From 8c51662867c86e45d39c64412f20dbafc530c91d Mon Sep 17 00:00:00 2001 From: Sofia Brenes Date: Mon, 28 Jul 2025 16:18:17 -0600 Subject: [PATCH 1/3] Adding ExternalFileEncryptionProperties class. Only builder and constructor, not doing much with it yet --- cpp/src/parquet/encryption/encryption.cc | 48 ++++++++++++++++++++++++ cpp/src/parquet/encryption/encryption.h | 43 ++++++++++++++++++++- 2 files changed, 90 insertions(+), 1 deletion(-) diff --git a/cpp/src/parquet/encryption/encryption.cc b/cpp/src/parquet/encryption/encryption.cc index 866812d18081..7df986d5abee 100644 --- a/cpp/src/parquet/encryption/encryption.cc +++ b/cpp/src/parquet/encryption/encryption.cc @@ -324,4 +324,52 @@ FileEncryptionProperties::FileEncryptionProperties( } } +ExternalFileEncryptionProperties::Builder* ExternalFileEncryptionProperties::Builder::app_context( + const std::map& context) { + if (context.size() == 0) { + return this; + } + + if (app_context_.size() != 0) { + throw ParquetException("App context already set"); + } + + app_context_ = context; + return this; +} + +ExternalFileEncryptionProperties::Builder* +ExternalFileEncryptionProperties::Builder::connection_config( + const std::map& config) { + if (config.size() == 0) { + return this; + } + + if (connection_config_.size() != 0) { + throw ParquetException("Connection config already set"); + } + + connection_config_ = config; + return this; +} + +std::shared_ptr +ExternalFileEncryptionProperties::Builder::build_external() { + return std::shared_ptr(new ExternalFileEncryptionProperties( + parquet_cipher_, footer_key_, footer_key_metadata_, encrypted_footer_, aad_prefix_, + store_aad_prefix_in_file_, encrypted_columns_, app_context_, connection_config_)); +} + +ExternalFileEncryptionProperties::ExternalFileEncryptionProperties( + ParquetCipher::type cipher, const std::string& footer_key, + const std::string& footer_key_metadata, bool encrypted_footer, + const std::string& aad_prefix, bool store_aad_prefix_in_file, + const ColumnPathToEncryptionPropertiesMap& encrypted_columns, + const std::map& app_context, + const std::map& connection_config) + : FileEncryptionProperties(cipher, footer_key, footer_key_metadata, encrypted_footer, + aad_prefix, store_aad_prefix_in_file, encrypted_columns), + app_context_(app_context), + connection_config_(connection_config) {} + } // namespace parquet diff --git a/cpp/src/parquet/encryption/encryption.h b/cpp/src/parquet/encryption/encryption.h index f023a0f38e9e..bea4d21923c5 100644 --- a/cpp/src/parquet/encryption/encryption.h +++ b/cpp/src/parquet/encryption/encryption.h @@ -410,7 +410,7 @@ class PARQUET_EXPORT FileEncryptionProperties { aad_prefix_, store_aad_prefix_in_file_, encrypted_columns_)); } - private: + protected: ParquetCipher::type parquet_cipher_; bool encrypted_footer_; std::string footer_key_; @@ -450,10 +450,51 @@ class PARQUET_EXPORT FileEncryptionProperties { bool store_aad_prefix_in_file_; ColumnPathToEncryptionPropertiesMap encrypted_columns_; + protected: FileEncryptionProperties(ParquetCipher::type cipher, const std::string& footer_key, const std::string& footer_key_metadata, bool encrypted_footer, const std::string& aad_prefix, bool store_aad_prefix_in_file, const ColumnPathToEncryptionPropertiesMap& encrypted_columns); }; +class PARQUET_EXPORT ExternalFileEncryptionProperties : public FileEncryptionProperties { + public: + + class PARQUET_EXPORT Builder : public FileEncryptionProperties::Builder { + public: + + explicit Builder(const std::string& footer_key) + : FileEncryptionProperties::Builder(footer_key) {} + + Builder* app_context(const std::map& context); + + Builder* connection_config(const std::map& config); + + std::shared_ptr build_external(); + + private: + std::map app_context_; + std::map connection_config_; + }; + + const std::map& app_context() const { + return app_context_; + } + + const std::map& connection_config() const { + return connection_config_; + } + + private: + std::map app_context_; + std::map connection_config_; + + ExternalFileEncryptionProperties(ParquetCipher::type cipher, const std::string& footer_key, + const std::string& footer_key_metadata, bool encrypted_footer, + const std::string& aad_prefix, bool store_aad_prefix_in_file, + const ColumnPathToEncryptionPropertiesMap& encrypted_columns, + const std::map& app_context, + const std::map& connection_config); +}; + } // namespace parquet From a243a187f1c43b8855a525a4ad7a0f8868c7d789 Mon Sep 17 00:00:00 2001 From: Sofia Brenes Date: Mon, 28 Jul 2025 16:28:10 -0600 Subject: [PATCH 2/3] Adding comments --- cpp/src/parquet/encryption/encryption.