libmongocrypt-helper 1.6.1.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_decrypt_request.c

@@ -0,0 +1,72 @@
+/*
+ * Copyright 2018-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"){}
+ *
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "kms_message/kms_message.h"
+#include "kms_message_private.h"
+#include "kms_message/kms_b64.h"
+#include "kms_request_str.h"
+
+
+kms_request_t *
+kms_decrypt_request_new (const uint8_t *ciphertext_blob,
+                         size_t len,
+                         const kms_request_opt_t *opt)
+{
+   kms_request_t *request;
+   size_t b64_len;
+   char *b64 = NULL;
+   kms_request_str_t *payload = NULL;
+
+   request = kms_request_new ("POST", "/", opt);
+   if (kms_request_get_error (request)) {
+      goto done;
+   }
+
+   if (!(kms_request_add_header_field (
+            request, "Content-Type", "application/x-amz-json-1.1") &&
+         kms_request_add_header_field (
+            request, "X-Amz-Target", "TrentService.Decrypt"))) {
+      goto done;
+   }
+
+   b64_len = (len / 3 + 1) * 4 + 1;
+
+   if (!(b64 = malloc (b64_len))) {
+      KMS_ERROR (request,
+                 "Could not allocate %d bytes for base64-encoding payload",
+                 (int) b64_len);
+      goto done;
+   }
+
+   if (kms_message_b64_ntop (ciphertext_blob, len, b64, b64_len) == -1) {
+      KMS_ERROR (request, "Could not base64-encode ciphertext blob");
+      goto done;
+   }
+
+   payload = kms_request_str_new ();
+   kms_request_str_appendf (payload, "{\"CiphertextBlob\": \"%s\"}", b64);
+   if (!kms_request_append_payload (request, payload->str, payload->len)) {
+      KMS_ERROR (request, "Could not append payload");
+      goto done;
+   }
+
+done:
+   free (b64);
+   kms_request_str_destroy (payload);
+
+   return request;
+}

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_encrypt_request.c

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2018-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"){}
+ *
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "kms_message/kms_message.h"
+#include "kms_message_private.h"
+#include "kms_message/kms_b64.h"
+#include "kms_request_str.h"
+
+kms_request_t *
+kms_encrypt_request_new (const uint8_t *plaintext,
+                         size_t plaintext_length,
+                         const char *key_id,
+                         const kms_request_opt_t *opt)
+{
+   kms_request_t *request;
+   size_t b64_len;
+   char *b64 = NULL;
+   kms_request_str_t *payload = NULL;
+
+   request = kms_request_new ("POST", "/", opt);
+   if (kms_request_get_error (request)) {
+      goto done;
+   }
+
+   if (!(kms_request_add_header_field (
+            request, "Content-Type", "application/x-amz-json-1.1") &&
+         kms_request_add_header_field (
+            request, "X-Amz-Target", "TrentService.Encrypt"))) {
+      goto done;
+   }
+
+   b64_len = (plaintext_length / 3 + 1) * 4 + 1;
+   if (!(b64 = malloc (b64_len))) {
+      KMS_ERROR (request,
+                 "Could not allocate %d bytes for base64-encoding payload",
+                 (int) b64_len);
+      goto done;
+   }
+
+   if (kms_message_b64_ntop (
+          (const uint8_t *) plaintext, plaintext_length, b64, b64_len) == -1) {
+      KMS_ERROR (request, "Could not base64-encode plaintext");
+      goto done;
+   }
+
+   payload = kms_request_str_new ();
+   kms_request_str_appendf (
