libmongocrypt-helper 1.6.1.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-private.h

@@ -0,0 +1,269 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_CTX_PRIVATE_H
+#define MONGOCRYPT_CTX_PRIVATE_H
+
+#include "mongocrypt.h"
+#include "mongocrypt-private.h"
+#include "mongocrypt-buffer-private.h"
+#include "mongocrypt-key-broker-private.h"
+#include "mongocrypt-key-private.h"
+#include "mongocrypt-endpoint-private.h"
+#include "mc-efc-private.h"
+#include "mc-optional-private.h"
+#include "mc-rangeopts-private.h"
+
+typedef enum {
+   _MONGOCRYPT_TYPE_NONE,
+   _MONGOCRYPT_TYPE_ENCRYPT,
+   _MONGOCRYPT_TYPE_DECRYPT,
+   _MONGOCRYPT_TYPE_CREATE_DATA_KEY,
+   _MONGOCRYPT_TYPE_REWRAP_MANY_DATAKEY,
+   _MONGOCRYPT_TYPE_COMPACT,
+} _mongocrypt_ctx_type_t;
+
+typedef enum {
+   MONGOCRYPT_INDEX_TYPE_NONE = 1,
+   MONGOCRYPT_INDEX_TYPE_EQUALITY = 2,
+   MONGOCRYPT_INDEX_TYPE_RANGEPREVIEW = 3
+} mongocrypt_index_type_t;
+
+const char *
+_mongocrypt_index_type_to_string (mongocrypt_index_type_t val);
+
+typedef enum {
+   MONGOCRYPT_QUERY_TYPE_EQUALITY = 1,
+   MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW = 2
+} mongocrypt_query_type_t;
+
+const char *
+_mongocrypt_query_type_to_string (mongocrypt_query_type_t val);
+
+/* Option values are validated when set.
+ * Different contexts accept/require different options,
+ * validated when a context is initialized.
+ */
+typedef struct __mongocrypt_ctx_opts_t {
+   _mongocrypt_buffer_t key_id;
+   _mongocrypt_key_alt_name_t *key_alt_names;
+   _mongocrypt_buffer_t key_material;
+   mongocrypt_encryption_algorithm_t algorithm;
+   _mongocrypt_kek_t kek;
+   struct {
+      mongocrypt_index_type_t value;
+      bool set;
+   } index_type;
+   _mongocrypt_buffer_t index_key_id;
+   struct {
+      int64_t value;
+      bool set;
+   } contention_factor;
+   struct {
+      mongocrypt_query_type_t value;
+      bool set;
+   } query_type;
+   struct {
+      mc_RangeOpts_t value;
+      bool set;
+   } rangeopts;
+} _mongocrypt_ctx_opts_t;
+
+
+/* All derived contexts may override these methods. */
+typedef struct {
+   bool (*mongo_op_collinfo) (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out);
+   bool (*mongo_feed_collinfo) (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *in);
+   bool (*mongo_done_collinfo) (mongocrypt_ctx_t *ctx);
+   bool (*mongo_op_markings) (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out);
+   bool (*mongo_feed_markings) (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *in);
+   bool (*mongo_done_markings) (mongocrypt_ctx_t *ctx);
+   bool (*mongo_op_keys) (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out);
+   bool (*mongo_feed_keys) (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *in);
+   bool (*mongo_done_keys) (mongocrypt_ctx_t *ctx);
+   bool (*after_kms_credentials_provided) (mongocrypt_ctx_t *ctx);
+   mongocrypt_kms_ctx_t *(*next_kms_ctx) (mongocrypt_ctx_t *ctx);
+   bool (*kms_done) (mongocrypt_ctx_t *ctx);
+   bool (*finalize) (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out);
+   void (*cleanup) (mongocrypt_ctx_t *ctx);
+} _mongocrypt_vtable_t;
+
+
+struct _mongocrypt_ctx_t {
+   mongocrypt_t *crypt;
+   mongocrypt_ctx_state_t state;
+   _mongocrypt_ctx_type_t type;
+   mongocrypt_status_t *status;
+   _mongocrypt_key_broker_t kb;
+   _mongocrypt_vtable_t vtable;
+   _mongocrypt_ctx_opts_t opts;
+   _mongocrypt_opts_kms_providers_t per_ctx_kms_providers; /* owned */
+   _mongocrypt_opts_kms_providers_t
+      kms_providers; /* not owned, is merged from per-ctx / per-mongocrypt_t */
+   bool initialized;
+   /* nothing_to_do is set to true under these conditions:
+    * 1. No keys are requested
+    * 2. The command is bypassed for automatic encryption (e.g. ping).
