gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-09-07 20:46:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): migrate direct encoding deps to simd (#6690)

Browse Source
This commit is contained in:
houseme
2026-08-27 03:17:24 +08:00
committed by GitHub
parent 31031f2a46
commit ba7785d61d
81 changed files with 523 additions and 505 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/kms/src/backends/aws.rs
+6 -7
View File
@@ -848,8 +848,7 @@ mod tests {
use aws_sdk_kms::config::{BehaviorVersion, Credentials, Region};
use aws_smithy_http_client::test_util::{NeverClient, ReplayEvent, StaticReplayClient};
use aws_smithy_types::body::SdkBody;
use base64::Engine as _;
use base64::engine::general_purpose::STANDARD as BASE64;
use base64_simd::STANDARD as BASE64;
use std::sync::atomic::{AtomicU64, Ordering};
/// AWS KMS speaks awsJson1_1; every request goes to `/` on the regional
@@ -977,8 +976,8 @@ mod tests {
let ciphertext = b"encrypted-data-key".to_vec();
let (http_client, backend) = scripted_backend(vec![ok_event(serde_json::json!({
"KeyId": "arn:aws:kms:us-east-1:111122223333:key/test-key",
"Plaintext": BASE64.encode(&plaintext),
"CiphertextBlob": BASE64.encode(&ciphertext),
"Plaintext": BASE64.encode_to_string(&plaintext),
"CiphertextBlob": BASE64.encode_to_string(&ciphertext),
}))]);
let response = backend
@@ -997,7 +996,7 @@ mod tests {
let plaintext = b"recovered-data-key".to_vec();
let (_http, backend) = scripted_backend(vec![ok_event(serde_json::json!({
"KeyId": "arn:aws:kms:us-east-1:111122223333:key/test-key",
"Plaintext": BASE64.encode(&plaintext),
"Plaintext": BASE64.encode_to_string(&plaintext),
"EncryptionAlgorithm": "SYMMETRIC_DEFAULT",
}))]);
@@ -1061,8 +1060,8 @@ mod tests {
error_event(400, "ThrottlingException", "rate exceeded"),
ok_event(serde_json::json!({
"KeyId": "test-key",
"Plaintext": BASE64.encode([1u8; 32]),
"CiphertextBlob": BASE64.encode(b"blob"),
"Plaintext": BASE64.encode_to_string([1u8; 32]),
"CiphertextBlob": BASE64.encode_to_string(b"blob"),
})),
]);
crates/kms/src/backends/contract_tests.rs
+2 -3
View File
@@ -41,8 +41,7 @@ use crate::types::{
DescribeKeyRequest, EncryptRequest, GenerateDataKeyRequest, KeySpec, KeyState, KeyUsage, ObjectEncryptionContext,
RewrapDataKeyRequest,
};
use base64::Engine as _;
use base64::engine::general_purpose::STANDARD as BASE64;
use base64_simd::STANDARD as BASE64;
use rand::RngExt as _;
use std::collections::HashMap;
use std::sync::Arc;
@@ -285,7 +284,7 @@ async fn static_backend_stateless_contract() {
let key_id = "static-contract-key";
let mut raw_key = [0u8; 32];
rand::rng().fill(&mut raw_key[..]);
let config = KmsConfig::static_kms(key_id.to_string(), BASE64.encode(raw_key));
let config = KmsConfig::static_kms(key_id.to_string(), BASE64.encode_to_string(raw_key));
let static_backend = StaticKmsBackend::new(config).await.expect("static backend should build");
let backend: &dyn KmsBackend = &static_backend;
crates/kms/src/backends/local.rs
+11 -7
View File
@@ -33,7 +33,7 @@ use aes_gcm::{
};
use argon2::{Algorithm, Argon2, Params, Version};
use async_trait::async_trait;
use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
use base64_simd::STANDARD as BASE64;
