libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt.h

@@ -0,0 +1,290 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef TEST_MONGOCRYPT_H
+#define TEST_MONGOCRYPT_H
+
+#include <bson/bson.h>
+#include <stdint.h>
+
+#include "mongocrypt.h"
+#include "mongocrypt-ctx-private.h"
+#include "mongocrypt-private.h"
+#include "mongocrypt-buffer-private.h"
+#include "mongocrypt-kms-ctx-private.h"
+#include "mongocrypt-key-broker-private.h"
+
+#include "test-mongocrypt-util.h"
+#include "test-mongocrypt-assert.h"
+
+struct __mongocrypt_tester_t;
+typedef void (*_mongocrypt_test_fn) (struct __mongocrypt_tester_t *tester);
+
+typedef enum tester_mongocrypt_flags {
+   /// Default settings for creating a mongocrypt_t for testing
+   TESTER_MONGOCRYPT_DEFAULT = 0,
+   /// Create a mongocrypt_t that has the crypt_shared library loaded. A
+   /// crypt_shared library must be present in the same directory as the test
+   /// executable.
+   TESTER_MONGOCRYPT_WITH_CRYPT_SHARED_LIB = 1 << 0,
+} tester_mongocrypt_flags;
+
+/* Arbitrary max of 2048 instances of temporary test data. Increase as needed.
+ */
+#define TEST_DATA_COUNT 2048
+typedef struct __mongocrypt_tester_t {
+   int test_count;
+   char *test_names[TEST_DATA_COUNT];
+   _mongocrypt_test_fn test_fns[TEST_DATA_COUNT];
+
+   int file_count;
+   char *file_paths[TEST_DATA_COUNT];
+   _mongocrypt_buffer_t file_bufs[TEST_DATA_COUNT];
+
+   int bson_count;
+   bson_t test_bson[TEST_DATA_COUNT];
+
+   int bin_count;
+   mongocrypt_binary_t *test_bin[TEST_DATA_COUNT];
+
+   int blob_count;
+   uint8_t *test_blob[TEST_DATA_COUNT];
+
+   // Overides used in run_ctx_to
+   struct {
+      char *collection_info;
+      char *mongocryptd_reply;
+      char *key_file;
+   } paths;
+
+   /* Example encrypted doc. */
+   _mongocrypt_buffer_t encrypted_doc;
+} _mongocrypt_tester_t;
+
+
+/* Load a .json file as bson */
+void
+_load_json_as_bson (const char *path, bson_t *out);
+
+
+void
+_mongocrypt_tester_satisfy_kms (_mongocrypt_tester_t *tester,
+                                mongocrypt_kms_ctx_t *kms);
+
+
+void
+_mongocrypt_tester_run_ctx_to (_mongocrypt_tester_t *tester,
+                               mongocrypt_ctx_t *ctx,
+                               mongocrypt_ctx_state_t stop_state);
+
+
+mongocrypt_binary_t *
+_mongocrypt_tester_encrypted_doc (_mongocrypt_tester_t *tester);
+
+
+/* Return a repeated character with no null terminator. */
+char *
+_mongocrypt_repeat_char (char c, uint32_t times);
+
+void
+_mongocrypt_tester_fill_buffer (_mongocrypt_buffer_t *buf, int n);
+
+
+/* Return a new initialized mongocrypt_t for testing. */
+mongocrypt_t *
+_mongocrypt_tester_mongocrypt (tester_mongocrypt_flags options);
+
+typedef enum {
+   CRYPTO_REQUIRED,
+   CRYPTO_OPTIONAL,
+   CRYPTO_PROHIBITED
+} _mongocrypt_tester_crypto_spec_t;
+
+void
+_mongocrypt_tester_install (_mongocrypt_tester_t *tester,
+                            char *name,
+                            _mongocrypt_test_fn fn,
+                            _mongocrypt_tester_crypto_spec_t crypto_spec);
+
+
+const char *
+_mongocrypt_tester_plaintext (_mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_crypto (_mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_log (_mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_data_key (_mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_ctx (_mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_ctx_encrypt (_mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_ctx_decrypt (_mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_ctx_rewrap_many_datakey (
+   _mongocrypt_tester_t *tester);
+
+
+void
