-
Notifications
You must be signed in to change notification settings - Fork 84
/
kms.go
163 lines (134 loc) · 3.69 KB
/
kms.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
package awskms
import (
"errors"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/service/kms"
"github.com/wanchain/go-wanchain/log"
"io/ioutil"
"os"
"path/filepath"
)
func EncryptFile(srcFile, desFile, aKID, secretKey, region, keyId string) error {
keyjson, err := ioutil.ReadFile(srcFile)
if err != nil {
return err
}
ciphertext, err := Encrypt(string(keyjson), aKID, secretKey, region, keyId)
if err != nil {
return err
}
// Create the keystore directory with appropriate permissions
// in case it is not present yet.
const dirPerm = 0700
if err := os.MkdirAll(filepath.Dir(desFile), dirPerm); err != nil {
return err
}
// Atomic write: create a temporary hidden file first
// then move it into place. TempFile assigns mode 0600.
f, err := ioutil.TempFile(filepath.Dir(desFile), "."+filepath.Base(desFile)+".tmp")
if err != nil {
return err
}
wLen, err := f.Write(ciphertext)
if err != nil {
f.Close()
os.Remove(f.Name())
return err
}
if wLen != len(ciphertext) {
f.Close()
os.Remove(f.Name())
return errors.New("The data len writen to file is less than excepted")
}
f.Close()
return os.Rename(f.Name(), desFile)
}
func DecryptFile(srcFile, desFile, aKID, secretKey, region string) error {
plaintext, err := DecryptFileToBuffer(srcFile, aKID, secretKey, region)
if err != nil {
return err
}
// Create the keystore directory with appropriate permissions
// in case it is not present yet.
const dirPerm = 0700
if err := os.MkdirAll(filepath.Dir(desFile), dirPerm); err != nil {
return err
}
// Atomic write: create a temporary hidden file first
// then move it into place. TempFile assigns mode 0600.
f, err := ioutil.TempFile(filepath.Dir(desFile), "."+filepath.Base(desFile)+".tmp")
if err != nil {
return err
}
wLen, err := f.Write(plaintext)
if err != nil {
f.Close()
os.Remove(f.Name())
return err
}
if wLen != len(plaintext) {
f.Close()
os.Remove(f.Name())
return errors.New("The data len writen to file is less than excepted")
}
f.Close()
return os.Rename(f.Name(), desFile)
}
func DecryptFileToBuffer(srcFile, aKID, secretKey, region string) ([]byte, error) {
keyjson, err := ioutil.ReadFile(srcFile)
if err != nil {
return nil, err
}
plaintext, err := Decrypt(keyjson, aKID, secretKey, region)
if err != nil {
return nil, err
}
return plaintext, nil
}
func Encrypt(text, aKID, secretKey, region, keyId string) ([]byte, error) {
// Initialize a session
sess, err := session.NewSession(&aws.Config{
Region: aws.String(region),
Credentials: credentials.NewStaticCredentials(aKID, secretKey, ""),
})
if err != nil {
log.Error("create kms session fail", "err", err)
return nil, err
}
// Create KMS service client
svc := kms.New(sess)
// Encrypt the data key
result, err := svc.Encrypt(&kms.EncryptInput{
KeyId: aws.String(keyId),
Plaintext: []byte(text),
})
if err != nil {
log.Error("kms encrypt fail", "err", err)
return nil, err
}
return result.CiphertextBlob, nil
}
func Decrypt(text []byte, aKID, secretKey, region string) ([]byte, error) {
// Initialize a session
sess, err := session.NewSession(&aws.Config{
Region: aws.String(region),
Credentials: credentials.NewStaticCredentials(aKID, secretKey, ""),
})
if err != nil {
log.Error("create kms session fail", "err", err)
return nil, err
}
// Create KMS service client
svc := kms.New(sess)
// Encrypted data
blob := []byte(text)
// Decrypt the data
result, err := svc.Decrypt(&kms.DecryptInput{CiphertextBlob: blob})
if err != nil {
log.Error("kms decrypt fail", "err", err)
return nil, err
}
return result.Plaintext, nil
}