PBS-39 feature: Add binlog encryption config and keyring support (part 3)

CMakeLists.txt

@@ -455,6 +455,9 @@ set(binsrv_source_files
   src/binsrv/binlog_file_metadata.hpp
   src/binsrv/binlog_file_metadata.cpp
 
+  src/binsrv/binlog_file_encryption_metadata_fwd.hpp
+  src/binsrv/binlog_file_encryption_metadata.hpp
+
   src/binsrv/cout_logger.hpp
   src/binsrv/cout_logger.cpp
 
@@ -468,12 +471,18 @@ set(binsrv_source_files
   src/binsrv/exception_handling_helpers.hpp
   src/binsrv/exception_handling_helpers.cpp
 
-  src/binsrv/file_logger.hpp
-  src/binsrv/file_logger.cpp
+  src/binsrv/file_data_envelope_fwd.hpp
+  src/binsrv/file_data_envelope.hpp
+
+  src/binsrv/file_key_envelope_fwd.hpp
+  src/binsrv/file_key_envelope.hpp
 
   src/binsrv/file_keyring.hpp
   src/binsrv/file_keyring.cpp
 
+  src/binsrv/file_logger.hpp
+  src/binsrv/file_logger.cpp
+
   src/binsrv/filesystem_storage_backend.hpp
   src/binsrv/filesystem_storage_backend.cpp
 

src/binsrv/basic_keyring.cpp

@@ -24,10 +24,15 @@ namespace binsrv {
 
 basic_keyring::~basic_keyring() = default;
 
+[[nodiscard]] bool basic_keyring::contains(std::string_view key_id) const {
+  return do_contains(key_id);
+}
+
 [[nodiscard]] const keyring_record &
-basic_keyring::get_key(std::string_view key_id) {
+basic_keyring::get_key(std::string_view key_id) const {
   return do_get_key(key_id);
 }
+
 [[nodiscard]] std::string basic_keyring::get_description() const {
   return do_get_description();
 }

src/binsrv/basic_keyring.hpp

@@ -34,12 +34,14 @@ class [[nodiscard]] basic_keyring {
 
   virtual ~basic_keyring();
 
-  [[nodiscard]] const keyring_record &get_key(std::string_view key_id);
+  [[nodiscard]] bool contains(std::string_view key_id) const;
+  [[nodiscard]] const keyring_record &get_key(std::string_view key_id) const;
   [[nodiscard]] std::string get_description() const;
 
 private:
+  [[nodiscard]] virtual bool do_contains(std::string_view key_id) const = 0;
   [[nodiscard]] virtual const keyring_record &
-  do_get_key(std::string_view key_id) = 0;
+  do_get_key(std::string_view key_id) const = 0;
   [[nodiscard]] virtual std::string do_get_description() const = 0;
 };
 

src/binsrv/binlog_file_encryption_metadata.hpp

@@ -0,0 +1,38 @@
+// Copyright (c) 2023-2024 Percona and/or its affiliates.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License, version 2.0,
+// as published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License, version 2.0, for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+#ifndef BINSRV_BINLOG_FILE_ENCRYPTION_METADATA_HPP
+#define BINSRV_BINLOG_FILE_ENCRYPTION_METADATA_HPP
+
+#include "binsrv/binlog_file_encryption_metadata_fwd.hpp" // IWYU pragma: export
+
+#include "binsrv/file_data_envelope.hpp" // IWYU pragma: export
+#include "binsrv/file_key_envelope.hpp"  // IWYU pragma: export
+
+#include "util/nv_tuple.hpp"
+
+namespace binsrv {
+
+class [[nodiscard]] binlog_file_encryption_metadata
+    : public util::nv_tuple<
+          // clang-format off
+          util::nv<"file_key_envelope", file_key_envelope>,
+          util::nv<"file_data_envelope", file_data_envelope>
+          // clang-format on
+          > {};
+
+} // namespace binsrv
+
+#endif // BINSRV_BINLOG_FILE_ENCRYPTION_METADATA_HPP

