@@ -31,68 +31,81 @@ void hex256(hash_bytes &in, hash_str &out) {
3131 }
3232}
3333
34- const EVP_CIPHER *GetCipher (const string &key) {
35- // For now, we only support GCM ciphers
36- switch (key.size ()) {
37- case 16 :
38- return EVP_aes_128_gcm ();
39- case 24 :
40- return EVP_aes_192_gcm ();
41- case 32 :
42- return EVP_aes_256_gcm ();
43- default :
44- throw InternalException (" Invalid AES key length"
45- }
46- }
47-
48- AESGCMStateSSL::AESGCMStateSSL () : gcm_context(EVP_CIPHER_CTX_new()) {
49- if (!(gcm_context)) {
34+ AESStateSSL::AESStateSSL (const std::string *key) : context(EVP_CIPHER_CTX_new()) {
35+ if (!(context)) {
5036 throw InternalException (" AES GCM failed with initializing context"
5137 }
5238}
5339
54- AESGCMStateSSL ::~AESGCMStateSSL
40+ AESStateSSL ::~AESStateSSL
5541 // Clean up
56- EVP_CIPHER_CTX_free (gcm_context );
42+ EVP_CIPHER_CTX_free (context );
5743}
5844
59- bool AESGCMStateSSL::IsOpenSSL () {
60- return ssl;
45+ const EVP_CIPHER *AESStateSSL::GetCipher (const string &key) {
46+
47+ switch (cipher) {
48+ case GCM:
49+ switch (key.size ()) {
50+ case 16 :
51+ return EVP_aes_128_gcm ();
52+ case 24 :
53+ return EVP_aes_192_gcm ();
54+ case 32 :
55+ return EVP_aes_256_gcm ();
56+ default :
57+ throw InternalException (" Invalid AES key length"
58+ }
59+ case CTR:
60+ switch (key.size ()) {
61+ case 16 :
62+ return EVP_aes_128_ctr ();
63+ case 24 :
64+ return EVP_aes_192_ctr ();
65+ case 32 :
66+ return EVP_aes_256_ctr ();
67+ default :
68+ throw InternalException (" Invalid AES key length"
69+ }
70+
71+ default :
72+ throw duckdb::InternalException (" Invalid Encryption/Decryption Cipher: %d" static_cast <int >(cipher));
73+ }
6174}
6275
63- void AESGCMStateSSL ::GenerateRandomDatadata_ptr_t data, idx_t len) {
76+ void AESStateSSL ::GenerateRandomDatadata_ptr_t data, idx_t len) {
6477 // generate random bytes for nonce
6578 RAND_bytes (data, len);
6679}
6780
68- void AESGCMStateSSL ::InitializeEncryptionconst_data_ptr_t iv, idx_t iv_len, const string *key) {
81+ void AESStateSSL ::InitializeEncryptionconst_data_ptr_t iv, idx_t iv_len, const string *key) {
6982 mode = ENCRYPT;
7083
71- if (1 != EVP_EncryptInit_ex (gcm_context , GetCipher (*key), NULL , const_data_ptr_cast (key->data ()), iv)) {
84+ if (1 != EVP_EncryptInit_ex (context , GetCipher (*key), NULL , const_data_ptr_cast (key->data ()), iv)) {
7285 throw InternalException (" EncryptInit failed"
7386 }
7487}
7588
76- void AESGCMStateSSL ::InitializeDecryptionconst_data_ptr_t iv, idx_t iv_len, const string *key) {
89+ void AESStateSSL ::InitializeDecryptionconst_data_ptr_t iv, idx_t iv_len, const string *key) {
7790 mode = DECRYPT;
7891
79- if (1 != EVP_DecryptInit_ex (gcm_context , GetCipher (*key), NULL , const_data_ptr_cast (key->data ()), iv)) {
92+ if (1 != EVP_DecryptInit_ex (context , GetCipher (*key), NULL , const_data_ptr_cast (key->data ()), iv)) {
8093 throw InternalException (" DecryptInit failed"
8194 }
8295}
8396
84- size_t AESGCMStateSSL ::Processconst_data_ptr_t in, idx_t in_len, data_ptr_t out, idx_t out_len) {
97+ size_t AESStateSSL ::Processconst_data_ptr_t in, idx_t in_len, data_ptr_t out, idx_t out_len) {
8598
8699 switch (mode) {
87100 case ENCRYPT:
88- if (1 != EVP_EncryptUpdate (gcm_context , data_ptr_cast (out), reinterpret_cast <int *>(&out_len),
101+ if (1 != EVP_EncryptUpdate (context , data_ptr_cast (out), reinterpret_cast <int *>(&out_len),
89102 const_data_ptr_cast (in), (int )in_len)) {
90103 throw InternalException (" EncryptUpdate failed"
91104 }
92105 break ;
93106
94107 case DECRYPT:
95- if (1 != EVP_DecryptUpdate (gcm_context , data_ptr_cast (out), reinterpret_cast <int *>(&out_len),
