libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoAwsKmsProviderOptions.java

@@ -0,0 +1,104 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package com.mongodb.crypt.capi;
+
+import static org.bson.assertions.Assertions.notNull;
+
+/**
+ * The options for configuring the AWS KMS provider.
+ */
+public class MongoAwsKmsProviderOptions {
+
+    private final String accessKeyId;
+    private final String secretAccessKey;
+
+    /**
+     * Construct a builder for the options
+     *
+     * @return the builder
+     */
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    /**
+     * Gets the access key id
+     *
+     * @return the access key id, which may not be null
+     */
+    public String getAccessKeyId() {
+        return accessKeyId;
+    }
+
+    /**
+     * Gets the secret access key
+     *
+     * @return the secret access key, which may not be null
+     */
+    public String getSecretAccessKey() {
+        return secretAccessKey;
+    }
+
+
+    /**
+     * The builder for the options
+     */
+    public static class Builder {
+        private String accessKeyId;
+        private String secretAccessKey;
+
+        private Builder() {
+        }
+
+        /**
+         * Sets the access key id.
+         *
+         * @param accessKeyId the access key id
+         * @return this
+         */
+        public Builder accessKeyId(final String accessKeyId) {
+            this.accessKeyId = accessKeyId;
+            return this;
+        }
+
+        /**
+         * Sets the secret access key.
+         *
+         * @param secretAccessKey the secret access key
+         * @return this
+         */
+        public Builder secretAccessKey(final String secretAccessKey) {
+            this.secretAccessKey = secretAccessKey;
+            return this;
+        }
+
+        /**
+         * Build the options.
+         *
+         * @return the options
+         */
+        public MongoAwsKmsProviderOptions build() {
+            return new MongoAwsKmsProviderOptions(this);
+        }
+    }
+
+    private MongoAwsKmsProviderOptions(final Builder builder) {
+        this.accessKeyId = notNull("AWS KMS provider accessKeyId", builder.accessKeyId);
+        this.secretAccessKey = notNull("AWS KMS provider secretAccessKey", builder.secretAccessKey);
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypt.java

@@ -0,0 +1,100 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+
+package com.mongodb.crypt.capi;
+
+import org.bson.BsonDocument;
+
+import java.io.Closeable;
+
+/**
+ * A context for encryption/decryption operations.
+ */
+public interface MongoCrypt extends Closeable {
+
+    /**
+     * Create a context to use for encryption
+     *
+     * @param database            the namespace
+     * @param command             the document representing the command to encrypt
+     * @return the context
+     */
+    MongoCryptContext createEncryptionContext(String database, final BsonDocument command);
+
+    /**
+     * Create a context to use for decryption
+     *
+     * @param document the document to decrypt
+     * @return the context
+     */
+    MongoCryptContext createDecryptionContext(BsonDocument document);
+
+    /**
+     * Create a context to use for creating a data key
+     * @param kmsProvider the KMS provider
+     * @param options the data key options
+     * @return the context
+     */
+    MongoCryptContext createDataKeyContext(String kmsProvider, MongoDataKeyOptions options);
+
+    /**
+     * Create a context to use for encryption
+     *
+     * @param document the document to encrypt, which must be in the form { "v" : BSON value to encrypt }
+     * @param options  the explicit encryption options
+     * @return the context
+     */
+    MongoCryptContext createExplicitEncryptionContext(BsonDocument document, MongoExplicitEncryptOptions options);
+
+    /**
+     * Create a context to use for encryption
+     *
+     * @param document the document to encrypt, which must be in the form { "v" : BSON value to encrypt }
+     * @param options  the expression encryption options
+     * @return the context
+     * @since 1.7
+     */
+    MongoCryptContext createEncryptExpressionContext(BsonDocument document, MongoExplicitEncryptOptions options);
+
+    /**
+     * Create a context to use for encryption
+     *
+     * @param document the document to decrypt,which must be in the form { "v" : encrypted BSON value }
+     * @return the context
+     */
+    MongoCryptContext createExplicitDecryptionContext(BsonDocument document);
+
+    /**
+     * Create a context to use for encryption
+     *
+     * @param filter The filter to use for the find command on the key vault collection to retrieve datakeys to rewrap.
+     * @param options  the rewrap many data key options
+     * @return the context
+     * @since 1.5
+     */
+    MongoCryptContext createRewrapManyDatakeyContext(BsonDocument filter, MongoRewrapManyDataKeyOptions options);
+
+    /**
+     * @return the version string of the loaded crypt shared dynamic library if available or null
+     * @since 1.5
+     */
+    String getCryptSharedLibVersionString();
+
+    @Override
+    void close();
+}

