libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-kek.c

@@ -0,0 +1,325 @@
+/*
+ * Copyright 2020-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mongocrypt-kek-private.h"
+#include "mongocrypt-private.h"
+#include "mongocrypt-opts-private.h"
+
+/* Possible documents to parse:
+ * AWS
+ *    provider: "aws"
+ *    region: <string>
+ *    key: <string>
+ *    endpoint: <optional string>
+ * Azure
+ *    provider: "azure"
+ *    keyVaultEndpoint: <string>
+ *    keyName: <string>
+ *    keyVersion: <optional string>
+ * GCP
+ *    provider: "gcp"
+ *    projectId: <string>
+ *    location: <string>
+ *    keyRing: <string>
+ *    keyName: <string>
+ *    keyVersion: <string>
+ *    endpoint: <optional string>
+ * Local
+ *    provider: "local"
+ * KMIP
+ *    provider: "kmip"
+ *    keyId: <optional string>
+ *    endpoint: <optional string>
+ */
+bool
+_mongocrypt_kek_parse_owned (const bson_t *bson,
+                             _mongocrypt_kek_t *kek,
+                             mongocrypt_status_t *status)
+{
+   char *kms_provider = NULL;
+   bool ret = false;
+
+   BSON_ASSERT_PARAM (bson);
+   BSON_ASSERT_PARAM (kek);
+
+   if (!_mongocrypt_parse_required_utf8 (
+          bson, "provider", &kms_provider, status)) {
+      goto done;
+   }
+
+   if (0 == strcmp (kms_provider, "aws")) {
+      kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_AWS;
+      if (!_mongocrypt_parse_required_utf8 (
+             bson, "key", &kek->provider.aws.cmk, status)) {
+         goto done;
+      }
+      if (!_mongocrypt_parse_required_utf8 (
+             bson, "region", &kek->provider.aws.region, status)) {
+         goto done;
+      }
+      if (!_mongocrypt_parse_optional_endpoint (bson,
+                                                "endpoint",
+                                                &kek->provider.aws.endpoint,
+                                                NULL /* opts */,
+                                                status)) {
+         goto done;
+      }
+      if (!_mongocrypt_check_allowed_fields (
+             bson, NULL, status, "provider", "key", "region", "endpoint")) {
+         goto done;
+      }
+   } else if (0 == strcmp (kms_provider, "local")) {
+      kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_LOCAL;
+      if (!_mongocrypt_check_allowed_fields (bson, NULL, status, "provider")) {
+         goto done;
+      }
+   } else if (0 == strcmp (kms_provider, "azure")) {
+      kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_AZURE;
+      if (!_mongocrypt_parse_required_endpoint (
+             bson,
+             "keyVaultEndpoint",
+             &kek->provider.azure.key_vault_endpoint,
+             NULL /* opts */,
+             status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_required_utf8 (
+             bson, "keyName", &kek->provider.azure.key_name, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_optional_utf8 (
+             bson, "keyVersion", &kek->provider.azure.key_version, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_check_allowed_fields (bson,
+                                             NULL,
+                                             status,
+                                             "provider",
+                                             "keyVaultEndpoint",
+                                             "keyName",
+                                             "keyVersion")) {
+         goto done;
+      }
+   } else if (0 == strcmp (kms_provider, "gcp")) {
+      kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_GCP;
+      if (!_mongocrypt_parse_optional_endpoint (bson,
+                                                "endpoint",
+                                                &kek->provider.gcp.endpoint,
+                                                NULL /* opts */,
+                                                status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_required_utf8 (
+             bson, "projectId", &kek->provider.gcp.project_id, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_required_utf8 (
+             bson, "location", &kek->provider.gcp.location, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_required_utf8 (
