
if (!session) {
throw new Error("Failed to open session");
}
return session;
// Execute the callback and await its result (works for both sync and async)
const result = await callbackWithSession(session);
return result;
} finally {
// Clean up session if it was created
if (session) {
try {
session.logout();
session.close();
} catch (error) {
logger.error("Error cleaning up HSM session:", error);
}
}
}
constructor(module: grapheneLib.Module, graphene: typeof grapheneLib) {
this.module = module;
this.graphene = graphene;
this.startSessionMonitoring();
}
}
};
// eslint-disable-next-line no-empty-pattern
export const hsmServiceFactory = ({ hsmModule: { module, graphene } }: THsmServiceFactoryDep) => {
@@ -116,8 +91,6 @@ export const hsmServiceFactory = ({ hsmModule: { module, graphene } }: THsmServi
const IV_LENGTH = 16;
const TAG_LENGTH = 16;
let sessionManager: HsmSessionManager | null = null;
const $findMasterKey = (session: grapheneLib.Session) => {
// Find the master key (root key)
const template = {
@@ -195,100 +168,101 @@ export const hsmServiceFactory = ({ hsmModule: { module, graphene } }: THsmServi
}
};
const encrypt = (data: Buffer) => {
const encrypt: {
(data: Buffer, providedSession: grapheneLib.Session): Promise<Buffer>;
(data: Buffer): Promise<Buffer>;
} = async (data: Buffer, providedSession?: grapheneLib.Session) => {
if (!module) {
throw new Error("PKCS#11 module is not initialized");
}
if (!sessionManager) {
throw new Error("HSM Session manager is not initialized");
const $performEncryption = (s: grapheneLib.Session) => {
// Generate IV for encryption
const iv = s.generateRandom(IV_LENGTH);
// Generate and wrap a new session key
const { wrappedKey, sessionKey } = $generateAndWrapKey(s);
const alg = {
name: appCfg.HSM_MECHANISM,
params: new graphene.AesGcm240Params(iv)
} as grapheneLib.IAlgorithm;
const cipher = s.createCipher(alg, new graphene.Key(sessionKey).toType());
// Calculate the output buffer size based on input length
// GCM adds a 16-byte auth tag, so we need input length + 16
const outputBuffer = Buffer.alloc(data.length + TAG_LENGTH);
const encryptedData = cipher.once(data, outputBuffer);
// Format: [Wrapped Key (40)][IV (16)][Encrypted Data + Tag]
return Buffer.concat([wrappedKey, iv, encryptedData]);
};
if (providedSession) {
return $performEncryption(providedSession);
}
const session = sessionManager.getSession();
// Generate IV for encryption
const iv = session.generateRandom(IV_LENGTH);
const encrypted = await withSession({ module, graphene }, $performEncryption);
// Generate and wrap a new session key
const { wrappedKey, sessionKey } = $generateAndWrapKey(session);
const alg = {
name: appCfg.HSM_MECHANISM,
params: new graphene.AesGcm240Params(iv)
} as grapheneLib.IAlgorithm;
const cipher = session.createCipher(alg, new graphene.Key(sessionKey).toType());
// Calculate the output buffer size based on input length
// GCM adds a 16-byte auth tag, so we need input length + 16
const outputBuffer = Buffer.alloc(data.length + TAG_LENGTH);
const encryptedData = cipher.once(data, outputBuffer);
// Format: [Wrapped Key (40)][IV (16)][Encrypted Data + Tag]
return Buffer.concat([wrappedKey, iv, encryptedData]);
return encrypted;
};
const decrypt = (encryptedBlob: Buffer) => {
const WRAPPED_KEY_LENGTH = 32 + 8; // AES-256 key + padding
if (!module || !sessionManager) {
const decrypt: {
(encryptedBlob: Buffer, providedSession: grapheneLib.Session): Promise<Buffer>;
(encryptedBlob: Buffer): Promise<Buffer>;
} = async (encryptedBlob: Buffer, providedSession?: grapheneLib.Session) => {
if (!module) {
throw new Error("HSM service not initialized");
}
const session = sessionManager.getSession();
const $performDecryption = (s: grapheneLib.Session) => {
const wrappedKey = encryptedBlob.subarray(0, WRAPPED_KEY_LENGTH);
const iv = encryptedBlob.subarray(WRAPPED_KEY_LENGTH, WRAPPED_KEY_LENGTH + IV_LENGTH);
const ciphertext = encryptedBlob.subarray(WRAPPED_KEY_LENGTH + IV_LENGTH);
// Extract wrapped key, IV, and ciphertext
const wrappedKey = encryptedBlob.subarray(0, WRAPPED_KEY_LENGTH);
const iv = encryptedBlob.subarray(WRAPPED_KEY_LENGTH, WRAPPED_KEY_LENGTH + IV_LENGTH);
const ciphertext = encryptedBlob.subarray(WRAPPED_KEY_LENGTH + IV_LENGTH);
// Unwrap the session key
const sessionKey = $unwrapKey(s, wrappedKey);
// Unwrap the session key
const sessionKey = $unwrapKey(session, wrappedKey);
const algo = {
name: appCfg.HSM_MECHANISM,
params: new graphene.AesGcm240Params(iv)
};
const algo = {
name: appCfg.HSM_MECHANISM,
params: new graphene.AesGcm240Params(iv)
const decipher = s.createDecipher(algo, new graphene.Key(sessionKey).toType());
const outputBuffer = Buffer.alloc(ciphertext.length);
// Extract wrapped key, IV, and ciphertext
return decipher.once(ciphertext, outputBuffer);
};
const decipher = session.createDecipher(algo, new graphene.Key(sessionKey).toType());
const outputBuffer = Buffer.alloc(ciphertext.length);
if (providedSession) {
return $performDecryption(providedSession);
}
const decrypted = await withSession({ module, graphene }, (newSession) => $performDecryption(newSession));
return decipher.once(ciphertext, outputBuffer);
return decrypted;
};
// We test the core functionality of the PKCS#11 module that we are using throughout Infisical. This is to ensure that the user doesn't configure a faulty or unsupported HSM device.