+      payload, "{\"Plaintext\": \"%s\", \"KeyId\": \"%s\"}", b64, key_id);
+   if (!kms_request_append_payload (request, payload->str, payload->len)) {
+      KMS_ERROR (request, "Could not append payload");
+      goto done;
+   }
+
+done:
+   free (b64);
+   kms_request_str_destroy (payload);
+
+   return request;
+}

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_endian_private.h

@@ -0,0 +1,165 @@
+/*
+ * Copyright 2021-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* This file is copied and modified from libbson's bson-endian.h. */
+
+#ifndef KMS_ENDIAN_PRIVATE_H
+#define KMS_ENDIAN_PRIVATE_H
+
+#include <string.h>
+
+#include "kms_message/kms_message_defines.h"
+
+/* Define a fallback for __has_builtin for compatibility with non-clang compilers. */
+#ifndef __has_builtin
+  #define __has_builtin(x) 0
+#endif
+
+#if defined(__clang__) && __has_builtin(__builtin_bswap16) && \
+   __has_builtin(__builtin_bswap32) && __has_builtin(__builtin_bswap64)
+#define KMS_UINT16_SWAP_LE_BE(v) __builtin_bswap16 (v)
+#define KMS_UINT32_SWAP_LE_BE(v) __builtin_bswap32 (v)
+#define KMS_UINT64_SWAP_LE_BE(v) __builtin_bswap64 (v)
+#elif defined(__GNUC__) && (__GNUC__ >= 4)
+#if __GNUC__ > 4 || (defined(__GNUC_MINOR__) && __GNUC_MINOR__ >= 3)
+#define KMS_UINT32_SWAP_LE_BE(v) __builtin_bswap32 ((uint32_t) v)
+#define KMS_UINT64_SWAP_LE_BE(v) __builtin_bswap64 ((uint64_t) v)
+#endif
+#if __GNUC__ > 4 || (defined(__GNUC_MINOR__) && __GNUC_MINOR__ >= 8)
+#define KMS_UINT16_SWAP_LE_BE(v) __builtin_bswap16 ((uint32_t) v)
+#endif
+#endif
+
+#ifndef KMS_UINT16_SWAP_LE_BE
+#define KMS_UINT16_SWAP_LE_BE(v) __kms_uint16_swap_slow ((uint16_t) v)
+#endif
+
+#ifndef KMS_UINT32_SWAP_LE_BE
+#define KMS_UINT32_SWAP_LE_BE(v) __kms_uint32_swap_slow ((uint32_t) v)
+#endif
+
+#ifndef KMS_UINT64_SWAP_LE_BE
+#define KMS_UINT64_SWAP_LE_BE(v) __kms_uint64_swap_slow ((uint64_t) v)
+#endif
+
+#if defined(KMS_MESSAGE_LITTLE_ENDIAN)
+#define KMS_UINT16_FROM_LE(v) ((uint16_t) v)
+#define KMS_UINT16_TO_LE(v) ((uint16_t) v)
+#define KMS_UINT16_FROM_BE(v) KMS_UINT16_SWAP_LE_BE (v)
+#define KMS_UINT16_TO_BE(v) KMS_UINT16_SWAP_LE_BE (v)
+#define KMS_UINT32_FROM_LE(v) ((uint32_t) v)
+#define KMS_UINT32_TO_LE(v) ((uint32_t) v)
+#define KMS_UINT32_FROM_BE(v) KMS_UINT32_SWAP_LE_BE (v)
+#define KMS_UINT32_TO_BE(v) KMS_UINT32_SWAP_LE_BE (v)
+#define KMS_UINT64_FROM_LE(v) ((uint64_t) v)
+#define KMS_UINT64_TO_LE(v) ((uint64_t) v)
+#define KMS_UINT64_FROM_BE(v) KMS_UINT64_SWAP_LE_BE (v)
+#define KMS_UINT64_TO_BE(v) KMS_UINT64_SWAP_LE_BE (v)
+#elif defined(KMS_MESSAGE_BIG_ENDIAN)
+#define KMS_UINT16_FROM_LE(v) KMS_UINT16_SWAP_LE_BE (v)
+#define KMS_UINT16_TO_LE(v) KMS_UINT16_SWAP_LE_BE (v)
+#define KMS_UINT16_FROM_BE(v) ((uint16_t) v)
+#define KMS_UINT16_TO_BE(v) ((uint16_t) v)
+#define KMS_UINT32_FROM_LE(v) KMS_UINT32_SWAP_LE_BE (v)
+#define KMS_UINT32_TO_LE(v) KMS_UINT32_SWAP_LE_BE (v)
+#define KMS_UINT32_FROM_BE(v) ((uint32_t) v)
+#define KMS_UINT32_TO_BE(v) ((uint32_t) v)
+#define KMS_UINT64_FROM_LE(v) KMS_UINT64_SWAP_LE_BE (v)
+#define KMS_UINT64_TO_LE(v) KMS_UINT64_SWAP_LE_BE (v)
+#define KMS_UINT64_FROM_BE(v) ((uint64_t) v)
+#define KMS_UINT64_TO_BE(v) ((uint64_t) v)
+#else
+#error "The endianness of target architecture is unknown."
+#endif
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * __kms_uint16_swap_slow --
+ *
+ *       Fallback endianness conversion for 16-bit integers.
