libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/bindings/node/lib/stateMachine.js

@@ -0,0 +1,487 @@
+'use strict';
+
+module.exports = function (modules) {
+  const tls = require('tls');
+  const net = require('net');
+  const fs = require('fs');
+  const { once } = require('events');
+  const { SocksClient } = require('socks');
+
+  // Try first to import 4.x name, fallback to 3.x name
+  const MongoNetworkTimeoutError =
+    modules.mongodb.MongoNetworkTimeoutError || modules.mongodb.MongoTimeoutError;
+
+  const common = require('./common');
+  const debug = common.debug;
+  const databaseNamespace = common.databaseNamespace;
+  const collectionNamespace = common.collectionNamespace;
+  const MongoCryptError = common.MongoCryptError;
+  const { BufferPool } = require('./buffer_pool');
+
+  // libmongocrypt states
+  const MONGOCRYPT_CTX_ERROR = 0;
+  const MONGOCRYPT_CTX_NEED_MONGO_COLLINFO = 1;
+  const MONGOCRYPT_CTX_NEED_MONGO_MARKINGS = 2;
+  const MONGOCRYPT_CTX_NEED_MONGO_KEYS = 3;
+  const MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS = 7;
+  const MONGOCRYPT_CTX_NEED_KMS = 4;
+  const MONGOCRYPT_CTX_READY = 5;
+  const MONGOCRYPT_CTX_DONE = 6;
+
+  const HTTPS_PORT = 443;
+
+  const stateToString = new Map([
+    [MONGOCRYPT_CTX_ERROR, 'MONGOCRYPT_CTX_ERROR'],
+    [MONGOCRYPT_CTX_NEED_MONGO_COLLINFO, 'MONGOCRYPT_CTX_NEED_MONGO_COLLINFO'],
+    [MONGOCRYPT_CTX_NEED_MONGO_MARKINGS, 'MONGOCRYPT_CTX_NEED_MONGO_MARKINGS'],
+    [MONGOCRYPT_CTX_NEED_MONGO_KEYS, 'MONGOCRYPT_CTX_NEED_MONGO_KEYS'],
+    [MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS, 'MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS'],
+    [MONGOCRYPT_CTX_NEED_KMS, 'MONGOCRYPT_CTX_NEED_KMS'],
+    [MONGOCRYPT_CTX_READY, 'MONGOCRYPT_CTX_READY'],
+    [MONGOCRYPT_CTX_DONE, 'MONGOCRYPT_CTX_DONE']
+  ]);
+
+  const INSECURE_TLS_OPTIONS = [
+    'tlsInsecure',
+    'tlsAllowInvalidCertificates',
+    'tlsAllowInvalidHostnames',
+    'tlsDisableOCSPEndpointCheck',
+    'tlsDisableCertificateRevocationCheck'
+  ];
+
+  /**
+   * @ignore
+   * @callback StateMachine~executeCallback
+   * @param {Error} [err] If present, indicates that the execute call failed with the given error
+   * @param {object} [result] If present, is the result of executing the state machine.
+   * @returns {void}
+   */
+
+  /**
+   * @ignore
+   * @callback StateMachine~fetchCollectionInfoCallback
+   * @param {Error} [err] If present, indicates that fetching the collection info failed with the given error
+   * @param {object} [result] If present, is the fetched collection info for the first collection to match the given filter
+   * @returns {void}
+   */
+
+  /**
+   * @ignore
+   * @callback StateMachine~markCommandCallback
+   * @param {Error} [err] If present, indicates that marking the command failed with the given error
+   * @param {Buffer} [result] If present, is the marked command serialized into bson
+   * @returns {void}
+   */
+
+  /**
+   * @ignore
+   * @callback StateMachine~fetchKeysCallback
+   * @param {Error} [err] If present, indicates that fetching the keys failed with the given error
+   * @param {object[]} [result] If present, is all the keys from the keyVault collection that matched the given filter
+   */
+
+  /**
+   * @ignore
+   * An internal class that executes across a MongoCryptContext until either
+   * a finishing state or an error is reached. Do not instantiate directly.