+             bson, "keyRing", &kek->provider.gcp.key_ring, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_required_utf8 (
+             bson, "keyName", &kek->provider.gcp.key_name, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_optional_utf8 (
+             bson, "keyVersion", &kek->provider.gcp.key_version, status)) {
+         goto done;
+      }
+      if (!_mongocrypt_check_allowed_fields (bson,
+                                             NULL,
+                                             status,
+                                             "provider",
+                                             "endpoint",
+                                             "projectId",
+                                             "location",
+                                             "keyRing",
+                                             "keyName",
+                                             "keyVersion")) {
+         goto done;
+      }
+   } else if (0 == strcmp (kms_provider, "kmip")) {
+      kek->kms_provider = MONGOCRYPT_KMS_PROVIDER_KMIP;
+      _mongocrypt_endpoint_parse_opts_t opts = {0};
+
+      opts.allow_empty_subdomain = true;
+      if (!_mongocrypt_parse_optional_endpoint (
+             bson, "endpoint", &kek->provider.kmip.endpoint, &opts, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_parse_optional_utf8 (
+             bson, "keyId", &kek->provider.kmip.key_id, status)) {
+         goto done;
+      }
+
+      if (!_mongocrypt_check_allowed_fields (
+             bson, NULL, status, "provider", "endpoint", "keyId")) {
+         goto done;
+      }
+   } else {
+      CLIENT_ERR ("unrecognized KMS provider: %s", kms_provider);
+      goto done;
+   }
+
+   ret = true;
+done:
+   bson_free (kms_provider);
+   return ret;
+}
+
+bool
+_mongocrypt_kek_append (const _mongocrypt_kek_t *kek,
+                        bson_t *bson,
+                        mongocrypt_status_t *status)
+{
+   BSON_ASSERT_PARAM (kek);
+   BSON_ASSERT_PARAM (bson);
+
+   if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_AWS) {
+      BSON_APPEND_UTF8 (bson, "provider", "aws");
+      BSON_APPEND_UTF8 (bson, "region", kek->provider.aws.region);
+      BSON_APPEND_UTF8 (bson, "key", kek->provider.aws.cmk);
+      if (kek->provider.aws.endpoint) {
+         BSON_APPEND_UTF8 (
+            bson, "endpoint", kek->provider.aws.endpoint->host_and_port);
+      }
+   } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_LOCAL) {
+      BSON_APPEND_UTF8 (bson, "provider", "local");
+   } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_AZURE) {
+      BSON_APPEND_UTF8 (bson, "provider", "azure");
+      BSON_APPEND_UTF8 (bson,
+                        "keyVaultEndpoint",
+                        kek->provider.azure.key_vault_endpoint->host_and_port);
+      BSON_APPEND_UTF8 (bson, "keyName", kek->provider.azure.key_name);
+      if (kek->provider.azure.key_version) {
+         BSON_APPEND_UTF8 (bson, "keyVersion", kek->provider.azure.key_version);
+      }
+   } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_GCP) {
+      BSON_APPEND_UTF8 (bson, "provider", "gcp");
+      BSON_APPEND_UTF8 (bson, "projectId", kek->provider.gcp.project_id);
+      BSON_APPEND_UTF8 (bson, "location", kek->provider.gcp.location);
+      BSON_APPEND_UTF8 (bson, "keyRing", kek->provider.gcp.key_ring);
+      BSON_APPEND_UTF8 (bson, "keyName", kek->provider.gcp.key_name);
+      if (kek->provider.gcp.key_version) {
+         BSON_APPEND_UTF8 (bson, "keyVersion", kek->provider.gcp.key_version);
+      }
+      if (kek->provider.gcp.endpoint) {
+         BSON_APPEND_UTF8 (
+            bson, "endpoint", kek->provider.gcp.endpoint->host_and_port);
+      }
+   } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_KMIP) {
+      BSON_APPEND_UTF8 (bson, "provider", "kmip");
+      if (kek->provider.kmip.endpoint) {
+         BSON_APPEND_UTF8 (
+            bson, "endpoint", kek->provider.kmip.endpoint->host_and_port);
+      }
+
+      /* "keyId" is required in the final data key document for the "kmip" KMS
+       * provider. It may be set from the "kmip.keyId" in the BSON document set
+       * in mongocrypt_ctx_setopt_key_encryption_key, Otherwise, libmongocrypt
