/
lib
/
python3.9
/
site-packages
/
oci
/
encryption
/
__pycache__
/
Upload File
HOME
a ���f�/ � @ s� d dl mZ d dlZd dlZd dlmZ d dlmZ d dlm Z m Z m Z d dl m Z mZmZ d dlmZmZmZ e�ej�G dd � d e��ZG d d � d e�Ze�ej�G d d � d e��ZG dd� de�ZG dd� de�ZdS )� )�sixN)� algorithms)� ServiceError)�KeyShape�GenerateKeyDetails�DecryptDataDetails)�KmsCryptoClient�KmsManagementClient�KmsVaultClient)�convert_to_str�verify_crc32_checksum�raise_runtime_error_fromc @ s, e Zd ZdZejdd� �Zejdd� �ZdS )�MasterKeyProviderzn An abstract base class defining methods to vend MasterKeys for use in encryption and decryption. c C s dS )zv Returns the primary master key for this MasterKeyProvider. :rtype: oci.encryption.MasterKey N� ��selfr r �@/usr/lib/python3.9/site-packages/oci/encryption/key_providers.py�get_primary_master_key s z(MasterKeyProvider.get_primary_master_keyc K s dS )zz Returns a specific master key based on the arguments provided. :rtype: oci.encryption.MasterKey Nr )r �kwargsr r r �get_master_key$ s z MasterKeyProvider.get_master_keyN)�__name__� __module__� __qualname__�__doc__�abc�abstractmethodr r r r r r r s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) �KMSMasterKeyProviderNc K sZ |dur t |�dkr td��d| _|r0|d | _|�d�| _|| _| jsV| jsVtd��dS )ak :param dict config: (required) An OCI config dict used to create underlying clients to talk to OCI KMS. Note, the 'region' in this config must match the region that the key / vault exist in otherwise they will not be found. :param list[KMSMasterKey] kms_master_keys: (optional) A list of KMSMasterKeys. Currently a max of 1 master key is supported. For decryption, you can use a KMSMasterKeyProvder with no master keys. :param signer: (optional) The signer to use when signing requests made by the service client. The default is to use a :py:class:`~oci.signer.Signer` based on the values provided in the config parameter. One use case for this parameter is for `Instance Principals authentication <https://docs.cloud.oracle.com/Content/Identity/Tasks/callingservicesfrominstances.htm>`__ by passing an instance of :py:class:`~oci.auth.signers.InstancePrincipalsSecurityTokenSigner` as the value for this keyword argument :type signer: :py:class:`~oci.signer.AbstractBaseSigner` N� zGOnly one KMS master key is currently supported for KMSMasterKeyProviderr �signer�+Either a config or signer must be passed in)�len� ValueError�primary_master_key�getr �config)r r$ Zkms_master_keysr r r r �__init__/ s � �z KMSMasterKeyProvider.__init__c C s | j S )N)r" r r r r r R s z+KMSMasterKeyProvider.get_primary_master_keyc K s^ |� d�std��| jr2| j�� |� d�kr2| jS | j}| jrH| j|d< tf d|i|��}|S )a8 Get a KMSMasterKey based on the provided parameters. If this key provider already has the KMSMasterKey that was requested, it will return it. If it does not have a representation of the KMSMasterKey locally, it will attempt to retrieve it from KMS. :param str master_key_id: (required) The OCID of this master key :param str vault_id: (optional) The OCID of the vault this master key resides in :param str region: (optional) The region this master key resides in � master_key_idz/keyword argument master_key_id must not be Noner r$ )r# r! r" �get_identifierr$ r � KMSMasterKey)r r Zmaster_key_configZkms_master_keyr r r r U s � z#KMSMasterKeyProvider.get_master_key)N)r r r r% r r r r r r r . s #r c @ s: e Zd ZdZejdd� �Zejdd� �Zejdd� �ZdS ) � MasterKeyzz An abstract base class representing a MasterKey resource to be used in encryption and decryption operations. c C s dS )a� Generates a data encryption key (DEK) based on the algorithm provided using this MasterKey. The returned DataEncryptionKey includes a copy of the DEK encrypted under this MasterKey. :param oci.encryption.algorithms.Algorithm algorithm: (required) The algorithm the key will be used for. :rtype: oci.encryption.key_providers.DataEncryptionKey Nr )r � algorithmr r r � generate_data_encryption_key} s z&MasterKey.generate_data_encryption_keyc C s dS )�� Decrypts and returns bytes that were encrypted under this master