CryptoParamsTrait.php
11 months ago
CryptoParamsTraitV2.php
11 months ago
HeadersMetadataStrategy.php
11 months ago
InstructionFileMetadataStrategy.php
11 months ago
S3EncryptionClient.php
11 months ago
S3EncryptionClientV2.php
11 months ago
S3EncryptionMultipartUploader.php
11 months ago
S3EncryptionMultipartUploaderV2.php
11 months ago
UserAgentTrait.php
11 months ago
S3EncryptionMultipartUploader.php
169 lines
| 1 | <?php |
| 2 | namespace Aws\S3\Crypto; |
| 3 | |
| 4 | use Aws\Crypto\AbstractCryptoClient; |
| 5 | use Aws\Crypto\EncryptionTrait; |
| 6 | use Aws\Crypto\MetadataEnvelope; |
| 7 | use Aws\Crypto\Cipher\CipherBuilderTrait; |
| 8 | use Aws\S3\MultipartUploader; |
| 9 | use Aws\S3\S3ClientInterface; |
| 10 | use GuzzleHttp\Promise; |
| 11 | |
| 12 | /** |
| 13 | * Encapsulates the execution of a multipart upload of an encrypted object to S3. |
| 14 | * |
| 15 | * Legacy implementation using older encryption workflow. Use |
| 16 | * S3EncryptionMultipartUploaderV2 if possible. |
| 17 | * |
| 18 | * @deprecated |
| 19 | */ |
| 20 | class S3EncryptionMultipartUploader extends MultipartUploader |
| 21 | { |
| 22 | use CipherBuilderTrait; |
| 23 | use CryptoParamsTrait; |
| 24 | use EncryptionTrait; |
| 25 | use UserAgentTrait; |
| 26 | |
| 27 | const CRYPTO_VERSION = '1n'; |
| 28 | |
| 29 | /** |
| 30 | * Returns if the passed cipher name is supported for encryption by the SDK. |
| 31 | * |
| 32 | * @param string $cipherName The name of a cipher to verify is registered. |
| 33 | * |
| 34 | * @return bool If the cipher passed is in our supported list. |
| 35 | */ |
| 36 | public static function isSupportedCipher($cipherName) |
| 37 | { |
| 38 | return in_array($cipherName, AbstractCryptoClient::$supportedCiphers); |
| 39 | } |
| 40 | |
| 41 | private $provider; |
| 42 | private $instructionFileSuffix; |
| 43 | private $strategy; |
| 44 | |
| 45 | /** |
| 46 | * Creates a multipart upload for an S3 object after encrypting it. |
| 47 | * |
| 48 | * The required configuration options are as follows: |
| 49 | * |
| 50 | * - @MaterialsProvider: (MaterialsProvider) Provides Cek, Iv, and Cek |
| 51 | * encrypting/decrypting for encryption metadata. |
| 52 | * - @CipherOptions: (array) Cipher options for encrypting data. A Cipher |
| 53 | * is required. Accepts the following options: |
| 54 | * - Cipher: (string) cbc|gcm |
| 55 | * See also: AbstractCryptoClient::$supportedCiphers. Note that |
| 56 | * cbc is deprecated and gcm should be used when possible. |
| 57 | * - KeySize: (int) 128|192|256 |
| 58 | * See also: MaterialsProvider::$supportedKeySizes |
| 59 | * - Aad: (string) Additional authentication data. This option is |
| 60 | * passed directly to OpenSSL when using gcm. It is ignored when |
| 61 | * using cbc. |
| 62 | * - bucket: (string) Name of the bucket to which the object is |
| 63 | * being uploaded. |
| 64 | * - key: (string) Key to use for the object being uploaded. |
| 65 | * |
| 66 | * The optional configuration arguments are as follows: |
| 67 | * |
| 68 | * - @MetadataStrategy: (MetadataStrategy|string|null) Strategy for storing |
| 69 | * MetadataEnvelope information. Defaults to using a |
| 70 | * HeadersMetadataStrategy. Can either be a class implementing |
| 71 | * MetadataStrategy, a class name of a predefined strategy, or empty/null |
| 72 | * to default. |
| 73 | * - @InstructionFileSuffix: (string|null) Suffix used when writing to an |
| 74 | * instruction file if an using an InstructionFileMetadataHandler was |
| 75 | * determined. |
| 76 | * - acl: (string) ACL to set on the object being upload. Objects are |
| 77 | * private by default. |
| 78 | * - before_complete: (callable) Callback to invoke before the |
| 79 | * `CompleteMultipartUpload` operation. The callback should have a |
| 80 | * function signature like `function (Aws\Command $command) {...}`. |