+       * is expected to set "keyId". */
+      if (kek->provider.kmip.key_id) {
+         BSON_APPEND_UTF8 (bson, "keyId", kek->provider.kmip.key_id);
+      } else {
+         CLIENT_ERR ("keyId required for KMIP");
+         return false;
+      }
+   } else {
+      BSON_ASSERT (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_NONE);
+   }
+   return true;
+}
+
+void
+_mongocrypt_kek_copy_to (const _mongocrypt_kek_t *src, _mongocrypt_kek_t *dst)
+{
+   BSON_ASSERT_PARAM (src);
+   BSON_ASSERT_PARAM (dst);
+
+   if (src->kms_provider == MONGOCRYPT_KMS_PROVIDER_AWS) {
+      dst->provider.aws.cmk = bson_strdup (src->provider.aws.cmk);
+      dst->provider.aws.region = bson_strdup (src->provider.aws.region);
+      dst->provider.aws.endpoint =
+         _mongocrypt_endpoint_copy (src->provider.aws.endpoint);
+   } else if (src->kms_provider == MONGOCRYPT_KMS_PROVIDER_AZURE) {
+      dst->provider.azure.key_vault_endpoint =
+         _mongocrypt_endpoint_copy (src->provider.azure.key_vault_endpoint);
+      dst->provider.azure.key_name = bson_strdup (src->provider.azure.key_name);
+      dst->provider.azure.key_version =
+         bson_strdup (src->provider.azure.key_version);
+   } else if (src->kms_provider == MONGOCRYPT_KMS_PROVIDER_GCP) {
+      dst->provider.gcp.project_id = bson_strdup (src->provider.gcp.project_id);
+      dst->provider.gcp.location = bson_strdup (src->provider.gcp.location);
+      dst->provider.gcp.key_ring = bson_strdup (src->provider.gcp.key_ring);
+      dst->provider.gcp.key_name = bson_strdup (src->provider.gcp.key_name);
+      dst->provider.gcp.key_version =
+         bson_strdup (src->provider.gcp.key_version);
+      dst->provider.gcp.endpoint =
+         _mongocrypt_endpoint_copy (src->provider.gcp.endpoint);
+   } else if (src->kms_provider == MONGOCRYPT_KMS_PROVIDER_KMIP) {
+      dst->provider.kmip.endpoint =
+         _mongocrypt_endpoint_copy (src->provider.kmip.endpoint);
+      dst->provider.kmip.key_id = bson_strdup (src->provider.kmip.key_id);
+   } else {
+      BSON_ASSERT (src->kms_provider == MONGOCRYPT_KMS_PROVIDER_NONE ||
+                   src->kms_provider == MONGOCRYPT_KMS_PROVIDER_LOCAL);
+   }
+   dst->kms_provider = src->kms_provider;
+}
+
+void
+_mongocrypt_kek_cleanup (_mongocrypt_kek_t *kek)
+{
+   if (!kek) {
+      return;
+   }
+
+   if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_AWS) {
+      bson_free (kek->provider.aws.cmk);
+      bson_free (kek->provider.aws.region);
+      _mongocrypt_endpoint_destroy (kek->provider.aws.endpoint);
+   } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_AZURE) {
+      _mongocrypt_endpoint_destroy (kek->provider.azure.key_vault_endpoint);
+      bson_free (kek->provider.azure.key_name);
+      bson_free (kek->provider.azure.key_version);
+   } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_GCP) {
+      bson_free (kek->provider.gcp.project_id);
+      bson_free (kek->provider.gcp.location);
+      bson_free (kek->provider.gcp.key_ring);
+      bson_free (kek->provider.gcp.key_name);
+      bson_free (kek->provider.gcp.key_version);
+      _mongocrypt_endpoint_destroy (kek->provider.gcp.endpoint);
+   } else if (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_KMIP) {
+      bson_free (kek->provider.kmip.key_id);
+      _mongocrypt_endpoint_destroy (kek->provider.kmip.endpoint);
+   } else {
+      BSON_ASSERT (kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_NONE ||
+                   kek->kms_provider == MONGOCRYPT_KMS_PROVIDER_LOCAL);
+   }
+   return;
+}

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-key-broker-private.h

@@ -0,0 +1,209 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_KEY_BROKER_PRIVATE_H
+#define MONGOCRYPT_KEY_BROKER_PRIVATE_H
+
+#include <bson/bson.h>
+
+#include "kms_message/kms_message.h"
+#include "mongocrypt.h"
+#include "mongocrypt-cache-private.h"
+#include "mongocrypt-kms-ctx-private.h"
+#include "mongocrypt-cache-key-private.h"
+#include "mongocrypt-binary-private.h"
+#include "mongocrypt-opts-private.h"
+#include "mongocrypt-cache-private.h"
+
+/* The key broker acts as a middle-man between an encrypt/decrypt request and
+ * the key cache.
