Skip to content

Commit e2f8819

Browse files
philasmarphilasmar
committed
feat: add support for .NET SDK V4
1 parent 6ce1cef commit e2f8819

34 files changed

+176
-2966
lines changed

‎.autover/autover.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"Projects": [
3+
{
4+
"Name": "Amazon.Extensions.S3.Encryption",
5+
"Path": "src/Amazon.Extensions.S3.Encryption.csproj"
6+
}
7+
],
8+
"UseCommitsForChangelog": false,
9+
"DefaultIncrementType": "Patch",
10+
"ChangeFilesDetermineIncrementType": true
11+
}

‎.autover/changes/23815243-2304-410c-bf18-b621e5931839.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"Projects": [
3+
{
4+
"Name": "Amazon.Extensions.S3.Encryption",
5+
"Type": "Patch",
6+
"ChangelogMessages": [
7+
"Dropped support for .NET Framework 3.5, updated .NET Framework 4.5 to .NET Framework 4.7.2 and added .NET 8 support",
8+
"Updated the .NET SDK dependencies to the latest version 4.0.0-preview.2",
9+
"Updated the `Portable.BouncyCastle` dependency to `BouncyCastle.Cryptography`"
10+
]
11+
}
12+
]
13+
}

‎CHANGELOG.md‎

Lines changed: 52 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,65 @@
1-
# Change log
1+
## Release 2024-09-03
22

3-
## 2.1.2 (2024-09-03)
4-
- Fixed issue with AmazonS3EncryptionClientV2 and uploading multipart objects triggering a "HashStream does not support base streams that are not capable of reading or writing" error.
3+
### Amazon.Extensions.S3.Encryption (2.1.2)
4+
* Fixed issue with AmazonS3EncryptionClientV2 and uploading multipart objects triggering a "HashStream does not support base streams that are not capable of reading or writing" error.
55

6-
## 2.1.1 (2024-04-20)
7-
- Update User-Agent string
6+
## Release 2024-04-20
87

9-
## 2.1.0 (2023-08-17)
10-
- Added KmsConfig to the client configuration, which allows users to configure the region, service URL, timeout, and other settings of the internal KMS client independently of the S3 client.
8+
### Amazon.Extensions.S3.Encryption (2.1.1)
9+
* Update User-Agent string
1110

12-
## 2.0.5 (2023-02-13)
13-
- Fixed issue when AWS SES is configured to send encrypted emails to S3 bucket, and then email fails to be decrypted by Amazon.Extensions.S3.Encryption
11+
## Release 2023-08-17
1412

15-
## 2.0.4 (2023-02-11)
16-
- Pull request [#32](https://github.com/aws/amazon-s3-encryption-client-dotnet/pull/32) Set KMS client config's timeout property. Thanks [1rjt](https://github.com/1rjt)
13+
### Amazon.Extensions.S3.Encryption (2.1.0)
14+
* Added KmsConfig to the client configuration, which allows users to configure the region, service URL, timeout, and other settings of the internal KMS client independently of the S3 client.
1715

18-
## 2.0.3 (2021-08-11)
19-
- Update Portable.BouncyCastle dependency to version 1.8.10
16+
## Release 2023-02-13
2017

21-
## 2.0.2 (2021-06-08)
22-
- Added ability to handle CalculateContentMD5Header flag for S3 uploads.
18+
### Amazon.Extensions.S3.Encryption (2.0.5)
19+
* Fixed issue when AWS SES is configured to send encrypted emails to S3 bucket, and then email fails to be decrypted by Amazon.Extensions.S3.Encryption
2320

24-
## 2.0.1 (2021-04-14)
25-
- fix: update AWSSDK.Core, AWSSDK.S3, AWSSDK.KeyManagementService versions
21+
## Release 2023-02-11
2622

27-
## 2.0.0 (2021-03-29)
28-
- Netstandard 1.3 support removed
29-
- AWS SDK dependencies updated to v3.7
23+
### Amazon.Extensions.S3.Encryption (2.0.4)
24+
* Pull request [#32](https://github.com/aws/amazon-s3-encryption-client-dotnet/pull/32) Set KMS client config's timeout property. Thanks [1rjt](https://github.com/1rjt)
3025

31-
## 1.2.1 (2021-01-14)
32-
- fix: update bouncy castle dependency versions
26+
## Release 2021-08-11
3327

