acra v0.85.0 Release NotesRelease Date: 2018-03-15 // almost 3 years ago
🚀 0.85.0, March 15th 2018
💥 Breaking changes:
🔧 Introducing a new more flexible configuration format for AcraCensor rules. AcraCensor doesn't support the old format, all users should migrate (don't worry, it's a simple procedure).
Search through encrypted data
You now can run SQL queries over encrypted AcraStructs allowing users to search through sensitive data without exposing it. This feature is only available in Acra Enterprise version.
Transparent proxy mode
TLDR: Transparent proxy mode allows you to configure AcraServer to encrypt records in specific database columns without altering the application code.
📜 The application flow doesn't need to change: application sends SQL requests through AcraConnector and AcraServer to the database. AcraServer parses each request, encrypts the desired values into AcraStructs, and passes the modified requests to the database. To retrieve the decrypted data, your application talks to AcraServer again: upon receiving the database response, AcraServer tries to detect AcraStructs, decrypts them, and returns the decrypted data to the application.
⚡️ Transparent proxy mode is useful for large distributed applications where updating the source code of each client app separately would be complicated.
To enable this mode, you need to create a separate encryptor configuration file (
acra-encryptor.yaml) that describes which columns to encrypt and provide a path to it in the AcraServer configuration file (or via CLI params
📚 Read more details in the Readme and in the Acra documentation section dedicated to Transparent encryption.
AcraCensor – SQL firewall to prevent SQL injections
TLDR: Improved stability of AcraCensor, switched to more flexible rules' configuration.
💥 Breaking changes: Introducing a new format for configuration files, the previous format is no longer supported, you should migrate to the new one.
🆕 New configuration file format allows configuring the allowlist and the denylist separately or simultaneously.
allowhandler allows something specific and restricts/forbids everything else. The
allowallhandler should be a final statement as that means that all the other queries will be allowed.
denyhandler allows everything and forbids something specific. The
denyallmeans "block all queries!" (that haven't been allowed or ignored before).
🔧 For each handler, there are settings that regulate queries, tables, and patterns. The order of priority for the lists is defined by their position in the configuration file. The processing priority for each list is as follows: queries, followed by tables, followed by patterns.
📚 Read more in AcraCensor docs.
➕ Added version to the configuration file. This allows detecting an outdated configuration easily. From now on, AcraCensor supports explicit configuration version and logs errors if the configuration is not valid (#321).
➕ Added ability to log unparsed queries to a separate log file for the debugging and configuration purposes. Sometimes AcraCensor can't parse all of the incoming queries and it is useful to have a separate log for them.
How to use it: Provide the path to the unparsed queries log file in the configuration file
👌 Improved support of PostgreSQL queries (
"RETURNING"clause) and quoted identifiers (now you can use
WHERE "column"=1) (#296).
🛠 Fixed the bug in QueryCapture log that caused duplicated of records in the log to appear (#318).
🛠 Fixed handling of null-size packets in PostgreSQL protocol (#286).
🛠 Fixed handling of setting a custom connection API port (#294).
🛠 Fixed handling of the plain text data response: if the database returns a plain text response, it is redirected "as is" (#305).
🛠 Fixed handling of casted placeholders in expressions like
SELECT $1::type1::type2 FROM table1 WHERE column1=$2::type3::type4(#328).
AcraServer, AcraTranslator, AcraConnector
➕ Added on-start version logging to make it easier to understand which version is running (#319).
➕ Added versioning for configuration files of each service (#322).
📚 Updated some configuration parameters descriptions for better user-friendliness (please see our docs of AcraConnector and AcraServer for detailed descriptions of each parameter and usage examples) (#329).
⚡️ Updated AcraWriter for ActiveRecord (Ruby), fixed dependencies, added support of mysql2 adapter (#287).
👌 Improved distribution of AcraWriter for Android, now it's available via Maven (#310).
Example projects and demos:
iOS Swift example project that shows how to generate AcraStructs with and without Zones.
Android example project that shows how to integrate AcraWriter library into Android app using maven, and then to generate AcraStructs with and without Zones, and to decrypt them using AcraTranslator.
🔧 AcraCensor demo that shows how to configure AcraCensor for SQL injections prevention in OWASP Mutillidae 2 example app.
💎 Protecting data in a Rails application demo based on AcraServer, PostgreSQL, and Ruby on Rails client application.
Protecting metrics in TimescaleDB demo based on AcraServer, TimescaleDB, and Grafana.
🔧 Transparent proxy mode demo that shows how to configure AcraServer in Transparent proxy mode to protect Django-based application.
Related blog posts:
🔋 Features coming soon:
🔌 Pseudonymisation: an early version of pseudonymisation library/plugin for Acra for transparent data pseudonymisation.
🔊 Cryptographically protected audit log: protection for logs against tampering.
📚 Updated AcraServer documentation to describe Transparent mode in more details.
📚 Updated AcraCensor documentation to describe the new configuration format and procedures for migration from the previous one.
📚 Updated AcraWriter documentation for iOS and Android to reflect the improved installation ways.
Previous changes from v0.76
- 👍 SSL / TLS support
- Unix sockets
👍 Acra now supports usage of both TCP and Unix Sockets as a connection layer between AcraWriter <-> AcraProxy <-> AcraServer.
- Updated integration test suit to support multiple connection modes between the Acra components and the database (#115, #117, #118, #120).
- Added Docker image to make testing easier (#104).
- ➕ Added support of Go 1.10, removed support of older Go versions (<1.6).
- ➕ Added support of Ubuntu 17.10, Ubuntu 16.04, Ubuntu 14.04, Debian Stretch.
- ⚡️ Updated dependency libraries (libthemis and libcrypto) to use the latest ones.
- 📚 Updated the documentation and tutorials to reflect the latest changes.