libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-config.h.in

@@ -0,0 +1,87 @@
+/*
+ * Copyright 2019-present MongoDB Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_CONFIG_H
+#define MONGOCRYPT_CONFIG_H
+
+/* clang-format off */
+
+/**
+ * @def MONGOCRYPT_VERSION
+ * @brief The version string describing libmongocrypt.
+ * Has the form x.y.z-<pre>+<date>+git<sha>.
+ */
+#define MONGOCRYPT_VERSION "@MONGOCRYPT_BUILD_VERSION@"
+
+/*
+ * MONGOCRYPT_ENABLE_CRYPTO_CNG is set from configure to determine if we are
+ * compiled with Native Crypto support on Windows
+ */
+#define MONGOCRYPT_ENABLE_CRYPTO_CNG @MONGOCRYPT_ENABLE_CRYPTO_CNG@
+
+#if MONGOCRYPT_ENABLE_CRYPTO_CNG != 1
+#  undef MONGOCRYPT_ENABLE_CRYPTO_CNG
+#endif
+
+
+/*
+ * MONGOCRYPT_ENABLE_CRYPTO_COMMON_CRYPTO is set from configure to determine if we are
+ * compiled with Native Crypto support on Darwin
+ */
+#define MONGOCRYPT_ENABLE_CRYPTO_COMMON_CRYPTO @MONGOCRYPT_ENABLE_CRYPTO_COMMON_CRYPTO@
+
+#if MONGOCRYPT_ENABLE_CRYPTO_COMMON_CRYPTO != 1
+#  undef MONGOCRYPT_ENABLE_CRYPTO_COMMON_CRYPTO
+#endif
+
+
+/*
+ * MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO is set from configure to determine if we are
+ * compiled with OpenSSL/LibreSSL (which both use libcrypto) support.
+ */
+#define MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO @MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO@
+#define MONGOCRYPT_ENABLE_CRYPTO_OPENSSL @MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO@
+
+#if MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO != 1
+#  undef MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO
+#  undef MONGOCRYPT_ENABLE_CRYPTO_OPENSSL
+#endif
+
+
+/*
+ * MONGOCRYPT_ENABLE_CRYPTO is set from configure to determine if we are
+ * compiled with any crypto support.
+ */
+#define MONGOCRYPT_ENABLE_CRYPTO @MONGOCRYPT_ENABLE_CRYPTO@
+
+#if MONGOCRYPT_ENABLE_CRYPTO != 1
+#  undef MONGOCRYPT_ENABLE_CRYPTO
+#endif
+
+
+/*
+ * MONGOCRYPT_ENABLE_TRACE is set from configure to determine if we are
+ * compiled with tracing support.
+ */
+#define MONGOCRYPT_ENABLE_TRACE @MONGOCRYPT_ENABLE_TRACE@
+
+#if MONGOCRYPT_ENABLE_TRACE != 1
+#  undef MONGOCRYPT_ENABLE_TRACE
+#endif
+
+/* clang-format on */
+
+#endif /* MONGOCRYPT_CONFIG_H */

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-crypto-private.h

@@ -0,0 +1,303 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_CRYPTO_PRIVATE_H
+#define MONGOCRYPT_CRYPTO_PRIVATE_H
+
+#include "mongocrypt.h"
+#include "mongocrypt-buffer-private.h"
+
+#define MONGOCRYPT_KEY_LEN 96
+#define MONGOCRYPT_IV_KEY_LEN 32
+#define MONGOCRYPT_MAC_KEY_LEN 32
+#define MONGOCRYPT_ENC_KEY_LEN 32
+#define MONGOCRYPT_IV_LEN 16
+#define MONGOCRYPT_HMAC_SHA512_LEN 64
+#define MONGOCRYPT_HMAC_LEN 32
+#define MONGOCRYPT_BLOCK_SIZE 16
+#define MONGOCRYPT_HMAC_SHA256_LEN 32
+#define MONGOCRYPT_TOKEN_KEY_LEN 32
+typedef struct {
+   int hooks_enabled;
+   mongocrypt_crypto_fn aes_256_cbc_encrypt;
+   mongocrypt_crypto_fn aes_256_cbc_decrypt;
+   mongocrypt_crypto_fn aes_256_ctr_encrypt;
+   mongocrypt_crypto_fn aes_256_ctr_decrypt;
+   mongocrypt_crypto_fn aes_256_ecb_encrypt;
+   mongocrypt_random_fn random;
+   mongocrypt_hmac_fn hmac_sha_512;
+   mongocrypt_hmac_fn hmac_sha_256;
+   mongocrypt_hash_fn sha_256;
+   void *ctx;
+} _mongocrypt_crypto_t;
+
+uint32_t
+_mongocrypt_calculate_ciphertext_len (uint32_t plaintext_len,
+                                      mongocrypt_status_t *status);
+
+/* _mongocrypt_fle2aead_calculate_ciphertext_len returns the required length of
+ * the ciphertext for _mongocrypt_fle2aead_do_encryption. */
+uint32_t
+_mongocrypt_fle2aead_calculate_ciphertext_len (uint32_t plaintext_len,
+                                               mongocrypt_status_t *status);
+
+/* _mongocrypt_fle2_calculate_ciphertext_len returns the required length of
+ * the ciphertext for _mongocrypt_fle2_do_encryption. */
+uint32_t
+_mongocrypt_fle2_calculate_ciphertext_len (uint32_t plaintext_len,
+                                           mongocrypt_status_t *status);
+
+uint32_t
+_mongocrypt_calculate_plaintext_len (uint32_t ciphertext_len,
