Skip to content

Commit 798214b

Browse files
author
Shubham Chaturvedi
committed
fix: PR comments
2 parents a21c0b3 + 9c0547b commit 798214b

29 files changed

Lines changed: 44843 additions & 31 deletions

File tree

.github/workflows/library_go_tests.yml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,13 @@ jobs:
1919
strategy:
2020
fail-fast: false
2121
matrix:
22-
library: [StandardLibrary, AwsCryptographyPrimitives]
22+
library:
23+
[
24+
StandardLibrary,
25+
ComAmazonawsKms,
26+
ComAmazonawsDynamodb,
27+
AwsCryptographyPrimitives,
28+
]
2329
go-version: ["1.23"]
2430
os: [
2531
# TODO fix Dafny-generated tests on Windows;

AwsCryptographicMaterialProviders/dafny/AwsCryptographicMaterialProviders/Model/structures.smithy

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,5 +150,4 @@ map EncryptionContext {
150150
value: Utf8Bytes,
151151
}
152152

153-
@sensitive
154153
blob Secret

AwsCryptographicMaterialProviders/dafny/AwsCryptographyKeyStore/Model/KeyStore.smithy

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -364,7 +364,6 @@ map HmacKeyMap {
364364
value: Secret
365365
}
366366

367-
@sensitive
368367
blob Secret
369368

370369
map EncryptionContext {

AwsCryptographicMaterialProviders/runtimes/net/tests/LocalCMC.Tests/LocalCMCTests.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@ private static void WorkForThread(object? state)
7575
BeaconKey = new BeaconKeyMaterials
7676
{
7777
BeaconKeyIdentifier = beaconKeyIdentifier,
78+
// The cacheIdentifier is used as the material
79+
// because we are not testing the cryptography here.
7880
BeaconKey = cacheIdentifier,
7981
EncryptionContext = new Dictionary<string, string>()
8082
}

