Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified
📁 ..	-	2025-05-25 12:27
📄 aes_cbc.go package s3crypto import ( "bytes" "crypto/aes" "crypto/cipher" "io" ) // AESCBC is a symmetric crypto algorithm. This algorithm // requires a padder due to CBC needing to be of the same block // size. AES CBC is vulnerable to Padding Oracle attacks and // so should be avoided when possible. type aesCBC struct { encrypter cipher.BlockMode decrypter cipher.BlockMode padder Padder } // newAESCBC creates a new AES CBC cipher. Expects keys to be of // the correct size. func newAESCBC(cd CipherData, padder Padder) (Cipher, error) { block, err := aes.NewCipher(cd.Key) if err != nil { return nil, err } encrypter := cipher.NewCBCEncrypter(block, cd.IV) decrypter := cipher.NewCBCDecrypter(block, cd.IV) return &aesCBC{encrypter, decrypter, padder}, nil } // Encrypt will encrypt the data using AES CBC by returning // an io.Reader. The io.Reader will encrypt the data as Read // is called. func (c aesCBC) Encrypt(src io.Reader) io.Reader { reader := &cbcEncryptReader{ encrypter: c.encrypter, src: src, padder: c.padder, } return reader } type cbcEncryptReader struct { encrypter cipher.BlockMode src io.Reader padder Padder size int buf bytes.Buffer } // Read will read from our io.Reader and encrypt the data as necessary. // Due to padding, we have to do some logic that when we encounter an // end of file to pad properly. func (reader cbcEncryptReader) Read(data []byte) (int, error) { n, err := reader.src.Read(data) reader.size += n blockSize := reader.encrypter.BlockSize() reader.buf.Write(data[:n]) if err == io.EOF { b := make([]byte, getSliceSize(blockSize, reader.buf.Len(), len(data))) n, err = reader.buf.Read(b) if err != nil && err != io.EOF { return n, err } // The buffer is now empty, we can now pad the data if reader.buf.Len() == 0 { b, err = reader.padder.Pad(b[:n], reader.size) if err != nil { return n, err } n = len(b) err = io.EOF } // We only want to encrypt if we have read anything if n > 0 { reader.encrypter.CryptBlocks(data, b) } return n, err } if err != nil { return n, err } if size := reader.buf.Len(); size >= blockSize { nBlocks := size / blockSize if size > len(data) { nBlocks = len(data) / blockSize } if nBlocks > 0 { b := make([]byte, nBlocksblockSize) n, _ = reader.buf.Read(b) reader.encrypter.CryptBlocks(data, b[:n]) } } else { n = 0 } return n, nil } // Decrypt will decrypt the data using AES CBC func (c aesCBC) Decrypt(src io.Reader) io.Reader { return &cbcDecryptReader{ decrypter: c.decrypter, src: src, padder: c.padder, } } type cbcDecryptReader struct { decrypter cipher.BlockMode src io.Reader padder Padder buf bytes.Buffer } // Read will read from our io.Reader and decrypt the data as necessary. // Due to padding, we have to do some logic that when we encounter an // end of file to pad properly. func (reader cbcDecryptReader) Read(data []byte) (int, error) { n, err := reader.src.Read(data) blockSize := reader.decrypter.BlockSize() reader.buf.Write(data[:n]) if err == io.EOF { b := make([]byte, getSliceSize(blockSize, reader.buf.Len(), len(data))) n, err = reader.buf.Read(b) if err != nil && err != io.EOF { return n, err } // We only want to decrypt if we have read anything if n > 0 { reader.decrypter.CryptBlocks(data, b) } if reader.buf.Len() == 0 { b, err = reader.padder.Unpad(data[:n]) n = len(b) if err != nil { return n, err } err = io.EOF } return n, err } if err != nil { return n, err } if size := reader.buf.Len(); size >= blockSize { nBlocks := size / blockSize if size > len(data) { nBlocks = len(data) / blockSize } // The last block is always padded. This will allow us to unpad // when we receive an io.EOF error nBlocks -= blockSize if nBlocks > 0 { b := make([]byte, nBlocksblockSize) n, _ = reader.buf.Read(b) reader.decrypter.CryptBlocks(data, b[:n]) } else { n = 0 } } return n, nil } // getSliceSize will return the correct amount of bytes we need to // read with regards to padding. func getSliceSize(blockSize, bufSize, dataSize int) int { size := bufSize if bufSize > dataSize { size = dataSize } size = size - (size % blockSize) - blockSize if size <= 0 { size = blockSize } return size }	4.29 KB	2025-05-25 12:27
📄 aes_cbc_content_cipher.go package s3crypto import ( "io" ) const ( cbcKeySize = 32 cbcNonceSize = 16 ) type cbcContentCipherBuilder struct { generator CipherDataGenerator padder Padder } // AESCBCContentCipherBuilder returns a new encryption only AES/CBC mode structure using the provided padder. The provided cipher data generator // will be used to provide keys for content encryption. // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func AESCBCContentCipherBuilder(generator CipherDataGenerator, padder Padder) ContentCipherBuilder { return cbcContentCipherBuilder{generator: generator, padder: padder} } // RegisterAESCBCContentCipher registers the AES/CBC cipher and padder with the provided CryptoRegistry. // // Example: // // cr := s3crypto.NewCryptoRegistry() // if err := s3crypto.RegisterAESCBCContentCipher(cr, s3crypto.AESCBCPadder); err != nil { // panic(err) // handle error // } // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func RegisterAESCBCContentCipher(registry CryptoRegistry, padder Padder) error { if registry == nil { return errNilCryptoRegistry } name := AESCBC + "/" + padder.Name() err := registry.AddCEK(name, newAESCBCContentCipher) if err != nil { return err } if err := registry.AddPadder(name, padder); err != nil { return err } return nil } func (builder cbcContentCipherBuilder) ContentCipher() (ContentCipher, error) { cd, err := builder.generator.GenerateCipherData(cbcKeySize, cbcNonceSize) if err != nil { return nil, err } cd.Padder = builder.padder return newAESCBCContentCipher(cd) } func (builder cbcContentCipherBuilder) isAWSFixture() bool { return true } func (cbcContentCipherBuilder) isEncryptionVersionCompatible(version clientVersion) error { if version != v1ClientVersion { return errDeprecatedIncompatibleCipherBuilder } return nil } // newAESCBCContentCipher will create a new aes cbc content cipher. If the cipher data's // will set the cek algorithm if it hasn't been set. func newAESCBCContentCipher(cd CipherData) (ContentCipher, error) { if len(cd.CEKAlgorithm) == 0 { cd.CEKAlgorithm = AESCBC + "/" + cd.Padder.Name() } cipher, err := newAESCBC(cd, cd.Padder) if err != nil { return nil, err } return &aesCBCContentCipher{ CipherData: cd, Cipher: cipher, }, nil } // aesCBCContentCipher will use AES CBC for the main cipher. type aesCBCContentCipher struct { CipherData CipherData Cipher Cipher } // EncryptContents will generate a random key and iv and encrypt the data using cbc func (cc aesCBCContentCipher) EncryptContents(src io.Reader) (io.Reader, error) { return cc.Cipher.Encrypt(src), nil } // DecryptContents will use the symmetric key provider to instantiate a new CBC cipher. // We grab a decrypt reader from CBC and wrap it in a CryptoReadCloser. The only error // expected here is when the key or iv is of invalid length. func (cc aesCBCContentCipher) DecryptContents(src io.ReadCloser) (io.ReadCloser, error) { reader := cc.Cipher.Decrypt(src) return &CryptoReadCloser{Body: src, Decrypter: reader}, nil } // GetCipherData returns cipher data func (cc aesCBCContentCipher) GetCipherData() CipherData { return cc.CipherData } var ( _ ContentCipherBuilder = (cbcContentCipherBuilder)(nil) _ compatibleEncryptionFixture = (cbcContentCipherBuilder)(nil) _ awsFixture = (cbcContentCipherBuilder)(nil) _ ContentCipher = (*aesCBCContentCipher)(nil) )	3.62 KB	2025-05-25 12:27
📄 aes_cbc_content_cipher_test.go package s3crypto import ( "strings" "testing" ) func TestAESCBCBuilder(t testing.T) { generator := mockGenerator{} builder := AESCBCContentCipherBuilder(generator, NoPadder) if builder == nil { t.Fatal(builder) } _, err := builder.ContentCipher() if err != nil { t.Fatal(err) } } func TestAesCBCContentCipher_isFixtureEncryptionCompatible(t testing.T) { generator := mockGenerator{} builder := AESCBCContentCipherBuilder(generator, NoPadder) if builder == nil { t.Fatal("expected builder to not be nil") } compatibility, ok := builder.(compatibleEncryptionFixture) if !ok { t.Fatal("expected builder to implement compatibleEncryptionFixture interface") } if err := compatibility.isEncryptionVersionCompatible(v1ClientVersion); err != nil { t.Errorf("expected builder to be compatible with v1 client") } if err := compatibility.isEncryptionVersionCompatible(v2ClientVersion); err == nil { t.Errorf("expected builder to not be compatible with v2 client") } } func TestRegisterAESCBCContentCipher(t *testing.T) { cr := NewCryptoRegistry() padder := AESCBCPadder err := RegisterAESCBCContentCipher(cr, padder) if err != nil { t.Fatalf("expected no error, got %v", err) } if v, ok := cr.GetCEK("AES/CBC/PKCS5Padding"); !ok { t.Fatal("expected cek algorithm handler to registered") } else if v == nil { t.Fatal("expected non-nil cek handler to be registered") } if v, ok := cr.GetPadder("AES/CBC/PKCS5Padding"); !ok { t.Fatal("expected padder to be registered") } else if v != padder { t.Fatal("padder did not match provided value") } // try to register padder again err = RegisterAESCBCContentCipher(cr, padder) if err == nil { t.Fatal("expected error, got none") } else if !strings.Contains(err.Error(), "duplicate cek registry entry") { t.Errorf("expected duplicate cek entry, got %v", err) } // try to regster padder with cek removed but padder entry still present if _, ok := cr.RemoveCEK("AES/CBC/PKCS5Padding"); !ok { t.Fatalf("expected value to be removed") } err = RegisterAESCBCContentCipher(cr, padder) if err == nil { t.Fatal("expected error, got none") } else if !strings.Contains(err.Error(), "duplicate padder registry entry") { t.Errorf("expected duplicate padder entry, got %v", err) } }	2.23 KB	2025-05-25 12:27
📄 aes_cbc_padder.go package s3crypto const ( pkcs5BlockSize = 16 ) var aescbcPadding = aescbcPadder{pkcs7Padder{16}} // AESCBCPadder is used to pad AES encrypted and decrypted data. // Although it uses the pkcs5Padder, it isn't following the RFC // for PKCS5. The only reason why it is called pkcs5Padder is // due to the Name returning PKCS5Padding. var AESCBCPadder = Padder(aescbcPadding) type aescbcPadder struct { padder pkcs7Padder } func (padder aescbcPadder) Pad(b []byte, n int) ([]byte, error) { return padder.padder.Pad(b, n) } func (padder aescbcPadder) Unpad(b []byte) ([]byte, error) { return padder.padder.Unpad(b) } func (padder aescbcPadder) Name() string { return "PKCS5Padding" }	691 B	2025-05-25 12:27
📄 aes_cbc_padder_test.go package s3crypto import ( "bytes" "fmt" "testing" ) func TestAESCBCPadding(t testing.T) { for i := 0; i < 16; i++ { input := make([]byte, i) expected := append(input, bytes.Repeat([]byte{byte(16 - i)}, 16-i)...) b, err := AESCBCPadder.Pad(input, len(input)) if err != nil { t.Fatal("Expected error to be nil but received " + err.Error()) } if len(b) != len(expected) { t.Fatal(fmt.Sprintf("Case %d: data is not of the same length", i)) } if bytes.Compare(b, expected) != 0 { t.Fatal(fmt.Sprintf("Expected %v but got %v", expected, b)) } } } func TestAESCBCUnpadding(t testing.T) { for i := 0; i < 16; i++ { expected := make([]byte, i) input := append(expected, bytes.Repeat([]byte{byte(16 - i)}, 16-i)...) b, err := AESCBCPadder.Unpad(input) if err != nil { t.Fatal("Error received, was expecting nil: " + err.Error()) } if len(b) != len(expected) { t.Fatal(fmt.Sprintf("Case %d: data is not of the same length", i)) } if bytes.Compare(b, expected) != 0 { t.Fatal(fmt.Sprintf("Expected %v but got %v", expected, b)) } } }	1.06 KB	2025-05-25 12:27
📄 aes_cbc_test.go package s3crypto import ( "bytes" "encoding/hex" "fmt" "io" "testing" ) func TestAESCBCEncryptDecrypt(t *testing.T) { var testCases = []struct { key string iv string plaintext string ciphertext string decodeHex bool padder Padder }{ // Test vectors from RFC 3602: https://tools.ietf.org/html/rfc3602 { "06a9214036b8a15b512e03d534120006", "3dafba429d9eb430b422da802c9fac41", "Single block msg", "e353779c1079aeb82708942dbe77181a", false, NoPadder, }, { "c286696d887c9aa0611bbb3e2025a45a", "562e17996d093d28ddb3ba695a2e6f58", "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "d296cd94c2cccf8a3a863028b5e1dc0a7586602d253cfff91b8266bea6d61ab1", true, NoPadder, }, { "6c3ea0477630ce21a2ce334aa746c2cd", "c782dc4c098c66cbd9cd27d825682c81", "This is a 48-byte message (exactly 3 AES blocks)", "d0a02b3836451753d493665d33f0e8862dea54cdb293abc7506939276772f8d5021c19216bad525c8579695d83ba2684", false, NoPadder, }, { "56e47a38c5598974bc46903dba290349", "8ce82eefbea0da3c44699ed7db51b7d9", "a0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedf", "c30e32ffedc0774e6aff6af0869f71aa0f3af07a9a31a9c684db207eb0ef8e4e35907aa632c3ffdf868bb7b29d3d46ad83ce9f9a102ee99d49a53e87f4c3da55", true, NoPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "", "B012949BA07D1A6DCE9DEE67274D41AB", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41", "8A11ABA68A566132FFE04DB336621D41", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141", "97D0896E41DFDB5CEA4A9EB70A938CFD", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141", "8464EAD45FA2D8790E8741E32C28083F", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141", "1E656D6E2745BA9F154FAF136B2BC73D", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141", "0B6031C4B230DAC6BD6D3F195645B287", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141", "5D09FEB6462BB489489A7E18FD341D9D", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141", "85745E398F2FD1050C2CE8F8614DA369", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141", "7BE52933970BA7B0FC6FB3FC37648205", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141", "ED3A1E134EF36CCFE60C8123B4272F89", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141", "C3B7C9E177E1052FC736F65FC1E74209", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141", "C3A8B53F7F57F0B9D346FA99810A3C28", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141", "D16B1ECE5BF00AF919E139E99775FF06", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141", "B258F4DF57FFCA1EFCF8D76140F05139", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141", "3CD2282DE24A2CF9E23326CC3DC9077A", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141", "3010232E7C752A3B4C9EE428B4C4FE88", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A22BC4E6D03BFD2418DD412D1ED1B31AF", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A5427BBD4A4D50776989441370E3B5B16", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A7FF985F55567D1B25EA40E23BB4CB1FE", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A0835E548C7370D8F8D9925C0E6B54727", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ADC0CF1436399E67BC1122B31CB596649", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A3D096F0DEAFF91938B82E5D404B0B065", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217AD56ABA897A355CF307CCB74226243192", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A151284F950B1B1DBCAD6D9E7900DF4E6", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217AEF85A612514121C299A1D87116C4A182", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A67F157569BFB4013EA3AD16DB8C69AD6", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217AF8520D191F6ACBD88B2140588B91C697", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ADD8BBAA71745669B96F2683E2F5AEC35", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217AFB2D4282817D7EC6B33EFAD7AA14A3C5", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A459B89E7E0DAF3DA654576B60B2DA7CE", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A65759F23F9789D05B23D5DBAA9E32036", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217A03C78FBD5E2CB08B3B6D181E23FBDE79", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA013D941FBBDE56C106C482CD022F290F", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA0645D313AC3C29B79DB1AA2E00A5B393", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA2ED0FD8048053BF22EBE501D82C4B3F1", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CAC57D706C7866A01D6E913F98AE57EE54", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CAB7FC1241FAFDFE45C4FF982D5DC1DAEF", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA7063EA296922DE8BDFD3B29D786C5F91", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA3A4603475F4AFDBFADC6E7FA908188B1", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA3365C63C2AF2A6C8FB4D0E9ED3C6FDA3", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA78BCC1874C0B7EB52645FC8F03B9C9CF", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA9B7A31397718EECB89B9E9CCCD729326", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CAB15EA8A67E9E9FADB4249710277F3D4F", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA94641D6A076193C660632CEA3F9CB02C", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CAB2170A08417BE77F0EAA9110F4790E12", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA4E30F1CD7B2256ABD57DC3DAB05376C9", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA9909B7B93D01BDAAC22D15AF34DF1EEF", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CAD97F5D1206F00E5C7225CAD81CCD4027", true, AESCBCPadder, }, { "11111111111111111111111111111111", "22222222222222222222222222222222", "414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141", "C3304FA46097CBBA59085416764A217ACEF79EE1163A2F52888F87A3979EB3CA570CBB001A0C87558906B60C884AB5F41DA97CEF2A9401BC6DD0D22A54DBAD6D", true, AESCBCPadder, }, } for i, testCase := range testCases { key, _ := hex.DecodeString(testCase.key) iv, _ := hex.DecodeString(testCase.iv) cd := CipherData{ Key: key, IV: iv, } cbc, err := newAESCBC(cd, testCase.padder) if err != nil { t.Fatal(fmt.Sprintf("Case %d: Expected no error for cipher creation, but received: %v", i, err.Error())) } plaintext := []byte(testCase.plaintext) if testCase.decodeHex { plaintext, _ = hex.DecodeString(testCase.plaintext) } cipherdata := cbc.Encrypt(bytes.NewReader(plaintext)) ciphertext := []byte{} b := make([]byte, 19) err = nil n := 0 for err != io.EOF { n, err = cipherdata.Read(b) ciphertext = append(ciphertext, b[:n]...) } if err != io.EOF { t.Fatal(fmt.Sprintf("Case %d: Expected no error during io reading, but received: %v", i, err.Error())) } expectedData, _ := hex.DecodeString(testCase.ciphertext) if bytes.Compare(expectedData, ciphertext) != 0 { t.Log("\n", ciphertext, "\n", expectedData) t.Fatal(fmt.Sprintf("Case %d: AES CBC encryption fails. Data is not the same", i)) } plaindata := cbc.Decrypt(bytes.NewReader(ciphertext)) plaintextDecrypted := []byte{} err = nil for err != io.EOF { n, err = plaindata.Read(b) plaintextDecrypted = append(plaintextDecrypted, b[:n]...) } if err != io.EOF { t.Fatal(fmt.Sprintf("Case %d: Expected no error during io reading, but received: %v", i, err.Error())) } if bytes.Compare(plaintext, plaintextDecrypted) != 0 { t.Log("\n", plaintext, "\n", plaintextDecrypted) t.Fatal(fmt.Sprintf("Case %d: AES CBC decryption fails. Data is not the same", i)) } } }	14.49 KB	2025-05-25 12:27
📄 aes_gcm.go package s3crypto import ( "bytes" "crypto/aes" "crypto/cipher" "io" "io/ioutil" ) // AESGCM Symmetric encryption algorithm. Since Golang designed this // with only TLS in mind. We have to load it all into memory meaning // this isn't streamed. type aesGCM struct { aead cipher.AEAD nonce []byte } // newAESGCM creates a new AES GCM cipher. Expects keys to be of // the correct size. // // Example: // // cd := &s3crypto.CipherData{ // Key: key, // "IV": iv, // } // cipher, err := s3crypto.newAESGCM(cd) func newAESGCM(cd CipherData) (Cipher, error) { block, err := aes.NewCipher(cd.Key) if err != nil { return nil, err } aesgcm, err := cipher.NewGCM(block) if err != nil { return nil, err } return &aesGCM{aesgcm, cd.IV}, nil } // Encrypt will encrypt the data using AES GCM // Tag will be included as the last 16 bytes of the slice func (c aesGCM) Encrypt(src io.Reader) io.Reader { reader := &gcmEncryptReader{ encrypter: c.aead, nonce: c.nonce, src: src, } return reader } type gcmEncryptReader struct { encrypter cipher.AEAD nonce []byte src io.Reader buf bytes.Buffer } func (reader gcmEncryptReader) Read(data []byte) (int, error) { if reader.buf == nil { b, err := ioutil.ReadAll(reader.src) if err != nil { return 0, err } b = reader.encrypter.Seal(b[:0], reader.nonce, b, nil) reader.buf = bytes.NewBuffer(b) } return reader.buf.Read(data) } // Decrypt will decrypt the data using AES GCM func (c aesGCM) Decrypt(src io.Reader) io.Reader { return &gcmDecryptReader{ decrypter: c.aead, nonce: c.nonce, src: src, } } type gcmDecryptReader struct { decrypter cipher.AEAD nonce []byte src io.Reader buf bytes.Buffer } func (reader gcmDecryptReader) Read(data []byte) (int, error) { if reader.buf == nil { b, err := ioutil.ReadAll(reader.src) if err != nil { return 0, err } b, err = reader.decrypter.Open(b[:0], reader.nonce, b, nil) if err != nil { return 0, err } reader.buf = bytes.NewBuffer(b) } return reader.buf.Read(data) }	2.04 KB	2025-05-25 12:27
