aws-sdk-s3 1.207.0 → 1.208.0

data/lib/aws-sdk-s3/encryptionV3/errors.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module EncryptionV3
+      module Errors
+        # Generic DecryptionError
+        class DecryptionError < RuntimeError; end
+
+        class EncryptionError < RuntimeError; end
+
+        # Raised when attempting to decrypt a legacy (V1) encrypted object
+        # when using a security_profile that does not support it.
+        class NonCommittingDecryptionError < DecryptionError
+          def initialize(*_args)
+            msg = 'The requested object is ' \
+              'was not encrypted with a committing algorithm ' \
+              'and decryption is not supported under :require_encrypt_require_decrypt commitment policy. ' \
+              'Change your commitment policy to :forbid_encrypt_allow_decrypt or :require_encrypt_allow_decrypt'
+            super(msg)
+          end
+        end
+
+        # Raised when attempting to decrypt a legacy (V1) encrypted object
+        # when using a security_profile that does not support it.
+        class LegacyDecryptionError < DecryptionError
+          def initialize(*_args)
+            msg = 'The requested object is ' \
+              'encrypted with V1 encryption schemas that have been disabled ' \
+              'by client configuration security_profile = :v2. Retry with ' \
+              ':v2_and_legacy or re-encrypt the object.'
+            super(msg)
+          end
+        end
+
+        class CEKAlgMismatchError < DecryptionError
+          def initialize(*_args)
+            msg = 'The content encryption algorithm used at encryption time ' \
+              'does not match the algorithm stored for decryption time. ' \
+              'The object may be altered or corrupted.'
+            super(msg)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/encryptionV3/io_auth_decrypter.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module EncryptionV3
+      # @api private
+      class IOAuthDecrypter
+        # @option options [required, IO#write] :io
+        #   An IO-like object that responds to {#write}.
+        # @option options [required, Integer] :encrypted_content_length
+        #   The number of bytes to decrypt from the `:io` object.
+        #   This should be the total size of `:io` minus the length of
+        #   the cipher auth tag.
+        # @option options [required, OpenSSL::Cipher] :cipher An initialized
+        #   cipher that can be used to decrypt the bytes as they are
+        #   written to the `:io` object.
+        def initialize(options = {})
+          @decrypter = IODecrypter.new(options[:cipher], options[:io])
+          @max_bytes = options[:encrypted_content_length]
+          @bytes_written = 0
+          @cipher = options[:cipher]
+          @auth_tag = String.new
+        end
+
+        def write(chunk)
+          chunk = truncate_chunk(chunk)
+          return unless chunk.bytesize.positive?
+
+          @bytes_written += chunk.bytesize
+          @decrypter.write(chunk)
+        end
+
+        def finalize
+          @cipher.auth_tag = @auth_tag
+          @decrypter.finalize
+        end
+
+        def io
+          @decrypter.io
+        end
+
+        private
+
+        def truncate_chunk(chunk)
+          if chunk.bytesize + @bytes_written <= @max_bytes
+            chunk
+          elsif @bytes_written < @max_bytes
+            @auth_tag << chunk[@max_bytes - @bytes_written..-1]
+            chunk[0..(@max_bytes - @bytes_written - 1)]
+          else
+            @auth_tag << chunk
+            # If the tag was sent over after the full body has been read,
+            # we don't want to accidentally append it.
+            ''
+          end
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/encryptionV3/io_decrypter.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module EncryptionV3
+      # @api private
+      class IODecrypter
+        # @param [OpenSSL::Cipher] cipher
+        # @param [IO#write] io An IO-like object that responds to `#write`.
+        def initialize(cipher, io)
+          @cipher = cipher
+          # Ensure that IO is reset between retries
+          @io = io.tap { |io| io.truncate(0) if io.respond_to?(:truncate) }
+          @cipher_buffer = String.new
+        end
+
+        # @return [#write]
+        attr_reader :io
+
+        def write(chunk)
+          # decrypt and write
+          if @cipher.method(:update).arity == 1
+            @io.write(@cipher.update(chunk))
+          else
+            @io.write(@cipher.update(chunk, @cipher_buffer))
+          end
+        end
+
+        def finalize
+          @io.write(@cipher.final)
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/encryptionV3/io_encrypter.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'stringio'
+require 'tempfile'
+
+module Aws
+  module S3
+    module EncryptionV3
+      # Provides an IO wrapper encrypting a stream of data.
