-
-
Notifications
You must be signed in to change notification settings - Fork 4
/
aes.go
233 lines (196 loc) · 5.62 KB
/
aes.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
package encrypt
import (
"crypto/aes"
"crypto/cipher"
"crypto/rand"
"io"
"os"
"strings"
"github.com/Laisky/errors"
"github.com/Laisky/zap"
"golang.org/x/sync/errgroup"
gutils "github.com/Laisky/go-utils/v3"
"github.com/Laisky/go-utils/v3/log"
)
// AesEncrypt encrypt bytes by AES GCM
//
// inspired by https://tutorialedge.net/golang/go-encrypt-decrypt-aes-tutorial/
//
// The key argument should be the AES key,
// either 16, 24, or 32 bytes to select
// AES-128, AES-192, or AES-256.
func AesEncrypt(secret []byte, cnt []byte) ([]byte, error) {
if len(cnt) == 0 {
return nil, errors.Errorf("content is empty")
}
// generate a new aes cipher
c, err := aes.NewCipher(secret)
if err != nil {
return nil, errors.Wrap(err, "new aes cipher")
}
// gcm or Galois/Counter Mode, is a mode of operation
// for symmetric key cryptographic block ciphers
// * https://en.wikipedia.org/wiki/Galois/Counter_Mode
gcm, err := cipher.NewGCM(c)
if err != nil {
return nil, errors.Wrap(err, "new gcm")
}
// creates a new byte array the size of the nonce
// which must be passed to Seal
nonce := make([]byte, gcm.NonceSize())
// populates our nonce with a cryptographically secure
// random sequence
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
return nil, errors.Wrap(err, "load nonce")
}
// here we encrypt our text using the Seal function
// Seal encrypts and authenticates plaintext, authenticates the
// additional data and appends the result to dst, returning the updated
// slice. The nonce must be NonceSize() bytes long and unique for all
// time, for a given key.
return gcm.Seal(nonce, nonce, cnt, nil), nil
}
// AesDecrypt encrypt bytes by AES GCM
//
// inspired by https://tutorialedge.net/golang/go-encrypt-decrypt-aes-tutorial/
//
// The key argument should be 16, 24, or 32 bytes
func AesDecrypt(secret []byte, encrypted []byte) ([]byte, error) {
if len(encrypted) == 0 {
return nil, errors.Errorf("encrypted is empty")
}
// generate a new aes cipher
c, err := aes.NewCipher(secret)
if err != nil {
return nil, errors.Wrap(err, "new aes cipher")
}
// gcm or Galois/Counter Mode, is a mode of operation
// for symmetric key cryptographic block ciphers
// * https://en.wikipedia.org/wiki/Galois/Counter_Mode
gcm, err := cipher.NewGCM(c)
if err != nil {
return nil, errors.Wrap(err, "new gcm")
}
nonceSize := gcm.NonceSize()
if len(encrypted) < nonceSize {
return nil, errors.Errorf("encrypted too short")
}
nonce, encrypted := encrypted[:nonceSize], encrypted[nonceSize:]
plaintext, err := gcm.Open(nil, nonce, encrypted, nil)
if err != nil {
return nil, errors.Wrap(err, "gcm decrypt")
}
return plaintext, nil
}
// AesReaderWrapper used to decrypt encrypted reader
type AesReaderWrapper struct {
cnt []byte
idx int
}
// NewAesReaderWrapper wrap reader by aes
func NewAesReaderWrapper(in io.Reader, key []byte) (*AesReaderWrapper, error) {
cipher, err := io.ReadAll(in)
if err != nil {
return nil, errors.Wrap(err, "read reader")
}
w := new(AesReaderWrapper)
if w.cnt, err = AesDecrypt(key, cipher); err != nil {
return nil, errors.Wrap(err, "decrypt")
}
return w, nil
}
func (w *AesReaderWrapper) Read(p []byte) (n int, err error) {
if w.idx == len(w.cnt) {
return 0, io.EOF
}
for n = range p {
p[n] = w.cnt[w.idx]
w.idx++
if w.idx == len(w.cnt) {
break
}
}
return n + 1, nil
}
const (
defaultEncryptSuffix = ".enc"
)
type encryptFilesOption struct {
ext string
// suffix will append in encrypted file'name after ext as suffix
suffix string
}
func (o *encryptFilesOption) fillDefault() {
// o.ext = ".toml"
o.suffix = defaultEncryptSuffix
}
// AESEncryptFilesInDirOption options to encrypt files in dir
type AESEncryptFilesInDirOption func(*encryptFilesOption) error
// WithAESFilesInDirFileExt only encrypt files with specific ext
func WithAESFilesInDirFileExt(ext string) AESEncryptFilesInDirOption {
return func(opt *encryptFilesOption) error {
if !strings.HasPrefix(ext, ".") {
return errors.Errorf("ext should start with `.`")
}
opt.ext = ext
return nil
}
}
// WithAESFilesInDirFileSuffix will append to encrypted's filename as suffix
//
// xxx.toml -> xxx.toml.enc
func WithAESFilesInDirFileSuffix(suffix string) AESEncryptFilesInDirOption {
return func(opt *encryptFilesOption) error {
if !strings.HasPrefix(suffix, ".") {
return errors.Errorf("suffix should start with `.`")
}
opt.suffix = suffix
return nil
}
}
// AESEncryptFilesInDir encrypt files in dir
//
// will generate new encrypted files with <suffix> after ext
//
// xxx.toml -> xxx.toml.enc
func AESEncryptFilesInDir(dir string, secret []byte, opts ...AESEncryptFilesInDirOption) (err error) {
opt := new(encryptFilesOption)
opt.fillDefault()
for _, optf := range opts {
if err = optf(opt); err != nil {
return err
}
}
logger := log.Shared.With(
zap.String("ext", opt.ext),
zap.String("suffix", opt.suffix),
)
fs, err := gutils.ListFilesInDir(dir)
if err != nil {
return errors.Wrapf(err, "read dir `%s`", dir)
}
var pool errgroup.Group
for _, fname := range fs {
if !strings.HasSuffix(fname, opt.ext) {
continue
}
fname := fname
pool.Go(func() (err error) {
raw, err := os.ReadFile(fname)
if err != nil {
return errors.Wrapf(err, "read file `%s`", fname)
}
cipher, err := AesEncrypt(secret, raw)
if err != nil {
return errors.Wrapf(err, "encrypt")
}
outfname := fname + opt.suffix
if err = os.WriteFile(outfname, cipher, 0600); err != nil {
return errors.Wrapf(err, "write file `%s`", outfname)
}
logger.Info("encrypt file", zap.String("src", fname), zap.String("out", outfname))
return nil
})
}
return pool.Wait()
}