huaweicloud-encryption-sdk-python 1.2.1__py3-none-any.whl

huaweicloud_encryptionsdk/handler/default_crypto_handler.py

@@ -0,0 +1,148 @@
+import struct
+from io import BytesIO
+
+from huaweicloud_encryptionsdk.common.constants import Constants
+from huaweicloud_encryptionsdk.common.counting_output_stream import CountingOutputStream
+from huaweicloud_encryptionsdk.handler.cipher_handler import CipherHandler, ENCRYPT_MODE, DECRYPT_MODE
+from huaweicloud_encryptionsdk.handler.crypto_handler import CryptoHandler
+from huaweicloud_encryptionsdk.handler.default_serialize_handler import DefaultSerializeHandler
+from huaweicloud_encryptionsdk.handler.file_encrypt_handler import FileEncryptHandler
+from huaweicloud_encryptionsdk.handler.file_decrypt_handler import FileDecryptHandler
+from huaweicloud_encryptionsdk.model.cipher_body import CipherBody
+from huaweicloud_encryptionsdk.model.cipher_header import CipherHeader
+from huaweicloud_encryptionsdk.model.crypto_result import CryptoResult
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.data_materials import DataMaterials
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.model.request.encrypt_request import EncryptRequest
+
+
+class DefaultCryptoHandler(CryptoHandler):
+
+    def __init__(self):
+        self._serialize_handler = DefaultSerializeHandler()
+
+    def encrypt(self, request, data_key_materials):
+        cipher_handler = CipherHandler(
+            data_key_materials.crypto_algorithm,
+            data_key_materials.plaintext_data_key,
+            ENCRYPT_MODE,
+        )
+        encrypted_data = cipher_handler.cipher_data(
+            request.plain_text, request.encryption_context, 0, len(request.plain_text)
+        )
+        if data_key_materials.crypto_algorithm == CryptoAlgorithm.SM4_128_CBC_PADDING:
+            tag_len = 0
+        else:
+            tag_len = data_key_materials.crypto_algorithm.tag_len
+
+        if tag_len != 0:
+            cipher_text = encrypted_data[: len(encrypted_data) - tag_len]
+            auth_tag = encrypted_data[len(encrypted_data) - tag_len:]
+        else:
+            cipher_text = encrypted_data
+            auth_tag = b""
+
+        cipher_header = CipherHeader(
+            data_key_materials.crypto_algorithm,
+            data_key_materials.encryption_contexts,
+            data_key_materials.ciphertext_data_keys,
+            data_key_materials.plaintext_data_key,
+            data_key_materials.key_capsule,
+        )
+        cipher_body = CipherBody(
+            cipher_handler.get_iv(), cipher_text, len(cipher_text), auth_tag
+        )
+        data_materials = DataMaterials(cipher_body, cipher_header)
+        serialized_data = self._serialize_handler.serialize(data_materials)
+        return CryptoResult(
+            result=serialized_data,
+            headers=cipher_header,
+            data_length=len(cipher_text),
+        )
+
+    def decrypt(self, cipher_text, data_key_materials):
+        data_materials = self._serialize_handler.deserialize(cipher_text)
+        headers = data_materials.headers
+        header_tag = headers.header_tag
+        header_tag_iv = header_tag[: headers.algorithm.iv_len]
+
+        cipher_handler = CipherHandler(
+            data_key_materials.crypto_algorithm,
+            data_key_materials.plaintext_data_key,
+            DECRYPT_MODE,
+        )
+        cipher_handler.set_iv(header_tag_iv)
+        headers.verify_header(cipher_handler)
+
+        cipher_body = data_materials.cipher_body
+        if cipher_body is None:
+            raise Exception("cipher text changed error")
+
+        iv = cipher_body.iv
+        encrypted_content = cipher_body.encrypted_content
+        auth_tag = cipher_body.auth_tag
+
+        if (
+            data_key_materials.crypto_algorithm != CryptoAlgorithm.SM4_128_CBC_PADDING
+            and len(auth_tag) != data_key_materials.crypto_algorithm.tag_len
+        ):
+            raise ValueError("Invalid tag length: " + str(len(auth_tag)))
+
+        result = bytearray(len(iv) + len(encrypted_content) + len(auth_tag))
+        result[: len(iv)] = iv
+        result[len(iv): len(iv) + len(encrypted_content)] = encrypted_content
+        result[len(iv) + len(encrypted_content):] = auth_tag
+
+        cipher_handler.set_iv(iv)
+        decrypt_data = cipher_handler.cipher_data(
+            bytes(result), data_key_materials.encryption_contexts, len(iv), len(result) - len(iv)
+        )
+        return CryptoResult(result=decrypt_data, headers=data_materials.headers)
+
+    def encrypt_stream(self, input_stream, output_stream, data_key_materials, encryption_context):
+        counting_stream = CountingOutputStream(output_stream)
+        cipher_header = CipherHeader(
+            data_key_materials.crypto_algorithm,
+            data_key_materials.encryption_contexts,
+            data_key_materials.ciphertext_data_keys,
+            data_key_materials.plaintext_data_key,
+            data_key_materials.key_capsule,
+        )
+        authenticated_fields = cipher_header.serialize_authenticated_fields()
+        counting_stream.write(
+            struct.pack(">h", len(authenticated_fields) + 2 + cipher_header.header_tag_length)
+        )
+        counting_stream.write(authenticated_fields)
+        counting_stream.write(struct.pack(">h", cipher_header.header_tag_length))
+        counting_stream.write(cipher_header.header_tag)
+
+        file_encrypt_handler = FileEncryptHandler(
+            data_key_materials.crypto_algorithm,
+            data_key_materials.plaintext_data_key,
+            ENCRYPT_MODE,
+        )
+        file_encrypt_handler.process_byte(
+            input_stream, counting_stream, data_key_materials.encryption_contexts, Constants.BLOCK_SIZE
+        )
+        return CryptoResult(
+            result=counting_stream,
+            headers=cipher_header,
+            data_length=counting_stream.get_bytes_written(),
+        )
+
+    def decrypt_stream(self, input_stream, output_stream, data_key_materials):
+        counting_stream = CountingOutputStream(output_stream)
+        file_decrypt_handler = FileDecryptHandler(
+            data_key_materials.crypto_algorithm,
+            data_key_materials.plaintext_data_key,
+            DECRYPT_MODE,
+        )
+        file_decrypt_handler.process_byte(
+            input_stream, counting_stream, data_key_materials.encryption_contexts, Constants.BLOCK_SIZE
+        )
+        return CryptoResult(
+            result=counting_stream,
+            headers=None,
+            data_length=counting_stream.get_bytes_written(),
+        )