use jiff::Zoned;
use rand::RngExt;
use serde::de::{self, IgnoredAny, MapAccess, Visitor};
@@ -1268,7 +1268,7 @@ impl LocalKmsClient {
}
let encrypted_bytes = BASE64
.decode(&stored_key.encrypted_key_material)
.decode_to_vec(&stored_key.encrypted_key_material)
.map_err(|e| KmsError::material_corrupt(key_id, format!("stored key material is not valid base64: {e}")))?;
let effective_protection = if stored_key.at_rest_protection == StoredKeyProtection::LegacyUnspecified {
@@ -1406,13 +1406,17 @@ impl LocalKmsClient {
.encrypt(&nonce, key_material)
.map_err(|e| KmsError::cryptographic_error("encrypt", e.to_string()))?;
// Encode encrypted bytes to base64 string
(BASE64.encode(&encrypted), nonce.to_vec(), StoredKeyProtection::EncryptedMasterKey)
(
BASE64.encode_to_string(&encrypted),
nonce.to_vec(),
StoredKeyProtection::EncryptedMasterKey,
)
} else {
warn!(
key_id = %master_key.key_id,
"Local KMS is storing key material as plaintext-dev-only because no master key is configured"
);
(BASE64.encode(key_material), Vec::new(), StoredKeyProtection::PlaintextDevOnly)
(BASE64.encode_to_string(key_material), Vec::new(), StoredKeyProtection::PlaintextDevOnly)
};
let stored_key = StoredMasterKey {
@@ -2648,10 +2652,10 @@ mod tests {
let tampered_material = {
let mut material = BASE64
.decode(pristine["encrypted_key_material"].as_str().expect("material is a string"))
.decode_to_vec(pristine["encrypted_key_material"].as_str().expect("material is a string"))
.expect("decode pristine material");
*material.last_mut().expect("material is not empty") ^= 0x01;
BASE64.encode(&material)
BASE64.encode_to_string(&material)
};
type PoisonCase = (&'static str, Vec<u8>, fn(&KmsError) -> bool);
@@ -2976,7 +2980,7 @@ mod tests {
"created_at": "2024-01-01T00:00:00+00:00",
"rotated_at": serde_json::Value::Null,
"created_by": "legacy-test",
"encrypted_key_material": BASE64.encode([7u8; 32]),
"encrypted_key_material": BASE64.encode_to_string([7u8; 32]),
"nonce": Vec::<u8>::new()
});
crates/kms/src/backends/mod.rs
+2 -3
View File
@@ -722,8 +722,7 @@ impl Default for BackendCapabilities {
mod tests {
use super::*;
use crate::config::KmsConfig;
use base64::Engine as _;
use base64::engine::general_purpose::STANDARD as BASE64;
use base64_simd::STANDARD as BASE64;
/// Backend that implements only the trait-mandated operations and relies
/// on the default `capabilities` implementation.
@@ -958,7 +957,7 @@ mod tests {
#[tokio::test]
async fn static_backend_capabilities_golden() {
let config = KmsConfig::static_kms("static-key".to_string(), BASE64.encode([0u8; 32]));
let config = KmsConfig::static_kms("static-key".to_string(), BASE64.encode_to_string([0u8; 32]));
let backend = static_kms::StaticKmsBackend::new(config)
.await
.expect("static backend should build");
crates/kms/src/backends/static_kms.rs
+2 -3
View File
@@ -434,8 +434,7 @@ mod tests {
use crate::backends::KmsBackend as KmsBackendTrait;
use crate::config::{BackendConfig, KmsBackend, StaticConfig};
use crate::encryption::is_data_key_envelope;
use base64::Engine as _;
use base64::engine::general_purpose::STANDARD as BASE64;
use base64_simd::STANDARD as BASE64;
/// Generate a random 32-byte key and return (key_id, raw_key).