+      # @api private
+      class IOEncrypter
+        # @api private
+        ONE_MEGABYTE = 1024 * 1024
+
+        def initialize(cipher, io)
+          @encrypted = if io.size <= ONE_MEGABYTE
+                         encrypt_to_stringio(cipher, io.read)
+                       else
+                         encrypt_to_tempfile(cipher, io)
+                       end
+          @size = @encrypted.size
+        end
+
+        # @return [Integer]
+        attr_reader :size
+
+        def read(bytes = nil, output_buffer = nil)
+          if @encrypted.is_a?(Tempfile) && @encrypted.closed?
+            @encrypted.open
+            @encrypted.binmode
+          end
+          @encrypted.read(bytes, output_buffer)
+        end
+
+        def rewind
+          @encrypted.rewind
+        end
+
+        # @api private
+        def close
+          @encrypted.close if @encrypted.is_a?(Tempfile)
+        end
+
+        private
+
+        ##= ../specification/s3-encryption/encryption.md#alg-aes-256-gcm-hkdf-sha512-commit-key
+        ##% The client MUST append the GCM auth tag to the ciphertext if the underlying crypto provider does not do so automatically.
+
+        def encrypt_to_stringio(cipher, plain_text)
+          if plain_text.empty?
+            StringIO.new(cipher.final + cipher.auth_tag)
+          else
+            StringIO.new(cipher.update(plain_text) + cipher.final + cipher.auth_tag)
+          end
+        end
+
+        def encrypt_to_tempfile(cipher, io)
+          encrypted = Tempfile.new(object_id.to_s)
+          encrypted.binmode
+          ##= ../specification/s3-encryption/encryption.md#content-encryption
+          ##= type=implication
+          ##% The client MUST validate that the length of the plaintext bytes does not exceed the algorithm suite's cipher's maximum content length in bytes.
+          # The expectation is that this is handled by the underlying cryptographic provider.
+          # In Ruby this is OpenSSL by default.
+          # See OpenSSL: https://github.com/openssl/openssl/blob/master/crypto/modes/gcm128.c#L784
+          # The relevant line is:
+          # if (mlen > ((U64(1) << 36) - 32) || (sizeof(len) == 8 && mlen < len))
+          #   return -1;
+          while (chunk = io.read(ONE_MEGABYTE, read_buffer ||= String.new))
+            if cipher.method(:update).arity == 1
+              encrypted.write(cipher.update(chunk))
+            else
+              encrypted.write(cipher.update(chunk, cipher_buffer ||= String.new))
+            end
+          end
+          encrypted.write(cipher.final)
+          encrypted.write(cipher.auth_tag)
+          encrypted.rewind
+          encrypted
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/encryptionV3/key_provider.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module EncryptionV3
+      # This module defines the interface required for a {Client#key_provider}.
+      # A key provider is any object that:
+      #
+      # * Responds to {#encryption_materials} with an {Materials} object.
+      #
+      # * Responds to {#key_for}, receiving a JSON document String,
+      #   returning an encryption key. The returned encryption key
+      #   must be one of:
+      #
+      #   * `OpenSSL::PKey::RSA` - for asymmetric encryption
+      #   * `String` - 32, 24, or 16 bytes long, for symmetric encryption
+      #
+      module KeyProvider
+        # @return [Materials]
+        def encryption_materials; end
+
+        # @param [String<JSON>] materials_description
+        # @return [OpenSSL::PKey::RSA, String] encryption_key
+        def key_for(materials_description); end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/encryptionV3/kms_cipher_provider.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require 'base64'
+
+module Aws
+  module S3
+    module EncryptionV3
+      # @api private
+      class KmsCipherProvider
+        def initialize(options = {})
+          @kms_key_id = validate_kms_key(options[:kms_key_id])
+          @kms_client = options[:kms_client]
+          @key_wrap_schema = validate_key_wrap(
+            options[:key_wrap_schema]
+          )
+          @content_encryption_schema = Utils.validate_cek(
+            options[:content_encryption_schema]
+          )
+        end
+
+        # @return [Array<Hash,Cipher>] Creates and returns a new encryption
+        #   envelope and encryption cipher.