34-
## 1.2.0 (2020-10-09)
35-
- Fix issue creating KMS client.
28+
### Amazon.Extensions.S3.Encryption (2.0.3)
29+
* Update Portable.BouncyCastle dependency to version 1.8.10
3630

37-
## 1.1.0 (2020-09-11)
38-
- Add ConcurrentDictionary to allow performing multipart uploads in multiple threads.
31+
## Release 2021-06-08
3932

40-
## 1.0.0 (2020-08-07)
41-
- Initial release
33+
### Amazon.Extensions.S3.Encryption (2.0.2)
34+
* Added ability to handle CalculateContentMD5Header flag for S3 uploads.
35+
36+
## Release 2021-04-14
37+
38+
### Amazon.Extensions.S3.Encryption (2.0.1)
39+
* fix: update AWSSDK.Core, AWSSDK.S3, AWSSDK.KeyManagementService versions
40+
41+
## Release 2021-03-29
42+
43+
### Amazon.Extensions.S3.Encryption (2.0.0)
44+
* Netstandard 1.3 support removed
45+
* AWS SDK dependencies updated to v3.7
46+
47+
## Release 2021-01-14
48+
49+
### Amazon.Extensions.S3.Encryption (1.2.1)
50+
* fix: update bouncy castle dependency versions
51+
52+
## Release 2020-10-09
53+
54+
### Amazon.Extensions.S3.Encryption (1.2.0)
55+
* Fix issue creating KMS client.
56+
57+
## Release 2020-09-11
58+
59+
### Amazon.Extensions.S3.Encryption (1.1.0)
60+
* Add ConcurrentDictionary to allow performing multipart uploads in multiple threads.
61+
62+
## Release 2020-08-07
63+
64+
### Amazon.Extensions.S3.Encryption (1.0.0)
65+
* Initial release

‎src/Amazon.Extensions.S3.Encryption.csproj‎

Lines changed: 13 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFrameworks>net35;net45;netstandard2.0;netcoreapp3.1</TargetFrameworks>
5-
<Version>2.1.2</Version>
4+
<TargetFrameworks>net472;netstandard2.0;netcoreapp3.1;net8.0</TargetFrameworks>
5+
<Version>3.0.0-preview.1</Version>
66
<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
77
<PackageId>Amazon.Extensions.S3.Encryption</PackageId>
88
<Title>Amazon S3 Encryption Client for .NET</Title>
@@ -15,43 +15,27 @@
1515
<PackageIcon>icon.png</PackageIcon>
1616
<RepositoryUrl>https://github.com/aws/amazon-s3-encryption-client-dotnet/</RepositoryUrl>
1717
<Company>Amazon Web Services</Company>
18-
<AssemblyVersion>2.1.2</AssemblyVersion>
19-
<FileVersion>2.1.2</FileVersion>
20-
2118
<SignAssembly>true</SignAssembly>
2219
<AssemblyOriginatorKeyFile>..\public.snk</AssemblyOriginatorKeyFile>
23-
24-
<!-- workaround per https://github.com/Microsoft/msbuild/issues/1333 -->
25-
<FrameworkPathOverride Condition="'$(TargetFramework)' == 'net35'">C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v3.5\Profile\Client</FrameworkPathOverride>
26-
27-
<!-- workaround per https://github.com/dotnet/msbuild/issues/5985 -->
28-
<AutomaticallyUseReferenceAssemblyPackages Condition=" '$(TargetFramework)' == 'net35' ">false</AutomaticallyUseReferenceAssemblyPackages>
20+
<PackageReadmeFile>README.md</PackageReadmeFile>
21+
</PropertyGroup>
22+
23+
<PropertyGroup Condition="'$(TargetFramework)' == 'net472'">
24+
<AssemblyVersion>3.0.0</AssemblyVersion>
2925
</PropertyGroup>
3026

3127
<ItemGroup>
3228
<None Include="../LICENSE" Pack="true" PackagePath="" />
3329
<None Include="../icon.png" Pack="true" PackagePath="" />
30+
<None Include="../README.md" Pack="true" PackagePath="" />
3431
</ItemGroup>
3532