+_mongocrypt_tester_install_ciphertext (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_key_broker (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_local_kms (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_cache (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_buffer (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_ctx_setopt (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_key (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_marking (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_traverse_util (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_crypto_hooks (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_key_cache (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_kms_responses (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_status (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_csfle_lib (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_dll (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_endpoint (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_kek (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_cache_oauth (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_kms_ctx (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_mc_tokens (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_fle2_payloads (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_efc (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_compact (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_fle2_payload_uev (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_fle2_payload_iup (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_gcp_auth (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_range_encoding (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_range_edge_generation (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_range_mincover (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_mc_RangeOpts (_mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_mc_FLE2RangeFindDriverSpec (
+   _mongocrypt_tester_t *tester);
+
+void
+_mongocrypt_tester_install_mc_reader (_mongocrypt_tester_t *tester);
+
+/* Conveniences for getting test data. */
+
+/* Get a temporary bson_t from a JSON string. Do not free it. */
+bson_t *
+_mongocrypt_tester_bson_from_json (_mongocrypt_tester_t *tester,
+                                   const char *json,
+                                   ...);
+#define TMP_BSON(...) _mongocrypt_tester_bson_from_json (tester, __VA_ARGS__)
+
+/* Get a temporary binary from a JSON string. Do not free it. */
+mongocrypt_binary_t *
+_mongocrypt_tester_bin_from_json (_mongocrypt_tester_t *tester,
+                                  const char *json,
+                                  ...);
+#define TEST_BSON(...) _mongocrypt_tester_bin_from_json (tester, __VA_ARGS__)
+
+/* Return a binary blob with the repeating sequence of 123. Do not free it. */
+mongocrypt_binary_t *
+_mongocrypt_tester_bin (_mongocrypt_tester_t *tester, int size);
+#define TEST_BIN(size) _mongocrypt_tester_bin (tester, size)
+
+/* Return either a .json file as BSON or a .txt file as characters. Do not free
+ * it. */
+mongocrypt_binary_t *
+_mongocrypt_tester_file (_mongocrypt_tester_t *tester, const char *path);
+#define TEST_FILE(path) _mongocrypt_tester_file (tester, path)
+
+#define INSTALL_TEST(fn) \
+   _mongocrypt_tester_install (tester, #fn, fn, CRYPTO_REQUIRED)
+#define INSTALL_TEST_CRYPTO(fn, crypto) \
+   _mongocrypt_tester_install (tester, #fn, fn, crypto)
+
+void
+_load_json_as_bson (const char *path, bson_t *out);
+
+extern bool _aes_ctr_is_supported_by_os;
+
+#endif

data/ext/libmongocrypt/libmongocrypt/test/util/HELP.autogen

@@ -0,0 +1,102 @@
+"`csfle` is a small utility for testing the state machine with real data.\n"
+"\n"
+"To build `csfle`, ensure libmongoc is installed (in addition to libbson) and set the option -DENABLE_ONLINE_TESTS=ON when configuring with `cmake`.\n"