+ * Each encrypt/decrypt request has one key broker. Key brokers are not shared.
+ * It is responsible for:
+ * - keeping track of requested keys (either by id or keyAltName)
+ * - copying keys from the cache to satisfy those requests
+ * - generating find cmd filters to fetch keys that aren't cached or are expired
+ * - generating KMS decrypt requests on newly fetched keys
+ * - adding newly fetched keys back to the cache
+ *
+ * Notes:
+ * - any key request that is satisfied stays satisfied.
+ * - keys returned from the driver are validated to not have intersecting key
+ * alt names (or duplicate ids).
+ * - keys fetched from the cache are not validated, because the cache is shared
+ * and locking only occurs on a single fetch (so it is possible to have two keys
+ * fetched from the cache that have intersecting keyAltNames but a different
+ * _id, and that is not an error)
+ */
+
+/* The state of the key broker. */
+typedef enum {
+   /* Starting state. Accept requests for keys to be added (either by id or
+      name) */
+   KB_REQUESTING,
+   /* Accept key documents fetched from the key vault collection. */
+   KB_ADDING_DOCS,
+   /* Accept any key document fetched from the key vault collection. */
+   KB_ADDING_DOCS_ANY,
+   /* Getting oauth token(s) from KMS providers. */
+   KB_AUTHENTICATING,
+   /* Accept KMS replies to decrypt key material in each key document. */
+   KB_DECRYPTING_KEY_MATERIAL,
+   KB_DONE,
+   KB_ERROR
+} key_broker_state_t;
+
+/* Represents a single request for a key, as indicated from a response
+ * from mongocryptd. */
+typedef struct _key_request_t {
+   /* only one of id or alt_name are set. */
+   _mongocrypt_buffer_t id;
+   _mongocrypt_key_alt_name_t *alt_name;
+   bool satisfied; /* true if satisfied by a cache entry or a key returned. */
+   struct _key_request_t *next;
+} key_request_t;
+
+/* Represents a single key supplied from the driver or cache. */
+typedef struct _key_returned_t {
+   _mongocrypt_key_doc_t *doc;
+   _mongocrypt_buffer_t decrypted_key_material;
+
+   mongocrypt_kms_ctx_t kms;
+   bool decrypted;
+
+   bool needs_auth;
+
+   struct _key_returned_t *next;
+} key_returned_t;
+
+typedef struct _auth_request_t {
+   mongocrypt_kms_ctx_t kms;
+   bool returned;
+   bool initialized;
+} auth_request_t;
+
+typedef struct {
+   key_broker_state_t state;
+   mongocrypt_status_t *status;
+   key_request_t *key_requests;
+   /* Keep keys returned from driver separate from keys returned from cache.
+    * Keys returned from driver MUST not have conflicts (e.g. intersecting key
+    * alt names)
+    * But keys from cache MAY have conflicts since the cache is only locked for
+    * a single get operation.