+    * 3. bypass_query_analysis is true.
+    * TODO (MONGOCRYPT-422) replace nothing_to_do.
+    */
+   bool nothing_to_do;
+};
+
+
+/* Transition to the error state. An error status must have been set. */
+bool
+_mongocrypt_ctx_fail (mongocrypt_ctx_t *ctx);
+
+
+/* Set an error status and transition to the error state. */
+bool
+_mongocrypt_ctx_fail_w_msg (mongocrypt_ctx_t *ctx, const char *msg);
+
+
+typedef struct {
+   mongocrypt_ctx_t parent;
+   bool explicit;
+   char *coll_name;
+   char *db_name;
+   char *ns;
+   _mongocrypt_buffer_t list_collections_filter;
+   _mongocrypt_buffer_t schema;
+   /* TODO CDRIVER-3150: audit + rename these buffers.
+    * original_cmd for explicit is {v: <BSON value>}, for auto is the command to
+    * be encrypted.
+    *
+    * mongocryptd_cmd is only applicable for auto encryption. It is the original
+    * command with JSONSchema appended.
+    *
+    * marked_cmd is the value of the 'result' field in mongocryptd response
+    *
+    * encrypted_cmd is the final output, the original command encrypted, or for
+    * explicit, the {v: <ciphertext>} doc.
+    */
+   _mongocrypt_buffer_t original_cmd;
+   _mongocrypt_buffer_t mongocryptd_cmd;
+   _mongocrypt_buffer_t marked_cmd;
+   _mongocrypt_buffer_t encrypted_cmd;
+   _mongocrypt_buffer_t key_id;
+   bool used_local_schema;
+   /* collinfo_has_siblings is true if the schema came from a remote JSON
+    * schema, and there were siblings. */
+   bool collinfo_has_siblings;
+   /* encrypted_field_config is set when:
+    * 1. <db_name>.<coll_name> is present in an encrypted_field_config_map.
+    * 2. (TODO MONGOCRYPT-414) The collection has encryptedFields in the
+    * response to listCollections. encrypted_field_config is true if and only if
+    * encryption is using FLE 2.0.
+    */
+   _mongocrypt_buffer_t encrypted_field_config;
+   mc_EncryptedFieldConfig_t efc;
+   /* bypass_query_analysis is set to true to skip the
+    * MONGOCRYPT_CTX_NEED_MONGO_MARKINGS state. */
+   bool bypass_query_analysis;
+   struct {
+      bool needed;
+      _mongocrypt_buffer_t cmd;
+      int32_t maxwireversion;
+   } ismaster;
+   // cmd_name is the first BSON field in original_cmd for auto encryption.
+   const char *cmd_name;
+} _mongocrypt_ctx_encrypt_t;
+
+
+typedef struct {
+   mongocrypt_ctx_t parent;
+   /* TODO CDRIVER-3150: audit + rename these buffers.
+    * Unlike ctx_encrypt, unwrapped_doc holds the binary value of the {v:
+    * <ciphertext>} doc.
