aws-sdk-resources 2.11.632 → 3.0.0.rc1

data/lib/aws-sdk-resources/services/s3/encryptionV2/errors.rb

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-module Aws
-  module S3
-    module EncryptionV2
-      module Errors
-
-        # Generic DecryptionError
-        class DecryptionError < RuntimeError; end
-
-        class EncryptionError < RuntimeError; end
-
-        # Raised when attempting to decrypt a legacy (V1) encrypted object
-        # when using a security_profile that does not support it.
-        class LegacyDecryptionError < DecryptionError
-          def initialize(*args)
-            msg = 'The requested object is ' \
-              'encrypted with V1 encryption schemas that have been disabled ' \
-              'by client configuration security_profile = :v2. Retry with ' \
-              ':v2_and_legacy or re-encrypt the object.'
-            super(msg)
-          end
-        end
-
-        class CEKAlgMismatchError < DecryptionError
-          def initialize(*args)
-            msg = 'The content encryption algorithm used at encryption time ' \
-              'does not match the algorithm stored for decryption time. ' \
-              'The object may be altered or corrupted.'
-            super(msg)
-          end
-        end
-
-      end
-    end
-  end
-end

data/lib/aws-sdk-resources/services/s3/encryptionV2/io_auth_decrypter.rb

@@ -1,58 +0,0 @@
-# frozen_string_literal: true
-
-module Aws
-  module S3
-    module EncryptionV2
-      # @api private
-      class IOAuthDecrypter
-
-        # @option options [required, IO#write] :io
-        #   An IO-like object that responds to {#write}.
-        # @option options [required, Integer] :encrypted_content_length
-        #   The number of bytes to decrypt from the `:io` object.
-        #   This should be the total size of `:io` minus the length of
-        #   the cipher auth tag.
-        # @option options [required, OpenSSL::Cipher] :cipher An initialized
-        #   cipher that can be used to decrypt the bytes as they are
-        #   written to the `:io` object. The cipher should already have
-        #   its `#auth_tag` set.
-        def initialize(options = {})
-          @decrypter = IODecrypter.new(options[:cipher], options[:io])
-          @max_bytes = options[:encrypted_content_length]
-          @bytes_written = 0
-        end
-
-        def write(chunk)
-          chunk = truncate_chunk(chunk)
-          if chunk.bytesize > 0
-            @bytes_written += chunk.bytesize
-            @decrypter.write(chunk)
-          end
-        end
-
-        def finalize
-          @decrypter.finalize
-        end
-
-        def io
-          @decrypter.io
-        end
-
-        private
-
-        def truncate_chunk(chunk)
-          if chunk.bytesize + @bytes_written <= @max_bytes
-            chunk
-          elsif @bytes_written < @max_bytes
-            chunk[0..(@max_bytes - @bytes_written - 1)]
-          else
-            # If the tag was sent over after the full body has been read,
-            # we don't want to accidentally append it.
-            ""
-          end
-        end
-
-      end
-    end
-  end
-end

data/lib/aws-sdk-resources/services/s3/encryptionV2/io_decrypter.rb

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-module Aws
-  module S3
-    module EncryptionV2
-      # @api private
-      class IODecrypter
-
-        # @param [OpenSSL::Cipher] cipher
-        # @param [IO#write] io An IO-like object that responds to `#write`.
-        def initialize(cipher, io)
-          @cipher = cipher
-          # Ensure that IO is reset between retries
-          @io = io.tap { |io| io.truncate(0) if io.respond_to?(:truncate) }
-          @cipher_buffer = String.new
-        end
-
-        # @return [#write]
-        attr_reader :io
-
-        def write(chunk)
-          # decrypt and write
-          if @cipher.method(:update).arity == 1
-            @io.write(@cipher.update(chunk))
-          else
-            @io.write(@cipher.update(chunk, @cipher_buffer))
-          end
-        end
-
-        def finalize
-          @io.write(@cipher.final)
-        end
-
-      end
-    end
-  end
-end

data/lib/aws-sdk-resources/services/s3/encryptionV2/io_encrypter.rb

@@ -1,73 +0,0 @@
-# frozen_string_literal: true
-
-require 'stringio'
-require 'tempfile'
-
-module Aws
-  module S3
-    module EncryptionV2
-
-      # Provides an IO wrapper encrypting a stream of data.
-      # @api private
-      class IOEncrypter
-
-        # @api private
-        ONE_MEGABYTE = 1024 * 1024
-
-        def initialize(cipher, io)
-          @encrypted = io.size <= ONE_MEGABYTE ?
-            encrypt_to_stringio(cipher, io.read) :
-            encrypt_to_tempfile(cipher, io)
-          @size = @encrypted.size
-        end
-
-        # @return [Integer]
-        attr_reader :size
-
-        def read(bytes = nil, output_buffer = nil)
-          if @encrypted.is_a?(Tempfile) && @encrypted.closed?
-            @encrypted.open
-            @encrypted.binmode
-          end
-          @encrypted.read(bytes, output_buffer)
-        end
-
-        def rewind
-          @encrypted.rewind
-        end
-
-        # @api private
-        def close
-          @encrypted.close if @encrypted.is_a?(Tempfile)
-        end
-
-        private
-
-        def encrypt_to_stringio(cipher, plain_text)
-          if plain_text.empty?
-            StringIO.new(cipher.final + cipher.auth_tag)
-          else
-            StringIO.new(cipher.update(plain_text) + cipher.final + cipher.auth_tag)
-          end
-        end
-
-        def encrypt_to_tempfile(cipher, io)
-          encrypted = Tempfile.new(self.object_id.to_s)
-          encrypted.binmode
-          while chunk = io.read(ONE_MEGABYTE, read_buffer ||= String.new)
-            if cipher.method(:update).arity == 1
-              encrypted.write(cipher.update(chunk))
-            else
-              encrypted.write(cipher.update(chunk, cipher_buffer ||= String.new))
-            end
-          end
-          encrypted.write(cipher.final)
-          encrypted.write(cipher.auth_tag)
-          encrypted.rewind
-          encrypted
-        end
-
-      end
-    end
-  end
-end