AwsCryptographicMaterialProviders/runtimes/rust/Cargo.toml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ readme = "README.md"
1515
[dependencies]
1616
aws-config = "1.5.8"
1717
aws-lc-rs = "1.10.0"
18-
aws-lc-sys = "0.22.0"
18+
aws-lc-sys = "0.23.1"
1919
aws-sdk-dynamodb = "1.50.0"
2020
aws-sdk-kms = "1.47.0"
2121
aws-smithy-runtime-api = {version = "1.7.2", features = ["client"] }
@@ -27,3 +27,6 @@ dashmap = "6.1.0"
2727
pem = "3.0.4"
2828
tokio = {version = "1.41.0", features = ["full"] }
2929
uuid = { version = "1.11.0", features = ["v4"] }
30+
timeout = "0.1.0"
31+
rand = "0.8.5"
32+
futures = "0.3"
Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
#![deny(warnings, unconditional_panic)]
5+
#![deny(nonstandard_style)]
6+
#![deny(clippy::all)]
7+
8+
pub struct BoxError(String);
9+
pub struct BoxError2(String);
10+
11+
impl std::fmt::Debug for BoxError2 {
12+
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
13+
write!(f, "{}", self.0)
14+
}
15+
}
16+
17+
impl From<BoxError> for BoxError2 {
18+
fn from(error: BoxError) -> Self {
19+
BoxError2(error.0)
20+
}
21+
}
22+
23+
impl<T: std::fmt::Debug> From<T> for BoxError {
24+
fn from(error: T) -> Self {
25+
let my_str = format!("{:?}", error);
26+
BoxError(my_str)
27+
}
28+
}
29+
30+
pub mod local_cmc_tests {
31+
use aws_mpl_rs::types::material_providers_config::MaterialProvidersConfig;
32+
use aws_mpl_rs::client as mpl_client;
33+
use aws_mpl_rs::types::CacheType;
34+
use aws_mpl_rs::types::DefaultCache;
35+
use aws_mpl_rs::types::cryptographic_materials_cache::CryptographicMaterialsCacheRef;
36+
use aws_mpl_rs::operation::get_cache_entry::GetCacheEntryOutput;
37+
use aws_mpl_rs::types::error::Error;
38+
use aws_mpl_rs::types::Materials;
39+
use aws_mpl_rs::deps::aws_cryptography_keyStore::types::BeaconKeyMaterials;
40+
use std::collections::HashMap;
41+
use chrono::Utc;
42+
use rand::{thread_rng, Rng};
43+
use futures::stream::StreamExt;
44+
// Currently this is commented out to keep it consistent with other
45+
// runtimes but every language should eventually have a network
46+
// call delay while testing adding to the StormTrackingCache.
47+
// use std::time::Duration;
48+
49+
async fn work_for_thread() -> Result<(), crate::BoxError> {
50+
let mpl_config: MaterialProvidersConfig = MaterialProvidersConfig::builder().build()?;
51+
let mpl: mpl_client::Client = mpl_client::Client::from_conf(mpl_config)?;
52+
53+
let test: CryptographicMaterialsCacheRef = mpl.create_cryptographic_materials_cache()
54+
.cache(CacheType::Default(
55+
DefaultCache::builder()
56+
.entry_capacity(10)
57+
.build()?))
58+
.send()
59+
.await?;
60+
61+
let identifiers: Vec<&str> = vec![
62+
"one",
63+
"two",
64+
"three",
65+
"four",
66+
"five",
67+
"six",
68+
"seven",
69+
"eight",
70+
"nine",
71+
"ten",
72+
"eleven",
73+
"twelve",
74+
"thirteen",
75+
"fourteen",
76+
"fifteen",
77+
"sixteen",
78+
"seventeen",
79+
"eighteen",
80+
"nineteen",
81+
"twenty",
82+
"twenty one"
83+
];
84+
85+
let id_size: usize = identifiers.len();
86+
87+
let invocations = 300000;
88+
let concurrent_tasks = 10;
89+
90+
futures::stream::iter(0..invocations)
91+
.map(|_i| {
92+
let identifiers = identifiers.clone();
93+
let test = test.clone();
94+
95+
async move {
96+
println!("-----------TestLotsofAdd-----------");
97+
let random = thread_rng().gen_range(0..id_size);
98+
let beacon_key_identifier: &str = identifiers[random];
99+
100+
let cache_identifier: aws_smithy_types::Blob = aws_smithy_types::Blob::new(beacon_key_identifier.as_bytes());
101+
102+
let cache_entry_output: Result<GetCacheEntryOutput, Error> = test.get_cache_entry()
103+
.identifier(cache_identifier.clone())
104+
.send()
105+
.await;
106+
107+
match cache_entry_output {
108+
Ok(_) => {
109+
println!("Cache hit for beacon key identifier: {}", beacon_key_identifier);
110+
}
111+
Err(Error::EntryDoesNotExist {message: _m}) => {
112+
let materials = Materials::BeaconKey(
113+
BeaconKeyMaterials::builder()
114+
.beacon_key_identifier(beacon_key_identifier.to_string())
115+
// The cacheIdentifier is used as the material
116+
// because we are not testing the cryptography here.
117+
.beacon_key(cache_identifier.clone())
118+
.encryption_context(HashMap::new())
119+
.build()?
120+
);
121+
// This sleep time is to mimic a KMS or DDB call
122+
// Currently this is commented out to keep it consistent with other
123+
// runtimes but every language should eventually have a network
124+
// call delay while testing adding to the StormTrackingCache.
125+
// The reason why this is commented out and not just set to 0 is because
126+
// setting it to 0 adds a significant overhead of task switching, and
127+
// with that, testing for 300_000 instances will not be possible.
128+
// let network_call_delay: u64 = 50;
129+
// tokio::time::sleep(Duration::from_millis(network_call_delay)).await;
130+
131+
test.put_cache_entry()
132+
.identifier(cache_identifier)
133+
.creation_time(Utc::now().timestamp())
134+
.expiry_time(Utc::now().timestamp() + 1)
135+
.materials(materials)
136+
.send()
137+
.await?;
138+
139+
println!("Cache miss for beacon key identifier: {}", beacon_key_identifier);
140+
}
141+
Err(e) => {
142+
panic!("Unexpected error while accessing cache: {}", e);
143+
}
144+
145+
}
146+
147+
Ok::<(), crate::BoxError>(())
148+
}
149+
})
150+
.buffer_unordered(concurrent_tasks)
151+
.collect::<Vec<_>>()
152+
.await;
153+
154+
Ok(())
155+
}
156+
157+
#[tokio::test(flavor = "multi_thread")]
158+
async fn test_a_lot_of_adding() -> Result<(), crate::BoxError2> {
159+
work_for_thread().await?;
160+
Ok(())
161+
}
162+
}