+    * */
+   _mongocrypt_buffer_t original_doc;
+   _mongocrypt_buffer_t decrypted_doc;
+} _mongocrypt_ctx_decrypt_t;
+
+
+typedef struct {
+   mongocrypt_ctx_t parent;
+   mongocrypt_kms_ctx_t kms;
+   bool kms_returned;
+   _mongocrypt_buffer_t key_doc;
+   _mongocrypt_buffer_t plaintext_key_material;
+   _mongocrypt_buffer_t encrypted_key_material;
+
+   const char *kmip_unique_identifier;
+   bool kmip_activated;
+   _mongocrypt_buffer_t kmip_secretdata;
+} _mongocrypt_ctx_datakey_t;
+
+
+typedef struct _mongocrypt_ctx_rmd_datakey_t _mongocrypt_ctx_rmd_datakey_t;
+
+struct _mongocrypt_ctx_rmd_datakey_t {
+   _mongocrypt_ctx_rmd_datakey_t *next;
+   mongocrypt_ctx_t *dkctx;
+   _mongocrypt_key_doc_t *doc;
+};
+
+typedef struct {
+   mongocrypt_ctx_t parent;
+   _mongocrypt_buffer_t filter;
+   mongocrypt_kms_ctx_t kms;
+   _mongocrypt_ctx_rmd_datakey_t *datakeys;
+   _mongocrypt_ctx_rmd_datakey_t *datakeys_iter;
+   _mongocrypt_buffer_t results;
+} _mongocrypt_ctx_rewrap_many_datakey_t;
+
+typedef struct {
+   mongocrypt_ctx_t parent;
+   _mongocrypt_buffer_t result;
+   mc_EncryptedFieldConfig_t efc;
+} _mongocrypt_ctx_compact_t;
+
+
+/* Used for option validation. True means required. False means prohibited. */
+typedef enum {
+   OPT_PROHIBITED = 0,
+   OPT_REQUIRED,
+   OPT_OPTIONAL
+} _mongocrypt_ctx_opt_spec_t;
+
+typedef struct {
+   _mongocrypt_ctx_opt_spec_t kek;
+   _mongocrypt_ctx_opt_spec_t schema;
+   _mongocrypt_ctx_opt_spec_t key_descriptor; /* a key_id or key_alt_name */
+   _mongocrypt_ctx_opt_spec_t key_alt_names;
+   _mongocrypt_ctx_opt_spec_t key_material;
+   _mongocrypt_ctx_opt_spec_t algorithm;
+   _mongocrypt_ctx_opt_spec_t rangeopts;
+} _mongocrypt_ctx_opts_spec_t;
+
+/* Common initialization. */
+bool
+_mongocrypt_ctx_init (mongocrypt_ctx_t *ctx,
+                      _mongocrypt_ctx_opts_spec_t *opt_spec)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* Set the state of the context from the state of keys in the key broker. */
+bool
+_mongocrypt_ctx_state_from_key_broker (mongocrypt_ctx_t *ctx)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* Get the KMS providers for the current context, fall back to the ones
+ * from mongocrypt_t if none are provided for the context specifically. */
+_mongocrypt_opts_kms_providers_t *
+_mongocrypt_ctx_kms_providers (mongocrypt_ctx_t *ctx);
+
+#endif /* MONGOCRYPT_CTX_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-rewrap-many-datakey.c

@@ -0,0 +1,415 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mongocrypt-ctx-private.h"
+
+
+static bool
+_finalize (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   bson_t doc = BSON_INITIALIZER;
+   bson_t array = BSON_INITIALIZER;
+
+   BSON_ASSERT_PARAM (ctx);
+   BSON_ASSERT_PARAM (out);
+
+   BSON_ASSERT (BSON_APPEND_ARRAY_BEGIN (&doc, "v", &array));
+   {
+      _mongocrypt_ctx_rmd_datakey_t *iter = NULL;
+      size_t idx = 0u;
+
+      for (iter = rmdctx->datakeys; iter; (iter = iter->next), (++idx)) {
+         mongocrypt_binary_t bin;
+         bson_t bson;
+         bson_t elem = BSON_INITIALIZER;
+
+         if (!mongocrypt_ctx_finalize (iter->dkctx, &bin)) {
+            return _mongocrypt_ctx_fail_w_msg (
+               ctx, "failed to encrypt datakey with new provider");
+         }
+
+         BSON_ASSERT (bson_init_static (&bson, bin.data, bin.len));
+
+         /* Among all (possible) fields in key document, the only fields
+          * required by caller to construct the corresponding bulk write
+          * operations to update the key document with rewrapped key material
+          * are:
+          *   - _id (same as original key)
+          *   - keyMaterial (updated)
