Skip to content

Commit 588542a

Browse files
jitendra-12113jitendra-12113
jitendra-12113
and
jitendra-12113
authored
[yugabyte#8335] [Platform] [API] EncryptionAtRestController error handling. (yugabyte#8474)
* Description: Use the new global exception handling in the EncryptionAtRestController. Test Plan: Its mostly refactor. Unit tests are updated. Run server and tested basic operations. * Description: Use the new global exception handling in the EncryptionAtRestController. Test Plan: Its mostly refactor. Unit tests are updated. Run server and tested basic operations. * Fix merge conflicts. Co-authored-by: jitendra-12113 <jitedra.kumar@hashedin.com>
1 parent cb64d5b commit 588542a

File tree

3 files changed

+224
-207
lines changed

3 files changed

+224
-207
lines changed

‎managed/src/main/java/com/yugabyte/yw/common/kms/util/EncryptionAtRestUtil.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import com.fasterxml.jackson.databind.ObjectMapper;
1515
import com.fasterxml.jackson.databind.node.ObjectNode;
1616
import com.yugabyte.yw.common.Util;
17+
import com.yugabyte.yw.common.YWServiceException;
1718
import com.yugabyte.yw.common.kms.algorithms.SupportedAlgorithmInterface;
1819
import com.yugabyte.yw.common.kms.services.EncryptionAtRestService;
1920
import com.yugabyte.yw.models.KmsConfig;
@@ -32,6 +33,7 @@
3233
import org.springframework.security.crypto.encrypt.TextEncryptor;
3334
import play.api.Play;
3435
import play.libs.Json;
36+
import static play.mvc.Http.Status.BAD_REQUEST;
3537

3638
public class EncryptionAtRestUtil {
3739
protected static final Logger LOG = LoggerFactory.getLogger(EncryptionAtRestUtil.class);
@@ -153,6 +155,7 @@ public static boolean keyRefExists(UUID universeUUID, byte[] keyRef) {
153155
KmsHistoryId.TargetType.UNIVERSE_KEY);
154156
}
155157

158+
@Deprecated
156159
public static KmsHistory getActiveKey(UUID universeUUID) {
157160
KmsHistory activeHistory = null;
158161
try {
@@ -230,6 +233,14 @@ public static void activateKeyRef(UUID universeUUID, UUID configUUID, byte[] key
230233
Base64.getEncoder().encodeToString(keyRef));
231234
}
232235

236+
public static KmsHistory getActiveKeyOrBadRequest(UUID universeUUID) {
237+
KmsHistory activeKey = getActiveKey(universeUUID);
238+
if(activeKey == null) {
239+
throw new YWServiceException(BAD_REQUEST, "Could not retrieve ActiveKey");
240+
}
241+
return activeKey;
242+
}
243+
233244
public static List<KmsHistory> getAllUniverseKeys(UUID universeUUID) {
234245
return KmsHistory.getAllTargetKeyRefs(universeUUID, KmsHistoryId.TargetType.UNIVERSE_KEY);
235246
}

‎managed/src/main/java/com/yugabyte/yw/controllers/EncryptionAtRestController.java‎

Lines changed: 162 additions & 163 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
import com.yugabyte.yw.commissioner.Commissioner;
1717
import com.yugabyte.yw.commissioner.tasks.params.KMSConfigTaskParams;
1818
import com.yugabyte.yw.common.ApiResponse;
19+
import com.yugabyte.yw.common.YWServiceException;
1920
import com.yugabyte.yw.common.kms.EncryptionAtRestManager;
2021
import com.yugabyte.yw.common.kms.util.EncryptionAtRestUtil;
2122
import com.yugabyte.yw.common.kms.util.KeyProvider;
@@ -35,61 +36,65 @@
3536
import java.util.stream.Collectors;
3637