📄 aes_gcm_content_cipher.go package s3crypto import ( "fmt" "io" "github.com/aws/aws-sdk-go/aws" ) const ( gcmKeySize = 32 gcmNonceSize = 12 ) // AESGCMContentCipherBuilder returns a new encryption only AES/GCM mode structure with a specific cipher data generator // that will provide keys to be used for content encryption. // // Note: This uses the Go stdlib AEAD implementation for AES/GCM. Due to this objects to be encrypted or decrypted // will be fully loaded into memory before encryption or decryption can occur. Caution must be taken to avoid memory // allocation failures. // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func AESGCMContentCipherBuilder(generator CipherDataGenerator) ContentCipherBuilder { return gcmContentCipherBuilder{generator} } // AESGCMContentCipherBuilderV2 returns a new encryption only AES/GCM mode structure with a specific cipher data generator // that will provide keys to be used for content encryption. This type is compatible with the V2 encryption client. // // Note: This uses the Go stdlib AEAD implementation for AES/GCM. Due to this objects to be encrypted or decrypted // will be fully loaded into memory before encryption or decryption can occur. Caution must be taken to avoid memory // allocation failures. func AESGCMContentCipherBuilderV2(generator CipherDataGeneratorWithCEKAlg) ContentCipherBuilder { return gcmContentCipherBuilderV2{generator} } // RegisterAESGCMContentCipher registers the AES/GCM content cipher algorithm with the provided CryptoRegistry. // // Example: // // cr := s3crypto.NewCryptoRegistry() // if err := s3crypto.RegisterAESGCMContentCipher(cr); err != nil { // panic(err) // handle error // } func RegisterAESGCMContentCipher(registry CryptoRegistry) error { if registry == nil { return errNilCryptoRegistry } err := registry.AddCEK(AESGCMNoPadding, newAESGCMContentCipher) if err != nil { return err } // NoPadder is generic but required by this algorithm, so if it is already registered and is the expected implementation // don't error. padderName := NoPadder.Name() if v, ok := registry.GetPadder(padderName); !ok { if err := registry.AddPadder(padderName, NoPadder); err != nil { return err } } else if _, ok := v.(noPadder); !ok { return fmt.Errorf("%s is already registred but does not match expected type %T", padderName, NoPadder) } return nil } // gcmContentCipherBuilder is a AES/GCM content cipher to be used with the V1 client CipherDataGenerator interface type gcmContentCipherBuilder struct { generator CipherDataGenerator } func (builder gcmContentCipherBuilder) ContentCipher() (ContentCipher, error) { return builder.ContentCipherWithContext(aws.BackgroundContext()) } func (builder gcmContentCipherBuilder) ContentCipherWithContext(ctx aws.Context) (ContentCipher, error) { var cd CipherData var err error switch v := builder.generator.(type) { case CipherDataGeneratorWithContext: cd, err = v.GenerateCipherDataWithContext(ctx, gcmKeySize, gcmNonceSize) default: cd, err = builder.generator.GenerateCipherData(gcmKeySize, gcmNonceSize) } if err != nil { return nil, err } return newAESGCMContentCipher(cd) } // isFixtureEncryptionCompatible will ensure that this type may only be used with the V1 client func (builder gcmContentCipherBuilder) isEncryptionVersionCompatible(version clientVersion) error { if version != v1ClientVersion { return errDeprecatedIncompatibleCipherBuilder } return nil } func (builder gcmContentCipherBuilder) isAWSFixture() bool { return true } // gcmContentCipherBuilderV2 return a new builder for encryption content using AES/GCM/NoPadding. This type is meant // to be used with key wrapping implementations that allow the cek algorithm to be provided when calling the // cipher data generator. type gcmContentCipherBuilderV2 struct { generator CipherDataGeneratorWithCEKAlg } func (builder gcmContentCipherBuilderV2) ContentCipher() (ContentCipher, error) { return builder.ContentCipherWithContext(aws.BackgroundContext()) } func (builder gcmContentCipherBuilderV2) ContentCipherWithContext(ctx aws.Context) (ContentCipher, error) { cd, err := builder.generator.GenerateCipherDataWithCEKAlg(ctx, gcmKeySize, gcmNonceSize, AESGCMNoPadding) if err != nil { return nil, err } return newAESGCMContentCipher(cd) } // isFixtureEncryptionCompatible will ensure that this type may only be used with the V2 client func (builder gcmContentCipherBuilderV2) isEncryptionVersionCompatible(version clientVersion) error { if version != v2ClientVersion { return errDeprecatedIncompatibleCipherBuilder } return nil } // isAWSFixture will return whether this type was constructed with an AWS provided CipherDataGenerator func (builder gcmContentCipherBuilderV2) isAWSFixture() bool { v, ok := builder.generator.(awsFixture) return ok && v.isAWSFixture() } func newAESGCMContentCipher(cd CipherData) (ContentCipher, error) { cd.CEKAlgorithm = AESGCMNoPadding cd.TagLength = "128" cipher, err := newAESGCM(cd) if err != nil { return nil, err } return &aesGCMContentCipher{ CipherData: cd, Cipher: cipher, }, nil } // AESGCMContentCipher will use AES GCM for the main cipher. type aesGCMContentCipher struct { CipherData CipherData Cipher Cipher } // EncryptContents will generate a random key and iv and encrypt the data using cbc func (cc aesGCMContentCipher) EncryptContents(src io.Reader) (io.Reader, error) { return cc.Cipher.Encrypt(src), nil } // DecryptContents will use the symmetric key provider to instantiate a new GCM cipher. // We grab a decrypt reader from gcm and wrap it in a CryptoReadCloser. The only error // expected here is when the key or iv is of invalid length. func (cc aesGCMContentCipher) DecryptContents(src io.ReadCloser) (io.ReadCloser, error) { reader := cc.Cipher.Decrypt(src) return &CryptoReadCloser{Body: src, Decrypter: reader}, nil } // GetCipherData returns cipher data func (cc aesGCMContentCipher) GetCipherData() CipherData { return cc.CipherData } // assert ContentCipherBuilder implementations var ( _ ContentCipherBuilder = (gcmContentCipherBuilder)(nil) _ ContentCipherBuilder = (gcmContentCipherBuilderV2)(nil) ) // assert ContentCipherBuilderWithContext implementations var ( _ ContentCipherBuilderWithContext = (gcmContentCipherBuilder)(nil) _ ContentCipherBuilderWithContext = (gcmContentCipherBuilderV2)(nil) ) // assert ContentCipher implementations var ( _ ContentCipher = (aesGCMContentCipher)(nil) ) // assert awsFixture implementations var ( _ awsFixture = (*gcmContentCipherBuilderV2)(nil) )	6.57 KB	2025-05-25 12:27
📄 aes_gcm_content_cipher_test.go package s3crypto import ( "strings" "testing" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/kms" ) func TestAESGCMContentCipherBuilder(t testing.T) { generator := mockGenerator{} if builder := AESGCMContentCipherBuilder(generator); builder == nil { t.Error("expected non-nil value") } } func TestAESGCMContentCipherNewEncryptor(t testing.T) { generator := mockGenerator{} builder := AESGCMContentCipherBuilder(generator) cipher, err := builder.ContentCipher() if err != nil { t.Errorf("expected no error, but received %v", err) } if cipher == nil { t.Errorf("expected non-nil vaue") } } func TestAESGCMContentCipherBuilderV2(t testing.T) { builder := AESGCMContentCipherBuilderV2(mockGeneratorV2{}) cipher, err := builder.ContentCipher() if err != nil { t.Errorf("expected no error, but received %v", err) } if cipher == nil { t.Errorf("expected non-nil vaue") } } func TestGcmContentCipherBuilder_isFixtureEncryptionCompatible(t testing.T) { builder := AESGCMContentCipherBuilder(NewKMSKeyGenerator(mockKMS{}, "cmkID")) features, ok := builder.(compatibleEncryptionFixture) if !ok { t.Errorf("expected to implement compatibleEncryptionFixture interface") } if err := features.isEncryptionVersionCompatible(v1ClientVersion); err != nil { t.Errorf("expected to receive no error, got %v", err) } if err := features.isEncryptionVersionCompatible(v2ClientVersion); err == nil { t.Errorf("expected to receive error, got nil") } } func TestGcmContentCipherBuilderV2_isFixtureEncryptionCompatible(t testing.T) { builder := AESGCMContentCipherBuilderV2(NewKMSContextKeyGenerator(mockKMS{}, "cmkID", nil)) features, ok := builder.(compatibleEncryptionFixture) if !ok { t.Errorf("expected to implement compatibleEncryptionFixture interface") } if err := features.isEncryptionVersionCompatible(v1ClientVersion); err == nil { t.Error("expected to receive error, got nil") } if err := features.isEncryptionVersionCompatible(v2ClientVersion); err != nil { t.Errorf("expected to receive no error, got %v", err) } } func TestRegisterAESGCMContentCipher(t testing.T) { cr := NewCryptoRegistry() err := RegisterAESGCMContentCipher(cr) if err != nil { t.Fatalf("expected no error, got %v", err) } if v, ok := cr.GetCEK("AES/GCM/NoPadding"); !ok { t.Fatal("expected cek handler to be registered") } else if v == nil { t.Fatal("expected non-nil cek handler") } if v, ok := cr.GetPadder("NoPadding"); !ok { t.Fatal("expected padder to be registered") } else if v != NoPadder { t.Fatal("padder did not match expected type") } err = RegisterAESGCMContentCipher(cr) if err == nil { t.Fatal("expected error, got none") } else if !strings.Contains(err.Error(), "duplicate cek registry entry") { t.Errorf("expected duplicate entry, got %v", err) } if _, ok := cr.RemoveCEK("AES/GCM/NoPadding"); !ok { t.Error("expected value to be removed") } err = RegisterAESGCMContentCipher(cr) if err != nil { t.Fatalf("expected no error, got %v", err) } if _, ok := cr.RemoveCEK("AES/GCM/NoPadding"); !ok { t.Fatalf("expected value to be removed") } if _, ok := cr.RemovePadder("NoPadding"); !ok { t.Fatalf("expected value to be removed") } if err := cr.AddPadder("NoPadding", mockPadder{}); err != nil { t.Fatalf("expected no error, got %v", err) } err = RegisterAESGCMContentCipher(cr) if err == nil { t.Fatalf("expected error, got %v", err) } else if !strings.Contains(err.Error(), "does not match expected type") { t.Errorf("expected padder type error, got %v", err) } } func TestAESGCMContentCipherBuilderV2_isAWSFixture(t *testing.T) { builder := AESGCMContentCipherBuilderV2(NewKMSContextKeyGenerator(kms.New(unit.Session.Copy()), "cmk", nil)) if !builder.(awsFixture).isAWSFixture() { t.Error("expected to be AWS ContentCipherBuilder constructed with a AWS CipherDataGenerator") } builder = AESGCMContentCipherBuilderV2(mockGeneratorV2{}) if builder.(awsFixture).isAWSFixture() { t.Error("expected to return that this is not an AWS fixture") } }	4.01 KB	2025-05-25 12:27
📄 aes_gcm_test.go //go:build go1.9 // +build go1.9 package s3crypto import ( "bytes" "encoding/hex" "encoding/json" "fmt" "io" "io/ioutil" "strings" "testing" ) // AES GCM func TestAES_GCM_NIST_gcmEncryptExtIV256_PTLen_128_Test_0(t testing.T) { iv, _ := hex.DecodeString("0d18e06c7c725ac9e362e1ce") key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") plaintext, _ := hex.DecodeString("2db5168e932556f8089a0622981d017d") expected, _ := hex.DecodeString("fa4362189661d163fcd6a56d8bf0405a") tag, _ := hex.DecodeString("d636ac1bbedd5cc3ee727dc2ab4a9489") aesgcmTest(t, iv, key, plaintext, expected, tag) } func TestAES_GCM_NIST_gcmEncryptExtIV256_PTLen_104_Test_3(t testing.T) { iv, _ := hex.DecodeString("4742357c335913153ff0eb0f") key, _ := hex.DecodeString("e5a0eb92cc2b064e1bc80891faf1fab5e9a17a9c3a984e25416720e30e6c2b21") plaintext, _ := hex.DecodeString("8499893e16b0ba8b007d54665a") expected, _ := hex.DecodeString("eb8e6175f1fe38eb1acf95fd51") tag, _ := hex.DecodeString("88a8b74bb74fda553e91020a23deed45") aesgcmTest(t, iv, key, plaintext, expected, tag) } func TestAES_GCM_NIST_gcmEncryptExtIV256_PTLen_256_Test_6(t testing.T) { iv, _ := hex.DecodeString("a291484c3de8bec6b47f525f") key, _ := hex.DecodeString("37f39137416bafde6f75022a7a527cc593b6000a83ff51ec04871a0ff5360e4e") plaintext, _ := hex.DecodeString("fafd94cede8b5a0730394bec68a8e77dba288d6ccaa8e1563a81d6e7ccc7fc97") expected, _ := hex.DecodeString("44dc868006b21d49284016565ffb3979cc4271d967628bf7cdaf86db888e92e5") tag, _ := hex.DecodeString("01a2b578aa2f41ec6379a44a31cc019c") aesgcmTest(t, iv, key, plaintext, expected, tag) } func TestAES_GCM_NIST_gcmEncryptExtIV256_PTLen_408_Test_8(t testing.T) { iv, _ := hex.DecodeString("92f258071d79af3e63672285") key, _ := hex.DecodeString("595f259c55abe00ae07535ca5d9b09d6efb9f7e9abb64605c337acbd6b14fc7e") plaintext, _ := hex.DecodeString("a6fee33eb110a2d769bbc52b0f36969c287874f665681477a25fc4c48015c541fbe2394133ba490a34ee2dd67b898177849a91") expected, _ := hex.DecodeString("bbca4a9e09ae9690c0f6f8d405e53dccd666aa9c5fa13c8758bc30abe1ddd1bcce0d36a1eaaaaffef20cd3c5970b9673f8a65c") tag, _ := hex.DecodeString("26ccecb9976fd6ac9c2c0f372c52c821") aesgcmTest(t, iv, key, plaintext, expected, tag) } type KAT struct { IV string `json:"iv"` Key string `json:"key"` Plaintext string `json:"pt"` AAD string `json:"aad"` CipherText string `json:"ct"` Tag string `json:"tag"` } func TestAES_GCM_KATS(t testing.T) { fileContents, err := ioutil.ReadFile("testdata/aes_gcm.json") if err != nil { t.Fatalf("failed to read KAT file: %v", err) } var kats []KAT err = json.Unmarshal(fileContents, &kats) if err != nil { t.Fatalf("failed to unmarshal KAT json file: %v", err) } for i, kat := range kats { t.Run(fmt.Sprintf("Case%d", i), func(t testing.T) { if len(kat.AAD) > 0 { t.Skip("Skipping... SDK implementation does not expose additional authenticated data") } iv, err := hex.DecodeString(kat.IV) if err != nil { t.Fatalf("failed to decode iv: %v", err) } key, err := hex.DecodeString(kat.Key) if err != nil { t.Fatalf("failed to decode key: %v", err) } plaintext, err := hex.DecodeString(kat.Plaintext) if err != nil { t.Fatalf("failed to decode plaintext: %v", err) } ciphertext, err := hex.DecodeString(kat.CipherText) if err != nil { t.Fatalf("failed to decode ciphertext: %v", err) } tag, err := hex.DecodeString(kat.Tag) if err != nil { t.Fatalf("failed to decode tag: %v", err) } aesgcmTest(t, iv, key, plaintext, ciphertext, tag) }) } } func TestGCMEncryptReader_SourceError(t testing.T) { gcm := &gcmEncryptReader{ encrypter: &mockCipherAEAD{}, src: &mockSourceReader{err: fmt.Errorf("test read error")}, } b := make([]byte, 10) n, err := gcm.Read(b) if err == nil { t.Fatalf("expected error, but got nil") } else if err != nil && !strings.Contains(err.Error(), "test read error") { t.Fatalf("expected source read error, but got %v", err) } if n != 0 { t.Errorf("expected number of read bytes to be zero, but got %v", n) } } func TestGCMDecryptReader_SourceError(t testing.T) { gcm := &gcmDecryptReader{ decrypter: &mockCipherAEAD{}, src: &mockSourceReader{err: fmt.Errorf("test read error")}, } b := make([]byte, 10) n, err := gcm.Read(b) if err == nil { t.Fatalf("expected error, but got nil") } else if err != nil && !strings.Contains(err.Error(), "test read error") { t.Fatalf("expected source read error, but got %v", err) } if n != 0 { t.Errorf("expected number of read bytes to be zero, but got %v", n) } } func TestGCMDecryptReader_DecrypterOpenError(t testing.T) { gcm := &gcmDecryptReader{ decrypter: &mockCipherAEAD{openError: fmt.Errorf("test open error")}, src: &mockSourceReader{err: io.EOF}, } b := make([]byte, 10) n, err := gcm.Read(b) if err == nil { t.Fatalf("expected error, but got nil") } else if err != nil && !strings.Contains(err.Error(), "test open error") { t.Fatalf("expected source read error, but got %v", err) } if n != 0 { t.Errorf("expected number of read bytes to be zero, but got %v", n) } } func aesgcmTest(t testing.T, iv, key, plaintext, expected, tag []byte) { t.Helper() const gcmTagSize = 16 cd := CipherData{ Key: key, IV: iv, } gcm, err := newAESGCM(cd) if err != nil { t.Errorf("expected no error, but received %v", err) } cipherdata := gcm.Encrypt(bytes.NewReader(plaintext)) ciphertext, err := ioutil.ReadAll(cipherdata) if err != nil { t.Errorf("expected no error, but received %v", err) } // splitting tag and ciphertext etag := ciphertext[len(ciphertext)-gcmTagSize:] if !bytes.Equal(etag, tag) { t.Errorf("expected tags to be equivalent") } if !bytes.Equal(ciphertext[:len(ciphertext)-gcmTagSize], expected) { t.Errorf("expected ciphertext to be equivalent") } data := gcm.Decrypt(bytes.NewReader(ciphertext)) text, err := ioutil.ReadAll(data) if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(plaintext, text) { t.Errorf("expected ciphertext to be equivalent") } } type mockSourceReader struct { n int err error } func (b mockSourceReader) Read(p []byte) (n int, err error) { return b.n, b.err } type mockCipherAEAD struct { seal []byte openError error } func (m mockCipherAEAD) NonceSize() int { panic("implement me") } func (m mockCipherAEAD) Overhead() int { panic("implement me") } func (m mockCipherAEAD) Seal(dst, nonce, plaintext, additionalData []byte) []byte { return m.seal } func (m mockCipherAEAD) Open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) { return []byte("mocked decrypt"), m.openError }	6.63 KB	2025-05-25 12:27
📄 cipher.go package s3crypto import ( "io" ) // Cipher interface allows for either encryption and decryption of an object type Cipher interface { Encrypter Decrypter } // Encrypter interface with only the encrypt method type Encrypter interface { Encrypt(io.Reader) io.Reader } // Decrypter interface with only the decrypt method type Decrypter interface { Decrypt(io.Reader) io.Reader } // CryptoReadCloser handles closing of the body and allowing reads from the decrypted // content. type CryptoReadCloser struct { Body io.ReadCloser Decrypter io.Reader isClosed bool } // Close lets the CryptoReadCloser satisfy io.ReadCloser interface func (rc CryptoReadCloser) Close() error { rc.isClosed = true return rc.Body.Close() } // Read lets the CryptoReadCloser satisfy io.ReadCloser interface func (rc CryptoReadCloser) Read(b []byte) (int, error) { if rc.isClosed { return 0, io.EOF } return rc.Decrypter.Read(b) }	933 B	2025-05-25 12:27
📄 cipher_builder.go package s3crypto import ( "io" "github.com/aws/aws-sdk-go/aws" ) // ContentCipherBuilder is a builder interface that builds // ciphers for each request. type ContentCipherBuilder interface { ContentCipher() (ContentCipher, error) } // ContentCipherBuilderWithContext is a builder interface that builds // ciphers for each request. type ContentCipherBuilderWithContext interface { ContentCipherWithContext(aws.Context) (ContentCipher, error) } // ContentCipher deals with encrypting and decrypting content type ContentCipher interface { EncryptContents(io.Reader) (io.Reader, error) DecryptContents(io.ReadCloser) (io.ReadCloser, error) GetCipherData() CipherData } // CipherData is used for content encryption. It is used for storing the // metadata of the encrypted content. type CipherData struct { Key []byte IV []byte WrapAlgorithm string CEKAlgorithm string TagLength string MaterialDescription MaterialDescription // EncryptedKey should be populated when calling GenerateCipherData EncryptedKey []byte Padder Padder } // Clone returns a new copy of CipherData func (cd CipherData) Clone() (v CipherData) { v = cd v.MaterialDescription = cd.MaterialDescription.Clone() return v }	1.24 KB	2025-05-25 12:27
📄 cipher_test.go package s3crypto_test import ( "io/ioutil" "strings" "testing" "github.com/aws/aws-sdk-go/service/s3/s3crypto" ) func TestCryptoReadCloserRead(t testing.T) { expectedStr := "HELLO WORLD " str := strings.NewReader(expectedStr) rc := &s3crypto.CryptoReadCloser{Body: ioutil.NopCloser(str), Decrypter: str} b, err := ioutil.ReadAll(rc) if err != nil { t.Errorf("expected no error, but received %v", err) } if expectedStr != string(b) { t.Errorf("expected %s, but received %s", expectedStr, string(b)) } } func TestCryptoReadCloserClose(t testing.T) { data := "HELLO WORLD " expectedStr := "" str := strings.NewReader(data) rc := &s3crypto.CryptoReadCloser{Body: ioutil.NopCloser(str), Decrypter: str} rc.Close() b, err := ioutil.ReadAll(rc) if err != nil { t.Errorf("expected no error, but received %v", err) } if expectedStr != string(b) { t.Errorf("expected %s, but received %s", expectedStr, string(b)) } }	946 B	2025-05-25 12:27
📄 cipher_util.go package s3crypto import ( "encoding/base64" "strconv" ) // AESGCMNoPadding is the constant value that is used to specify // the cek algorithm consiting of AES GCM with no padding. const AESGCMNoPadding = "AES/GCM/NoPadding" // AESCBC is the string constant that signifies the AES CBC algorithm cipher. const AESCBC = "AES/CBC" func encodeMeta(reader lengthReader, cd CipherData) (Envelope, error) { iv := base64.StdEncoding.EncodeToString(cd.IV) key := base64.StdEncoding.EncodeToString(cd.EncryptedKey) contentLength := reader.GetContentLength() matdesc, err := cd.MaterialDescription.encodeDescription() if err != nil { return Envelope{}, err } return Envelope{ CipherKey: key, IV: iv, MatDesc: string(matdesc), WrapAlg: cd.WrapAlgorithm, CEKAlg: cd.CEKAlgorithm, TagLen: cd.TagLength, UnencryptedContentLen: strconv.FormatInt(contentLength, 10), }, nil }	980 B	2025-05-25 12:27
📄 cipher_util_test.go package s3crypto import ( "encoding/base64" "encoding/hex" "fmt" "net/http" "net/http/httptest" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/kms" ) func TestWrapFactory(t testing.T) { o := DecryptionClientOptions{ CryptoRegistry: initCryptoRegistryFrom(map[string]WrapEntry{ KMSWrap: (kmsKeyHandler{ kms: kms.New(unit.Session), }).decryptHandler, }, map[string]CEKEntry{ AESGCMNoPadding: newAESGCMContentCipher, }, map[string]Padder{}), } env := Envelope{ WrapAlg: KMSWrap, MatDesc: `{"kms_cmk_id":""}`, } wrap, err := wrapFromEnvelope(o, env) w, ok := wrap.(kmsKeyHandler) if err != nil { t.Errorf("expected no error, but received %v", err) } if wrap == nil { t.Error("expected non-nil value") } if !ok { t.Errorf("expected kmsKeyHandler, but received %v", w) } } func TestWrapFactoryErrorNoWrap(t testing.T) { o := DecryptionClientOptions{ CryptoRegistry: initCryptoRegistryFrom(map[string]WrapEntry{ KMSWrap: (kmsKeyHandler{ kms: kms.New(unit.Session), }).decryptHandler, }, map[string]CEKEntry{ AESGCMNoPadding: newAESGCMContentCipher, }, map[string]Padder{}), } env := Envelope{ WrapAlg: "none", MatDesc: `{"kms_cmk_id":""}`, } wrap, err := wrapFromEnvelope(o, env) if err == nil { t.Error("expected error, but received none") } if wrap != nil { t.Errorf("expected nil wrap value, received %v", wrap) } } func TestWrapFactoryCustomEntry(t testing.T) { o := DecryptionClientOptions{ CryptoRegistry: initCryptoRegistryFrom(map[string]WrapEntry{ "custom": (kmsKeyHandler{ kms: kms.New(unit.Session), }).decryptHandler, }, map[string]CEKEntry{ AESGCMNoPadding: newAESGCMContentCipher, }, map[string]Padder{}), } env := Envelope{ WrapAlg: "custom", MatDesc: `{"kms_cmk_id":""}`, } wrap, err := wrapFromEnvelope(o, env) if err != nil { t.Errorf("expected no error, but received %v", err) } if wrap == nil { t.Errorf("expected nil wrap value, received %v", wrap) } } func TestCEKFactory(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.URLEncoding.EncodeToString(key) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) o := DecryptionClientOptions{ CryptoRegistry: initCryptoRegistryFrom(map[string]WrapEntry{ KMSWrap: (kmsKeyHandler{ kms: kms.New(sess), }).decryptHandler, }, map[string]CEKEntry{ AESGCMNoPadding: newAESGCMContentCipher, }, map[string]Padder{ NoPadder.Name(): NoPadder, }), } iv, err := hex.DecodeString("0d18e06c7c725ac9e362e1ce") if err != nil { t.Errorf("expected no error, but received %v", err) } ivB64 := base64.URLEncoding.EncodeToString(iv) cipherKey, err := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") if err != nil { t.Errorf("expected no error, but received %v", err) } cipherKeyB64 := base64.URLEncoding.EncodeToString(cipherKey) env := Envelope{ WrapAlg: KMSWrap, CEKAlg: AESGCMNoPadding, CipherKey: cipherKeyB64, IV: ivB64, MatDesc: `{"kms_cmk_id":""}`, } wrap, err := wrapFromEnvelope(o, env) if err != nil { t.Errorf("expected no error, but received %v", err) } cek, err := cekFromEnvelope(o, aws.BackgroundContext(), env, wrap) if err != nil { t.Errorf("expected no error, but received %v", err) } if cek == nil { t.Errorf("expected non-nil cek") } } func TestCEKFactoryNoCEK(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.URLEncoding.EncodeToString(key) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) o := DecryptionClientOptions{ CryptoRegistry: initCryptoRegistryFrom( map[string]WrapEntry{ KMSWrap: (kmsKeyHandler{ kms: kms.New(sess), }).decryptHandler, }, map[string]CEKEntry{ AESGCMNoPadding: newAESGCMContentCipher, }, map[string]Padder{ NoPadder.Name(): NoPadder, }), } iv, err := hex.DecodeString("0d18e06c7c725ac9e362e1ce") if err != nil { t.Errorf("expected no error, but received %v", err) } ivB64 := base64.URLEncoding.EncodeToString(iv) cipherKey, err := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") if err != nil { t.Errorf("expected no error, but received %v", err) } cipherKeyB64 := base64.URLEncoding.EncodeToString(cipherKey) env := Envelope{ WrapAlg: KMSWrap, CEKAlg: "none", CipherKey: cipherKeyB64, IV: ivB64, MatDesc: `{"kms_cmk_id":""}`, } wrap, err := wrapFromEnvelope(o, env) if err != nil { t.Errorf("expected no error, but received %v", err) } cek, err := cekFromEnvelope(o, aws.BackgroundContext(), env, wrap) if err == nil { t.Error("expected error, but received none") } if cek != nil { t.Errorf("expected nil cek value, received %v", wrap) } } func TestCEKFactoryCustomEntry(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.URLEncoding.EncodeToString(key) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) o := DecryptionClientOptions{ CryptoRegistry: initCryptoRegistryFrom( map[string]WrapEntry{ KMSWrap: (kmsKeyHandler{ kms: kms.New(sess), }).decryptHandler, }, map[string]CEKEntry{ "custom": newAESGCMContentCipher, }, map[string]Padder{}), } iv, err := hex.DecodeString("0d18e06c7c725ac9e362e1ce") if err != nil { t.Errorf("expected no error, but received %v", err) } ivB64 := base64.URLEncoding.EncodeToString(iv) cipherKey, err := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") if err != nil { t.Errorf("expected no error, but received %v", err) } cipherKeyB64 := base64.URLEncoding.EncodeToString(cipherKey) env := Envelope{ WrapAlg: KMSWrap, CEKAlg: "custom", CipherKey: cipherKeyB64, IV: ivB64, MatDesc: `{"kms_cmk_id":""}`, } wrap, err := wrapFromEnvelope(o, env) if err != nil { t.Errorf("expected no error, but received %v", err) } cek, err := cekFromEnvelope(o, aws.BackgroundContext(), env, wrap) if err != nil { t.Errorf("expected no error, but received %v", err) } if cek == nil { t.Errorf("expected non-nil cek") } }	7.35 KB	2025-05-25 12:27