data/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContext.java

@@ -0,0 +1,137 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package com.mongodb.crypt.capi;
+
+import org.bson.BsonDocument;
+import org.bson.RawBsonDocument;
+
+import java.io.Closeable;
+
+/**
+ * An interface representing the lifecycle of an encryption or decryption request.  It's modelled as a state machine.
+ */
+public interface MongoCryptContext extends Closeable {
+
+    /**
+     * The possible states.
+     */
+    enum State {
+        /**
+         *  Needs collection information from the cluster encrypting to
+         */
+        NEED_MONGO_COLLINFO(CAPI.MONGOCRYPT_CTX_NEED_MONGO_COLLINFO),
+
+        /**
+         * Need to mark command with encryption markers
+         */
+        NEED_MONGO_MARKINGS(CAPI.MONGOCRYPT_CTX_NEED_MONGO_MARKINGS),
+
+        /**
+         *  Need keys from the key vault
+         */
+        NEED_MONGO_KEYS(CAPI.MONGOCRYPT_CTX_NEED_MONGO_KEYS),
+
+        /**
+         * Need the key management service
+         */
+        NEED_KMS(CAPI.MONGOCRYPT_CTX_NEED_KMS),
+
+        /**
+         * Need to fetch/renew KMS credentials
+         * @since 1.4
+         */
+        NEED_KMS_CREDENTIALS(CAPI.MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS),
+
+        /**
+         * Ready for encryption/decryption
+         */
+        READY(CAPI.MONGOCRYPT_CTX_READY),
+
+        /**
+         * Done
+         */
+        DONE(CAPI.MONGOCRYPT_CTX_DONE);
+
+        private final int index;
+
+        State(final int index) {
+            this.index = index;
+        }
+
+        static State fromIndex(final int index) {
+            for (State state : State.values()) {
+                if (state.index == index) {
+                    return state;
+                }
+            }
+            throw new MongoCryptException("Unknown context state " + index);
+        }
+    }
+
+    /**
+     * Gets the current state.
+     *
+     * @return the current state
+     */
+    State getState();
+
+    /**
+     *
+     * @return the operation to execute
+     */
+    RawBsonDocument getMongoOperation();
+
+    /**
+     *
+     * @param document a result of the operation
+     */
+    void addMongoOperationResult(BsonDocument document);
+
+    /**
+     * Signal completion of the operation
+     */
+    void completeMongoOperation();
+
+    /**
+     * Provide KMS credentials on demand, in response to NEED_KMS_CREDENTIALS state
+     *
+     * @param credentialsDocument document containing all credentials
+     * @since 1.4
+     */
+    void provideKmsProviderCredentials(BsonDocument credentialsDocument);
+
+    /**
+     *
+     * @return the next key decryptor, or null if there are no more
+     */
+    MongoKeyDecryptor nextKeyDecryptor();
+
+    /**
+     * Indicate that all key decryptors have been completed
+     */
+    void completeKeyDecryptors();
+
+    /**
+     *
+     * @return the encrypted or decrypted document
+     */
+    RawBsonDocument finish();
+
+    @Override
+    void close();
+}