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/cpp/src/parquet/encryption/encryption.h b/cpp/src/parquet/encryption/encryption.h index bea4d21923c5..4ff14646f338 100644 --- a/cpp/src/parquet/encryption/encryption.h +++ b/cpp/src/parquet/encryption/encryption.h @@ -466,8 +466,17 @@ class PARQUET_EXPORT ExternalFileEncryptionProperties : public FileEncryptionPro explicit Builder(const std::string& footer_key) : FileEncryptionProperties::Builder(footer_key) {} + /// External encryption services may use additional context provided by the application to + /// enforce robust access control. The values sent to the external service depend on each + /// implementation. Builder* app_context(const std::map& context); + /// Key/value map of the location of configuration files needed by the external + /// encryption service, including location of a dynamically-linked library, or config files + /// where the external service can find urls, certificates, and parameters needed to make a + /// remote service call. + /// For security, these values should never be sent in this config, only the locations of + /// the files that the external service will know how to access. Builder* connection_config(const std::map& config); std::shared_ptr build_external(); From 25cc0e780fd1a001598465e1cc916732efe0d2ac Mon Sep 17 00:00:00 2001 From: Sofia Brenes Date: Mon, 28 Jul 2025 22:13:32 -0600 Subject: [PATCH 3/3] Addressing PR comments --- cpp/src/parquet/encryption/encryption.cc | 20 ++++++++++---------- cpp/src/parquet/encryption/encryption.h | 16 ++++++---------- 2 files changed, 16 insertions(+), 20 deletions(-) diff --git a/cpp/src/parquet/encryption/encryption.cc b/cpp/src/parquet/encryption/encryption.cc index 7df986d5abee..477d8e6f5335 100644 --- a/cpp/src/parquet/encryption/encryption.cc +++ b/cpp/src/parquet/encryption/encryption.cc @@ -325,13 +325,13 @@ FileEncryptionProperties::FileEncryptionProperties( } ExternalFileEncryptionProperties::Builder* ExternalFileEncryptionProperties::Builder::app_context( - const std::map& context) { - if (context.size() == 0) { - return this; + const std::string& context) { + if (!app_context_.empty()) { + throw ParquetException("App context already set"); } - if (app_context_.size() != 0) { - throw ParquetException("App context already set"); + if (context.empty()) { + return this; } app_context_ = context; @@ -341,13 +341,13 @@ ExternalFileEncryptionProperties::Builder* ExternalFileEncryptionProperties::Bui ExternalFileEncryptionProperties::Builder* ExternalFileEncryptionProperties::Builder::connection_config( const std::map& config) { - if (config.size() == 0) { - return this; - } - if (connection_config_.size() != 0) { throw ParquetException("Connection config already set"); } + + if (config.size() == 0) { + return this; + } connection_config_ = config; return this; @@ -365,7 +365,7 @@ ExternalFileEncryptionProperties::ExternalFileEncryptionProperties( const std::string& footer_key_metadata, bool encrypted_footer, const std::string& aad_prefix, bool store_aad_prefix_in_file, const ColumnPathToEncryptionPropertiesMap& encrypted_columns, - const std::map& app_context, + const std::string& app_context, const std::map& connection_config) : FileEncryptionProperties(cipher, footer_key, footer_key_metadata, encrypted_footer, aad_prefix, store_aad_prefix_in_file, encrypted_columns), diff --git a/cpp/src/parquet/encryption/encryption.h b/cpp/src/parquet/encryption/encryption.h index 4ff14646f338..27b732b57423 100644 --- a/cpp/src/parquet/encryption/encryption.h +++ b/cpp/src/parquet/encryption/encryption.h @@ -466,27 +466,23 @@ class PARQUET_EXPORT ExternalFileEncryptionProperties : public FileEncryptionPro explicit Builder(const std::string& footer_key) : FileEncryptionProperties::Builder(footer_key) {} - /// External encryption services may use additional context provided by the application to - /// enforce robust access control. The values sent to the external service depend on each - /// implementation. - Builder* app_context(const std::map& context); + /// Valid JSON string with additional application context needed for security checks. + Builder* app_context(const std::string& context); /// Key/value map of the location of configuration files needed by the external /// encryption service, including location of a dynamically-linked library, or config files /// where the external service can find urls, certificates, and parameters needed to make a /// remote service call. - /// For security, these values should never be sent in this config, only the locations of - /// the files that the external service will know how to access. Builder* connection_config(const std::map& config); std::shared_ptr build_external(); private: - std::map app_context_; + std::string app_context_; std::map connection_config_; }; - const std::map& app_context() const { + const std::string& app_context() const { return app_context_; } @@ -495,14 +491,14 @@ class PARQUET_EXPORT ExternalFileEncryptionProperties : public FileEncryptionPro } private: - std::map app_context_; + std::string app_context_; std::map connection_config_; ExternalFileEncryptionProperties(ParquetCipher::type cipher, const std::string& footer_key, const std::string& footer_key_metadata, bool encrypted_footer, const std::string& aad_prefix, bool store_aad_prefix_in_file, const ColumnPathToEncryptionPropertiesMap& encrypted_columns, - const std::map& app_context, + const std::string& app_context, const std::map& connection_config); };