Encryption key rotation

arangodb · jsteemann · Mar 13, 2020 · Feb 4, 2020 · Feb 11, 2020 · Feb 11, 2020
commit caa5a8c23d9f955af2c6bb7620cee5b62acae7c3
diff --git a/arangod/RestHandler/RestAdminServerHandler.cpp b/arangod/RestHandler/RestAdminServerHandler.cpp
@@ -58,6 +58,8 @@ RestStatus RestAdminServerHandler::execute() {
     handleTLS();
   } else if (suffixes.size() == 1 && suffixes[0] == "jwt") {
     handleJWTSecretsReload();
+  } else if (suffixes.size() == 1 && suffixes[0] == "encryption") {
+    handleEncryptionKeyRotation();
   } else {
     generateError(rest::ResponseCode::NOT_FOUND, TRI_ERROR_HTTP_NOT_FOUND);
   }
@@ -256,4 +258,8 @@ void RestAdminServerHandler::handleTLS() {
 void RestAdminServerHandler::handleJWTSecretsReload() {
   generateError(rest::ResponseCode::NOT_FOUND, TRI_ERROR_HTTP_NOT_FOUND);
 }
+
+void RestAdminServerHandler::handleEncryptionKeyRotation() {
+  generateError(rest::ResponseCode::NOT_FOUND, TRI_ERROR_HTTP_NOT_FOUND);
+}
 #endif
diff --git a/arangod/RestHandler/RestAdminServerHandler.h b/arangod/RestHandler/RestAdminServerHandler.h
@@ -54,6 +54,7 @@ class RestAdminServerHandler : public RestBaseHandler {
   void writeModeResult(bool);
 
   void handleJWTSecretsReload();
+  void handleEncryptionKeyRotation();
 };
 }  // namespace arangodb
 

diff --git a/arangod/RocksDBEngine/RocksDBEngine.h b/arangod/RocksDBEngine/RocksDBEngine.h
@@ 
10000
-350,11 +350,18 @@ class RocksDBEngine final : public StorageEngine {
   void startEnterprise();
   void configureEnterpriseRocksDBOptions(rocksdb::Options& options);
   void validateJournalFiles() const;
+
+  Result readUserEncryptionIV(std::string& out);
 
   enterprise::RocksDBEngineEEData _eeData;
 
 public:
   std::string const& getEncryptionKey();
+
+  std::string const& getEncryptedIVFile();
+
+  Result rotateEncryptionKey();
+
 #endif
 private:
   // activate generation of SHA256 files to parallel .sst files

diff --git a/lib/Basics/StringUtils.h b/lib/Basics/StringUtils.h
@@ -165,7 +165,7 @@ static inline char tolower(char c) {
 }
 
 static inline unsigned char tolower(unsigned char c) {
-  return c + ((c - 65U < 26U) << 5);
+  return static_cast<unsigned char>(c + ((c - 65U < 26U) << 5));
 }
 
 static inline char toupper(char c) {

diff --git a/lib/Basics/VelocyPackHelper.cpp b/lib/Basics/VelocyPackHelper.cpp
@@ -60,8 +60,6 @@
 #include "Basics/memory.h"
 #include "Basics/system-compiler.h"
 #include "Logger/LogMacros.h"
-#include "Logger/Logger.h"
-#include "Logger/LoggerStream.h"
 
 extern "C" {
 unsigned long long XXH64(const void* input, size_t length, unsigned long long seed);

diff --git a/lib/V8/v8-buffer.cpp b/lib/V8/v8-buffer.cpp
@@ -712,7 +712,8 @@ void V8Buffer::replace(v8::Isolate* isolate, char* data, size_t length,
       memcpy(_data, data, _length);
     }
 
-    isolate->AdjustAmountOfExternalAllocatedMemory(sizeof(V8Buffer) + _length + SAFETY_OVERHEAD);
+    int64_t bytesToChange = (int64_t)(sizeof(V8Buffer) + _length + SAFETY_OVERHEAD);
+    isolate->AdjustAmountOfExternalAllocatedMemory(bytesToChange);
   } else {
     _data = NULL;
   }
@@ -808,9 +809,12 @@ static void JS_Ucs2Slice(v8::FunctionCallbackInfo<v8::Value> const& args) {
   if (!sliceArgs(isolate, args[0], args[1], parent, start, end)) {
     return;
   }
+
+  std::vector<uint16_t> buffer;
+  buffer.resize((end - start) / 2);
+  memcpy(buffer.data(), parent->_data + start, (end - start));
 
-  uint16_t* data = (uint16_t*)(parent->_data + start);
-  TRI_V8_RETURN(TRI_V8_STRING_UTF16(isolate, data, (end - start) / 2));
+  TRI_V8_RETURN(TRI_V8_STRING_UTF16(isolate, buffer.data(), buffer.size()));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -829,7 +833,7 @@ static void JS_HexSlice(v8::FunctionCallbackInfo<v8::Value> const& args) {
   }
 
   char* src = parent->_data + start;
-  uint32_t dstlen = (end - start) * 2;
+  uint32_t dstlen = static_cast<size_t>(end - start) * 2;
 
   if (dstlen == 0) {
     TRI_V8_RETURN(v8::String::Empty(isolate));
@@ -948,7 +952,7 @@ static void JS_Fill(v8::FunctionCallbackInfo<v8::Value> const& args) {
     return;
   }
 
-  memset((void*)(parent->_data + start), value, end - start);
+  memset((void*)(parent->_data + start), value, static_cast<size_t>(end - start));
 
   TRI_V8_RETURN_UNDEFINED();
 }
@@ -1079,11 +1083,13 @@ static void JS_Ucs2Write(v8::FunctionCallbackInfo<v8::Value> const& args) {
                                              : TRI_GET_UINT32(args[2]);
 
   max_length = MIN(buffer->_length - offset, max_length) / 2;
-
-  uint16_t* p = (uint16_t*)(buffer->_data + offset);
+
+  std::vector<uint16_t> ucs2;
+  ucs2.resize(max_length);
+  memcpy(ucs2.data(), buffer->_data + offset, max_length);
 
   int written =
-      s->Write(isolate, p, 0, (int)max_length,
+      s->Write(isolate, ucs2.data(), 0, (int)max_length,
                (v8::String::HINT_MANY_WRITES_EXPECTED | v8::String::NO_NULL_TERMINATION));
 
   TRI_V8_RETURN(v8::Integer::New(isolate, written * 2));

diff --git a/lib/V8/v8-utils.cpp b/lib/V8/v8-utils.cpp
@@ -2063,7 +2063,6 @@ static void JS_Load(v8::FunctionCallbackInfo<v8::Value> const& args) {
         TRI_V8_LOG_THROW_EXCEPTION(tryCatch);
       } else {
         tryCatch.ReThrow();
-        TRI_GET_GLOBALS();
         v8g->_canceled = true;
         TRI_V8_RETURN_UNDEFINED();
       }