+                                     mongocrypt_status_t *status);
+
+/* _mongocrypt_fle2aead_calculate_plaintext_len returns the required length of
+ * the plaintext for _mongocrypt_fle2aead_do_decryption. */
+uint32_t
+_mongocrypt_fle2aead_calculate_plaintext_len (uint32_t ciphertext_len,
+                                              mongocrypt_status_t *status);
+
+/* _mongocrypt_fle2_calculate_plaintext_len returns the required length of
+ * the plaintext for _mongocrypt_fle2_do_decryption. */
+uint32_t
+_mongocrypt_fle2_calculate_plaintext_len (uint32_t ciphertext_len,
+                                          mongocrypt_status_t *status);
+
+bool
+_mongocrypt_do_encryption (_mongocrypt_crypto_t *crypto,
+                           const _mongocrypt_buffer_t *iv,
+                           const _mongocrypt_buffer_t *associated_data,
+                           const _mongocrypt_buffer_t *key,
+                           const _mongocrypt_buffer_t *plaintext,
+                           _mongocrypt_buffer_t *ciphertext,
+                           uint32_t *bytes_written,
+                           mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_mongocrypt_do_decryption (_mongocrypt_crypto_t *crypto,
+                           const _mongocrypt_buffer_t *associated_data,
+                           const _mongocrypt_buffer_t *key,
+                           const _mongocrypt_buffer_t *ciphertext,
+                           _mongocrypt_buffer_t *plaintext,
+                           uint32_t *bytes_written,
+                           mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* _mongocrypt_fle2aead_do_encryption does AEAD encryption.
+ * It follows the construction described in the [AEAD with
+ * CTR](https://docs.google.com/document/d/1eCU7R8Kjr-mdyz6eKvhNIDVmhyYQcAaLtTfHeK7a_vE/)
+ *
+ * Note: The 96 byte key is split differently for FLE 2.
+ * - FLE 1 uses first 32 bytes as the mac key, and the second 32 bytes as the
+ *   encryption key.
+ * - FLE 2 uses first 32 bytes as encryption key, and the
+ *   second 32 bytes as the mac key.
+ * Note: Attempting to encrypt a 0 length plaintext is an error.
+ */
+bool
+_mongocrypt_fle2aead_do_encryption (_mongocrypt_crypto_t *crypto,
+                                    const _mongocrypt_buffer_t *iv,
+                                    const _mongocrypt_buffer_t *associated_data,
+                                    const _mongocrypt_buffer_t *key,
+                                    const _mongocrypt_buffer_t *plaintext,
+                                    _mongocrypt_buffer_t *ciphertext,
+                                    uint32_t *bytes_written,
+                                    mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_mongocrypt_fle2aead_do_decryption (_mongocrypt_crypto_t *crypto,
+                                    const _mongocrypt_buffer_t *associated_data,
+                                    const _mongocrypt_buffer_t *key,
+                                    const _mongocrypt_buffer_t *ciphertext,
+                                    _mongocrypt_buffer_t *plaintext,
+                                    uint32_t *bytes_written,
+                                    mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* _mongocrypt_fle2_do_encryption does non-AEAD encryption.
+ * @key is expected to be only an encryption key of size MONGOCRYPT_ENC_KEY_LEN.
+ * Note: Attempting to encrypt a 0 length plaintext is an error.
+ */
+bool
+_mongocrypt_fle2_do_encryption (_mongocrypt_crypto_t *crypto,
+                                const _mongocrypt_buffer_t *iv,
+                                const _mongocrypt_buffer_t *key,
+                                const _mongocrypt_buffer_t *plaintext,
+                                _mongocrypt_buffer_t *ciphertext,
+                                uint32_t *bytes_written,
+                                mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* _mongocrypt_fle2_do_decryption does non-AEAD decryption.
+ * @key is expected to be only an encryption key of size MONGOCRYPT_ENC_KEY_LEN.
