acelyc111 commented on code in PR #1706: URL: https://github.com/apache/incubator-pegasus/pull/1706#discussion_r1441415662
########## src/runtime/security/kms_client.cpp: ########## @@ -0,0 +1,204 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +#include <initializer_list> +#include <map> +#include <stdexcept> +#include <string> +#include <vector> + +#include "absl/strings/escaping.h" +#include "fmt/core.h" +#include "http/http_client.h" +#include "http/http_method.h" +#include "http/http_status_code.h" +#include "nlohmann/json.hpp" +#include "nlohmann/json_fwd.hpp" +#include "runtime/security/kms_client.h" +#include "runtime/security/replica_kms_info.h" +#include "utils/error_code.h" +#include "utils/fmt_logging.h" + +namespace dsn { +namespace security { + +dsn::error_s KMSClient::DecryptEncryptionKey(const dsn::replication::replica_kms_info &kms_info, + std::string *decrypted_key) +{ + nlohmann::json payload; + payload["name"] = cluster_key_name_; + std::string iv_plain = ::absl::HexStringToBytes(kms_info.iv); + std::string iv_b64; + ::absl::WebSafeBase64Escape(iv_plain, &iv_b64); + payload["iv"] = iv_b64; + std::string eek_plain = ::absl::HexStringToBytes(kms_info.eek); + std::string eek_b64; + ::absl::WebSafeBase64Escape(eek_plain, &eek_b64); + payload["material"] = eek_b64; + + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } Review Comment: You can use the macro RETURN_NOT_OK to simplify code. Other places are the same. ########## src/runtime/security/kms_client.cpp: ########## @@ -0,0 +1,204 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +#include <initializer_list> +#include <map> +#include <stdexcept> +#include <string> +#include <vector> + +#include "absl/strings/escaping.h" +#include "fmt/core.h" +#include "http/http_client.h" +#include "http/http_method.h" +#include "http/http_status_code.h" +#include "nlohmann/json.hpp" +#include "nlohmann/json_fwd.hpp" +#include "runtime/security/kms_client.h" +#include "runtime/security/replica_kms_info.h" +#include "utils/error_code.h" +#include "utils/fmt_logging.h" + +namespace dsn { +namespace security { + +dsn::error_s KMSClient::DecryptEncryptionKey(const dsn::replication::replica_kms_info &kms_info, + std::string *decrypted_key) +{ + nlohmann::json payload; + payload["name"] = cluster_key_name_; + std::string iv_plain = ::absl::HexStringToBytes(kms_info.iv); + std::string iv_b64; + ::absl::WebSafeBase64Escape(iv_plain, &iv_b64); + payload["iv"] = iv_b64; + std::string eek_plain = ::absl::HexStringToBytes(kms_info.eek); + std::string eek_b64; + ::absl::WebSafeBase64Escape(eek_plain, &eek_b64); + payload["material"] = eek_b64; + + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back(fmt::format("{}/v1/keyversion/{}/_eek?eek_op=decrypt", url, kms_info.kv)); + } + + client.clear_header_fields(); + client.set_content_type("application/json"); + client.set_accept("*/*"); + err = client.with_post_method(payload.dump()); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set method failed"); + } + + nlohmann::json j; + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http clientt set url failed"); + } + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec post method failed"); Review Comment: In the case of one of the KMS servers down, exec_method will return error, so it should contine to try on the next KMS server. In Kudu, it continue in the case of ``` if (s.IsNetworkError() || s.IsTimedOut()) { continue; } ``` ########## src/runtime/security/kms_client.cpp: ########## @@ -0,0 +1,204 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +#include <initializer_list> +#include <map> +#include <stdexcept> +#include <string> +#include <vector> + +#include "absl/strings/escaping.h" +#include "fmt/core.h" +#include "http/http_client.h" +#include "http/http_method.h" +#include "http/http_status_code.h" +#include "nlohmann/json.hpp" +#include "nlohmann/json_fwd.hpp" +#include "runtime/security/kms_client.h" +#include "runtime/security/replica_kms_info.h" +#include "utils/error_code.h" +#include "utils/fmt_logging.h" + +namespace dsn { +namespace security { + +dsn::error_s KMSClient::DecryptEncryptionKey(const dsn::replication::replica_kms_info &kms_info, + std::string *decrypted_key) +{ + nlohmann::json payload; + payload["name"] = cluster_key_name_; + std::string iv_plain = ::absl::HexStringToBytes(kms_info.iv); + std::string