src/binsrv/binlog_file_encryption_metadata_fwd.hpp

@@ -0,0 +1,29 @@
+// Copyright (c) 2023-2024 Percona and/or its affiliates.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License, version 2.0,
+// as published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License, version 2.0, for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+#ifndef BINSRV_BINLOG_FILE_ENCRYPTION_METADATA_FWD_HPP
+#define BINSRV_BINLOG_FILE_ENCRYPTION_METADATA_FWD_HPP
+
+#include <optional>
+
+namespace binsrv {
+
+class binlog_file_encryption_metadata;
+using optional_binlog_file_encryption_metadata =
+    std::optional<binlog_file_encryption_metadata>;
+
+} // namespace binsrv
+
+#endif // BINSRV_BINLOG_FILE_ENCRYPTION_METADATA_FWD_HPP

src/binsrv/binlog_file_metadata.cpp

@@ -30,7 +30,14 @@
 namespace binsrv {
 
 binlog_file_metadata::binlog_file_metadata()
-    : impl_{{expected_binlog_file_metadata_version}, {}, {}, {}, {}, {}, {}} {}
+    : impl_{{expected_binlog_file_metadata_version},
+            {},
+            {},
+            {},
+            {},
+            {},
+            {},
+            {}} {}
 
 binlog_file_metadata::binlog_file_metadata(std::string_view data) : impl_{} {
   auto json_value = boost::json::parse(data);

src/binsrv/binlog_file_metadata.hpp

@@ -22,6 +22,8 @@
 #include <string>
 #include <string_view>
 
+#include "binsrv/binlog_file_encryption_metadata.hpp" // IWYU pragma: export
+
 #include "binsrv/events/common_types.hpp"
 
 #include "binsrv/gtids/gtid_set.hpp"
@@ -47,7 +49,8 @@ class [[nodiscard]] binlog_file_metadata {
       util::nv<"added_gtids", gtids::optional_gtid_set>,
       util::nv<"min_timestamp", util::ctime_timestamp>,
       util::nv<"max_timestamp", util::ctime_timestamp>,
-      util::nv<"last_sequence_number", events::seq_no_t>
+      util::nv<"last_sequence_number", events::seq_no_t>,
+      util::nv<"encryption", optional_binlog_file_encryption_metadata>
       // clang-format on
       >;
 

src/binsrv/file_data_envelope.hpp

@@ -0,0 +1,39 @@
+// Copyright (c) 2023-2024 Percona and/or its affiliates.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License, version 2.0,
+// as published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License, version 2.0, for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+#ifndef BINSRV_FILE_DATA_ENVELOPE_HPP
+#define BINSRV_FILE_DATA_ENVELOPE_HPP
+
+#include "binsrv/file_data_envelope_fwd.hpp" // IWYU pragma: export
+
+#include <string>
+
+#include "util/hex_value.hpp"
+#include "util/nv_tuple.hpp"
+
+namespace binsrv {
+
+class [[nodiscard]] file_data_envelope
+    : public util::nv_tuple<
+          // clang-format off
+          util::nv<"cipher", std::string>,
+          util::nv<"iv_hex", util::hex_value>,
+          util::nv<"tag_hex", util::optional_hex_value>
+          // clang-format on
+          > {};
+
+} // namespace binsrv
+
+#endif // BINSRV_FILE_DATA_ENVELOPE_HPP

src/binsrv/file_data_envelope_fwd.hpp

@@ -0,0 +1,25 @@
+// Copyright (c) 2023-2024 Percona and/or its affiliates.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License, version 2.0,
+// as published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License, version 2.0, for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+#ifndef BINSRV_FILE_DATA_ENVELOPE_FWD_HPP
+#define BINSRV_FILE_DATA_ENVELOPE_FWD_HPP
+
+namespace binsrv {
+
+class file_data_envelope;
+
+} // namespace binsrv
+
+#endif // BINSRV_FILE_DATA_ENVELOPE_FWD_HPP

src/binsrv/file_key_envelope.hpp

@@ -0,0 +1,40 @@
+// Copyright (c) 2023-2024 Percona and/or its affiliates.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License, version 2.0,
+// as published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License, version 2.0, for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+#ifndef BINSRV_FILE_KEY_ENVELOPE_HPP
+#define BINSRV_FILE_KEY_ENVELOPE_HPP
+
+#include "binsrv/file_key_envelope_fwd.hpp" // IWYU pragma: export
+
+#include <string>
+
+#include "util/hex_value.hpp"
+#include "util/nv_tuple.hpp"
+
+namespace binsrv {
+
+class [[nodiscard]] file_key_envelope
+    : public util::nv_tuple<
+          // clang-format off
+          util::nv<"kek_id", std::string>,
+          util::nv<"data_hex", util::hex_value>,
+          util::nv<"iv_hex", util::optional_hex_value>,
+          util::nv<"tag_hex", util::optional_hex_value>
+          // clang-format on
+          > {};
+
+} // namespace binsrv
+
+#endif // BINSRV_FILE_KEY_ENVELOPE_HPP

