Skip to content

feat(tdf): TDFOption varargs interface #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmihalcik-virtru merged 7 commits into from
Feb 21, 2024
Merged

feat(tdf): TDFOption varargs interface #235

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bb24066
feat(tdf): TDFOption varargs interface
sujankota Feb 21, 2024
52dfd96
cleanup
sujankota Feb 21, 2024
5233160
cleanups
dmihalcik-virtru Feb 21, 2024
de10dfa
cleanups
dmihalcik-virtru Feb 21, 2024
eb1c85b
nolints
dmihalcik-virtru Feb 21, 2024
71db84d
lint fixes/nolints
dmihalcik-virtru Feb 21, 2024
5ecbab2
Update tdf.go
dmihalcik-virtru Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 18 additions & 17 deletions sdk/internal/archive/writer_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,23 +103,24 @@ var ArchiveTests = []struct { //nolint:gochecknoglobals // This global is used a
526397048,
},

{
[]ZipEntryInfo{
{
"1.txt",
oneGB,
},
{
"2.txt",
oneGB,
},
{
"3.txt",
tenGB,
},
},
12582912572,
},
// Disabled because this test take long time.
//{
// []ZipEntryInfo{
// {
// "1.txt",
// oneGB,
// },
// {
// "2.txt",
// oneGB,
// },
// {
// "3.txt",
// tenGB,
// },
// },
// 12582912572,
// },
}

// create a buffer of 2mb and fill it with 0xFF, and
Expand Down
79 changes: 44 additions & 35 deletions sdk/tdf.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,32 +35,32 @@ var (
)

const (
maxFileSizeSupported = 68719476736 // 64gb
defaultMimeType = "application/octet-stream"
tdfAsZip = "zip"
gcmIvSize = 12
aesBlockSize = 16
hmacIntegrityAlgorithm = "HS256"
gmacIntegrityAlgorithm = "GMAC"
tdfZipReference = "reference"
kKeySize = 32
kWrapped = "wrapped"
kKasProtocol = "kas"
kSplitKeyType = "split"
kGCMCipherAlgorithm = "AES-256-GCM"
kGMACPayloadLength = 16
// kClientPublicKey = "clientPublicKey"
kSignedRequestToken = "signedRequestToken"
// kKasURL = "url"
kRewrapV2 = "/v2/rewrap"
kAuthorizationKey = "Authorization"
kContentTypeKey = "Content-Type"
kAcceptKey = "Accept"
kContentTypeJSONValue = "application/json"
kEntityWrappedKey = "entityWrappedKey"
// kPolicy = "policy"
// kHmacIntegrityAlgorithm = "HS256"
// kGmacIntegrityAlgorithm = "GMAC"
maxFileSizeSupported = 68719476736 // 64gb
defaultMimeType = "application/octet-stream"
tdfAsZip = "zip"
gcmIvSize = 12
aesBlockSize = 16
hmacIntegrityAlgorithm = "HS256"
gmacIntegrityAlgorithm = "GMAC"
tdfZipReference = "reference"
kKeySize = 32
kWrapped = "wrapped"
kKasProtocol = "kas"
kSplitKeyType = "split"
kGCMCipherAlgorithm = "AES-256-GCM"
kGMACPayloadLength = 16
kClientPublicKey = "clientPublicKey"
kSignedRequestToken = "signedRequestToken"
kKasURL = "url"
kRewrapV2 = "/v2/rewrap"
kAuthorizationKey = "Authorization"
kContentTypeKey = "Content-Type"
kAcceptKey = "Accept"
kContentTypeJSONValue = "application/json"
kEntityWrappedKey = "entityWrappedKey"
kPolicy = "policy"
kHmacIntegrityAlgorithm = "HS256"
kGmacIntegrityAlgorithm = "GMAC"
)

type Reader struct {
Expand Down Expand Up @@ -92,8 +92,8 @@ type RequestBody struct {
Policy string `json:"policy"`
}

// CreateTDF tdf
func CreateTDF(tdfConfig TDFConfig, reader io.ReadSeeker, writer io.Writer) (*TDFObject, error) { //nolint:funlen, gocognit, lll
// CreateTDF reads plain text from the given reader and saves it to the writer, subject to the given options
func CreateTDF(writer io.Writer, reader io.ReadSeeker, opts ...TDFOption) (*TDFObject, error) { //nolint:funlen, gocognit, lll
inputSize, err := reader.Seek(0, io.SeekEnd)
if err != nil {
return nil, fmt.Errorf("readSeeker.Seek failed: %w", err)
Expand All @@ -108,8 +108,13 @@ func CreateTDF(tdfConfig TDFConfig, reader io.ReadSeeker, writer io.Writer) (*TD
return nil, fmt.Errorf("readSeeker.Seek failed: %w", err)
}

tdfConfig, err := NewTDFConfig(opts...)
if err != nil {
return nil, fmt.Errorf("NewTDFConfig failed: %w", err)
}

tdfObject := &TDFObject{}
err = tdfObject.prepareManifest(tdfConfig)
err = tdfObject.prepareManifest(*tdfConfig)
if err != nil {
return nil, fmt.Errorf("fail to create a new split key: %w", err)
}
Expand Down Expand Up @@ -251,7 +256,7 @@ func (tdfObject *TDFObject) prepareManifest(tdfConfig TDFConfig) error { //nolin
}

base64PolicyObject := crypto.Base64Encode(policyObjectAsStr)
symKeys := [][]byte{}
symKeys := make([][]byte, 0, len(tdfConfig.kasInfoList))
for _, kasInfo := range tdfConfig.kasInfoList {
if len(kasInfo.publicKey) == 0 {
return errKasPubKeyMissing
Expand Down Expand Up @@ -296,8 +301,10 @@ func (tdfObject *TDFObject) prepareManifest(tdfConfig TDFConfig) error { //nolin
}

iv := encryptedMetaData[:crypto.GcmStandardNonceSize]
metadata := EncryptedMetadata{Cipher: string(crypto.Base64Encode(encryptedMetaData)),
Iv: string(crypto.Base64Encode(iv))}
metadata := EncryptedMetadata{
Cipher: string(crypto.Base64Encode(encryptedMetaData)),
Iv: string(crypto.Base64Encode(iv)),
}

metadataJSON, err := json.Marshal(metadata)
if err != nil {
Expand Down Expand Up @@ -737,7 +744,7 @@ func handleKasRequest(kasPath string, body *RequestBody, authConfig AuthConfig)

claims := rewrapJWTClaims{
jwt.RegisteredClaims{
ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)), // Set expiration to be one minute from now
ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
IssuedAt: jwt.NewNumericDate(time.Now()),
},
string(requestBodyData),
Expand Down Expand Up @@ -807,8 +814,10 @@ func rewrap(authConfig AuthConfig, requestBody *RequestBody) ([]byte, error) {
}

response, err := handleKasRequest(kRewrapV2, requestBody, authConfig)

defer func() {
if response == nil {
return
}
err := response.Body.Close()
if err != nil {
slog.Error("Fail to close HTTP response")
Expand All @@ -817,7 +826,7 @@ func rewrap(authConfig AuthConfig, requestBody *RequestBody) ([]byte, error) {

if err != nil {
slog.Error("failed http request")
return nil, fmt.Errorf("http request error: %w", err)
return nil, err
}
if response.StatusCode != kHTTPOk {
return nil, fmt.Errorf("http request failed status code:%d", response.StatusCode)
Expand Down
Loading