huaweicloud-encryption-sdk-python 1.2.1__py3-none-any.whl

huaweicloud_encryptionsdk/huawei_crypto.py

@@ -0,0 +1,311 @@
+from __future__ import annotations
+
+import os
+from typing import Optional, Union
+
+from huaweicloud_encryptionsdk.exception.errors import (
+    HuaweicloudException,
+    KeyringNotFoundException,
+    ErrorMessage,
+)
+from huaweicloud_encryptionsdk.handler.default_crypto_handler import DefaultCryptoHandler
+from huaweicloud_encryptionsdk.keyrings.keyring import Keyring
+from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_keyring import KMSKeyring
+from huaweicloud_encryptionsdk.log.log_reporter_manager import LogReporterManager
+from huaweicloud_encryptionsdk.meterialmanager.cache_crypto_meterial_manager import CacheCryptoMaterialsManager
+from huaweicloud_encryptionsdk.meterialmanager.crypto_meterial_manager import CryptoMaterialManager
+from huaweicloud_encryptionsdk.meterialmanager.default_crypto_meterials_manager import DefaultCryptoMaterialsManager
+from huaweicloud_encryptionsdk.model.crypto_result import CryptoResult
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.enums.access_point_type import AccessPointType
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.model.request.encrypt_request import EncryptRequest
+from huaweicloud_encryptionsdk.common.ecs_metadata_service import EcsMetadataService
+
+
+class HuaweiCrypto:
+
+    def __init__(self, huawei_config):
+        self._huawei_config = huawei_config
+        if self._huawei_config.crypto_algorithm is None:
+            self._huawei_config.crypto_algorithm = CryptoAlgorithm.AES_128_GCM_NOPADDING
+        self._crypto_handler = DefaultCryptoHandler()
+        self._crypto_materials_manager: CryptoMaterialManager = DefaultCryptoMaterialsManager(huawei_config)
+        self._keyring: Optional[Keyring] = None
+        self._log_reporter_manager = LogReporterManager()
+
+        if self._huawei_config.log_config is not None or self._huawei_config.local_log_only:
+            self._log_reporter_manager.init(huawei_config)
+
+    def close(self) -> None:
+        self._log_reporter_manager.shutdown()
+
+    def with_crypto_material_manager(self, manager: CryptoMaterialManager) -> HuaweiCrypto:
+        self._crypto_materials_manager = manager
+        return self
+
+    def with_keyring(self, keyring: Keyring) -> HuaweiCrypto:
+        self._keyring = keyring
+        if isinstance(keyring, KMSKeyring):
+            keyring.huawei_config = self._huawei_config
+        return self
+
+    def encrypt(self, plain_text_or_request: Union[bytes, EncryptRequest]) -> CryptoResult[bytes]:
+        if isinstance(plain_text_or_request, (bytes, bytearray)):
+            request = EncryptRequest(encryption_context={}, plain_text=plain_text_or_request)
+        else:
+            request = plain_text_or_request
+
+        if self._keyring is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NULL_EXCEPTION.message)
+
+        data_key_materials = None
+        try:
+            data_key_materials = DataKeyMaterials()
+            data_key_materials.encryption_contexts = request.encryption_context or {}
+            data_key_materials.crypto_algorithm = self._huawei_config.crypto_algorithm
+            data_key_materials.policy_id = request.policy_id
+            data_key_materials.key_policy = request.key_policy
+
+            if isinstance(self._crypto_materials_manager, CacheCryptoMaterialsManager):
+                if self._crypto_materials_manager.max_byte_limit < len(request.plain_text):
+                    raise HuaweicloudException(ErrorMessage.DATA_EXCEED_LIMIT.message)
+
+            data_key_materials = self._crypto_materials_manager.get_materials_for_encrypt(
+                self._keyring, data_key_materials, len(request.plain_text)
+            )
+            result = self._crypto_handler.encrypt(request, data_key_materials)
+
+            if self._huawei_config.log_config is not None or self._huawei_config.local_log_only:
+                if data_key_materials.key_capsule is not None:
+                    key_id = data_key_materials.key_capsule.key_id
+                    encrypt_data_bytes = len(request.plain_text)
+                    encrypt_output_bytes = result.data_length
+                    access_point_type = AccessPointType.get_display_name_by_code(
+                        data_key_materials.key_capsule.access_point_type
+                    )
+                    instance_id = (
+                        EcsMetadataService.get_ecs_instance_id()
+                        if data_key_materials.key_capsule.access_point_type == AccessPointType.ECS.code
+                        else None
+                    )
+                    self._log_reporter_manager.record_encrypt_log(
+                        None, encrypt_data_bytes, None, encrypt_output_bytes,
+                        key_id, access_point_type, instance_id
+                    )
+
+            return result
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.CIPHER_EXCEPTION.message) from e