iv_b64; + ::absl::WebSafeBase64Escape(iv_plain, &iv_b64); + payload["iv"] = iv_b64; + std::string eek_plain = ::absl::HexStringToBytes(kms_info.eek); + std::string eek_b64; + ::absl::WebSafeBase64Escape(eek_plain, &eek_b64); + payload["material"] = eek_b64; + + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back(fmt::format("{}/v1/keyversion/{}/_eek?eek_op=decrypt", url, kms_info.kv)); + } + + client.clear_header_fields(); + client.set_content_type("application/json"); + client.set_accept("*/*"); + err = client.with_post_method(payload.dump()); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set method failed"); + } + + nlohmann::json j; + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http clientt set url failed"); + } + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec post method failed"); + } + http_status_code http_status; + client.get_http_status(http_status); + if (http_status == http_status_code::kOk) { + j = nlohmann::json::parse(resp); + break; + } + + LOG_WARNING("The http status is ({}), and url is ({})", + get_http_status_message(http_status), + url); + } + + std::string dek_b64; + if (j.contains("material")) { + dek_b64 = j.at("material"); + } else { + return dsn::error_s::make(ERR_INVALID_DATA, "Null material received"); + } + std::string dek_plain; + if (!::absl::WebSafeBase64Unescape(dek_b64, &dek_plain)) { + return dsn::error_s::make(ERR_INVALID_DATA, "Invalid IV received"); + } + *decrypted_key = ::absl::BytesToHexString(dek_plain); + return dsn::error_s::ok(); +} + +dsn::error_s KMSClient::GenerateEncryptionKeyFromKMS(const std::string &key_name, + dsn::replication::replica_kms_info *kms_info) +{ + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back( + fmt::format("{}/v1/key/{}/_eek?eek_op=generate&num_keys=1", url, key_name)); + } + + nlohmann::json j = nlohmann::json::object(); + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set url failed"); + } + + err = client.with_get_method(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set get method failed"); + } + + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec get method failed"); + } + + http_status_code http_status; + client.get_http_status(http_status); + if (http_status == http_status_code::kOk) { + j = nlohmann::json::parse(resp); + nlohmann::json jsonObject = j.at(0); + std::string res = jsonObject.dump(); + j = nlohmann::json::parse(res); Review Comment: Is the second dump() and parse() necessary, is it possible to access the data from `j` in line 155 directly? ########## src/runtime/security/kms_client.cpp: ########## @@ -0,0 +1,204 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +#include <initializer_list> +#include <map> +#include <stdexcept> +#include <string> +#include <vector> + +#include "absl/strings/escaping.h" +#include "fmt/core.h" +#include "http/http_client.h" +#include "http/http_method.h" +#include "http/http_status_code.h" +#include "nlohmann/json.hpp" +#include "nlohmann/json_fwd.hpp" +#include "runtime/security/kms_client.h" +#include "runtime/security/replica_kms_info.h" +#include "utils/error_code.h" +#include "utils/fmt_logging.h" + +namespace dsn { +namespace security { + +dsn::error_s KMSClient::DecryptEncryptionKey(const dsn::replication::replica_kms_info &kms_info, + std::string *decrypted_key) +{ + nlohmann::json payload; + payload["name"] = cluster_key_name_; + std::string iv_plain = ::absl::HexStringToBytes(kms_info.iv); + std::string iv_b64; + ::absl::WebSafeBase64Escape(iv_plain, &iv_b64); + payload["iv"] = iv_b64; + std::string eek_plain = ::absl::HexStringToBytes(kms_info.eek); + std::string eek_b64; + ::absl::WebSafeBase64Escape(eek_plain, &eek_b64); + payload["material"] = eek_b64; + + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back(fmt::format("{}/v1/keyversion/{}/_eek?eek_op=decrypt", url, kms_info.kv)); + } + + client.clear_header_fields(); + client.set_content_type("application/json"); + client.set_accept("*/*"); + err = client.with_post_method(payload.dump()); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set method failed"); + } + + nlohmann::json j; + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http clientt set url failed"); + } + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec post method failed"); + } + http_status_code http_status; + client.get_http_status(http_status); + if (http_status == http_status_code::kOk) { + j = nlohmann::json::parse(resp); + break; + } + + LOG_WARNING("The http status is ({}), and url is ({})", + get_http_status_message(http_status), + url); + } + + std::string dek_b64; + if (j.contains("material")) { + dek_b64 = j.at("material"); + } else { + return dsn::error_s::make(ERR_INVALID_DATA, "Null material received"); + } + std::string dek_plain; + if (!::absl::WebSafeBase64Unescape(dek_b64, &dek_plain)) { + return dsn::error_s::make(ERR_INVALID_DATA, "Invalid IV received"); + } + *decrypted_key = ::absl::BytesToHexString(dek_plain); + return dsn::error_s::ok(); +} + +dsn::error_s KMSClient::GenerateEncryptionKeyFromKMS(const std::string &key_name, + dsn::replication::replica_kms_info *kms_info) +{ + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back( + fmt::format("{}/v1/key/{}/_eek?eek_op=generate&num_keys=1", url, key_name)); + } + + nlohmann::json j = nlohmann::json::object(); + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set url failed"); + } + + err = client.with_get_method(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set get method failed"); + } + + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec get method failed"); + } + + http_status_code http_status; + client.get_http_status(http_status); + if (http_status == http_status_code::kOk) { + j = nlohmann::json::parse(resp); Review Comment: nlohmann::json::parse may throw exception if the data is not JSON format, it's necessary to catch the exception. ########## src/runtime/security/kms_client.cpp: ########## @@ -0,0 +1,204 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +#include <initializer_list> +#include <map> +#include <stdexcept> +#include <string> +#include <vector> + +#include "absl/strings/escaping.h" +#include "fmt/core.h" +#include "http/http_client.h" +#include "http/http_method.h" +#include "http/http_status_code.h" +#include "nlohmann/json.hpp" +#include "nlohmann/json_fwd.hpp" +#include "runtime/security/kms_client.h" +#include "runtime/security/replica_kms_info.h" +#include "utils/error_code.h" +#include "utils/fmt_logging.h" + +namespace dsn { +namespace security { + +dsn::error_s KMSClient::DecryptEncryptionKey(const dsn::replication::replica_kms_info &kms_info, + std::string *decrypted_key) +{ + nlohmann::json payload; + payload["name"] = cluster_key_name_; + std::string iv_plain = ::absl::HexStringToBytes(kms_info.iv); + std::string iv_b64; + ::absl::WebSafeBase64Escape(iv_plain, &iv_b64); + payload["iv"] = iv_b64; + std::string eek_plain = ::absl::HexStringToBytes(kms_info.eek); + std::string eek_b64; + ::absl::WebSafeBase64Escape(eek_plain, &eek_b64); + payload["material"] = eek_b64; + + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back(fmt::format("{}/v1/keyversion/{}/_eek?eek_op=decrypt", url, kms_info.kv)); + } + + client.clear_header_fields(); + client.set_content_type("application/json"); + client.set_accept("*/*"); + err = client.with_post_method(payload.dump()); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set method failed"); + } + + nlohmann::json j; + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http clientt set url failed"); + } + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec post method failed"); + } + http_status_code http_status; + client.get_http_status(http_status); + if (http_status == http_status_code::kOk) { + j = nlohmann::json::parse(resp); + break; + } + + LOG_WARNING("The http status is ({}), and url is ({})", + get_http_status_message(http_status), + url); + } + + std::string dek_b64; + if (j.contains("material")) { + dek_b64 = j.at("material"); + } else { + return dsn::error_s::make(ERR_INVALID_DATA, "Null material received"); + } + std::string dek_plain; + if (!::absl::WebSafeBase64Unescape(dek_b64, &dek_plain)) { + return dsn::error_s::make(ERR_INVALID_DATA, "Invalid IV received"); + } + *decrypted_key = ::absl::BytesToHexString(dek_plain); + return dsn::error_s::ok(); +} + +dsn::error_s KMSClient::GenerateEncryptionKeyFromKMS(const std::string &key_name, + dsn::replication::replica_kms_info *kms_info) +{ + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back( + fmt::format("{}/v1/key/{}/_eek?eek_op=generate&num_keys=1", url, key_name)); + } + + nlohmann::json j = nlohmann::json::object(); + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set url failed"); + } + + err = client.with_get_method(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set get method