awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 06:35:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2024-11-11 21:45:06 +04:00
parent d0b3c6b66a
commit 8d4115925c
15 changed files with 47 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/kms/kms-service.ts
+8 -10
View File
@@ -629,7 +629,7 @@ export const kmsServiceFactory = ({
const $decryptRootKey = async (kmsRootConfig: TKmsRootConfig) => {
// case 1: root key is encrypted with HSM
if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.Hsm) {
if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.HSM) {
if (!hsmService.isActive()) {
throw new Error("Unable to decrypt root KMS key. HSM service is inactive. Did you configure the HSM?");
}
@@ -637,8 +637,8 @@ export const kmsServiceFactory = ({
return hsmService.decrypt(kmsRootConfig.encryptedRootKey);
}
// case 2: root key is encrypted with basic encryption
if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.Basic) {
// case 2: root key is encrypted with software encryption
if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.Software) {
const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
const encryptionKeyBuffer = $getBasicEncryptionKey();
@@ -649,14 +649,14 @@ export const kmsServiceFactory = ({
};
const $encryptRootKey = async (plainKeyBuffer: Buffer, strategy: RootKeyEncryptionStrategy) => {
if (strategy === RootKeyEncryptionStrategy.Hsm) {
if (strategy === RootKeyEncryptionStrategy.HSM) {
if (!hsmService.isActive()) {
throw new Error("Unable to encrypt root KMS key. HSM service is inactive. Did you configure the HSM?");
}
return hsmService.encrypt(plainKeyBuffer);
}
if (strategy === RootKeyEncryptionStrategy.Basic) {
if (strategy === RootKeyEncryptionStrategy.Software) {
const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
const encryptionKeyBuffer = $getBasicEncryptionKey();
@@ -870,9 +870,7 @@ export const kmsServiceFactory = ({
const decryptedRootKey = await $decryptRootKey(kmsRootConfig).catch((err) => {
logger.error(err, `KMS: Failed to decrypt ROOT Key [strategy=${kmsRootConfig.encryptionStrategy}]`);
// We do not want to throw on startup. If the HSM has issues, this will throw an error, causing the entire API to shut down.
// If the API shuts down, the user will have no way to do recovery by importing their backup decryption key and rolling back to basic encryption.
return Buffer.alloc(0);
throw err;
});
// set the flag so that other instance nodes can start
@@ -885,7 +883,7 @@ export const kmsServiceFactory = ({
// case 2: no config is found, so we create a new root key with basic encryption
logger.info("KMS: Generating new ROOT Key");
const newRootKey = randomSecureBytes(32);
const encryptedRootKey = await $encryptRootKey(newRootKey, RootKeyEncryptionStrategy.Basic).catch((err) => {
const encryptedRootKey = await $encryptRootKey(newRootKey, RootKeyEncryptionStrategy.Software).catch((err) => {
logger.error({ hsmEnabled: hsmService.isActive() }, "KMS: Failed to encrypt ROOT Key");
throw err;
});
@@ -894,7 +892,7 @@ export const kmsServiceFactory = ({
// @ts-expect-error id is kept as fixed for idempotence and to avoid race condition
id: KMS_ROOT_CONFIG_UUID,
encryptedRootKey,
encryptionStrategy: RootKeyEncryptionStrategy.Basic
encryptionStrategy: RootKeyEncryptionStrategy.Software
});
// set the flag so that other instance nodes can start
backend/src/services/kms/kms-types.ts
+2 -2
View File
@@ -58,6 +58,6 @@ export type TUpdateProjectSecretManagerKmsKeyDTO = {
};
export enum RootKeyEncryptionStrategy {
Basic = "BASIC",
Hsm = "HSM"
Software = "SOFTWARE",
HSM = "HSM"
}