📄 crypto_registry.go package s3crypto import ( "fmt" ) // CryptoRegistry is a collection of registries for configuring a decryption client with different key wrapping algorithms, // content encryption algorithms, and padders. type CryptoRegistry struct { wrap map[string]WrapEntry cek map[string]CEKEntry padder map[string]Padder } // NewCryptoRegistry creates a new CryptoRegistry to which wrapping algorithms, content encryption ciphers, and // padders can be registered for use with the DecryptionClientV2. func NewCryptoRegistry() CryptoRegistry { return &CryptoRegistry{ wrap: map[string]WrapEntry{}, cek: map[string]CEKEntry{}, padder: map[string]Padder{}, } } // initCryptoRegistryFrom creates a CryptoRegistry from prepopulated values, this is used for the V1 client func initCryptoRegistryFrom(wrapRegistry map[string]WrapEntry, cekRegistry map[string]CEKEntry, padderRegistry map[string]Padder) CryptoRegistry { cr := &CryptoRegistry{ wrap: wrapRegistry, cek: cekRegistry, padder: padderRegistry, } return cr } // GetWrap returns the WrapEntry identified by the given name. Returns false if the entry is not registered. func (c CryptoRegistry) GetWrap(name string) (WrapEntry, bool) { if c.wrap == nil { return nil, false } entry, ok := c.wrap[name] return entry, ok } // AddWrap registers the provided WrapEntry under the given name, returns an error if a WrapEntry is already present // for the given name. // // This method should only be used if you need to register custom wrapping algorithms. Please see the following methods // for helpers to register AWS provided algorithms: // // RegisterKMSContextWrapWithAnyCMK (kms+context) // RegisterKMSContextWrapWithCMK (kms+context) // RegisterKMSWrapWithAnyCMK (kms) // RegisterKMSWrapWithCMK (kms) func (c CryptoRegistry) AddWrap(name string, entry WrapEntry) error { if entry == nil { return errNilWrapEntry } if _, ok := c.wrap[name]; ok { return newErrDuplicateWrapEntry(name) } c.wrap[name] = entry return nil } // RemoveWrap removes the WrapEntry identified by name. If the WrapEntry is not present returns false. func (c CryptoRegistry) RemoveWrap(name string) (WrapEntry, bool) { if c.wrap == nil { return nil, false } entry, ok := c.wrap[name] if ok { delete(c.wrap, name) } return entry, ok } // GetCEK returns the CEKEntry identified by the given name. Returns false if the entry is not registered. func (c CryptoRegistry) GetCEK(name string) (CEKEntry, bool) { if c.cek == nil { return nil, false } entry, ok := c.cek[name] return entry, ok } // AddCEK registers CEKEntry under the given name, returns an error if a CEKEntry is already present for the given name. // // This method should only be used if you need to register custom content encryption algorithms. Please see the following methods // for helpers to register AWS provided algorithms: // // RegisterAESGCMContentCipher (AES/GCM) // RegisterAESCBCContentCipher (AES/CBC) func (c CryptoRegistry) AddCEK(name string, entry CEKEntry) error { if entry == nil { return errNilCEKEntry } if _, ok := c.cek[name]; ok { return newErrDuplicateCEKEntry(name) } c.cek[name] = entry return nil } // RemoveCEK removes the CEKEntry identified by name. If the entry is not present returns false. func (c CryptoRegistry) RemoveCEK(name string) (CEKEntry, bool) { if c.cek == nil { return nil, false } entry, ok := c.cek[name] if ok { delete(c.cek, name) } return entry, ok } // GetPadder returns the Padder identified by name. If the Padder is not present, returns false. func (c CryptoRegistry) GetPadder(name string) (Padder, bool) { if c.padder == nil { return nil, false } entry, ok := c.padder[name] return entry, ok } // AddPadder registers Padder under the given name, returns an error if a Padder is already present for the given name. // // This method should only be used to register custom padder implementations not provided by AWS. func (c CryptoRegistry) AddPadder(name string, padder Padder) error { if padder == nil { return errNilPadder } if _, ok := c.padder[name]; ok { return newErrDuplicatePadderEntry(name) } c.padder[name] = padder return nil } // RemovePadder removes the Padder identified by name. If the entry is not present returns false. func (c *CryptoRegistry) RemovePadder(name string) (Padder, bool) { if c.padder == nil { return nil, false } padder, ok := c.padder[name] if ok { delete(c.padder, name) } return padder, ok } func (c CryptoRegistry) valid() error { if len(c.wrap) == 0 { return fmt.Errorf("at least one key wrapping algorithms must be provided") } if len(c.cek) == 0 { return fmt.Errorf("at least one content decryption algorithms must be provided") } return nil }	4.65 KB	2025-05-25 12:27
📄 crypto_registry_test.go package s3crypto import ( "strings" "testing" ) func TestCryptoRegistry_Wrap(t testing.T) { cr := NewCryptoRegistry() mockWrap := WrapEntry(func(envelope Envelope) (CipherDataDecrypter, error) { return nil, nil }) if _, ok := cr.GetWrap("foo"); ok { t.Errorf("expected wrapper to not be present") } if _, ok := cr.RemoveWrap("foo"); ok { t.Errorf("expected wrapped to not have been removed") } if err := cr.AddWrap("foo", nil); err == nil { t.Errorf("expected error, got none") } if err := cr.AddWrap("foo", mockWrap); err != nil { t.Errorf("expected no error, got %v", err) } if err := cr.AddWrap("foo", mockWrap); err == nil { t.Error("expected error, got none") } if v, ok := cr.GetWrap("foo"); !ok \|\| v == nil { t.Error("expected wrapper to be present and not nil") } if v, ok := cr.RemoveWrap("foo"); !ok \|\| v == nil { t.Error("expected wrapper to have been removed and not nil") } if _, ok := cr.GetWrap("foo"); ok { t.Error("expected wrapper to have been removed and not nil") } } func TestCryptoRegistry_CEK(t testing.T) { cr := NewCryptoRegistry() mockEntry := CEKEntry(func(data CipherData) (ContentCipher, error) { return nil, nil }) if _, ok := cr.GetCEK("foo"); ok { t.Errorf("expected wrapper to not be present") } if _, ok := cr.RemoveCEK("foo"); ok { t.Errorf("expected wrapped to not have been removed") } if err := cr.AddCEK("foo", nil); err == nil { t.Errorf("expected error, got none") } if err := cr.AddCEK("foo", mockEntry); err != nil { t.Errorf("expected no error, got %v", err) } if err := cr.AddCEK("foo", mockEntry); err == nil { t.Error("expected error, got none") } if v, ok := cr.GetCEK("foo"); !ok \|\| v == nil { t.Error("expected wrapper to be present and not nil") } if v, ok := cr.RemoveCEK("foo"); !ok \|\| v == nil { t.Error("expected wrapper to have been removed and not nil") } if _, ok := cr.GetCEK("foo"); ok { t.Error("expected wrapper to have been removed and not nil") } } func TestCryptoRegistry_Padder(t testing.T) { cr := NewCryptoRegistry() padder := &mockPadder{} if _, ok := cr.GetPadder("foo"); ok { t.Errorf("expected wrapper to not be present") } if _, ok := cr.RemovePadder("foo"); ok { t.Errorf("expected wrapped to not have been removed") } if err := cr.AddPadder("foo", nil); err == nil { t.Errorf("expected error, got none") } if err := cr.AddPadder("foo", padder); err != nil { t.Errorf("expected no error, got %v", err) } if err := cr.AddPadder("foo", padder); err == nil { t.Error("expected error, got none") } if v, ok := cr.GetPadder("foo"); !ok \|\| v == nil { t.Error("expected wrapper to be present and not nil") } if v, ok := cr.RemovePadder("foo"); !ok \|\| v == nil { t.Error("expected wrapper to have been removed and not nil") } } func TestCryptoRegistry_valid(t testing.T) { cr := NewCryptoRegistry() if err := cr.valid(); err == nil { t.Errorf("expected error, got none") } else if e, a := "at least one key wrapping algorithms must be provided", err.Error(); !strings.Contains(a, e) { t.Errorf("expected %v, got %v", e, a) } if err := cr.AddWrap("foo", func(envelope Envelope) (CipherDataDecrypter, error) { return nil, nil }); err != nil { t.Fatalf("expected no error, got %v", err) } if err := cr.valid(); err == nil { t.Fatalf("expected error, got none") } else if e, a := "least one content decryption algorithms must be provided", err.Error(); !strings.Contains(a, e) { t.Errorf("expected %v, got %v", e, a) } if err := cr.AddCEK("foo", func(data CipherData) (ContentCipher, error) { return nil, nil }); err != nil { t.Fatalf("expected no error, got %v", err) } if err := cr.valid(); err != nil { t.Fatalf("expected no error, got %v", err) } }	3.7 KB	2025-05-25 12:27
📄 decryption_client.go package s3crypto import ( "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3iface" ) // WrapEntry is builder that return a proper key decrypter and error type WrapEntry func(Envelope) (CipherDataDecrypter, error) // CEKEntry is a builder that returns a proper content decrypter and error type CEKEntry func(CipherData) (ContentCipher, error) // DecryptionClient is an S3 crypto client. The decryption client // will handle all get object requests from Amazon S3. // Supported key wrapping algorithms: // // AWS KMS // // Supported content ciphers: // - AES/GCM // - AES/CBC // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. type DecryptionClient struct { S3Client s3iface.S3API // LoadStrategy is used to load the metadata either from the metadata of the object // or from a separate file in s3. // // Defaults to our default load strategy. LoadStrategy LoadStrategy WrapRegistry map[string]WrapEntry CEKRegistry map[string]CEKEntry PadderRegistry map[string]Padder } // NewDecryptionClient instantiates a new S3 crypto client // // Example: // // sess := session.Must(session.NewSession()) // svc := s3crypto.NewDecryptionClient(sess, func(svc s3crypto.DecryptionClient{ // // Custom client options here // })) // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func NewDecryptionClient(prov client.ConfigProvider, options ...func(DecryptionClient)) DecryptionClient { s3client := s3.New(prov) s3client.Handlers.Build.PushBack(func(r request.Request) { request.AddToUserAgent(r, "S3CryptoV1n") }) kmsClient := kms.New(prov) client := &DecryptionClient{ S3Client: s3client, LoadStrategy: defaultV2LoadStrategy{ client: s3client, }, WrapRegistry: map[string]WrapEntry{ KMSWrap: NewKMSWrapEntry(kmsClient), KMSContextWrap: newKMSContextWrapEntryWithAnyCMK(kmsClient), }, CEKRegistry: map[string]CEKEntry{ AESGCMNoPadding: newAESGCMContentCipher, AESCBC + "/" + AESCBCPadder.Name(): newAESCBCContentCipher, }, PadderRegistry: map[string]Padder{ AESCBC + "/" + AESCBCPadder.Name(): AESCBCPadder, NoPadder.Name(): NoPadder, }, } for _, option := range options { option(client) } return client } // GetObjectRequest will make a request to s3 and retrieve the object. In this process // decryption will be done. The SDK only supports V2 reads of KMS and GCM. // // Example: // // sess := session.Must(session.NewSession()) // svc := s3crypto.NewDecryptionClient(sess) // req, out := svc.GetObjectRequest(&s3.GetObjectInput { // Key: aws.String("testKey"), // Bucket: aws.String("testBucket"), // }) // err := req.Send() // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func (c DecryptionClient) GetObjectRequest(input s3.GetObjectInput) (request.Request, s3.GetObjectOutput) { return getObjectRequest(c.getClientOptions(), input) } // GetObject is a wrapper for GetObjectRequest // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func (c DecryptionClient) GetObject(input s3.GetObjectInput) (s3.GetObjectOutput, error) { return getObject(c.getClientOptions(), input) } // GetObjectWithContext is a wrapper for GetObjectRequest with the additional // context, and request options support. // // GetObjectWithContext is the same as GetObject with the additional support for // Context input parameters. The Context must not be nil. A nil Context will // cause a panic. Use the Context to add deadlining, timeouts, etc. In the future // this may create sub-contexts for individual underlying requests. // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func (c DecryptionClient) GetObjectWithContext(ctx aws.Context, input s3.GetObjectInput, opts ...request.Option) (s3.GetObjectOutput, error) { return getObjectWithContext(c.getClientOptions(), ctx, input, opts...) } func (c DecryptionClient) getClientOptions() DecryptionClientOptions { return DecryptionClientOptions{ S3Client: c.S3Client, LoadStrategy: c.LoadStrategy, CryptoRegistry: initCryptoRegistryFrom(c.WrapRegistry, c.CEKRegistry, c.PadderRegistry), } }	4.86 KB	2025-05-25 12:27
📄 decryption_client_test.go package s3crypto_test import ( "bytes" "encoding/base64" "encoding/hex" "fmt" "io/ioutil" "net/http" "net/http/httptest" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3crypto" ) func TestGetObjectGCM(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.StdEncoding.EncodeToString(key) // This is our KMS response ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) c := s3crypto.NewDecryptionClient(sess) if c == nil { t.Error("expected non-nil value") } input := &s3.GetObjectInput{ Key: aws.String("test"), Bucket: aws.String("test"), } req, out := c.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r request.Request) { iv, err := hex.DecodeString("0d18e06c7c725ac9e362e1ce") if err != nil { t.Errorf("expected no error, but received %v", err) } b, err := hex.DecodeString("fa4362189661d163fcd6a56d8bf0405ad636ac1bbedd5cc3ee727dc2ab4a9489") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"SpFRES0JyU8BLZSKo51SrwILK4lhtZsWiMNjgO4WmoK+joMwZPG7Hw=="}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{base64.URLEncoding.EncodeToString(iv)}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"kms_cmk_id":"arn:aws:kms:us-east-1:172259396726:key/a22a4b30-79f4-4b3d-bab4-a26d327a231b"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{s3crypto.AESGCMNoPadding}, http.CanonicalHeaderKey("x-amz-meta-x-amz-tag-len"): []string{"128"}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } }) err := req.Send() if err != nil { t.Errorf("expected no error, but received %v", err) } b, err := ioutil.ReadAll(out.Body) if err != nil { t.Errorf("expected no error, but received %v", err) } expected, err := hex.DecodeString("2db5168e932556f8089a0622981d017d") if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(expected, b) { t.Error("expected bytes to be equivalent") } } func TestGetObjectCBC(t testing.T) { key, _ := hex.DecodeString("898be9cc5004ed0fa6e117c9a3099d31") keyB64 := base64.StdEncoding.EncodeToString(key) // This is our KMS response ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) c := s3crypto.NewDecryptionClient(sess) if c == nil { t.Error("expected non-nil value") } input := &s3.GetObjectInput{ Key: aws.String("test"), Bucket: aws.String("test"), } req, out := c.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r request.Request) { iv, err := hex.DecodeString("9dea7621945988f96491083849b068df") if err != nil { t.Errorf("expected no error, but received %v", err) } b, err := hex.DecodeString("e232cd6ef50047801ee681ec30f61d53cfd6b0bca02fd03c1b234baa10ea82ac9dab8b960926433a19ce6dea08677e34") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"SpFRES0JyU8BLZSKo51SrwILK4lhtZsWiMNjgO4WmoK+joMwZPG7Hw=="}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{base64.URLEncoding.EncodeToString(iv)}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"kms_cmk_id":"arn:aws:kms:us-east-1:172259396726:key/a22a4b30-79f4-4b3d-bab4-a26d327a231b"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{strings.Join([]string{s3crypto.AESCBC, s3crypto.AESCBCPadder.Name()}, "/")}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } }) err := req.Send() if err != nil { t.Errorf("expected no error, but received %v", err) } b, err := ioutil.ReadAll(out.Body) if err != nil { t.Errorf("expected no error, but received %v", err) } expected, err := hex.DecodeString("0397f4f6820b1f9386f14403be5ac16e50213bd473b4874b9bcbf5f318ee686b1d") if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(expected, b) { t.Error("expected bytes to be equivalent") } } func TestGetObjectCBC2(t testing.T) { key, _ := hex.DecodeString("8d70e92489c4e6cfb12261b4d17f4b85826da687fc8742fcf9f87fadb5b4cb89") keyB64 := base64.StdEncoding.EncodeToString(key) // This is our KMS response ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) c := s3crypto.NewDecryptionClient(sess) if c == nil { t.Error("expected non-nil value") } input := &s3.GetObjectInput{ Key: aws.String("test"), Bucket: aws.String("test"), } req, out := c.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r request.Request) { b, err := hex.DecodeString("fd0c71ecb7ed16a9bf42ea5f75501d416df608f190890c3b4d8897f24744cd7f9ea4a0b212e60634302450e1c5378f047ff753ccefe365d411c36339bf22e301fae4c3a6226719a4b93dc74c1af79d0296659b5d56c0892315f2c7cc30190220db1eaafae3920d6d9c65d0aa366499afc17af493454e141c6e0fbdeb6a990cb4") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"AQEDAHikdGvcj7Gil5VqAR/JWvvPp3ue26+t2vhWy4lL2hg4mAAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDCcy43wCR0bSsnzTrAIBEIA7WdD2jxC3tCrK6TOdiEfbIN64m+UN7Velz4y0LRra5jn2U1CDClacwIpiBYuDp5ymPKO+ZqUGE0WEf20="}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{"EMMWJY8ZLcK/9FOj3iCpng=="}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"kms_cmk_id":"arn:aws:kms:us-east-1:172259396726:key/a22a4b30-79f4-4b3d-bab4-a26d327a231b"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{strings.Join([]string{s3crypto.AESCBC, s3crypto.AESCBCPadder.Name()}, "/")}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } }) err := req.Send() if err != nil { t.Errorf("expected no error, but received %v", err) } b, err := ioutil.ReadAll(out.Body) if err != nil { t.Errorf("expected no error, but received %v", err) } expected, err := hex.DecodeString("a6ccd3482f5ce25c9ddeb69437cd0acbc0bdda2ef8696d90781de2b35704543529871b2032e68ef1c5baed1769aba8d420d1aca181341b49b8b3587a6580cdf1d809c68f06735f7735c16691f4b70c967d68fc08195b81ad71bcc4df452fd0a5799c1e1234f92f1cd929fc072167ccf9f2ac85b93170932b32") if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(expected, b) { t.Error("expected bytes to be equivalent") } } func TestGetObjectWithContext(t testing.T) { c := s3crypto.NewDecryptionClient(unit.Session) ctx := &awstesting.FakeContext{DoneCh: make(chan struct{})} ctx.Error = fmt.Errorf("context canceled") close(ctx.DoneCh) input := s3.GetObjectInput{ Key: aws.String("test"), Bucket: aws.String("test"), } _, err := c.GetObjectWithContext(ctx, &input) if err == nil { t.Fatalf("expected error, did not get one") } aerr := err.(awserr.Error) if e, a := request.CanceledErrorCode, aerr.Code(); e != a { t.Errorf("expected error code %q, got %q", e, a) } if e, a := "canceled", aerr.Message(); !strings.Contains(a, e) { t.Errorf("expected error message to contain %q, but did not %q", e, a) } } func TestDecryptionClient_GetObject_V2Artifact(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, "hJUv7S6K2cHF64boS9ixHX0TZAjBZLT4ZpEO4XxkGnY=", `"}`)) })) defer ts.Close() c := s3crypto.NewDecryptionClient(unit.Session.Copy(&aws.Config{Endpoint: &ts.URL})) input := &s3.GetObjectInput{ Bucket: aws.String("test"), Key: aws.String("test"), } req, out := c.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r *request.Request) { b, err := hex.DecodeString("6b134eb7a353131de92faff64f594b2794e3544e31776cca26fe3bbeeffc68742d1007234f11c6670522602326868e29f37e9d2678f1614ec1a2418009b9772100929aadbed9a21a") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"PsuclPnlo2O0MQoov6kL1TBlaZG6oyNwWuAqmAgq7g8b9ZeeORi3VTMg624FU9jx"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{"dqqlq2dRVSQ5hFRb"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"aws:x-amz-cek-alg": "AES/GCM/NoPadding"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSContextWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{"AES/GCM/NoPadding"}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } }) err := req.Send() if err != nil { t.Fatalf("expected no error, got %v", err) } actual, err := ioutil.ReadAll(out.Body) if err != nil { t.Fatalf("expected no error, got %v", err) } expected, err := hex.DecodeString("af150d7156bf5b3f5c461e5c6ac820acc5a33aab7085d920666c250ff251209d5a4029b3bd78250fab6e11aed52fae948d407056a9519b68") if err != nil { t.Fatalf("expected no error, got %v", err) } if bytes.Compare(expected, actual) != 0 { t.Fatalf("expected content to match but it did not") } }	10.86 KB	2025-05-25 12:27
📄 decryption_client_v2.go package s3crypto import ( "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3iface" ) // DecryptionClientV2 is an S3 crypto client. The decryption client // will handle all get object requests from Amazon S3. // Supported key wrapping algorithms: // - AWS KMS // - AWS KMS + Context // // Supported content ciphers: // - AES/GCM // - AES/CBC type DecryptionClientV2 struct { options DecryptionClientOptions } // DecryptionClientOptions is the configuration options for DecryptionClientV2. type DecryptionClientOptions struct { S3Client s3iface.S3API // LoadStrategy is used to load the metadata either from the metadata of the object // or from a separate file in s3. // // Defaults to our default load strategy. LoadStrategy LoadStrategy CryptoRegistry CryptoRegistry } // NewDecryptionClientV2 instantiates a new DecryptionClientV2. The NewDecryptionClientV2 must be configured with the // desired key wrapping and content encryption algorithms that are required to be read by the client. These algorithms // are registered by providing the client a CryptoRegistry that has been constructed with the desired configuration. // NewDecryptionClientV2 will return an error if no key wrapping or content encryption algorithms have been provided. // // Example: // // sess := session.Must(session.NewSession()) // cr := s3crypto.NewCryptoRegistry() // if err := s3crypto.RegisterKMSContextWrapWithAnyCMK(cr, kms.New(sess)); err != nil { // panic(err) // handle error // } // if err := s3crypto.RegisterAESGCMContentCipher(cr); err != nil { // panic(err) // handle error // } // svc, err := s3crypto.NewDecryptionClientV2(sess, cr, func(o s3crypto.DecryptionClientOptions) { // // Custom client options here // }) // if err != nil { // panic(err) // handle error // } func NewDecryptionClientV2( prov client.ConfigProvider, cryptoRegistry CryptoRegistry, options ...func(clientOptions DecryptionClientOptions), ) (DecryptionClientV2, error) { s3client := s3.New(prov) s3client.Handlers.Build.PushBack(func(r request.Request) { request.AddToUserAgent(r, "S3CryptoV2") }) clientOptions := &DecryptionClientOptions{ S3Client: s3client, LoadStrategy: defaultV2LoadStrategy{ client: s3client, }, CryptoRegistry: cryptoRegistry, } for _, option := range options { option(clientOptions) } if err := cryptoRegistry.valid(); err != nil { return nil, err } return &DecryptionClientV2{options: clientOptions}, nil } // GetObjectRequest will make a request to s3 and retrieve the object. In this process // decryption will be done. The SDK only supports V2 reads of KMS and GCM. // // Example: // // req, out := svc.GetObjectRequest(&s3.GetObjectInput { // Key: aws.String("testKey"), // Bucket: aws.String("testBucket"), // }) // err := req.Send() func (c DecryptionClientV2) GetObjectRequest(input s3.GetObjectInput) (request.Request, s3.GetObjectOutput) { return getObjectRequest(c.options, input) } // GetObject is a wrapper for GetObjectRequest func (c DecryptionClientV2) GetObject(input s3.GetObjectInput) (s3.GetObjectOutput, error) { req, out := getObjectRequest(c.options, input) return out, req.Send() } // GetObjectWithContext is a wrapper for GetObjectRequest with the additional // context, and request options support. // // GetObjectWithContext is the same as GetObject with the additional support for // Context input parameters. The Context must not be nil. A nil Context will // cause a panic. Use the Context to add deadlining, timeouts, etc. In the future // this may create sub-contexts for individual underlying requests. func (c DecryptionClientV2) GetObjectWithContext(ctx aws.Context, input s3.GetObjectInput, opts ...request.Option) (*s3.GetObjectOutput, error) { req, out := getObjectRequest(c.options, input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() }	3.93 KB	2025-05-25 12:27