failed"); + } + + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { Review Comment: Same, retry is needed. ########## src/runtime/security/kms_client.cpp: ########## @@ -0,0 +1,204 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +#include <initializer_list> +#include <map> +#include <stdexcept> +#include <string> +#include <vector> + +#include "absl/strings/escaping.h" +#include "fmt/core.h" +#include "http/http_client.h" +#include "http/http_method.h" +#include "http/http_status_code.h" +#include "nlohmann/json.hpp" +#include "nlohmann/json_fwd.hpp" +#include "runtime/security/kms_client.h" +#include "runtime/security/replica_kms_info.h" +#include "utils/error_code.h" +#include "utils/fmt_logging.h" + +namespace dsn { +namespace security { + +dsn::error_s KMSClient::DecryptEncryptionKey(const dsn::replication::replica_kms_info &kms_info, + std::string *decrypted_key) +{ + nlohmann::json payload; + payload["name"] = cluster_key_name_; + std::string iv_plain = ::absl::HexStringToBytes(kms_info.iv); + std::string iv_b64; + ::absl::WebSafeBase64Escape(iv_plain, &iv_b64); + payload["iv"] = iv_b64; + std::string eek_plain = ::absl::HexStringToBytes(kms_info.eek); + std::string eek_b64; + ::absl::WebSafeBase64Escape(eek_plain, &eek_b64); + payload["material"] = eek_b64; + + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back(fmt::format("{}/v1/keyversion/{}/_eek?eek_op=decrypt", url, kms_info.kv)); + } + + client.clear_header_fields(); + client.set_content_type("application/json"); + client.set_accept("*/*"); + err = client.with_post_method(payload.dump()); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set method failed"); + } + + nlohmann::json j; + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http clientt set url failed"); + } + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec post method failed"); + } + http_status_code http_status; + client.get_http_status(http_status); + if (http_status == http_status_code::kOk) { + j = nlohmann::json::parse(resp); + break; + } + + LOG_WARNING("The http status is ({}), and url is ({})", + get_http_status_message(http_status), + url); + } + + std::string dek_b64; + if (j.contains("material")) { + dek_b64 = j.at("material"); + } else { + return dsn::error_s::make(ERR_INVALID_DATA, "Null material received"); + } + std::string dek_plain; + if (!::absl::WebSafeBase64Unescape(dek_b64, &dek_plain)) { + return dsn::error_s::make(ERR_INVALID_DATA, "Invalid IV received"); + } + *decrypted_key = ::absl::BytesToHexString(dek_plain); + return dsn::error_s::ok(); +} + +dsn::error_s KMSClient::GenerateEncryptionKeyFromKMS(const std::string &key_name, + dsn::replication::replica_kms_info *kms_info) +{ + http_client client; + auto err = client.init(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "Start http client failed"); + } + err = client.set_auth(http_auth_type::SPNEGO); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set auth type failed"); + } + std::vector<std::string> urls; + urls.reserve(kms_urls_.size()); + for (const auto &url : kms_urls_) { + urls.emplace_back( + fmt::format("{}/v1/key/{}/_eek?eek_op=generate&num_keys=1", url, key_name)); + } + + nlohmann::json j = nlohmann::json::object(); + for (const auto &url : urls) { + err = client.set_url(url); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set url failed"); + } + + err = client.with_get_method(); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client set get method failed"); + } + + std::string resp; + err = client.exec_method(&resp); + if (!err.is_ok()) { + return dsn::error_s::make(ERR_CURL_FAILED, "http client exec get method failed"); + } + + http_status_code http_status; + client.get_http_status(http_status); + if (http_status == http_status_code::kOk) { + j = nlohmann::json::parse(resp); + nlohmann::json jsonObject = j.at(0); + std::string res = jsonObject.dump(); + j = nlohmann::json::parse(res); + break; + } + + LOG_WARNING("The http status is ({}), and url is ({})", + get_http_status_message(http_status), + url); + } + + if (j.contains("versionName")) { Review Comment: Add a new macro to simplify the code: ``` #define RETURN_ERRS_NOT_TRUE(exp, code, ...) \ do { \ if (dsn_unlikely(!exp)) { \ return dsn::error_s::make(code, fmt::format(__VA_ARGS__)); \ } \ } while (false); ``` You can do it in another independent patch. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