+    */
+   key_returned_t *keys_returned;
+   key_returned_t *keys_cached;
+   _mongocrypt_buffer_t filter;
+   mongocrypt_t *crypt;
+
+   key_returned_t *decryptor_iter;
+   auth_request_t auth_request_azure;
+   auth_request_t auth_request_gcp;
+} _mongocrypt_key_broker_t;
+
+void
+_mongocrypt_key_broker_init (_mongocrypt_key_broker_t *kb, mongocrypt_t *crypt);
+
+/* Add a request for a key by UUID. */
+bool
+_mongocrypt_key_broker_request_id (_mongocrypt_key_broker_t *kb,
+                                   const _mongocrypt_buffer_t *key_id)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+
+/* Add keyAltName into the key broker.
+   Key is added as KEY_EMPTY. */
+bool
+_mongocrypt_key_broker_request_name (_mongocrypt_key_broker_t *kb,
+                                     const bson_value_t *key_alt_name)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* Switch mode to permit adding documents without prior requests. */
+bool
+_mongocrypt_key_broker_request_any (_mongocrypt_key_broker_t *kb)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_mongocrypt_key_broker_requests_done (_mongocrypt_key_broker_t *kb);
+
+/* Get the find command filter. */
+bool
+_mongocrypt_key_broker_filter (_mongocrypt_key_broker_t *kb,
+                               mongocrypt_binary_t *out)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+
+/* Add a key document. */
+bool
+_mongocrypt_key_broker_add_doc (_mongocrypt_key_broker_t *kb,
+                                _mongocrypt_opts_kms_providers_t *kms_providers,
+                                const _mongocrypt_buffer_t *doc)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+bool
+_mongocrypt_key_broker_docs_done (_mongocrypt_key_broker_t *kb);
+
+/* Iterate the keys needing KMS decryption. */
+mongocrypt_kms_ctx_t *
+_mongocrypt_key_broker_next_kms (_mongocrypt_key_broker_t *kb)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+
+/* Indicate that all KMS requests are complete. */
+bool
+_mongocrypt_key_broker_kms_done (
+   _mongocrypt_key_broker_t *kb,
+   _mongocrypt_opts_kms_providers_t *kms_providers);
+
+
+/* Get the final decrypted key material from a key by looking up with a key_id.
+ * @out is always initialized, even on error. */
+bool
+_mongocrypt_key_broker_decrypted_key_by_id (_mongocrypt_key_broker_t *kb,
+                                            const _mongocrypt_buffer_t *key_id,
+                                            _mongocrypt_buffer_t *out)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+/* Get the final decrypted key material from a key, and optionally its key_id.
+ * @key_id_out may be NULL. @out and @key_id_out (if not NULL) are always
+ * initialized, even on error. */
+bool
+_mongocrypt_key_broker_decrypted_key_by_name (_mongocrypt_key_broker_t *kb,
+                                              const bson_value_t *key_alt_name,
+                                              _mongocrypt_buffer_t *out,
+                                              _mongocrypt_buffer_t *key_id_out)
+   MONGOCRYPT_WARN_UNUSED_RESULT;
+
+
+bool
+_mongocrypt_key_broker_status (_mongocrypt_key_broker_t *kb,
+                               mongocrypt_status_t *out);
+
+
+void
+_mongocrypt_key_broker_cleanup (_mongocrypt_key_broker_t *kb);
+
+/* For testing only, add a decrypted key */
+void
+_mongocrypt_key_broker_add_test_key (_mongocrypt_key_broker_t *kb,
+                                     const _mongocrypt_buffer_t *key_id);
+
+/* _mongocrypt_key_broker_restart is used to request additional keys. It must
+ * only be called in the KB_DONE state. */
+bool
+_mongocrypt_key_broker_restart (_mongocrypt_key_broker_t *kb);
+
+#endif /* MONGOCRYPT_KEY_BROKER_PRIVATE_H */