📄 decryption_client_v2_test.go //go:build go1.7 // +build go1.7 package s3crypto_test import ( "bytes" "encoding/hex" "fmt" "io/ioutil" "net/http" "net/http/httptest" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3crypto" ) func TestDecryptionClientV2_CheckDeprecatedFeatures(t testing.T) { // AES/GCM/NoPadding with kms+context => allowed builder := s3crypto.AESGCMContentCipherBuilderV2(s3crypto.NewKMSContextKeyGenerator(kms.New(unit.Session), "cmkID", s3crypto.MaterialDescription{})) _, err := s3crypto.NewEncryptionClientV2(unit.Session, builder) if err != nil { t.Errorf("expected no error, got %v", err) } // AES/GCM/NoPadding with kms => not allowed builder = s3crypto.AESGCMContentCipherBuilder(s3crypto.NewKMSKeyGenerator(kms.New(unit.Session), "cmkID")) _, err = s3crypto.NewEncryptionClientV2(unit.Session, builder) if err == nil { t.Error("expected error, but got nil") } // AES/CBC/PKCS5Padding with kms => not allowed builder = s3crypto.AESCBCContentCipherBuilder(s3crypto.NewKMSKeyGenerator(kms.New(unit.Session), "cmkID"), s3crypto.NewPKCS7Padder(128)) _, err = s3crypto.NewEncryptionClientV2(unit.Session, builder) if err == nil { t.Error("expected error, but got nil") } } func TestDecryptionClientV2_GetObject(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, "hJUv7S6K2cHF64boS9ixHX0TZAjBZLT4ZpEO4XxkGnY=", `"}`)) })) defer ts.Close() kmsClient := kms.New(unit.Session.Copy(&aws.Config{Endpoint: &ts.URL})) cr := s3crypto.NewCryptoRegistry() if err := s3crypto.RegisterKMSContextWrapWithAnyCMK(cr, kmsClient); err != nil { t.Fatalf("expected no error, got %v", err) } if err := s3crypto.RegisterAESGCMContentCipher(cr); err != nil { t.Fatalf("expected no error, got %v", err) } c, err := s3crypto.NewDecryptionClientV2(unit.Session.Copy(), cr) if err != nil { t.Fatalf("expected no error, got %v", err) } input := &s3.GetObjectInput{ Bucket: aws.String("test"), Key: aws.String("test"), } req, out := c.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r request.Request) { b, err := hex.DecodeString("6b134eb7a353131de92faff64f594b2794e3544e31776cca26fe3bbeeffc68742d1007234f11c6670522602326868e29f37e9d2678f1614ec1a2418009b9772100929aadbed9a21a") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"PsuclPnlo2O0MQoov6kL1TBlaZG6oyNwWuAqmAgq7g8b9ZeeORi3VTMg624FU9jx"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{"dqqlq2dRVSQ5hFRb"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"aws:x-amz-cek-alg":"AES/GCM/NoPadding"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSContextWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{"AES/GCM/NoPadding"}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } }) err = req.Send() if err != nil { t.Fatalf("expected no error, got %v", err) } actual, err := ioutil.ReadAll(out.Body) if err != nil { t.Fatalf("expected no error, got %v", err) } expected, err := hex.DecodeString("af150d7156bf5b3f5c461e5c6ac820acc5a33aab7085d920666c250ff251209d5a4029b3bd78250fab6e11aed52fae948d407056a9519b68") if err != nil { t.Fatalf("expected no error, got %v", err) } if bytes.Compare(expected, actual) != 0 { t.Fatalf("expected content to match but it did not") } } func TestDecryptionClientV2_GetObject_V1Interop_KMS_AESCBC(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, "7ItX9CTGNWWegC62RlaNu6EJ3+J9yGO7yAqDNU4CdeA=", `"}`)) })) defer ts.Close() kmsClient := kms.New(unit.Session.Copy(&aws.Config{Endpoint: &ts.URL})) cr := s3crypto.NewCryptoRegistry() if err := s3crypto.RegisterKMSWrapWithAnyCMK(cr, kmsClient); err != nil { t.Fatalf("expected no error, got %v", err) } if err := s3crypto.RegisterAESCBCContentCipher(cr, s3crypto.AESCBCPadder); err != nil { t.Fatalf("expected no error, got %v", err) } c, err := s3crypto.NewDecryptionClientV2(unit.Session.Copy(), cr) if err != nil { t.Fatalf("expected no error, got %v", err) } input := &s3.GetObjectInput{ Bucket: aws.String("test"), Key: aws.String("test"), } req, out := c.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r request.Request) { b, err := hex.DecodeString("6f4f413a357a3c3a12289442fb835c5e4ecc8db1d86d3d1eab906ce07e1ad772180b2e9ec49c3fc667d8aceea8c46da6bb9738251a8e36241a473ad820f99c701906bac1f48578d5392e928889bbb1d9") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"/nJlgMtxMNk2ErKLLrLp3H7A7aQyJcJOClE2ldAIIFNZU4OhUMc1mMCHdIEC8fby"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{"adO9U7pcEHxUTaguIkho9g=="}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"kms_cmk_id":"test-key-id"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{"AES/CBC/PKCS5Padding"}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } }) err = req.Send() if err != nil { t.Fatalf("expected no error, got %v", err) } actual, err := ioutil.ReadAll(out.Body) if err != nil { t.Fatalf("expected no error, got %v", err) } expected, err := hex.DecodeString("a716e018ffecf4bb94d4352082af4662612d9c225efed6f389bf1f6f0447a9bce80cc712d7e66ee5e1c086af38e607ead351fd2c1a0247878e693ada73bd580b") if err != nil { t.Fatalf("expected no error, got %v", err) } if bytes.Compare(expected, actual) != 0 { t.Fatalf("expected content to match but it did not") } } func TestDecryptionClientV2_GetObject_V1Interop_KMS_AESGCM(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, "Hrjrkkt/vQwMYtqvK6+MiXh3xiMvviL1Ks7w2mgsJgU=", `"}`)) })) defer ts.Close() kmsClient := kms.New(unit.Session.Copy(&aws.Config{Endpoint: &ts.URL})) cr := s3crypto.NewCryptoRegistry() if err := s3crypto.RegisterKMSWrapWithAnyCMK(cr, kmsClient); err != nil { t.Fatalf("expected no error, got %v", err) } if err := s3crypto.RegisterAESGCMContentCipher(cr); err != nil { t.Fatalf("expected no error, got %v", err) } c, err := s3crypto.NewDecryptionClientV2(unit.Session.Copy(), cr) if err != nil { t.Fatalf("expected no error, got %v", err) } input := &s3.GetObjectInput{ Bucket: aws.String("test"), Key: aws.String("test"), } req, out := c.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r request.Request) { b, err := hex.DecodeString("6370a90b9a118301c2160c23a90d96146761276acdcfa92e6cbcb783abdc2e1813891506d6850754ef87ed2ac3bf570dd5c9da9492b7769ae1e639d073d688bd284815404ce2648a") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"/7tu/RFXZU1UFwRzzf11IdF3b1wBxBZhnUMjVYHKKr5DjAHS602GvXt4zYcx/MJo"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{"8Rlvyy8AoYj8v579"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"kms_cmk_id":"test-key-id"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{"AES/GCM/NoPadding"}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } }) err = req.Send() if err != nil { t.Fatalf("expected no error, got %v", err) } actual, err := ioutil.ReadAll(out.Body) if err != nil { t.Fatalf("expected no error, got %v", err) } expected, err := hex.DecodeString("75f6805afa7d7be4f56c5906adc27a5959158bf4af6e7c7e12bda3458300f6b1c8daaf9a5949f7a6bdbb8a9c072de05bf0541633421f42f8") if err != nil { t.Fatalf("expected no error, got %v", err) } if bytes.Compare(expected, actual) != 0 { t.Fatalf("expected content to match but it did not") } } func TestDecryptionClientV2_GetObject_OnlyDecryptsRegisteredAlgorithms(t testing.T) { dataHandler := func(r request.Request) { b, err := hex.DecodeString("1bd0271b25951fdef3dbe51a9b7af85f66b311e091aa10a346655068f657b9da9acc0843ea0522b0d1ae4a25a31b13605dd1ac5d002db8965d9d4652fd602693") if err != nil { t.Errorf("expected no error, but received %v", err) } r.HTTPResponse = &http.Response{ StatusCode: 200, Header: http.Header{ http.CanonicalHeaderKey("x-amz-meta-x-amz-key-v2"): []string{"gNuYjzkLTzfhOcIX9h1l8jApWcAAQqzlryOE166kdDojaHH/+7cCqR5HU8Bpxmij"}, http.CanonicalHeaderKey("x-amz-meta-x-amz-iv"): []string{"Vmauu+TMEgaXa26ObqpARA=="}, http.CanonicalHeaderKey("x-amz-meta-x-amz-matdesc"): []string{`{"kms_cmk_id":"test-key-id"}`}, http.CanonicalHeaderKey("x-amz-meta-x-amz-wrap-alg"): []string{s3crypto.KMSWrap}, http.CanonicalHeaderKey("x-amz-meta-x-amz-cek-alg"): []string{"AES/CBC/PKCS5Padding"}, }, Body: ioutil.NopCloser(bytes.NewBuffer(b)), } } cases := map[string]struct { Client s3crypto.DecryptionClientV2 WantErr string }{ "unsupported wrap": { Client: func() s3crypto.DecryptionClientV2 { cr := s3crypto.NewCryptoRegistry() if err := s3crypto.RegisterKMSContextWrapWithAnyCMK(cr, kms.New(unit.Session.Copy())); err != nil { t.Fatalf("expected no error, got %v", err) } if err := s3crypto.RegisterAESGCMContentCipher(cr); err != nil { t.Fatalf("expected no error, got %v", err) } c, err := s3crypto.NewDecryptionClientV2(unit.Session.Copy(), cr) if err != nil { t.Fatalf("expected no error, got %v", err) } return c }(), WantErr: "wrap algorithm isn't supported, kms", }, "unsupported cek": { Client: func() s3crypto.DecryptionClientV2 { cr := s3crypto.NewCryptoRegistry() if err := s3crypto.RegisterKMSWrapWithAnyCMK(cr, kms.New(unit.Session.Copy())); err != nil { t.Fatalf("expected no error, got %v", err) } if err := s3crypto.RegisterAESGCMContentCipher(cr); err != nil { t.Fatalf("expected no error, got %v", err) } c, err := s3crypto.NewDecryptionClientV2(unit.Session.Copy(), cr) if err != nil { t.Fatalf("expected no error, got %v", err) } return c }(), WantErr: "cek algorithm isn't supported, AES/CBC/PKCS5Padding", }, } for name, tt := range cases { t.Run(name, func(t testing.T) { input := &s3.GetObjectInput{ Bucket: aws.String("test"), Key: aws.String("test"), } req, _ := tt.Client.GetObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(dataHandler) err := req.Send() if err == nil { t.Fatalf("expected error, got none") } if e, a := tt.WantErr, err.Error(); !strings.Contains(a, e) { t.Errorf("expected %v, got %v", e, a) } }) } } func TestDecryptionClientV2_CheckValidCryptoRegistry(t *testing.T) { cr := s3crypto.NewCryptoRegistry() _, err := s3crypto.NewDecryptionClientV2(unit.Session.Copy(), cr) if err == nil { t.Fatal("expected error, got none") } if e, a := "at least one key wrapping algorithms must be provided", err.Error(); !strings.Contains(a, e) { t.Fatalf("expected %v, got %v", e, a) } }	11.71 KB	2025-05-25 12:27
📄 doc.go /* Package s3crypto provides encryption to S3 using KMS and AES GCM. Keyproviders are interfaces that handle masterkeys. Masterkeys are used to encrypt and decrypt the randomly generated cipher keys. The SDK currently uses KMS to do this. A user does not need to provide a master key since all that information is hidden in KMS. Modes are interfaces that handle content encryption and decryption. It is an abstraction layer that instantiates the ciphers. If content is being encrypted we generate the key and iv of the cipher. For decryption, we use the metadata stored either on the object or an instruction file object to decrypt the contents. Ciphers are interfaces that handle encryption and decryption of data. This may be key wrap ciphers or content ciphers. Creating an S3 cryptography client cmkID := "<some key ID>" sess := session.Must(session.NewSession()) kmsClient := kms.New(sess) // Create the KeyProvider var matdesc s3crypto.MaterialDescription handler := s3crypto.NewKMSContextKeyGenerator(kmsClient, cmkID, matdesc) // Create an encryption and decryption client // We need to pass the session here so S3 can use it. In addition, any decryption that // occurs will use the KMS client. svc, err := s3crypto.NewEncryptionClientV2(sess, s3crypto.AESGCMContentCipherBuilderV2(handler)) if err != nil { panic(err) // handle error } // Create a CryptoRegistry and register the algorithms you wish to use for decryption cr := s3crypto.NewCryptoRegistry() if err := s3crypto.RegisterAESGCMContentCipher(cr); err != nil { panic(err) // handle error } if err := s3crypto.RegisterKMSContextWrapWithAnyCMK(cr, kmsClient); err != nil { panic(err) // handle error } // Create a decryption client to decrypt artifacts svc, err := s3crypto.NewDecryptionClientV2(sess, cr) if err != nil { panic(err) // handle error } Configuration of the S3 cryptography client sess := session.Must(session.NewSession()) handler := s3crypto.NewKMSContextKeyGenerator(kms.New(sess), cmkID, s3crypto.MaterialDescription{}) svc, err := s3crypto.NewEncryptionClientV2(sess, s3crypto.AESGCMContentCipherBuilderV2(handler), func (o s3crypto.EncryptionClientOptions) { // Save instruction files to separate objects o.SaveStrategy = NewS3SaveStrategy(sess, "") // Change instruction file suffix to .example o.InstructionFileSuffix = ".example" // Set temp folder path o.TempFolderPath = "/path/to/tmp/folder/" // Any content less than the minimum file size will use memory // instead of writing the contents to a temp file. o.MinFileSize = int64(1024 1024 * 1024) }) if err != nil { panic(err) // handle error } # Object Metadata SaveStrategy The default SaveStrategy is to save metadata to an object's headers. An alternative SaveStrategy can be provided to the EncryptionClientV2. For example, the S3SaveStrategy can be used to save the encryption metadata to a instruction file that is stored in S3 using the objects KeyName+InstructionFileSuffix. The InstructionFileSuffix defaults to .instruction. If using this strategy you will need to configure the DecryptionClientV2 to use the matching S3LoadStrategy LoadStrategy in order to decrypt object using this save strategy. # Custom Key Wrappers and Custom Content Encryption Algorithms Registration of custom key wrapping or content encryption algorithms not provided by AWS is allowed by the SDK, but security and compatibility with custom types can not be guaranteed. For example if you want to support `CustomWrap` key wrapping algorithm and `CustomCEK` content encryption algorithm. You can use the CryptoRegistry to register these types. cr := s3crypto.NewCryptoRegistry() // Register a custom key wrap algorithm to the CryptoRegistry if err := cr.AddWrap("CustomWrap", NewCustomWrapEntry); err != nil { panic(err) // handle error } // Register a custom content encryption algorithm to the CryptoRegistry if err := cr.AddCEK("CustomCEK", NewCustomCEKEntry); err != nil { panic(err) // handle error } svc, err := s3crypto.NewDecryptionClientV2(sess, cr) if err != nil { panic(err) // handle error } We have now registered these new algorithms to the decryption client. When the client calls `GetObject` and sees the wrap as `CustomWrap` then it'll use that wrap algorithm. This is also true for `CustomCEK`. For encryption adding a custom content cipher builder and key handler will allow for encryption of custom defined ciphers. // Our wrap algorithm, CustomWrap handler := NewCustomWrap(key, iv) // Our content cipher builder, NewCustomCEKContentBuilder svc := s3crypto.NewEncryptionClientV2(sess, NewCustomCEKContentBuilder(handler)) # Maintenance Mode Notification for V1 Clients The EncryptionClient and DecryptionClient are in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. Users of these clients should migrate to EncryptionClientV2 and DecryptionClientV2. EncryptionClientV2 removes encryption support of the following features - AES/CBC (content cipher) - kms (key wrap algorithm) Attempting to construct an EncryptionClientV2 with deprecated features will result in an error returned back to the calling application during construction of the client. Users of `AES/CBC` will need to migrate usage to `AES/GCM`. Users of `kms` key provider will need to migrate `kms+context`. DecryptionClientV2 client adds support for the `kms+context` key provider and maintains backwards comparability with objects encrypted with the V1 EncryptionClient. # Migrating from V1 to V2 Clients Examples of how to migrate usage of the V1 clients to the V2 equivalents have been documented as usage examples of the NewEncryptionClientV2 and NewDecryptionClientV2 functions. Please see the AWS SDK for Go Developer Guide for additional migration steps https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/s3-encryption-migration.html */ package s3crypto	5.87 KB	2025-05-25 12:27
📄 encryption_client.go package s3crypto import ( "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3iface" ) // DefaultMinFileSize is used to check whether we want to write to a temp file // or store the data in memory. const DefaultMinFileSize = 1024 * 512 * 5 // EncryptionClient is an S3 crypto client. By default the SDK will use Authentication mode which // will use KMS for key wrapping and AES GCM for content encryption. // AES GCM will load all data into memory. However, the rest of the content algorithms // do not load the entire contents into memory. // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. type EncryptionClient struct { S3Client s3iface.S3API ContentCipherBuilder ContentCipherBuilder // SaveStrategy will dictate where the envelope is saved. // // Defaults to the object's metadata SaveStrategy SaveStrategy // TempFolderPath is used to store temp files when calling PutObject. // Temporary files are needed to compute the X-Amz-Content-Sha256 header. TempFolderPath string // MinFileSize is the minimum size for the content to write to a // temporary file instead of using memory. MinFileSize int64 } func validateV1EncryptionClientConstruction(c EncryptionClient) error { builder, ok := c.ContentCipherBuilder.(compatibleEncryptionFixture) if !ok { return nil } err := builder.isEncryptionVersionCompatible(v1ClientVersion) if err != nil { return awserr.New(clientConstructionErrorCode, "invalid client configuration", err) } return nil } // NewEncryptionClient instantiates a new S3 crypto client // // Example: // // cmkID := "arn:aws:kms:region:000000000000:key/00000000-0000-0000-0000-000000000000" // sess := session.Must(session.NewSession()) // handler := s3crypto.NewKMSKeyGenerator(kms.New(sess), cmkID) // svc := s3crypto.NewEncryptionClient(sess, s3crypto.AESGCMContentCipherBuilder(handler)) // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func NewEncryptionClient(prov client.ConfigProvider, builder ContentCipherBuilder, options ...func(EncryptionClient)) EncryptionClient { s3client := s3.New(prov) s3client.Handlers.Build.PushBack(func(r request.Request) { request.AddToUserAgent(r, "S3CryptoV1n") }) client := &EncryptionClient{ S3Client: s3client, ContentCipherBuilder: builder, SaveStrategy: HeaderV2SaveStrategy{}, MinFileSize: DefaultMinFileSize, } for _, option := range options { option(client) } return client } // PutObjectRequest creates a temp file to encrypt the contents into. It then streams // that data to S3. // // Example: // // svc := s3crypto.NewEncryptionClient(session.Must(session.NewSession()), s3crypto.AESGCMContentCipherBuilder(handler)) // req, out := svc.PutObjectRequest(&s3.PutObjectInput { // Key: aws.String("testKey"), // Bucket: aws.String("testBucket"), // Body: strings.NewReader("test data"), // }) // err := req.Send() // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func (c EncryptionClient) PutObjectRequest(input s3.PutObjectInput) (request.Request, s3.PutObjectOutput) { req, out := putObjectRequest(c.getClientOptions(), input) if err := validateV1EncryptionClientConstruction(c); err != nil { errHandler := setReqError(err) req.Error = err req.Handlers.Build.Clear() req.Handlers.Send.Clear() req.Handlers.Validate.PushFront(errHandler) req.Handlers.Build.PushFront(errHandler) req.Handlers.Send.PushFront(errHandler) } return req, out } func setReqError(err error) func(request.Request) { return func(r request.Request) { r.Error = err } } // PutObject is a wrapper for PutObjectRequest // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func (c EncryptionClient) PutObject(input s3.PutObjectInput) (s3.PutObjectOutput, error) { if err := validateV1EncryptionClientConstruction(c); err != nil { return nil, err } return putObject(c.getClientOptions(), input) } // PutObjectWithContext is a wrapper for PutObjectRequest with the additional // context, and request options support. // // PutObjectWithContext is the same as PutObject with the additional support for // Context input parameters. The Context must not be nil. A nil Context will // cause a panic. Use the Context to add deadlining, timeouts, etc. In the future // this may create sub-contexts for individual underlying requests. // PutObject is a wrapper for PutObjectRequest // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func (c EncryptionClient) PutObjectWithContext(ctx aws.Context, input s3.PutObjectInput, opts ...request.Option) (s3.PutObjectOutput, error) { if err := validateV1EncryptionClientConstruction(c); err != nil { return nil, err } return putObjectWithContext(c.getClientOptions(), ctx, input, opts...) } func (c *EncryptionClient) getClientOptions() EncryptionClientOptions { return EncryptionClientOptions{ S3Client: c.S3Client, ContentCipherBuilder: c.ContentCipherBuilder, SaveStrategy: c.SaveStrategy, TempFolderPath: c.TempFolderPath, MinFileSize: c.MinFileSize, } }	5.79 KB	2025-05-25 12:27
