Skip to content

chore: add ranged get tests #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
imabhichow wants to merge 55 commits into from
Closed

chore: add ranged get tests #84

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
55 commits
Select commit Hold shift + click to select a range
53a2865
chore: s3ec v3 transtion and v4 improved tests
imabhichow Oct 17, 2025
1e5b2ea
comment cpp checkout
imabhichow Oct 27, 2025
e0e7ab3
bump s3ec-java commits
imabhichow Oct 27, 2025
5dbb019
chore: add duvet reports for s3ec-java (transition & improved)
imabhichow Sep 30, 2025
ddfdb9b
format
imabhichow Oct 27, 2025
009d1b2
git-ignore
imabhichow Oct 27, 2025
e12fa7d
Merge branch 'fireegg-test-servers' into imabhichow/java-v4-extended-…
imabhichow Oct 27, 2025
db6c65d
Merge branch 'fireegg-test-servers' into imabhichow/java-v4-extended-…
imabhichow Oct 29, 2025
a570537
update java submodule
imabhichow Oct 27, 2025
39fc548
fix configuration
imabhichow Oct 29, 2025
c755778
Revert "chore: reenable c++ (#52)"
imabhichow Oct 29, 2025
d72d851
remove java transiton for now
imabhichow Oct 30, 2025
0dc303f
fix configuration
imabhichow Oct 30, 2025
88c2bc5
fix configuration
imabhichow Oct 30, 2025
edd534e
Update test configuration
imabhichow Oct 30, 2025
12614dc
Duvet
imabhichow Nov 5, 2025
76387f0
Merge remote-tracking branch 'origin/fireegg-test-servers' into imabh…
imabhichow Nov 5, 2025
d0457ad
Rebase
imabhichow Nov 5, 2025
ec3dabf
Merge branch 'fireegg-test-servers' into imabhichow/java-v4-extended-…
imabhichow Nov 6, 2025
131d905
nit - format
imabhichow Nov 6, 2025
ebdaa64
Merge remote-tracking branch 'origin/fireegg-test-servers' into imabh…
imabhichow Nov 7, 2025
9acf8ad
Change java-v4-port
imabhichow Nov 7, 2025
398fc4e
duvet changes
imabhichow Nov 7, 2025
cd342a1
Dotnet change
imabhichow Nov 7, 2025
a8a025b
Merge branch 'fireegg-test-servers' into imabhichow/java-v4-extended-…
imabhichow Nov 7, 2025
2b1b810
remove symlink
imabhichow Nov 7, 2025
e0ee483
Fix Tests
imabhichow Nov 7, 2025
87b3bb1
chore: enable java-v3-transition test server
imabhichow Nov 10, 2025
4ccaab4
chore: enable java-v3-transition test server
imabhichow Nov 10, 2025
ff8e92b
update .gitmodule branch
imabhichow Nov 10, 2025
2d477a6
Merge remote-tracking branch 'origin/fireegg-test-servers' into imabh…
imabhichow Nov 10, 2025
3769f83
Merge branch 'fireegg-test-servers' into imabhichow/java-test-server-v3
imabhichow Nov 10, 2025
d290f89
Merge remote-tracking branch 'origin/fireegg-test-servers' into imabh…
imabhichow Nov 12, 2025
b7bf864
chore: add ranged get tests
imabhichow Nov 12, 2025
402acb3
chore: add ranged get tests
imabhichow Nov 12, 2025
8370d08
more tests
imabhichow Nov 13, 2025
1c63c14
cpp ranged get
imabhichow Nov 13, 2025
a58ef9a
Revert "cpp ranged get"
imabhichow Nov 13, 2025
f85bf2e
Merge branch 'fireegg-test-servers' into imabhichow/java-test-server-v3
imabhichow Nov 13, 2025
09d339d
Merge Conflicts
imabhichow Nov 13, 2025
75d0c2f
Merge branch 'imabhichow/java-test-server-v3' into imabhichow/ranged-get
imabhichow Nov 13, 2025
375ff21
m
imabhichow Nov 13, 2025
45a657e
Merge branch 'fireegg-test-servers' into imabhichow/ranged-get
imabhichow Nov 14, 2025
e9f96a8
Merge branch 'fireegg-test-servers' into imabhichow/ranged-get
imabhichow Nov 14, 2025
c159f9f
Reapply "cpp ranged get"
imabhichow Nov 14, 2025
ba2414e
update cpp
imabhichow Nov 14, 2025
f0d5d12
Merge branch 'refs/heads/fireegg-test-servers' into imabhichow/ranged…
imabhichow Nov 14, 2025
630ff58
update tests
imabhichow Nov 14, 2025
5767928
format
imabhichow Nov 14, 2025
40d9fa0
Merge branch 'fireegg-test-servers' into imabhichow/ranged-get
imabhichow Nov 14, 2025
180081b
Revert "cpp range get"
imabhichow Nov 15, 2025
6ceab31
Merge remote-tracking branch 'origin/imabhichow/ranged-get' into imab…
imabhichow Nov 15, 2025
58634c7
Merge branch 'fireegg-test-servers' into imabhichow/ranged-get
imabhichow Nov 17, 2025
434520c
Rename
imabhichow Nov 17, 2025
e174930
Merge branch 'fireegg-test-servers' into imabhichow/ranged-get
rishav-karanjit Nov 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
105 changes: 80 additions & 25 deletions test-server/java-tests/src/it/java/software/amazon/encryption/s3/CBCDecryptTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,46 +5,30 @@