+   * @class StateMachine
+   */
+  class StateMachine {
+    constructor(options) {
+      this.options = options || {};
+      this.bson = options.bson;
+    }
+
+    /**
+     * @ignore
+     * Executes the state machine according to the specification
+     * @param {AutoEncrypter|ClientEncryption} autoEncrypter The JS encryption object
+     * @param {object} context The C++ context object returned from the bindings
+     * @param {StateMachine~executeCallback} callback Invoked with the result/error of executing the state machine
+     * @returns {void}
+     */
+    execute(autoEncrypter, context, callback) {
+      const bson = this.bson;
+      const keyVaultNamespace = autoEncrypter._keyVaultNamespace;
+      const keyVaultClient = autoEncrypter._keyVaultClient;
+      const metaDataClient = autoEncrypter._metaDataClient;
+      const mongocryptdClient = autoEncrypter._mongocryptdClient;
+      const mongocryptdManager = autoEncrypter._mongocryptdManager;
+
+      debug(`[context#${context.id}] ${stateToString.get(context.state) || context.state}`);
+      switch (context.state) {
+        case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO: {
+          const filter = bson.deserialize(context.nextMongoOperation());
+          this.fetchCollectionInfo(metaDataClient, context.ns, filter, (err, collInfo) => {
+            if (err) {
+              return callback(err, null);
+            }
+
+            if (collInfo) {
+              context.addMongoOperationResponse(collInfo);
+            }
+
+            context.finishMongoOperation();
+            this.execute(autoEncrypter, context, callback);
+          });
+
+          return;
+        }
+
+        case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS: {
+          const command = context.nextMongoOperation();
+          this.markCommand(mongocryptdClient, context.ns, command, (err, markedCommand) => {
+            if (err) {
+              // If we are not bypassing spawning, then we should retry once on a MongoTimeoutError (server selection error)
+              if (
+                err instanceof MongoNetworkTimeoutError &&
+                mongocryptdManager &&
+                !mongocryptdManager.bypassSpawn
+              ) {
+                mongocryptdManager.spawn(() => {
+                  // TODO: should we be shadowing the variables here?
+                  this.markCommand(mongocryptdClient, context.ns, command, (err, markedCommand) => {
+                    if (err) return callback(err, null);
+
+                    context.addMongoOperationResponse(markedCommand);
+                    context.finishMongoOperation();
+
+                    this.execute(autoEncrypter, context, callback);
+                  });
+                });
+                return;
+              }
+              return callback(err, null);
+            }
+            context.addMongoOperationResponse(markedCommand);
+            context.finishMongoOperation();
+
+            this.execute(autoEncrypter, context, callback);
+          });
+
+          return;
+        }
+
+        case MONGOCRYPT_CTX_NEED_MONGO_KEYS: {
+          const filter = context.nextMongoOperation();
+          this.fetchKeys(keyVaultClient, keyVaultNamespace, filter, (err, keys) => {
+            if (err) return callback(err, null);
+            keys.forEach(key => {
+              context.addMongoOperationResponse(bson.serialize(key));
+            });
+
+            context.finishMongoOperation();
+            this.execute(autoEncrypter, context, callback);
+          });
+
+          return;
+        }
+
+        case MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS: {
+          autoEncrypter
+            .askForKMSCredentials()
+            .then(kmsProviders => {
+              context.provideKMSProviders(
+                !Buffer.isBuffer(kmsProviders) ? bson.serialize(kmsProviders) : kmsProviders
+              );
+              this.execute(autoEncrypter, context, callback);
+            })
+            .catch(err => {
+              callback(err, null);
+            });
+
+          return;
+        }
+
+        case MONGOCRYPT_CTX_NEED_KMS: {
+          const promises = [];
+
+          let request;
+          while ((request = context.nextKMSRequest())) {
+            promises.push(this.kmsRequest(request));
+          }
+
+          Promise.all(promises)
+            .then(() => {
+              context.finishKMSRequests();
+              this.execute(autoEncrypter, context, callback);
+            })
+            .catch(err => {
+              callback(err, null);
+            });
+
+          return;
+        }
+
+        // terminal states
+        case MONGOCRYPT_CTX_READY: {
+          const finalizedContext = context.finalize();
+          // TODO: Maybe rework the logic here so that instead of doing
+          // the callback here, finalize stores the result, and then
+          // we wait to MONGOCRYPT_CTX_DONE to do the callback
+          if (context.state === MONGOCRYPT_CTX_ERROR) {
+            const message = context.status.message || 'Finalization error';
+            callback(new MongoCryptError(message));
+            return;
+          }
+          callback(null, bson.deserialize(finalizedContext, this.options));
+          return;
+        }
+        case MONGOCRYPT_CTX_ERROR: {
+          const message = context.status.message;
+          callback(new MongoCryptError(message));
+          return;
+        }
+
+        case MONGOCRYPT_CTX_DONE:
+          callback();
+          return;
+
+        default:
+          callback(new MongoCryptError(`Unknown state: ${context.state}`));
+          return;
+      }
+    }
+
+    /**
+     * @ignore
+     * Handles the request to the KMS service. Exposed for testing purposes. Do not directly invoke.