AwsCryptographyPrimitives/runtimes/go/ImplementationFromDafny-go/AESEncryption/externs.go

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -83,20 +83,17 @@ func (CompanionStruct_Default___) AESEncryptExtern(algo AwsCryptographyPrimitive
8383
dafny.SeqOfChars([]dafny.Char(err.Error())...)))
8484
}
8585

86-
if algo.Is_AES__GCM() {
87-
gcm, err := cipher.NewGCM(block)
88-
if err != nil {
89-
return Wrappers.Companion_Result_.Create_Failure_(AwsCryptographyPrimitivesTypes.Companion_Error_.Create_AwsCryptographicPrimitivesError_(
90-
dafny.SeqOfChars([]dafny.Char(err.Error())...)))
91-
}
92-
93-
cipherText := gcm.Seal(nil, ivBytes, dafny.ToByteArray(msg), aadBytes)
94-
if cipherText == nil {
95-
return Wrappers.Companion_Result_.Create_Failure_(AwsCryptographyPrimitivesTypes.Companion_Error_.Create_AwsCryptographicPrimitivesError_(
96-
dafny.SeqOfChars([]dafny.Char(fmt.Errorf("failed to do AES_GCM Encrypt with the given parameters").Error())...)))
97-
}
98-
return Wrappers.Companion_Result_.Create_Success_(AwsCryptographyPrimitivesTypes.Companion_AESEncryptOutput_.Create_AESEncryptOutput_(
99-
dafny.SeqOfBytes(cipherText[:len(cipherText)-gcm.Overhead()]), dafny.SeqOfBytes(cipherText[len(cipherText)-gcm.Overhead():])))
86+
gcm, err := cipher.NewGCM(block)
87+
if err != nil {
88+
return Wrappers.Companion_Result_.Create_Failure_(AwsCryptographyPrimitivesTypes.Companion_Error_.Create_AwsCryptographicPrimitivesError_(
89+
dafny.SeqOfChars([]dafny.Char(err.Error())...)))
90+
}
91+
92+
cipherText := gcm.Seal(nil, ivBytes, dafny.ToByteArray(msg), aadBytes)
93+
if cipherText == nil {
94+
return Wrappers.Companion_Result_.Create_Failure_(AwsCryptographyPrimitivesTypes.Companion_Error_.Create_AwsCryptographicPrimitivesError_(
95+
dafny.SeqOfChars([]dafny.Char(fmt.Errorf("failed to do AES_GCM Encrypt with the given parameters").Error())...)))
10096
}
101-
return Wrappers.Companion_Result_.Create_Failure_(false)
97+
return Wrappers.Companion_Result_.Create_Success_(AwsCryptographyPrimitivesTypes.Companion_AESEncryptOutput_.Create_AESEncryptOutput_(
98+
dafny.SeqOfBytes(cipherText[:len(cipherText)-gcm.Overhead()]), dafny.SeqOfBytes(cipherText[len(cipherText)-gcm.Overhead():])))
10299
}

AwsCryptographyPrimitives/runtimes/go/ImplementationFromDafny-go/ExternDigest/externs.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ import (
1111
)
1212