3738
public class EncryptionAtRestController extends AuthenticatedController {
38-
public static final Logger LOG = LoggerFactory.getLogger(EncryptionAtRestController.class);
39-
40-
@Inject EncryptionAtRestManager keyManager;
41-
42-
@Inject Commissioner commissioner;
43-
44-
public Result createKMSConfig(UUID customerUUID, String keyProvider) {
45-
LOG.info(
46-
String.format(
47-
"Creating KMS configuration for customer %s with %s",
48-
customerUUID.toString(), keyProvider));
49-
try {
50-
TaskType taskType = TaskType.CreateKMSConfig;
51-
ObjectNode formData = (ObjectNode) request().body().asJson();
52-
KMSConfigTaskParams taskParams = new KMSConfigTaskParams();
53-
taskParams.kmsProvider = Enum.valueOf(KeyProvider.class, keyProvider);
54-
taskParams.providerConfig = formData;
55-
taskParams.customerUUID = customerUUID;
56-
taskParams.kmsConfigName = formData.get("name").asText();
57-
formData.remove("name");
58-
UUID taskUUID = commissioner.submit(taskType, taskParams);
59-
LOG.info("Submitted create KMS config for {}, task uuid = {}.", customerUUID, taskUUID);
60-
61-
// Add this task uuid to the user universe.
62-
CustomerTask.create(
63-
Customer.get(customerUUID),
64-
customerUUID,
65-
taskUUID,
66-
CustomerTask.TargetType.KMSConfiguration,
67-
CustomerTask.TaskType.Create,
68-
taskParams.getName());
69-
LOG.info(
70-
"Saved task uuid " + taskUUID + " in customer tasks table for customer: " + customerUUID);
71-
72-
auditService().createAuditEntry(ctx(), request(), formData);
73-
return new YWResults.YWTask(taskUUID).asResult();
74-
} catch (Exception e) {
75-
final String errMsg = "Error caught attempting to create KMS configuration";
76-
LOG.error(errMsg, e);
77-
return ApiResponse.error(BAD_REQUEST, e.getMessage());
39+
public static final Logger LOG = LoggerFactory.getLogger(EncryptionAtRestController.class);
40+
41+
@Inject
42+
EncryptionAtRestManager keyManager;
43+
44+
@Inject
45+
Commissioner commissioner;
46+
47+
public Result createKMSConfig(UUID customerUUID, String keyProvider) {
48+
LOG.info(String.format(
49+
"Creating KMS configuration for customer %s with %s",
50+
customerUUID.toString(),
51+
keyProvider
52+
));
53+
Customer customer = Customer.getOrBadRequest(customerUUID);
54+
try {
55+
TaskType taskType = TaskType.CreateKMSConfig;
56+
ObjectNode formData = (ObjectNode) request().body().asJson();
57+
KMSConfigTaskParams taskParams = new KMSConfigTaskParams();
58+
taskParams.kmsProvider = Enum.valueOf(KeyProvider.class, keyProvider);
59+
taskParams.providerConfig = formData;
60+
taskParams.customerUUID = customerUUID;
61+
taskParams.kmsConfigName = formData.get("name").asText();
62+
formData.remove("name");
63+
UUID taskUUID = commissioner.submit(taskType, taskParams);
64+
LOG.info("Submitted create KMS config for {}, task uuid = {}.", customerUUID, taskUUID);
65+
// Add this task uuid to the user universe.
66+
CustomerTask.create(customer,
67+
customerUUID,
68+
taskUUID,
69+
CustomerTask.TargetType.KMSConfiguration,
70+
CustomerTask.TaskType.Create,
71+
taskParams.getName());
72+
LOG.info("Saved task uuid " + taskUUID + " in customer tasks table for customer: " +
73+
customerUUID);
74+
75+
auditService().createAuditEntry(ctx(), request(), formData);
76+
return new YWResults.YWTask(taskUUID).asResult();
77+
} catch (Exception e) {
78+
throw new YWServiceException(BAD_REQUEST, e.getMessage());
79+
}
7880
}
79-
}
8081

