Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Client Encryption: Adds integration with latest CosmosDb package 3.19.0-preview1 and check for Client Encryption Policy format version. #2475

Merged
merged 9 commits into from
May 18, 2021
Merged

Client Encryption: Adds integration with latest CosmosDb package 3.19.0-preview1 and check for Client Encryption Policy format version. #2475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
a817166
Update to latest CosmosDB SDK package.
kr-santosh May 18, 2021
41e693c
Update package version and changelog
kr-santosh May 18, 2021
929f48f
Update EncryptionSettings.cs
kr-santosh May 18, 2021
b908cf7
Update MdeEncryptionTests.cs
kr-santosh May 18, 2021
83d3bde
Updated change log.
kr-santosh May 18, 2021
d04837f
Update changelog.md
kr-santosh May 18, 2021
b7690a0
Added const for SupportedCEPFormatVersion
kr-santosh May 18, 2021
f8d29e8
Update changelog.md
kr-santosh May 18, 2021
a80f773
Update changelog.md
kr-santosh May 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Directory.Build.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<ClientPreviewVersion>3.19.0</ClientPreviewVersion>
<ClientPreviewSuffixVersion>preview1</ClientPreviewSuffixVersion>
<DirectVersion>3.19.1</DirectVersion>
<EncryptionVersion>1.0.0-previewV14</EncryptionVersion>
<EncryptionVersion>1.0.0-previewV15</EncryptionVersion>
<HybridRowVersion>1.1.0-preview3</HybridRowVersion>
<AboveDirBuildProps>$([MSBuild]::GetPathOfFileAbove('Directory.Build.props', '$(MSBuildThisFileDirectory)../'))</AboveDirBuildProps>
<DefineConstants Condition=" '$(IsNightly)' == 'true' or '$(IsPreview)' == 'true' ">$(DefineConstants);PREVIEW</DefineConstants>
Expand Down
14 changes: 14 additions & 0 deletions Microsoft.Azure.Cosmos.Encryption/changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,24 @@ Preview features are treated as a separate branch and will not be included in th
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

### <a name="1.0.0-previewV15"/> [1.0.0-previewV15](https://www.nuget.org/packages/Microsoft.Azure.Cosmos.Encryption/1.0.0-previewV15) - 2021-05-18

#### Added
- [#2475](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2475) Adds integration with latest CosmosDb Preview Package - 3.19.0-preview1 and check for Client Encryption Policy format version.
kr-santosh marked this conversation as resolved.
Show resolved Hide resolved
- [#2449](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2449) Adds validation that partition key paths are not encrypted.
- [#2452](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2452) Adds the implementation for new ChangeFeed APIs.
- [#2448](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2448) Adds client encryption support for patch.
- [#2453](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2453) Removes Plaintext encryption type support.

#### Fixes
- [#2445](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2445) Fixes query support on encrypted parameters and fixes samples.
- [#2403](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2403) Fixes issue with clients using incorrect/stale Encryption Policy or Encryption Keys from the cache.

### <a name="1.0.0-previewV14"/> [1.0.0-previewV14](https://www.nuget.org/packages/Microsoft.Azure.Cosmos.Encryption/1.0.0-previewV14) - 2021-04-28

#### Added
kr-santosh marked this conversation as resolved.
Show resolved Hide resolved
- [#2433](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2433) Adds integration with latest CosmosDb Preview Package - 3.19.0-preview.
- [#2372](https://github.com/Azure/azure-cosmos-dotnet-v3/pull/2372) Adds decryption support for ChangeFeed Processor.

### <a name="1.0.0-previewV13"/> [1.0.0-previewV13](https://www.nuget.org/packages/Microsoft.Azure.Cosmos.Encryption/1.0.0-previewV13) - 2021-03-26

Expand Down
1 change: 1 addition & 0 deletions Microsoft.Azure.Cosmos.Encryption/src/Constants.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,6 @@ internal static class Constants
public const string DocumentsResourcePropertyName = "Documents";
public const string SubStatusHeader = "x-ms-substatus";
public const string IncorrectContainerRidSubStatus = "1024";
public const int SupportedClientEncryptionPolicyFormatVersion = 1;
}
}
6 changes: 6 additions & 0 deletions Microsoft.Azure.Cosmos.Encryption/src/EncryptionSettings.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,12 @@ private static async Task<EncryptionSettings> InitializeEncryptionSettingsAsync(

if (clientEncryptionPolicy != null)
{
if (clientEncryptionPolicy.PolicyFormatVersion > Constants.SupportedClientEncryptionPolicyFormatVersion)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will we always support version less than meaning there will never be a breaking change?

Copy link
Contributor Author

@kr-santosh kr-santosh May 18, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current intention is to check for this version(1), if in future we end up having a new version of Policy we might change this to handle the policy retrieved accordingly. Say policy version x to be processed by the Package in certain way and version y in a certain way. @abhijitpai ...correct me if i am wrong. But ideally i think we should make it back compat.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need a backend fix to store the format version... currently its retrieved as 0 , should move to 1 , once we have the fix.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We expect to maintain back compat. Even in case we end up not being able to do so, the current code seems okay for the current package version.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That seems fair. Just be very careful in making breaking changes. There needs to be a path for customers to upgrade. If they have 1000 clients running on 1000 different VMs they can't just upgrade them all at the same time.

{
throw new InvalidOperationException("This version of Microsoft.Azure.Cosmos.Encryption cannot be used with this container." +
" Please upgrade to the latest version of the same. Please refer to https://aka.ms/CosmosClientEncryption for more details. ");
}

// for each of the unique keys in the policy Add it in /Update the cache.
foreach (string clientEncryptionKeyId in clientEncryptionPolicy.IncludedPaths.Select(x => x.ClientEncryptionKeyId).Distinct())
{
Expand Down
2 changes: 1 addition & 1 deletion Microsoft.Azure.Cosmos.Encryption/src/Microsoft.Azure.Cosmos.Encryption.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
</ItemGroup>

<ItemGroup Condition=" '$(SdkProjectRef)' != 'True' ">
<PackageReference Include="Microsoft.Azure.Cosmos" Version="3.19.0-preview" />
<PackageReference Include="Microsoft.Azure.Cosmos" Version="3.19.0-preview1" />
</ItemGroup>

<ItemGroup Condition=" '$(SdkProjectRef)' == 'True' ">
Expand Down
9 changes: 3 additions & 6 deletions Microsoft.Azure.Cosmos.Encryption/tests/EmulatorTests/MdeEncryptionTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -835,15 +835,12 @@ public async Task EncryptionRestrictedProperties()

ContainerProperties containerProperties = new ContainerProperties(Guid.NewGuid().ToString(), "/PK") { ClientEncryptionPolicy = clientEncryptionPolicyPk };

Container encryptionContainer = await database.CreateContainerAsync(containerProperties, 400);
await encryptionContainer.InitializeEncryptionAsync();

try
{
await MdeEncryptionTests.MdeCreateItemAsync(encryptionContainer);
Assert.Fail("Expected item creation with PK specified to be encrypted to fail.");
kr-santosh marked this conversation as resolved.
Show resolved Hide resolved
Container encryptionContainer = await database.CreateContainerAsync(containerProperties, 400);
Assert.Fail("CreateContainerAsync operation with PK specified to be encrypted should have failed. ");
}
catch (CosmosException ex) when (ex.StatusCode == HttpStatusCode.BadRequest)
catch (ArgumentException)
{
}

Expand Down