| 81 | * - before_initiate: (callable) Callback to invoke before the |
| 82 | * `CreateMultipartUpload` operation. The callback should have a function |
| 83 | * signature like `function (Aws\Command $command) {...}`. |
| 84 | * - before_upload: (callable) Callback to invoke before any `UploadPart` |
| 85 | * operations. The callback should have a function signature like |
| 86 | * `function (Aws\Command $command) {...}`. |
| 87 | * - concurrency: (int, default=int(5)) Maximum number of concurrent |
| 88 | * `UploadPart` operations allowed during the multipart upload. |
| 89 | * - params: (array) An array of key/value parameters that will be applied |
| 90 | * to each of the sub-commands run by the uploader as a base. |
| 91 | * Auto-calculated options will override these parameters. If you need |
| 92 | * more granularity over parameters to each sub-command, use the before_* |
| 93 | * options detailed above to update the commands directly. |
| 94 | * - part_size: (int, default=int(5242880)) Part size, in bytes, to use when |
| 95 | * doing a multipart upload. This must between 5 MB and 5 GB, inclusive. |
| 96 | * - state: (Aws\Multipart\UploadState) An object that represents the state |
| 97 | * of the multipart upload and that is used to resume a previous upload. |
| 98 | * When this option is provided, the `bucket`, `key`, and `part_size` |
| 99 | * options are ignored. |
| 100 | * |
| 101 | * @param S3ClientInterface $client Client used for the upload. |
| 102 | * @param mixed $source Source of the data to upload. |
| 103 | * @param array $config Configuration used to perform the upload. |
| 104 | */ |
| 105 | public function __construct( |
| 106 | S3ClientInterface $client, |
| 107 | $source, |
| 108 | array $config = [] |
| 109 | ) { |
| 110 | $this->appendUserAgent($client, 'feat/s3-encrypt/' . self::CRYPTO_VERSION); |
| 111 | $this->client = $client; |
| 112 | $config['params'] = []; |
| 113 | if (!empty($config['bucket'])) { |
| 114 | $config['params']['Bucket'] = $config['bucket']; |
| 115 | } |
| 116 | if (!empty($config['key'])) { |
| 117 | $config['params']['Key'] = $config['key']; |
| 118 | } |
| 119 | |
| 120 | $this->provider = $this->getMaterialsProvider($config); |
| 121 | unset($config['@MaterialsProvider']); |
| 122 | |
| 123 | $this->instructionFileSuffix = $this->getInstructionFileSuffix($config); |
| 124 | unset($config['@InstructionFileSuffix']); |
| 125 | $this->strategy = $this->getMetadataStrategy( |
| 126 | $config, |
| 127 | $this->instructionFileSuffix |
| 128 | ); |
| 129 | if ($this->strategy === null) { |
| 130 | $this->strategy = self::getDefaultStrategy(); |
| 131 | } |
| 132 | unset($config['@MetadataStrategy']); |
| 133 | |
| 134 | $config['prepare_data_source'] = $this->getEncryptingDataPreparer(); |
| 135 | |
| 136 | parent::__construct($client, $source, $config); |
| 137 | } |
| 138 | |
| 139 | private static function getDefaultStrategy() |
| 140 | { |
| 141 | return new HeadersMetadataStrategy(); |
| 142 | } |
| 143 | |
| 144 | private function getEncryptingDataPreparer() |
| 145 | { |
| 146 | return function() { |
| 147 | // Defer encryption work until promise is executed |
| 148 | $envelope = new MetadataEnvelope(); |
| 149 | |
| 150 | list($this->source, $params) = Promise\Create::promiseFor($this->encrypt( |
| 151 | $this->source, |
| 152 | $this->config['@cipheroptions'] ?: [], |
| 153 | $this->provider, |
| 154 | $envelope |
| 155 | ))->then( |
| 156 | function ($bodyStream) use ($envelope) { |
| 157 | $params = $this->strategy->save( |
| 158 | $envelope, |
| 159 | $this->config['params'] |
| 160 | ); |
| 161 | return [$bodyStream, $params]; |
| 162 | } |
| 163 | )->wait(); |
| 164 | |
| 165 | $this->source->rewind(); |
| 166 | $this->config['params'] = $params; |
| 167 | }; |
| 168 | } |
| 169 | } |