aws-sdk-resources 2.3.12 → 2.3.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 76114a5d01dbe1f0181019ddb59cd107b2ac8e03
-  data.tar.gz: abcb08becd617abd22eaf6227185f9b27ec5b043
+  metadata.gz: 11c22ca5443cb742557f0ff0d51e1fef0df79fcf
+  data.tar.gz: e4491cd6fc35298e073d7a8b2acc125d51b1f4ff
 SHA512:
-  metadata.gz: 789c7eef7377f560a950459011e3894c1bb21513540c3f3ae1a16eda3334892034eea17430ee45f75cbade0921519d2e0741bbfd84eaf6ea2567c8e43fa03a35
-  data.tar.gz: c1b29ca6bb7dea3b4175fc6395c8768e9f306574fd84c56e2ee1a722ca6a1d821ede54936871552e3702f32dc82f0d4ff764472703a33406efe953e8e041bcfa
+  metadata.gz: 415203dbe9f34837a545a8665a75c2573ff78bdbce65fb04556fed2d8168b9144b7e7d8205334e3aac2cfa3d544d4c29cd5b9a4ef12cc1a10c5621f832cd9817
+  data.tar.gz: de05df3ec9627f3f6a53b9e41914921ec0476fd22702bf8a15736c53673ad13fe222c7c7c7b9e456dcf23bd5e2477043707793aaadd0583e3a9990b4cd77d932

data/lib/aws-sdk-resources/services/s3/encryption.rb

@@ -9,6 +9,7 @@ module Aws
       autoload :EncryptHandler, 'aws-sdk-resources/services/s3/encryption/encrypt_handler'
       autoload :Errors, 'aws-sdk-resources/services/s3/encryption/errors'
       autoload :IOEncrypter, 'aws-sdk-resources/services/s3/encryption/io_encrypter'
+      autoload :IOAuthDecrypter, 'aws-sdk-resources/services/s3/encryption/io_auth_decrypter'
       autoload :IODecrypter, 'aws-sdk-resources/services/s3/encryption/io_decrypter'
       autoload :KeyProvider, 'aws-sdk-resources/services/s3/encryption/key_provider'
       autoload :KmsCipherProvider, 'aws-sdk-resources/services/s3/encryption/kms_cipher_provider'

data/lib/aws-sdk-resources/services/s3/encryption/decrypt_handler.rb

@@ -22,6 +22,11 @@ module Aws
 
         POSSIBLE_ENVELOPE_KEYS = (V1_ENVELOPE_KEYS + V2_ENVELOPE_KEYS).uniq
 
+        POSSIBLE_ENCRYPTION_FORMATS = %w(
+          AES/GCM/NoPadding
+          AES/CBC/PKCS5Padding
+        )
+
         def call(context)
           attach_http_event_listeners(context)
           @handler.call(context)
@@ -30,10 +35,13 @@ module Aws
         private
 
         def attach_http_event_listeners(context)
+
           context.http_response.on_headers(200) do
             cipher = decryption_cipher(context)
-            body = context.http_response.body
-            context.http_response.body = IODecrypter.new(cipher, body)
+            decrypter = body_contains_auth_tag?(context) ?
+              authenticated_decrypter(context, cipher) :
+              IODecrypter.new(cipher, context.http_response.body)
+            context.http_response.body = decrypter
           end
 
           context.http_response.on_success(200) do
@@ -44,7 +52,7 @@ module Aws
           end
 
           context.http_response.on_error do
-            if context.http_response.body.is_a?(IODecrypter)
+            if context.http_response.body.respond_to?(:io)
               context.http_response.body = context.http_response.body.io
             end
           end
@@ -103,7 +111,7 @@ module Aws
         end
 
         def v2_envelope(envelope)
-          unless envelope['x-amz-cek-alg'] == 'AES/CBC/PKCS5Padding'
+          unless POSSIBLE_ENCRYPTION_FORMATS.include? envelope['x-amz-cek-alg']
             alg = envelope['x-amz-cek-alg'].inspect
             msg = "unsupported content encrypting key (cek) format: #{alg}"
             raise Errors::DecryptionError, msg
@@ -124,6 +132,42 @@ module Aws
           envelope
         end
 
+        # When the x-amz-meta-x-amz-tag-len header is present, it indicates
+        # that the body of this object has a trailing auth tag. The header
+        # indicates the length of that tag.
+        #
+        # This method fetches the tag from the end of the object by
+        # making a GET Object w/range request. This auth tag is used
+        # to initialize the cipher, and the decrypter truncates the
+        # auth tag from the body when writing the final bytes.
+        def authenticated_decrypter(context, cipher)
+          http_resp = context.http_response
+          content_length = http_resp.headers['content-length'].to_i
+          auth_tag_length = http_resp.headers['x-amz-meta-x-amz-tag-len']
+          auth_tag_length = auth_tag_length.to_i / 8
+
+          auth_tag = context.client.get_object(
+            bucket: context.params[:bucket],
+            key: context.params[:key],
+            range: "bytes=-#{auth_tag_length}"
+          ).body.read
+
+          cipher.auth_tag = auth_tag
+          cipher.auth_data = ''
+
+          # The encrypted object contains both the cipher text
+          # plus a trailing auth tag. This decrypter will the body
+          # expect for the trailing auth tag.
+          decrypter = IOAuthDecrypter.new(
+            io: http_resp.body,
+            encrypted_content_length: content_length - auth_tag_length,
+            cipher: cipher)
+        end
+
+        def body_contains_auth_tag?(context)
+          context.http_response.headers['x-amz-meta-x-amz-tag-len']
+        end
+
       end
     end
   end