+
+    def decrypt(self, cipher_text: bytes) -> CryptoResult[bytes]:
+        if self._keyring is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NULL_EXCEPTION.message)
+
+        data_key_materials = None
+        try:
+            data_key_materials = self._crypto_materials_manager.get_materials_for_decrypt(
+                self._keyring, cipher_text
+            )
+            result = self._crypto_handler.decrypt(cipher_text, data_key_materials)
+
+            if self._huawei_config.log_config is not None or self._huawei_config.local_log_only:
+                if data_key_materials.key_capsule is not None:
+                    key_id = data_key_materials.key_capsule.key_id
+                    decrypt_data_bytes = len(cipher_text)
+                    decrypt_output_bytes = len(result.result) if result.result is not None else 0
+                    access_point_type = AccessPointType.get_display_name_by_code(
+                        data_key_materials.key_capsule.access_point_type
+                    )
+                    instance_id = data_key_materials.key_capsule.instance_id
+                    self._log_reporter_manager.record_decrypt_log(
+                        None, decrypt_data_bytes, None, decrypt_output_bytes,
+                        key_id, access_point_type, instance_id
+                    )
+
+            return result
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.DECRYPT_EXCEPTION.message) from e
+
+    def encrypt_stream(self, input_stream, output_stream, encryption_context=None) -> CryptoResult:
+        if self._keyring is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NULL_EXCEPTION.message)
+
+        data_key_materials = None
+        try:
+            encrypt_data_bytes = 0
+            try:
+                pos = input_stream.tell()
+                input_stream.seek(0, 2)
+                encrypt_data_bytes = input_stream.tell()
+                input_stream.seek(pos)
+            except Exception:
+                pass
+
+            data_key_materials = DataKeyMaterials()
+            data_key_materials.encryption_contexts = encryption_context if encryption_context is not None else {}
+            data_key_materials.crypto_algorithm = self._huawei_config.crypto_algorithm
+
+            if isinstance(self._crypto_materials_manager, CacheCryptoMaterialsManager):
+                if self._crypto_materials_manager.max_byte_limit < encrypt_data_bytes:
+                    raise HuaweicloudException(ErrorMessage.DATA_EXCEED_LIMIT.message)
+
+            data_key_materials = self._crypto_materials_manager.get_materials_for_encrypt(
+                self._keyring, data_key_materials, encrypt_data_bytes
+            )
+            crypto_result = self._crypto_handler.encrypt_stream(
+                input_stream, output_stream, data_key_materials, encryption_context
+            )
+
+            if self._huawei_config.log_config is not None or self._huawei_config.local_log_only:
+                if data_key_materials.key_capsule is not None:
+                    key_id = data_key_materials.key_capsule.key_id
+                    access_point_type = AccessPointType.get_display_name_by_code(
+                        data_key_materials.key_capsule.access_point_type
+                    )
+                    instance_id = (
+                        EcsMetadataService.get_ecs_instance_id()
+                        if data_key_materials.key_capsule.access_point_type == AccessPointType.ECS.code
+                        else None
+                    )
+                    self._log_reporter_manager.record_encrypt_log(
+                        None, encrypt_data_bytes, None, crypto_result.data_length,
+                        key_id, access_point_type, instance_id
+                    )
+
+            return crypto_result
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.CIPHER_EXCEPTION.message) from e
+
+    def decrypt_stream(self, input_stream, output_stream) -> CryptoResult:
+        if self._keyring is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NULL_EXCEPTION.message)
+
+        data_key_materials = None
+        try:
+            decrypt_data_bytes = 0
+            try:
+                pos = input_stream.tell()
+                input_stream.seek(0, 2)
+                decrypt_data_bytes = input_stream.tell()
+                input_stream.seek(pos)
+            except Exception:
+                pass
+
+            data_key_materials = self._crypto_materials_manager.get_materials_for_stream_decrypt(
+                self._keyring, input_stream
+            )
+            crypto_result = self._crypto_handler.decrypt_stream(
+                input_stream, output_stream, data_key_materials
+            )
+
+            if self._huawei_config.log_config is not None or self._huawei_config.local_log_only:
+                if data_key_materials.key_capsule is not None:
+                    key_id = data_key_materials.key_capsule.key_id
