Skip to content

Commit 81dd4c2

Browse files
netfnetf
committed
Added tests
1 parent f712d6f commit 81dd4c2

File tree

14 files changed

+821
-706
lines changed

14 files changed

+821
-706
lines changed

‎example/main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import (
1616

1717
const (
1818
awsRegion = "eu-west-2"
19-
keyURI = "aws-kms://arn:aws:kms:eu-west-2:076594877490:key/02813db0-b23a-420c-94b0-bdceb08e121b"
19+
keyURI = "arn:aws:kms:eu-west-2:076594877490:key/02813db0-b23a-420c-94b0-bdceb08e121b"
2020
dynamoDBTableName = "meta"
2121
)
2222

‎example/sm/main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ func main() {
148148

149149
tableName := "UserSecretsTest"
150150

151-
keyURI := "aws-kms://arn:aws:kms:eu-west-2:076123456789:key/02813db0-b23a-420c-94b0-bdceb08e121b"
151+
keyURI := "aws-kms://arn:aws:kms:eu-west-2:076594877490:key/02813db0-b23a-420c-94b0-bdceb08e121b"
152152

153153
// Create DynamoDB client
154154
dynamoDBClient := dynamodb.NewFromConfig(cfg)

‎example/sm/sm

-176 Bytes
Binary file not shown.

‎go.mod

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,12 @@ module github.com/cloudopsy/dynamodb-encryption-go
33
go 1.21.7
44

55
require (
6-
github.com/aws/aws-sdk-go v1.51.6
6+
github.com/aws/aws-sdk-go v1.51.8
77
github.com/aws/aws-sdk-go-v2 v1.26.0
88
github.com/aws/aws-sdk-go-v2/config v1.27.9
9-
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.11
9+
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.12
1010
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.31.0
11-
github.com/stretchr/testify v1.9.0
12-
github.com/tink-crypto/tink-go-awskms v0.0.0-20230616072154-ba4f9f22c3e9
11+
github.com/google/go-cmp v0.6.0
1312
github.com/tink-crypto/tink-go/v2 v2.1.0
1413
)
1514

@@ -29,10 +28,10 @@ require (
2928
github.com/aws/smithy-go v1.20.1 // indirect
3029
github.com/davecgh/go-spew v1.1.1 // indirect
3130
github.com/jmespath/go-jmespath v0.4.0 // indirect
32-
github.com/pmezard/go-difflib v1.0.0 // indirect
33-
github.com/stretchr/objx v0.5.2 // indirect
31+
github.com/tink-crypto/tink-go v0.0.0-20230613075026-d6de17e3f164 // indirect
32+
github.com/tink-crypto/tink-go-awskms v0.0.0-20230616072154-ba4f9f22c3e9 // indirect
33+
github.com/tink-crypto/tink-go-awskms/v2 v2.0.0 // indirect
3434
golang.org/x/crypto v0.21.0 // indirect
3535
golang.org/x/sys v0.18.0 // indirect
3636
google.golang.org/protobuf v1.33.0 // indirect
37-
gopkg.in/yaml.v3 v3.0.1 // indirect
3837
)

