Skip to content

feat: enable sensitive fields encryption by default #11076

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Mar 28, 2024
Merged

feat: enable sensitive fields encryption by default #11076

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
9a26867
feat: enable sensitive fields encryption by default
shreemaan-abhishek Mar 21, 2024
e1accce
encrypt fields only when using etcd
shreemaan-abhishek Mar 22, 2024
7c2994b
make test compatible
shreemaan-abhishek Mar 22, 2024
3c96bbf
remove trailing space
shreemaan-abhishek Mar 22, 2024
b448dce
fix condition check
shreemaan-abhishek Mar 22, 2024
f55bd79
fix test
shreemaan-abhishek Mar 23, 2024
394ec19
fix test
shreemaan-abhishek Mar 24, 2024
14bcd0c
fix test
shreemaan-abhishek Mar 24, 2024
f8e6737
fix test
shreemaan-abhishek Mar 24, 2024
c48dac5
review suggestion
shreemaan-abhishek Mar 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apisix/plugin.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -907,7 +907,7 @@ local function enable_gde()
if enable_data_encryption == nil then
enable_data_encryption =
core.table.try_read_attr(local_conf, "apisix", "data_encryption",
"enable_encrypt_fields")
"enable_encrypt_fields") and (core.config.type == "etcd")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

encrypt fields only when config type is etcd. Without this addition, enabling encrypt_fields on standalone mode would cause unexpected failures.

_M.enable_data_encryption = enable_data_encryption
end

Expand Down
2 changes: 1 addition & 1 deletion conf/config-default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ apisix:
disable_sync_configuration_during_start: false # Safe exit. TO BE REMOVED.

data_encryption: # Data encryption settings.
enable_encrypt_fields: false # Whether enable encrypt fields specified in `encrypt_fields` in plugin schema.
enable_encrypt_fields: true # Whether enable encrypt fields specified in `encrypt_fields` in plugin schema.
keyring: # This field is used to encrypt the private key of SSL and the `encrypt_fields`
# in plugin schema.
- qeddd145sfvddff3 # Set the encryption key for AES-128-CBC. It should be a hexadecimal string
Expand Down
2 changes: 1 addition & 1 deletion t/admin/consumers.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ passed
"desc": "new consumer",
"plugins": {
"key-auth": {
"key": "auth-one"
"key": "4y+JvURBE6ZwRbbgaryrhg=="
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since data encryption is true now, the body returned after a PUT operation would consist of encrypted information.

}
}
},
Expand Down
4 changes: 2 additions & 2 deletions t/node/chash-hashon.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ __DATA__
"username": "jack",
"plugins": {
"key-auth": {
"key": "auth-jack"
"key": "re62sf0vRJqOBjvJJ6RUcA=="
}
}
}
Expand Down Expand Up @@ -83,7 +83,7 @@ __DATA__
"username": "tom",
"plugins": {
"key-auth": {
"key": "auth-tom"
"key": "RAL/niDfEUpx+ynsoqWDuA=="
}
}
}
Expand Down
4 changes: 2 additions & 2 deletions t/plugin/error-log-logger-clickhouse.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ done
--- error_log
this is a warning message for test2
clickhouse body: INSERT INTO t FORMAT JSONEachRow
clickhouse headers: x-clickhouse-key:a
clickhouse headers: x-clickhouse-key:dpwomMlEsHH2L7wSUi6YiQ==
clickhouse headers: x-clickhouse-user:default
clickhouse headers: x-clickhouse-database:default
--- wait: 3
Expand Down Expand Up @@ -133,7 +133,7 @@ clickhouse headers: x-clickhouse-database:default
--- error_log
this is a warning message for test3
clickhouse body: INSERT INTO t FORMAT JSONEachRow
clickhouse headers: x-clickhouse-key:a
clickhouse headers: x-clickhouse-key:dpwomMlEsHH2L7wSUi6YiQ==
clickhouse headers: x-clickhouse-user:default
clickhouse headers: x-clickhouse-database:default
--- wait: 5
Expand Down
13 changes: 13 additions & 0 deletions t/plugin/key-auth.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,19 @@ use t::APISIX 'no_plan';
repeat_each(2);
no_long_string();
no_root_location();

add_block_preprocessor(sub {
my ($block) = @_;

my $user_yaml_config = <<_EOC_;
apisix:
data_encryption:
enable_encrypt_fields: false
_EOC_
$block->set_value("yaml_config", $user_yaml_config);
});


run_tests;

__DATA__
Expand Down