36-
<PropertyGroup>
37-
<DefineConstants Condition="'$(TargetFramework)' == 'net35'">$(DefineConstants);BCL;BCL35;AWS_APM_API</DefineConstants>
38-
<DefineConstants Condition="'$(TargetFramework)' == 'net45'">$(DefineConstants);BCL;BCL45;AWS_ASYNC_API</DefineConstants>
39-
<DefineConstants Condition="'$(TargetFramework)' == 'netstandard2.0'">$(DefineConstants);NETSTANDARD;AWS_ASYNC_API</DefineConstants>
40-
<DefineConstants Condition="'$(TargetFramework)' == 'netcoreapp3.1'">$(DefineConstants);NETSTANDARD;AWS_ASYNC_API</DefineConstants>
41-
</PropertyGroup>
42-
4333
<ItemGroup>
44-
<PackageReference Include="AWSSDK.Core" Version="3.7.303.14" />
45-
<PackageReference Include="AWSSDK.S3" Version="3.7.307.15" />
46-
<PackageReference Include="AWSSDK.KeyManagementService" Version="3.7.301.15" />
47-
</ItemGroup>
48-
49-
<ItemGroup Condition="'$(TargetFramework)' == 'net35'">
50-
<PackageReference Include="BouncyCastle" Version="1.8.9" />
51-
</ItemGroup>
52-
53-
<ItemGroup Condition="'$(TargetFramework)' == 'net45' Or '$(TargetFramework)' == 'netstandard2.0' Or '$(TargetFramework)' == 'netcoreapp3.1'">
54-
<PackageReference Include="Portable.BouncyCastle" Version="1.8.10" />
34+
<PackageReference Include="AWSSDK.Core" Version="4.0.0-preview.2" />
35+
<PackageReference Include="AWSSDK.S3" Version="4.0.0-preview.2" />
36+
<PackageReference Include="AWSSDK.KeyManagementService" Version="4.0.0-preview.2" />
37+
<PackageReference Include="BouncyCastle.Cryptography" Version="2.4.0" />
38+
<PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Version="8.0.0" />
5539
</ItemGroup>
5640

5741
</Project>

‎src/AmazonCryptoException.cs‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -21,27 +21,13 @@ namespace Amazon.Extensions.S3.Encryption
2121
/// <summary>
2222
/// Exception thrown by the SDK for errors that occur within the SDK for crypto operations.
2323
/// </summary>
24-
#if !PCL && !NETSTANDARD
24+
#if !PCL && NETFRAMEWORK
2525
[Serializable]
2626
#endif
2727
public class AmazonCryptoException : Exception
2828
{
2929
public AmazonCryptoException(string message) : base(message) { }
3030

3131
public AmazonCryptoException(string message, Exception innerException) : base(message, innerException) { }
32-
33-
#if !PCL && !NETSTANDARD
34-
/// <summary>
35-
/// Constructs a new instance of the AmazonCryptoException class with serialized data.
36-
/// </summary>
37-
/// <param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
38-
/// <param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
39-
/// <exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
40-
/// <exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
41-
protected AmazonCryptoException(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context)
42-
: base(info, context)
43-
{
44-
}
45-
#endif
4632
}
4733
}

‎src/AmazonS3CryptoConfigurationV2.cs‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,7 @@
1313
* permissions and limitations under the License.
1414
*/
1515

16-
using System;
17-
using System.Collections.Generic;
18-
using System.Linq;
19-
using System.Text;
2016
using Amazon.Runtime.Internal.Util;
21-
using Amazon.S3;
22-
using System;
23-
using System.Collections.Generic;
24-
using Amazon.Runtime;
25-
using Amazon.S3.Model;
26-
using Amazon.Runtime.Internal;
27-
using Amazon.S3;
2817

2918
namespace Amazon.Extensions.S3.Encryption
3019
{

‎src/AmazonS3EncryptionClientBase.cs‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -92,17 +92,10 @@ internal AmazonS3Client S3ClientForInstructionFile
9292
}
9393