‎go.sum

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,13 @@
1-
github.com/aws/aws-sdk-go v1.51.4 h1:yOVfGhRJyReBrACK0alLosJl8iXhWkNY1vrePYmhHdw=
2-
github.com/aws/aws-sdk-go v1.51.4/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
3-
github.com/aws/aws-sdk-go v1.51.6 h1:Ld36dn9r7P9IjU8WZSaswQ8Y/XUCRpewim5980DwYiU=
4-
github.com/aws/aws-sdk-go v1.51.6/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
1+
github.com/aws/aws-sdk-go v1.51.8 h1:tD7gQq5XKuKdhA6UMEH26ZNQH0s+HbL95rzv/ACz5TQ=
2+
github.com/aws/aws-sdk-go v1.51.8/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
53
github.com/aws/aws-sdk-go-v2 v1.26.0 h1:/Ce4OCiM3EkpW7Y+xUnfAFpchU78K7/Ug01sZni9PgA=
64
github.com/aws/aws-sdk-go-v2 v1.26.0/go.mod h1:35hUlJVYd+M++iLI3ALmVwMOyRYMmRqUXpTtRGW+K9I=
7-
github.com/aws/aws-sdk-go-v2/config v1.27.8 h1:0r8epOsiJ7YJz65MGcb8i91ehFp4kvvFe2qkq5oYeRI=
8-
github.com/aws/aws-sdk-go-v2/config v1.27.8/go.mod h1:XsmYKxYNuIhLsFddpNds+j9H5XKzjWDdg/SZngiwFio=
95
github.com/aws/aws-sdk-go-v2/config v1.27.9 h1:gRx/NwpNEFSk+yQlgmk1bmxxvQ5TyJ76CWXs9XScTqg=
106
github.com/aws/aws-sdk-go-v2/config v1.27.9/go.mod h1:dK1FQfpwpql83kbD873E9vz4FyAxuJtR22wzoXn3qq0=
11-
github.com/aws/aws-sdk-go-v2/credentials v1.17.8 h1:WUdNLXbyNbU07V/WFrSOBXqZTDgmmMNMgUFzpYOKJhw=
12-
github.com/aws/aws-sdk-go-v2/credentials v1.17.8/go.mod h1:iPZzLpaBIfhyvVS/XGD3JvR1GP3YdHTqpySKDlqkfs8=
137
github.com/aws/aws-sdk-go-v2/credentials v1.17.9 h1:N8s0/7yW+h8qR8WaRlPQeJ6czVMNQVNtNdUqf6cItao=
148
github.com/aws/aws-sdk-go-v2/credentials v1.17.9/go.mod h1:446YhIdmSV0Jf/SLafGZalQo+xr2iw7/fzXGDPTU1yQ=
15-
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.11 h1:nyWawIVs7Y75DuNhh6vao/qmKKWS56zUuWt/+dOE5iI=
16-
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.11/go.mod h1:5WPGXfp9+ss7gYsZ5QjJeY16qTpCLaIcQItE7Yw7ld4=
17-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.4 h1:S+L2QSKhUuShih3aq9P/mkzDBiOO5tTyVg+vXREfsfg=
18-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.4/go.mod h1:nQ3how7DMnFMWiU1SpECohgC82fpn4cKZ875NDMmwtA=
9+
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.12 h1:q6f5Y1gcGQVz53Q4WcACo6y1sP2VuNGZPW4JtWhwplI=
10+
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.13.12/go.mod h1:5WPGXfp9+ss7gYsZ5QjJeY16qTpCLaIcQItE7Yw7ld4=
1911
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 h1:af5YzcLf80tv4Em4jWVD75lpnOHSBkPUZxZfGkrI3HI=
2012
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0/go.mod h1:nQ3how7DMnFMWiU1SpECohgC82fpn4cKZ875NDMmwtA=
2113
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 h1:0ScVK/4qZ8CIW0k8jOeFVsyS/sAiXpYxRBLolMkuLQM=
@@ -54,12 +46,12 @@ github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfC
5446
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
5547
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5648
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
57-
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
58-
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
59-
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
60-
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
49+
github.com/tink-crypto/tink-go v0.0.0-20230613075026-d6de17e3f164 h1:yhVO0Yhq84FjdcotvFFvDJRNHJ7mO743G12VdcW4Evc=
50+
github.com/tink-crypto/tink-go v0.0.0-20230613075026-d6de17e3f164/go.mod h1:HhtDVdE/PRZFRia834tkmcwuscnaAzda1RJUW9Pr3Rg=
6151
github.com/tink-crypto/tink-go-awskms v0.0.0-20230616072154-ba4f9f22c3e9 h1:MoIsYvBNJd8vkKZjLYloE3OK8bfcO10cMPw/EtydMBs=
6252
github.com/tink-crypto/tink-go-awskms v0.0.0-20230616072154-ba4f9f22c3e9/go.mod h1:TTE4PoQLsYB5jQ1kK2g7WU4wzHg0Arn1CEozIUXiGSY=
53+
github.com/tink-crypto/tink-go-awskms/v2 v2.0.0 h1:UT9z5+ofB2i1LXuuQlaRRxogToKQ5wO3fSDVpuUselA=
54+
github.com/tink-crypto/tink-go-awskms/v2 v2.0.0/go.mod h1:pm7AWeeSzYjPLFKoBTPcuzlMX1DDaKyaIOYdVbsy168=
6355
github.com/tink-crypto/tink-go/v2 v2.1.0 h1:QXFBguwMwTIaU17EgZpEJWsUSc60b1BAGTzBIoMdmok=
6456
github.com/tink-crypto/tink-go/v2 v2.1.0/go.mod h1:y1TnYFt1i2eZVfx4OGc+C+EMp4CoKWAw2VSEuoicHHI=
6557
golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
@@ -68,9 +60,6 @@ golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
6860
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
6961
google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
7062
google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
71-
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
7263
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
7364
gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
7465
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
75-
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
76-
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎internal/fakekms/fakekms.go