package software.amazon.encryption.s3;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assertions.fail;
import static software.amazon.encryption.s3.TestUtils.*;
import static software.amazon.encryption.s3.TestUtils.appendTestSuffix;

import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.stream.Stream;

import com.amazonaws.services.s3.model.KMSEncryptionMaterials;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import org.junit.jupiter.api.Nested;
import software.amazon.encryption.s3.client.S3ECTestServerClient;
import software.amazon.encryption.s3.model.CommitmentPolicy;
import software.amazon.encryption.s3.model.CreateClientInput;
import software.amazon.encryption.s3.model.CreateClientOutput;
import software.amazon.encryption.s3.model.GetObjectInput;
import software.amazon.encryption.s3.model.GetObjectOutput;
import software.amazon.encryption.s3.model.KeyMaterial;
import software.amazon.encryption.s3.model.PutObjectInput;
import software.amazon.encryption.s3.model.S3ECConfig;
import software.amazon.encryption.s3.model.S3EncryptionClientError;
import software.amazon.encryption.s3.model.EncryptionAlgorithm;

import com.amazonaws.services.s3.AmazonS3Encryption;
import com.amazonaws.services.s3.AmazonS3EncryptionClient;
import com.amazonaws.services.s3.model.CryptoConfiguration;
import com.amazonaws.services.s3.model.CryptoMode;
import com.amazonaws.services.s3.model.CryptoStorageMode;
import software.amazon.encryption.s3.TestUtils.*;
import com.amazonaws.services.s3.model.EncryptionMaterialsProvider;
import com.amazonaws.services.s3.model.KMSEncryptionMaterialsProvider;

import software.amazon.encryption.s3.client.S3ECTestServerClient;
import software.amazon.encryption.s3.model.CommitmentPolicy;
import software.amazon.encryption.s3.model.CreateClientInput;
import software.amazon.encryption.s3.model.CreateClientOutput;
import software.amazon.encryption.s3.model.EncryptionAlgorithm;
import software.amazon.encryption.s3.model.KeyMaterial;
import software.amazon.encryption.s3.model.S3ECConfig;

/**
* Exhaustive tests for S3 Encryption Client round-trip operations.
* These tests cover various combinations of client versions, commitment policies, and encryption modes.
Expand Down Expand Up @@ -181,4 +165,75 @@ void improved_configured_with_the_default_should_fail_to_decrypt_cbc(TestUtils.L

TestUtils.Decrypt_fails(decClient, decS3ECId, Arrays.asList(sharedObjectKey), EncryptionAlgorithm.ALG_AES_256_CBC_IV16_NO_KDF);
}

// Ranged Get Tests - using existing CBC encrypted object with ranged-get-supported clients

@ParameterizedTest(name = "{0}: Transition configured with ForbidEncryptAllowDecrypt can ranged get CBC")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetTransitionClientsForTest")
void transition_configured_with_forbid_encrypt_allow_decrypt_ranged_get_cbc(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient client = TestUtils.testServerClientFor(language);
CreateClientOutput clientOutput = client.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
.encryptionAlgorithm(EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF)
.enableLegacyUnauthenticatedModes(true)
.enableLegacyWrappingAlgorithms(true)
.build())
.build());

@rishav-karanjit rishav-karanjit Nov 14, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: we could had formatted it better.

