libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/CryptContext.cs

@@ -0,0 +1,214 @@
+/*
+ * Copyright 2019–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+using System.Collections.Generic;
+
+namespace MongoDB.Libmongocrypt
+{
+    /// <summary>
+    /// A encryption or decryption session. It may not be reused.
+    /// </summary>
+    /// <seealso cref="System.IDisposable" />
+    /// <seealso cref="IStatus" />
+    public class CryptContext : IDisposable, IStatus
+    {
+        /// <summary>
+        /// States of the CryptContext state machine
+        /// </summary>
+        public enum StateCode
+        {
+            /// <summary>
+            /// LibMongoCrypt hit an error
+            /// </summary>
+            MONGOCRYPT_CTX_ERROR = 0,
+
+            /// <summary>
+            /// LibMongoCrypt wants the collection information by running a OP_MSG command against the users' mongod.
+            /// </summary>
+            MONGOCRYPT_CTX_NEED_MONGO_COLLINFO = 1,
+
+            /// <summary>
+            /// LibMongoCrypt wants a command to be run against mongocryptd.
+            /// </summary>
+            MONGOCRYPT_CTX_NEED_MONGO_MARKINGS = 2,
+
+            /// <summary>
+            /// LibMongoCrypt wants a command to be run against mongod key vault.
+            /// </summary>
+            MONGOCRYPT_CTX_NEED_MONGO_KEYS = 3,
+
+            /// <summary>
+            /// LibMongoCrypt wants a request sent to KMS.
+            /// </summary>
+            MONGOCRYPT_CTX_NEED_KMS = 4,
+
+            /// <summary>
+            /// LibMongoCrypt is ready to do encryption, call Finish().
+            /// </summary>
+            MONGOCRYPT_CTX_READY = 5,
+
+            /// <summary>
+            /// LibMongoCrypt is complete.
+            /// </summary>
+            MONGOCRYPT_CTX_DONE = 6,
+
+            /// <summary>
+            /// LibMongoCrypt requires new credentials.
+            /// </summary>
+            MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS = 7
+        }
+
+        private ContextSafeHandle _handle;
+        private Status _status;
+
+        internal CryptContext(ContextSafeHandle handle)
+        {
+            _handle = handle;
+            _status = new Status();
+        }
+
+        /// <summary>
+        /// Gets the state.
+        /// </summary>
+        /// <value>
+        /// The state.
+        /// </value>
+        public StateCode State
+        {
+            get
+            {
+                return Library.mongocrypt_ctx_state(_handle);
+            }
+        }
+
+        /// <summary>
+        /// Gets a value indicating whether this instance is done.
+        /// </summary>
+        /// <value>
+        ///   <c>true</c> if this instance is done; otherwise, <c>false</c>.
+        /// </value>
+        public bool IsDone
+        {
+            get { return State == StateCode.MONGOCRYPT_CTX_DONE; }
+        }
+
+        /// <summary>
+        /// Gets the operation.
+        /// </summary>
+        /// <returns>Binary payload to send to either KMS, mongod, or mongocryptd</returns>
+        public Binary GetOperation()
+        {
+            Binary binary = new Binary();
+            Check(Library.mongocrypt_ctx_mongo_op(_handle, binary.Handle));
+            return binary;
+        }
+
+        /// <summary>
+        /// Feeds the result from running a remote operation back to the libmongocrypt.
+        /// </summary>
+        /// <param name="buffer">The buffer.</param>
+        public void Feed(byte[] buffer)
+        {
+            unsafe
+            {
+                fixed (byte* p = buffer)
+                {
+                    IntPtr ptr = (IntPtr)p;
+                    using (PinnedBinary pinned = new PinnedBinary(ptr, (uint)buffer.Length))
+                    {
+                        Check(Library.mongocrypt_ctx_mongo_feed(_handle, pinned.Handle));
+                    }
+                }
+            }
+        }
+
+        /// <summary>
+        /// Signal the feeding is done.
+        /// </summary>
+        public void MarkDone()
+        {
+            Check(Library.mongocrypt_ctx_mongo_done(_handle));
+        }
+
+        /// <summary>
+        /// Finalizes for encryption.
+        /// </summary>
+        /// <returns>The encrypted or decrypted result.</returns>
+        public Binary FinalizeForEncryption()
+        {
+            Binary binary = new Binary();
+            Check(Library.mongocrypt_ctx_finalize(_handle, binary.Handle));
+            return binary;
+        }
+
+        /// <summary>
+        /// Gets a collection of KMS message requests to make
+        /// </summary>
+        /// <returns>Collection of KMS Messages</returns>
+        public KmsRequestCollection GetKmsMessageRequests()
+        {
+            var requests = new List<KmsRequest>();
+            for (IntPtr request = Library.mongocrypt_ctx_next_kms_ctx(_handle); request != IntPtr.Zero; request = Library.mongocrypt_ctx_next_kms_ctx(_handle))
+            {
+                requests.Add(new KmsRequest(request));
+            }
+
+            return new KmsRequestCollection(requests, this);
+        }
+
+        public void SetCredentials(byte[] credentials)
+        {
+            PinnedBinary.RunAsPinnedBinary(_handle, credentials, _status, (h, b) => Library.mongocrypt_ctx_provide_kms_providers(h, b));
+        }
+
+        void IStatus.Check(Status status)
+        {
+            Library.mongocrypt_ctx_status(_handle, status.Handle);
+        }
+
+        #region IDisposable
+        public void Dispose()
+        {
+            Dispose(true);
+            GC.SuppressFinalize(this);
+        }
+
+        protected virtual void Dispose(bool disposing)
+        {
+            // Adapted from: https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.safehandle?view=netcore-3.0
+            if (_handle != null && !_handle.IsInvalid)
+            {
+                // Free the handle
+                _handle.Dispose();
+            }
+        }
+        #endregion
+
+        internal void MarkKmsDone()
+        {
+            Check(Library.mongocrypt_ctx_kms_done(_handle));
+        }
+
+        private void Check(bool success)
+        {
+            if (!success)
+            {
+                _status.Check(this);
+            }
+        }
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/CryptException.cs