fn random_static_key(key_id: &str) -> (String, [u8; 32]) {
@@ -447,7 +446,7 @@ mod tests {
fn static_config(key_id: &str, raw_key: &[u8; 32]) -> StaticConfig {
StaticConfig {
key_id: key_id.to_string(),
secret_key: BASE64.encode(raw_key),
secret_key: BASE64.encode_to_string(raw_key),
}
}
crates/kms/src/backends/vault.rs
+13 -13
View File
@@ -33,7 +33,7 @@ use crate::persisted_observability::{BoundedUnknownFieldName, UnknownFieldSummar
use crate::policy::{self, AttemptError, OpClass, RetryPolicy};
use crate::types::*;
use async_trait::async_trait;
use base64::{Engine as _, engine::general_purpose};
use base64_simd::STANDARD as BASE64;
use jiff::Zoned;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;
@@ -527,8 +527,8 @@ fn decode_stored_key_material(key_id: &str, encrypted_material: &str) -> Result<
// Mirrors `decrypt_key_material`: stored material is currently base64 without an
// additional encryption layer.
let key_material = general_purpose::STANDARD
.decode(encrypted_material)
let key_material = BASE64
.decode_to_vec(encrypted_material)
.map_err(|e| KmsError::material_corrupt(key_id, format!("stored key material is not valid base64: {e}")))?;
// Key material must be exactly 32 bytes for AES-256.
@@ -693,7 +693,7 @@ impl VaultKmsClient {
/// confidentiality. Any identity with KV read access to the key path can recover the
/// plaintext master key.
async fn encrypt_key_material(&self, key_material: &[u8]) -> Result<String> {
Ok(general_purpose::STANDARD.encode(key_material))
Ok(base64_simd::STANDARD.encode_to_string(key_material))
}
/// Read the immutable material record of one key version.
@@ -2405,7 +2405,7 @@ mod tests {
tags: HashMap::new(),
deletion_date: None,
rotated_at: None,
encrypted_key_material: general_purpose::STANDARD.encode([0x42u8; 32]),
encrypted_key_material: base64_simd::STANDARD.encode_to_string([0x42u8; 32]),
baseline_version: None,
wrap_budget_reserved: 0,
}
@@ -2869,21 +2869,21 @@ mod tests {
));
// Truncated material: valid base64 of fewer than 32 bytes.
let truncated = general_purpose::STANDARD.encode([0x42u8; 16]);
let truncated = base64_simd::STANDARD.encode_to_string([0x42u8; 16]);
assert!(matches!(
decode_stored_key_material("poisoned", &truncated),
Err(KmsError::MaterialCorrupt { key_id, .. }) if key_id == "poisoned"
));
// Oversized material: valid base64 of more than 32 bytes.
let oversized = general_purpose::STANDARD.encode([0x42u8; 33]);
let oversized = base64_simd::STANDARD.encode_to_string([0x42u8; 33]);
assert!(matches!(
decode_stored_key_material("poisoned", &oversized),
Err(KmsError::MaterialCorrupt { key_id, .. }) if key_id == "poisoned"
));
// Well-formed material still decodes.
let valid = general_purpose::STANDARD.encode([0x42u8; 32]);
let valid = base64_simd::STANDARD.encode_to_string([0x42u8; 32]);
assert_eq!(
decode_stored_key_material("healthy", &valid).expect("valid material must decode"),
vec![0x42u8; 32]
@@ -3046,7 +3046,7 @@ mod tests {
description: None,
metadata: HashMap::new(),
tags: HashMap::new(),
encrypted_key_material: general_purpose::STANDARD.encode([0x42u8; 32]),
encrypted_key_material: base64_simd::STANDARD.encode_to_string([0x42u8; 32]),
baseline_version: Some(1),
deletion_date: None,
rotated_at: None,
@@ -3760,7 +3760,7 @@ mod tests {
/// Base64 material distinct from `healthy_key_data`'s, standing in for the
/// material a concurrent rotation committed.
