93 lines
3.4 KiB
Python
93 lines
3.4 KiB
Python
# -*- coding: utf-8 -*- #
|
|
# Copyright 2020 Google LLC. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""Helpers for End to End integirty verification."""
|
|
|
|
from __future__ import absolute_import
|
|
from __future__ import division
|
|
from __future__ import unicode_literals
|
|
|
|
import re
|
|
|
|
from googlecloudsdk.calliope import exceptions
|
|
from googlecloudsdk.core import exceptions as core_exceptions
|
|
|
|
_ERROR_MESSAGE_SUFFIX = (
|
|
"Please try again. This should happen rarely. If the error persists, "
|
|
"contact cloudkms-feedback@google.com. To learn more about how Cloud KMS "
|
|
"verifies in-transit integrity, visit "
|
|
"https://cloud.google.com/kms/docs/data-integrity-guidelines.")
|
|
|
|
|
|
class ServerSideIntegrityVerificationError(core_exceptions.Error):
|
|
"""Error raised when server reported integrity verification error."""
|
|
|
|
|
|
class ClientSideIntegrityVerificationError(core_exceptions.Error):
|
|
"""Error raised when client identifies integrity verification error."""
|
|
|
|
|
|
class ResourceNameVerificationError(core_exceptions.Error):
|
|
"""Error raised when server returned resource name differs from client provided resource name."""
|
|
|
|
|
|
def GetRequestToServerCorruptedErrorMessage():
|
|
"""Error message for when the request to server failed an integrity check."""
|
|
|
|
return ("The request sent to the server was corrupted in-transit. {}".format(
|
|
_ERROR_MESSAGE_SUFFIX))
|
|
|
|
|
|
def GetResponseFromServerCorruptedErrorMessage():
|
|
"""Error message for when the response from server failed an integrity check."""
|
|
|
|
return ("The response received from the server was corrupted in-transit. {}"
|
|
.format(_ERROR_MESSAGE_SUFFIX))
|
|
|
|
|
|
def GetResourceNameMismatchErrorMessage(request_resource_name,
|
|
response_resource_name):
|
|
return (
|
|
"Found a mismatch between user-requested crypto resource ({})".format(
|
|
request_resource_name) +
|
|
"and server-reported resource used for the cryptographic operation ({}).\n"
|
|
.format(response_resource_name) + _ERROR_MESSAGE_SUFFIX)
|
|
|
|
|
|
# LINT.IfChange(invalid_checksum_err)
|
|
def ProcessHttpBadRequestError(error):
|
|
"""Intercept INVALID_ARGUMENT errors related to checksum verification.
|
|
|
|
Intercept INVALID_ARGUMENT errors related to checksum verification, to present
|
|
a user-friendly message.
|
|
All other errors are surfaced as-is.
|
|
Args:
|
|
error: apitools_exceptions.ProcessHttpBadRequestError.
|
|
|
|
Raises:
|
|
ServerSideIntegrityVerificationError: if |error| is a result of a failed
|
|
server-side request integrity verification.
|
|
Else, re-raises |error| as exceptions.HttpException.
|
|
"""
|
|
exc = exceptions.HttpException(error)
|
|
regex = re.compile(
|
|
"The checksum in field .* did not match the data in field .*.")
|
|
if regex.search(exc.payload.status_message) is not None:
|
|
raise ServerSideIntegrityVerificationError(
|
|
GetRequestToServerCorruptedErrorMessage())
|
|
else:
|
|
raise exc
|
|
# Code paths are prohibited from being included in this file.
|
|
# LINT.ThenChange()
|