Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support to set KMS Server endpoint when use client-side-encryption #170

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

support to set KMS Server endpoint when use client-side-encryption #170

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions src/main/java/com/qcloud/cos/COSEncryptionClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@
import com.qcloud.cos.model.PutObjectResult;
import com.qcloud.cos.model.UploadPartRequest;
import com.qcloud.cos.model.UploadPartResult;
import com.tencentcloudapi.common.profile.ClientProfile;

public class COSEncryptionClient extends COSClient implements COSEncryption {

Expand All @@ -67,6 +68,12 @@ public COSEncryptionClient(COSCredentialsProvider credentialsProvider,
this(null, credentialsProvider, kekMaterialsProvider, clientConfig, cryptoConfig);
}

public COSEncryptionClient(COSCredentialsProvider credentialsProvider,
EncryptionMaterialsProvider kekMaterialsProvider, ClientConfig clientConfig,
CryptoConfiguration cryptoConfig,ClientProfile clientProfile) {
this(null, credentialsProvider, kekMaterialsProvider, clientConfig, cryptoConfig, clientProfile);
}

public COSEncryptionClient(QCLOUDKMS kms, COSCredentialsProvider credentialsProvider,
EncryptionMaterialsProvider kekMaterialsProvider, ClientConfig clientConfig,
CryptoConfiguration cryptoConfig) {
Expand All @@ -81,6 +88,20 @@ public COSEncryptionClient(QCLOUDKMS kms, COSCredentialsProvider credentialsProv
kekMaterialsProvider, cryptoConfig);
}

public COSEncryptionClient(QCLOUDKMS kms, COSCredentialsProvider credentialsProvider,
EncryptionMaterialsProvider kekMaterialsProvider, ClientConfig clientConfig,
CryptoConfiguration cryptoConfig, ClientProfile clientProfile) {
super(credentialsProvider.getCredentials(), clientConfig);
assertParameterNotNull(kekMaterialsProvider,
"EncryptionMaterialsProvider parameter must not be null.");
assertParameterNotNull(cryptoConfig, "CryptoConfiguration parameter must not be null.");
this.isKMSClientInternal = kms == null;
this.kms = isKMSClientInternal ?
newTencentCloudKMSClient(credentialsProvider, clientConfig, cryptoConfig, clientProfile) : kms;
this.crypto = new CryptoModuleDispatcher(this.kms, new COSDirectImpl(), credentialsProvider,
kekMaterialsProvider, cryptoConfig);
}

private TencentCloudKMSClient newTencentCloudKMSClient(
COSCredentialsProvider credentialsProvider,
ClientConfig clientConfig,
Expand All @@ -95,6 +116,21 @@ private TencentCloudKMSClient newTencentCloudKMSClient(
return kmsClient;
}

private TencentCloudKMSClient newTencentCloudKMSClient(
COSCredentialsProvider credentialsProvider,
ClientConfig clientConfig,
CryptoConfiguration cryptoConfig,
ClientProfile clientProfile) {
String region = cryptoConfig.getKmsRegion();
if (region == null) {
region = clientConfig.getRegion().getRegionName();
}

final TencentCloudKMSClient kmsClient = new TencentCloudKMSClient(credentialsProvider, region, clientProfile);

return kmsClient;
}

private void assertParameterNotNull(Object parameterValue, String errorMessage) {
if (parameterValue == null)
throw new IllegalArgumentException(errorMessage);
Expand Down
18 changes: 18 additions & 0 deletions src/main/java/com/qcloud/cos/demo/KMSEncryptionClientDemo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@
import com.qcloud.cos.transfer.TransferManager;
import com.qcloud.cos.transfer.TransferManagerConfiguration;
import com.qcloud.cos.transfer.Upload;
import com.tencentcloudapi.common.profile.ClientProfile;
import com.tencentcloudapi.common.profile.HttpProfile;

public class KMSEncryptionClientDemo {
static String cmk = "kms-xxxxxxx";
Expand Down Expand Up @@ -67,6 +69,22 @@ static COSClient createCosClient(String region) {

// 生成加密客户端EncryptionClient, COSEncryptionClient是COSClient的子类, 所有COSClient支持的接口他都支持。
// EncryptionClient覆盖了COSClient上传下载逻辑，操作内部会执行加密操作，其他操作执行逻辑和COSClient一致

// in case you want to use different kms server:
//{
//String kmsEndPoint = "";
///HttpProfile httpProfile = new HttpProfile();
//httpProfile.setEndpoint(kmsEndPoint);
//httpProfile.setProtocol(HttpProfile.REQ_HTTP);
//ClientProfile clientProfile = new ClientProfile();
//clientProfile.setHttpProfile(httpProfile);

//COSEncryptionClient cosEncryptionClient =
// new COSEncryptionClient(new COSStaticCredentialsProvider(cred),
// new KMSEncryptionMaterialsProvider(encryptionMaterials), clientConfig,
// cryptoConf,clientProfile);
//}

COSEncryptionClient cosEncryptionClient =
new COSEncryptionClient(new COSStaticCredentialsProvider(cred),
new KMSEncryptionMaterialsProvider(encryptionMaterials), clientConfig,
Expand Down
9 changes: 9 additions & 0 deletions src/main/java/com/qcloud/cos/internal/crypto/TencentCloudKMSClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
import com.tencentcloudapi.kms.v20190118.models.EncryptResponse;
import com.tencentcloudapi.kms.v20190118.models.GenerateDataKeyRequest;
import com.tencentcloudapi.kms.v20190118.models.GenerateDataKeyResponse;
import com.tencentcloudapi.common.profile.ClientProfile;

/**
* Client for accessing TencentCloud KMS.
Expand All @@ -45,6 +46,14 @@ public TencentCloudKMSClient(COSCredentialsProvider cosCredentialsProvider, Stri
this.kmsClient = new KmsClient(credential, region);
}

public TencentCloudKMSClient(COSCredentialsProvider cosCredentialsProvider, String region, ClientProfile clientProfile) {
COSCredentials cosCredentials = cosCredentialsProvider.getCredentials();
String secretId = cosCredentials.getCOSAccessKeyId();
String secretKey = cosCredentials.getCOSSecretKey();

Credential credential = new Credential(secretId, secretKey);
this.kmsClient = new KmsClient(credential, region, clientProfile);
}
/**
* Generates a unique symmetric data key for client-side encryption. This operation returns a plaintext copy of the
* data key and a copy that is encrypted under a customer master key (CMK) that you specify. You can use the
Expand Down