+"\n"
+"Options can also be provided through a config flag.\n"
+"\n"
+"```\n"
+"Global options\n"
+"    --options_file <string>\n"
+"        Alternative way to pass all options.\n"
+"    --kms_providers_file <string>\n"
+"        Defaults to ~/.csfle/kms_providers.json\n"
+"    --mongocryptd_uri <string>\n"
+"        Defaults to 'mongodb://localhost:27020'.\n"
+"    --mongodb_uri <string>\n"
+"        Defaults to 'mongodb://localhost:27017'.\n"
+"    --mongodb_keyvault_uri <string>\n"
+"        Defaults to 'mongodb://localhost:27017'.\n"
+"    --keyvault_namespace <string>\n"
+"        Defaults to 'keyvault.datakeys'.\n"
+"    --schema_map_file <string> (optional)\n"
+"        Defaults to using remote schemas.\n"
+"    --trace <bool>\n"
+"        Defaults to false.\n"
+"    --tls_ca_file <string>\n"
+"        Set a custom CA to verify server certificates in TLS connections. If not set, uses system defaults. Useful for KMIP.\n"
+"    --tls_certificate_key_file <string>\n"
+"        The client certificate and private key. If not set, a client certificate is not sent in TLS connections. Useful for KMIP.\n"
+"\n"
+"csfle create_datakey\n"
+"    --kms_provider <string>\n"
+"    --key_alt_names <comma separated strings>\n"
+"\n"
+"    AWS options.\n"
+"    --aws_kek_region <string>\n"
+"    --aws_kek_key <string>\n"
+"    --aws_kek_endpoint <string>\n"
+"\n"
+"    Azure options.\n"
+"    --azure_kek_keyvaultendpoint <string>\n"
+"    --azure_kek_keyname <string>\n"
+"    --azure_kek_keyversion <string> (optional)\n"
+"\n"
+"    GCP options.\n"
+"    --gcp_kek_endpoint <string>\n"
+"    --gcp_kek_projectid <string>\n"
+"    --gcp_kek_location <string>\n"
+"    --gcp_kek_keyring <string>\n"
+"    --gcp_kek_keyname <string>\n"
+"    --gcp_kek_keyversion <string> (optional)\n"
+"\n"
+"    KMIP options.\n"
+"    --kmip_kek_endpoint <string>\n"
+"    --kmip_kek_keyid <string>\n"
+"\n"
+"csfle auto_encrypt\n"
+"    --command <JSON string> or --command_file <string>\n"
+"    --db <string>\n"
+"\n"
+"csfle auto_decrypt\n"
+"    --document <JSON string> or --document_file <string>\n"
+"\n"
+"csfle explicit_encrypt\n"
+"    --value <JSON string> Document must have form { 'v': ... }\n"
+"    --key_id <base64 string>\n"
+"    --key_alt_name <string>\n"
+"    --algorithm <string>\n"
+"\n"
+"csfle explicit_decrypt\n"
+"    --value <JSON string> Document must have form { 'v': ... }\n"
+"```\n"
+"\n"
+"\n"
+"The KMS providers file must be extended canonical JSON of the following form.\n"
+"\n"
+"```\n"
+"{\n"
+"    'aws': {\n"
+"        'accessKeyId': <string>,\n"
+"        'secretAccessKey': <string>\n"
+"    }\n"
+"\n"
+"    'local': {\n"
+"        'key': <binary of 96 bytes>\n"
+"    }\n"
+"}\n"
+"```\n"
+"\n"
+"No KMS providers are required.\n"
+"\n"
+"\n"
+"## Examples\n"
+"\n"
+"```\n"
+"csfle create_datakey --kms_provider aws --aws_kek_region us-east-1 --aws_kek_key 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0'\n"
+"\n"
+"csfle auto_encrypt --command '{'insert': 'coll', 'documents': [{'ssn': '123'}]}' --db 'db' --schema_map_file ./.csfle/schema_map.json\n"
+"\n"
+"csfle auto_decrypt --document '{ 'insert' : 'coll', 'documents' : [ { 'ssn' : { '$binary' : { 'base64': 'ARG+PK8ud0RZlDIzKwQmFoMCOuSIPyrfYleSqMZRXgaPCQOAurv0LTLNL6Tn/G7TuVOyf/Qv3j6VxSxCQEeu/yO7vv/UDE5niDE0itjOqjmf5Q==', 'subType' : '06' } } } ] }'\n"
+"\n"
+"csfle explicit_encrypt --key_id 'Eb48ry53RFmUMjMrBCYWgw==' --value '{'v': 'test'}' --algorithm 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'\n"
+"``\n"

data/ext/libmongocrypt/libmongocrypt/test/util/README.md

@@ -0,0 +1,103 @@
+`csfle` is a small utility for testing the state machine with real data.
