1 // -*- mode:C; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab
4 * Crypto filters for Put/Post/Get operations.
6 #ifndef CEPH_RGW_CRYPT_H
7 #define CEPH_RGW_CRYPT_H
9 #include <rgw/rgw_op.h>
10 #include <rgw/rgw_rest.h>
11 #include <rgw/rgw_rest_s3.h>
12 #include <boost/utility/string_view.hpp>
15 * \brief Interface for block encryption methods
17 * Encrypts and decrypts data.
18 * Operations are performed in context of larger stream being divided into blocks.
19 * Each block can be processed independently, but only as a whole.
20 * Part block cannot be properly processed.
21 * Each request must start on block-aligned offset.
22 * Each request should have length that is multiply of block size.
23 * Request with unaligned length is only acceptable for last part of stream.
28 virtual ~BlockCrypt(){};
31 * Determines size of encryption block.
32 * This is usually multiply of key size.
33 * It determines size of chunks that should be passed to \ref encrypt and \ref decrypt.
35 virtual size_t get_block_size() = 0;
39 * Argument \ref stream_offset shows where in generalized stream chunk is located.
40 * Input for encryption is \ref input buffer, with relevant data in range <in_ofs, in_ofs+size).
41 * \ref input and \output may not be the same buffer.
44 * input - source buffer of data
45 * in_ofs - offset of chunk inside input
46 * size - size of chunk, must be chunk-aligned unless last part is processed
47 * output - destination buffer to encrypt to
48 * stream_offset - location of <in_ofs,in_ofs+size) chunk in data stream, must be chunk-aligned
49 * \return true iff successfully encrypted
51 virtual bool encrypt(bufferlist& input,
55 off_t stream_offset) = 0;
59 * Argument \ref stream_offset shows where in generalized stream chunk is located.
60 * Input for decryption is \ref input buffer, with relevant data in range <in_ofs, in_ofs+size).
61 * \ref input and \output may not be the same buffer.
64 * input - source buffer of data
65 * in_ofs - offset of chunk inside input
66 * size - size of chunk, must be chunk-aligned unless last part is processed
67 * output - destination buffer to encrypt to
68 * stream_offset - location of <in_ofs,in_ofs+size) chunk in data stream, must be chunk-aligned
69 * \return true iff successfully encrypted
71 virtual bool decrypt(bufferlist& input,
75 off_t stream_offset) = 0;
78 static const size_t AES_256_KEYSIZE = 256 / 8;
79 bool AES_256_ECB_encrypt(CephContext* cct,
82 const uint8_t* data_in,
86 class RGWGetObj_BlockDecrypt : public RGWGetObj_Filter {
89 std::unique_ptr<BlockCrypt> crypt; /**< already configured stateless BlockCrypt
90 for operations when enough data is accumulated */
91 off_t enc_begin_skip; /**< amount of data to skip from beginning of received data */
92 off_t ofs; /**< stream offset of data we expect to show up next through \ref handle_data */
93 off_t end; /**< stream offset of last byte that is requested */
94 bufferlist cache; /**< stores extra data that could not (yet) be processed by BlockCrypt */
95 size_t block_size; /**< snapshot of \ref BlockCrypt.get_block_size() */
96 std::vector<size_t> parts_len; /**< size of parts of multipart object, parsed from manifest */
98 RGWGetObj_BlockDecrypt(CephContext* cct,
100 std::unique_ptr<BlockCrypt> crypt);
101 virtual ~RGWGetObj_BlockDecrypt();
103 virtual int fixup_range(off_t& bl_ofs,
104 off_t& bl_end) override;
105 virtual int handle_data(bufferlist& bl,
107 off_t bl_len) override;
108 virtual int flush() override;
110 int read_manifest(bufferlist& manifest_bl);
111 }; /* RGWGetObj_BlockDecrypt */
114 class RGWPutObj_BlockEncrypt : public RGWPutObj_Filter
117 std::unique_ptr<BlockCrypt> crypt; /**< already configured stateless BlockCrypt
118 for operations when enough data is accumulated */
119 off_t ofs; /**< stream offset of data we expect to show up next through \ref handle_data */
120 bufferlist cache; /**< stores extra data that could not (yet) be processed by BlockCrypt */
121 size_t block_size; /**< snapshot of \ref BlockCrypt.get_block_size() */
123 RGWPutObj_BlockEncrypt(CephContext* cct,
124 RGWPutObjDataProcessor* next,
125 std::unique_ptr<BlockCrypt> crypt);
126 virtual ~RGWPutObj_BlockEncrypt();
127 virtual int handle_data(bufferlist& bl,
131 bool *again) override;
132 virtual int throttle_data(void *handle,
133 const rgw_raw_obj& obj,
135 bool need_to_wait) override;
136 }; /* RGWPutObj_BlockEncrypt */
139 int rgw_s3_prepare_encrypt(struct req_state* s,
140 std::map<std::string, ceph::bufferlist>& attrs,
141 std::map<std::string,
142 RGWPostObj_ObjStore::post_form_part,
143 const ltstr_nocase>* parts,
144 std::unique_ptr<BlockCrypt>* block_crypt,
145 std::map<std::string,
146 std::string>& crypt_http_responses);
148 int rgw_s3_prepare_decrypt(struct req_state* s,
149 std::map<std::string, ceph::bufferlist>& attrs,
150 std::unique_ptr<BlockCrypt>* block_crypt,
151 std::map<std::string,
152 std::string>& crypt_http_responses);