String S3ECId = clientOutput.getClientId();

TestUtils.DecryptWithRangedGet(client, S3ECId, Arrays.asList(sharedObjectKey), EncryptionAlgorithm.ALG_AES_256_CBC_IV16_NO_KDF);
}

@ParameterizedTest(name = "{0}: Improved configured with ForbidEncryptAllowDecrypt can ranged get CBC")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetImprovedClientsForTest")
void improved_configured_with_forbid_encrypt_allow_decrypt_should_ranged_get_cbc(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient decClient = TestUtils.testServerClientFor(language);
CreateClientOutput decClientOutput = decClient.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
.encryptionAlgorithm(EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF)
.enableLegacyUnauthenticatedModes(true)
.enableLegacyWrappingAlgorithms(true)
.build())
.build());
String decS3ECId = decClientOutput.getClientId();

TestUtils.DecryptWithRangedGet(decClient, decS3ECId, Arrays.asList(sharedObjectKey), EncryptionAlgorithm.ALG_AES_256_CBC_IV16_NO_KDF);
}

@ParameterizedTest(name = "{0}: Improved configured with RequireEncryptAllowDecrypt should ranged get CBC")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetImprovedClientsForTest")
void improved_configured_with_require_encrypt_allow_decrypt_should_ranged_get_cbc(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient decClient = TestUtils.testServerClientFor(language);
CreateClientOutput decClientOutput = decClient.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.REQUIRE_ENCRYPT_ALLOW_DECRYPT)
.enableLegacyUnauthenticatedModes(true)
.enableLegacyWrappingAlgorithms(true)
.build())
.build());
String decS3ECId = decClientOutput.getClientId();

TestUtils.DecryptWithRangedGet(decClient, decS3ECId, Arrays.asList(sharedObjectKey), EncryptionAlgorithm.ALG_AES_256_CBC_IV16_NO_KDF);
}

@ParameterizedTest(name = "{0}: Improved configured with RequireEncryptRequireDecrypt should FAIL to ranged get CBC")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetImprovedClientsForTest")
void improved_configured_with_require_encrypt_require_decrypt_should_ranged_get_cbc(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient decClient = TestUtils.testServerClientFor(language);
CreateClientOutput decClientOutput = decClient.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT)
.enableLegacyUnauthenticatedModes(true)
.build())
.build());
String decS3ECId = decClientOutput.getClientId();

TestUtils.DecryptWithRangedGet_fails(decClient, decS3ECId, Arrays.asList(sharedObjectKey), EncryptionAlgorithm.ALG_AES_256_CBC_IV16_NO_KDF);
}
}
124 changes: 95 additions & 29 deletions test-server/java-tests/src/it/java/software/amazon/encryption/s3/GCMTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,48 +5,24 @@

package software.amazon.encryption.s3;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assertions.fail;
import static software.amazon.encryption.s3.TestUtils.*;
import static software.amazon.encryption.s3.TestUtils.appendTestSuffix;

import java.lang.annotation.ElementType;
import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.stream.Stream;

import com.amazonaws.services.s3.model.KMSEncryptionMaterials;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import org.junit.jupiter.api.TestMethodOrder;
import org.junit.jupiter.api.MethodOrderer;
import org.junit.jupiter.api.Order;
import org.junit.jupiter.api.TestMethodOrder;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.MethodSource;

import software.amazon.encryption.s3.client.S3ECTestServerClient;
import software.amazon.encryption.s3.model.CommitmentPolicy;
import software.amazon.encryption.s3.model.CreateClientInput;
import software.amazon.encryption.s3.model.CreateClientOutput;
import software.amazon.encryption.s3.model.EncryptionAlgorithm;
import software.amazon.encryption.s3.model.GetObjectInput;
import software.amazon.encryption.s3.model.GetObjectOutput;
import software.amazon.encryption.s3.model.KeyMaterial;
import software.amazon.encryption.s3.model.PutObjectInput;
import software.amazon.encryption.s3.model.S3ECConfig;
import software.amazon.encryption.s3.model.S3EncryptionClientError;

import com.amazonaws.services.s3.AmazonS3Encryption;
import com.amazonaws.services.s3.AmazonS3EncryptionClient;
import com.amazonaws.services.s3.model.CryptoConfiguration;
import com.amazonaws.services.s3.model.CryptoMode;
import com.amazonaws.services.s3.model.CryptoStorageMode;
import software.amazon.encryption.s3.TestUtils.*;
import com.amazonaws.services.s3.model.EncryptionMaterialsProvider;
import com.amazonaws.services.s3.model.KMSEncryptionMaterialsProvider;