+ */
+bool
+_mongocrypt_fle2_do_decryption (_mongocrypt_crypto_t *crypto,
+                                const _mongocrypt_buffer_t *key,
+                                const _mongocrypt_buffer_t *ciphertext,
+                                _mongocrypt_buffer_t *plaintext,
+                                uint32_t *bytes_written,
+                                mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_mongocrypt_random (_mongocrypt_crypto_t *crypto,
+                    _mongocrypt_buffer_t *out,
+                    uint32_t count,
+                    mongocrypt_status_t *status) MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* Generates a random number in the range [0, exclusive_upper_bound) in out. */
+bool
+_mongocrypt_random_uint64 (_mongocrypt_crypto_t *crypto,
+                           uint64_t exclusive_upper_bound,
+                           uint64_t *out,
+                           mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* Generates a random number in the range [0, exclusive_upper_bound) in out. */
+bool
+_mongocrypt_random_int64 (_mongocrypt_crypto_t *crypto,
+                          int64_t exclusive_upper_bound,
+                          int64_t *out,
+                          mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* Returns 0 if equal, non-zero otherwise */
+int
+_mongocrypt_memequal (const void *const b1, const void *const b2, size_t len);
+
+
+/*
+ * _mongocrypt_wrap_key encrypts a DEK with a KEK.
+
+ * kek is an input Key Encryption Key.
+ * dek is an input Data Encryption Key.
+ * encrypted_dek the result of encrypting dek with kek.
+ * encrypted_dek is always initialized.
+ * Returns true if no error occurred.
+ * Returns false and sets @status if an error occurred.
+ */
+bool
+_mongocrypt_wrap_key (_mongocrypt_crypto_t *crypto,
+                      _mongocrypt_buffer_t *kek,
+                      _mongocrypt_buffer_t *dek,
+                      _mongocrypt_buffer_t *encrypted_dek,
+                      mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/*
+ * _mongocrypt_unwrap_key decrypts an encrypted DEK with a KEK.
+ *
+ * kek is an input Key Encryption Key.
+ * encrypted_dek is an input encrypted Data Encryption Key.
+ * dek is the result of decrypting encrypted_dek with kek.
+ * dek is always initialized.
+ * Returns true if no error occurred.
+ * Returns false and sets @status if an error occurred.
+ */
+bool
+_mongocrypt_unwrap_key (_mongocrypt_crypto_t *crypto,
+                        _mongocrypt_buffer_t *kek,
+                        _mongocrypt_buffer_t *encrypted_dek,
+                        _mongocrypt_buffer_t *dek,
+                        mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_mongocrypt_calculate_deterministic_iv (
+   _mongocrypt_crypto_t *crypto,
+   const _mongocrypt_buffer_t *key,
+   const _mongocrypt_buffer_t *plaintext,
+   const _mongocrypt_buffer_t *associated_data,
+   _mongocrypt_buffer_t *out,
+   mongocrypt_status_t *status) MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/*
+ * _mongocrypt_hmac_sha_256 computes the HMAC SHA-256.
+ *
+ * Uses the hmac_sha_256 hook set on @crypto if set, and otherwise
+ * calls the native implementation.
+ *
+ * @out must have length 32 bytes.
+ *
+ * Returns true if no error occurred.
+ * Returns false sets @status if an error occurred.
+ */
+bool
+_mongocrypt_hmac_sha_256 (_mongocrypt_crypto_t *crypto,
+                          const _mongocrypt_buffer_t *key,
+                          const _mongocrypt_buffer_t *in,
+                          _mongocrypt_buffer_t *out,
+                          mongocrypt_status_t *status);
+
+/* Crypto implementations must implement these functions. */
+
+/* This variable must be defined in implementation
+   files, and must be set to true when _crypto_init
+   is successful. */
+extern bool _native_crypto_initialized;
+
+void
+_native_crypto_init (void);
+
+typedef struct {
+   const _mongocrypt_buffer_t *key;
+   const _mongocrypt_buffer_t *iv;
+   const _mongocrypt_buffer_t *in;
+   _mongocrypt_buffer_t *out;
+   uint32_t *bytes_written;
+   mongocrypt_status_t *status;
+} aes_256_args_t;
+
+bool
+_native_crypto_aes_256_cbc_encrypt (aes_256_args_t args)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_native_crypto_aes_256_cbc_decrypt (aes_256_args_t args)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_native_crypto_hmac_sha_512 (const _mongocrypt_buffer_t *key,
+                             const _mongocrypt_buffer_t *in,
+                             _mongocrypt_buffer_t *out,
+                             mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_native_crypto_random (_mongocrypt_buffer_t *out,
+                       uint32_t count,
+                       mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_native_crypto_aes_256_ctr_encrypt (aes_256_args_t args)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_native_crypto_aes_256_ctr_decrypt (aes_256_args_t args)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_native_crypto_hmac_sha_256 (const _mongocrypt_buffer_t *key,
+                             const _mongocrypt_buffer_t *in,
+                             _mongocrypt_buffer_t *out,
+                             mongocrypt_status_t *status)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+#endif /* MONGOCRYPT_CRYPTO_PRIVATE_H */