+                    access_point_type = AccessPointType.get_display_name_by_code(
+                        data_key_materials.key_capsule.access_point_type
+                    )
+                    instance_id = data_key_materials.key_capsule.instance_id
+                    self._log_reporter_manager.record_decrypt_log(
+                        None, decrypt_data_bytes, None, None,
+                        key_id, access_point_type, instance_id
+                    )
+
+            return crypto_result
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.DECRYPT_EXCEPTION.message) from e
+
+    def encrypt_file(self, source_file_path: str, target_file_path: str, encryption_context=None) -> CryptoResult:
+        if self._keyring is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NULL_EXCEPTION.message)
+
+        data_key_materials = None
+        try:
+            encrypt_data_bytes = os.path.getsize(source_file_path)
+
+            data_key_materials = DataKeyMaterials()
+            data_key_materials.encryption_contexts = encryption_context if encryption_context is not None else {}
+            data_key_materials.crypto_algorithm = self._huawei_config.crypto_algorithm
+
+            if isinstance(self._crypto_materials_manager, CacheCryptoMaterialsManager):
+                if self._crypto_materials_manager.max_byte_limit < encrypt_data_bytes:
+                    raise HuaweicloudException(ErrorMessage.DATA_EXCEED_LIMIT.message)
+
+            data_key_materials = self._crypto_materials_manager.get_materials_for_encrypt(
+                self._keyring, data_key_materials, encrypt_data_bytes
+            )
+
+            with open(source_file_path, "rb", buffering=1024 * 1024) as input_stream, \
+                 open(target_file_path, "wb", buffering=1024 * 1024) as output_stream:
+                crypto_result = self._crypto_handler.encrypt_stream(
+                    input_stream, output_stream, data_key_materials, encryption_context
+                )
+
+            if self._huawei_config.log_config is not None or self._huawei_config.local_log_only:
+                if data_key_materials.key_capsule is not None:
+                    key_id = data_key_materials.key_capsule.key_id
+                    access_point_type = AccessPointType.get_display_name_by_code(
+                        data_key_materials.key_capsule.access_point_type
+                    )
+                    instance_id = (
+                        EcsMetadataService.get_ecs_instance_id()
+                        if data_key_materials.key_capsule.access_point_type == AccessPointType.ECS.code
+                        else None
+                    )
+                    output_size = os.path.getsize(target_file_path)
+                    self._log_reporter_manager.record_encrypt_log(
+                        os.path.basename(source_file_path), encrypt_data_bytes,
+                        os.path.basename(target_file_path), output_size,
+                        key_id, access_point_type, instance_id
+                    )
+
+            return crypto_result
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.CIPHER_EXCEPTION.message) from e
+
+    def decrypt_file(self, source_file_path: str, target_file_path: str) -> CryptoResult:
+        if self._keyring is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NULL_EXCEPTION.message)
+
+        data_key_materials = None
+        try:
+            decrypt_data_bytes = os.path.getsize(source_file_path)
+
+            with open(source_file_path, "rb", buffering=1024 * 1024) as input_stream:
+                data_key_materials = self._crypto_materials_manager.get_materials_for_stream_decrypt(
+                    self._keyring, input_stream
+                )
+                with open(target_file_path, "wb", buffering=1024 * 1024) as output_stream:
+                    crypto_result = self._crypto_handler.decrypt_stream(
+                        input_stream, output_stream, data_key_materials
+                    )
+
+            if self._huawei_config.log_config is not None or self._huawei_config.local_log_only:
+                if data_key_materials.key_capsule is not None:
+                    key_id = data_key_materials.key_capsule.key_id
+                    access_point_type = AccessPointType.get_display_name_by_code(
+                        data_key_materials.key_capsule.access_point_type
+                    )
+                    instance_id = data_key_materials.key_capsule.instance_id
+                    output_size = os.path.getsize(target_file_path)
+                    self._log_reporter_manager.record_decrypt_log(
+                        os.path.basename(source_file_path), decrypt_data_bytes,
+                        os.path.basename(target_file_path), output_size,
+                        key_id, access_point_type, instance_id
+                    )
+
+            return crypto_result
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.DECRYPT_EXCEPTION.message) from e