/**
* Exhaustive tests for S3 Encryption Client round-trip operations.
Expand Down Expand Up @@ -159,6 +135,7 @@ void transition_configured_with_forbid_encrypt_allow_decrypt_should_decrypt_gcm(
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
.encryptionAlgorithm(EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF)
.build())
.build());
String S3ECId = clientOutput.getClientId();
Expand Down Expand Up @@ -199,5 +176,94 @@ void improved_configured_with_require_encrypt_require_decrypt_should_fail_to_dec

TestUtils.Decrypt_fails(client, S3ECId, crossLanguageObjects, EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF);
}

// Ranged Get Tests - using existing GCM encrypted objects with ranged-get-supported clients

@Order(21)
@ParameterizedTest(name = "{0}: Transition configured with the default can ranged get GCM")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetTransitionClientsForTest")
void transition_configured_with_the_default_can_ranged_get_gcm(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient client = TestUtils.testServerClientFor(language);
CreateClientOutput clientOutput = client.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.enableLegacyUnauthenticatedModes(true)
// .commitmentPolicy(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
.build())
.build());
String S3ECId = clientOutput.getClientId();

TestUtils.DecryptWithRangedGet(client, S3ECId, crossLanguageObjects, EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF);
}

@Order(22)
@ParameterizedTest(name = "{0}: Transition configured with ForbidEncryptAllowDecrypt can ranged get GCM")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetTransitionClientsForTest")
void transition_configured_with_forbid_encrypt_allow_decrypt_can_ranged_get_gcm(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient client = TestUtils.testServerClientFor(language);
CreateClientOutput clientOutput = client.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
.encryptionAlgorithm(EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF)
.enableLegacyUnauthenticatedModes(true)
.build())
.build());
String S3ECId = clientOutput.getClientId();

TestUtils.DecryptWithRangedGet(client, S3ECId, crossLanguageObjects, EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF);

@rishav-karanjit rishav-karanjit Nov 14, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How do this work on languages that don't support RangeGets? I don't see any logic here to skip this test. I might be also missing something

@rishav-karanjit rishav-karanjit Nov 14, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found it in testutils, its with @MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetTransitionClientsForTest") right?

@imabhichow imabhichow Nov 14, 2025

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found it in testutils, its with @MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetTransitionClientsForTest") right?

Yes

}

@Order(23)
@ParameterizedTest(name = "{0}: Improved configured with ForbidEncryptAllowDecrypt can ranged get GCM")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetImprovedClientsForTest")
void improved_configured_with_forbid_encrypt_allow_decrypt_can_ranged_get_gcm(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient client = TestUtils.testServerClientFor(language);
CreateClientOutput clientOutput = client.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.FORBID_ENCRYPT_ALLOW_DECRYPT)
.encryptionAlgorithm(EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF)
.enableLegacyUnauthenticatedModes(true)
.build())
.build());
String S3ECId = clientOutput.getClientId();

TestUtils.DecryptWithRangedGet(client, S3ECId, crossLanguageObjects, EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF);
}

@Order(24)
@ParameterizedTest(name = "{0}: Improved configured with RequireEncryptAllowDecrypt can ranged get GCM")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetImprovedClientsForTest")
void improved_configured_with_require_encrypt_allow_decrypt_can_ranged_get_gcm(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient client = TestUtils.testServerClientFor(language);
CreateClientOutput clientOutput = client.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.REQUIRE_ENCRYPT_ALLOW_DECRYPT)
.enableLegacyUnauthenticatedModes(true)
.build())
.build());
String S3ECId = clientOutput.getClientId();

TestUtils.DecryptWithRangedGet(client, S3ECId, crossLanguageObjects, EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF);
}

@Order(25)
@ParameterizedTest(name = "{0}: Improved configured with RequireEncryptRequireDecrypt should fail to ranged get GCM")
@MethodSource("software.amazon.encryption.s3.TestUtils#rangedGetImprovedClientsForTest")
void improved_configured_with_require_encrypt_require_decrypt_should_fail_to_ranged_get_gcm(TestUtils.LanguageServerTarget language) {
S3ECTestServerClient client = TestUtils.testServerClientFor(language);
CreateClientOutput clientOutput = client.createClient(CreateClientInput.builder()
.config(S3ECConfig.builder()
.keyMaterial(kmsKeyArn)
.commitmentPolicy(CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT)
.enableLegacyUnauthenticatedModes(true)
.build())
.build());
String S3ECId = clientOutput.getClientId();

TestUtils.DecryptWithRangedGet_fails(client, S3ECId, crossLanguageObjects, EncryptionAlgorithm.ALG_AES_256_GCM_IV12_TAG16_NO_KDF);
}

}
Loading
Loading