+
+To build `csfle`, ensure libmongoc is installed (in addition to libbson) and set the option -DENABLE_ONLINE_TESTS=ON when configuring with `cmake`.
+
+Options can also be provided through a config flag.
+
+```
+Global options
+    --options_file <string>
+        Alternative way to pass all options.
+    --kms_providers_file <string>
+        Defaults to ~/.csfle/kms_providers.json
+    --mongocryptd_uri <string>
+        Defaults to "mongodb://localhost:27020".
+    --mongodb_uri <string>
+        Defaults to "mongodb://localhost:27017".
+    --mongodb_keyvault_uri <string>
+        Defaults to "mongodb://localhost:27017".
+    --keyvault_namespace <string>
+        Defaults to "keyvault.datakeys".
+    --schema_map_file <string> (optional)
+        Defaults to using remote schemas.
+    --trace <bool>
+        Defaults to false.
+    --tls_ca_file <string>
+        Set a custom CA to verify server certificates in TLS connections. If not set, uses system defaults. Useful for KMIP.
+    --tls_certificate_key_file <string>
+        The client certificate and private key. If not set, a client certificate is not sent in TLS connections. Useful for KMIP.
+
+csfle create_datakey
+    --kms_provider <string>
+    --key_alt_names <comma separated strings>
+    --key_material <base64 string>
+
+    AWS options.
+    --aws_kek_region <string>
+    --aws_kek_key <string>
+    --aws_kek_endpoint <string>
+
+    Azure options.
+    --azure_kek_keyvaultendpoint <string>
+    --azure_kek_keyname <string>
+    --azure_kek_keyversion <string> (optional)
+
+    GCP options.
+    --gcp_kek_endpoint <string>
+    --gcp_kek_projectid <string>
+    --gcp_kek_location <string>
+    --gcp_kek_keyring <string>
+    --gcp_kek_keyname <string>
+    --gcp_kek_keyversion <string> (optional)
+
+    KMIP options.
+    --kmip_kek_endpoint <string>
+    --kmip_kek_keyid <string>
+
+csfle auto_encrypt
+    --command <JSON string> or --command_file <string>
+    --db <string>
+
+csfle auto_decrypt
+    --document <JSON string> or --document_file <string>
+
+csfle explicit_encrypt
+    --value <JSON string> Document must have form { "v": ... }
+    --key_id <base64 string>
+    --key_alt_name <string>
+    --algorithm <string>
+
+csfle explicit_decrypt
+    --value <JSON string> Document must have form { "v": ... }
+```
+
+
+The KMS providers file must be extended canonical JSON of the following form.
+
+```
+{
+    "aws": {
+        "accessKeyId": <string>,
+        "secretAccessKey": <string>
+    }
+
+    "local": {
+        "key": <binary of 96 bytes>
+    }
+}
+```
+
+No KMS providers are required.
+
+
+## Examples
+
+```
+csfle create_datakey --kms_provider aws --aws_kek_region us-east-1 --aws_kek_key "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0"
+
+csfle auto_encrypt --command '{"insert": "coll", "documents": [{"ssn": "123"}]}' --db "db" --schema_map_file ./.csfle/schema_map.json
+
+csfle auto_decrypt --document '{ "insert" : "coll", "documents" : [ { "ssn" : { "$binary" : { "base64": "ARG+PK8ud0RZlDIzKwQmFoMCOuSIPyrfYleSqMZRXgaPCQOAurv0LTLNL6Tn/G7TuVOyf/Qv3j6VxSxCQEeu/yO7vv/UDE5niDE0itjOqjmf5Q==", "subType" : "06" } } } ] }'
+
+csfle explicit_encrypt --key_id "Eb48ry53RFmUMjMrBCYWgw==" --value '{"v": "test"}' --algorithm "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
+```