huaweicloud_encryptionsdk/keyrings/keyring.py

@@ -0,0 +1,14 @@
+from abc import ABC, abstractmethod
+
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+
+
+class Keyring(ABC):
+
+    @abstractmethod
+    def encrypt_data_key(self, data_key_materials: DataKeyMaterials) -> DataKeyMaterials:
+        pass
+
+    @abstractmethod
+    def decrypt_data_key(self, data_key_materials: DataKeyMaterials) -> DataKeyMaterials:
+        pass

huaweicloud_encryptionsdk/keyrings/keyring_factory.py

@@ -0,0 +1,10 @@
+from abc import ABC, abstractmethod
+
+from huaweicloud_encryptionsdk.keyrings.keyring import Keyring
+
+
+class KeyringFactory(ABC):
+
+    @abstractmethod
+    def get_keyring(self, type: str) -> Keyring:
+        pass

huaweicloud_encryptionsdk/keyrings/kms_keyring_factory.py

@@ -0,0 +1,21 @@
+from huaweicloud_encryptionsdk.exception.errors import KeyringNotFoundException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.keyring_factory import KeyringFactory
+from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_discovery_keyring import KMSDiscoveryKeyring
+from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_multi_region_keyring import KMSMultiRegionKeyring
+from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_key_capsule_keyring import KMSKeyCapsuleKeyring
+from huaweicloud_encryptionsdk.model.enums.keyring_type_enum import KeyringTypeEnum
+
+
+class KmsKeyringFactory(KeyringFactory):
+
+    def get_keyring(self, type: str):
+        keyring_type_enum = KeyringTypeEnum.get_raw_keyring_type(type)
+        if keyring_type_enum is None:
+            raise KeyringNotFoundException(ErrorMessage.KEYRING_NOT_FOUND_EXCEPTION.message)
+        if keyring_type_enum == KeyringTypeEnum.KMS_DISCOVERY:
+            return KMSDiscoveryKeyring()
+        elif keyring_type_enum == KeyringTypeEnum.KMS_MULTI_REGION:
+            return KMSMultiRegionKeyring()
+        elif keyring_type_enum == KeyringTypeEnum.KMS_KEY_CAPSULE:
+            return KMSKeyCapsuleKeyring()
+        return None

huaweicloud_encryptionsdk/keyrings/kmskeyring/kms_discovery_keyring.py

@@ -0,0 +1,51 @@
+from huaweicloud_encryptionsdk.common.utils import is_empty
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_keyring import KMSKeyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.kms_config import KMSConfig
+
+
+class KMSDiscoveryKeyring(KMSKeyring):
+
+    def do_decrypt(self, data_key_materials: DataKeyMaterials):
+        self._prepare_key_id(data_key_materials)
+        self.real_decrypt(data_key_materials)
+
+    def _prepare_key_id(self, data_key_materials: DataKeyMaterials):
+        kms_config_list = []
+        huawei_config = self.huawei_config
+        origin_kms_config_list = huawei_config.origin_kms_config_list
+        if not origin_kms_config_list:
+            huawei_config.origin_kms_config_list = huawei_config.kms_config_list
+            origin_kms_config_list = huawei_config.origin_kms_config_list
+        for ciphertext_data_key in data_key_materials.ciphertext_data_keys:
+            if not self._check_discovery(ciphertext_data_key):
+                raise HuaweicloudException(ErrorMessage.NOT_SUPPORT_DISCOVERY_DECRYPT.message)
+            current_kms_config = None
+            if origin_kms_config_list:
+                for kms_config in origin_kms_config_list:
+                    if ciphertext_data_key.region == kms_config.region:
+                        current_kms_config = KMSConfig(
+                            region=ciphertext_data_key.region,
+                            key_id=ciphertext_data_key.key_id,
+                            project_id=kms_config.project_id,
+                            end_point=ciphertext_data_key.end_point
+                        )
+                        break
+            if current_kms_config is None:
+                current_kms_config = KMSConfig(
+                    region=ciphertext_data_key.region,
+                    key_id=ciphertext_data_key.key_id,
+                    project_id=ciphertext_data_key.project_id,
+                    end_point=ciphertext_data_key.end_point
+                )
+            kms_config_list.append(current_kms_config)
+        huawei_config.kms_config_list = kms_config_list
+
+    @staticmethod
+    def _check_discovery(ciphertext_data_key):
+        return (ciphertext_data_key.is_discovery()
+                and not is_empty(ciphertext_data_key.key_id)
+                and not is_empty(ciphertext_data_key.region)
+                and not is_empty(ciphertext_data_key.project_id))