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2019–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+
+namespace MongoDB.Libmongocrypt
+{
+    /// <summary>
+    /// An exception from libmongocrypt.
+    /// </summary>
+    /// <seealso cref="System.Exception" />
+    public class CryptException : Exception
+    {
+        private readonly uint _code;
+        private readonly Library.StatusType _statusType;
+
+        internal CryptException(Library.StatusType statusType, uint code, string message)
+            : base(message)
+        {
+            _code = code;
+            _statusType = statusType;
+        }
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/CryptOptions.cs

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2019–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+
+namespace MongoDB.Libmongocrypt
+{
+    /// <summary>
+    /// Options to configure mongocrypt with.
+    /// </summary>
+    public class CryptOptions
+    {
+        public bool BypassQueryAnalysis { get; }
+        public string CryptSharedLibPath { get; }
+        public string CryptSharedLibSearchPath { get; }
+        public byte[] EncryptedFieldsMap { get; }
+        public bool IsCryptSharedLibRequired { get; }
+        public IReadOnlyList<KmsCredentials> KmsCredentials { get; }
+        public byte[] Schema { get; }
+
+        public CryptOptions(IEnumerable<KmsCredentials> credentials) : this(credentials, null)
+        {
+        }
+
+        public CryptOptions(
+            IEnumerable<KmsCredentials> credentials,
+            byte[] schema) : this(credentials, null, schema, false, null, null, false)
+        {
+        }
+
+        public CryptOptions(
+            IEnumerable<KmsCredentials> credentials,
+            byte[] encryptedFieldsMap,
+            byte[] schema,
+            bool bypassQueryAnalysis,
+            string cryptSharedLibPath,
+            string cryptSharedLibSearchPath,
+            bool isCryptSharedLibRequired)
+        {
+            BypassQueryAnalysis = bypassQueryAnalysis;
+            CryptSharedLibPath = cryptSharedLibPath;
+            CryptSharedLibSearchPath = cryptSharedLibSearchPath;
+            IsCryptSharedLibRequired = isCryptSharedLibRequired;
+            EncryptedFieldsMap = encryptedFieldsMap;
+            KmsCredentials = new ReadOnlyCollection<KmsCredentials>((credentials ?? throw new ArgumentNullException(nameof(credentials))).ToList());
+            Schema = schema;
+        }
+
+        // TODO: - add configurable logging support
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/HashCallback.cs