📄 encryption_client_test.go package s3crypto import ( "bytes" "errors" "fmt" "io/ioutil" "net/http" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/s3" ) func TestDefaultConfigValues(t testing.T) { sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) svc := kms.New(sess) handler := NewKMSKeyGenerator(svc, "testid") c := NewEncryptionClient(sess, AESGCMContentCipherBuilder(handler)) if c == nil { t.Error("expected non-vil client value") } if c.ContentCipherBuilder == nil { t.Error("expected non-vil content cipher builder value") } if c.SaveStrategy == nil { t.Error("expected non-vil save strategy value") } } func TestPutObject(t testing.T) { size := 1024 * 1024 data := make([]byte, size) expected := bytes.Repeat([]byte{1}, size) generator := mockGenerator{} cb := mockCipherBuilder{generator} sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) c := NewEncryptionClient(sess, cb) if c == nil { t.Error("expected non-vil client value") } input := &s3.PutObjectInput{ Key: aws.String("test"), Bucket: aws.String("test"), Body: bytes.NewReader(data), } req, _ := c.PutObjectRequest(input) req.Handlers.Send.Clear() req.Handlers.Send.PushBack(func(r request.Request) { r.Error = errors.New("stop") r.HTTPResponse = &http.Response{ StatusCode: 200, } }) err := req.Send() if e, a := "stop", err.Error(); e != a { t.Errorf("expected %s error, but received %s", e, a) } b, err := ioutil.ReadAll(req.HTTPRequest.Body) if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(expected, b) { t.Error("expected bytes to be equivalent, but received otherwise") } } func TestPutObjectWithContext(t testing.T) { generator := mockGenerator{} cb := mockCipherBuilder{generator} c := NewEncryptionClient(unit.Session, cb) ctx := &awstesting.FakeContext{DoneCh: make(chan struct{})} ctx.Error = fmt.Errorf("context canceled") close(ctx.DoneCh) input := s3.PutObjectInput{ Bucket: aws.String("test"), Key: aws.String("test"), Body: bytes.NewReader([]byte{}), } _, err := c.PutObjectWithContext(ctx, &input) if err == nil { t.Fatalf("expected error, did not get one") } aerr := err.(awserr.Error) if e, a := request.CanceledErrorCode, aerr.Code(); e != a { t.Errorf("expected error code %q, got %q", e, a) } if e, a := "canceled", aerr.Message(); !strings.Contains(a, e) { t.Errorf("expected error message to contain %q, but did not %q", e, a) } } func TestEncryptionClient_PutObject_InvalidClientConstruction(t *testing.T) { generator := mockGeneratorV2{} cb := mockCipherBuilderV2{generator: generator} c := NewEncryptionClient(unit.Session, cb) if c == nil { t.Errorf("expected client not to be nil") } input := s3.PutObjectInput{ Bucket: aws.String("test"), Key: aws.String("test"), Body: bytes.NewReader([]byte{}), } _, err := c.PutObject(&input) if err == nil { t.Fatalf("expected error, did not get one") } if e, a := "invalid client configuration", err.Error(); !strings.Contains(a, e) { t.Errorf("expected %v, got %v", e, a) } _, err = c.PutObjectWithContext(aws.BackgroundContext(), &input) if err == nil { t.Fatalf("expected error, did not get one") } if e, a := "invalid client configuration", err.Error(); !strings.Contains(a, e) { t.Errorf("expected %v, got %v", e, a) } _, err = c.PutObjectWithContext(aws.BackgroundContext(), &input) if err == nil { t.Fatalf("expected error, did not get one") } if e, a := "invalid client configuration", err.Error(); !strings.Contains(a, e) { t.Errorf("expected %v, got %v", e, a) } req, _ := c.PutObjectRequest(&input) err = req.Send() if err == nil { t.Fatalf("expected error, did not get one") } if e, a := "invalid client configuration", err.Error(); !strings.Contains(a, e) { t.Errorf("expected %v, got %v", e, a) } }	4.2 KB	2025-05-25 12:27
📄 encryption_client_v2.go package s3crypto import ( "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3iface" ) const customTypeWarningMessage = "WARNING: The S3 Encryption Client is configured to write encrypted objects using types not provided by AWS. Security and compatibility with these types can not be guaranteed." // EncryptionClientV2 is an S3 crypto client. By default the SDK will use Authentication mode which // will use KMS for key wrapping and AES GCM for content encryption. // AES GCM will load all data into memory. However, the rest of the content algorithms // do not load the entire contents into memory. type EncryptionClientV2 struct { options EncryptionClientOptions } // EncryptionClientOptions is the configuration options for EncryptionClientV2 type EncryptionClientOptions struct { S3Client s3iface.S3API ContentCipherBuilder ContentCipherBuilder // SaveStrategy will dictate where the envelope is saved. // // Defaults to the object's metadata SaveStrategy SaveStrategy // TempFolderPath is used to store temp files when calling PutObject. // Temporary files are needed to compute the X-Amz-Content-Sha256 header. TempFolderPath string // MinFileSize is the minimum size for the content to write to a // temporary file instead of using memory. MinFileSize int64 } // NewEncryptionClientV2 instantiates a new S3 crypto client. An error will be returned to the caller if the provided // contentCipherBuilder has been deprecated or was constructed with a deprecated component. // // Example: // // cmkID := "arn:aws:kms:region:000000000000:key/00000000-0000-0000-0000-000000000000" // sess := session.Must(session.NewSession()) // var matdesc s3crypto.MaterialDescription // handler := s3crypto.NewKMSContextKeyGenerator(kms.New(sess), cmkID, matdesc) // svc := s3crypto.NewEncryptionClientV2(sess, s3crypto.AESGCMContentCipherBuilderV2(handler)) func NewEncryptionClientV2(prov client.ConfigProvider, contentCipherBuilder ContentCipherBuilder, options ...func(clientOptions EncryptionClientOptions), ) ( client EncryptionClientV2, err error, ) { s3client := s3.New(prov) s3client.Handlers.Build.PushBack(func(r request.Request) { request.AddToUserAgent(r, "S3CryptoV2") }) clientOptions := &EncryptionClientOptions{ S3Client: s3client, ContentCipherBuilder: contentCipherBuilder, SaveStrategy: HeaderV2SaveStrategy{}, MinFileSize: DefaultMinFileSize, } for _, option := range options { option(clientOptions) } // Check that the configured client uses a compatible ContentCipherBuilder. // User provided types will not implement this method if fixture, ok := contentCipherBuilder.(compatibleEncryptionFixture); ok { if err := fixture.isEncryptionVersionCompatible(v2ClientVersion); err != nil { return nil, err } } // Check if the passed in type is an fixture, if not log a warning message to the user if fixture, ok := contentCipherBuilder.(awsFixture); !ok \|\| !fixture.isAWSFixture() { if s3client.Config.Logger != nil { s3client.Config.Logger.Log(customTypeWarningMessage) } } client = &EncryptionClientV2{ clientOptions, } return client, err } // PutObjectRequest creates a temp file to encrypt the contents into. It then streams // that data to S3. // // Example: // // req, out := svc.PutObjectRequest(&s3.PutObjectInput { // Key: aws.String("testKey"), // Bucket: aws.String("testBucket"), // Body: strings.NewReader("test data"), // }) // err := req.Send() func (c EncryptionClientV2) PutObjectRequest(input s3.PutObjectInput) (request.Request, s3.PutObjectOutput) { return putObjectRequest(c.options, input) } // PutObject is a wrapper for PutObjectRequest func (c EncryptionClientV2) PutObject(input s3.PutObjectInput) (s3.PutObjectOutput, error) { return putObject(c.options, input) } // PutObjectWithContext is a wrapper for PutObjectRequest with the additional // context, and request options support. // // PutObjectWithContext is the same as PutObject with the additional support for // Context input parameters. The Context must not be nil. A nil Context will // cause a panic. Use the Context to add deadlining, timeouts, etc. In the future // this may create sub-contexts for individual underlying requests. func (c EncryptionClientV2) PutObjectWithContext(ctx aws.Context, input s3.PutObjectInput, opts ...request.Option) (s3.PutObjectOutput, error) { return putObjectWithContext(c.options, ctx, input, opts...) }	4.51 KB	2025-05-25 12:27
📄 encryption_client_v2_test.go //go:build go1.7 // +build go1.7 package s3crypto import ( "bytes" "encoding/hex" "fmt" "io" "io/ioutil" "net/http" "net/http/httptest" "reflect" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/s3" ) func sessionWithLogCheck(message string) (session.Session, bool) { gotWarning := false u := unit.Session.Copy(&aws.Config{Logger: aws.LoggerFunc(func(i ...interface{}) { if len(i) == 0 { return } s, ok := i[0].(string) if !ok { return } if s == message { gotWarning = true } })}) return u, &gotWarning } func TestNewEncryptionClientV2(t testing.T) { tUnit, gotWarning := sessionWithLogCheck(customTypeWarningMessage) mcb := AESGCMContentCipherBuilderV2(NewKMSContextKeyGenerator(nil, "id", nil)) v2, err := NewEncryptionClientV2(tUnit, mcb) if err != nil { t.Fatalf("expected no error, got %v", err) } if v2 == nil { t.Fatal("expected client to not be nil") } if gotWarning { t.Errorf("expected no warning for aws provided custom cipher builder") } if !reflect.DeepEqual(mcb, v2.options.ContentCipherBuilder) { t.Errorf("content cipher builder did not match provided value") } _, ok := v2.options.SaveStrategy.(HeaderV2SaveStrategy) if !ok { t.Errorf("expected default save strategy to be s3 header strategy") } if v2.options.S3Client == nil { t.Errorf("expected s3 client not be nil") } if e, a := DefaultMinFileSize, v2.options.MinFileSize; int64(e) != a { t.Errorf("expected %v, got %v", e, a) } if e, a := "", v2.options.TempFolderPath; e != a { t.Errorf("expected %v, got %v", e, a) } } func TestNewEncryptionClientV2_NonDefaults(t testing.T) { tUnit, gotWarning := sessionWithLogCheck(customTypeWarningMessage) s3Client := s3.New(tUnit) mcb := mockCipherBuilderV2{} v2, err := NewEncryptionClientV2(tUnit, nil, func(clientOptions EncryptionClientOptions) { clientOptions.S3Client = s3Client clientOptions.ContentCipherBuilder = mcb clientOptions.TempFolderPath = "/mock/path" clientOptions.MinFileSize = 42 clientOptions.SaveStrategy = S3SaveStrategy{} }) if err != nil { t.Fatalf("expected no error, got %v", err) } if v2 == nil { t.Fatal("expected client to not be nil") } if !gotWarning { t.Errorf("expected warning for custom provided content cipher builder") } if !reflect.DeepEqual(mcb, v2.options.ContentCipherBuilder) { t.Errorf("content cipher builder did not match provided value") } _, ok := v2.options.SaveStrategy.(S3SaveStrategy) if !ok { t.Errorf("expected default save strategy to be s3 header strategy") } if v2.options.S3Client != s3Client { t.Errorf("expected s3 client not be nil") } if e, a := 42, v2.options.MinFileSize; int64(e) != a { t.Errorf("expected %v, got %v", e, a) } if e, a := "/mock/path", v2.options.TempFolderPath; e != a { t.Errorf("expected %v, got %v", e, a) } } // cdgWithStaticTestIV is a test structure that wraps a CipherDataGeneratorWithCEKAlg and stubs in a static IV // so that encryption tests can be guaranteed to be consistent. type cdgWithStaticTestIV struct { IV []byte CipherDataGeneratorWithCEKAlg } // isAWSFixture will avoid the warning log message when doing tests that need to mock the IV func (k cdgWithStaticTestIV) isAWSFixture() bool { return true } func (k cdgWithStaticTestIV) GenerateCipherDataWithCEKAlg(ctx aws.Context, keySize, ivSize int, cekAlg string) (CipherData, error) { cipherData, err := k.CipherDataGeneratorWithCEKAlg.GenerateCipherDataWithCEKAlg(ctx, keySize, ivSize, cekAlg) if err == nil { cipherData.IV = k.IV } return cipherData, err } func TestEncryptionClientV2_PutObject_KMSCONTEXT_AESGCM(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request http.Request) { fmt.Fprintln(writer, `{"CiphertextBlob":"8gSzlk7giyfFbLPUVgoVjvQebI1827jp8lDkO+n2chsiSoegx1sjm8NdPk0Bl70I","KeyId":"test-key-id","Plaintext":"lP6AbIQTmptyb/+WQq+ubDw+w7na0T1LGSByZGuaono="}`) })) sess := unit.Session.Copy() kmsClient := kms.New(sess.Copy(&aws.Config{Endpoint: &ts.URL})) var md MaterialDescription iv, _ := hex.DecodeString("ae325acae2bfd5b9c3d0b813") kmsWithStaticIV := cdgWithStaticTestIV{ IV: iv, CipherDataGeneratorWithCEKAlg: NewKMSContextKeyGenerator(kmsClient, "test-key-id", md), } contentCipherBuilderV2 := AESGCMContentCipherBuilderV2(kmsWithStaticIV) client, err := NewEncryptionClientV2(sess, contentCipherBuilderV2) if err != nil { t.Fatalf("expected no error, got %v", err) } req, _ := client.PutObjectRequest(&s3.PutObjectInput{ Bucket: aws.String("test-bucket"), Key: aws.String("test-key"), Body: func() io.ReadSeeker { content, _ := hex.DecodeString("8f2c59c6dbfcacf356f3da40788cbde67ca38161a4702cbcf757af663e1c24a600001b2f500417dbf5a050f57db6737422b2ed6a44c75e0d") return bytes.NewReader(content) }(), }) req.Handlers.Send.Clear() req.Handlers.Send.PushFront(func(r request.Request) { all, err := ioutil.ReadAll(r.Body) if err != nil { t.Fatalf("expected no error, got %v", err) } expected, _ := hex.DecodeString("4cd8e95a1c9b8b19640e02838b02c8c09e66250703a602956695afbc23cbb8647d51645955ab63b89733d0766f9a264adb88571b1d467b734ff72eb73d31de9a83670d59688c54ea") if !bytes.Equal(all, expected) { t.Error("encrypted bytes did not match expected") } req.HTTPResponse = &http.Response{ Status: http.StatusText(200), StatusCode: http.StatusOK, Body: aws.ReadSeekCloser(bytes.NewReader([]byte{})), } }) err = req.Send() if err != nil { t.Errorf("expected no error, got %v", err) } } func TestNewEncryptionClientV2_FailsOnIncompatibleFixtures(t *testing.T) { sess := unit.Session.Copy() _, err := NewEncryptionClientV2(sess, AESGCMContentCipherBuilder(NewKMSKeyGenerator(kms.New(sess), "cmkId"))) if err == nil { t.Fatal("expected to fail, but got nil") } if !strings.Contains(err.Error(), "attempted to use deprecated or incompatible cipher builder") { t.Errorf("expected to get error for using dperecated cipher builder") } }	6.11 KB	2025-05-25 12:27
📄 envelope.go package s3crypto import ( "encoding/json" "fmt" "strconv" ) // DefaultInstructionKeySuffix is appended to the end of the instruction file key when // grabbing or saving to S3 const DefaultInstructionKeySuffix = ".instruction" const ( metaHeader = "x-amz-meta" keyV1Header = "x-amz-key" keyV2Header = keyV1Header + "-v2" ivHeader = "x-amz-iv" matDescHeader = "x-amz-matdesc" cekAlgorithmHeader = "x-amz-cek-alg" wrapAlgorithmHeader = "x-amz-wrap-alg" tagLengthHeader = "x-amz-tag-len" unencryptedMD5Header = "x-amz-unencrypted-content-md5" unencryptedContentLengthHeader = "x-amz-unencrypted-content-length" ) // Envelope encryption starts off by generating a random symmetric key using // AES GCM. The SDK generates a random IV based off the encryption cipher // chosen. The master key that was provided, whether by the user or KMS, will be used // to encrypt the randomly generated symmetric key and base64 encode the iv. This will // allow for decryption of that same data later. type Envelope struct { // IV is the randomly generated IV base64 encoded. IV string `json:"x-amz-iv"` // CipherKey is the randomly generated cipher key. CipherKey string `json:"x-amz-key-v2"` // MaterialDesc is a description to distinguish from other envelopes. MatDesc string `json:"x-amz-matdesc"` WrapAlg string `json:"x-amz-wrap-alg"` CEKAlg string `json:"x-amz-cek-alg"` TagLen string `json:"x-amz-tag-len"` // Deprecated: This MD5 hash is no longer populated UnencryptedMD5 string `json:"-"` UnencryptedContentLen string `json:"x-amz-unencrypted-content-length"` } // UnmarshalJSON unmarshalls the given JSON bytes into Envelope func (e Envelope) UnmarshalJSON(value []byte) error { type StrictEnvelope Envelope type LaxEnvelope struct { StrictEnvelope TagLen json.RawMessage `json:"x-amz-tag-len"` UnencryptedContentLen json.RawMessage `json:"x-amz-unencrypted-content-length"` } inner := LaxEnvelope{} err := json.Unmarshal(value, &inner) if err != nil { return err } e = Envelope(inner.StrictEnvelope) e.TagLen, err = getJSONNumberAsString(inner.TagLen) if err != nil { return fmt.Errorf("failed to parse tag length: %v", err) } e.UnencryptedContentLen, err = getJSONNumberAsString(inner.UnencryptedContentLen) if err != nil { return fmt.Errorf("failed to parse unencrypted content length: %v", err) } return nil } // getJSONNumberAsString will attempt to convert the provided bytes into a string representation of a JSON Number. // Only supports byte values that are string or integers, not floats. If the provided value is JSON Null, empty string // will be returned. func getJSONNumberAsString(data []byte) (string, error) { if len(data) == 0 { return "", nil } // first try string, this also catches null value var s string err := json.Unmarshal(data, &s) if err == nil && s != nil { return s, nil } else if err == nil { return "", nil } // fallback to int64 var i int64 err = json.Unmarshal(data, &i) if err == nil { return strconv.FormatInt(i, 10), nil } return "", fmt.Errorf("failed to parse as JSON Number") }	3.19 KB	2025-05-25 12:27
📄 envelope_test.go //go:build go1.7 // +build go1.7 package s3crypto import ( "encoding/json" "reflect" "testing" ) func TestEnvelope_UnmarshalJSON(t testing.T) { cases := map[string]struct { content []byte expected Envelope actual Envelope }{ "string json numbers": { content: []byte(`{ "x-amz-iv": "iv", "x-amz-key-v2": "key", "x-amz-matdesc": "{\"aws:x-amz-cek-alg\":\"AES/GCM/NoPadding\"}", "x-amz-wrap-alg": "kms+context", "x-amz-cek-alg": "AES/GCM/NoPadding", "x-amz-tag-len": "128", "x-amz-unencrypted-content-length": "1024" } `), expected: Envelope{ IV: "iv", CipherKey: "key", MatDesc: `{"aws:x-amz-cek-alg":"AES/GCM/NoPadding"}`, WrapAlg: "kms+context", CEKAlg: "AES/GCM/NoPadding", TagLen: "128", UnencryptedContentLen: "1024", }, }, "integer json numbers": { content: []byte(`{ "x-amz-iv": "iv", "x-amz-key-v2": "key", "x-amz-matdesc": "{\"aws:x-amz-cek-alg\":\"AES/GCM/NoPadding\"}", "x-amz-wrap-alg": "kms+context", "x-amz-cek-alg": "AES/GCM/NoPadding", "x-amz-tag-len": 128, "x-amz-unencrypted-content-length": 1024 } `), expected: Envelope{ IV: "iv", CipherKey: "key", MatDesc: `{"aws:x-amz-cek-alg":"AES/GCM/NoPadding"}`, WrapAlg: "kms+context", CEKAlg: "AES/GCM/NoPadding", TagLen: "128", UnencryptedContentLen: "1024", }, }, "null json numbers": { content: []byte(`{ "x-amz-iv": "iv", "x-amz-key-v2": "key", "x-amz-matdesc": "{\"aws:x-amz-cek-alg\":\"AES/GCM/NoPadding\"}", "x-amz-wrap-alg": "kms+context", "x-amz-cek-alg": "AES/GCM/NoPadding", "x-amz-tag-len": null, "x-amz-unencrypted-content-length": null } `), expected: Envelope{ IV: "iv", CipherKey: "key", MatDesc: `{"aws:x-amz-cek-alg":"AES/GCM/NoPadding"}`, WrapAlg: "kms+context", CEKAlg: "AES/GCM/NoPadding", }, }, "no json numbers": { content: []byte(`{ "x-amz-iv": "iv", "x-amz-key-v2": "key", "x-amz-matdesc": "{\"aws:x-amz-cek-alg\":\"AES/GCM/NoPadding\"}", "x-amz-wrap-alg": "kms+context", "x-amz-cek-alg": "AES/GCM/NoPadding" } `), expected: Envelope{ IV: "iv", CipherKey: "key", MatDesc: `{"aws:x-amz-cek-alg":"AES/GCM/NoPadding"}`, WrapAlg: "kms+context", CEKAlg: "AES/GCM/NoPadding", }, }, } for name, tt := range cases { t.Run(name, func(t testing.T) { err := json.Unmarshal(tt.content, &tt.actual) if err != nil { t.Errorf("expected no error, got %v", err) } if !reflect.DeepEqual(tt.expected, tt.actual) { t.Errorf("expected %v, got %v", tt.expected, tt.actual) } }) } }	2.74 KB	2025-05-25 12:27
📄 errors.go package s3crypto import "fmt" var errNilCryptoRegistry = fmt.Errorf("provided CryptoRegistry must not be nil") var errNilWrapEntry = fmt.Errorf("wrap entry must not be nil") var errNilCEKEntry = fmt.Errorf("cek entry must not be nil") var errNilPadder = fmt.Errorf("padder must not be nil") func newErrDuplicateWrapEntry(name string) error { return newErrDuplicateRegistryEntry("wrap", name) } func newErrDuplicateCEKEntry(name string) error { return newErrDuplicateRegistryEntry("cek", name) } func newErrDuplicatePadderEntry(name string) error { return newErrDuplicateRegistryEntry("padder", name) } func newErrDuplicateRegistryEntry(registry, key string) error { return fmt.Errorf("duplicate %v registry entry, %v", registry, key) }	746 B	2025-05-25 12:27
📄 fixture.go package s3crypto import "fmt" type clientVersion int const ( v1ClientVersion clientVersion = 1 + iota v2ClientVersion ) var errDeprecatedIncompatibleCipherBuilder = fmt.Errorf("attempted to use deprecated or incompatible cipher builder") // compatibleEncryptionFixture is an unexported interface to expose whether a given fixture is compatible for encryption // given the provided client version. type compatibleEncryptionFixture interface { isEncryptionVersionCompatible(clientVersion) error } // awsFixture is an unexported interface to expose whether a given fixture is an aws provided fixture, and whether that // fixtures dependencies were constructed using aws types. // // This interface is used in v2 clients to warn users if they are using custom implementations of ContentCipherBuilder // or CipherDataGenerator. type awsFixture interface { isAWSFixture() bool }	883 B	2025-05-25 12:27
📄 hash_io.go package s3crypto import ( "crypto/sha256" "hash" "io" ) // lengthReader returns the content length type lengthReader interface { GetContentLength() int64 } type contentLengthReader struct { contentLength int64 body io.Reader } func newContentLengthReader(f io.Reader) contentLengthReader { return &contentLengthReader{body: f} } func (r contentLengthReader) Read(b []byte) (int, error) { n, err := r.body.Read(b) if err != nil && err != io.EOF { return n, err } r.contentLength += int64(n) return n, err } func (r contentLengthReader) GetContentLength() int64 { return r.contentLength } type sha256Writer struct { sha256 []byte hash hash.Hash out io.Writer } func newSHA256Writer(f io.Writer) sha256Writer { return &sha256Writer{hash: sha256.New(), out: f} } func (r sha256Writer) Write(b []byte) (int, error) { r.hash.Write(b) return r.out.Write(b) } func (r sha256Writer) GetValue() []byte { return r.hash.Sum(nil) }	970 B	2025-05-25 12:27
📄 hash_io_test.go package s3crypto import ( "bytes" "encoding/hex" "fmt" "io" "io/ioutil" "strings" "testing" ) // From Go stdlib encoding/sha256 test cases func TestSHA256(t testing.T) { sha := newSHA256Writer(nil) expected, _ := hex.DecodeString("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855") b := sha.GetValue() if !bytes.Equal(expected, b) { t.Errorf("expected equivalent sha values, but received otherwise") } } func TestSHA256_Case2(t testing.T) { sha := newSHA256Writer(bytes.NewBuffer([]byte{})) sha.Write([]byte("hello")) expected, _ := hex.DecodeString("2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824") b := sha.GetValue() if !bytes.Equal(expected, b) { t.Errorf("expected equivalent sha values, but received otherwise") } } type mockReader struct { err error } func (m mockReader) Read(p []byte) (int, error) { return len(p), m.err } func TestContentLengthReader(t *testing.T) { cases := []struct { reader io.Reader expected int64 expectedErr string }{ { reader: bytes.NewReader([]byte("foo bar baz")), expected: 11, }, { reader: bytes.NewReader(nil), expected: 0, }, { reader: mockReader{err: fmt.Errorf("not an EOF error")}, expectedErr: "not an EOF error", }, } for _, tt := range cases { reader := newContentLengthReader(tt.reader) _, err := ioutil.ReadAll(reader) if err != nil { if len(tt.expectedErr) == 0 { t.Errorf("expected no error, got %v", err) } else if !strings.Contains(err.Error(), tt.expectedErr) { t.Errorf("expected error %v, got %v", tt.expectedErr, err.Error()) } continue } else if len(tt.expectedErr) > 0 { t.Error("expected error, got none") continue } actual := reader.GetContentLength() if tt.expected != actual { t.Errorf("expected %v, got %v", tt.expected, actual) } } }	1.83 KB	2025-05-25 12:27