huaweicloud_encryptionsdk/keyrings/kmskeyring/kms_key_capsule_keyring.py

@@ -0,0 +1,100 @@
+import logging
+
+from huaweicloud_encryptionsdk.common.utils import is_empty, bytes_to_hex, hex_to_bytes, get_capsule_kms_config
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.kmskeyring.kms_keyring import KMSKeyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.kms_config import KMSConfig
+
+logger = logging.getLogger(__name__)
+
+
+class KMSKeyCapsuleKeyring(KMSKeyring):
+
+    def do_decrypt(self, data_key_materials: DataKeyMaterials):
+        key_capsule = data_key_materials.key_capsule
+        if key_capsule is None:
+            raise HuaweicloudException("Key capsule is null")
+
+        ciphertext_data_keys = data_key_materials.ciphertext_data_keys
+        if ciphertext_data_keys is None or len(ciphertext_data_keys) == 0:
+            raise HuaweicloudException(ErrorMessage.CIPHER_TEXT_DATA_KEY_NOT_NULL.message)
+        ciphertext_data_key = ciphertext_data_keys[0]
+        kms_config = self._get_kms_config(ciphertext_data_key)
+        key_capsule.datakey_capsule = bytes_to_hex(ciphertext_data_key.data_key)
+
+        huawei_config = self.huawei_config
+        from huaweicloudsdkcore.auth.credentials import BasicCredentials
+        auth = BasicCredentials(huawei_config.ak, huawei_config.sk, kms_config.project_id)
+        if huawei_config.security_token:
+            auth = auth.with_security_token(huawei_config.security_token)
+
+        access_point_config = huawei_config.key_capsule_config.access_point_config
+        from huaweicloud_encryptionsdk.proof.proof_info import ProofInfo
+        proof_info = ProofInfo(
+            type=key_capsule.access_point_type,
+            encrypted_private_key=access_point_config.encrypted_private_key,
+            private_key_decrypt_callback=access_point_config.private_key_decrypt_callback,
+            key_capsule=key_capsule.datakey_capsule,
+        )
+
+        from huaweicloud_encryptionsdk.proof.proof_collector_factory import ProofCollectorFactory
+        attestation_document = ProofCollectorFactory.collect(proof_info)
+
+        plaintext_data_key = self._decrypt_key_capsule_by_kms(key_capsule, attestation_document, kms_config, auth)
+
+        data_key_materials.plaintext_data_key = plaintext_data_key
+
+    def _get_kms_config(self, ciphertext_data_key):
+        return KMSConfig(
+            region=ciphertext_data_key.region,
+            key_id=ciphertext_data_key.key_id,
+            project_id=ciphertext_data_key.project_id,
+            end_point=ciphertext_data_key.end_point
+        )
+
+    def encrypt_data_key(self, data_key_materials: DataKeyMaterials) -> DataKeyMaterials:
+        key_capsule_config = self.huawei_config.key_capsule_config
+        kms_config = get_capsule_kms_config(self.huawei_config.kms_config_list, key_capsule_config)
+        region = key_capsule_config.region
+        key_id = kms_config.key_id
+        project_id = kms_config.project_id
+        endpoint = kms_config.end_point
+        if not endpoint:
+            try:
+                from huaweicloudsdkkms.v2.region.kms_region import KmsRegion
+                kms_region = KmsRegion.value_of(key_capsule_config.region)
+                endpoint = kms_region.endpoints[0]
+            except Exception:
+                endpoint = None
+        if not endpoint:
+            raise HuaweicloudException(ErrorMessage.END_POINT_NOT_NULL.message)
+        ciphertext_data_keys = []
+        try:
+            cipher_data_key_bytes = hex_to_bytes(data_key_materials.key_capsule.datakey_capsule)
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.KMS_CREATE_KEY_CAPSULE_EXCEPTION.message, e)
+        ciphertext_data_keys.append(CiphertextDataKey(
+            data_key=cipher_data_key_bytes,
+            kms_config=KMSConfig(region=region, key_id=key_id, project_id=project_id, end_point=endpoint)
+        ))
+        data_key_materials.ciphertext_data_keys = ciphertext_data_keys
+        return data_key_materials
+
+    def _decrypt_key_capsule_by_kms(self, key_capsule, attestation_document, kms_config, auth):
+        try:
+            from huaweicloud_encryptionsdk.kms.kms_http_client import KmsHttpClient
+            client = KmsHttpClient(self.huawei_config.ak, self.huawei_config.sk, kms_config, self.huawei_config.security_token)
+            from huaweicloud_encryptionsdk.kms.decrypt_key_capsule_request import DecryptKeyCapsuleRequest
+            request_body = DecryptKeyCapsuleRequest(
+                key_id=key_capsule.key_id,
+                datakey_capsule=key_capsule.datakey_capsule,
+                attestation_document=attestation_document
+            )
+            from huaweicloud_encryptionsdk.kms.decrypt_key_capsule_response import DecryptKeyCapsuleResponse
+            response = client.post("/kms/datakey-capsule/decrypt", request_body, DecryptKeyCapsuleResponse)
+            key_capsule.instance_id = response.instance_id
+            return hex_to_bytes(response.datakey)
+        except Exception as e:
+            raise HuaweicloudException("Failed to decrypt key capsule", e)