+ *
+ * Returns:
+ *       The endian swapped version.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+static KMS_MSG_INLINE uint16_t
+__kms_uint16_swap_slow (uint16_t v) /* IN */
+{
+   return (uint16_t) (((v & 0x00FF) << 8) | ((v & 0xFF00) >> 8));
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * __kms_uint32_swap_slow --
+ *
+ *       Fallback endianness conversion for 32-bit integers.
+ *
+ * Returns:
+ *       The endian swapped version.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+static KMS_MSG_INLINE uint32_t
+__kms_uint32_swap_slow (uint32_t v) /* IN */
+{
+   return ((v & 0x000000FFU) << 24) | ((v & 0x0000FF00U) << 8) |
+          ((v & 0x00FF0000U) >> 8) | ((v & 0xFF000000U) >> 24);
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * __kms_uint64_swap_slow --
+ *
+ *       Fallback endianness conversion for 64-bit integers.
+ *
+ * Returns:
+ *       The endian swapped version.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+static KMS_MSG_INLINE uint64_t
+__kms_uint64_swap_slow (uint64_t v) /* IN */
+{
+   return ((v & 0x00000000000000FFULL) << 56) |
+          ((v & 0x000000000000FF00ULL) << 40) |
+          ((v & 0x0000000000FF0000ULL) << 24) |
+          ((v & 0x00000000FF000000ULL) << 8) |
+          ((v & 0x000000FF00000000ULL) >> 8) |
+          ((v & 0x0000FF0000000000ULL) >> 24) |
+          ((v & 0x00FF000000000000ULL) >> 40) |
+          ((v & 0xFF00000000000000ULL) >> 56);
+}
+
+
+#endif /* KMS_ENDIAN_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_gcp_request.c

@@ -0,0 +1,286 @@
+/*
+ * Copyright 2020-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "kms_message/kms_gcp_request.h"
+
+#include "kms_message/kms_b64.h"
+#include "kms_message_private.h"
+#include "kms_request_opt_private.h"
+
+/* Set a default expiration of 5 minutes for JSON Web Tokens (GCP allows up to
+ * one hour) */
+#define JWT_EXPIRATION_SECS 5 * 60
+#define SIGNATURE_LEN 256
+
+kms_request_t *
+kms_gcp_request_oauth_new (const char *host,
+                           const char *email,
+                           const char *audience,
+                           const char *scope,
+                           const char *private_key_data,
+                           size_t private_key_len,
+                           const kms_request_opt_t *opt)
+{
+   kms_request_t *req = NULL;
+   kms_request_str_t *str = NULL;
+   time_t issued_at;
+   /* base64 encoding of {"alg":"RS256","typ":"JWT"} */
+   const char *jwt_header_b64url = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9";
+   char *jwt_claims_b64url = NULL;
+   char *jwt_header_and_claims_b64url = NULL;
+   uint8_t *jwt_signature = NULL;
+   char *jwt_signature_b64url = NULL;
+   char *jwt_assertion_b64url = NULL;
+   char *payload = NULL;
+
+   req = kms_request_new ("POST", "/token", opt);
+   if (opt->provider != KMS_REQUEST_PROVIDER_GCP) {
+      KMS_ERROR (req, "Expected KMS request with provider type: GCP");
+      goto done;
+   }
+
+   if (kms_request_get_error (req)) {
+      goto done;
+   }
+
+   /* Produce the signed JWT <base64url header>.<base64url claims>.<base64url
+    * signature> */
+   issued_at = time (NULL);
+   str = kms_request_str_new ();
+   kms_request_str_appendf (str,
+                            "{\"iss\": \"%s\", \"aud\": \"%s\", \"scope\": "
+                            "\"%s\", \"iat\": %lu, \"exp\": %lu}",
+                            email,
+                            audience,
+                            scope,
+                            (unsigned long) issued_at,
+                            (unsigned long) issued_at + JWT_EXPIRATION_SECS);
+   jwt_claims_b64url =
+      kms_message_raw_to_b64url ((const uint8_t *) str->str, str->len);
+   kms_request_str_destroy (str);
+   if (!jwt_claims_b64url) {
+      KMS_ERROR (req, "Failed to base64url encode JWT claims");
+      goto done;
+   }
+
+   str = kms_request_str_new ();
+   kms_request_str_appendf (str, "%s.%s", jwt_header_b64url, jwt_claims_b64url);
+   jwt_header_and_claims_b64url = kms_request_str_detach (str);
+
+   /* Produce the signature of <base64url header>.<base64url claims> */
+   req->crypto.sign_rsaes_pkcs1_v1_5 = kms_sign_rsaes_pkcs1_v1_5;
+   if (opt->crypto.sign_rsaes_pkcs1_v1_5) {
