ACRA 0.85.0 LOOKING GLASS

New Acra 0.85.0 brings the expanded functionality we’ve announced during the release of Acra 0.84.0.

We’ve added server-side encryption mode which allows integrating Acra without altering the client application code. It’s called AcraServer’s Transparent proxy mode and allows you to configure AcraServer to parse SQL queries and to encrypt values designated for specific database columns. Transparent encryption mode is useful for large distributed applications where updating the source code of each client app separately would be complicated.

Now AcraCensor is even more useful for preventing complex SQL injections: new flexible configuration file describes how AcraCensor should process the incoming SQL queries – log, pass, block, or ignore them. Each action is described by a separate handler, and you can combine handlers in a different order.

This release also marks a clear subdivision of Acra into Acra Community Edition (Acra CE), which is open source and forever free, plus Acra Pro and Acra Enterprise versions.

The most exciting feature of this release is Secure Search. Now you can run SQL queries over encrypted data allowing users to search through sensitive data without exposing it. It allows including Acra-protected records in WHERE clauses of SQL queries and perform proxy-side search over the protected lists of data. You can fully utilise cryptography even where search over protected data is required. This feature is only available in Acra Enterprise version.

More details about the new Acra CE release:

Core

• Transparent proxy mode

Transparent proxy mode allows you to configure AcraServer to encrypt records in specific database columns without altering the application code. The application flow doesn't need to change: application sends SQL requests through AcraConnector and AcraServer to the database. AcraServer parses each request, encrypts the desired values into AcraStructs, and passes the modified requests to the database. To retrieve the decrypted data, your application talks to AcraServer again: upon receiving the database response, AcraServer tries to detect AcraStructs, decrypts them, and returns the decrypted data to the application. Read more details in the Changelog, Readme, and in the Acra documentation section dedicated to Transparent encryption (#285, #309, #314).

• AcraCensor – SQL firewall to prevent SQL injections

Improved stability of AcraCensor, switched to more flexible rules' configuration.

Breaking changes: Introducing a new format for configuration files, the previous format is no longer supported, you should migrate to the new one.

• • New configuration file format allows configuring the allowlist and the denylist separately or simultaneously.

  • The allow handler allows something specific and restricts/forbids everything else. The allowall handler should be a final statement as that means that all the other queries will be allowed.

  • The deny handler allows everything and forbids something specific. The denyall means "block all queries!" (that haven't been allowed or ignored before).

  • For each handler, there are settings that regulate queries, tables, and patterns. The order of priority for the lists is defined by their position in the configuration file. The processing priority for each list is as follows: queries, followed by tables, followed by patterns (#298, #297, #304, #306). Read more in AcraCensor docs.

  • Added version to the configuration file. This allows detecting an outdated configuration easily. From now on, AcraCensor supports explicit configuration version and logs errors if the configuration is not valid (#321).

  • Improved parsing of SQL queries with prepared statements (#303, #283).

  • Improved error handling for queries that AcraCensor can't parse (#291, #284).

  • Added ability to log unparsed queries to a separate log file for the debugging and configuration purposes. Sometimes AcraCensor can't parse all of the incoming queries and it is useful to have a separate log for them.

  • How to use it: Provide the path to the unparsed queries log file in the configuration file parse_errors_log: unparsed_queries.log (#295).

  • Improved support of PostgreSQL queries ("RETURNING" clause) and quoted identifiers (now you can use "tablename" and WHERE "column"=1) (#296).

  • Fixed the bug in QueryCapture log that caused duplicated of records in the log to appear (#318).

• AcraServer

• • Fixed handling of null-size packets in PostgreSQL protocol (#286).

  • Fixed handling of setting a custom connection API port (#294).

  • Fixed handling of the plain text data response: if the database returns a plain text response, it is redirected "as is" (#305).

  • Fixed handling of casted placeholders in expressions like SELECT $1::type1::type2 FROM table1 WHERE column1=$2::type3::type4 (#328).

  • Improved code quality (some refactoring here and there) (#302, #301).

• AcraServer, AcraTranslator, AcraConnector

• • Refactored logs and error messages got even more descriptive and user-friendly (#312, #299, #317).

  • Added on-start version logging to make it easier to understand which version is running (#319).

  • Added versioning for configuration files of each service (#322).

  • Added exporting version to metrics (#330, #320).

  • Updated some configuration parameters descriptions for better user-friendliness (please see our docs of AcraConnector and AcraServer for detailed descriptions of each parameter and usage examples) (#329).

• AcraWriter

• • Updated AcraWriter for ActiveRecord (Ruby), fixed dependencies, added support of mysql2 adapter (#287).

  • Updated AcraWriter for Django (Python), fixed potential encoding issues (#293, #292).

  • Updated AcraWriter for C++, improved cpp codec usage (#290, #289).

  • Added bitcode for AcraWriter iOS and added Swift example project (#327, #326, #325, #324, #323, #323, #307).

  • Improved distribution of AcraWriter for Android, now it's available via Maven (#310).

• Other

• • Added more tests and then — added even more tests. We just love automating things! (#331, #311, #308, #292).

  • Updated the version of pyyaml used in the tests due to CVE-2017-18342. This change doesn't affect the users of Acra, it only affects our test suite (#300).

Infrastructure

• Updated Docker files, added more comments, and updated Go version (#313, #288).

Example projects and demos

• iOS Swift example project that shows how to generate AcraStructs with and without Zones.

• Android example project that shows how to integrate AcraWriter library into Android app using maven, and then to generate AcraStructs with and without Zones, and to decrypt them using AcraTranslator.

• AcraCensor demo that shows how to configure AcraCensor for SQL injections prevention in OWASP Mutillidae 2 example app.

• Protecting data in a Rails application demo based on AcraServer, PostgreSQL, and Ruby on Rails client application.

• Protecting metrics in TimescaleDB demo based on AcraServer, TimescaleDB, and Grafana.

• Transparent proxy mode demo that shows how to configure AcraServer in Transparent proxy mode to protect Django-based application.

Related blog posts

• The difference between SQL firewalls and Web Application Firewalls.

• Engineering details on how we built AcraCensor.

Features coming soon

• Pseudonymisation: an early version of pseudonymisation library/plugin for Acra for transparent data pseudonymisation.

• Cryptographically protected audit log: protection for logs against tampering.

Documentation

• Updated AcraServer documentation to describe Transparent mode in more details.

• Updated AcraCensor documentation to describe the new configuration format and procedures for migration from the previous one.

• Updated AcraWriter documentation for iOS and Android to reflect the improved installation ways.

Originally we planned to release the new version on the 2nd anniversary of the first public release of Acra on March 7 but decided to have a celebration instead, but it’s still Mercury retrograde and it’s Friday so we’re staying true to the tradition of releasing things on the most jinxed days possible ;).

Enjoy Acra — try it now!