fix: allow CipherSubscriber to determine if the part is last part

pom.xml

@@ -56,7 +56,7 @@
       <dependency>
         <groupId>software.amazon.awssdk</groupId>
         <artifactId>bom</artifactId>
-        <version>2.30.38</version>
+        <version>2.31.14</version>
         <optional>true</optional>
         <type>pom</type>
         <scope>import</scope>
@@ -68,21 +68,21 @@
     <dependency>
       <groupId>software.amazon.awssdk</groupId>
       <artifactId>s3</artifactId>
-      <version>2.30.38</version>
+      <version>2.31.14</version>
     </dependency>
 
     <dependency>
       <groupId>software.amazon.awssdk</groupId>
       <artifactId>kms</artifactId>
-      <version>2.30.38</version>
+      <version>2.31.14</version>
     </dependency>
 
     <!-- Used when enableMultipartPutObject is configured -->
     <dependency>
       <groupId>software.amazon.awssdk.crt</groupId>
       <artifactId>aws-crt</artifactId>
       <optional>true</optional>
-      <version>0.36.3</version>
+      <version>0.37.0</version>
     </dependency>
 
     <dependency>
@@ -163,7 +163,7 @@
     <dependency>
       <groupId>software.amazon.awssdk</groupId>
       <artifactId>sts</artifactId>
-      <version>2.30.38</version>
+      <version>2.31.14</version>
       <optional>true</optional>
       <scope>test</scope>
     </dependency>

src/examples/java/software/amazon/encryption/s3/examples/MultipartUploadExample.java

@@ -1,10 +1,6 @@
 package software.amazon.encryption.s3.examples;
 
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static software.amazon.encryption.s3.S3EncryptionClient.withAdditionalConfiguration;
-import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.KMS_KEY_ID;
-import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.appendTestSuffix;
-
+import org.apache.commons.io.IOUtils;
 import software.amazon.awssdk.core.ResponseInputStream;
 import software.amazon.awssdk.core.sync.RequestBody;
 import software.amazon.awssdk.services.s3.S3Client;
@@ -26,7 +22,10 @@
 import java.util.List;
 import java.util.Map;
 
-import org.apache.commons.io.IOUtils;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static software.amazon.encryption.s3.S3EncryptionClient.withAdditionalConfiguration;
+import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.KMS_KEY_ID;
+import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.appendTestSuffix;
 
 public class MultipartUploadExample {
     public static String BUCKET;

src/main/java/software/amazon/encryption/s3/internal/CipherAsyncRequestBody.java

@@ -20,12 +20,14 @@ public class CipherAsyncRequestBody implements AsyncRequestBody {
     private final Long ciphertextLength;
     private final CryptographicMaterials materials;
     private final byte[] iv;
+    private final boolean isLastPart;
 
     public CipherAsyncRequestBody(final AsyncRequestBody wrappedAsyncRequestBody, final Long ciphertextLength, final CryptographicMaterials materials, final byte[] iv, final boolean isLastPart) {
         this.wrappedAsyncRequestBody = wrappedAsyncRequestBody;
         this.ciphertextLength = ciphertextLength;
         this.materials = materials;
         this.iv = iv;
+        this.isLastPart = isLastPart;
     }
 
     public CipherAsyncRequestBody(final AsyncRequestBody wrappedAsyncRequestBody, final Long ciphertextLength, final CryptographicMaterials materials, final byte[] iv) {
@@ -38,7 +40,7 @@ public CipherAsyncRequestBody(final AsyncRequestBody wrappedAsyncRequestBody, fi
     public void subscribe(Subscriber<? super ByteBuffer> subscriber) {
         wrappedAsyncRequestBody.subscribe(new CipherSubscriber(subscriber,
                 contentLength().orElseThrow(() -> new S3EncryptionClientException("Unbounded streams are currently not supported.")),
-                materials, iv));
+                materials, iv, isLastPart));
     }
 
     @Override

src/main/java/software/amazon/encryption/s3/internal/CipherSubscriber.java

@@ -18,17 +18,13 @@ public class CipherSubscriber implements Subscriber<ByteBuffer> {
     private final Subscriber<? super ByteBuffer> wrappedSubscriber;
     private Cipher cipher;
     private final Long contentLength;
-    private final CryptographicMaterials materials;
-    private byte[] iv;
     private boolean isLastPart;
 
     private byte[] outputBuffer;
 
