cloud/src/common/kms.cpp

// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.

#include "common/kms.h"

#include <alibabacloud/core/AlibabaCloud.h>
#include <alibabacloud/core/CommonClient.h>
#include <json/json.h>

#include <memory>

#include "common/logging.h"
#include "cpp/sync_point.h"
namespace doris::cloud {

int create_kms_client(KmsConf&& conf, std::unique_ptr<KmsClient>* kms_client) {
    if (conf.ak.empty() || conf.sk.empty() || conf.endpoint.empty() || conf.region.empty() ||
        conf.provider.empty() || conf.cmk.empty()) {
        LOG(WARNING) << "incorrect kms conf";
        return -1;
    }
    // Todo: only support ali cloud now
    if (conf.provider != "ali") {
        LOG(WARNING) << "only support kms for ali cloud now";
        return -1;
    }
    *kms_client = std::make_unique<AliKmsClient>(std::move(conf));
    return 0;
}

AliKmsClient::AliKmsClient(KmsConf&& conf) : KmsClient(std::move(conf)) {
    AlibabaCloud::InitializeSdk();
}

AliKmsClient::~AliKmsClient() {
    AlibabaCloud::ShutdownSdk();
}

int AliKmsClient::init() {
    AlibabaCloud::ClientConfiguration configuration(conf_.region);
    AlibabaCloud::Credentials credential(conf_.ak, conf_.sk);
    kms_client_ = std::make_unique<AlibabaCloud::CommonClient>(std::move(credential),
                                                               std::move(configuration));
    return 0;
}

int AliKmsClient::encrypt(const std::string& plaintext, std::string* output) {
    AlibabaCloud::CommonRequest request(AlibabaCloud::CommonRequest::RequestPattern::RpcPattern);
    request.setHttpMethod(AlibabaCloud::HttpRequest::Method::Post);
    request.setDomain(conf_.endpoint);
    request.setVersion("2016-01-20");
    request.setQueryParameter("Action", "Encrypt");
    request.setQueryParameter("KeyId", conf_.cmk);
    request.setQueryParameter("Plaintext", plaintext);

    auto response = kms_client_->commonResponse(request);
    if (response.isSuccess()) {
        Json::Value json;
        Json::Reader reader;
        if (reader.parse(response.result().payload(), json) && json.isMember("CiphertextBlob")) {
            *output = json["CiphertextBlob"].asString();
            return 0;
        } else {
            LOG(WARNING) << "failed to parse response, response=" << response.result().payload();
            return -1;
        }
    } else {
        LOG(WARNING) << "failed to encrypt data, error=" << response.error().errorMessage()
                     << " request id=" << response.error().requestId();
        return -1;
    }
    return 0;
}

int AliKmsClient::decrypt(const std::string& ciphertext, std::string* output) {
    TEST_SYNC_POINT_RETURN_WITH_VALUE("alikms::decrypt", (int)0, output);
    AlibabaCloud::CommonRequest request(AlibabaCloud::CommonRequest::RequestPattern::RpcPattern);
    request.setHttpMethod(AlibabaCloud::HttpRequest::Method::Post);
    request.setDomain(conf_.endpoint);
    request.setVersion("2016-01-20");
    request.setQueryParameter("Action", "Decrypt");
    request.setQueryParameter("CiphertextBlob", ciphertext);

    auto response = kms_client_->commonResponse(request);
    if (response.isSuccess()) {
        Json::Value json;
        Json::Reader reader;
        if (reader.parse(response.result().payload(), json) && json.isMember("Plaintext")) {
            *output = json["Plaintext"].asString();
            return 0;
        } else {
            LOG(WARNING) << "failed to parse response, response=" << response.result().payload();
            return -1;
        }
    } else {
        LOG(WARNING) << "failed to decrypt data, error=" << response.error().errorMessage()
                     << " request id=" << response.error().requestId();
        return -1;
    }
    return 0;
}

int AliKmsClient::generate_data_key(std::string* ciphertext, std::string* plaintext) {
    TEST_SYNC_POINT_RETURN_WITH_VALUE("alikms::generate_data_key", (int)0, ciphertext, plaintext);
    AlibabaCloud::CommonRequest request(AlibabaCloud::CommonRequest::RequestPattern::RpcPattern);
    request.setHttpMethod(AlibabaCloud::HttpRequest::Method::Post);
    request.setDomain(conf_.endpoint);
    request.setVersion("2016-01-20");
    request.setQueryParameter("Action", "GenerateDataKey");
    request.setQueryParameter("KeySpec", "AES_256");
    request.setQueryParameter("KeyId", "839ff82c-dcb5-4438-a6a4-6ec832443ba8");

    auto response = kms_client_->commonResponse(request);
    if (response.isSuccess()) {
        Json::Value json;
        Json::Reader reader;
        if (reader.parse(response.result().payload(), json) && json.isMember("Plaintext") &&
            json.isMember("CiphertextBlob")) {
            *plaintext = json["Plaintext"].asString();
            *ciphertext = json["CiphertextBlob"].asString();
            return 0;
        } else {
            LOG(WARNING) << "failed to parse response, response=" << response.result().payload();
            return -1;
        }
    } else {
        LOG(WARNING) << "failed to generate data key, error=" << response.error().errorMessage()
                     << " request id=" << response.error().requestId();
        return -1;
    }
    return 0;
}

} // namespace doris::cloud