fn rotated_material() -> String {
general_purpose::STANDARD.encode([0x43u8; 32])
base64_simd::STANDARD.encode_to_string([0x43u8; 32])
}
/// The issue's lost-update scenario: node A disables a key while node B's
@@ -4358,7 +4358,7 @@ mod tests {
let material_v2 = [0x43u8; 32];
let record_v2 = VaultKeyVersionRecord {
version: 2,
encrypted_key_material: general_purpose::STANDARD.encode(material_v2),
encrypted_key_material: base64_simd::STANDARD.encode_to_string(material_v2),
created_at: Zoned::now(),
};
// A well-formed envelope wrapped under version 2 — under a reverted
@@ -4900,8 +4900,8 @@ mod tests {
#[tokio::test]
async fn wired_decrypt_of_pre_versioning_envelope_adds_no_request() {
let key_data = healthy_key_data();
let key_material = general_purpose::STANDARD
.decode(&key_data.encrypted_key_material)
let key_material = BASE64
.decode_to_vec(&key_data.encrypted_key_material)
.expect("decode fixture material");
let (encrypted_key, nonce) = AesDekCrypto::new()
.encrypt(&key_material, b"dek-plaintext", &[])
crates/kms/src/backends/vault_transit.rs
+6 -6
View File
@@ -31,7 +31,7 @@ use crate::persisted_observability::{BoundedUnknownFieldName, UnknownFieldSummar
use crate::policy::{self, AttemptError, OpClass, RetryPolicy};
use crate::types::*;
use async_trait::async_trait;
use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
use base64_simd::STANDARD as BASE64;
use jiff::Zoned;
use moka::future::Cache;
use serde::{Deserialize, Serialize};
@@ -479,7 +479,7 @@ impl VaultTransitKmsClient {
.map(|(key, value)| (key.clone(), value.clone()))
.collect();
let serialized = serde_json::to_vec(&ordered)?;
Ok(Some(BASE64.encode(serialized)))
Ok(Some(BASE64.encode_to_string(serialized)))
}
fn map_vault_error(key_id: &str, error: vaultrs::error::ClientError, operation: &str) -> KmsError {
@@ -524,7 +524,7 @@ impl VaultTransitKmsClient {
plaintext: &[u8],
encryption_context: &HashMap<String, String>,
) -> Result<String> {
let plaintext_b64 = BASE64.encode(plaintext);
let plaintext_b64 = BASE64.encode_to_string(plaintext);
let plaintext_b64 = plaintext_b64.as_str();
let aad = Self::canonicalize_context(encryption_context)?;
let aad = aad.as_deref();
@@ -568,7 +568,7 @@ impl VaultTransitKmsClient {
.await?;
BASE64
.decode(response.plaintext)
.decode_to_vec(response.plaintext)
.map_err(|e| KmsError::cryptographic_error("base64_decode", e.to_string()))
}
@@ -3031,7 +3031,7 @@ mod tests {
ScriptedResponse::ok(kv2_write_ack()),
// decrypt of the pre-rotation envelope; Vault owns the transit
// crypto, so the recovered material is the responder's to hand back.
ScriptedResponse::ok(serde_json::json!({ "plaintext": BASE64.encode(RECOVERED_DEK) })),
ScriptedResponse::ok(serde_json::json!({ "plaintext": BASE64.encode_to_string(RECOVERED_DEK) })),
])
.await;
@@ -3243,7 +3243,7 @@ mod tests {
// rewrap, context-bound route: latest-version read, then decrypt,
// then re-encrypt under the newest version.
ScriptedResponse::ok(transit_key_read_data_up_to("wired-key", 2)),
ScriptedResponse::ok(serde_json::json!({ "plaintext": BASE64.encode(RECOVERED_DEK) })),
ScriptedResponse::ok(serde_json::json!({ "plaintext": BASE64.encode_to_string(RECOVERED_DEK) })),
ScriptedResponse::ok(serde_json::json!({ "ciphertext": "vault:v2:rewrapped" })),
])
.await;