📄 helper.go package s3crypto import ( "errors" "io" "io/ioutil" "os" "github.com/aws/aws-sdk-go/aws/request" ) func getWriterStore(req request.Request, path string, useTempFile bool) (io.ReadWriteSeeker, error) { if !useTempFile { return &bytesReadWriteSeeker{}, nil } // Create temp file to be used later for calculating the SHA256 header f, err := ioutil.TempFile(path, "") if err != nil { return nil, err } req.Handlers.Complete.PushBack(func(r request.Request) { // Close the temp file and cleanup f.Close() os.Remove(f.Name()) }) return f, nil } type bytesReadWriteSeeker struct { buf []byte i int64 } // Copied from Go stdlib bytes.Reader func (ws bytesReadWriteSeeker) Read(b []byte) (int, error) { if ws.i >= int64(len(ws.buf)) { return 0, io.EOF } n := copy(b, ws.buf[ws.i:]) ws.i += int64(n) return n, nil } func (ws bytesReadWriteSeeker) Write(b []byte) (int, error) { ws.buf = append(ws.buf, b...) return len(b), nil } // Copied from Go stdlib bytes.Reader func (ws *bytesReadWriteSeeker) Seek(offset int64, whence int) (int64, error) { var abs int64 switch whence { case 0: abs = offset case 1: abs = int64(ws.i) + offset case 2: abs = int64(len(ws.buf)) + offset default: return 0, errors.New("bytes.Reader.Seek: invalid whence") } if abs < 0 { return 0, errors.New("bytes.Reader.Seek: negative position") } ws.i = abs return abs, nil }	1.38 KB	2025-05-25 12:27
📄 helper_test.go package s3crypto import ( "bytes" "io/ioutil" "net/http" "os" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting" "github.com/aws/aws-sdk-go/internal/sdkio" ) func TestBytesReadWriteSeeker_Read(t testing.T) { b := &bytesReadWriteSeeker{[]byte{1, 2, 3}, 0} expected := []byte{1, 2, 3} buf := make([]byte, 3) n, err := b.Read(buf) if err != nil { t.Errorf("expected no error, but received %v", err) } if e, a := 3, n; e != a { t.Errorf("expected %d, but received %d", e, a) } if !bytes.Equal(expected, buf) { t.Error("expected equivalent byte slices, but received otherwise") } } func TestBytesReadWriteSeeker_Write(t testing.T) { b := &bytesReadWriteSeeker{} expected := []byte{1, 2, 3} buf := make([]byte, 3) n, err := b.Write([]byte{1, 2, 3}) if err != nil { t.Errorf("expected no error, but received %v", err) } if e, a := 3, n; e != a { t.Errorf("expected %d, but received %d", e, a) } n, err = b.Read(buf) if err != nil { t.Errorf("expected no error, but received %v", err) } if e, a := 3, n; e != a { t.Errorf("expected %d, but received %d", e, a) } if !bytes.Equal(expected, buf) { t.Error("expected equivalent byte slices, but received otherwise") } } func TestBytesReadWriteSeeker_Seek(t testing.T) { b := &bytesReadWriteSeeker{[]byte{1, 2, 3}, 0} expected := []byte{2, 3} m, err := b.Seek(1, sdkio.SeekStart) if err != nil { t.Errorf("expected no error, but received %v", err) } if e, a := 1, int(m); e != a { t.Errorf("expected %d, but received %d", e, a) } buf := make([]byte, 3) n, err := b.Read(buf) if err != nil { t.Errorf("expected no error, but received %v", err) } if e, a := 2, n; e != a { t.Errorf("expected %d, but received %d", e, a) } if !bytes.Equal(expected, buf[:n]) { t.Error("expected equivalent byte slices, but received otherwise") } } func TestGetWriterStore_TempFile(t testing.T) { response := http.Response{StatusCode: 200} s := awstesting.NewClient(aws.NewConfig().WithMaxRetries(10)) s.Handlers.Validate.Clear() s.Handlers.Send.Clear() // mock sending s.Handlers.Send.PushBack(func(r request.Request) { r.HTTPResponse = &response }) type testData struct { Data string } out := &testData{} r := s.NewRequest(&request.Operation{Name: "Operation"}, nil, out) f, err := getWriterStore(r, "", true) if err != nil { t.Fatalf("expected no error, but received %v", err) } tempFile, ok := f.(os.File) if !ok { t.Fatal("io.ReadWriteSeeker expected to be os.file") } err = r.Send() if err != nil { t.Errorf("expected no error, but received %v", err) } if _, err := os.Stat(tempFile.Name()); !os.IsNotExist(err) { t.Errorf("expected temp file be deleted, but still exists %v", tempFile.Name()) } } func TestGetWriterStore_TempFileWithRetry(t testing.T) { responses := []http.Response{ {StatusCode: 500, Header: http.Header{}, Body: ioutil.NopCloser(&bytes.Buffer{})}, {StatusCode: 200, Header: http.Header{}, Body: ioutil.NopCloser(&bytes.Buffer{})}, } s := awstesting.NewClient(aws.NewConfig().WithMaxRetries(10)) s.Handlers.Validate.Clear() s.Handlers.Send.Clear() // mock sending s.Handlers.Send.PushBack(func(r request.Request) { r.HTTPResponse = responses[0] responses = responses[1:] }) type testData struct { Data string } out := &testData{} r := s.NewRequest(&request.Operation{Name: "Operation"}, nil, out) f, err := getWriterStore(r, "", true) if err != nil { t.Fatalf("expected no error, but received %v", err) } tempFile, ok := f.(os.File) if !ok { t.Fatal("io.ReadWriteSeeker expected to be os.file") } err = r.Send() if err != nil { t.Errorf("expected no error, but received %v", err) } if _, err := os.Stat(tempFile.Name()); !os.IsNotExist(err) { t.Errorf("expected temp file be deleted, but still exists %v", tempFile.Name()) } if v := len(responses); v != 0 { t.Errorf("expect all retries to be used, have %v remaining", v) } } func TestGetWriterStore_Memory(t testing.T) { response := http.Response{StatusCode: 200} s := awstesting.NewClient(aws.NewConfig().WithMaxRetries(10)) s.Handlers.Validate.Clear() s.Handlers.Send.Clear() // mock sending s.Handlers.Send.PushBack(func(r request.Request) { r.HTTPResponse = &response }) type testData struct { Data string } out := &testData{} r := s.NewRequest(&request.Operation{Name: "Operation"}, nil, out) f, err := getWriterStore(r, "", false) if err != nil { t.Fatalf("expected no error, but received %v", err) } if _, ok := f.(bytesReadWriteSeeker); !ok { t.Fatal("io.ReadWriteSeeker expected to be bytesReadWriteSeeker") } if err != nil { t.Errorf("expected no error, but received %v", err) } err = r.Send() if err != nil { t.Errorf("expected no error, but received %v", err) } }	4.75 KB	2025-05-25 12:27
📄 integ_test.go //go:build go1.9 && s3crypto_integ // +build go1.9,s3crypto_integ package s3crypto_test import ( "bytes" "encoding/base64" "fmt" "io/ioutil" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/awstesting/integration" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3crypto" ) func TestInteg_EncryptFixtures(t testing.T) { sess := integration.SessionWithDefaultRegion("us-west-2") const bucket = "aws-s3-shared-tests" const version = "version_2" cases := []struct { CEKAlg string KEK, V1, V2, CEK string }{ { CEKAlg: "aes_gcm", KEK: "kms", V1: "AWS_SDK_TEST_ALIAS", V2: "us-west-2", CEK: "aes_gcm", }, { CEKAlg: "aes_cbc", KEK: "kms", V1: "AWS_SDK_TEST_ALIAS", V2: "us-west-2", CEK: "aes_cbc", }, } for _, c := range cases { t.Run(c.CEKAlg, func(t testing.T) { s3Client := s3.New(sess) fixtures := getFixtures(t, s3Client, c.CEKAlg, bucket) builder, masterKey := getEncryptFixtureBuilder(t, c.KEK, c.V1, c.V2, c.CEK) encClient := s3crypto.NewEncryptionClient(sess, builder) for caseKey, plaintext := range fixtures.Plaintexts { _, err := encClient.PutObject(&s3.PutObjectInput{ Bucket: aws.String(bucket), Key: aws.String( fmt.Sprintf("%s/%s/language_Go/ciphertext_test_case_%s", fixtures.BaseFolder, version, caseKey), ), Body: bytes.NewReader(plaintext), Metadata: map[string]string{ "Masterkey": &masterKey, }, }) if err != nil { t.Fatalf("failed to upload encrypted fixture, %v", err) } } }) } } func TestInteg_DecryptFixtures(t testing.T) { sess := integration.SessionWithDefaultRegion("us-west-2") const bucket = "aws-s3-shared-tests" const version = "version_2" cases := []struct { CEKAlg string Lang string }{ {CEKAlg: "aes_cbc", Lang: "Go"}, {CEKAlg: "aes_gcm", Lang: "Go"}, {CEKAlg: "aes_cbc", Lang: "Java"}, {CEKAlg: "aes_gcm", Lang: "Java"}, } for _, c := range cases { t.Run(c.CEKAlg+"-"+c.Lang, func(t testing.T) { decClient := s3crypto.NewDecryptionClient(sess) s3Client := s3.New(sess) fixtures := getFixtures(t, s3Client, c.CEKAlg, bucket) ciphertexts := decryptFixtures(t, decClient, s3Client, fixtures, bucket, c.Lang, version) for caseKey, ciphertext := range ciphertexts { if e, a := len(fixtures.Plaintexts[caseKey]), len(ciphertext); e != a { t.Errorf("expect %v text len, got %v", e, a) } if e, a := fixtures.Plaintexts[caseKey], ciphertext; !bytes.Equal(e, a) { t.Errorf("expect %v text, got %v", e, a) } } }) } } type testFixtures struct { BaseFolder string Plaintexts map[string][]byte } func getFixtures(t testing.T, s3Client s3.S3, cekAlg, bucket string) testFixtures { t.Helper() prefix := "plaintext_test_case_" baseFolder := "crypto_tests/" + cekAlg out, err := s3Client.ListObjects(&s3.ListObjectsInput{ Bucket: aws.String(bucket), Prefix: aws.String(baseFolder + "/" + prefix), }) if err != nil { t.Fatalf("unable to list fixtures %v", err) } plaintexts := map[string][]byte{} for _, obj := range out.Contents { ptObj, err := s3Client.GetObject(&s3.GetObjectInput{ Bucket: aws.String(bucket), Key: obj.Key, }) if err != nil { t.Fatalf("unable to get fixture object %s, %v", obj.Key, err) } caseKey := strings.TrimPrefix(obj.Key, baseFolder+"/"+prefix) plaintext, err := ioutil.ReadAll(ptObj.Body) if err != nil { t.Fatalf("unable to read fixture object %s, %v", obj.Key, err) } plaintexts[caseKey] = plaintext } return testFixtures{ BaseFolder: baseFolder, Plaintexts: plaintexts, } } func getEncryptFixtureBuilder(t testing.T, kek, v1, v2, cek string, ) (builder s3crypto.ContentCipherBuilder, masterKey string) { t.Helper() var handler s3crypto.CipherDataGenerator switch kek { case "kms": arn, err := getAliasInformation(v1, v2) if err != nil { t.Fatalf("failed to get fixture alias info for %s, %v", v1, err) } masterKey = base64.StdEncoding.EncodeToString([]byte(arn)) if err != nil { t.Fatalf("failed to encode alias's arn %v", err) } kmsSvc := kms.New(integration.Session, &aws.Config{ Region: &v2, }) handler = s3crypto.NewKMSKeyGenerator(kmsSvc, arn) default: t.Fatalf("unknown fixture KEK, %v", kek) } switch cek { case "aes_gcm": builder = s3crypto.AESGCMContentCipherBuilder(handler) case "aes_cbc": builder = s3crypto.AESCBCContentCipherBuilder(handler, s3crypto.AESCBCPadder) default: t.Fatalf("unknown fixture CEK, %v", cek) } return builder, masterKey } func getAliasInformation(alias, region string) (string, error) { arn := "" svc := kms.New(integration.Session, &aws.Config{ Region: &region, }) truncated := true var marker string for truncated { out, err := svc.ListAliases(&kms.ListAliasesInput{ Marker: marker, }) if err != nil { return arn, err } for _, aliasEntry := range out.Aliases { if aliasEntry.AliasName == "alias/"+alias { return aliasEntry.AliasArn, nil } } truncated = out.Truncated marker = out.NextMarker } return "", fmt.Errorf("kms alias %s does not exist", alias) } func decryptFixtures(t testing.T, decClient s3crypto.DecryptionClient, s3Client s3.S3, fixtures testFixtures, bucket, lang, version string, ) map[string][]byte { t.Helper() prefix := "ciphertext_test_case_" lang = "language_" + lang ciphertexts := map[string][]byte{} for caseKey := range fixtures.Plaintexts { cipherKey := fixtures.BaseFolder + "/" + version + "/" + lang + "/" + prefix + caseKey // To get metadata for encryption key ctObj, err := s3Client.GetObject(&s3.GetObjectInput{ Bucket: &bucket, Key: &cipherKey, }) if err != nil { // TODO error? continue } // We don't support wrap, so skip it if ctObj.Metadata["X-Amz-Wrap-Alg"] == nil \|\| *ctObj.Metadata["X-Amz-Wrap-Alg"] != "kms" { continue } ctObj, err = decClient.GetObject(&s3.GetObjectInput{ Bucket: &bucket, Key: &cipherKey, }) if err != nil { t.Fatalf("failed to get encrypted object %v", err) } ciphertext, err := ioutil.ReadAll(ctObj.Body) if err != nil { t.Fatalf("failed to read object data %v", err) } ciphertexts[caseKey] = ciphertext } return ciphertexts }	6.22 KB	2025-05-25 12:27
📁 integration	-	2025-05-25 12:27
📄 key_handler.go package s3crypto import ( "crypto/rand" "github.com/aws/aws-sdk-go/aws" ) // CipherDataGenerator handles generating proper key and IVs of proper size for the // content cipher. CipherDataGenerator will also encrypt the key and store it in // the CipherData. type CipherDataGenerator interface { GenerateCipherData(int, int) (CipherData, error) } // CipherDataGeneratorWithContext handles generating proper key and IVs of // proper size for the content cipher. CipherDataGenerator will also encrypt // the key and store it in the CipherData. type CipherDataGeneratorWithContext interface { GenerateCipherDataWithContext(aws.Context, int, int) (CipherData, error) } // CipherDataGeneratorWithCEKAlg handles generating proper key and IVs of proper size for the // content cipher. CipherDataGenerator will also encrypt the key and store it in // the CipherData. type CipherDataGeneratorWithCEKAlg interface { GenerateCipherDataWithCEKAlg(ctx aws.Context, keySize, ivSize int, cekAlgorithm string) (CipherData, error) } // CipherDataDecrypter is a handler to decrypt keys from the envelope. type CipherDataDecrypter interface { DecryptKey([]byte) ([]byte, error) } // CipherDataDecrypterWithContext is a handler to decrypt keys from the envelope with request context. type CipherDataDecrypterWithContext interface { DecryptKeyWithContext(aws.Context, []byte) ([]byte, error) } func generateBytes(n int) ([]byte, error) { b := make([]byte, n) _, err := rand.Read(b) if err != nil { return nil, err } return b, nil }	1.5 KB	2025-05-25 12:27
📄 key_handler_test.go package s3crypto import ( "testing" ) func TestGenerateBytes(t *testing.T) { b, _ := generateBytes(5) if e, a := 5, len(b); e != a { t.Errorf("expected %d, but received %d", e, a) } b, _ = generateBytes(0) if e, a := 0, len(b); e != a { t.Errorf("expected %d, but received %d", e, a) } b, _ = generateBytes(1024) if e, a := 1024, len(b); e != a { t.Errorf("expected %d, but received %d", e, a) } }	416 B	2025-05-25 12:27
📄 kms_context_key_handler.go package s3crypto import ( "fmt" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/kms/kmsiface" ) const ( // KMSContextWrap is a constant used during decryption to build a kms+context key handler KMSContextWrap = "kms+context" kmsAWSCEKContextKey = "aws:" + cekAlgorithmHeader kmsReservedKeyConflictErrMsg = "conflict in reserved KMS Encryption Context key %s. This value is reserved for the S3 Encryption Client and cannot be set by the user" kmsMismatchCEKAlg = "the content encryption algorithm used at encryption time does not match the algorithm stored for decryption time. The object may be altered or corrupted" ) // NewKMSContextKeyGenerator builds a new kms+context key provider using the customer key ID and material // description. // // Example: // // sess := session.Must(session.NewSession()) // cmkID := "KMS Key ARN" // var matdesc s3crypto.MaterialDescription // handler := s3crypto.NewKMSContextKeyGenerator(kms.New(sess), cmkID, matdesc) func NewKMSContextKeyGenerator(client kmsiface.KMSAPI, cmkID string, matdesc MaterialDescription) CipherDataGeneratorWithCEKAlg { return newKMSContextKeyHandler(client, cmkID, matdesc) } // RegisterKMSContextWrapWithCMK registers the kms+context wrapping algorithm to the given WrapRegistry. The wrapper // will be configured to only call KMS Decrypt using the provided CMK. // // Example: // // cr := s3crypto.NewCryptoRegistry() // if err := RegisterKMSContextWrapWithCMK(); err != nil { // panic(err) // handle error // } func RegisterKMSContextWrapWithCMK(registry CryptoRegistry, client kmsiface.KMSAPI, cmkID string) error { if registry == nil { return errNilCryptoRegistry } return registry.AddWrap(KMSContextWrap, newKMSContextWrapEntryWithCMK(client, cmkID)) } // RegisterKMSContextWrapWithAnyCMK registers the kms+context wrapping algorithm to the given WrapRegistry. The wrapper // will be configured to call KMS decrypt without providing a CMK. // // Example: // // sess := session.Must(session.NewSession()) // cr := s3crypto.NewCryptoRegistry() // if err := s3crypto.RegisterKMSContextWrapWithAnyCMK(cr, kms.New(sess)); err != nil { // panic(err) // handle error // } func RegisterKMSContextWrapWithAnyCMK(registry CryptoRegistry, client kmsiface.KMSAPI) error { if registry == nil { return errNilCryptoRegistry } return registry.AddWrap(KMSContextWrap, newKMSContextWrapEntryWithAnyCMK(client)) } // newKMSContextWrapEntryWithCMK builds returns a new kms+context key provider and its decrypt handler. // The returned handler will be configured to calls KMS Decrypt API without specifying a specific KMS CMK. func newKMSContextWrapEntryWithCMK(kmsClient kmsiface.KMSAPI, cmkID string) WrapEntry { // These values are read only making them thread safe kp := &kmsContextKeyHandler{ kms: kmsClient, cmkID: &cmkID, } return kp.decryptHandler } // newKMSContextWrapEntryWithAnyCMK builds returns a new kms+context key provider and its decrypt handler. // The returned handler will be configured to calls KMS Decrypt API without specifying a specific KMS CMK. func newKMSContextWrapEntryWithAnyCMK(kmsClient kmsiface.KMSAPI) WrapEntry { // These values are read only making them thread safe kp := &kmsContextKeyHandler{ kms: kmsClient, } return kp.decryptHandler } // kmsContextKeyHandler wraps the kmsKeyHandler to explicitly make this type incompatible with the v1 client // by not exposing the old interface implementations. type kmsContextKeyHandler struct { kms kmsiface.KMSAPI cmkID string CipherData } func (kp kmsContextKeyHandler) isAWSFixture() bool { return true } func newKMSContextKeyHandler(client kmsiface.KMSAPI, cmkID string, matdesc MaterialDescription) kmsContextKeyHandler { kp := &kmsContextKeyHandler{ kms: client, cmkID: &cmkID, } if matdesc == nil { matdesc = MaterialDescription{} } kp.CipherData.WrapAlgorithm = KMSContextWrap kp.CipherData.MaterialDescription = matdesc return kp } func (kp kmsContextKeyHandler) GenerateCipherDataWithCEKAlg(ctx aws.Context, keySize int, ivSize int, cekAlgorithm string) (CipherData, error) { cd := kp.CipherData.Clone() if len(cekAlgorithm) == 0 { return CipherData{}, fmt.Errorf("cek algorithm identifier must not be empty") } if _, ok := cd.MaterialDescription[kmsAWSCEKContextKey]; ok { return CipherData{}, fmt.Errorf(kmsReservedKeyConflictErrMsg, kmsAWSCEKContextKey) } cd.MaterialDescription[kmsAWSCEKContextKey] = &cekAlgorithm out, err := kp.kms.GenerateDataKeyWithContext(ctx, &kms.GenerateDataKeyInput{ EncryptionContext: cd.MaterialDescription, KeyId: kp.cmkID, KeySpec: aws.String("AES_256"), }) if err != nil { return CipherData{}, err } iv, err := generateBytes(ivSize) if err != nil { return CipherData{}, err } cd.Key = out.Plaintext cd.IV = iv cd.EncryptedKey = out.CiphertextBlob return cd, nil } // decryptHandler initializes a KMS keyprovider with a material description. This // is used with Decrypting kms content, due to the cmkID being in the material description. func (kp kmsContextKeyHandler) decryptHandler(env Envelope) (CipherDataDecrypter, error) { if env.WrapAlg != KMSContextWrap { return nil, fmt.Errorf("%s value `%s` did not match the expected algorithm `%s` for this handler", cekAlgorithmHeader, env.WrapAlg, KMSContextWrap) } m := MaterialDescription{} err := m.decodeDescription([]byte(env.MatDesc)) if err != nil { return nil, err } if v, ok := m[kmsAWSCEKContextKey]; !ok { return nil, fmt.Errorf("required key %v is missing from encryption context", kmsAWSCEKContextKey) } else if v == nil \|\| v != env.CEKAlg { return nil, fmt.Errorf(kmsMismatchCEKAlg) } kp.MaterialDescription = m kp.WrapAlgorithm = KMSContextWrap return &kp, nil } // DecryptKey makes a call to KMS to decrypt the key. func (kp kmsContextKeyHandler) DecryptKey(key []byte) ([]byte, error) { return kp.DecryptKeyWithContext(aws.BackgroundContext(), key) } // DecryptKeyWithContext makes a call to KMS to decrypt the key with request context. func (kp kmsContextKeyHandler) DecryptKeyWithContext(ctx aws.Context, key []byte) ([]byte, error) { out, err := kp.kms.DecryptWithContext(ctx, &kms.DecryptInput{ KeyId: kp.cmkID, // will be nil and not serialized if created with the AnyCMK constructor EncryptionContext: kp.MaterialDescription, CiphertextBlob: key, GrantTokens: []string{}, }) if err != nil { return nil, err } return out.Plaintext, nil } var ( _ CipherDataGeneratorWithCEKAlg = (kmsContextKeyHandler)(nil) _ CipherDataDecrypter = (kmsContextKeyHandler)(nil) _ CipherDataDecrypterWithContext = (kmsContextKeyHandler)(nil) _ awsFixture = (kmsContextKeyHandler)(nil) )	6.69 KB	2025-05-25 12:27