huaweicloud_encryptionsdk/handler/default_serialize_handler.py

@@ -0,0 +1,45 @@
+import struct
+from io import BytesIO
+
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.handler.serialize_handler import SerializeHandler
+from huaweicloud_encryptionsdk.model.cipher_body import CipherBody
+from huaweicloud_encryptionsdk.model.cipher_header import CipherHeader
+from huaweicloud_encryptionsdk.model.data_materials import DataMaterials
+
+
+class DefaultSerializeHandler(SerializeHandler):
+
+    def serialize(self, data_materials):
+        cipher_body = data_materials.cipher_body
+        headers = data_materials.headers.serialize_authenticated_fields()
+        header_tag = data_materials.headers.header_tag
+        header_tag_length = data_materials.headers.header_tag_length
+        body_bytes = cipher_body.to_byte_array()
+        total_length = len(body_bytes) + len(headers) + 2 + len(header_tag)
+        buf = bytearray(total_length)
+        offset = 0
+        buf[offset:offset + len(headers)] = headers
+        offset += len(headers)
+        struct.pack_into(">h", buf, offset, header_tag_length)
+        offset += 2
+        buf[offset:offset + len(header_tag)] = header_tag
+        offset += len(header_tag)
+        buf[offset:offset + len(body_bytes)] = body_bytes
+        return bytes(buf)
+
+    def deserialize(self, cipher_data):
+        try:
+            data_stream = BytesIO(cipher_data)
+            cipher_header = CipherHeader()
+            cipher_header.deserialize_authenticated_fields(data_stream)
+            cipher_body = None
+            remaining = len(cipher_data) - data_stream.tell()
+            if remaining > 0:
+                cipher_body = CipherBody()
+                cipher_body.deserialize(data_stream, cipher_header.algorithm)
+            return DataMaterials(cipher_body, cipher_header)
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.DESERIALIZE_EXCEPTION.message, e)

