/
opt
/
gsutil
/
gslib
/
utils
/
__pycache__
/
up file
home
a +(Wg � @ s� d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlZddlZddlm Z ddl Z ddl Z ddl Z ddl mZ dd lmZ d Zed d � �ZG d d� de�ZG dd� de�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Z dS ) zGHelper functions for dealing with encryption keys used with cloud APIs.� )�absolute_import)�print_function)�division)�unicode_literalsN)�sha256)�CommandException)� LazyWrapper�d c C s t �d�S )Nzqprojects/([^/]+)/locations/([a-zA-Z0-9_-]{1,63})/keyRings/([a-zA-Z0-9_-]{1,63})/cryptoKeys/([a-zA-Z0-9_-]{1,63})$)�re�compile� r r �,/opt/gsutil/gslib/utils/encryption_helper.py�<lambda>" � r c @ s e Zd ZdZdZdZdS )� CryptoKeyTypezDEnum of valid types of encryption keys used with cloud API requests.�CSEK�CMEKN)�__name__� __module__� __qualname__�__doc__r r r r r r r ( s r c @ s e Zd ZdZdd� ZdS )�CryptoKeyWrapperz�Class describing a crypto key used with cloud API requests. This class should be instantiated via the `CryptoKeyWrapperFromKey` method. c C s� || _ t|�dkrFtj| _d| _zt|�| _W q� td��Y q�0 nTz t |� W n2 ty� } ztd|j ��W Y d}~n d}~0 0 tj | _d| _d| _dS )a Initialize the CryptoKeyWrapper. Args: crypto_key: Base64-encoded string of a CSEK, or the name of a Cloud KMS CMEK. Raises: CommandException: The specified crypto key was neither a CMEK key name nor a valid base64-encoded string of a CSEK. �, �AES256z�Configured encryption_key or decryption_key looked like a CSEK, but it was not a valid 44-character base64 string. Please double-check your configuration and ensure the key is correct.zaConfigured encryption_key or decryption_key looked like a CMEK, but the key failed validation: %sN) � crypto_key�lenr r � crypto_type� crypto_alg�#Base64Sha256FromBase64EncryptionKey�crypto_key_sha256r � ValidateCMEK�reasonr )�selfr �er r r �__init__4 s* � ��zCryptoKeyWrapper.__init__N)r r r r r$ r r r r r . s r c C s | r t | �S dS )z>Returns a CryptoKeyWrapper for crypto_key, or None for no key.N)r )r r r r �CryptoKeyWrapperFromKeyX s r% c C s� t jrt| t�s| �d�} t|�ddd��}|durP|jtj krP|j | krP|j S t t �D ]T}|d }t|�ddt|� d��}|du r� q�qX|jtj krX|j | krX|j S qXdS )a~ Searches boto_config for a CSEK with the given base64-encoded SHA256 hash. Args: key_sha256: (str) Base64-encoded SHA256 hash of the AES256 encryption key. boto_config: (boto.pyami.config.Config) The boto config in which to check for a matching encryption key. Returns: (str) Base64-encoded encryption key string if a match is found, None otherwise. �ascii�GSUtil�encryption_keyN� zdecryption_key%s)�six�PY3� isinstance�bytes�encoder% �getr r r r r �range�MAX_DECRYPTION_KEYS�str)� key_sha256� boto_configZ keywrapper�iZ key_numberr r r � FindMatchingCSEKInBotoConfig] s. � �� � �r6 c C s | � ddd�}|rt|�S dS )a� Returns a CryptoKeyWrapper for the configured encryption key. Reads in the value of the "encryption_key" attribute in boto_config, and if present, verifies it is a valid base64-encoded string and returns a CryptoKeyWrapper for it. Args: boto_config: (boto.pyami.config.Config) The boto config in which to check for a matching encryption key. Returns: CryptoKeyWrapper for the specified encryption key, or None if no encryption key was specified in boto_config. r' r( N)r/ r �r4 r( r r r �GetEncryptionKeyWrapper� s r8 c C sL t jrt| t�s| �d�} t�| �}t|�}t� |�}t� |�}|� dd�S )Nr& � r ) r* r+ r, r- r. �base64� b64decode�_CalculateSha256FromString�binascii� unhexlify� b64encode�replace)Zcsek_encryption_key� decoded_bytesr3 Z sha256_bytesZ sha256_base64r r r r � s r c C s> | s t d��| �d�r"t d| ��t� �| �s:t d| ��d S )NzKMS key is empty.�/z5KMS key should not start with leading slash (/): "%s"z�Invalid KMS key name: "%s". KMS keys should follow the format "projects/<project-id>/locations/<location>/keyRings/<keyring>/cryptoKeys/<key-name>")r � startswith� VALID_CMEK_RE�match)�keyr r r r � s � ��r c C s t � }|�| � |�� S )N)r �update� hexdigest)Z input_stringZ sha256_hashr r r r< � s r< c C s: | � ddd�}|r6zt�|� W n td��Y n0 |S )aC Reads the encryption key from boto_config and ensures it is base64-encoded. Args: boto_config: (boto.pyami.config.Config) The boto config in which to check for a matching encryption key. Returns: (str) Base64-encoded encryption key string, or None if no encryption key exists in configuration. r' r( Nz�Configured encryption_key is not a valid base64 string. Please double-check your configuration and ensure the key is valid and in base64 format.)r/ r: r; r r7 r r r � _GetAndVerifyBase64EncryptionKey� s � rI ) r � __future__r r r r r: r= �hashlibr r �sysr* �gslib.exceptionr �gslib.lazy_wrapperr r1 rD �objectr r r% r6 r8 r r r< rI r r r r �<module> s2 �*$