+          *   - masterKey (updated)
+          * Which means the following fields can be excluded:
+          *   - _id (discard new ID generated during rewrapping)
+          *   - creationDate
+          *   - updateDate (updated via the $currentDate operator)
+          *   - status
+          *   - keyAltNames
+          */
+         bson_copy_to_excluding_noinit (&bson,
+                                        &elem,
+                                        "_id",
+                                        "creationDate",
+                                        "updateDate",
+                                        "status",
+                                        "keyAltNames",
+                                        NULL);
+
+         /* Preserve key ID of original document. */
+         BSON_ASSERT (iter->doc);
+         BSON_ASSERT (BSON_APPEND_BINARY (&elem,
+                                          "_id",
+                                          BSON_SUBTYPE_UUID,
+                                          iter->doc->id.data,
+                                          iter->doc->id.len));
+
+         /* Array indicies must be specified manually. */
+         {
+            char *idx_str = bson_strdup_printf ("%zu", idx);
+            BSON_ASSERT (BSON_APPEND_DOCUMENT (&array, idx_str, &elem));
+            bson_free (idx_str);
+         }
+
+         bson_destroy (&elem);
+      }
+   }
+   BSON_ASSERT (bson_append_array_end (&doc, &array));
+
+   /* Extend lifetime of bson so it can be referenced by out parameter. */
+   _mongocrypt_buffer_steal_from_bson (&rmdctx->results, &doc);
+
+   out->data = rmdctx->results.data;
+   out->len = rmdctx->results.len;
+
+   ctx->state = MONGOCRYPT_CTX_DONE;
+
+   return true;
+}
+
+static bool
+_kms_done_encrypt (mongocrypt_ctx_t *ctx)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   BSON_ASSERT_PARAM (ctx);
+
+   {
+      _mongocrypt_ctx_rmd_datakey_t *iter;
+
+      for (iter = rmdctx->datakeys; iter; iter = iter->next) {
+         if (iter->dkctx->state == MONGOCRYPT_CTX_NEED_KMS &&
+             !mongocrypt_ctx_kms_done (iter->dkctx)) {
+            _mongocrypt_status_copy_to (iter->dkctx->status, ctx->status);
+            return _mongocrypt_ctx_fail (ctx);
+         }
+      }
+   }
+
+   /* Some providers may require multiple rounds of KMS requests. Reiterate
+    * through datakey contexts to verify if more work needs to be done. */
+   rmdctx->datakeys_iter = rmdctx->datakeys;
+
+   while (rmdctx->datakeys_iter &&
+          rmdctx->datakeys_iter->dkctx->state != MONGOCRYPT_CTX_NEED_KMS) {
+      rmdctx->datakeys_iter = rmdctx->datakeys_iter->next;
+   }
+
+   if (rmdctx->datakeys_iter) {
+      /* More work to be done, remain in MONGOCRYPT_CTX_NEED_KMS state. */
+      return true;
+   }
+
+   /* All datakeys have been encrypted and are ready to be finalized. */
+   ctx->state = MONGOCRYPT_CTX_READY;
+   ctx->vtable.finalize = _finalize;
+
+   return true;
+}
+
+static mongocrypt_kms_ctx_t *
+_next_kms_ctx_encrypt (mongocrypt_ctx_t *ctx)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   mongocrypt_ctx_t *dkctx = NULL;
+
+   BSON_ASSERT_PARAM (ctx);
+
+   /* No more datakey contexts requiring KMS. */
+   if (!rmdctx->datakeys_iter) {
+      return NULL;
+   }
+
+   dkctx = rmdctx->datakeys_iter->dkctx;
+
+   /* Skip next iterator ahead to next datakey context that needs KMS. */
+   do {
+      rmdctx->datakeys_iter = rmdctx->datakeys_iter->next;
+   } while (rmdctx->datakeys_iter &&
+            rmdctx->datakeys_iter->dkctx->state != MONGOCRYPT_CTX_NEED_KMS);
+
+   return mongocrypt_ctx_next_kms_ctx (dkctx);
+}
+
+static bool
