Class: Chef::EncryptedDataBagItem

Inherits:
Object
  • Object
show all
Defined in:
lib/chef/encrypted_data_bag_item.rb,
lib/chef/encrypted_data_bag_item/decryptor.rb,
lib/chef/encrypted_data_bag_item/encryptor.rb,
lib/chef/encrypted_data_bag_item/assertions.rb,
lib/chef/encrypted_data_bag_item/check_encrypted.rb,
lib/chef/encrypted_data_bag_item/decryption_failure.rb,
lib/chef/encrypted_data_bag_item/encryption_failure.rb,
lib/chef/encrypted_data_bag_item/unsupported_cipher.rb,
lib/chef/encrypted_data_bag_item/encrypted_data_bag_item_assertions.rb,
lib/chef/encrypted_data_bag_item/unsupported_encrypted_data_bag_item_format.rb,
lib/chef/encrypted_data_bag_item/unacceptable_encrypted_data_bag_item_format.rb

Overview

Author:: Seth Falcon ([email protected]) Copyright:: Copyright (c) Chef Software Inc. License:: Apache License, Version 2.0

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Defined Under Namespace

Modules: Assertions, CheckEncrypted, Decryptor, Encryptor Classes: DecryptionFailure, EncryptedDataBagRequirementsFailure, EncryptionFailure, UnacceptableEncryptedDataBagItemFormat, UnsupportedCipher, UnsupportedEncryptedDataBagItemFormat

Constant Summary collapse

ALGORITHM = 
"aes-256-cbc".freeze
AEAD_ALGORITHM = 
"aes-256-gcm".freeze

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(enc_hash, secret) ⇒ EncryptedDataBagItem

=== Synopsis

EncryptedDataBagItem.new(hash, secret)

=== Args

+enc_hash+:: The encrypted hash to be decrypted +secret+:: The raw secret key

=== Description

Create a new encrypted data bag item for reading (decryption)



68
69
70
71
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 68

def initialize(enc_hash, secret)
  @enc_hash = enc_hash
  @secret = secret
end

Class Method Details

.encrypt_data_bag_item(plain_hash, secret) ⇒ Object 



92
93
94
95
96
97
98
99
100
101
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 92

def self.encrypt_data_bag_item(plain_hash, secret)
  plain_hash.inject({}) do |h, (key, val)|
    h[key] = if key != "id"
               Encryptor.new(val, secret).for_encrypted_item
             else
               val
             end
    h
  end
end

.load(data_bag, name, secret = nil) ⇒ Object

=== Synopsis

EncryptedDataBagItem.load(data_bag, name, secret = nil)

=== Args

+data_bag+:: The name of the data bag to fetch +name+:: The name of the data bag item to fetch +secret+:: The raw secret key. If the +secret+ is nil, the value of the file at +Chef::Config[:encrypted_data_bag_secret]+ is loaded. See +load_secret+ for more information.

=== Description

Loads and decrypts the data bag item with the given name.



123
124
125
126
127
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 123

def self.load(data_bag, name, secret = nil)
  raw_hash = Chef::DataBagItem.load(data_bag, name)
  secret ||= load_secret
  new(raw_hash, secret)
end

.load_secret(path = nil) ⇒ Object 



129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 129

def self.load_secret(path = nil)
  require "open-uri" unless defined?(OpenURI)
  path ||= Chef::Config[:encrypted_data_bag_secret]
  unless path
    raise ArgumentError, "No secret specified and no secret found at #{Chef::Config.platform_specific_path(ChefConfig::Config.etc_chef_dir) + "/encrypted_data_bag_secret"}"
  end

  secret = case path
           when %r{^\w+://}
             # We have a remote key
             begin
               Kernel.open(path).read.strip
             rescue Errno::ECONNREFUSED
               raise ArgumentError, "Remote key not available from '#{path}'"
             rescue OpenURI::HTTPError
               raise ArgumentError, "Remote key not found at '#{path}'"
             end
           else
             unless File.exist?(path)
               raise Errno::ENOENT, "file not found '#{path}'"
             end

             IO.read(path).strip
           end
  if secret.size < 1
    raise ArgumentError, "invalid zero length secret in '#{path}'"
  end

  secret
end

Instance Method Details

#[](key) ⇒ Object 



73
74
75
76
77
78
79
80
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 73

def [](key)
  value = @enc_hash[key]
  if key == "id" || value.nil?
    value
  else
    Decryptor.for(value, @secret).for_decrypted_item
  end
end

#[]=(key, value) ⇒ Object

Raises:

  • (ArgumentError) 


82
83
84
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 82

def []=(key, value)
  raise ArgumentError, "assignment not supported for #{self.class}"
end

#to_h ⇒ Object Also known as: to_hash 



86
87
88
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 86

def to_h
  @enc_hash.keys.inject({}) { |hash, key| hash[key] = self[key]; hash }
end