huaweicloud_encryptionsdk/handler/file_decrypt_handler.py

@@ -0,0 +1,101 @@
+from huaweicloud_encryptionsdk.handler.cipher_handler import CipherHandler, DECRYPT_MODE
+from huaweicloud_encryptionsdk.model.cipher_header import CipherHeader
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.common.utils import serialize_context
+
+
+class FileDecryptHandler:
+
+    def __init__(self, algorithm, secret_key, mode):
+        self._mode = mode
+        self._algorithm = algorithm
+        self._secret_key = secret_key
+        self._un_parsed_byte = b""
+        self._header = None
+
+    def process_byte(self, input_stream, output_stream, encryption_context, block_size):
+        try:
+            cipher_handler = CipherHandler(self._algorithm, self._secret_key, self._mode)
+            aad = serialize_context(encryption_context)
+            file_header_length = CipherHeader().get_file_header_length(self._algorithm)
+
+            while True:
+                read_data = input_stream.read(block_size)
+                if not read_data:
+                    break
+
+                # 拼接未解析数据和新读取数据
+                if self._un_parsed_byte:
+                    buf = self._un_parsed_byte + read_data
+                    self._un_parsed_byte = b""
+                else:
+                    buf = read_data
+
+                offset = 0
+                total = len(buf)
+
+                # 如果有残留的 header，先处理
+                if self._header is not None:
+                    remaining = total - offset
+                    if self._header.content_length > remaining:
+                        self._un_parsed_byte = buf[offset:]
+                        continue
+                    cipher_text = buf[offset:offset + self._header.content_length]
+                    offset += self._header.content_length
+                    cipher_handler.set_iv(self._header.iv)
+                    cipher_handler.process_decrypt_byte(cipher_text, len(cipher_text), output_stream, aad)
+                    self._header = None
+
+                # 循环处理所有完整块
+                while offset + file_header_length <= total:
+                    temp_header = CipherHeader()
+                    header_bytes = buf[offset:offset + file_header_length]
+                    temp_header.deserialize_file_fields(header_bytes, self._algorithm)
+                    content_length = temp_header.content_length
+                    offset += file_header_length
+
+                    if content_length == 0:
+                        raise HuaweicloudException(ErrorMessage.FILE_CHANGED_ERROR.message)
+
+                    if content_length > total - offset:
+                        # 数据不完整，保存 header 和剩余数据
+                        self._header = temp_header
+                        self._un_parsed_byte = buf[offset:]
+                        offset = total
+                        break
+
+                    cipher_text = buf[offset:offset + content_length]
+                    offset += content_length
+                    cipher_handler.set_iv(temp_header.iv)
+                    cipher_handler.process_decrypt_byte(cipher_text, len(cipher_text), output_stream, aad)
+
+                # 保存未处理的剩余数据
+                if offset < total and not self._un_parsed_byte:
+                    self._un_parsed_byte = buf[offset:]
+                    if not self._header:
+                        # 剩余数据不足一个 header
+                        pass
+
+            # 处理文件末尾剩余数据
+            while self._un_parsed_byte and len(self._un_parsed_byte) > 0:
+                if self._header is None:
+                    if len(self._un_parsed_byte) < file_header_length:
+                        break
+                    temp_header = CipherHeader()
+                    header_bytes = self._un_parsed_byte[:file_header_length]
+                    temp_header.deserialize_file_fields(header_bytes, self._algorithm)
+                    self._header = temp_header
+                    self._un_parsed_byte = self._un_parsed_byte[file_header_length:]
+                if self._header.content_length == 0:
+                    raise HuaweicloudException(ErrorMessage.FILE_CHANGED_ERROR.message)
+                if self._header.content_length > len(self._un_parsed_byte):
+                    break
+                cipher_text = self._un_parsed_byte[:self._header.content_length]
+                cipher_handler.set_iv(self._header.iv)
+                cipher_handler.process_decrypt_byte(cipher_text, len(cipher_text), output_stream, aad)
+                self._un_parsed_byte = self._un_parsed_byte[self._header.content_length:]
+                self._header = None
+        except HuaweicloudException:
+            raise
+        except Exception as e:
+            raise HuaweicloudException(ErrorMessage.FILE_CHANGED_ERROR.message) from e