1313
func Digest(algorithm AwsCryptographyPrimitivesTypes.DigestAlgorithm, message dafny.Sequence) Wrappers.Result {
14-
hash, _ := getNativeEcdhCurve(algorithm)
14+
hash, _ := getNativeDigestAlgorithm(algorithm)
1515
hash.Write(dafny.ToByteArray(message))
1616
return Wrappers.Companion_Result_.Create_Success_(dafny.SeqOfBytes(hash.Sum(nil)))
1717
}
1818

19-
func getNativeEcdhCurve(algorithm AwsCryptographyPrimitivesTypes.DigestAlgorithm) (hash.Hash, error) {
19+
func getNativeDigestAlgorithm(algorithm AwsCryptographyPrimitivesTypes.DigestAlgorithm) (hash.Hash, error) {
2020
switch algorithm {
2121
case AwsCryptographyPrimitivesTypes.Companion_DigestAlgorithm_.Create_SHA__256_():
2222
return crypto.SHA256.New(), nil

AwsCryptographyPrimitives/runtimes/go/ImplementationFromDafny-go/HMAC/externs.go

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,6 @@ func (hMac *HMac) BlockUpdate(message dafny.Sequence) {
4141
}
4242
}
4343

44-
func (hMac *HMac) String() string {
45-
return ""
46-
}
4744
func (hMac *HMac) GetResult() dafny.Sequence {
4845
res := hMac.hash.Sum(nil)
4946
// reset the hash for future use. or maybe reinit it like rust?

AwsCryptographyPrimitives/runtimes/python/src/aws_cryptography_primitives/internaldafny/extern/Signature.py

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
decode_dss_signature,
2222
encode_dss_signature
2323
)
24+
from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
2425

2526
from collections import namedtuple
2627
import _dafny
@@ -48,7 +49,7 @@ def ExternKeyGen(signature_algorithm):
4849
return Wrappers.Result_Failure(maybe_signature_algorithm.error)
4950

5051
private_key = ec.generate_private_key(
51-
maybe_signature_algorithm.value.value.curve
52+
maybe_signature_algorithm.value.value.curve()
5253
)
5354

5455
private_key_pem_bytes = private_key.private_bytes(Encoding.PEM, PrivateFormat.PKCS8, NoEncryption())
@@ -101,9 +102,9 @@ def Verify(signature_algorithm, verification_key, message, signature):
101102

102103
message_digest_algorithm = maybe_signature_algorithm.value.value.message_digest_algorithm
103104
if message_digest_algorithm.is_SHA__256:
104-
sign_algo = ec.ECDSA(hashes.SHA256())
105+
sign_algo = ec.ECDSA(Prehashed(hashes.SHA256()))
105106
elif message_digest_algorithm.is_SHA__384:
106-
sign_algo = ec.ECDSA(hashes.SHA384())
107+
sign_algo = ec.ECDSA(Prehashed(hashes.SHA384()))
107108
else:
108109
return Wrappers.Result_Failure(Error_AwsCryptographicPrimitivesError(
109110
message=f"Requested Digest Algorithm is not supported. Requested {message_digest_algorithm}"
@@ -242,9 +243,9 @@ def _ecc_static_length_signature(key, algorithm, digest):
242243
:rtype: bytes
243244
"""
244245
if algorithm.message_digest_algorithm.is_SHA__256:
245-
sign_algo = ec.ECDSA(hashes.SHA256())
246+
sign_algo = ec.ECDSA(Prehashed(hashes.SHA256()))
246247
elif algorithm.message_digest_algorithm.is_SHA__384:
247-
sign_algo = ec.ECDSA(hashes.SHA384())
248+
sign_algo = ec.ECDSA(Prehashed(hashes.SHA384()))
248249
pre_hashed_algorithm = sign_algo
249250
signature = b""
250251
while len(signature) != algorithm.expected_signature_length:

0 commit comments

Comments
 (0)