-
Notifications
You must be signed in to change notification settings - Fork 936
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add encrypt/decrypt module on data source plugin
Signed-off-by: Louis Chu <[email protected]>
- Loading branch information
Showing
18 changed files
with
666 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6 changes: 6 additions & 0 deletions
6
src/plugins/credential_management/public/components/text_content/index.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| export * as localizedContent from '../text_content/text_content'; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| export * as Credential from './types'; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { SavedObjectAttributes } from 'src/core/types'; | ||
|
|
||
| export type SharedAuthType = 'shared'; | ||
| export type UsernamePasswordType = 'username_password'; | ||
| export type NoAuthType = 'no_auth'; | ||
|
|
||
| export interface CredentialSavedObjectAttributes extends SavedObjectAttributes { | ||
| title: string; | ||
| authType: SharedAuthType; | ||
| credentialMaterials: CredentialMaterials; | ||
| description?: string; | ||
| } | ||
|
|
||
| export interface CredentialMaterials extends SavedObjectAttributes { | ||
| credentialMaterialsType: UsernamePasswordType | NoAuthType; | ||
| credentialMaterialsContent?: UsernamePasswordTypedContent; | ||
| } | ||
|
|
||
| export interface UsernamePasswordTypedContent extends SavedObjectAttributes { | ||
| username: string; | ||
| password: string; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { schema, TypeOf } from '@osd/config-schema'; | ||
|
|
||
| const KEY_NAME_MIN_LENGTH: number = 1; | ||
| const KEY_NAME_MAX_LENGTH: number = 100; | ||
| // Wrapping key size shoule be 32 bytes, as used in envelope encryption algorithms. | ||
| const WRAPPING_KEY_SIZE: number = 32; | ||
|
|
||
| export const configSchema = schema.object({ | ||
| enabled: schema.boolean({ defaultValue: false }), | ||
| wrappingKeyName: schema.string({ | ||
| minLength: KEY_NAME_MIN_LENGTH, | ||
| maxLength: KEY_NAME_MAX_LENGTH, | ||
| defaultValue: 'changeme', | ||
| }), | ||
| wrappingKeyNamespace: schema.string({ | ||
| minLength: KEY_NAME_MIN_LENGTH, | ||
| maxLength: KEY_NAME_MAX_LENGTH, | ||
| defaultValue: 'changeme', | ||
| }), | ||
| wrappingKey: schema.maybe( | ||
| schema.arrayOf(schema.number(), { | ||
| minSize: WRAPPING_KEY_SIZE, | ||
| maxSize: WRAPPING_KEY_SIZE, | ||
| }) | ||
| ), | ||
| }); | ||
|
|
||
| export type DataSourcePluginConfigType = TypeOf<typeof configSchema>; |
117 changes: 117 additions & 0 deletions
117
src/plugins/data_source/server/cryptography/cryptography_client.test.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { CryptographyClient } from './cryptography_client'; | ||
| import { randomBytes } from 'crypto'; | ||
|
|
||
| const dummyWrappingKeyName = 'dummy_wrapping_key_name'; | ||
| const dummyWrappingKeyNamespace = 'dummy_wrapping_key_namespace'; | ||
|
|
||
| test('Invalid wrapping key size throws error', () => { | ||
| const dummyRandomBytes = [...randomBytes(31)]; | ||
| const expectedErrorMsg = `Wrapping key size shoule be 32 bytes, as used in envelope encryption. Current wrapping key size: '${dummyRandomBytes.length}' bytes`; | ||
| expect(() => { | ||
| new CryptographyClient(dummyWrappingKeyName, dummyWrappingKeyNamespace, dummyRandomBytes); | ||
| }).toThrowError(new Error(expectedErrorMsg)); | ||
| }); | ||
|
|
||
| describe('Test encrpyt and decrypt module', () => { | ||
| const dummyPlainText = 'dummy'; | ||
| const dummyNumArray1 = [...randomBytes(32)]; | ||
| const dummyNumArray2 = [...randomBytes(32)]; | ||
|
|
||
| describe('Positive test cases', () => { | ||
| test('Encrypt and Decrypt with same in memory keyring', async () => { | ||
| const cryptographyClient = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| const encrypted = await cryptographyClient.encryptAndEncode(dummyPlainText); | ||
| const outputText = await cryptographyClient.decodeAndDecrypt(encrypted); | ||
| expect(outputText).toBe(dummyPlainText); | ||
| }); | ||
| test('Encrypt and Decrypt with two different keyrings with exact same identifiers', async () => { | ||
| const cryptographyClient1 = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| const encrypted = await cryptographyClient1.encryptAndEncode(dummyPlainText); | ||
|
|
||
| const cryptographyClient2 = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| const outputText = await cryptographyClient2.decodeAndDecrypt(encrypted); | ||
| expect(cryptographyClient1 === cryptographyClient2).toBeFalsy(); | ||
| expect(outputText).toBe(dummyPlainText); | ||
| }); | ||
| }); | ||
|
|
||
| describe('Negative test cases', () => { | ||
| const defaultWrappingKeyName = 'changeme'; | ||
| const defaultWrappingKeyNamespace = 'changeme'; | ||
| const expectedErrorMsg = 'unencryptedDataKey has not been set'; | ||
| test('Encrypt and Decrypt with different key names', async () => { | ||
| const cryptographyClient1 = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| const encrypted = await cryptographyClient1.encryptAndEncode(dummyPlainText); | ||
|
|
||
| const cryptographyClient2 = new CryptographyClient( | ||
| defaultWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| try { | ||
| await cryptographyClient2.decodeAndDecrypt(encrypted); | ||
| } catch (error) { | ||
| expect(error.message).toMatch(expectedErrorMsg); | ||
| } | ||
| }); | ||
| test('Encrypt and Decrypt with different key namespaces', async () => { | ||
| const cryptographyClient1 = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| const encrypted = await cryptographyClient1.encryptAndEncode(dummyPlainText); | ||
|
|
||
| const cryptographyClient2 = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| defaultWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| try { | ||
| await cryptographyClient2.decodeAndDecrypt(encrypted); | ||
| } catch (error) { | ||
| expect(error.message).toMatch(expectedErrorMsg); | ||
| } | ||
| }); | ||
| test('Encrypt and Decrypt with different wrapping keys', async () => { | ||
| const cryptographyClient1 = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray1 | ||
| ); | ||
| const encrypted = await cryptographyClient1.encryptAndEncode(dummyPlainText); | ||
|
|
||
| const cryptographyClient2 = new CryptographyClient( | ||
| dummyWrappingKeyName, | ||
| dummyWrappingKeyNamespace, | ||
| dummyNumArray2 | ||
| ); | ||
| try { | ||
| await cryptographyClient2.decodeAndDecrypt(encrypted); | ||
| } catch (error) { | ||
| expect(error.message).toMatch(expectedErrorMsg); | ||
| } | ||
| }); | ||
| }); | ||
| }); |
Oops, something went wrong.