|
| 1 | +// Licensed to the Apache Software Foundation (ASF) under one |
| 2 | +// or more contributor license agreements. See the NOTICE file |
| 3 | +// distributed with this work for additional information |
| 4 | +// regarding copyright ownership. The ASF licenses this file |
| 5 | +// to you under the Apache License, Version 2.0 (the |
| 6 | +// "License"); you may not use this file except in compliance |
| 7 | +// with the License. You may obtain a copy of the License at |
| 8 | +// |
| 9 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +// |
| 11 | +// Unless required by applicable law or agreed to in writing, |
| 12 | +// software distributed under the License is distributed on an |
| 13 | +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | +// KIND, either express or implied. See the License for the |
| 15 | +// specific language governing permissions and limitations |
| 16 | +// under the License. |
| 17 | + |
| 18 | +#include "gandiva/encrypt_utils_cbc.h" |
| 19 | +#include "gandiva/encrypt_utils_common.h" |
| 20 | +#include <openssl/aes.h> |
| 21 | +#include <openssl/err.h> |
| 22 | +#include <stdexcept> |
| 23 | +#include <cstring> |
| 24 | +#include <sstream> |
| 25 | +#include <cctype> |
| 26 | + |
| 27 | +namespace gandiva { |
| 28 | + |
| 29 | +namespace { |
| 30 | + |
| 31 | +const EVP_CIPHER* get_cbc_cipher_algo(int32_t key_length) { |
| 32 | + switch (key_length) { |
| 33 | + case 16: |
| 34 | + return EVP_aes_128_cbc(); |
| 35 | + case 24: |
| 36 | + return EVP_aes_192_cbc(); |
| 37 | + case 32: |
| 38 | + return EVP_aes_256_cbc(); |
| 39 | + default: { |
| 40 | + std::ostringstream oss; |
| 41 | + oss << "Unsupported key length for AES-CBC: " << key_length |
| 42 | + << " bytes. Supported lengths: 16, 24, 32 bytes"; |
| 43 | + throw std::runtime_error(oss.str()); |
| 44 | + } |
| 45 | + } |
| 46 | +} |
| 47 | + |
| 48 | +} // namespace |
| 49 | + |
| 50 | +GANDIVA_EXPORT |
| 51 | +int32_t aes_encrypt_cbc(const char* plaintext, int32_t plaintext_len, const char* key, |
| 52 | + int32_t key_len, const char* iv, int32_t iv_len, |
| 53 | + bool use_padding, unsigned char* cipher) { |
| 54 | + // Validate IV length |
| 55 | + if (iv_len != 16) { |
| 56 | + std::ostringstream oss; |
| 57 | + oss << "Invalid IV length for AES-CBC: " << iv_len |
| 58 | + << " bytes. IV must be exactly 16 bytes"; |
| 59 | + throw std::runtime_error(oss.str()); |
| 60 | + } |
| 61 | + |
| 62 | + int32_t cipher_len = 0; |
| 63 | + int32_t len = 0; |
| 64 | + EVP_CIPHER_CTX* en_ctx = EVP_CIPHER_CTX_new(); |
| 65 | + const EVP_CIPHER* cipher_algo = get_cbc_cipher_algo(key_len); |
| 66 | + |
| 67 | + if (!en_ctx) { |
| 68 | + throw std::runtime_error("Could not create EVP cipher context for encryption: " + |
| 69 | + get_openssl_error_string()); |
| 70 | + } |
| 71 | + |
| 72 | + if (!EVP_EncryptInit_ex(en_ctx, cipher_algo, nullptr, |
| 73 | + reinterpret_cast<const unsigned char*>(key), |
| 74 | + reinterpret_cast<const unsigned char*>(iv))) { |
| 75 | + EVP_CIPHER_CTX_free(en_ctx); |
| 76 | + throw std::runtime_error("Could not initialize EVP cipher context for encryption: " + |
| 77 | + get_openssl_error_string()); |
| 78 | + } |
| 79 | + |
| 80 | + int padding_flag = use_padding ? 1 : 0; |
| 81 | + if (!EVP_CIPHER_CTX_set_padding(en_ctx, padding_flag)) { |
| 82 | + EVP_CIPHER_CTX_free(en_ctx); |
| 83 | + throw std::runtime_error("Could not set padding mode for encryption: " + |