108+ if (1 != EVP_DecryptUpdate (context , data_ptr_cast (out), reinterpret_cast <int *>(&out_len),
96109 const_data_ptr_cast (in), (int )in_len)) {
97110
98111 throw InternalException (" DecryptUpdate failed"
@@ -107,30 +120,30 @@ size_t AESGCMStateSSL::Process(const_data_ptr_t in, idx_t in_len, data_ptr_t out
107120 return out_len;
108121}
109122
110- size_t AESGCMStateSSL::Finalize (data_ptr_t out, idx_t out_len, data_ptr_t tag, idx_t tag_len) {
123+ size_t AESStateSSL::FinalizeGCM (data_ptr_t out, idx_t out_len, data_ptr_t tag, idx_t tag_len) {
111124 auto text_len = out_len;
112125
113126 switch (mode) {
114- case ENCRYPT:
115- {
116- if (1 != EVP_EncryptFinal_ex (gcm_context, data_ptr_cast (out) + out_len, reinterpret_cast <int *>(&out_len))) {
127+ case ENCRYPT: {
128+ if (1 != EVP_EncryptFinal_ex (context, data_ptr_cast (out) + out_len, reinterpret_cast <int *>(&out_len))) {
117129 throw InternalException (" EncryptFinal failed"
118130 }
119131 text_len += out_len;
132+
120133 // The computed tag is written at the end of a chunk
121- if (1 != EVP_CIPHER_CTX_ctrl (gcm_context , EVP_CTRL_GCM_GET_TAG, tag_len, tag)) {
134+ if (1 != EVP_CIPHER_CTX_ctrl (context , EVP_CTRL_GCM_GET_TAG, tag_len, tag)) {
122135 throw InternalException (" Calculating the tag failed"
123136 }
124137 return text_len;
125138 }
126- case DECRYPT:
127- {
139+ case DECRYPT: {
128140 // Set expected tag value
129- if (!EVP_CIPHER_CTX_ctrl (gcm_context , EVP_CTRL_GCM_SET_TAG, tag_len, tag)) {
141+ if (!EVP_CIPHER_CTX_ctrl (context , EVP_CTRL_GCM_SET_TAG, tag_len, tag)) {
130142 throw InternalException (" Finalizing tag failed"
131143 }
144+
132145 // EVP_DecryptFinal() will return an error code if final block is not correctly formatted.
133- int ret = EVP_DecryptFinal_ex (gcm_context , data_ptr_cast (out) + out_len, reinterpret_cast <int *>(&out_len));
146+ int ret = EVP_DecryptFinal_ex (context , data_ptr_cast (out) + out_len, reinterpret_cast <int *>(&out_len));
134147 text_len += out_len;
135148
136149 if (ret > 0 ) {
@@ -144,12 +157,46 @@ size_t AESGCMStateSSL::Finalize(data_ptr_t out, idx_t out_len, data_ptr_t tag, i
144157 }
145158}
146159
160+ size_t AESStateSSL::Finalize (data_ptr_t out, idx_t out_len, data_ptr_t tag, idx_t tag_len) {
161+
162+ if (cipher == GCM) {
163+ return FinalizeGCM (out, out_len, tag, tag_len);
164+ }
165+
166+ auto text_len = out_len;
167+ switch (mode) {
168+
169+ case ENCRYPT: {
170+ if (1 != EVP_EncryptFinal_ex (context, data_ptr_cast (out) + out_len, reinterpret_cast <int *>(&out_len))) {
171+ throw InternalException (" EncryptFinal failed"
172+ }
173+
174+ return text_len += out_len;
175+ }
176+
177+ case DECRYPT: {
178+ // EVP_DecryptFinal() will return an error code if final block is not correctly formatted.
179+ int ret = EVP_DecryptFinal_ex (context, data_ptr_cast (out) + out_len, reinterpret_cast <int *>(&out_len));
180+ text_len += out_len;
181+
182+ if (ret > 0 ) {
183+ // success
184+ return text_len;
185+ }
186+
187+ throw InvalidInputException (" Computed AES tag differs from read AES tag, are you using the right key?"
188+ }
189+ default :
190+ throw InternalException (" Unhandled encryption mode %d" static_cast <int >(mode));
191+ }
192+ }
193+
147194} // namespace duckdb
148195
149196extern " C"
150197
151198// Call the member function through the factory object
152- DUCKDB_EXTENSION_API AESGCMStateSSLFactory *CreateSSLFactory () {
153- return new AESGCMStateSSLFactory ();
199+ DUCKDB_EXTENSION_API AESStateSSLFactory *CreateSSLFactory () {
200+ return new AESStateSSLFactory ();
154201};
155202}
0 commit comments