const $testPkcs11Module = () => {
const $testPkcs11Module = async (session: grapheneLib.Session) => {
try {
if (!module || !sessionManager) {
if (!module) {
throw new Error("HSM service not initialized");
}
const session = sessionManager.getSession();
let randomData: Buffer;
let encryptedData: Buffer;
let decryptedData: Buffer;
try {
randomData = session.generateRandom(256);
} catch (error) {
throw new Error(`Error generating random bytes: ${(error as Error).message || "Unknown error"}`);
if (!session) {
throw new Error("Session not initialized");
}
try {
encryptedData = encrypt(Buffer.from(randomData));
} catch (error) {
throw new Error(`Error encrypting data: ${(error as Error).message || "Unknown error"}`);
}
try {
decryptedData = decrypt(encryptedData);
} catch (error) {
throw new Error(`Error decrypting data: ${(error as Error).message || "Unknown error"}`);
}
const randomData = session.generateRandom(256);
const encryptedData = await encrypt(Buffer.from(randomData), session);
const decryptedData = await decrypt(encryptedData, session);
if (Buffer.from(randomData).toString("hex") !== Buffer.from(decryptedData).toString("hex")) {
throw new Error("Decrypted data does not match original data");
}
return true;
} catch (error) {
logger.error(error, "Error testing PKCS#11 module");
@@ -296,15 +270,15 @@ export const hsmServiceFactory = ({ hsmModule: { module, graphene } }: THsmServi
}
};
const isActive = () => {
if (!module || !appCfg.isHsmConfigured || !sessionManager) {
const isActive = async () => {
if (!module || !appCfg.isHsmConfigured) {
return false;
}
let pkcs11TestPassed = false;
try {
pkcs11TestPassed = $testPkcs11Module();
pkcs11TestPassed = await withSession({ module, graphene }, $testPkcs11Module);
} catch (err) {
logger.error(err, "isActive: Error testing PKCS#11 module");
}
@@ -312,53 +286,54 @@ export const hsmServiceFactory = ({ hsmModule: { module, graphene } }: THsmServi
return appCfg.isHsmConfigured && module !== null && pkcs11TestPassed;
};
const startService = () => {
const startService = async () => {
if (!appCfg.isHsmConfigured || !module) return;
sessionManager = new HsmSessionManager(module, graphene);
const session = sessionManager.getSession();
try {
// Check if master key exists, create if not
if (!$keyExists(session)) {
// Generate 256-bit AES master key with persistent storage
session.generateKey(graphene.KeyGenMechanism.AES, {
class: graphene.ObjectClass.SECRET_KEY,
token: true,
valueLen: 256 / 8,
keyType: graphene.KeyType.AES,
label: appCfg.HSM_KEY_LABEL,
derive: true, // Enable key derivation
extractable: false,
sensitive: true,
private: true
});
logger.info(`Master key created successfully with label: ${appCfg.HSM_KEY_LABEL}`);
}
await withSession({ module, graphene }, async (session) => {
// Check if master key exists, create if not
if (!$keyExists(session)) {
// Generate 256-bit AES master key with persistent storage
session.generateKey(graphene.KeyGenMechanism.AES, {
class: graphene.ObjectClass.SECRET_KEY,
token: true,
valueLen: 256 / 8,
keyType: graphene.KeyType.AES,
label: appCfg.HSM_KEY_LABEL,
derive: true, // Enable key derivation
extractable: false,
sensitive: true,
private: true
});
logger.info(`Master key created successfully with label: ${appCfg.HSM_KEY_LABEL}`);
}
// Verify HSM supports required mechanisms
const mechs = session.slot.getMechanisms();
const mechNames: string[] = [];
// Verify HSM supports required mechanisms
const mechs = session.slot.getMechanisms();
const mechNames: string[] = [];
// eslint-disable-next-line no-plusplus