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
//
15+
////////////////////////////////////////////////////////////////////////////////
16+
17+
// Package fakeawskms provides a partial fake implementation of kmsiface.KMSAPI.
18+
package fakeawskms
19+
20+
import (
21+
"bytes"
22+
"errors"
23+
"fmt"
24+
"sort"
25+
26+
"github.com/aws/aws-sdk-go/service/kms"
27+
"github.com/aws/aws-sdk-go/service/kms/kmsiface"
28+
"github.com/tink-crypto/tink-go/v2/aead"
29+
"github.com/tink-crypto/tink-go/v2/keyset"
30+
"github.com/tink-crypto/tink-go/v2/tink"
31+
)
32+
33+
type fakeAWSKMS struct {
34+
kmsiface.KMSAPI
35+
aeads map[string]tink.AEAD
36+
keyIDs []string
37+
}
38+
39+
// serializeContext serializes the context map in a canonical way into a byte array.
40+
func serializeContext(context map[string]*string) []byte {
41+
names := make([]string, 0, len(context))
42+
for name := range context {
43+
names = append(names, name)
44+
}
45+
sort.Strings(names)
46+
b := new(bytes.Buffer)
47+
b.WriteString("{")
48+
for i, name := range names {
49+
if i > 0 {
50+
b.WriteString(",")
51+
}
52+
fmt.Fprintf(b, "%q:%q", name, *context[name])
53+
}
54+
b.WriteString("}")
55+
return b.Bytes()
56+
}
57+
58+
// New returns a new fake AWS KMS API.
59+
func New(validKeyIDs []string) (kmsiface.KMSAPI, error) {
60+
aeads := make(map[string]tink.AEAD)
61+
for _, keyID := range validKeyIDs {
62+
handle, err := keyset.NewHandle(aead.AES256GCMKeyTemplate())
63+
if err != nil {
64+
return nil, err
65+
}
66+
a, err := aead.New(handle)
67+
if err != nil {
68+
return nil, err
69+
}
70+
aeads[keyID] = a
71+
}
72+
return &fakeAWSKMS{
73+
aeads: aeads,
74+
keyIDs: validKeyIDs,
75+
}, nil
76+
}
77+
78+
func (f *fakeAWSKMS) Encrypt(request *kms.EncryptInput) (*kms.EncryptOutput, error) {
79+
a, ok := f.aeads[*request.KeyId]
80+
if !ok {
81+
return nil, fmt.Errorf("unknown keyID: %q not in %q", *request.KeyId, f.keyIDs)
82+
}
83+
serializedContext := serializeContext(request.EncryptionContext)
84+
ciphertext, err := a.Encrypt(request.Plaintext, serializedContext)
85+
if err != nil {
86+
return nil, err
87+
}
88+
return &kms.EncryptOutput{
89+
CiphertextBlob: ciphertext,
90+
KeyId: request.KeyId,
91+
}, nil
92+
}
93+
94+
func (f *fakeAWSKMS) Decrypt(request *kms.DecryptInput) (*kms.DecryptOutput, error) {
95+
serializedContext := serializeContext(request.EncryptionContext)
96+
if request.KeyId != nil {
97+
a, ok := f.aeads[*request.KeyId]
98+
if !ok {
99+
return nil, fmt.Errorf("unknown keyID: %q not in %q", *request.KeyId, f.keyIDs)
100+
}
101+
plaintext, err := a.Decrypt(request.CiphertextBlob, serializedContext)
102+
if err != nil {
103+
return nil, fmt.Errorf("decryption with keyID %q failed", *request.KeyId)
104+
}
105+
return &kms.DecryptOutput{
106+
Plaintext: plaintext,
107+
KeyId: request.KeyId,
108+
}, nil
109+
}
110+
// When KeyId is not set, try out all AEADs.
111+
for keyID, a := range f.aeads {
112+
plaintext, err := a.Decrypt(request.CiphertextBlob, serializedContext)
113+
if err == nil {
114+
return &kms.DecryptOutput{
115+
Plaintext: plaintext,
116+
KeyId: &keyID,
117+
}, nil
118+
}
119+
}
120+
return nil, errors.New("unable to decrypt message")
121+
}

0 commit comments

Comments
 (0)