+_add_new_datakey (mongocrypt_ctx_t *ctx, key_returned_t *key)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   BSON_ASSERT_PARAM (ctx);
+   BSON_ASSERT_PARAM (key);
+
+   /* Datakey should be fully decrypted at this stage. */
+   BSON_ASSERT (key->decrypted);
+
+   _mongocrypt_ctx_rmd_datakey_t *const datakey =
+      bson_malloc0 (sizeof (_mongocrypt_ctx_rmd_datakey_t));
+
+   datakey->dkctx = mongocrypt_ctx_new (ctx->crypt);
+   datakey->next = rmdctx->datakeys;
+   datakey->doc = key->doc;
+   rmdctx->datakeys = datakey; /* Ownership transfer. */
+
+   /* Set new provider and master key (rewrapManyDataKeyOpts). */
+   if (ctx->opts.kek.kms_provider == MONGOCRYPT_KMS_PROVIDER_NONE) {
+      /* Reuse current KMS provider if option not set. */
+      _mongocrypt_kek_copy_to (&key->doc->kek, &datakey->dkctx->opts.kek);
+   } else {
+      /* Apply new KMS provider as given by options. */
+      _mongocrypt_kek_copy_to (&ctx->opts.kek, &datakey->dkctx->opts.kek);
+   }
+
+   /* Preserve alt names. */
+   datakey->dkctx->opts.key_alt_names =
+      _mongocrypt_key_alt_name_copy_all (key->doc->key_alt_names);
+
+   /* Preserve key material. */
+   _mongocrypt_buffer_copy_to (&key->decrypted_key_material,
+                               &datakey->dkctx->opts.key_material);
+
+   if (!mongocrypt_ctx_datakey_init (datakey->dkctx)) {
+      _mongocrypt_status_copy_to (datakey->dkctx->status, ctx->status);
+      return _mongocrypt_ctx_fail (ctx);
+   }
+
+   /* Reuse KMS credentials provided during decryption. */
+   if (datakey->dkctx->state == MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS) {
+      memcpy (&datakey->dkctx->kms_providers,
+              _mongocrypt_ctx_kms_providers (ctx),
+              sizeof (_mongocrypt_opts_kms_providers_t));
+      if (!datakey->dkctx->vtable.after_kms_credentials_provided (
+             datakey->dkctx)) {
+         _mongocrypt_status_copy_to (datakey->dkctx->status, ctx->status);
+         return _mongocrypt_ctx_fail (ctx);
+      }
+   }
+
+   return true;
+}
+
+static bool
+_start_kms_encrypt (mongocrypt_ctx_t *ctx)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   BSON_ASSERT_PARAM (ctx);
+
+   /* Finish KMS requests for decryption if there were any. */
+   if (ctx->state == MONGOCRYPT_CTX_NEED_KMS) {
+      _mongocrypt_opts_kms_providers_t *const providers =
+         _mongocrypt_ctx_kms_providers (ctx);
+
+      if (!_mongocrypt_key_broker_kms_done (&ctx->kb, providers)) {
+         _mongocrypt_status_copy_to (ctx->kb.status, ctx->status);
+         return _mongocrypt_ctx_fail (ctx);
+      }
+
+      if (!_mongocrypt_ctx_state_from_key_broker (ctx)) {
+         return _mongocrypt_ctx_fail (ctx);
+      }
+
+      /* Some providers may require multiple rounds of KMS requests. */
+      if (ctx->state == MONGOCRYPT_CTX_NEED_KMS) {
+         return true;
+      }
+   }
+
+   /* All datakeys should be decrypted at this point. */
+   BSON_ASSERT (ctx->state == MONGOCRYPT_CTX_READY);
+
+   /* For all decrypted datakeys, initialize a corresponding datakey context. */
+   {
+      key_returned_t *key;
+
+      /* Some decrypted keys may have been cached. */
+      for (key = ctx->kb.keys_cached; key; key = key->next) {
+         if (!_add_new_datakey (ctx, key)) {
+            return _mongocrypt_ctx_fail (ctx);
+         }
+      }
+
+      /* Remaining keys were decrypted via KMS requests. */
+      for (key = ctx->kb.keys_returned; key; key = key->next) {
+         if (!_add_new_datakey (ctx, key)) {
+            return _mongocrypt_ctx_fail (ctx);
+         }
+      }
+   }
+
+   /* Prepare iterator used by _next_kms_ctx_encrypt. */