| 84 | + get_openssl_error_string()); |
| 85 | + } |
| 86 | + |
| 87 | + if (!EVP_EncryptUpdate(en_ctx, cipher, &len, |
| 88 | + reinterpret_cast<const unsigned char*>(plaintext), |
| 89 | + plaintext_len)) { |
| 90 | + EVP_CIPHER_CTX_free(en_ctx); |
| 91 | + throw std::runtime_error("Could not update EVP cipher context for encryption: " + |
| 92 | + get_openssl_error_string()); |
| 93 | + } |
| 94 | + |
| 95 | + cipher_len += len; |
| 96 | + |
| 97 | + if (!EVP_EncryptFinal_ex(en_ctx, cipher + len, &len)) { |
| 98 | + EVP_CIPHER_CTX_free(en_ctx); |
| 99 | + throw std::runtime_error("Could not finalize EVP cipher context for encryption: " + |
| 100 | + get_openssl_error_string()); |
| 101 | + } |
| 102 | + |
| 103 | + cipher_len += len; |
| 104 | + |
| 105 | + EVP_CIPHER_CTX_free(en_ctx); |
| 106 | + return cipher_len; |
| 107 | +} |
| 108 | + |
| 109 | +GANDIVA_EXPORT |
| 110 | +int32_t aes_decrypt_cbc(const char* ciphertext, int32_t ciphertext_len, const char* key, |
| 111 | + int32_t key_len, const char* iv, int32_t iv_len, |
| 112 | + bool use_padding, unsigned char* plaintext) { |
| 113 | + // Validate IV length |
| 114 | + if (iv_len != 16) { |
| 115 | + std::ostringstream oss; |
| 116 | + oss << "Invalid IV length for AES-CBC: " << iv_len |
| 117 | + << " bytes. IV must be exactly 16 bytes"; |
| 118 | + throw std::runtime_error(oss.str()); |
| 119 | + } |
| 120 | + |
| 121 | + int32_t plaintext_len = 0; |
| 122 | + int32_t len = 0; |
| 123 | + EVP_CIPHER_CTX* de_ctx = EVP_CIPHER_CTX_new(); |
| 124 | + const EVP_CIPHER* cipher_algo = get_cbc_cipher_algo(key_len); |
| 125 | + |
| 126 | + if (!de_ctx) { |
| 127 | + throw std::runtime_error("Could not create EVP cipher context for decryption: " + |
| 128 | + get_openssl_error_string()); |
| 129 | + } |
| 130 | + |
| 131 | + if (!EVP_DecryptInit_ex(de_ctx, cipher_algo, nullptr, |
| 132 | + reinterpret_cast<const unsigned char*>(key), |
| 133 | + reinterpret_cast<const unsigned char*>(iv))) { |
| 134 | + EVP_CIPHER_CTX_free(de_ctx); |
| 135 | + throw std::runtime_error("Could not initialize EVP cipher context for decryption: " + |
| 136 | + get_openssl_error_string()); |
| 137 | + } |
| 138 | + |
| 139 | + int padding_flag = use_padding ? 1 : 0; |
| 140 | + if (!EVP_CIPHER_CTX_set_padding(de_ctx, padding_flag)) { |
| 141 | + EVP_CIPHER_CTX_free(de_ctx); |
| 142 | + throw std::runtime_error("Could not set padding mode for decryption: " + |
| 143 | + get_openssl_error_string()); |
| 144 | + } |
| 145 | + |
| 146 | + if (!EVP_DecryptUpdate(de_ctx, plaintext, &len, |
| 147 | + reinterpret_cast<const unsigned char*>(ciphertext), |
| 148 | + ciphertext_len)) { |
| 149 | + EVP_CIPHER_CTX_free(de_ctx); |
| 150 | + throw std::runtime_error("Could not update EVP cipher context for decryption: " + |
| 151 | + get_openssl_error_string()); |
| 152 | + } |
| 153 | + |
| 154 | + plaintext_len += len; |
| 155 | + |
| 156 | + if (!EVP_DecryptFinal_ex(de_ctx, plaintext + len, &len)) { |
| 157 | + EVP_CIPHER_CTX_free(de_ctx); |
| 158 | + throw std::runtime_error("Could not finalize EVP cipher context for decryption: " + |
| 159 | + get_openssl_error_string()); |
| 160 | + } |
| 161 | + |
| 162 | + plaintext_len += len; |
| 163 | + |
| 164 | + EVP_CIPHER_CTX_free(de_ctx); |
| 165 | + return plaintext_len; |
| 166 | +} |
| 167 | + |
| 168 | +} // namespace gandiva |
| 169 | + |
0 commit comments