+        def encryption_cipher(options = {})
+          validate_key_for_encryption
+          encryption_context = build_encryption_context(@content_encryption_schema, options)
+          key_data = Aws::Plugins::UserAgent.metric('S3_CRYPTO_V3') do
+            @kms_client.generate_data_key(
+              key_id: @kms_key_id,
+              encryption_context: encryption_context,
+              key_spec: 'AES_256'
+            )
+          end
+          cipher, message_id, commitment_key = Utils.generate_alg_aes_256_gcm_hkdf_sha512_commit_key_cipher(key_data.plaintext)
+          ##= ../specification/s3-encryption/data-format/content-metadata.md#algorithm-suite-and-message-format-version-compatibility
+          ##% Objects encrypted with ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY MUST use the V3 message format version only.
+          envelope = {
+            'x-amz-3' => encode64(key_data.ciphertext_blob),
+            'x-amz-c' => @content_encryption_schema,
+            'x-amz-w' => @key_wrap_schema,
+            'x-amz-d' => encode64(commitment_key),
+            'x-amz-i' => encode64(message_id),
+            ##= ../specification/s3-encryption/data-format/content-metadata.md#v3-only
+            ##% The Encryption Context value MUST be used for wrapping algorithm `kms+context` or `12`.
+            'x-amz-t' => Json.dump(encryption_context)
+          }
+          [envelope, cipher]
+        end
+
+        # @return [Cipher] Given an encryption envelope, returns a
+        #   decryption cipher.
+        def decryption_cipher(envelope, options = {})
+          case envelope['x-amz-w']
+          when '12'
+            cek_alg = envelope['x-amz-c']
+            encryption_context =
+              if !envelope['x-amz-t'].nil?
+                Json.load(envelope['x-amz-t'])
+              else
+                ##= ../specification/s3-encryption/data-format/content-metadata.md#v3-only
+                ##% If the mapkey x-amz-t is not present, the default Material Description value MUST be set to an empty map (`{}`).
+                {}
+              end
+            ##= ../specification/s3-encryption/data-format/content-metadata.md#v3-only
+            ##% - The wrapping algorithm value "12" MUST be translated to kms+context upon retrieval, and vice versa on write.
+            raise Errors::CEKAlgMismatchError if cek_alg != encryption_context['aws:x-amz-cek-alg']
+
+            if encryption_context != build_encryption_context(cek_alg, options)
+              raise Errors::DecryptionError, 'Value of encryption context from'\
+                ' envelope does not match the provided encryption context'
+            end
+          when '02'
+            raise ArgumentError, 'Key mismatch - Client is configured' \
+                    ' with a KMS key and the x-amz-wrap-alg is AES/GCM.'
+          when '22'
+            raise ArgumentError, 'Key mismatch - Client is configured' \
+                    ' with a KMS key and the x-amz-wrap-alg is RSA-OAEP-SHA1.'
+          when nil
+            raise ArgumentError, 'Plaintext passthrough not supported'
+          else
+            # assert !envelope['x-amz-w'].nil?