     CipherSubscriber(Subscriber<? super ByteBuffer> wrappedSubscriber, Long contentLength, CryptographicMaterials materials, byte[] iv, boolean isLastPart) {
         this.wrappedSubscriber = wrappedSubscriber;
         this.contentLength = contentLength;
-        this.materials = materials;
-        this.iv = iv;
         cipher = materials.getCipher(iv);
         this.isLastPart = isLastPart;
     }

src/main/java/software/amazon/encryption/s3/internal/GetEncryptedObjectPipeline.java

@@ -17,12 +17,7 @@
 import software.amazon.encryption.s3.materials.DecryptionMaterials;
 import software.amazon.encryption.s3.materials.EncryptedDataKey;
 
-import javax.crypto.Cipher;
-import javax.crypto.SecretKey;
-import javax.crypto.spec.GCMParameterSpec;
-import javax.crypto.spec.IvParameterSpec;
 import java.nio.ByteBuffer;
-import java.security.GeneralSecurityException;
 import java.util.Collections;
 import java.util.List;
 import java.util.concurrent.CompletableFuture;
@@ -143,42 +138,23 @@ public void onStream(SdkPublisher<ByteBuffer> ciphertextPublisher) {
             long[] desiredRange = RangedGetUtils.getRange(materials.getContentRange());
             long[] cryptoRange = RangedGetUtils.getCryptoRange(materials.getContentRange());
             AlgorithmSuite algorithmSuite = materials.algorithmSuite();
-            SecretKey contentKey = materials.dataKey();
-            final int tagLength = algorithmSuite.cipherTagLengthBits();
             byte[] iv = contentMetadata.contentIv();
             if (algorithmSuite == AlgorithmSuite.ALG_AES_256_CTR_IV16_TAG16_NO_KDF) {
                 iv = AesCtrUtils.adjustIV(iv, cryptoRange[0]);
             }
-            try {
-                final Cipher cipher = CryptoFactory.createCipher(algorithmSuite.cipherName(), materials.cryptoProvider());
-                switch (algorithmSuite) {
-                    case ALG_AES_256_GCM_IV12_TAG16_NO_KDF:
-                        cipher.init(Cipher.DECRYPT_MODE, contentKey, new GCMParameterSpec(tagLength, iv));
-                        break;
-                    case ALG_AES_256_CTR_IV16_TAG16_NO_KDF:
-                    case ALG_AES_256_CBC_IV16_NO_KDF:
-                        cipher.init(Cipher.DECRYPT_MODE, contentKey, new IvParameterSpec(iv));
-                        break;
-                    default:
-                        throw new S3EncryptionClientException("Unknown algorithm: " + algorithmSuite.cipherName());
-                }
-
-                if (algorithmSuite.equals(AlgorithmSuite.ALG_AES_256_CBC_IV16_NO_KDF)
-                        || algorithmSuite.equals(AlgorithmSuite.ALG_AES_256_CTR_IV16_TAG16_NO_KDF)
-                        || _enableDelayedAuthentication) {
-                    // CBC and GCM with delayed auth enabled use a standard publisher
-                    CipherPublisher plaintextPublisher = new CipherPublisher(ciphertextPublisher,
-                            getObjectResponse.contentLength(), desiredRange, contentMetadata.contentRange(), algorithmSuite.cipherTagLengthBits(), materials, iv);
-                    wrappedAsyncResponseTransformer.onStream(plaintextPublisher);
-                } else {
-                    // Use buffered publisher for GCM when delayed auth is not enabled
-                    BufferedCipherPublisher plaintextPublisher = new BufferedCipherPublisher(ciphertextPublisher,
-                            getObjectResponse.contentLength(), materials, iv, _bufferSize);
-                    wrappedAsyncResponseTransformer.onStream(plaintextPublisher);
-                }
-
-            } catch (GeneralSecurityException e) {
-                throw new S3EncryptionClientException("Unable to " + algorithmSuite.cipherName() + " content decrypt.", e);
+
+            if (algorithmSuite.equals(AlgorithmSuite.ALG_AES_256_CBC_IV16_NO_KDF)
+                    || algorithmSuite.equals(AlgorithmSuite.ALG_AES_256_CTR_IV16_TAG16_NO_KDF)
+                    || _enableDelayedAuthentication) {
+                // CBC and GCM with delayed auth enabled use a standard publisher
+                CipherPublisher plaintextPublisher = new CipherPublisher(ciphertextPublisher,
+                        getObjectResponse.contentLength(), desiredRange, contentMetadata.contentRange(), algorithmSuite.cipherTagLengthBits(), materials, iv);
+                wrappedAsyncResponseTransformer.onStream(plaintextPublisher);
+            } else {
+                // Use buffered publisher for GCM when delayed auth is not enabled
+                BufferedCipherPublisher plaintextPublisher = new BufferedCipherPublisher(ciphertextPublisher,
+                        getObjectResponse.contentLength(), materials, iv, _bufferSize);
+                wrappedAsyncResponseTransformer.onStream(plaintextPublisher);
             }
         }
     }

