cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.35k stars 127 forks source link

Reset encryptor configs on query processing #628

Closed Lagovas closed 1 year ago

Lagovas commented 1 year ago

Brief overview how Acra process transparent decryption. At first, it captures query from the application to the database, tries to match it to the encryptor_config and remembers which columns requested from db and which of them should be decrypted/detokenized. In case of simple decryption, Acra can decrypt even without configs, because parses everything that looks like AcraStruct/AcraBlock. In the case of tokenization, it should know token type. Then, when database returns DataRow with data, Acra remembers the order of columns and which of them should be processed, and what rules to apply.

This PR fixes the situation, when Acra remembers the configuration for the decryption after processing the valid query and applies second time for the next query if it wasn't parsed correctly and previous configuration wasn't flushed.

So, here is added resetting querySelectSetting on every OnQuery call that flushes the previously saved list of settings to not apply it on the wrong query. Before that, we expected that every OnQuery will execute parts at end of onSelect/onReturning with assigning new allocated slice to the variable but omitted cases with not parsed queries. So it allows cases when after correctly processed query with some transparent encryption, Acra will try to apply same config on the next query even because weren't executed parts with re-assigning.

This fix is first part of whole fix that cover simple case with one query per TCP packet. But it doesn't cover case when one TCP packet will have several Parse + Bind + Execute db packets, when the second will override previously remembered setting and Acra will apply second config for the first Parse packet... It will be fixed in next PRs because required refactoring and some re-designing.

Checklist

Lagovas commented 1 year ago

@Zhaars , please look one more time on added new changes for MySQL side of testing with returning expression.

Zhaars commented 1 year ago

@Zhaars , please look one more time on added new changes for MySQL side of testing with returning expression.

@Lagovas, Good to go, as for me.