+            # because of the when above
+            raise ArgumentError, 'Unsupported wrapping algorithm: ' \
+                "#{envelope['x-amz-w']}"
+          end
+
+          any_cmk_mode = options[:kms_allow_decrypt_with_any_cmk]
+          decrypt_options = {
+            ciphertext_blob: decode64(envelope['x-amz-3']),
+            encryption_context: encryption_context
+          }
+          decrypt_options[:key_id] = @kms_key_id unless any_cmk_mode
+
+          data_key = Aws::Plugins::UserAgent.metric('S3_CRYPTO_V3') do
+            @kms_client.decrypt(decrypt_options).plaintext
+          end
+
+          message_id = decode64(envelope['x-amz-i'])
+          commitment_key = decode64(envelope['x-amz-d'])
+
+          Utils.derive_alg_aes_256_gcm_hkdf_sha512_commit_key_cipher(data_key, message_id, commitment_key)
+        end
+
+        private
+
+        def validate_key_wrap(key_wrap_schema)
+          case key_wrap_schema
+          when :kms_context then '12'
+          else
+            raise ArgumentError, "Unsupported key_wrap_schema: #{key_wrap_schema}"
+          end
+        end
+
+        def validate_kms_key(kms_key_id)
+          if kms_key_id.nil? || kms_key_id.empty?
+            raise ArgumentError, 'KMS CMK ID was not specified. ' \
+              'Please specify a CMK ID, ' \
+              'or set kms_key_id: :kms_allow_decrypt_with_any_cmk to use ' \
+              'any valid CMK from the object.'
+          end
+
+          if kms_key_id.is_a?(Symbol) && kms_key_id != :kms_allow_decrypt_with_any_cmk
+            raise ArgumentError, 'kms_key_id must be a valid KMS CMK or be ' \
+              'set to :kms_allow_decrypt_with_any_cmk'
+          end
+          kms_key_id
+        end
+
+        def build_encryption_context(cek_alg, options = {})
+          kms_context = (options[:kms_encryption_context] || {})
+                        .transform_keys(&:to_s)
+          if kms_context.include? 'aws:x-amz-cek-alg'
+            raise ArgumentError, 'Conflict in reserved KMS Encryption Context ' \
+              'key aws:x-amz-cek-alg. This value is reserved for the S3 ' \
+              'Encryption Client and cannot be set by the user.'
+          end
+          {
+            'aws:x-amz-cek-alg' => cek_alg
+          }.merge(kms_context)
+        end
+
+        def encode64(str)
+          Base64.encode64(str).split("\n") * ''
+        end
+
+        def decode64(str)
+          Base64.decode64(str)
+        end
+
+        def validate_key_for_encryption
+          return unless @kms_key_id == :kms_allow_decrypt_with_any_cmk
+
+          raise ArgumentError, 'Unable to encrypt/write objects with '\
+            'kms_key_id = :kms_allow_decrypt_with_any_cmk.  Provide ' \
+            'a valid kms_key_id on client construction.'
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/encryptionV3/materials.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'base64'
+
+module Aws
+  module S3
+    module EncryptionV3
+      class Materials
+        # @option options [required, OpenSSL::PKey::RSA, String] :key
+        #   The master key to use for encrypting/decrypting all objects.
+        #
+        # @option options [String<JSON>] :description ('{}')
+        #   The encryption materials description. This is must be
+        #   a JSON document string.
+        #
+        def initialize(options = {})
+          @key = validate_key(options[:key])
+          @description = validate_desc(options[:description])
+        end
+
+        # @return [OpenSSL::PKey::RSA, String]
+        attr_reader :key
+
+        # @return [String<JSON>]
+        attr_reader :description
+
+        private
+
+        def validate_key(key)
+          case key
+          when OpenSSL::PKey::RSA then key
+          when String
+            if [32, 24, 16].include?(key.bytesize)
+              key
+            else
+              msg = 'invalid key, symmetric key required to be 16, 24, or '\
+                    '32 bytes in length, saw length ' + key.bytesize.to_s
+              raise ArgumentError, msg
+            end
+          else
+            msg = 'invalid encryption key, expected an OpenSSL::PKey::RSA key '\
+                  '(for asymmetric encryption) or a String (for symmetric '\
+                  'encryption).'
+            raise ArgumentError, msg
+          end
+        end
+
+        def validate_desc(description)
+          Json.load(description)
+          description
+        rescue Json::ParseError, EncodingError
+          msg = 'expected description to be a valid JSON document string'
+          raise ArgumentError, msg
+        end
+      end
+    end
+  end
+end