huaweicloud_encryptionsdk/handler/file_encrypt_handler.py

@@ -0,0 +1,30 @@
+from huaweicloud_encryptionsdk.handler.cipher_handler import CipherHandler
+from huaweicloud_encryptionsdk.common.utils import serialize_context
+
+
+class FileEncryptHandler:
+
+    def __init__(self, algorithm, secret_key, mode):
+        self._mode = mode
+        self._algorithm = algorithm
+        self._secret_key = secret_key
+
+    def process_byte(self, input_stream, output_stream, encryption_context, block_size):
+        read_bytes = bytearray(block_size)
+        cipher_handler = CipherHandler(self._algorithm, self._secret_key, self._mode)
+        aad = serialize_context(encryption_context)
+        while True:
+            read_len = input_stream.readinto(read_bytes) if hasattr(input_stream, 'readinto') else self._read_stream(input_stream, read_bytes)
+            if read_len is None or read_len == -1 or read_len == 0:
+                break
+            cipher_handler.reset_iv()
+            cipher_handler.process_encrypt_byte(read_bytes[:read_len], read_len, output_stream, aad)
+
+    @staticmethod
+    def _read_stream(input_stream, buf):
+        data = input_stream.read(len(buf))
+        if data is None or len(data) == 0:
+            return -1
+        n = len(data)
+        buf[:n] = data
+        return n

huaweicloud_encryptionsdk/handler/serialize_handler.py

@@ -0,0 +1,14 @@
+from abc import ABC, abstractmethod
+
+from huaweicloud_encryptionsdk.model.data_materials import DataMaterials
+
+
+class SerializeHandler(ABC):
+
+    @abstractmethod
+    def serialize(self, data_materials):
+        pass
+
+    @abstractmethod
+    def deserialize(self, cipher_data):
+        pass

huaweicloud_encryptionsdk/huawei_config.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Optional
+
+from huaweicloud_encryptionsdk.exception.errors import HuaweicloudException, ErrorMessage
+from huaweicloud_encryptionsdk.model.kms_config import KMSConfig
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+from huaweicloud_encryptionsdk.model.key_capsule_config import KeyCapsuleConfig
+from huaweicloud_encryptionsdk.log.log_config import LogConfig
+
+
+@dataclass
+class HuaweiConfig:
+    ak: str = ""
+    sk: str = ""
+    security_token: Optional[str] = None
+    is_discovery: bool = False
+    kms_config_list: Optional[list[KMSConfig]] = None
+    origin_kms_config_list: Optional[list[KMSConfig]] = None
+    crypto_algorithm: Optional[CryptoAlgorithm] = None
+    key_capsule_config: Optional[KeyCapsuleConfig] = None
+    log_config: Optional[LogConfig] = None
+    local_log_only: bool = False
+
+    def __post_init__(self):
+        if self.ak:
+            self._validate_non_empty(self.ak, ErrorMessage.AK_NULL_EXCEPTION)
+        if self.sk:
+            self._validate_non_empty(self.sk, ErrorMessage.SK_NULL_EXCEPTION)
+
+    @staticmethod
+    def _validate_non_empty(value: str, error: ErrorMessage) -> None:
+        if not value or not value.strip():
+            raise HuaweicloudException(error.message)
+
+    def set_ak(self, value: str) -> None:
+        self._validate_non_empty(value, ErrorMessage.AK_NULL_EXCEPTION)
+        self.ak = value
+
+    def set_sk(self, value: str) -> None:
+        self._validate_non_empty(value, ErrorMessage.SK_NULL_EXCEPTION)
+        self.sk = value
+
+    def get_ak(self) -> str:
+        return self.ak
+
+    def get_sk(self) -> str:
+        return self.sk