for (let i = 0; i < mechs.length; i++) {
mechNames.push(mechs.items(i).name);
}
// eslint-disable-next-line no-plusplus
for (let i = 0; i < mechs.length; i++) {
mechNames.push(mechs.items(i).name);
}
const hasAesGcm = mechNames.includes(RequiredMechanisms.AesGcm);
const hasAesKeyWrap = mechNames.includes(RequiredMechanisms.AesKeyWrap);
const hasAesGcm = mechNames.includes(RequiredMechanisms.AesGcm);
const hasAesKeyWrap = mechNames.includes(RequiredMechanisms.AesKeyWrap);
if (!hasAesGcm) {
throw new Error(`Required mechanism ${RequiredMechanisms.AesGcm} not supported by HSM`);
}
if (!hasAesKeyWrap) {
throw new Error(`Required mechanism ${RequiredMechanisms.AesKeyWrap} not supported by HSM`);
}
if (!hasAesGcm) {
throw new Error(`Required mechanism ${RequiredMechanisms.AesGcm} not supported by HSM`);
}
if (!hasAesKeyWrap) {
throw new Error(`Required mechanism ${RequiredMechanisms.AesKeyWrap} not supported by HSM`);
}
// Run a test to verify module is working
if (!$testPkcs11Module()) {
throw new Error("PKCS#11 module test failed. Please ensure that the HSM is correctly configured.");
}
const testPassed = await $testPkcs11Module(session);
// Run a test to verify module is working
if (!testPassed) {
throw new Error("PKCS#11 module test failed. Please ensure that the HSM is correctly configured.");
}
});
} catch (error) {
logger.error(error, "Error initializing HSM service");
throw error;

20
backend/src/services/kms/kms-service.ts
View File

@@ -630,11 +630,13 @@ export const kmsServiceFactory = ({
const $decryptRootKey = async (kmsRootConfig: TKmsRootConfig) => {
// case 1: root key is encrypted with HSM
if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.HSM) {
if (!hsmService.isActive()) {
const hsmIsActive = await hsmService.isActive();
if (!hsmIsActive) {
throw new Error("Unable to decrypt root KMS key. HSM service is inactive. Did you configure the HSM?");
}
return hsmService.decrypt(kmsRootConfig.encryptedRootKey);
const decryptedKey = await hsmService.decrypt(kmsRootConfig.encryptedRootKey);
return decryptedKey;
}
// case 2: root key is encrypted with software encryption
@@ -650,10 +652,12 @@ export const kmsServiceFactory = ({
const $encryptRootKey = async (plainKeyBuffer: Buffer, strategy: RootKeyEncryptionStrategy) => {
if (strategy === RootKeyEncryptionStrategy.HSM) {
if (!hsmService.isActive()) {
const hsmIsActive = await hsmService.isActive();
if (!hsmIsActive) {
throw new Error("Unable to encrypt root KMS key. HSM service is inactive. Did you configure the HSM?");
}
return hsmService.encrypt(plainKeyBuffer);
const encrypted = await hsmService.encrypt(plainKeyBuffer);
return encrypted;
}
if (strategy === RootKeyEncryptionStrategy.Software) {
@@ -828,7 +832,6 @@ export const kmsServiceFactory = ({
},
tx
);
return kmsDAL.findByIdWithAssociatedKms(key.id, tx);
});
@@ -866,12 +869,9 @@ export const kmsServiceFactory = ({
// case 1: a root key already exists in the DB
if (kmsRootConfig) {
if (lock) await lock.release();
logger.info("KMS: Encrypted ROOT Key found from DB. Decrypting.");
logger.info(`KMS: Encrypted ROOT Key found from DB. Decrypting. [strategy=${kmsRootConfig.encryptionStrategy}]`);
const decryptedRootKey = await $decryptRootKey(kmsRootConfig).catch((err) => {
logger.error(err, `KMS: Failed to decrypt ROOT Key [strategy=${kmsRootConfig.encryptionStrategy}]`);
throw err;
});
const decryptedRootKey = await $decryptRootKey(kmsRootConfig);
// set the flag so that other instance nodes can start
await keyStore.setItemWithExpiry(KMS_ROOT_CREATION_WAIT_KEY, KMS_ROOT_CREATION_WAIT_TIME, "true");