data/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContextImpl.java

@@ -0,0 +1,164 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package com.mongodb.crypt.capi;
+
+import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t;
+import com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_t;
+import com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_t;
+import org.bson.BsonDocument;
+import org.bson.RawBsonDocument;
+
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_destroy;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_new;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_destroy;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_finalize;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_kms_done;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_mongo_done;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_mongo_feed;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_mongo_op;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_next_kms_ctx;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_provide_kms_providers;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_state;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_status;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_destroy;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_new;
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_t;
+import static com.mongodb.crypt.capi.CAPIHelper.toBinary;
+import static com.mongodb.crypt.capi.CAPIHelper.toDocument;
+import static org.bson.assertions.Assertions.isTrue;
+import static org.bson.assertions.Assertions.notNull;
+
+class MongoCryptContextImpl implements MongoCryptContext {
+    private final mongocrypt_ctx_t wrapped;
+    private volatile boolean closed;
+
+    MongoCryptContextImpl(final mongocrypt_ctx_t wrapped) {
+        notNull("wrapped", wrapped);
+        this.wrapped = wrapped;
+    }
+
+    @Override
+    public State getState() {
+        isTrue("open", !closed);
+        return State.fromIndex(mongocrypt_ctx_state(wrapped));
+    }
+
+    @Override
+    public RawBsonDocument getMongoOperation() {
+        isTrue("open", !closed);
+        mongocrypt_binary_t binary = mongocrypt_binary_new();
+
+        try {
+            boolean success = mongocrypt_ctx_mongo_op(wrapped, binary);
+            if (!success) {
+                throwExceptionFromStatus();
+            }
+            return toDocument(binary);
+        } finally {
+            mongocrypt_binary_destroy(binary);
+        }
+    }
+
+    @Override
+    public void addMongoOperationResult(final BsonDocument document) {
+        isTrue("open", !closed);
+
+        try (BinaryHolder binaryHolder = toBinary(document)) {
+            boolean success = mongocrypt_ctx_mongo_feed(wrapped, binaryHolder.getBinary());
+            if (!success) {
+                throwExceptionFromStatus();
+            }
+        }
+    }
+
+    @Override
+    public void completeMongoOperation() {
+        isTrue("open", !closed);
+        boolean success = mongocrypt_ctx_mongo_done(wrapped);
+        if (!success) {
+            throwExceptionFromStatus();
+        }
+    }
+
+    @Override
+    public void provideKmsProviderCredentials(final BsonDocument credentialsDocument) {
+        try (BinaryHolder binaryHolder = toBinary(credentialsDocument)) {
+            boolean success = mongocrypt_ctx_provide_kms_providers(wrapped, binaryHolder.getBinary());
+            if (!success) {
+                throwExceptionFromStatus();
+            }
+        }
+    }
+
+    @Override
+    public MongoKeyDecryptor nextKeyDecryptor() {
+        isTrue("open", !closed);
+
+        mongocrypt_kms_ctx_t kmsContext = mongocrypt_ctx_next_kms_ctx(wrapped);
+        if (kmsContext == null) {
+            return null;
+        }
+        return new MongoKeyDecryptorImpl(kmsContext);
+    }
+
+    @Override
+    public void completeKeyDecryptors() {
+        isTrue("open", !closed);
+
+        boolean success = mongocrypt_ctx_kms_done(wrapped);
+        if (!success) {
+            throwExceptionFromStatus();
+        }
+
+    }
+
+    @Override
+    public RawBsonDocument finish() {
+        isTrue("open", !closed);
+
+        mongocrypt_binary_t binary = mongocrypt_binary_new();
+
+        try {
+            boolean success = mongocrypt_ctx_finalize(wrapped, binary);
+            if (!success) {
+                throwExceptionFromStatus();
+            }
+            return toDocument(binary);
+        } finally {
+            mongocrypt_binary_destroy(binary);
+        }
+    }
+
+    @Override
+    public void close() {
+        mongocrypt_ctx_destroy(wrapped);
+        closed = true;
+    }
+
+    static void throwExceptionFromStatus(final mongocrypt_ctx_t wrapped) {
+        mongocrypt_status_t status = mongocrypt_status_new();
+        mongocrypt_ctx_status(wrapped, status);
+        MongoCryptException e = new MongoCryptException(status);
+        mongocrypt_status_destroy(status);
+        throw e;
+    }
+
+    private void throwExceptionFromStatus() {
+        throwExceptionFromStatus(wrapped);
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptException.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package com.mongodb.crypt.capi;
+
+
+import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t;
+
+import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_code;
+import static org.bson.assertions.Assertions.isTrue;
+
+/**
+ * Top level Exception for all Mongo Crypt CAPI exceptions
+ */
+public class MongoCryptException extends RuntimeException {
+    private static final long serialVersionUID = -5524416583514807953L;
+    private final int code;
+
+    /**
+     * @param msg the message
+     */
+    public MongoCryptException(final String msg) {
+        super(msg);
+        this.code = -1;
+    }
+
+    /**
+     * @param msg   the message
+     * @param cause the cause
+     */
+    public MongoCryptException(final String msg, Throwable cause) {
+        super(msg, cause);
+        this.code = -1;
+    }
+
+    /**
+     * Construct an instance from a {@code mongocrypt_status_t}.
+     *
+     * @param status the status
+     */
+    MongoCryptException(final mongocrypt_status_t status) {
+        super(CAPI.mongocrypt_status_message(status, null).toString());
+        isTrue("status not ok", !CAPI.mongocrypt_status_ok(status));
+        code = mongocrypt_status_code(status);
+    }
+
+    /**
+     * @return the error code for the exception.
+     */
+    public int getCode() {
+        return code;
+    }
+}