+      req->crypto.sign_rsaes_pkcs1_v1_5 = opt->crypto.sign_rsaes_pkcs1_v1_5;
+      req->crypto.sign_ctx = opt->crypto.sign_ctx;
+   }
+
+   jwt_signature = malloc (SIGNATURE_LEN);
+   if (!req->crypto.sign_rsaes_pkcs1_v1_5 (
+          req->crypto.sign_ctx,
+          private_key_data,
+          private_key_len,
+          jwt_header_and_claims_b64url,
+          strlen (jwt_header_and_claims_b64url),
+          jwt_signature)) {
+      KMS_ERROR (req, "Failed to create GCP oauth request signature");
+      goto done;
+   }
+
+   jwt_signature_b64url =
+      kms_message_raw_to_b64url (jwt_signature, SIGNATURE_LEN);
+   if (!jwt_signature_b64url) {
+      KMS_ERROR (req, "Failed to base64url encode JWT signature");
+      goto done;
+   }
+   str = kms_request_str_new ();
+   kms_request_str_appendf (str,
+                            "%s.%s.%s",
+                            jwt_header_b64url,
+                            jwt_claims_b64url,
+                            jwt_signature_b64url);
+   jwt_assertion_b64url = kms_request_str_detach (str);
+
+   str =
+      kms_request_str_new_from_chars ("grant_type=urn%3Aietf%3Aparams%3Aoauth%"
+                                      "3Agrant-type%3Ajwt-bearer&assertion=",
+                                      -1);
+   kms_request_str_append_chars (str, jwt_assertion_b64url, -1);
+   payload = kms_request_str_detach (str);
+
+   if (!kms_request_add_header_field (
+          req, "Content-Type", "application/x-www-form-urlencoded")) {
+      goto done;
+   }
+   if (!kms_request_add_header_field (req, "Host", host)) {
+      goto done;
+   }
+   if (!kms_request_add_header_field (req, "Accept", "application/json")) {
+      goto done;
+   }
+
+   if (!kms_request_append_payload (req, payload, strlen (payload))) {
+      goto done;
+   }
+
+done:
+   free (jwt_signature);
+   free (jwt_signature_b64url);
+   free (jwt_claims_b64url);
+   free (jwt_header_and_claims_b64url);
+   free (jwt_assertion_b64url);
+   free (payload);
+   return req;
+}
+
+static kms_request_t *
+_encrypt_decrypt_common (const char *encrypt_decrypt,
+                         const char *host,
+                         const char *access_token,
+                         const char *project_id,
+                         const char *location,
+                         const char *key_ring_name,
+                         const char *key_name,
+                         const char *key_version,
+                         const uint8_t *value,
+                         size_t value_len,
+                         const kms_request_opt_t *opt)
+{
+   char *path_and_query = NULL;
+   char *payload = NULL;
+   char *bearer_token_value = NULL;
+   char *value_base64 = NULL;
+   kms_request_t *req;
+   kms_request_str_t *str;
+
+   str = kms_request_str_new ();
+   /* /v1/projects/{project-id}/locations/{location}/keyRings/{key-ring-name}/cryptoKeys/{key-name}
+    */
+   kms_request_str_appendf (
+      str,
+      "/v1/projects/%s/locations/%s/keyRings/%s/cryptoKeys/%s",
+      project_id,
+      location,
+      key_ring_name,
+      key_name);
+   if (key_version && strlen (key_version) > 0) {
+      kms_request_str_appendf (str, "/cryptoKeyVersions/%s", key_version);
+   }
+   kms_request_str_appendf (str, ":%s", encrypt_decrypt);
+   path_and_query = kms_request_str_detach (str);
+
+   req = kms_request_new ("POST", path_and_query, opt);
+
+   if (opt->provider != KMS_REQUEST_PROVIDER_GCP) {
+      KMS_ERROR (req, "Expected KMS request with provider type: GCP");
+      goto done;
+   }
+
+   if (kms_request_get_error (req)) {
+      goto done;
+   }
+
+   value_base64 = kms_message_raw_to_b64 (value, value_len);
+   if (!value_base64) {
+      KMS_ERROR (req, "Could not bases64-encode plaintext");
+      goto done;
+   }
+
+   str = kms_request_str_new ();
+   if (0 == strcmp ("encrypt", encrypt_decrypt)) {
+      kms_request_str_appendf (str, "{\"plaintext\": \"%s\"}", value_base64);
+   } else {
+      kms_request_str_appendf (str, "{\"ciphertext\": \"%s\"}", value_base64);
+   }
+
+   payload = kms_request_str_detach (str);
+   str = kms_request_str_new ();
+   kms_request_str_appendf (str, "Bearer %s", access_token);