+     * @param {*} kmsContext A C++ KMS context returned from the bindings
+     * @returns {Promise<void>} A promise that resolves when the KMS reply has be fully parsed
+     */
+    kmsRequest(request) {
+      const parsedUrl = request.endpoint.split(':');
+      const port = parsedUrl[1] != null ? Number.parseInt(parsedUrl[1], 10) : HTTPS_PORT;
+      const options = { host: parsedUrl[0], servername: parsedUrl[0], port };
+      const message = request.message;
+
+      // TODO(NODE-3959): We can adopt `for-await on(socket, 'data')` with logic to control abort
+      // eslint-disable-next-line no-async-promise-executor
+      return new Promise(async (resolve, reject) => {
+        const buffer = new BufferPool();
+
+        let socket;
+        let rawSocket;
+
+        function destroySockets() {
+          for (const sock of [socket, rawSocket]) {
+            if (sock) {
+              sock.removeAllListeners();
+              sock.destroy();
+            }
+          }
+        }
+
+        function ontimeout() {
+          destroySockets();
+          reject(new MongoCryptError('KMS request timed out'));
+        }
+
+        function onerror(err) {
+          destroySockets();
+          const mcError = new MongoCryptError('KMS request failed');
+          mcError.originalError = err;
+          reject(mcError);
+        }
+
+        if (this.options.proxyOptions && this.options.proxyOptions.proxyHost) {
+          rawSocket = net.connect({
+            host: this.options.proxyOptions.proxyHost,
+            port: this.options.proxyOptions.proxyPort || 1080
+          });
+
+          rawSocket.on('timeout', ontimeout);
+          rawSocket.on('error', onerror);
+          try {
+            await once(rawSocket, 'connect');
+            options.socket = (
+              await SocksClient.createConnection({
+                existing_socket: rawSocket,
+                command: 'connect',
+                destination: { host: options.host, port: options.port },
+                proxy: {
+                  // host and port are ignored because we pass existing_socket
+                  host: 'iLoveJavaScript',
+                  port: 0,
+                  type: 5,
+                  userId: this.options.proxyOptions.proxyUsername,
+                  password: this.options.proxyOptions.proxyPassword
+                }
+              })
+            ).socket;
+          } catch (err) {
+            return onerror(err);
+          }
+        }
+
+        const tlsOptions = this.options.tlsOptions;
+        if (tlsOptions) {
+          const kmsProvider = request.kmsProvider;
+          const providerTlsOptions = tlsOptions[kmsProvider];
+          if (providerTlsOptions) {
+            const error = this.validateTlsOptions(kmsProvider, providerTlsOptions);
+            if (error) reject(error);
+            this.setTlsOptions(providerTlsOptions, options);
+          }
+        }
+        socket = tls.connect(options, () => {
+          socket.write(message);
+        });
+
+        socket.once('timeout', ontimeout);
+        socket.once('error', onerror);
+
+        socket.on('data', data => {
+          buffer.append(data);
+          while (request.bytesNeeded > 0 && buffer.length) {
+            const bytesNeeded = Math.min(request.bytesNeeded, buffer.length);
+            request.addResponse(buffer.read(bytesNeeded));
+          }
+
+          if (request.bytesNeeded <= 0) {
+            // There's no need for any more activity on this socket at this point.
+            destroySockets();
+            resolve();
+          }
+        });
+      });
+    }
+
+    /**
+     * @ignore
+     * Validates the provided TLS options are secure.
+     *
+     * @param {string} kmsProvider The KMS provider name.
+     * @param {ClientEncryptionTLSOptions} tlsOptions The client TLS options for the provider.
+     *
+     * @returns {Error} If any option is invalid.
