forgejo/modules/setting
Gusted 12f97ef51f
[SEC] Add keying module
The keying modules tries to solve two problems, the lack of key
separation and the lack of AEAD being used for encryption. The currently
used `secrets` doesn't provide this and is hard to adjust to provide
this functionality.

For encryption, the additional data is now a parameter that can be used,
as the underlying primitive is an AEAD constructions. This allows for
context binding to happen and can be seen as defense-in-depth; it
ensures that if a value X is encrypted for context Y (e.g. ID=3,
Column="private_key") it will only decrypt if that context Y is also
given in the Decrypt function. This makes confused deputy attack harder
to exploit.[^1]

For key separation, HKDF is used to derives subkeys from some IKM, which
is the value of the `[service].SECRET_KEY` config setting. The context
for subkeys are hardcoded, any variable should be shuffled into the the
additional data parameter when encrypting.

[^1]: This is still possible, because the used AEAD construction is not
key-comitting. For Forgejo's current use-case this risk is negligible,
because the subkeys aren't known to a malicious user (which is required
for such attack), unless they also have access to the IKM (at which
point you can assume the whole system is compromised). See
https://scottarc.blog/2022/10/17/lucid-multi-key-deputies-require-commitment/
2024-08-21 16:06:17 +02:00
..
config Customizable "Open with" applications for repository clone (#29320) 2024-03-23 11:58:54 +01:00
actions.go fix: enable LOG_COMPRESSION by default 2024-08-13 09:05:50 +02:00
actions_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
admin.go fix(services): set SendNotificationEmailOnNewUser 2024-05-25 16:27:44 +02:00
admin_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
api.go
asset_dynamic.go
asset_static.go
attachment.go feat: allow .webp attachments by default 2024-07-21 13:01:08 +05:00
attachment_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
badges.go [GITEA] Add support for shields.io-based badges 2024-02-05 16:09:42 +01:00
cache.go
camo.go
config.go Customizable "Open with" applications for repository clone (#29320) 2024-03-23 11:58:54 +01:00
config_env.go Enable unparam linter (#31277) 2024-06-16 13:42:58 +02:00
config_env_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
config_provider.go [gitea] Remove unnecessary parameter (#29092) 2024-02-10 10:53:43 +01:00
config_provider_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
cors.go
cron.go
cron_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
database.go Limit database max connections by default 2024-04-23 00:47:50 +02:00
database_sqlite.go
database_test.go Fix incorrect PostgreSQL connection string for Unix sockets (#28865) 2024-01-20 16:04:47 +00:00
f3.go fix(f3): do not run the F3 CLI if F3 is disabled 2024-06-16 13:33:33 +02:00
federation.go activitypub: Sign the Host header too 2024-08-04 23:57:48 +02:00
forgejo_storage_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
git.go git-grep: set timeout to 2s by default and allow configuring it 2024-08-14 07:55:05 +02:00
git_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
highlight.go
i18n.go i18n: restore Malayalam and Serbian files, remove ml-IN from the language selector (#4576) 2024-07-22 14:08:15 +00:00
incoming_email.go Resolve lint for unused parameter and unnecessary type arguments (#30750) 2024-05-05 08:38:16 +01:00
incoming_email_test.go setting: Infer [email.incoming].PORT from .USE_TLS 2024-04-22 16:30:35 +02:00
indexer.go [FEAT] Support Include/Exclude Filters for Grep (#3058) 2024-04-06 13:25:39 +00:00
indexer_test.go
lfs.go Port "Use general token signing secret" 2024-02-19 20:49:37 +01:00
lfs_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
log.go log: journald integration (#2869) 2024-08-09 07:49:13 +00:00
log_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
mailer.go Add option to change mail from user display name (#31528) 2024-07-22 15:44:13 +02:00
mailer_test.go setting: Allow aliases for some email settings 2024-04-22 16:09:01 +02:00
markup.go Add setting to restrict count of lines being displayed & only highlight those lines 2024-03-25 16:05:01 +01:00
metrics.go
migrations.go
mime_type_map.go
mirror.go
oauth2.go OAuth2 provider: support for granular scopes 2024-08-09 14:58:15 +02:00
oauth2_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
other.go Add [other].SHOW_FOOTER_POWERED_BY setting to hide Powered by (#30253) 2024-04-07 15:40:31 +02:00
packages.go Arch packages implementation (#4785) 2024-08-04 06:16:29 +00:00
packages_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
path.go [BRANDING] alias {FORGEJO,GITEA}_{CUSTOM,WORK_DIR} 2024-02-05 16:05:01 +01:00
path_test.go [BRANDING] alias {FORGEJO,GITEA}_{CUSTOM,WORK_DIR} 2024-02-05 16:05:01 +01:00
picture.go
project.go
proxy.go
queue.go
quota.go feat(quota): Humble beginnings of a quota engine 2024-08-02 11:10:34 +02:00
repository.go Change the default SSH clone url to the ssh:// style 2024-04-17 11:04:48 +02:00
repository_archive.go
repository_archive_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
security.go [SEC] Add keying module 2024-08-21 16:06:17 +02:00
server.go Add slogan config (#3752) 2024-06-07 17:12:48 +00:00
server_test.go Add slogan config (#3752) 2024-06-07 17:12:48 +00:00
service.go [GITEA] add option for banning dots in usernames 2024-02-05 16:05:50 +01:00
service_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
session.go Fix incorrect cookie path for AppSubURL (#29534) 2024-03-06 12:10:46 +08:00
setting.go log: journald integration (#2869) 2024-08-09 07:49:13 +00:00
setting_test.go
ssh.go
storage.go Enable unparam linter (#31277) 2024-06-16 13:42:58 +02:00
storage_test.go Add testifylint to lint checks (#4535) 2024-07-30 19:41:10 +00:00
task.go
time.go Enable more revive linter rules (#30608) 2024-04-28 15:39:00 +02:00
ui.go Add MAX_ROWS option for CSV rendering (#30268) 2024-06-09 16:04:57 +02:00
webhook.go [REFACTOR] simplify checkHookType 2024-03-27 22:26:55 +01:00