huaweicloud_encryptionsdk/keyrings/kmskeyring/kms_keyring.py

@@ -0,0 +1,155 @@
+import logging
+from abc import abstractmethod
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from huaweicloud_encryptionsdk.common.utils import is_empty, bytes_to_hex, hex_to_bytes, common_hash
+from huaweicloud_encryptionsdk.exception.errors import EncryptException, HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.keyrings.keyring import Keyring
+from huaweicloud_encryptionsdk.model.ciphertext_data_key import CiphertextDataKey
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.kms_config import KMSConfig
+
+logger = logging.getLogger(__name__)
+
+SHA256 = "SHA256"
+SM3 = "SM3"
+
+
+class KMSKeyring(Keyring):
+
+    kms_client_cache: dict = {}
+
+    def __init__(self):
+        self._huawei_config = None
+
+    @property
+    def huawei_config(self):
+        return self._huawei_config
+
+    @huawei_config.setter
+    def huawei_config(self, value):
+        self._huawei_config = value
+
+    @abstractmethod
+    def do_decrypt(self, data_key_materials: DataKeyMaterials):
+        pass
+
+    def encrypt_data_key(self, data_key_materials: DataKeyMaterials) -> DataKeyMaterials:
+        self._do_encrypt(data_key_materials)
+        return data_key_materials
+
+    def decrypt_data_key(self, data_key_materials: DataKeyMaterials) -> DataKeyMaterials:
+        self.do_decrypt(data_key_materials)
+        return data_key_materials
+
+    def _do_encrypt(self, data_key_materials: DataKeyMaterials):
+        kms_config_list = self.huawei_config.kms_config_list
+        ciphertext_data_keys = []
+
+        def encrypt_for_config(kms_config):
+            try:
+                from huaweicloudsdkcore.auth.credentials import BasicCredentials
+                from huaweicloudsdkkms.v2.region.kms_region import KmsRegion
+                from huaweicloudsdkkms.v2 import KmsClient
+                from huaweicloudsdkkms.v2.model.encrypt_datakey_request import EncryptDatakeyRequest
+                from huaweicloudsdkkms.v2.model.encrypt_datakey_request_body import EncryptDatakeyRequestBody
+
+                auth = BasicCredentials(self.huawei_config.ak, self.huawei_config.sk, kms_config.project_id)
+                if self.huawei_config.security_token:
+                    auth = auth.with_security_token(self.huawei_config.security_token)
+                kms_client = self._get_kms_client(kms_config.region, kms_config.end_point, auth)
+                plaintext_data_key = data_key_materials.plaintext_data_key
+                data_key_hex = bytes_to_hex(plaintext_data_key)
+                length = len(data_key_hex)
+                key_spec = self._get_key_spec(kms_client, kms_config.key_id)
+                if key_spec == "AES_256":
+                    digest_alg = SHA256
+                else:
+                    digest_alg = SM3
+                tmp_digest = common_hash(plaintext_data_key, digest_alg)
+                data_key_with_hash = data_key_hex + bytes_to_hex(tmp_digest)
+                body = EncryptDatakeyRequestBody(
+                    key_id=kms_config.key_id,
+                    plain_text=data_key_with_hash,
+                    datakey_plain_length=str(length // 2)
+                )
+                request = EncryptDatakeyRequest(body=body)
+                response = kms_client.encrypt_datakey(request)
+                cipher_data_key_bytes = hex_to_bytes(response.cipher_text)
+                if self.huawei_config.is_discovery:
+                    ciphertext_data_key = CiphertextDataKey(data_key=cipher_data_key_bytes, kms_config=kms_config)
+                else:
+                    ciphertext_data_key = CiphertextDataKey(data_key=cipher_data_key_bytes, kms_config=None)
+                ciphertext_data_keys.append(ciphertext_data_key)
+            except Exception:
+                logger.warning(