+     */
+    validateTlsOptions(kmsProvider, tlsOptions) {
+      const tlsOptionNames = Object.keys(tlsOptions);
+      for (const option of INSECURE_TLS_OPTIONS) {
+        if (tlsOptionNames.includes(option)) {
+          return new MongoCryptError(
+            `Insecure TLS options prohibited for ${kmsProvider}: ${option}`
+          );
+        }
+      }
+    }
+
+    /**
+     * @ignore
+     * Sets only the valid secure TLS options.
+     *
+     * @param {ClientEncryptionTLSOptions} tlsOptions The client TLS options for the provider.
+     * @param {Object} options The existing connection options.
+     */
+    setTlsOptions(tlsOptions, options) {
+      if (tlsOptions.tlsCertificateKeyFile) {
+        const cert = fs.readFileSync(tlsOptions.tlsCertificateKeyFile);
+        options.cert = options.key = cert;
+      }
+      if (tlsOptions.tlsCAFile) {
+        options.ca = fs.readFileSync(tlsOptions.tlsCAFile);
+      }
+      if (tlsOptions.tlsCertificateKeyFilePassword) {
+        options.passphrase = tlsOptions.tlsCertificateKeyFilePassword;
+      }
+    }
+
+    /**
+     * @ignore
+     * Fetches collection info for a provided namespace, when libmongocrypt
+     * enters the `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO` state. The result is
+     * used to inform libmongocrypt of the schema associated with this
+     * namespace. Exposed for testing purposes. Do not directly invoke.
+     *
+     * @param {MongoClient} client A MongoClient connected to the topology
+     * @param {string} ns The namespace to list collections from
+     * @param {object} filter A filter for the listCollections command
+     * @param {StateMachine~fetchCollectionInfoCallback} callback Invoked with the info of the requested collection, or with an error
+     */
+    fetchCollectionInfo(client, ns, filter, callback) {
+      const bson = this.bson;
+      const dbName = databaseNamespace(ns);
+
+      client
+        .db(dbName)
+        .listCollections(filter, {
+          promoteLongs: false,
+          promoteValues: false,
+          session: this.options.session
+        })
+        .toArray()
+        .then(
+          collections => {
+            const info = collections.length > 0 ? bson.serialize(collections[0]) : null;
+            return callback(null, info);
+          },
+          err => {
+            callback(err, null);
+          }
+        );
+    }
+
+    /**
+     * @ignore
+     * Calls to the mongocryptd to provide markings for a command.
+     * Exposed for testing purposes. Do not directly invoke.
+     * @param {MongoClient} client A MongoClient connected to a mongocryptd
+     * @param {string} ns The namespace (database.collection) the command is being executed on
+     * @param {object} command The command to execute.
+     * @param {StateMachine~markCommandCallback} callback Invoked with the serialized and marked bson command, or with an error
+     * @returns {void}
+     */
+    markCommand(client, ns, command, callback) {
+      const bson = this.bson;
+      const options = { promoteLongs: false, promoteValues: false };
+      const dbName = databaseNamespace(ns);
+      const rawCommand = bson.deserialize(command, options);
+
+      client
+        .db(dbName)
+        .command(rawCommand, options)
+        .then(
+          response => {
+            return callback(null, bson.serialize(response, this.options));
+          },
+          err => {
+            callback(err, null);
+          }
+        );
+    }
+
+    /**
+     * @ignore
+     * Requests keys from the keyVault collection on the topology.
+     * Exposed for testing purposes. Do not directly invoke.
+     * @param {MongoClient} client A MongoClient connected to the topology
+     * @param {string} keyVaultNamespace The namespace (database.collection) of the keyVault Collection
+     * @param {object} filter The filter for the find query against the keyVault Collection
+     * @param {StateMachine~fetchKeysCallback} callback Invoked with the found keys, or with an error
+     * @returns {void}
+     */
+    fetchKeys(client, keyVaultNamespace, filter, callback) {
+      const bson = this.bson;
+      const dbName = databaseNamespace(keyVaultNamespace);
+      const collectionName = collectionNamespace(keyVaultNamespace);
+      filter = bson.deserialize(filter);
+
+      client
+        .db(dbName)
+        .collection(collectionName, { readConcern: { level: 'majority' } })
+        .find(filter, { session: this.options.session })
+        .toArray()
+        .then(
+          keys => {
+            return callback(null, keys);
+          },
+          err => {
+            callback(err, null);
+          }
+        );
+    }
+  }
+
+  return { StateMachine };
+};