9494
internal AmazonS3CryptoConfigurationBase S3CryptoConfig { get; set; }
95-
#if BCL35
96-
internal readonly Amazon.Extensions.S3.Encryption.Utils.ConcurrentDictionary<string, UploadPartEncryptionContext> CurrentMultiPartUploadKeys =
97-
new Amazon.Extensions.S3.Encryption.Utils.ConcurrentDictionary<string, UploadPartEncryptionContext>();
98-
internal readonly Amazon.Extensions.S3.Encryption.Utils.ConcurrentDictionary<InitiateMultipartUploadRequest, UploadPartEncryptionContext> AllMultiPartUploadRequestContexts =
99-
new Amazon.Extensions.S3.Encryption.Utils.ConcurrentDictionary<InitiateMultipartUploadRequest, UploadPartEncryptionContext>();
100-
#else
10195
internal readonly System.Collections.Concurrent.ConcurrentDictionary<string, UploadPartEncryptionContext> CurrentMultiPartUploadKeys =
10296
new System.Collections.Concurrent.ConcurrentDictionary<string, UploadPartEncryptionContext>();
10397
internal readonly System.Collections.Concurrent.ConcurrentDictionary<InitiateMultipartUploadRequest, UploadPartEncryptionContext> AllMultiPartUploadRequestContexts =
10498
new System.Collections.Concurrent.ConcurrentDictionary<InitiateMultipartUploadRequest, UploadPartEncryptionContext>();
105-
#endif
10699
internal const string S3CryptoStream = "S3-Crypto-Stream";
107100

108101
#region Constructors

‎src/AmazonS3EncryptionClientV2.cs‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,6 @@ protected override void CustomizeRuntimePipeline(RuntimePipeline pipeline)
6868
pipeline.AddHandlerBefore<Amazon.S3.Internal.AmazonS3ResponseHandler>(new SetupDecryptionHandlerV2(this));
6969
}
7070

71-
#if AWS_ASYNC_API
72-
7371
/// <summary>
7472
/// Retrieves objects from Amazon S3. To use <c>GET</c>, you must have <c>READ</c>
7573
/// access to the object. If you grant <c>READ</c> access to the anonymous user,
@@ -723,9 +721,8 @@ public override System.Threading.Tasks.Task<GetObjectResponse> GetObjectAsync(st
723721
{
724722
return base.GetObjectAsync(bucketName, key, versionId, cancellationToken);
725723
}
726-
#endif
727724

728-
#if BCL
725+
#if NETFRAMEWORK
729726
/// <summary>
730727
/// Retrieves objects from Amazon S3. To use <c>GET</c>, you must have <c>READ</c>
731728
/// access to the object. If you grant <c>READ</c> access to the anonymous user,

‎src/EncryptionUtils.cs‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
using Amazon.KeyManagementService;
2626
using Amazon.Runtime.SharedInterfaces;
2727
using Amazon.Extensions.S3.Encryption.Util;
28+
using Amazon.KeyManagementService.Model;
2829

2930
namespace Amazon.Extensions.S3.Encryption
3031
{
@@ -86,7 +87,7 @@ internal static partial class EncryptionUtils
8687

8788
private static byte[] EncryptEnvelopeKeyUsingAsymmetricKeyPair(AsymmetricAlgorithm asymmetricAlgorithm, byte[] envelopeKey)
8889
{
89-
#if NETSTANDARD
90+
#if !NETFRAMEWORK
9091
RSA rsaCrypto = asymmetricAlgorithm as RSA;
9192
if (rsaCrypto == null)
9293
{
@@ -133,7 +134,7 @@ internal static byte[] DecryptNonKMSEnvelopeKey(byte[] encryptedEnvelopeKey, Enc
133134

134135
private static byte[] DecryptEnvelopeKeyUsingAsymmetricKeyPair(AsymmetricAlgorithm asymmetricAlgorithm, byte[] encryptedEnvelopeKey)
135136
{
136-
#if NETSTANDARD
137+
#if !NETFRAMEWORK
137138
RSA rsaCrypto = asymmetricAlgorithm as RSA;
138139
if (rsaCrypto == null)
139140
{
@@ -245,6 +246,7 @@ internal static void DecryptObjectUsingInstructionsGcm(GetObjectResponse respons
245246

246247
#region InstructionGeneration
247248

249+
#if NETFRAMEWORK
248250
/// <summary>
249251
/// Generates an instruction that will be used to encrypt an object
250252
/// using materials with the KMSKeyID set.
@@ -269,14 +271,18 @@ internal static EncryptionInstructions GenerateInstructionsForKMSMaterials(IAmaz
269271

270272
// Generate IV, and get both the key and the encrypted key from KMS.
271273
RandomNumberGenerator.Create().GetBytes(iv);
272-
var generateDataKeyResult = kmsClient.GenerateDataKey(materials.KMSKeyID, materials.MaterialsDescription, KMSKeySpec);
274+
var generateDataKeyResult = kmsClient.GenerateDataKey(new GenerateDataKeyRequest
275+
{
276+
KeyId = materials.KMSKeyID,
277+
EncryptionContext = materials.MaterialsDescription,
278+
KeySpec = KMSKeySpec
279+
});
273280