81-
public Result getKMSConfig(UUID customerUUID, UUID configUUID) {
82-
LOG.info(String.format("Retrieving KMS configuration %s", configUUID.toString()));
83-
KmsConfig config = KmsConfig.get(configUUID);
84-
ObjectNode kmsConfig =
85-
keyManager.getServiceInstance(config.keyProvider.name()).getAuthConfig(configUUID);
86-
if (kmsConfig == null) {
87-
return ApiResponse.error(
88-
BAD_REQUEST,
89-
String.format("No KMS configuration found for config %s", configUUID.toString()));
82+
public Result getKMSConfig(UUID customerUUID, UUID configUUID) {
83+
LOG.info(String.format(
84+
"Retrieving KMS configuration %s",
85+
configUUID.toString()
86+
));
87+
KmsConfig config = KmsConfig.get(configUUID);
88+
ObjectNode kmsConfig = keyManager.getServiceInstance(config.keyProvider.name())
89+
.getAuthConfig(configUUID);
90+
if (kmsConfig == null) {
91+
throw new YWServiceException(BAD_REQUEST, String.format(
92+
"No KMS configuration found for config %s",
93+
configUUID.toString()
94+
));
95+
}
96+
return ApiResponse.success(kmsConfig);
9097
}
91-
return ApiResponse.success(kmsConfig);
92-
}
9398

9499
public Result listKMSConfigs(UUID customerUUID) {
95100
LOG.info(String.format("Listing KMS configurations for customer %s", customerUUID.toString()));
@@ -125,126 +130,120 @@ public Result listKMSConfigs(UUID customerUUID) {
125130
return ApiResponse.success(kmsConfigs);
126131
}
127132

128-
public Result deleteKMSConfig(UUID customerUUID, UUID configUUID) {
129-
LOG.info(
130-
String.format(
131-
"Deleting KMS configuration %s for customer %s",
132-
configUUID.toString(), customerUUID.toString()));
133-
try {
134-
KmsConfig config = KmsConfig.get(configUUID);
135-
TaskType taskType = TaskType.DeleteKMSConfig;
136-
KMSConfigTaskParams taskParams = new KMSConfigTaskParams();
137-
taskParams.kmsProvider = config.keyProvider;
138-
taskParams.customerUUID = customerUUID;
139-
taskParams.configUUID = configUUID;
140-
UUID taskUUID = commissioner.submit(taskType, taskParams);
141-
LOG.info("Submitted delete KMS config for {}, task uuid = {}.", customerUUID, taskUUID);
142-
143-
// Add this task uuid to the user universe.
144-
CustomerTask.create(
145-
Customer.get(customerUUID),
146-
customerUUID,
147-
taskUUID,
148-
CustomerTask.TargetType.KMSConfiguration,
149-
CustomerTask.TaskType.Delete,
150-
taskParams.getName());
151-
LOG.info(
152-
"Saved task uuid " + taskUUID + " in customer tasks table for customer: " + customerUUID);
153-
154-
auditService().createAuditEntry(ctx(), request());
155-
return new YWResults.YWTask(taskUUID).asResult();
156-
} catch (Exception e) {
157-
final String errMsg = "Error caught attempting to delete KMS configuration";
158-
LOG.error(errMsg, e);
159-
return ApiResponse.error(BAD_REQUEST, e.getMessage());
133+
public Result deleteKMSConfig(UUID customerUUID, UUID configUUID) {
134+
LOG.info(String.format(
135+
"Deleting KMS configuration %s for customer %s",
136+
configUUID.toString(),
137+
customerUUID.toString()
138+
));
139+
Customer customer = Customer.getOrBadRequest(customerUUID);
140+
try {
141+
KmsConfig config = KmsConfig.get(configUUID);
142+
TaskType taskType = TaskType.DeleteKMSConfig;
143+
KMSConfigTaskParams taskParams = new KMSConfigTaskParams();
144+
taskParams.kmsProvider = config.keyProvider;
145+
taskParams.customerUUID = customerUUID;
146+
taskParams.configUUID = configUUID;
147+
UUID taskUUID = commissioner.submit(taskType, taskParams);
148+
LOG.info("Submitted delete KMS config for {}, task uuid = {}.", customerUUID, taskUUID);
149+
150+
// Add this task uuid to the user universe.
151+
CustomerTask.create(customer,
152+
customerUUID,
153+
taskUUID,
154+
CustomerTask.TargetType.KMSConfiguration,
155+
CustomerTask.TaskType.Delete,
156+
taskParams.getName());
157+
LOG.info("Saved task uuid " + taskUUID + " in customer tasks table for customer: " +
158+
customerUUID);
159+
auditService().createAuditEntry(ctx(), request());
160+
return new YWResults.YWTask(taskUUID).asResult();
161+
} catch (Exception e) {
162+
throw new YWServiceException(BAD_REQUEST, e.getMessage());
163+
}
164+
}
165+
166+
public Result retrieveKey(UUID customerUUID, UUID universeUUID) {
167+
LOG.info(String.format(
168+
"Retrieving universe key for universe %s",
169+
customerUUID.toString(),
170+
universeUUID.toString()
171+
));
172+
ObjectNode formData = (ObjectNode) request().body().asJson();
173+
byte[] keyRef = Base64.getDecoder().decode(formData.get("reference").asText());
174+
UUID configUUID = UUID.fromString(formData.get("configUUID").asText());
175+
byte[] recoveredKey = getRecoveredKeyOrBadRequest(
176+
universeUUID,
177+
configUUID,
178+
keyRef
179+
);
180+
ObjectNode result = Json.newObject()
181+
.put("reference", keyRef)
182+
.put("value", Base64.getEncoder().encodeToString(recoveredKey));
183+
auditService().createAuditEntry(ctx(), request(), formData);
184+
return ApiResponse.success(result);
160185
}
161-
}
162186