data/lib/aws-sdk-resources/services/s3/encryption/io_auth_decrypter.rb

@@ -0,0 +1,50 @@
+module Aws
+  module S3
+    module Encryption
+      # @api private
+      class IOAuthDecrypter
+
+        # @option options [required, IO#write] :io
+        #   An IO-like object that responds to {#write}.
+        # @option options [required, Integer] :encrypted_content_length
+        #   The number of bytes to decrypt from the `:io` object.
+        #   This should be the total size of `:io` minus the length of
+        #   the cipher auth tag.
+        # @option options [required, OpenSSL::Cipher] :cipher An initialized
+        #   cipher that can be used to decrypt the bytes as they are
+        #   written to the `:io` object. The cipher should already have
+        #   its `#auth_tag` set.
+        def initialize(options = {})
+          @decrypter = IODecrypter.new(options[:cipher], options[:io])
+          @max_bytes = options[:encrypted_content_length]
+          @bytes_written = 0
+        end
+
+        def write(chunk)
+          chunk = truncate_chunk(chunk)
+          @bytes_written += chunk.bytesize
+          @decrypter.write(chunk)
+        end
+
+        def finalize
+          @decrypter.finalize
+        end
+
+        def io
+          @decrypter.io
+        end
+
+        private
+
+        def truncate_chunk(chunk)
+          if chunk.bytesize + @bytes_written <= @max_bytes
+            chunk
+          else
+            chunk[0..(@max_bytes - @bytes_written - 1)]
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/aws-sdk-resources/services/s3/encryption/io_decrypter.rb

@@ -5,18 +5,17 @@ module Aws
       class IODecrypter
 
         # @param [OpenSSL::Cipher] cipher
-        # @param [#write] io An IO-like object that responds to {#write}.
+        # @param [IO#write] io An IO-like object that responds to `#write`.
         def initialize(cipher, io)
-          @orig_cipher = cipher.clone
           @cipher = cipher.clone
           @io = io
-          reset_cipher
         end
 
         # @return [#write]
         attr_reader :io
 
         def write(chunk)
+          # decrypt and write
           @io.write(@cipher.update(chunk))
         end
 
@@ -24,12 +23,6 @@ module Aws
           @io.write(@cipher.final)
         end
 
-        private
-
-        def reset_cipher
-          @cipher = @orig_cipher.clone
-        end
-
       end
     end
   end

data/lib/aws-sdk-resources/services/s3/encryption/kms_cipher_provider.rb

@@ -41,7 +41,18 @@ module Aws
             encryption_context: encryption_context,
           ).plaintext
           iv = decode64(envelope['x-amz-iv'])
-          Utils.aes_decryption_cipher(:CBC, key, iv)
+          block_mode =
+            case envelope['x-amz-cek-alg']
+            when 'AES/CBC/PKCS5Padding'
+              :CBC
+            when 'AES/GCM/NoPadding'
+              :GCM
+            else
+              type = envelope['x-amz-cek-alg'].inspect
+              msg = "unsupported content encrypting key (cek) format: #{type}"
+              raise Errors::DecryptionError, msg
+            end
+          Utils.aes_decryption_cipher(block_mode, key, iv)
         end
 
         private

data/lib/aws-sdk-resources/services/s3/encryption/utils.rb

@@ -57,8 +57,8 @@ module Aws
           # @param [String, nil] iv The initialization vector
           def aes_cipher(mode, block_mode, key, iv)
             cipher = key ?
-              OpenSSL::Cipher.new("AES-#{cipher_size(key)}-#{block_mode}") :
-              OpenSSL::Cipher.new("AES-256-#{block_mode}")
+              OpenSSL::Cipher.new("aes-#{cipher_size(key)}-#{block_mode.downcase}") :
+              OpenSSL::Cipher.new("aes-256-#{block_mode.downcase}")
             cipher.send(mode) # encrypt or decrypt
             cipher.key = key if key
             cipher.iv = iv if iv

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-resources
 version: !ruby/object:Gem::Version
-  version: 2.3.12
+  version: 2.3.13
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-07 00:00:00.000000000 Z
+date: 2016-06-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.12
+        version: 2.3.13
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.12
+        version: 2.3.13
 description: Provides resource oriented interfaces and other higher-level abstractions
   for many AWS services. This gem is part of the official AWS SDK for Ruby.
 email:
@@ -65,6 +65,7 @@ files:
 - lib/aws-sdk-resources/services/s3/encryption/default_key_provider.rb
 - lib/aws-sdk-resources/services/s3/encryption/encrypt_handler.rb
 - lib/aws-sdk-resources/services/s3/encryption/errors.rb
+- lib/aws-sdk-resources/services/s3/encryption/io_auth_decrypter.rb
 - lib/aws-sdk-resources/services/s3/encryption/io_decrypter.rb
 - lib/aws-sdk-resources/services/s3/encryption/io_encrypter.rb
 - lib/aws-sdk-resources/services/s3/encryption/key_provider.rb