+   rmdctx->datakeys_iter = rmdctx->datakeys;
+
+   /* Skip datakeys that do not require a KMS request. */
+   while (rmdctx->datakeys_iter &&
+          rmdctx->datakeys_iter->dkctx->state == MONGOCRYPT_CTX_READY) {
+      rmdctx->datakeys_iter = rmdctx->datakeys_iter->next;
+   }
+
+   /* Skip to READY state if no KMS requests are required. */
+   if (!rmdctx->datakeys_iter) {
+      ctx->state = MONGOCRYPT_CTX_READY;
+      ctx->vtable.finalize = _finalize;
+      return true;
+   }
+
+   ctx->state = MONGOCRYPT_CTX_NEED_KMS;
+   ctx->vtable.next_kms_ctx = _next_kms_ctx_encrypt;
+   ctx->vtable.kms_done = _kms_done_encrypt;
+
+   return true;
+}
+
+static bool
+_mongo_done_keys (mongocrypt_ctx_t *ctx)
+{
+   BSON_ASSERT_PARAM (ctx);
+
+   if (!_mongocrypt_key_broker_docs_done (&ctx->kb) ||
+       !_mongocrypt_ctx_state_from_key_broker (ctx)) {
+      return _mongocrypt_ctx_fail (ctx);
+   }
+
+   /* No keys to rewrap, no work to be done. */
+   if (!ctx->kb.key_requests) {
+      ctx->state = MONGOCRYPT_CTX_DONE;
+      return true;
+   }
+
+   /* No KMS required, skip straight to encryption. */
+   if (ctx->state == MONGOCRYPT_CTX_READY) {
+      return _start_kms_encrypt (ctx);
+   }
+
+   /* KMS requests needed to decrypt keys. */
+   BSON_ASSERT (ctx->state == MONGOCRYPT_CTX_NEED_KMS);
+
+   return true;
+}
+
+static bool
+_mongo_op_keys (mongocrypt_ctx_t *ctx, mongocrypt_binary_t *out)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   BSON_ASSERT_PARAM (ctx);
+   BSON_ASSERT_PARAM (out);
+
+   _mongocrypt_buffer_to_binary (&rmdctx->filter, out);
+
+   return true;
+}
+
+static bool
+_kms_start_decrypt (mongocrypt_ctx_t *ctx)
+{
+   BSON_ASSERT_PARAM (ctx);
+
+   return _mongocrypt_key_broker_request_any (&ctx->kb) &&
+          _mongocrypt_ctx_state_from_key_broker (ctx);
+}
+
+static void
+_cleanup (mongocrypt_ctx_t *ctx)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   BSON_ASSERT_PARAM (ctx);
+
+   _mongocrypt_buffer_cleanup (&rmdctx->results);
+
+   while (rmdctx->datakeys) {
+      _mongocrypt_ctx_rmd_datakey_t *result = rmdctx->datakeys;
+      rmdctx->datakeys = result->next;
+
+      mongocrypt_ctx_destroy (result->dkctx);
+      bson_free (result);
+   }
+
+   _mongocrypt_kms_ctx_cleanup (&rmdctx->kms);
+   _mongocrypt_buffer_cleanup (&rmdctx->filter);
+}
+
+bool
+mongocrypt_ctx_rewrap_many_datakey_init (mongocrypt_ctx_t *ctx,
+                                         mongocrypt_binary_t *filter)
+{
+   _mongocrypt_ctx_rewrap_many_datakey_t *const rmdctx =
+      (_mongocrypt_ctx_rewrap_many_datakey_t *) ctx;
+
+   if (!ctx) {
+      return false;
+   }
+
+   if (!filter) {
+      return _mongocrypt_ctx_fail_w_msg (ctx, "filter must not be null");
+   }
+
+   {
+      _mongocrypt_ctx_opts_spec_t opts_spec;
+      memset (&opts_spec, 0, sizeof (opts_spec));
+
+      opts_spec.kek = OPT_OPTIONAL;
+
+      if (!_mongocrypt_ctx_init (ctx, &opts_spec)) {
+         return _mongocrypt_ctx_fail (ctx);
+      }
+   }
+
+   ctx->type = _MONGOCRYPT_TYPE_REWRAP_MANY_DATAKEY;
+   ctx->state = MONGOCRYPT_CTX_NEED_MONGO_KEYS;
+   ctx->vtable.cleanup = _cleanup;
+   ctx->vtable.kms_done = _start_kms_encrypt;
+   ctx->vtable.mongo_op_keys = _mongo_op_keys;
+   ctx->vtable.mongo_done_keys = _mongo_done_keys;
+
+   _mongocrypt_buffer_copy_from_binary (&rmdctx->filter, filter);
+
+   /* Obtain KMS credentials for use during decryption and encryption. */
+   if (_mongocrypt_needs_credentials (ctx->crypt)) {
+      ctx->state = MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS;
+      ctx->vtable.after_kms_credentials_provided = _kms_start_decrypt;
+      return true;
+   }
+
+   return _kms_start_decrypt (ctx);
+}