📄 kms_context_key_handler_test.go package s3crypto import ( "bytes" "encoding/base64" "encoding/hex" "encoding/json" "fmt" "io/ioutil" "net/http" "net/http/httptest" "reflect" "strings" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/kms" ) func TestKmsContextKeyHandler_GenerateCipherDataWithCEKAlg(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { bodyBytes, err := ioutil.ReadAll(r.Body) if err != nil { w.WriteHeader(500) return } var body map[string]interface{} err = json.Unmarshal(bodyBytes, &body) if err != nil { w.WriteHeader(500) return } md, ok := body["EncryptionContext"].(map[string]interface{}) if !ok { w.WriteHeader(500) return } exEncContext := map[string]interface{}{ "aws:" + cekAlgorithmHeader: "cekAlgValue", } if e, a := exEncContext, md; !reflect.DeepEqual(e, a) { w.WriteHeader(500) t.Errorf("expected %v, got %v", e, a) return } fmt.Fprintln(w, `{"CiphertextBlob":"AQEDAHhqBCCY1MSimw8gOGcUma79cn4ANvTtQyv9iuBdbcEF1QAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDJ6IcN5E4wVbk38MNAIBEIA7oF1E3lS7FY9DkoxPc/UmJsEwHzL82zMqoLwXIvi8LQHr8If4Lv6zKqY8u0+JRgSVoqCvZDx3p8Cn6nM=","KeyId":"arn:aws:kms:us-west-2:042062605278:key/c80a5cdb-8d09-4f9f-89ee-df01b2e3870a","Plaintext":"6tmyz9JLBE2yIuU7iXpArqpDVle172WSmxjcO6GNT7E="}`) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) svc := kms.New(sess) handler := NewKMSContextKeyGenerator(svc, "testid", nil) keySize := 32 ivSize := 16 cd, err := handler.GenerateCipherDataWithCEKAlg(aws.BackgroundContext(), keySize, ivSize, "cekAlgValue") if err != nil { t.Errorf("expected no error, but received %v", err) } if keySize != len(cd.Key) { t.Errorf("expected %d, but received %d", keySize, len(cd.Key)) } if ivSize != len(cd.IV) { t.Errorf("expected %d, but received %d", ivSize, len(cd.IV)) } } func TestKmsContextKeyHandler_GenerateCipherDataWithCEKAlg_ReservedKeyConflict(t testing.T) { svc := kms.New(unit.Session.Copy()) handler := NewKMSContextKeyGenerator(svc, "testid", MaterialDescription{ "aws:x-amz-cek-alg": aws.String("something unexpected"), }) _, err := handler.GenerateCipherDataWithCEKAlg(aws.BackgroundContext(), 32, 16, "cekAlgValue") if err == nil { t.Errorf("expected error, but none") } else if !strings.Contains(err.Error(), "conflict in reserved KMS Encryption Context key aws:x-amz-cek-alg") { t.Errorf("expected reserved key error, got %v", err) } } func TestKmsContextKeyHandler_DecryptKey(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.URLEncoding.EncodeToString(key) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { bodyBytes, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("expected no error, got %v", err) w.WriteHeader(500) return } var body map[string]interface{} err = json.Unmarshal(bodyBytes, &body) if err != nil { w.WriteHeader(500) return } if _, ok := body["KeyId"]; ok { t.Errorf("expected CMK to not be sent") } md, ok := body["EncryptionContext"].(map[string]interface{}) if !ok { w.WriteHeader(500) return } exEncContext := map[string]interface{}{ "aws:" + cekAlgorithmHeader: "AES/GCM/NoPadding", } if e, a := exEncContext, md; !reflect.DeepEqual(e, a) { w.WriteHeader(500) t.Errorf("expected %v, got %v", e, a) return } fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) handler, err := newKMSContextWrapEntryWithAnyCMK(kms.New(sess))(Envelope{WrapAlg: KMSContextWrap, CEKAlg: "AES/GCM/NoPadding", MatDesc: `{"aws:x-amz-cek-alg": "AES/GCM/NoPadding"}`}) if err != nil { t.Fatalf("expected no error, but received %v", err) } plaintextKey, err := handler.DecryptKey([]byte{1, 2, 3, 4}) if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(key, plaintextKey) { t.Errorf("expected %v, but received %v", key, plaintextKey) } } func TestKmsContextKeyHandler_decryptHandler_MismatchCEK(t testing.T) { _, err := newKMSContextWrapEntryWithAnyCMK(kms.New(unit.Session.Copy()))(Envelope{WrapAlg: KMSContextWrap, CEKAlg: "MismatchCEKValue", MatDesc: `{"aws:x-amz-cek-alg": "AES/GCM/NoPadding"}`}) if err == nil { t.Fatal("expected error, but got none") } if e, a := "algorithm used at encryption time does not match the algorithm stored", err.Error(); !strings.Contains(a, e) { t.Errorf("expected error to contain %v, got %v", e, a) } } func TestKmsContextKeyHandler_decryptHandler_MissingContextKey(t testing.T) { _, err := newKMSContextWrapEntryWithAnyCMK(kms.New(unit.Session.Copy()))(Envelope{WrapAlg: KMSContextWrap, CEKAlg: "AES/GCM/NoPadding", MatDesc: `{}`}) if err == nil { t.Fatal("expected error, but got none") } if e, a := "missing from encryption context", err.Error(); !strings.Contains(a, e) { t.Errorf("expected error to contain %v, got %v", e, a) } } func TestKmsContextKeyHandler_decryptHandler_MismatchWrap(t testing.T) { _, err := newKMSContextWrapEntryWithAnyCMK(kms.New(unit.Session.Copy()))(Envelope{WrapAlg: KMSWrap, CEKAlg: "AES/GCM/NoPadding", MatDesc: `{}`}) if err == nil { t.Fatal("expected error, but got none") } if e, a := "x-amz-cek-alg value `kms` did not match the expected algorithm `kms+context` for this handler", err.Error(); !strings.Contains(a, e) { t.Errorf("expected error to contain %v, got %v", e, a) } } func TestKmsContextKeyHandler_DecryptKey_WithCMK(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.URLEncoding.EncodeToString(key) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { body, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("expected no error, got %v", err) w.WriteHeader(500) return } if !bytes.Contains(body, []byte(`"KeyId":"thisKey"`)) { t.Errorf("expected CMK to be sent") } fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"thisKey","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) handler, err := newKMSContextWrapEntryWithCMK(kms.New(sess), "thisKey")(Envelope{WrapAlg: KMSContextWrap, CEKAlg: "AES/GCM/NoPadding", MatDesc: `{"aws:x-amz-cek-alg": "AES/GCM/NoPadding"}`}) if err != nil { t.Errorf("expected no error, but received %v", err) } _, err = handler.DecryptKey([]byte{1, 2, 3, 4}) if err != nil { t.Errorf("expected no error, but received %v", err) } } func TestRegisterKMSContextWrapWithAnyCMK(t testing.T) { kmsClient := kms.New(unit.Session.Copy()) cr := NewCryptoRegistry() if err := RegisterKMSContextWrapWithAnyCMK(cr, kmsClient); err != nil { t.Errorf("expected no error, got %v", err) } if wrap, ok := cr.GetWrap(KMSContextWrap); !ok { t.Errorf("expected wrapped to be present") } else if wrap == nil { t.Errorf("expected wrap to not be nil") } if err := RegisterKMSContextWrapWithCMK(cr, kmsClient, "test-key-id"); err == nil { t.Error("expected error, got none") } } func TestRegisterKMSContextWrapWithCMK(t testing.T) { kmsClient := kms.New(unit.Session.Copy()) cr := NewCryptoRegistry() if err := RegisterKMSContextWrapWithCMK(cr, kmsClient, "cmkId"); err != nil { t.Errorf("expected no error, got %v", err) } if wrap, ok := cr.GetWrap(KMSContextWrap); !ok { t.Errorf("expected wrapped to be present") } else if wrap == nil { t.Errorf("expected wrap to not be nil") } if err := RegisterKMSContextWrapWithAnyCMK(cr, kmsClient); err == nil { t.Error("expected error, got none") } }	8.25 KB	2025-05-25 12:27
📄 kms_key_handler.go package s3crypto import ( "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/kms/kmsiface" ) const ( // KMSWrap is a constant used during decryption to build a KMS key handler. KMSWrap = "kms" ) // kmsKeyHandler will make calls to KMS to get the masterkey type kmsKeyHandler struct { kms kmsiface.KMSAPI cmkID string // useProvidedCMK is toggled when using `kms` key wrapper with V2 client useProvidedCMK bool CipherData } // NewKMSKeyGenerator builds a new KMS key provider using the customer key ID and material // description. // // Example: // // sess := session.Must(session.NewSession()) // cmkID := "arn to key" // matdesc := s3crypto.MaterialDescription{} // handler := s3crypto.NewKMSKeyGenerator(kms.New(sess), cmkID) // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func NewKMSKeyGenerator(kmsClient kmsiface.KMSAPI, cmkID string) CipherDataGenerator { return NewKMSKeyGeneratorWithMatDesc(kmsClient, cmkID, MaterialDescription{}) } func newKMSKeyHandler(client kmsiface.KMSAPI, cmkID string, matdesc MaterialDescription) kmsKeyHandler { // These values are read only making them thread safe kp := &kmsKeyHandler{ kms: client, cmkID: &cmkID, } if matdesc == nil { matdesc = MaterialDescription{} } matdesc["kms_cmk_id"] = &cmkID kp.CipherData.WrapAlgorithm = KMSWrap kp.CipherData.MaterialDescription = matdesc return kp } // NewKMSKeyGeneratorWithMatDesc builds a new KMS key provider using the customer key ID and material // description. // // Example: // // sess := session.Must(session.NewSession()) // cmkID := "arn to key" // matdesc := s3crypto.MaterialDescription{} // handler := s3crypto.NewKMSKeyGeneratorWithMatDesc(kms.New(sess), cmkID, matdesc) // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func NewKMSKeyGeneratorWithMatDesc(kmsClient kmsiface.KMSAPI, cmkID string, matdesc MaterialDescription) CipherDataGenerator { return newKMSKeyHandler(kmsClient, cmkID, matdesc) } // NewKMSWrapEntry builds returns a new KMS key provider and its decrypt handler. // // Example: // // sess := session.Must(session.NewSession()) // customKMSClient := kms.New(sess) // decryptHandler := s3crypto.NewKMSWrapEntry(customKMSClient) // // svc := s3crypto.NewDecryptionClient(sess, func(svc s3crypto.DecryptionClient) { // svc.WrapRegistry[s3crypto.KMSWrap] = decryptHandler // })) // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func NewKMSWrapEntry(kmsClient kmsiface.KMSAPI) WrapEntry { kp := newKMSWrapEntry(kmsClient) return kp.decryptHandler } // RegisterKMSWrapWithCMK registers the `kms` wrapping algorithm to the given WrapRegistry. The wrapper will be // configured to call KMS Decrypt with the provided CMK. // // Example: // // sess := session.Must(session.NewSession()) // cr := s3crypto.NewCryptoRegistry() // if err := s3crypto.RegisterKMSWrapWithCMK(cr, kms.New(sess), "cmkId"); err != nil { // panic(err) // handle error // } // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func RegisterKMSWrapWithCMK(registry CryptoRegistry, client kmsiface.KMSAPI, cmkID string) error { if registry == nil { return errNilCryptoRegistry } return registry.AddWrap(KMSWrap, newKMSWrapEntryWithCMK(client, cmkID)) } // RegisterKMSWrapWithAnyCMK registers the `kms` wrapping algorithm to the given WrapRegistry. The wrapper will be // configured to call KMS Decrypt without providing a CMK. // // Example: // // sess := session.Must(session.NewSession()) // cr := s3crypto.NewCryptoRegistry() // if err := s3crypto.RegisterKMSWrapWithAnyCMK(cr, kms.New(sess)); err != nil { // panic(err) // handle error // } // // Deprecated: This feature is in maintenance mode, no new updates will be released. Please see https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html for more information. func RegisterKMSWrapWithAnyCMK(registry CryptoRegistry, client kmsiface.KMSAPI) error { if registry == nil { return errNilCryptoRegistry } return registry.AddWrap(KMSWrap, NewKMSWrapEntry(client)) } // newKMSWrapEntryWithCMK builds returns a new KMS key provider and its decrypt handler. The wrap entry will be configured // to only attempt to decrypt the data key using the provided CMK. func newKMSWrapEntryWithCMK(kmsClient kmsiface.KMSAPI, cmkID string) WrapEntry { kp := newKMSWrapEntry(kmsClient) kp.useProvidedCMK = true kp.cmkID = &cmkID return kp.decryptHandler } func newKMSWrapEntry(kmsClient kmsiface.KMSAPI) kmsKeyHandler { // These values are read only making them thread safe kp := &kmsKeyHandler{ kms: kmsClient, } return kp } // decryptHandler initializes a KMS keyprovider with a material description. This // is used with Decrypting kms content, due to the cmkID being in the material description. func (kp kmsKeyHandler) decryptHandler(env Envelope) (CipherDataDecrypter, error) { m := MaterialDescription{} err := m.decodeDescription([]byte(env.MatDesc)) if err != nil { return nil, err } _, ok := m["kms_cmk_id"] if !ok { return nil, awserr.New("MissingCMKIDError", "Material description is missing CMK ID", nil) } kp.CipherData.MaterialDescription = m kp.WrapAlgorithm = KMSWrap return &kp, nil } // DecryptKey makes a call to KMS to decrypt the key. func (kp kmsKeyHandler) DecryptKey(key []byte) ([]byte, error) { return kp.DecryptKeyWithContext(aws.BackgroundContext(), key) } // DecryptKeyWithContext makes a call to KMS to decrypt the key with request context. func (kp kmsKeyHandler) DecryptKeyWithContext(ctx aws.Context, key []byte) ([]byte, error) { in := &kms.DecryptInput{ EncryptionContext: kp.MaterialDescription, CiphertextBlob: key, GrantTokens: []string{}, } // useProvidedCMK will be true if a constructor was used with the new V2 client if kp.useProvidedCMK { in.KeyId = kp.cmkID } out, err := kp.kms.DecryptWithContext(ctx, in) if err != nil { return nil, err } return out.Plaintext, nil } // GenerateCipherData makes a call to KMS to generate a data key, Upon making // the call, it also sets the encrypted key. func (kp kmsKeyHandler) GenerateCipherData(keySize, ivSize int) (CipherData, error) { return kp.GenerateCipherDataWithContext(aws.BackgroundContext(), keySize, ivSize) } // GenerateCipherDataWithContext makes a call to KMS to generate a data key, // Upon making the call, it also sets the encrypted key. func (kp kmsKeyHandler) GenerateCipherDataWithContext(ctx aws.Context, keySize, ivSize int) (CipherData, error) { cd := kp.CipherData.Clone() out, err := kp.kms.GenerateDataKeyWithContext(ctx, &kms.GenerateDataKeyInput{ EncryptionContext: cd.MaterialDescription, KeyId: kp.cmkID, KeySpec: aws.String("AES_256"), }) if err != nil { return CipherData{}, err } iv, err := generateBytes(ivSize) if err != nil { return CipherData{}, err } cd.Key = out.Plaintext cd.IV = iv cd.EncryptedKey = out.CiphertextBlob return cd, nil } func (kp kmsKeyHandler) isAWSFixture() bool { return true } var ( _ CipherDataGenerator = (kmsKeyHandler)(nil) _ CipherDataGeneratorWithContext = (kmsKeyHandler)(nil) _ CipherDataDecrypter = (kmsKeyHandler)(nil) _ CipherDataDecrypterWithContext = (kmsKeyHandler)(nil) _ awsFixture = (kmsKeyHandler)(nil) )	7.73 KB	2025-05-25 12:27
📄 kms_key_handler_test.go package s3crypto import ( "bytes" "encoding/base64" "encoding/hex" "fmt" "io/ioutil" "net/http" "net/http/httptest" "reflect" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/kms" ) func TestNewKMSKeyGenerator(t testing.T) { svc := kms.New(unit.Session) handler := NewKMSKeyGenerator(svc, "testid") if handler == nil { t.Error("expected non-nil handler") } } func TestNewKMSKeyGeneratorWithMatDesc(t testing.T) { svc := kms.New(unit.Session) handler := NewKMSKeyGeneratorWithMatDesc(svc, "testid", MaterialDescription{ "Testing": aws.String("123"), }) if handler == nil { t.Error("expected non-nil handler") } kmsHandler := handler.(kmsKeyHandler) expected := MaterialDescription{ "kms_cmk_id": aws.String("testid"), "Testing": aws.String("123"), } if !reflect.DeepEqual(expected, kmsHandler.CipherData.MaterialDescription) { t.Errorf("expected %v, but received %v", expected, kmsHandler.CipherData.MaterialDescription) } } func TestKmsKeyHandler_GenerateCipherData(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintln(w, `{"CiphertextBlob":"AQEDAHhqBCCY1MSimw8gOGcUma79cn4ANvTtQyv9iuBdbcEF1QAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDJ6IcN5E4wVbk38MNAIBEIA7oF1E3lS7FY9DkoxPc/UmJsEwHzL82zMqoLwXIvi8LQHr8If4Lv6zKqY8u0+JRgSVoqCvZDx3p8Cn6nM=","KeyId":"arn:aws:kms:us-west-2:042062605278:key/c80a5cdb-8d09-4f9f-89ee-df01b2e3870a","Plaintext":"6tmyz9JLBE2yIuU7iXpArqpDVle172WSmxjcO6GNT7E="}`) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) svc := kms.New(sess) handler := NewKMSKeyGenerator(svc, "testid") keySize := 32 ivSize := 16 cd, err := handler.GenerateCipherData(keySize, ivSize) if err != nil { t.Errorf("expected no error, but received %v", err) } if keySize != len(cd.Key) { t.Errorf("expected %d, but received %d", keySize, len(cd.Key)) } if ivSize != len(cd.IV) { t.Errorf("expected %d, but received %d", ivSize, len(cd.IV)) } } func TestKmsKeyHandler_DecryptKey(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.URLEncoding.EncodeToString(key) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { body, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("expected no error, got %v", err) w.WriteHeader(500) return } if bytes.Contains(body, []byte(`"KeyId":"test"`)) { t.Errorf("expected CMK to not be sent") } fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) handler, err := (kmsKeyHandler{kms: kms.New(sess)}).decryptHandler(Envelope{WrapAlg: KMSWrap, MatDesc: `{"kms_cmk_id":"test"}`}) if err != nil { t.Errorf("expected no error, but received %v", err) } plaintextKey, err := handler.DecryptKey([]byte{1, 2, 3, 4}) if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(key, plaintextKey) { t.Errorf("expected %v, but received %v", key, plaintextKey) } } func TestKmsKeyHandler_DecryptKey_WithCMK(t testing.T) { key, _ := hex.DecodeString("31bdadd96698c204aa9ce1448ea94ae1fb4a9a0b3c9d773b51bb1822666b8f22") keyB64 := base64.URLEncoding.EncodeToString(key) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { body, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("expected no error, got %v", err) w.WriteHeader(500) return } if !bytes.Contains(body, []byte(`"KeyId":"thisKey"`)) { t.Errorf("expected CMK to be sent") } fmt.Fprintln(w, fmt.Sprintf("%s%s%s", `{"KeyId":"test-key-id","Plaintext":"`, keyB64, `"}`)) })) defer ts.Close() sess := unit.Session.Copy(&aws.Config{ MaxRetries: aws.Int(0), Endpoint: aws.String(ts.URL), DisableSSL: aws.Bool(true), S3ForcePathStyle: aws.Bool(true), Region: aws.String("us-west-2"), }) handler, err := newKMSWrapEntryWithCMK(kms.New(sess), "thisKey")(Envelope{WrapAlg: KMSWrap, MatDesc: `{"kms_cmk_id":"test"}`}) if err != nil { t.Errorf("expected no error, but received %v", err) } plaintextKey, err := handler.DecryptKey([]byte{1, 2, 3, 4}) if err != nil { t.Errorf("expected no error, but received %v", err) } if !bytes.Equal(key, plaintextKey) { t.Errorf("expected %v, but received %v", key, plaintextKey) } } func TestRegisterKMSWrapWithAnyCMK(t testing.T) { kmsClient := kms.New(unit.Session.Copy()) cr := NewCryptoRegistry() if err := RegisterKMSWrapWithAnyCMK(cr, kmsClient); err != nil { t.Errorf("expected no error, got %v", err) } if wrap, ok := cr.GetWrap(KMSWrap); !ok { t.Errorf("expected wrapped to be present") } else if wrap == nil { t.Errorf("expected wrap to not be nil") } if err := RegisterKMSWrapWithCMK(cr, kmsClient, "test-key-id"); err == nil { t.Error("expected error, got none") } } func TestRegisterKMSWrapWithCMK(t *testing.T) { kmsClient := kms.New(unit.Session.Copy()) cr := NewCryptoRegistry() if err := RegisterKMSWrapWithCMK(cr, kmsClient, "cmkId"); err != nil { t.Errorf("expected no error, got %v", err) } if wrap, ok := cr.GetWrap(KMSWrap); !ok { t.Errorf("expected wrapped to be present") } else if wrap == nil { t.Errorf("expected wrap to not be nil") } if err := RegisterKMSWrapWithAnyCMK(cr, kmsClient); err == nil { t.Error("expected error, got none") } }	5.83 KB	2025-05-25 12:27
📄 mat_desc.go package s3crypto import ( "encoding/json" ) // MaterialDescription is used to identify how and what master // key has been used. type MaterialDescription map[string]string // Clone returns a copy of the MaterialDescription func (md MaterialDescription) Clone() (clone MaterialDescription) { if md == nil { return nil } clone = make(MaterialDescription, len(md)) for k, v := range md { clone[k] = copyPtrString(v) } return clone } func (md MaterialDescription) encodeDescription() ([]byte, error) { v, err := json.Marshal(&md) return v, err } func (md MaterialDescription) decodeDescription(b []byte) error { return json.Unmarshal(b, &md) } func copyPtrString(v string) string { if v == nil { return nil } ns := v return &ns }	758 B	2025-05-25 12:27
📄 mat_desc_test.go //go:build go1.7 // +build go1.7 package s3crypto import ( "reflect" "testing" "github.com/aws/aws-sdk-go/aws" ) func TestEncodeMaterialDescription(t testing.T) { md := MaterialDescription{} md["foo"] = aws.String("bar") b, err := md.encodeDescription() expected := `{"foo":"bar"}` if err != nil { t.Errorf("expected no error, but received %v", err) } if expected != string(b) { t.Errorf("expected %s, but received %s", expected, string(b)) } } func TestDecodeMaterialDescription(t testing.T) { md := MaterialDescription{} json := `{"foo":"bar"}` err := md.decodeDescription([]byte(json)) expected := MaterialDescription{ "foo": aws.String("bar"), } if err != nil { t.Errorf("expected no error, but received %v", err) } if !reflect.DeepEqual(expected, md) { t.Error("expected material description to be equivalent, but received otherwise") } } func TestMaterialDescription_Clone(t testing.T) { tests := map[string]struct { md MaterialDescription wantClone MaterialDescription }{ "it handles nil": { md: nil, wantClone: nil, }, "it copies all values": { md: MaterialDescription{ "key1": aws.String("value1"), "key2": aws.String("value2"), }, wantClone: MaterialDescription{ "key1": aws.String("value1"), "key2": aws.String("value2"), }, }, } for name, tt := range tests { t.Run(name, func(t testing.T) { if gotClone := tt.md.Clone(); !reflect.DeepEqual(gotClone, tt.wantClone) { t.Errorf("Clone() = %v, want %v", gotClone, tt.wantClone) } }) } }	1.53 KB	2025-05-25 12:27
📄 migrations_test.go package s3crypto_test import ( "bytes" "fmt" "io/ioutil" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/service/kms" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3crypto" ) // ExampleNewEncryptionClientV2_migration00 provides a migration example for how users can migrate from the V1 // encryption client to the V2 encryption client. This example demonstrates how an application using the `kms` key wrap // algorithm with `AES/CBC/PKCS5Padding` can migrate their application to `kms+context` key wrapping with // `AES/GCM/NoPadding` content encryption. func ExampleNewEncryptionClientV2_migration00() { sess := session.Must(session.NewSession()) kmsClient := kms.New(sess) cmkID := "1234abcd-12ab-34cd-56ef-1234567890ab" // Usage of NewKMSKeyGenerator (kms) key wrapping algorithm must be migrated to NewKMSContextKeyGenerator (kms+context) key wrapping algorithm // // cipherDataGenerator := s3crypto.NewKMSKeyGenerator(kmsClient, cmkID) cipherDataGenerator := s3crypto.NewKMSContextKeyGenerator(kmsClient, cmkID, s3crypto.MaterialDescription{}) // Usage of AESCBCContentCipherBuilder (AES/CBC/PKCS5Padding) must be migrated to AESGCMContentCipherBuilder (AES/GCM/NoPadding) // // contentCipherBuilder := s3crypto.AESCBCContentCipherBuilder(cipherDataGenerator, s3crypto.AESCBCPadder) contentCipherBuilder := s3crypto.AESGCMContentCipherBuilderV2(cipherDataGenerator) // Construction of an encryption client should be done using NewEncryptionClientV2 // // encryptionClient := s3crypto.NewEncryptionClient(sess, contentCipherBuilder) encryptionClient, err := s3crypto.NewEncryptionClientV2(sess, contentCipherBuilder) if err != nil { fmt.Printf("failed to construct encryption client: %v", err) return } _, err = encryptionClient.PutObject(&s3.PutObjectInput{ Bucket: aws.String("your_bucket"), Key: aws.String("your_key"), Body: bytes.NewReader([]byte("your content")), }) if err != nil { fmt.Printf("put object error: %v\n", err) return } fmt.Println("put object completed") } // ExampleNewEncryptionClientV2_migration01 provides a more advanced migration example for how users can // migrate from the V1 encryption client to the V2 encryption client using more complex client construction. func ExampleNewEncryptionClientV2_migration01() { sess := session.Must(session.NewSession()) kmsClient := kms.New(sess) cmkID := "1234abcd-12ab-34cd-56ef-1234567890ab" cipherDataGenerator := s3crypto.NewKMSContextKeyGenerator(kmsClient, cmkID, s3crypto.MaterialDescription{}) contentCipherBuilder := s3crypto.AESGCMContentCipherBuilderV2(cipherDataGenerator) // Overriding of the encryption client options is possible by passing in functional arguments that override the // provided EncryptionClientOptions. // // encryptionClient := s3crypto.NewEncryptionClient(cipherDataGenerator, contentCipherBuilder, func(o s3crypto.EncryptionClient) { // o.S3Client = s3.New(sess, &aws.Config{Region: aws.String("us-west-2")}), // }) encryptionClient, err := s3crypto.NewEncryptionClientV2(sess, contentCipherBuilder, func(o s3crypto.EncryptionClientOptions) { o.S3Client = s3.New(sess, &aws.Config{Region: aws.String("us-west-2")}) }) if err != nil { fmt.Printf("failed to construct encryption client: %v", err) return } _, err = encryptionClient.PutObject(&s3.PutObjectInput{ Bucket: aws.String("your_bucket"), Key: aws.String("your_key"), Body: bytes.NewReader([]byte("your content")), }) if err != nil { fmt.Printf("put object error: %v\n", err) return } fmt.Println("put object completed") } // ExampleNewDecryptionClientV2_migration00 provides a migration example for how users can migrate // from the V1 Decryption Clients to the V2 Decryption Clients. func ExampleNewDecryptionClientV2_migration00() { sess := session.Must(session.NewSession()) // Construction of an decryption client must be done using NewDecryptionClientV2 // The V2 decryption client is able to decrypt object encrypted by the V1 client. // // decryptionClient := s3crypto.NewDecryptionClient(sess) // The V2 decryption client requires you to explicitly register the key wrap algorithms and content encryption algorithms // that you want to explicitly support decryption for. registry := s3crypto.NewCryptoRegistry() kmsClient := kms.New(sess) // If you need support for unwrapping data keys wrapped using the `kms` wrap algorithm you can use RegisterKMSWrapWithAnyCMK. // Alternatively you may use RegisterKMSWrapWithCMK if you wish to limit KMS decrypt calls to a specific CMK. if err := s3crypto.RegisterKMSWrapWithAnyCMK(registry, kmsClient); err != nil { fmt.Printf("error: %v", err) return } // For unwrapping data keys wrapped using the new `kms+context` key wrap algorithm you can use RegisterKMSContextWrapWithAnyCMK. // Alternatively you may use RegisterKMSWrapWithCMK if you wish to limit KMS decrypt calls to a specific CMK. if err := s3crypto.RegisterKMSContextWrapWithAnyCMK(registry, kmsClient); err != nil { fmt.Printf("error: %v", err) return } // If you need to decrypt objects encrypted using the V1 AES/CBC/PCKS5Padding cipher you can do so with RegisterAESCBCContentCipher if err := s3crypto.RegisterAESCBCContentCipher(registry, s3crypto.AESCBCPadder); err != nil { fmt.Printf("error: %v", err) return } // For decrypting objects encrypted in V1 or V2 using AES/GCM/NoPadding cipher you can do so with RegisterAESGCMContentCipher. if err := s3crypto.RegisterAESGCMContentCipher(registry); err != nil { fmt.Printf("error: %v", err) return } // Instantiate a new decryption client, and provided the Wrap, cek, and Padder that have been registered // with your desired algorithms. decryptionClient, err := s3crypto.NewDecryptionClientV2(sess, registry) if err != nil { fmt.Printf("error: %v", err) return } getObject, err := decryptionClient.GetObject(&s3.GetObjectInput{ Bucket: aws.String("your_bucket"), Key: aws.String("your_key"), }) if err != nil { fmt.Printf("get object error: %v\n", err) return } _, err = ioutil.ReadAll(getObject.Body) if err != nil { fmt.Printf("error reading object: %v\n", err) } fmt.Println("get object completed") } // ExampleNewDecryptionClientV2_migration01 provides a more advanced migration example for how users can // migrate from the V1 decryption client to the V2 decryption client using more complex client construction. func ExampleNewDecryptionClientV2_migration01() { sess := session.Must(session.NewSession()) // Construction of an decryption client must be done using NewDecryptionClientV2 // The V2 decryption client is able to decrypt object encrypted by the V1 client. // // decryptionClient := s3crypto.NewDecryptionClient(sess, func(o s3crypto.DecryptionClient) { // o.S3Client = s3.New(sess, &aws.Config{Region: aws.String("us-west-2")}) //}) registry := s3crypto.NewCryptoRegistry() kmsClient := kms.New(sess) if err := s3crypto.RegisterKMSWrapWithAnyCMK(registry, kmsClient); err != nil { fmt.Printf("error: %v", err) return } // If you need to decrypt objects encrypted using AES/GCM/NoPadding cipher you can do so with RegisterAESGCMContentCipher if err := s3crypto.RegisterAESGCMContentCipher(registry); err != nil { fmt.Printf("error: %v", err) return } decryptionClient, err := s3crypto.NewDecryptionClientV2(sess, registry, func(o s3crypto.DecryptionClientOptions) { o.S3Client = s3.New(sess, &aws.Config{Region: aws.String("us-west-2")}) }) if err != nil { fmt.Printf("error: %v", err) return } getObject, err := decryptionClient.GetObject(&s3.GetObjectInput{ Bucket: aws.String("your_bucket"), Key: aws.String("your_key"), }) if err != nil { fmt.Printf("get object error: %v\n", err) return } _, err = ioutil.ReadAll(getObject.Body) if err != nil { fmt.Printf("error reading object: %v\n", err) } fmt.Println("get object completed") }	7.82 KB	2025-05-25 12:27