data/lib/aws-sdk-resources/services/s3/encryptionV2/key_provider.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-module Aws
-  module S3
-    module EncryptionV2
-
-      # This module defines the interface required for a {Client#key_provider}.
-      # A key provider is any object that:
-      #
-      # * Responds to {#encryption_materials} with an {Materials} object.
-      #
-      # * Responds to {#key_for}, receiving a JSON document String,
-      #   returning an encryption key. The returned encryption key
-      #   must be one of:
-      #
-      #   * `OpenSSL::PKey::RSA` - for asymmetric encryption
-      #   * `String` - 32, 24, or 16 bytes long, for symmetric encryption
-      #
-      module KeyProvider
-
-        # @return [Materials]
-        def encryption_materials; end
-
-        # @param [String<JSON>] materials_description
-        # @return [OpenSSL::PKey::RSA, String] encryption_key
-        def key_for(materials_description); end
-
-      end
-    end
-  end
-end

data/lib/aws-sdk-resources/services/s3/encryptionV2/kms_cipher_provider.rb

@@ -1,169 +0,0 @@
-# frozen_string_literal: true
-
-require 'base64'
-
-module Aws
-  module S3
-    module EncryptionV2
-      # @api private
-      class KmsCipherProvider
-
-        def initialize(options = {})
-          @kms_key_id = validate_kms_key(options[:kms_key_id])
-          @kms_client = options[:kms_client]
-          @key_wrap_schema = validate_key_wrap(
-            options[:key_wrap_schema]
-          )
-          @content_encryption_schema = validate_cek(
-            options[:content_encryption_schema]
-          )
-        end
-
-        # @return [Array<Hash,Cipher>] Creates and returns a new encryption
-        #   envelope and encryption cipher.
-        def encryption_cipher(options = {})
-          validate_key_for_encryption
-          encryption_context = build_encryption_context(@content_encryption_schema, options)
-          key_data = @kms_client.generate_data_key(
-            key_id: @kms_key_id,
-            encryption_context: encryption_context,
-            key_spec: 'AES_256'
-          )
-          cipher = Utils.aes_encryption_cipher(:GCM)
-          cipher.key = key_data.plaintext
-          envelope = {
-            'x-amz-key-v2' => encode64(key_data.ciphertext_blob),
-            'x-amz-iv' => encode64(cipher.iv = cipher.random_iv),
-            'x-amz-cek-alg' => @content_encryption_schema,
-            'x-amz-tag-len' => (AES_GCM_TAG_LEN_BYTES * 8).to_s,
-            'x-amz-wrap-alg' => @key_wrap_schema,
-            'x-amz-matdesc' => Json.dump(encryption_context)
-          }
-          cipher.auth_data = '' # auth_data must be set after key and iv
-          [envelope, cipher]
-        end
-
-        # @return [Cipher] Given an encryption envelope, returns a
-        #   decryption cipher.
-        def decryption_cipher(envelope, options = {})
-          encryption_context = Json.load(envelope['x-amz-matdesc'])
-          cek_alg = envelope['x-amz-cek-alg']
-
-          case envelope['x-amz-wrap-alg']
-          when 'kms'
-            unless options[:security_profile] == :v2_and_legacy
-              raise Errors::LegacyDecryptionError
-            end
-          when 'kms+context'
-            if cek_alg != encryption_context['aws:x-amz-cek-alg']
-              raise Errors::CEKAlgMismatchError
-            end
-
-            if encryption_context != build_encryption_context(cek_alg, options)
-              raise Errors::DecryptionError, 'Value of encryption context from'\
-                ' envelope does not match the provided encryption context'
-            end
-          when 'AES/GCM'
-            raise ArgumentError, 'Key mismatch - Client is configured' \
-                    ' with a KMS key and the x-amz-wrap-alg is AES/GCM.'
-          when 'RSA-OAEP-SHA1'
-            raise ArgumentError, 'Key mismatch - Client is configured' \
-                    ' with a KMS key and the x-amz-wrap-alg is RSA-OAEP-SHA1.'
-          else
-            raise ArgumentError, 'Unsupported wrap-alg: ' \
-                "#{envelope['x-amz-wrap-alg']}"
-          end
-
-          any_cmk_mode = false || options[:kms_allow_decrypt_with_any_cmk]
-          decrypt_options = {
-            ciphertext_blob: decode64(envelope['x-amz-key-v2']),
-            encryption_context: encryption_context
-          }
-          unless any_cmk_mode
-            decrypt_options[:key_id] = @kms_key_id
-          end
-
-          key = @kms_client.decrypt(decrypt_options).plaintext
-          iv = decode64(envelope['x-amz-iv'])
-          block_mode =
-            case cek_alg
-            when 'AES/CBC/PKCS5Padding'