163-
public Result retrieveKey(UUID customerUUID, UUID universeUUID) {
164-
LOG.info(
165-
String.format(
166-
"Retrieving universe key for universe %s",
167-
customerUUID.toString(), universeUUID.toString()));
168-
byte[] keyRef = null;
169-
byte[] recoveredKey = null;
170-
try {
171-
ObjectNode formData = (ObjectNode) request().body().asJson();
172-
keyRef = Base64.getDecoder().decode(formData.get("reference").asText());
173-
UUID configUUID = UUID.fromString(formData.get("configUUID").asText());
174-
recoveredKey = keyManager.getUniverseKey(universeUUID, configUUID, keyRef);
187+
public byte[] getRecoveredKeyOrBadRequest(UUID universeUUID, UUID configUUID, byte[] keyRef) {
188+
byte[] recoveredKey = keyManager.getUniverseKey(universeUUID, configUUID, keyRef);
175189
if (recoveredKey == null || recoveredKey.length == 0) {
176-
final String errMsg =
177-
String.format("No universe key found for universe %s", universeUUID.toString());
178-
throw new RuntimeException(errMsg);
190+
final String errMsg = String.format(
191+
"No universe key found for universe %s",
192+
universeUUID.toString()
193+
);
194+
throw new YWServiceException(BAD_REQUEST, errMsg);
179195
}
180-
ObjectNode result =
181-
Json.newObject()
182-
.put("reference", keyRef)
183-
.put("value", Base64.getEncoder().encodeToString(recoveredKey));
184-
auditService().createAuditEntry(ctx(), request(), formData);
185-
return ApiResponse.success(result);
186-
} catch (Exception e) {
187-
final String errMsg =
188-
String.format("Could not recover universe key from universe %s", universeUUID.toString());
189-
LOG.error(errMsg, e);
190-
return ApiResponse.error(BAD_REQUEST, e.getMessage());
196+
return recoveredKey;
191197
}
192-
}
193198

