Class: Chef::EncryptedDataBagItem::Decryptor::Version1Decryptor

Inherits:
Object
  • Object
show all
Defined in:
lib/chef/encrypted_data_bag_item.rb

Direct Known Subclasses

Version2Decryptor

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(encrypted_data, key) ⇒ Version1Decryptor

Returns a new instance of Version1Decryptor.



230
231
232
233
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 230

def initialize(encrypted_data, key)
  @encrypted_data = encrypted_data
  @key = key
end

Instance Attribute Details

#encrypted_data ⇒ Object (readonly)

Returns the value of attribute encrypted_data.



227
228
229
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 227

def encrypted_data
  @encrypted_data
end

#key ⇒ Object (readonly)

Returns the value of attribute key.



228
229
230
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 228

def key
  @key
end

Instance Method Details

#assert_valid_cipher! ⇒ Object 



272
273
274
275
276
277
278
279
280
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 272

def assert_valid_cipher!
  # In the future, chef may support configurable ciphers. For now, only
  # aes-256-cbc is supported.
  requested_cipher = @encrypted_data["cipher"]
  unless requested_cipher == ALGORITHM
    raise UnsupportedCipher,
      "Cipher '#{requested_cipher}' is not supported by this version of Chef. Available ciphers: ['#{ALGORITHM}']"
  end
end

#decrypted_data ⇒ Object 



252
253
254
255
256
257
258
259
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 252

def decrypted_data
  @decrypted_data ||= begin
    plaintext = openssl_decryptor.update(encrypted_bytes)
    plaintext << openssl_decryptor.final
  rescue OpenSSL::Cipher::CipherError => e
    raise DecryptionFailure, "Error decrypting data bag value: '#{e.message}'. Most likely the provided key is incorrect"
  end
end

#encrypted_bytes ⇒ Object 



244
245
246
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 244

def encrypted_bytes
  Base64.decode64(@encrypted_data["encrypted_data"])
end

#for_decrypted_item ⇒ Object 



235
236
237
238
239
240
241
242
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 235

def for_decrypted_item
  Yajl::Parser.parse(decrypted_data)["json_wrapper"]
rescue Yajl::ParseError
  # convert to a DecryptionFailure error because the most likely scenario
  # here is that the decryption step was unsuccessful but returned bad
  # data rather than raising an error.
  raise DecryptionFailure, "Error decrypting data bag value. Most likely the provided key is incorrect"
end

#iv ⇒ Object 



248
249
250
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 248

def iv
  Base64.decode64(@encrypted_data["iv"])
end

#openssl_decryptor ⇒ Object 



261
262
263
264
265
266
267
268
269
270
 
# File 'lib/chef/encrypted_data_bag_item.rb', line 261

def openssl_decryptor
  @openssl_decryptor ||= begin
    assert_valid_cipher!
    d = OpenSSL::Cipher::Cipher.new(ALGORITHM)
    d.decrypt
    d.key = Digest::SHA256.digest(key)
    d.iv = iv
    d
  end
end