src/test/java/software/amazon/encryption/s3/examples/AsyncClientExampleTest.java

@@ -3,11 +3,18 @@
 import org.junit.jupiter.api.Test;
 import software.amazon.encryption.s3.utils.S3EncryptionClientTestResources;
 
+import static org.junit.jupiter.api.Assertions.fail;
+
 public class AsyncClientExampleTest {
 
     @Test
     public void testAsyncClientExamples() {
         final String bucket = S3EncryptionClientTestResources.BUCKET;
-        AsyncClientExample.main(new String[]{bucket});
+        try {
+            AsyncClientExample.main(new String[]{bucket});
+        } catch (Throwable exception) {
+            exception.printStackTrace();
+            fail("Async Example Test Failed!!", exception);
+        }
     }
 }

src/test/java/software/amazon/encryption/s3/examples/ClientConfigurationExampleTest.java

@@ -2,9 +2,16 @@
 
 import org.junit.jupiter.api.Test;
 
+import static org.junit.jupiter.api.Assertions.fail;
+
 public class ClientConfigurationExampleTest {
   @Test
   public void testClientConfigurationExamples() {
-      ClientConfigurationExample.main(new String[0]);
+      try {
+          ClientConfigurationExample.main(new String[0]);
+      } catch (Throwable exception) {
+          exception.printStackTrace();
+          fail("Client Configuration Example Test Failed!!", exception);
+      }
   }
 }

src/test/java/software/amazon/encryption/s3/examples/MultipartUploadExampleTest.java

@@ -3,13 +3,18 @@
 import org.junit.jupiter.api.Test;
 import software.amazon.encryption.s3.utils.S3EncryptionClientTestResources;
 
-import java.io.IOException;
+import static org.junit.jupiter.api.Assertions.fail;
 
 public class MultipartUploadExampleTest {
 
     @Test
-    public void testMultipartUploadExamples() throws IOException {
+    public void testMultipartUploadExamples() {
         final String bucket = S3EncryptionClientTestResources.BUCKET;
-        MultipartUploadExample.main(new String[]{bucket});
+        try {
+            MultipartUploadExample.main(new String[]{bucket});
+        } catch (Throwable exception) {
+            exception.printStackTrace();
+            fail("Multipart Example Test Failed!!", exception);
+        }
     }
 }

src/test/java/software/amazon/encryption/s3/examples/PartialKeyPairExampleTest.java

@@ -5,12 +5,18 @@
 import org.junit.jupiter.api.Test;
 import software.amazon.encryption.s3.utils.S3EncryptionClientTestResources;
 
+import static org.junit.jupiter.api.Assertions.fail;
+
 public class PartialKeyPairExampleTest {
 
     @Test
     public void testPartialKeyPairExamples() {
         final String bucket = S3EncryptionClientTestResources.BUCKET;
-
-        PartialKeyPairExample.main(new String[]{bucket});
+        try {
+            PartialKeyPairExample.main(new String[]{bucket});
+        } catch (Throwable exception) {
+            exception.printStackTrace();
+            fail("Partial Key Pair Example Test Failed!!", exception);
+        }
     }
 }

src/test/java/software/amazon/encryption/s3/examples/RangedGetExampleTest.java

@@ -3,11 +3,18 @@
 import org.junit.jupiter.api.Test;
 import software.amazon.encryption.s3.utils.S3EncryptionClientTestResources;
 
+import static org.junit.jupiter.api.Assertions.fail;
+
 public class RangedGetExampleTest {
 
     @Test
     public void testRangedGetExamples() {
         final String bucket = S3EncryptionClientTestResources.BUCKET;
-        RangedGetExample.main(new String[]{bucket});
+        try {
+            RangedGetExample.main(new String[]{bucket});
+        } catch (Throwable exception) {
+            exception.printStackTrace();
+            fail("Ranged Get Test Failed!!", exception);
+        }
     }
 }