key. :param bytes bytes_to_decrypt: (required) The bytes to decrypt using this MasterKey. :rtype: bytes Nr )r �bytes_to_decryptr r r �decrypt� s zMasterKey.decryptc C s dS )zP Returns an identifier for this MasterKey. :rtype: str Nr r r r r r' � s zMasterKey.get_identifierN) r r r r r r r+ r. r' r r r r r) w s r) c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) r( c K s |s|� d�std��d| _|� d�r4|� d�| _n,d|v rH|d | _n|� d�r`|� d�j| _t|fi |��}|j�| j� z|�|�j}W n> ty� } z&dj || jd�}t ||� W Y d}~n d}~0 0 t |fd|j i|��| _ t|fd|ji|��| _|| _|j| _dS )a� Represents a MasterKey contained in the OCI Key Management Service. :param dict config: (required) An OCI config dict used to create underlying clients to talk to OCI KMS. Note, the 'region' in this config must match the region that the key / vault exist in otherwise they will not be found. :param str master_key_id: (required) The OCID of the KMS master key :param str vault_id: (required) The OCID of the vault containing the master key :param signer: (optional) The signer to use when signing requests made by the service client. The default is to use a :py:class:`~oci.signer.Signer` based on the values provided in the config parameter. One use case for this parameter is for `Instance Principals authentication <https://docs.cloud.oracle.com/Content/Identity/Tasks/callingservicesfrominstances.htm>`__ by passing an instance of :py:class:`~oci.auth.signers.InstancePrincipalsSecurityTokenSigner` as the value for this keyword argument :type signer: :py:class:`~oci.signer.AbstractBaseSigner` :param str region: (optional) The region this master key resides in r r N�regionzFFailed to access vaultId: {vault_id} while targeting region: {region}.)�vault_idr/ Zservice_endpoint)r# r! r/ r Z base_clientZ set_regionZ get_vault�datar �formatr r Zmanagement_endpointZkms_management_clientr Zcrypto_endpoint�kms_crypto_clientr& �idr0 ) r r$ r& r0 r Zkms_vault_clientZvault� service_error�messager r r r% � sH � � ������zKMSMasterKey.__init__c C s� t � }|jjtjjkr td��t j|_|j|_t � }d|_ | j |_ ||_ z| j�|�j}W n@ ty� } z(dj| j | jd�}t||� W Y d }~n d }~0 0 t�|j�}t�|j�}t|||jd�S )NzNOnly AES is currently supported for client side encryption with KMS master keyTzlFailed to generate data encryption key using masterKeyId: {master_key_id} while targeting vault: {vault_id}.�r& r0 )�plaintext_key_bytes�encrypted_key_bytes�plaintext_key_checksum)r r* �namer ZAESr! Z ALGORITHM_AESZkey_len�lengthr Zinclude_plaintext_keyr& �key_idZ key_shaper3 r+ r1 r r2 r0 r �base64� b64decode� plaintext� ciphertext�DataEncryptionKey�plaintext_checksum) r r* Z dek_key_shapeZgenerate_key_detailsZ generated_keyr5 r6 Zdek_plaintext_bytesZdek_ciphertext_bytesr r r r+ � s8 �� � �z)KMSMasterKey.generate_data_encryption_keyc C s� t � }tt�|��|_| j|_z| j�|�j }W n@ t yp } z(dj | j| j d�}t ||� W Y d}~n d}~0 0 tt�|j�|j� |jS )r, zkFailed to decrypt data encryption key using masterKeyId: {master_key_id} while targeting vault: {vault_id}.r7 N)r r r> Z b64encoderA r& r= r3 r. r1 r r2 r0 r r r? r@ rC )r r- Zdecrypt_data_detailsZdecrypted_datar5 r6 r r r r. s$ �� �zKMSMasterKey.decryptc C s | j S )zm Returns the OCID of this master key in the OCI Key Management Service. :rtype: str )r& r r r r r' ' s zKMSMasterKey.get_identifierN)r r r r% r+ r. r' r r r r r( � s ?%!r( c @ s e Zd ZdZddd�ZdS )rB zP Represents a data encryption key used to encrypt and decrypt payloads. Nc C s& || _ || _|| _| jr"t||� dS )aX :param bytes plaintext_key_bytes: The bytes of the data encryption key in plaintext :param bytes encrypted_key_bytes: The bytes of the data encrypted key encrypted under a master key :param str plaintext_key_checksum: The crc32 checsum of the plaintext data encryption key N)r8 r9 r: r )r r8 r9 r: r r r r% 4 s zDataEncryptionKey.__init__)N)r r r r r% r r r r rB 0 s �rB ) Z oci._vendorr r r> Z&cryptography.hazmat.primitives.ciphersr Zoci.exceptionsr Zoci.key_management.modelsr r r Zoci.key_managementr r r Z oci.encryption.internal.utilsr r r Z add_metaclass�ABCMeta�objectr r r) r( rB r r r r �<module> s I )