📄 mock_test.go package s3crypto import ( "bytes" "fmt" "io" "io/ioutil" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/service/kms/kmsiface" ) type mockGenerator struct{} func (m mockGenerator) GenerateCipherData(keySize, ivSize int) (CipherData, error) { cd := CipherData{ Key: make([]byte, keySize), IV: make([]byte, ivSize), } return cd, nil } func (m mockGenerator) DecryptKey(key []byte) ([]byte, error) { return make([]byte, 16), nil } type mockGeneratorV2 struct{} func (m mockGeneratorV2) GenerateCipherDataWithCEKAlg(ctx aws.Context, keySize int, ivSize int, cekAlg string) (CipherData, error) { cd := CipherData{ Key: make([]byte, keySize), IV: make([]byte, ivSize), } return cd, nil } func (m mockGeneratorV2) DecryptKey(key []byte) ([]byte, error) { return make([]byte, 16), nil } func (m mockGeneratorV2) isEncryptionVersionCompatible(version clientVersion) error { if version != v2ClientVersion { return fmt.Errorf("mock error about version") } return nil } type mockCipherBuilder struct { generator CipherDataGenerator } func (builder mockCipherBuilder) isEncryptionVersionCompatible(version clientVersion) error { if version != v1ClientVersion { return fmt.Errorf("mock error about version") } return nil } func (builder mockCipherBuilder) ContentCipher() (ContentCipher, error) { cd, err := builder.generator.GenerateCipherData(32, 16) if err != nil { return nil, err } return &mockContentCipher{cd}, nil } type mockCipherBuilderV2 struct { generator CipherDataGeneratorWithCEKAlg } func (builder mockCipherBuilderV2) isEncryptionVersionCompatible(version clientVersion) error { if version != v2ClientVersion { return fmt.Errorf("mock error about version") } return nil } func (builder mockCipherBuilderV2) ContentCipher() (ContentCipher, error) { cd, err := builder.generator.GenerateCipherDataWithCEKAlg(aws.BackgroundContext(), 32, 16, "mock-cek-alg") if err != nil { return nil, err } return &mockContentCipher{cd}, nil } type mockContentCipher struct { cd CipherData } func (cipher mockContentCipher) GetCipherData() CipherData { return cipher.cd } func (cipher mockContentCipher) EncryptContents(src io.Reader) (io.Reader, error) { b, err := ioutil.ReadAll(src) if err != nil { return nil, err } size := len(b) b = bytes.Repeat([]byte{1}, size) return bytes.NewReader(b), nil } func (cipher *mockContentCipher) DecryptContents(src io.ReadCloser) (io.ReadCloser, error) { b, err := ioutil.ReadAll(src) if err != nil { return nil, err } size := len(b) return ioutil.NopCloser(bytes.NewReader(make([]byte, size))), nil } type mockKMS struct { kmsiface.KMSAPI } type mockPadder struct { } func (m mockPadder) Pad(i []byte, i2 int) ([]byte, error) { return i, nil } func (m mockPadder) Unpad(i []byte) ([]byte, error) { return i, nil } func (m mockPadder) Name() string { return "mockPadder" }	2.84 KB	2025-05-25 12:27
📄 padder.go package s3crypto // Padder handles padding of crypto data type Padder interface { // Pad will pad the byte array. // The second parameter is NOT how many // bytes to pad by, but how many bytes // have been read prior to the padding. // This allows for streamable padding. Pad([]byte, int) ([]byte, error) // Unpad will unpad the byte bytes. Unpad // methods must be constant time. Unpad([]byte) ([]byte, error) // Name returns the name of the padder. // This is used when decrypting on // instantiating new padders. Name() string } // NoPadder does not pad anything var NoPadder = Padder(noPadder{}) type noPadder struct{} func (padder noPadder) Pad(b []byte, n int) ([]byte, error) { return b, nil } func (padder noPadder) Unpad(b []byte) ([]byte, error) { return b, nil } func (padder noPadder) Name() string { return "NoPadding" }	856 B	2025-05-25 12:27
📄 pkcs7_padder.go package s3crypto // Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved. // // Portions Licensed under the MIT License. Copyright (c) 2016 Carl Jackson import ( "bytes" "crypto/subtle" "github.com/aws/aws-sdk-go/aws/awserr" ) const ( pkcs7MaxPaddingSize = 255 ) type pkcs7Padder struct { blockSize int } // NewPKCS7Padder follows the RFC 2315: https://www.ietf.org/rfc/rfc2315.txt // PKCS7 padding is subject to side-channel attacks and timing attacks. For // the most secure data, use an authenticated crypto algorithm. func NewPKCS7Padder(blockSize int) Padder { return pkcs7Padder{blockSize} } var errPKCS7Padding = awserr.New("InvalidPadding", "invalid padding", nil) // Pad will pad the data relative to how many bytes have been read. // Pad follows the PKCS7 standard. func (padder pkcs7Padder) Pad(buf []byte, n int) ([]byte, error) { if padder.blockSize < 1 \|\| padder.blockSize > pkcs7MaxPaddingSize { return nil, awserr.New("InvalidBlockSize", "block size must be between 1 and 255", nil) } size := padder.blockSize - (n % padder.blockSize) pad := bytes.Repeat([]byte{byte(size)}, size) buf = append(buf, pad...) return buf, nil } // Unpad will unpad the correct amount of bytes based off // of the PKCS7 standard func (padder pkcs7Padder) Unpad(buf []byte) ([]byte, error) { if len(buf) == 0 { return nil, errPKCS7Padding } // Here be dragons. We're attempting to check the padding in constant // time. The only piece of information here which is public is len(buf). // This code is modeled loosely after tls1_cbc_remove_padding from // OpenSSL. padLen := buf[len(buf)-1] toCheck := pkcs7MaxPaddingSize good := 1 if toCheck > len(buf) { toCheck = len(buf) } for i := 0; i < toCheck; i++ { b := buf[len(buf)-1-i] outOfRange := subtle.ConstantTimeLessOrEq(int(padLen), i) equal := subtle.ConstantTimeByteEq(padLen, b) good &= subtle.ConstantTimeSelect(outOfRange, 1, equal) } good &= subtle.ConstantTimeLessOrEq(1, int(padLen)) good &= subtle.ConstantTimeLessOrEq(int(padLen), len(buf)) if good != 1 { return nil, errPKCS7Padding } return buf[:len(buf)-int(padLen)], nil } func (padder pkcs7Padder) Name() string { return "PKCS7Padding" }	2.18 KB	2025-05-25 12:27
📄 pkcs7_padder_test.go package s3crypto_test import ( "bytes" "fmt" "testing" "github.com/aws/aws-sdk-go/service/s3/s3crypto" ) func padTest(size int, t testing.T) { padder := s3crypto.NewPKCS7Padder(size) for i := 0; i < size; i++ { input := make([]byte, i) expected := append(input, bytes.Repeat([]byte{byte(size - i)}, size-i)...) b, err := padder.Pad(input, len(input)) if err != nil { t.Fatal("Expected error to be nil but received " + err.Error()) } if len(b) != len(expected) { t.Fatal(fmt.Sprintf("Case %d: data is not of the same length", i)) } if bytes.Compare(b, expected) != 0 { t.Fatal(fmt.Sprintf("Expected %v but got %v", expected, b)) } } } func unpadTest(size int, t testing.T) { padder := s3crypto.NewPKCS7Padder(size) for i := 0; i < size; i++ { expected := make([]byte, i) input := append(expected, bytes.Repeat([]byte{byte(size - i)}, size-i)...) b, err := padder.Unpad(input) if err != nil { t.Fatal("Error received, was expecting nil: " + err.Error()) } if len(b) != len(expected) { t.Fatal(fmt.Sprintf("Case %d: data is not of the same length", i)) } if bytes.Compare(b, expected) != 0 { t.Fatal(fmt.Sprintf("Expected %v but got %v", expected, b)) } } } func TestPKCS7Padding(t testing.T) { padTest(10, t) padTest(16, t) padTest(255, t) } func TestPKCS7Unpadding(t testing.T) { unpadTest(10, t) unpadTest(16, t) unpadTest(255, t) }	1.38 KB	2025-05-25 12:27
📄 shared_client.go package s3crypto import ( "encoding/base64" "encoding/hex" "io" "strings" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/internal/sdkio" "github.com/aws/aws-sdk-go/service/s3" ) // clientConstructionErrorCode is used for operations that can't be completed due to invalid client construction const clientConstructionErrorCode = "ClientConstructionError" // mismatchWrapError is an error returned if a wrapping handler receives an unexpected envelope var mismatchWrapError = awserr.New(clientConstructionErrorCode, "wrap algorithm provided did not match handler", nil) func putObjectRequest(c EncryptionClientOptions, input s3.PutObjectInput) (request.Request, s3.PutObjectOutput) { req, out := c.S3Client.PutObjectRequest(input) // Get Size of file n, err := aws.SeekerLen(input.Body) if err != nil { req.Error = err return req, out } dst, err := getWriterStore(req, c.TempFolderPath, n >= c.MinFileSize) if err != nil { req.Error = err return req, out } req.Handlers.Build.PushFront(func(r request.Request) { if err != nil { r.Error = err return } var encryptor ContentCipher if v, ok := c.ContentCipherBuilder.(ContentCipherBuilderWithContext); ok { encryptor, err = v.ContentCipherWithContext(r.Context()) } else { encryptor, err = c.ContentCipherBuilder.ContentCipher() } if err != nil { r.Error = err return } lengthReader := newContentLengthReader(input.Body) sha := newSHA256Writer(dst) reader, err := encryptor.EncryptContents(lengthReader) if err != nil { r.Error = err return } _, err = io.Copy(sha, reader) if err != nil { r.Error = err return } data := encryptor.GetCipherData() env, err := encodeMeta(lengthReader, data) if err != nil { r.Error = err return } shaHex := hex.EncodeToString(sha.GetValue()) req.HTTPRequest.Header.Set("X-Amz-Content-Sha256", shaHex) dst.Seek(0, sdkio.SeekStart) input.Body = dst err = c.SaveStrategy.Save(env, r) r.Error = err }) return req, out } func putObject(options EncryptionClientOptions, input s3.PutObjectInput) (s3.PutObjectOutput, error) { req, out := putObjectRequest(options, input) return out, req.Send() } func putObjectWithContext(options EncryptionClientOptions, ctx aws.Context, input s3.PutObjectInput, opts ...request.Option) (s3.PutObjectOutput, error) { req, out := putObjectRequest(options, input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } func getObjectRequest(options DecryptionClientOptions, input s3.GetObjectInput) (request.Request, s3.GetObjectOutput) { req, out := options.S3Client.GetObjectRequest(input) req.Handlers.Unmarshal.PushBack(func(r request.Request) { env, err := options.LoadStrategy.Load(r) if err != nil { r.Error = err out.Body.Close() return } // If KMS should return the correct cek algorithm with the proper // KMS key provider cipher, err := contentCipherFromEnvelope(options, r.Context(), env) if err != nil { r.Error = err out.Body.Close() return } reader, err := cipher.DecryptContents(out.Body) if err != nil { r.Error = err out.Body.Close() return } out.Body = reader }) return req, out } func getObject(options DecryptionClientOptions, input s3.GetObjectInput) (s3.GetObjectOutput, error) { req, out := getObjectRequest(options, input) return out, req.Send() } func getObjectWithContext(options DecryptionClientOptions, ctx aws.Context, input s3.GetObjectInput, opts ...request.Option) (s3.GetObjectOutput, error) { req, out := getObjectRequest(options, input) req.SetContext(ctx) req.ApplyOptions(opts...) return out, req.Send() } func contentCipherFromEnvelope(options DecryptionClientOptions, ctx aws.Context, env Envelope) (ContentCipher, error) { wrap, err := wrapFromEnvelope(options, env) if err != nil { return nil, err } return cekFromEnvelope(options, ctx, env, wrap) } func wrapFromEnvelope(options DecryptionClientOptions, env Envelope) (CipherDataDecrypter, error) { f, ok := options.CryptoRegistry.GetWrap(env.WrapAlg) if !ok \|\| f == nil { return nil, awserr.New( "InvalidWrapAlgorithmError", "wrap algorithm isn't supported, "+env.WrapAlg, nil, ) } return f(env) } func cekFromEnvelope(options DecryptionClientOptions, ctx aws.Context, env Envelope, decrypter CipherDataDecrypter) (ContentCipher, error) { f, ok := options.CryptoRegistry.GetCEK(env.CEKAlg) if !ok \|\| f == nil { return nil, awserr.New( "InvalidCEKAlgorithmError", "cek algorithm isn't supported, "+env.CEKAlg, nil, ) } key, err := base64.StdEncoding.DecodeString(env.CipherKey) if err != nil { return nil, err } iv, err := base64.StdEncoding.DecodeString(env.IV) if err != nil { return nil, err } if d, ok := decrypter.(CipherDataDecrypterWithContext); ok { key, err = d.DecryptKeyWithContext(ctx, key) } else { key, err = decrypter.DecryptKey(key) } if err != nil { return nil, err } cd := CipherData{ Key: key, IV: iv, CEKAlgorithm: env.CEKAlg, Padder: getPadder(options, env.CEKAlg), } return f(cd) } // getPadder will return an unpadder with checking the cek algorithm specific padder. // If there wasn't a cek algorithm specific padder, we check the padder itself. // We return a no unpadder, if no unpadder was found. This means any customization // either contained padding within the cipher implementation, and to maintain // backwards compatibility we will simply not unpad anything. func getPadder(options DecryptionClientOptions, cekAlg string) Padder { padder, ok := options.CryptoRegistry.GetPadder(cekAlg) if !ok { padder, ok = options.CryptoRegistry.GetPadder(cekAlg[strings.LastIndex(cekAlg, "/")+1:]) if !ok { return NoPadder } } return padder }	5.77 KB	2025-05-25 12:27
📄 strategy.go package s3crypto import ( "bytes" "encoding/json" "io/ioutil" "net/http" "strings" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/s3" ) // SaveStrategy is how the data's metadata wants to be saved type SaveStrategy interface { Save(Envelope, request.Request) error } // S3SaveStrategy will save the metadata to a separate instruction file in S3 type S3SaveStrategy struct { Client s3.S3 InstructionFileSuffix string } // Save will save the envelope contents to s3. func (strat S3SaveStrategy) Save(env Envelope, req request.Request) error { input := req.Params.(s3.PutObjectInput) b, err := json.Marshal(env) if err != nil { return err } instInput := s3.PutObjectInput{ Bucket: input.Bucket, Body: bytes.NewReader(b), } if strat.InstructionFileSuffix == "" { instInput.Key = aws.String(input.Key + DefaultInstructionKeySuffix) } else { instInput.Key = aws.String(input.Key + strat.InstructionFileSuffix) } _, err = strat.Client.PutObject(&instInput) return err } // HeaderV2SaveStrategy will save the metadata of the crypto contents to the header of // the object. type HeaderV2SaveStrategy struct{} // Save will save the envelope to the request's header. func (strat HeaderV2SaveStrategy) Save(env Envelope, req request.Request) error { input := req.Params.(s3.PutObjectInput) if input.Metadata == nil { input.Metadata = map[string]string{} } input.Metadata[http.CanonicalHeaderKey(keyV2Header)] = &env.CipherKey input.Metadata[http.CanonicalHeaderKey(ivHeader)] = &env.IV input.Metadata[http.CanonicalHeaderKey(matDescHeader)] = &env.MatDesc input.Metadata[http.CanonicalHeaderKey(wrapAlgorithmHeader)] = &env.WrapAlg input.Metadata[http.CanonicalHeaderKey(cekAlgorithmHeader)] = &env.CEKAlg input.Metadata[http.CanonicalHeaderKey(unencryptedContentLengthHeader)] = &env.UnencryptedContentLen if len(env.TagLen) > 0 { input.Metadata[http.CanonicalHeaderKey(tagLengthHeader)] = &env.TagLen } return nil } // LoadStrategy ... type LoadStrategy interface { Load(request.Request) (Envelope, error) } // S3LoadStrategy will load the instruction file from s3 type S3LoadStrategy struct { Client s3.S3 InstructionFileSuffix string } // Load from a given instruction file suffix func (load S3LoadStrategy) Load(req request.Request) (Envelope, error) { env := Envelope{} if load.InstructionFileSuffix == "" { load.InstructionFileSuffix = DefaultInstructionKeySuffix } input := req.Params.(s3.GetObjectInput) out, err := load.Client.GetObject(&s3.GetObjectInput{ Key: aws.String(strings.Join([]string{input.Key, load.InstructionFileSuffix}, "")), Bucket: input.Bucket, }) if err != nil { return env, err } b, err := ioutil.ReadAll(out.Body) if err != nil { return env, err } err = json.Unmarshal(b, &env) return env, err } // HeaderV2LoadStrategy will load the envelope from the metadata type HeaderV2LoadStrategy struct{} // Load from a given object's header func (load HeaderV2LoadStrategy) Load(req request.Request) (Envelope, error) { env := Envelope{} env.CipherKey = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, keyV2Header}, "-")) env.IV = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, ivHeader}, "-")) env.MatDesc = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, matDescHeader}, "-")) env.WrapAlg = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, wrapAlgorithmHeader}, "-")) env.CEKAlg = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, cekAlgorithmHeader}, "-")) env.TagLen = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, tagLengthHeader}, "-")) env.UnencryptedContentLen = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, unencryptedContentLengthHeader}, "-")) return env, nil } type defaultV2LoadStrategy struct { client s3.S3 suffix string } func (load defaultV2LoadStrategy) Load(req *request.Request) (Envelope, error) { if value := req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, keyV2Header}, "-")); value != "" { strat := HeaderV2LoadStrategy{} return strat.Load(req) } else if value = req.HTTPResponse.Header.Get(strings.Join([]string{metaHeader, keyV1Header}, "-")); value != "" { return Envelope{}, awserr.New("V1NotSupportedError", "The AWS SDK for Go does not support version 1", nil) } strat := S3LoadStrategy{ Client: load.client, InstructionFileSuffix: load.suffix, } return strat.Load(req) }	4.51 KB	2025-05-25 12:27
📄 strategy_test.go package s3crypto_test import ( "bytes" "encoding/json" "io/ioutil" "net/http" "reflect" "testing" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3crypto" ) func TestHeaderV2SaveStrategy(t testing.T) { cases := []struct { env s3crypto.Envelope expected map[string]string }{ { s3crypto.Envelope{ CipherKey: "Foo", IV: "Bar", MatDesc: "{}", WrapAlg: s3crypto.KMSWrap, CEKAlg: s3crypto.AESGCMNoPadding, TagLen: "128", UnencryptedMD5: "hello", UnencryptedContentLen: "0", }, map[string]string{ "X-Amz-Key-V2": aws.String("Foo"), "X-Amz-Iv": aws.String("Bar"), "X-Amz-Matdesc": aws.String("{}"), "X-Amz-Wrap-Alg": aws.String(s3crypto.KMSWrap), "X-Amz-Cek-Alg": aws.String(s3crypto.AESGCMNoPadding), "X-Amz-Tag-Len": aws.String("128"), "X-Amz-Unencrypted-Content-Length": aws.String("0"), }, }, { s3crypto.Envelope{ CipherKey: "Foo", IV: "Bar", MatDesc: "{}", WrapAlg: s3crypto.KMSWrap, CEKAlg: s3crypto.AESGCMNoPadding, UnencryptedMD5: "hello", UnencryptedContentLen: "0", }, map[string]string{ "X-Amz-Key-V2": aws.String("Foo"), "X-Amz-Iv": aws.String("Bar"), "X-Amz-Matdesc": aws.String("{}"), "X-Amz-Wrap-Alg": aws.String(s3crypto.KMSWrap), "X-Amz-Cek-Alg": aws.String(s3crypto.AESGCMNoPadding), "X-Amz-Unencrypted-Content-Length": aws.String("0"), }, }, } for _, c := range cases { params := &s3.PutObjectInput{} req := &request.Request{ Params: params, } strat := s3crypto.HeaderV2SaveStrategy{} err := strat.Save(c.env, req) if err != nil { t.Errorf("expected no error, but received %v", err) } if !reflect.DeepEqual(c.expected, params.Metadata) { t.Errorf("expected %v, but received %v", c.expected, params.Metadata) } } } func TestS3SaveStrategy(t testing.T) { cases := []struct { env s3crypto.Envelope expected s3crypto.Envelope }{ { s3crypto.Envelope{ CipherKey: "Foo", IV: "Bar", MatDesc: "{}", WrapAlg: s3crypto.KMSWrap, CEKAlg: s3crypto.AESGCMNoPadding, TagLen: "128", UnencryptedMD5: "hello", UnencryptedContentLen: "0", }, s3crypto.Envelope{ CipherKey: "Foo", IV: "Bar", MatDesc: "{}", WrapAlg: s3crypto.KMSWrap, CEKAlg: s3crypto.AESGCMNoPadding, TagLen: "128", UnencryptedContentLen: "0", }, }, { s3crypto.Envelope{ CipherKey: "Foo", IV: "Bar", MatDesc: "{}", WrapAlg: s3crypto.KMSWrap, CEKAlg: s3crypto.AESGCMNoPadding, UnencryptedMD5: "hello", UnencryptedContentLen: "0", }, s3crypto.Envelope{ CipherKey: "Foo", IV: "Bar", MatDesc: "{}", WrapAlg: s3crypto.KMSWrap, CEKAlg: s3crypto.AESGCMNoPadding, UnencryptedContentLen: "0", }, }, } for _, c := range cases { params := &s3.PutObjectInput{ Bucket: aws.String("fooBucket"), Key: aws.String("barKey"), } req := &request.Request{ Params: params, } client := s3.New(unit.Session) client.Handlers.Send.Clear() client.Handlers.Unmarshal.Clear() client.Handlers.UnmarshalMeta.Clear() client.Handlers.UnmarshalError.Clear() client.Handlers.Send.PushBack(func(r request.Request) { bodyBytes, err := ioutil.ReadAll(r.Body) if err != nil { r.HTTPResponse = &http.Response{ StatusCode: 500, Body: ioutil.NopCloser(bytes.NewReader([]byte(err.Error()))), } return } var actual s3crypto.Envelope err = json.Unmarshal(bodyBytes, &actual) if err != nil { r.HTTPResponse = &http.Response{ StatusCode: 500, Body: ioutil.NopCloser(bytes.NewReader([]byte(err.Error()))), } return } if e, a := c.expected, actual; !reflect.DeepEqual(e, a) { t.Errorf("expected %v, got %v", e, a) } r.HTTPResponse = &http.Response{ StatusCode: 200, Body: ioutil.NopCloser(bytes.NewReader([]byte(""))), } }) strat := s3crypto.S3SaveStrategy{Client: client} err := strat.Save(c.env, req) if err != nil { t.Errorf("expected no error, but received %v", err) } } }	4.87 KB	2025-05-25 12:27
📁 testdata	-	2025-05-25 12:27

Edit File:

Terminal