+                    "encrypt data key error by kms server,please check the server information is right,region is :%s,keyId is:%s",
+                    kms_config.region, kms_config.key_id
+                )
+
+        with ThreadPoolExecutor() as executor:
+            futures = [executor.submit(encrypt_for_config, kms_config) for kms_config in kms_config_list]
+            for future in as_completed(futures):
+                future.result()
+
+        if len(ciphertext_data_keys) <= 0:
+            raise EncryptException(ErrorMessage.ENCRYPT_DATA_KEY_EXCEPTION.message)
+        data_key_materials.ciphertext_data_keys = ciphertext_data_keys
+
+    def _get_key_spec(self, kms_client, key_id):
+        try:
+            from huaweicloudsdkkms.v2.model.list_key_detail_request import ListKeyDetailRequest
+            from huaweicloudsdkkms.v2.model.operate_key_request_body import OperateKeyRequestBody
+            body = OperateKeyRequestBody(key_id=key_id)
+            request = ListKeyDetailRequest(body=body)
+            response = kms_client.list_key_detail(request)
+            return response.key_info.key_spec
+        except Exception:
+            return "AES_256"
+
+    def _get_kms_client(self, region_str, end_point, auth):
+        from huaweicloudsdkkms.v2.region.kms_region import KmsRegion
+        from huaweicloudsdkkms.v2 import KmsClient
+
+        cache_key = self.huawei_config.ak + self.huawei_config.sk + region_str
+        if cache_key in KMSKeyring.kms_client_cache:
+            return KMSKeyring.kms_client_cache[cache_key]
+        if is_empty(end_point):
+            region = KmsRegion.value_of(region_str)
+        else:
+            from huaweicloudsdkcore.region.region import Region
+            region = Region(region_str, end_point)
+        kms_client = KmsClient.new_builder().with_credentials(auth).with_region(region).build()
+        KMSKeyring.kms_client_cache[cache_key] = kms_client
+        return kms_client
+
+    def real_decrypt(self, data_key_materials: DataKeyMaterials):
+        kms_config_list = self.huawei_config.kms_config_list
+        ciphertext_data_keys = data_key_materials.ciphertext_data_keys
+        for kms_config in kms_config_list:
+            from huaweicloudsdkcore.auth.credentials import BasicCredentials
+            auth = BasicCredentials(self.huawei_config.ak, self.huawei_config.sk, kms_config.project_id)
+            if self.huawei_config.security_token:
+                auth = auth.with_security_token(self.huawei_config.security_token)
+            for ciphertext_data_key in ciphertext_data_keys:
+                try:
+                    region_str = kms_config.region
+                    end_point = kms_config.end_point
+                    key_id = kms_config.key_id
+                    kms_client = self._get_kms_client(region_str, end_point, auth)
+                    encode_data_key = bytes_to_hex(ciphertext_data_key.data_key)
+                    from huaweicloudsdkkms.v2.model.decrypt_datakey_request import DecryptDatakeyRequest
+                    from huaweicloudsdkkms.v2.model.decrypt_datakey_request_body import DecryptDatakeyRequestBody
+                    body = DecryptDatakeyRequestBody(
+                        key_id=key_id,
+                        cipher_text=encode_data_key,
+                        datakey_cipher_length="32"
+                    )
+                    request = DecryptDatakeyRequest(body=body)
+                    response = kms_client.decrypt_datakey(request)
+                    plaint_bytes = hex_to_bytes(response.data_key)
+                    algorithm_name = data_key_materials.crypto_algorithm.sec_key_algorithm
+                    data_key_materials.plaintext_data_key = plaint_bytes
+                    return
+                except Exception as e:
+                    logger.error("one master key may be not match when decrypt data key in KMSKeyring: %s", e)