+   bearer_token_value = kms_request_str_detach (str);
+   if (!kms_request_add_header_field (
+          req, "Authorization", bearer_token_value)) {
+      goto done;
+   }
+   if (!kms_request_add_header_field (
+          req, "Content-Type", "application/json")) {
+      goto done;
+   }
+   if (!kms_request_add_header_field (req, "Host", host)) {
+      goto done;
+   }
+   if (!kms_request_add_header_field (req, "Accept", "application/json")) {
+      goto done;
+   }
+
+   if (!kms_request_append_payload (req, payload, strlen (payload))) {
+      goto done;
+   }
+
+done:
+   kms_request_free_string (path_and_query);
+   kms_request_free_string (payload);
+   kms_request_free_string (bearer_token_value);
+   kms_request_free_string (value_base64);
+   return req;
+}
+
+kms_request_t *
+kms_gcp_request_encrypt_new (const char *host,
+                             const char *access_token,
+                             const char *project_id,
+                             const char *location,
+                             const char *key_ring_name,
+                             const char *key_name,
+                             const char *key_version,
+                             const uint8_t *plaintext,
+                             size_t plaintext_len,
+                             const kms_request_opt_t *opt)
+{
+   return _encrypt_decrypt_common ("encrypt",
+                                   host,
+                                   access_token,
+                                   project_id,
+                                   location,
+                                   key_ring_name,
+                                   key_name,
+                                   key_version,
+                                   plaintext,
+                                   plaintext_len,
+                                   opt);
+}
+
+kms_request_t *
+kms_gcp_request_decrypt_new (const char *host,
+                             const char *access_token,
+                             const char *project_id,
+                             const char *location,
+                             const char *key_ring_name,
+                             const char *key_name,
+                             const uint8_t *ciphertext,
+                             size_t ciphertext_len,
+                             const kms_request_opt_t *opt)
+{
+   return _encrypt_decrypt_common ("decrypt",
+                                   host,
+                                   access_token,
+                                   project_id,
+                                   location,
+                                   key_ring_name,
+                                   key_name,
+                                   NULL /* key_version */,
+                                   ciphertext,
+                                   ciphertext_len,
+                                   opt);
+}

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_kmip_item_type_private.h

@@ -0,0 +1,59 @@
+/*
+ * Copyright 2021-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef KMS_KMIP_ITEM_TYPE_PRIVATE_H
+#define KMS_KMIP_ITEM_TYPE_PRIVATE_H
+
+#include "kms_message/kms_message_defines.h"
+
+#define KMS_XMACRO           \
+   KMS_X (Structure, 0x01)   \
+   KMS_X (Integer, 0x02)     \
+   KMS_X (LongInteger, 0x03) \
+   KMS_X (BigInteger, 0x04)  \
+   KMS_X (Enumeration, 0x05) \
+   KMS_X (Boolean, 0x06)     \
+   KMS_X (TextString, 0x07)  \
+   KMS_X (ByteString, 0x08)  \
+   KMS_X (DateTime, 0x09)    \
+   KMS_X_LAST (Interval, 0x0A)
+
+/* Generate an enum with each item_type value. */
+#define KMS_X(ITEM_TYPE, VAL) KMIP_ITEM_TYPE_##ITEM_TYPE = VAL,
+#define KMS_X_LAST(ITEM_TYPE, VAL) KMIP_ITEM_TYPE_##ITEM_TYPE = VAL
+typedef enum { KMS_XMACRO } kmip_item_type_t;
+#undef KMS_X
+#undef KMS_X_LAST
+
+#define KMS_X(ITEM_TYPE, VAL)       \
+   case KMIP_ITEM_TYPE_##ITEM_TYPE: \
+      return #ITEM_TYPE;
+#define KMS_X_LAST KMS_X
+static KMS_MSG_INLINE const char *
+kmip_item_type_to_string (kmip_item_type_t item_type)
+{
+   switch (item_type) {
+   default:
+      return "Unknown KMIP item type";
+      KMS_XMACRO
+   }
+}
+#undef KMS_X
+#undef KMS_X_LAST
+
+#undef KMS_XMACRO
+
+#endif /* KMS_KMIP_ITEM_TYPE_PRIVATE_H */