274-
return new EncryptionInstructions(materials.MaterialsDescription, generateDataKeyResult.KeyPlaintext, generateDataKeyResult.KeyCiphertext, iv,
281+
return new EncryptionInstructions(materials.MaterialsDescription, generateDataKeyResult.Plaintext.ToArray(), generateDataKeyResult.CiphertextBlob.ToArray(), iv,
275282
XAmzWrapAlgKmsValue, XAmzAesCbcPaddingCekAlgValue);
276283
}
277-
278-
#if AWS_ASYNC_API
279-
284+
#endif
285+
280286
/// <summary>
281287
/// Generates an instruction that will be used to encrypt an object
282288
/// using materials with the KMSKeyID set.
@@ -302,14 +308,17 @@ internal static async System.Threading.Tasks.Task<EncryptionInstructions> Genera
302308

303309
// Generate IV, and get both the key and the encrypted key from KMS.
304310
RandomNumberGenerator.Create().GetBytes(iv);
305-
var generateDataKeyResult = await kmsClient.GenerateDataKeyAsync(materials.KMSKeyID, materials.MaterialsDescription, KMSKeySpec).ConfigureAwait(false);
311+
var generateDataKeyResult = await kmsClient.GenerateDataKeyAsync(new GenerateDataKeyRequest
312+
{
313+
KeyId = materials.KMSKeyID,
314+
EncryptionContext = materials.MaterialsDescription,
315+
KeySpec = KMSKeySpec
316+
}).ConfigureAwait(false);
306317

307-
return new EncryptionInstructions(materials.MaterialsDescription, generateDataKeyResult.KeyPlaintext, generateDataKeyResult.KeyCiphertext, iv,
318+
return new EncryptionInstructions(materials.MaterialsDescription, generateDataKeyResult.Plaintext.ToArray(), generateDataKeyResult.CiphertextBlob.ToArray(), iv,
308319
XAmzWrapAlgKmsValue, XAmzAesCbcPaddingCekAlgValue);
309320
}
310321

311-
#endif
312-
313322
/// <summary>
314323
/// Generates an instruction that will be used to encrypt an object
315324
/// using materials with the AsymmetricProvider or SymmetricProvider set.
@@ -354,15 +363,19 @@ internal static void EnsureSupportedAlgorithms(MetadataCollection metadata)
354363
var xAmzWrapAlgMetadataValue = metadata[XAmzWrapAlg];
355364
if (!SupportedWrapAlgorithms.Contains(xAmzWrapAlgMetadataValue))
356365
{
366+
#pragma warning disable 0618
357367
throw new InvalidDataException($"Value '{xAmzWrapAlgMetadataValue}' for metadata key '{XAmzWrapAlg}' is invalid." +
358368
$"{typeof(AmazonS3EncryptionClient).Name} only supports '{XAmzWrapAlgKmsValue}' as the key wrap algorithm. {ModeMessage}");
369+
#pragma warning restore 0618
359370
}
360371

361372
var xAmzCekAlgMetadataValue = metadata[XAmzCekAlg];
362373
if (!(SupportedCekAlgorithms.Contains(xAmzCekAlgMetadataValue)))
374+
#pragma warning disable 0618
363375
throw new InvalidDataException(string.Format(CultureInfo.InvariantCulture,
364376
"Value '{0}' for metadata key '{1}' is invalid. {2} only supports '{3}' as the content encryption algorithm. {4}",
365377
xAmzCekAlgMetadataValue, XAmzCekAlg, typeof(AmazonS3EncryptionClient).Name, XAmzAesCbcPaddingCekAlgValue, ModeMessage));
378+
#pragma warning restore 0618
366379
}
367380
}
368381

@@ -399,7 +412,6 @@ internal static EncryptionInstructions BuildInstructionsFromObjectMetadata(
399412
var cekAlgorithm = metadata[XAmzCekAlg];
400413
var wrapAlgorithm = metadata[XAmzWrapAlg];
401414

402-
EncryptionInstructions instructions;
403415
if (decryptedEnvelopeKeyKMS != null)
404416
{
405417
return new EncryptionInstructions(materialDescription, decryptedEnvelopeKeyKMS, encryptedEnvelopeKey, IV, wrapAlgorithm, cekAlgorithm);

0 commit comments

Comments
 (0)