src/binsrv/file_key_envelope_fwd.hpp

@@ -0,0 +1,25 @@
+// Copyright (c) 2023-2024 Percona and/or its affiliates.
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License, version 2.0,
+// as published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License, version 2.0, for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+#ifndef BINSRV_FILE_KEY_ENVELOPE_FWD_HPP
+#define BINSRV_FILE_KEY_ENVELOPE_FWD_HPP
+
+namespace binsrv {
+
+class file_key_envelope;
+
+} // namespace binsrv
+
+#endif // BINSRV_FILE_KEY_ENVELOPE_FWD_HPP

src/binsrv/file_keyring.cpp

@@ -84,8 +84,11 @@ file_keyring::file_keyring(std::string_view keyring_uri) : key_file_path_{} {
 
 file_keyring::~file_keyring() = default;
 
+[[nodiscard]] bool file_keyring::do_contains(std::string_view key_id) const {
+  return keyring_records_->contains_key(key_id);
+}
 [[nodiscard]] const keyring_record &
-file_keyring::do_get_key(std::string_view key_id) {
+file_keyring::do_get_key(std::string_view key_id) const {
   return keyring_records_->get_key(key_id);
 }
 [[nodiscard]] std::string file_keyring::do_get_description() const {

src/binsrv/file_keyring.hpp

@@ -49,8 +49,9 @@ class [[nodiscard]] file_keyring final : public basic_keyring {
   std::filesystem::path key_file_path_;
   keyring_record_collection_ptr keyring_records_;
 
+  [[nodiscard]] bool do_contains(std::string_view key_id) const override;
   [[nodiscard]] const keyring_record &
-  do_get_key(std::string_view key_id) override;
+  do_get_key(std::string_view key_id) const override;
   [[nodiscard]] std::string do_get_description() const override;
 };
 

src/binsrv/keyring_record_collection.cpp

@@ -42,18 +42,19 @@ keyring_record_collection::keyring_record_collection(std::string_view file_name)
   validate();
 }
 
+[[nodiscard]] bool
+keyring_record_collection::contains_key(std::string_view key_id) const {
+  return find_key_internal(key_id) != std::cend(root().get<"keys">());
+}
+
 [[nodiscard]] const keyring_record &
 keyring_record_collection::get_key(std::string_view key_id) const {
-  const auto &keys{root().get<"keys">()};
-  const auto key_it =
-      std::ranges::find_if(keys, [key_id](const keyring_record &key) {
-        return key.get<"id">() == key_id;
-      });
-  if (key_it == std::end(keys)) {
+  const auto fnd_it{find_key_internal(key_id)};
+  if (fnd_it == std::cend(root().get<"keys">())) {
     util::exception_location().raise<std::out_of_range>(
         "key not found in the keyring record collection");
   }
-  return *key_it;
+  return *fnd_it;
 }
 
 void keyring_record_collection::validate() const {
@@ -75,4 +76,12 @@ void keyring_record_collection::validate() const {
   return result;
 }
 
+[[nodiscard]] keyring_record_collection::key_collection::const_iterator
+keyring_record_collection::find_key_internal(std::string_view key_id) const {
+  const auto &keys{root().get<"keys">()};
+  return std::ranges::find_if(keys, [key_id](const keyring_record &key) {
+    return key.get<"id">() == key_id;
+  });
+}
+
 } // namespace binsrv

src/binsrv/keyring_record_collection.hpp

@@ -44,13 +44,17 @@ class [[nodiscard]] keyring_record_collection {
   explicit keyring_record_collection(std::string_view file_name);
 
   [[nodiscard]] const auto &root() const noexcept { return impl_; }
+
+  [[nodiscard]] bool contains_key(std::string_view key_id) const;
   [[nodiscard]] const keyring_record &get_key(std::string_view key_id) const;
   [[nodiscard]] std::string get_description() const;
 
 private:
   impl_type impl_;
 
   void validate() const;
+  [[nodiscard]] key_collection::const_iterator
+  find_key_internal(std::string_view key_id) const;
 };
 
 } // namespace binsrv