meta: support sm for format encryption (#6419)

Signed-off-by: jiefenghuang <[email protected]>

Author: jiefenghuang

pkg/meta/config.go

@@ -27,6 +27,9 @@ import (
 	"io"
 	"time"
 
+	"github.com/emmansun/gmsm/sm3"
+	"github.com/emmansun/gmsm/sm4"
+	"github.com/juicedata/juicefs/pkg/object"
 	"github.com/juicedata/juicefs/pkg/version"
 	"github.com/pkg/errors"
 )
@@ -187,31 +190,52 @@ func (f *Format) CheckCliVersion(ver *version.Semver) error {
 	return nil
 }
 
+func newCipher(algo string, key string) (cipher.AEAD, error) {
+	switch algo {
+	case object.SM4GCM:
+		block, err := sm4.NewCipher(sm3.Kdf([]byte(key), 16))
+		if err != nil {
+			return nil, fmt.Errorf("new sm4 cipher: %s", err)
+		}
+		aead, err := cipher.NewGCM(block)
+		if err != nil {
+			return nil, fmt.Errorf("new sm4 GCM: %s", err)
+		}
+		return aead, nil
+	default:
+		hashKey := md5.Sum([]byte(key))
+		block, err := aes.NewCipher(hashKey[:])
+		if err != nil {
+			return nil, fmt.Errorf("new cipher: %s", err)
+		}
+		aead, err := cipher.NewGCM(block)
+		if err != nil {
+			return nil, fmt.Errorf("new GCM: %s", err)
+		}
+		return aead, nil
+	}
+}
+
 func (f *Format) Encrypt() error {
 	if f.KeyEncrypted || f.SecretKey == "" && f.EncryptKey == "" && f.SessionToken == "" {
 		return nil
 	}
-	key := md5.Sum([]byte(f.UUID))
-	block, err := aes.NewCipher(key[:])
-	if err != nil {
-		return fmt.Errorf("new cipher: %s", err)
-	}
-	aesgcm, err := cipher.NewGCM(block)
+	ci, err := newCipher(f.EncryptAlgo, f.UUID)
 	if err != nil {
-		return fmt.Errorf("new GCM: %s", err)
+		return err
 	}
 	encrypt := func(k *string) {
 		if *k == "" {
 			return
 		}
-		nonce := make([]byte, 12)
+		nonce := make([]byte, ci.NonceSize())
 		if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
 			logger.Fatalf("generate nonce for secret key: %s", err)
 		}
-		ciphertext := aesgcm.Seal(nil, nonce, []byte(*k), nil)
-		buf := make([]byte, 12+len(ciphertext))
+		ciphertext := ci.Seal(nil, nonce, []byte(*k), nil)
+		buf := make([]byte, ci.NonceSize()+len(ciphertext))
 		copy(buf, nonce)
-		copy(buf[12:], ciphertext)
+		copy(buf[ci.NonceSize():], ciphertext)
 		*k = base64.StdEncoding.EncodeToString(buf)
 	}
 
@@ -226,14 +250,10 @@ func (f *Format) Decrypt() error {
 	if !f.KeyEncrypted {
 		return nil
 	}
-	key := md5.Sum([]byte(f.UUID))
-	block, err := aes.NewCipher(key[:])
-	if err != nil {
-		return fmt.Errorf("new cipher: %s", err)
-	}
-	aesgcm, err := cipher.NewGCM(block)
+
+	ci, err := newCipher(f.EncryptAlgo, f.UUID)
 	if err != nil {
-		return fmt.Errorf("new GCM: %s", err)
+		return err
 	}
 	decrypt := func(k *string) {
 		if *k == "" {
@@ -248,7 +268,7 @@ func (f *Format) Decrypt() error {
 			err = fmt.Errorf("decode key: %s", e)
 			return
 		}
-		plaintext, e := aesgcm.Open(nil, buf[:12], buf[12:], nil)
+		plaintext, e := ci.Open(nil, buf[:ci.NonceSize()], buf[ci.NonceSize():], nil)
 		if e != nil {
 			err = fmt.Errorf("open cipher: %s", e)
 			return

pkg/meta/config_test.go

@@ -19,6 +19,8 @@ package meta
 import (
 	"strings"
 	"testing"
+
+	"github.com/juicedata/juicefs/pkg/object"
 )
 
 func TestRemoveSecret(t *testing.T) {
@@ -38,17 +40,29 @@ func TestRemoveSecret(t *testing.T) {
 }
 
 func TestEncrypt(t *testing.T) {
-	format := Format{Name: "test", SecretKey: "testSecret", SessionToken: "token", EncryptKey: "testEncrypt"}
-	if err := format.Encrypt(); err != nil {
-		t.Fatalf("Format encrypt: %s", err)
-	}
-	if format.SecretKey == "testSecret" || format.SessionToken == "token" || format.EncryptKey == "testEncrypt" {
-		t.Fatalf("invalid format: %+v", format)
-	}
-	if err := format.Decrypt(); err != nil {
-		t.Fatalf("Format decrypt: %s", err)
+	cases := []struct {
+		algo string
+	}{
+		{object.AES256GCM_RSA},
+		{object.CHACHA20_RSA},
+		{object.SM4GCM},
 	}
-	if format.SecretKey != "testSecret" || format.SessionToken != "token" || format.EncryptKey != "testEncrypt" {
-		t.Fatalf("invalid format: %+v", format)
+	format := Format{Name: "test", SecretKey: "testSecret", SessionToken: "token", EncryptKey: "testEncrypt"}
+	for _, c := range cases {
+		format.EncryptAlgo = c.algo
+		t.Run(c.algo, func(t *testing.T) {
+			if err := format.Encrypt(); err != nil {
+				t.Fatalf("Format encrypt: %s", err)
+			}
+			if format.SecretKey == "testSecret" || format.SessionToken == "token" || format.EncryptKey == "testEncrypt" {
+				t.Fatalf("invalid format: %+v", format)
+			}
+			if err := format.Decrypt(); err != nil {
+				t.Fatalf("Format decrypt: %s", err)
+			}
+			if format.SecretKey != "testSecret" || format.SessionToken != "token" || format.EncryptKey != "testEncrypt" {
+				t.Fatalf("invalid format: %+v", format)
+			}
+		})
 	}
 }