194-
public Result getKeyRefHistory(UUID customerUUID, UUID universeUUID) {
195-
LOG.info(
196-
String.format(
197-
"Retrieving key ref history for customer %s and universe %s",
198-
customerUUID.toString(), universeUUID.toString()));
199-
try {
200-
return ApiResponse.success(
201-
KmsHistory.getAllTargetKeyRefs(universeUUID, KmsHistoryId.TargetType.UNIVERSE_KEY)
202-
.stream()
203-
.map(
204-
history -> {
205-
return Json.newObject()
206-
.put("reference", history.uuid.keyRef)
207-
.put("configUUID", history.configUuid.toString())
208-
.put("timestamp", history.timestamp.toString());
209-
})
210-
.collect(Collectors.toList()));
211-
} catch (Exception e) {
212-
return ApiResponse.error(BAD_REQUEST, e.getMessage());
199+
public Result getKeyRefHistory(UUID customerUUID, UUID universeUUID) {
200+
LOG.info(String.format(
201+
"Retrieving key ref history for customer %s and universe %s",
202+
customerUUID.toString(),
203+
universeUUID.toString()
204+
));
205+
return ApiResponse.success(KmsHistory.getAllTargetKeyRefs(
206+
universeUUID,
207+
KmsHistoryId.TargetType.UNIVERSE_KEY
208+
)
209+
.stream()
210+
.map(history -> {
211+
return Json.newObject()
212+
.put("reference", history.uuid.keyRef)
213+
.put("configUUID", history.configUuid.toString())
214+
.put("timestamp", history.timestamp.toString());
215+
})
216+
.collect(Collectors.toList()));
213217
}
214-
}
215218

216-
public Result removeKeyRefHistory(UUID customerUUID, UUID universeUUID) {
217-
LOG.info(
218-
String.format(
219-
"Removing key ref for customer %s with universe %s",
220-
customerUUID.toString(), universeUUID.toString()));
221-
try {
222-
keyManager.cleanupEncryptionAtRest(customerUUID, universeUUID);
223-
auditService().createAuditEntry(ctx(), request());
224-
return YWResults.YWSuccess.withMessage("Key ref was successfully removed");
225-
} catch (Exception e) {
226-
return ApiResponse.error(BAD_REQUEST, e.getMessage());
219+
public Result removeKeyRefHistory(UUID customerUUID, UUID universeUUID) {
220+
LOG.info(String.format(
221+
"Removing key ref for customer %s with universe %s",
222+
customerUUID.toString(),
223+
universeUUID.toString()
224+
));
225+
keyManager.cleanupEncryptionAtRest(customerUUID, universeUUID);
226+
auditService().createAuditEntry(ctx(), request());
227+
return YWResults.YWSuccess.withMessage("Key ref was successfully removed");
227228
}
228-
}
229229

230-
public Result getCurrentKeyRef(UUID customerUUID, UUID universeUUID) {
231-
LOG.info(
232-
String.format(
233-
"Retrieving key ref for customer %s and universe %s",
234-
customerUUID.toString(), universeUUID.toString()));
235-
try {
236-
KmsHistory activeKey = EncryptionAtRestUtil.getActiveKey(universeUUID);
237-
String keyRef = activeKey.uuid.keyRef;
238-
if (keyRef == null || keyRef.length() == 0) {
239-
return ApiResponse.error(
240-
BAD_REQUEST,
241-
String.format(
242-
"Could not retrieve key service for customer %s and universe %s",
243-
customerUUID.toString(), universeUUID.toString()));
244-
}
245-
return ApiResponse.success(Json.newObject().put("reference", keyRef));
246-
} catch (Exception e) {
247-
return ApiResponse.error(BAD_REQUEST, e.getMessage());
248-
}
230+
public Result getCurrentKeyRef(UUID customerUUID, UUID universeUUID) {
231+
LOG.info(String.format(
232+
"Retrieving key ref for customer %s and universe %s",
233+
customerUUID.toString(),
234+
universeUUID.toString()
235+
));
236+
KmsHistory activeKey = EncryptionAtRestUtil.getActiveKeyOrBadRequest(universeUUID);
237+
String keyRef = activeKey.uuid.keyRef;
238+
if (keyRef == null || keyRef.length() == 0) {
239+
throw new YWServiceException(BAD_REQUEST, String.format(
240+
"Could not retrieve key service for customer %s and universe %s",
241+
customerUUID.toString(),
242+
universeUUID.toString()
243+
));
244+
}
245+
return ApiResponse.success(Json.newObject().put(
246+
"reference", keyRef
247+
));
249248
}
250249
}

0 commit comments

Comments
 (0)