-              :CBC
-            when 'AES/CBC/PKCS7Padding'
-              :CBC
-            when 'AES/GCM/NoPadding'
-              :GCM
-            else
-              type = envelope['x-amz-cek-alg'].inspect
-              msg = "unsupported content encrypting key (cek) format: #{type}"
-              raise Errors::DecryptionError, msg
-            end
-          Utils.aes_decryption_cipher(block_mode, key, iv)
-        end
-
-        private
-
-        def validate_key_wrap(key_wrap_schema)
-          case key_wrap_schema
-          when :kms_context then 'kms+context'
-          else
-            raise ArgumentError, "Unsupported key_wrap_schema: #{key_wrap_schema}"
-          end
-        end
-
-        def validate_cek(content_encryption_schema)
-          case content_encryption_schema
-          when :aes_gcm_no_padding
-            "AES/GCM/NoPadding"
-          else
-            raise ArgumentError, "Unsupported content_encryption_schema: #{content_encryption_schema}"
-          end
-        end
-
-        def validate_kms_key(kms_key_id)
-          if kms_key_id.nil? || kms_key_id.length.zero?
-            raise ArgumentError, 'KMS CMK ID was not specified. ' \
-              'Please specify a CMK ID, ' \
-              'or set kms_key_id: :kms_allow_decrypt_with_any_cmk to use ' \
-              'any valid CMK from the object.'
-          end
-
-          if kms_key_id.is_a?(Symbol) && kms_key_id != :kms_allow_decrypt_with_any_cmk
-            raise ArgumentError, 'kms_key_id must be a valid KMS CMK or be ' \
-              'set to :kms_allow_decrypt_with_any_cmk'
-          end
-          kms_key_id
-        end
-
-        def build_encryption_context(cek_alg, options = {})
-          kms_context = (options[:kms_encryption_context] || {})
-            .each_with_object({}) { |(k, v), h| h[k.to_s] = v }
-          if kms_context.include? 'aws:x-amz-cek-alg'
-            raise ArgumentError, 'Conflict in reserved KMS Encryption Context ' \
-              'key aws:x-amz-cek-alg. This value is reserved for the S3 ' \
-              'Encryption Client and cannot be set by the user.'
-          end
-          {
-            'aws:x-amz-cek-alg' => cek_alg
-          }.merge(kms_context)
-        end
-
-        def encode64(str)
-          Base64.encode64(str).split("\n") * ""
-        end
-
-        def decode64(str)
-          Base64.decode64(str)
-        end
-
-        def validate_key_for_encryption
-          if @kms_key_id == :kms_allow_decrypt_with_any_cmk
-            raise ArgumentError, 'Unable to encrypt/write objects with '\
-              'kms_key_id = :kms_allow_decrypt_with_any_cmk.  Provide ' \
-              'a valid kms_key_id on client construction.'
-          end
-        end
-      end
-    end
-  end
-end

data/lib/aws-sdk-resources/services/s3/encryptionV2/materials.rb

@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-require 'base64'
-
-module Aws
-  module S3
-    module EncryptionV2
-      class Materials
-
-        # @option options [required, OpenSSL::PKey::RSA, String] :key
-        #   The master key to use for encrypting/decrypting all objects.
-        #
-        # @option options [String<JSON>] :description ('{}')
-        #   The encryption materials description. This is must be
-        #   a JSON document string.
-        #
-        def initialize(options = {})
-          @key = validate_key(options[:key])
-          @description = validate_desc(options[:description])
-        end
-
-        # @return [OpenSSL::PKey::RSA, String]
-        attr_reader :key
-
-        # @return [String<JSON>]
-        attr_reader :description
-
-        private
-
-        def validate_key(key)
-          case key
-          when OpenSSL::PKey::RSA then key
-          when String
-            if [32, 24, 16].include?(key.bytesize)
-              key
-            else
-              msg = 'invalid key, symmetric key required to be 16, 24, or '\
-                    '32 bytes in length, saw length ' + key.bytesize.to_s
-              raise ArgumentError, msg
-            end
-          else
-            msg = 'invalid encryption key, expected an OpenSSL::PKey::RSA key '\
-                  '(for asymmetric encryption) or a String (for symmetric '\
-                  'encryption).'
-            raise ArgumentError, msg
-          end
-        end
-
-        def validate_desc(description)
-          Json.load(description)
-          description
-        rescue Json::ParseError, EncodingError
-          msg = 'expected description to be a valid JSON document string'
-          raise ArgumentError, msg
-        end
-
-      end
-    end
-  end
-end