@@ -0,0 +1,59 @@
+/*
+ * Copyright 2020–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+using System.Security.Cryptography;
+
+namespace MongoDB.Libmongocrypt
+{
+    internal static class HashCallback
+    {
+        public static bool Hash(
+            IntPtr ctx,
+            IntPtr @in,
+            IntPtr @out,
+            IntPtr statusPtr)
+        {
+            using (var status = new Status(StatusSafeHandle.FromIntPtr(statusPtr)))
+            {
+                try
+                {
+                    var inputBinary = new Binary(BinarySafeHandle.FromIntPtr(@in));
+                    var outBinary = new Binary(BinarySafeHandle.FromIntPtr(@out));
+
+                    var outBytes = CalculateHash(inputBinary.ToArray());
+                    outBinary.WriteBytes(outBytes);
+                    return true;
+                }
+                catch (Exception ex)
+                {
+                    status.SetStatus(1, ex.Message);
+                    return false;
+                }
+            }
+        }
+
+        public static byte[] CalculateHash(byte[] inputBytes)
+        {
+            using (var sha256 = SHA256.Create())
+            {
+                sha256.Initialize();
+                _ = sha256.TransformFinalBlock(inputBytes, 0, inputBytes.Length);
+                return sha256.Hash;
+            }
+        }
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/HmacShaCallbacks.cs

@@ -0,0 +1,96 @@
+/*
+ * Copyright 2020–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+using System.Security.Cryptography;
+
+namespace MongoDB.Libmongocrypt
+{
+    internal static class HmacShaCallbacks
+    {
+        public static bool HmacSha512(
+            IntPtr ctx,
+            IntPtr key,
+            IntPtr @in,
+            IntPtr @out,
+            IntPtr statusPtr)
+        {
+            return Hmac(key, @in, @out, statusPtr, bitness: 512);
+        }
+
+        public static bool HmacSha256(
+           IntPtr ctx,
+           IntPtr key,
+           IntPtr @in,
+           IntPtr @out,
+           IntPtr statusPtr)
+        {
+            return Hmac(key, @in, @out, statusPtr, bitness: 256);
+        }
+
+        public static byte[] CalculateHash(byte[] keyBytes, byte[] inputBytes, int bitness)
+        {
+            using (var hmac = GetHmacByBitness(bitness, keyBytes))
+            {
+                hmac.Initialize();
+                _ = hmac.TransformFinalBlock(inputBytes, 0, inputBytes.Length);
+                return hmac.Hash;
+            }
+        }
+
+        private static HMAC GetHmacByBitness(int bitness, byte[] keyBytes)
+        {
+            switch (bitness)
+            {
+                case 256: return new HMACSHA256(keyBytes);
+                case 512: return new HMACSHA512(keyBytes);
+                default: throw new ArgumentOutOfRangeException($"The bitness {bitness} is unsupported."); // should not be reached
+            }
+        }
+
+        private static bool Hmac(
+            IntPtr key,
+            IntPtr @in,
+            IntPtr @out,
+            IntPtr statusPtr,
+            int bitness)
+        {
+            using (var status = new Status(StatusSafeHandle.FromIntPtr(statusPtr)))
+            {
+                try
+                {
+                    var keyBinary = new Binary(BinarySafeHandle.FromIntPtr(key));
+                    var inBinary = new Binary(BinarySafeHandle.FromIntPtr(@in));
+                    var outBinary = new Binary(BinarySafeHandle.FromIntPtr(@out));
+
+                    var keyBytes = keyBinary.ToArray();
+                    var inBytes = inBinary.ToArray();
+
+                    var outBytes = CalculateHash(keyBytes, inBytes, bitness: bitness);
+                    outBinary.WriteBytes(outBytes);
+
+                    return true;
+                }
+                catch (Exception ex)
+                {
+                    // let mongocrypt level to handle the error
+                    status.SetStatus(1, ex.Message);
+                    return false;
+                }
+            }
+        }
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/IStatus.cs

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2019–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+namespace MongoDB.Libmongocrypt
+{
+    /// <summary>
+    /// Interface for checking the status of the various libmongocrypt options.
+    /// </summary>
+    internal interface IStatus
+    {
+        void Check(Status status);
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/KmsCredentials.cs

@@ -0,0 +1,53 @@
+/*
+ * Copyright 2020–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System;
+
+namespace MongoDB.Libmongocrypt
+{
+    /// <summary>
+    /// KMS Credentials.
+    /// </summary>
+    public class KmsCredentials
+    {
+        private readonly byte[] _credentialsBytes;
+
+        /// <summary>
+        /// Creates a <see cref="KmsCredentials"/> class.
+        /// </summary>
+        /// <param name="credentialsBytes">The byte representation of credentials bson document.</param>
+        public KmsCredentials(byte[] credentialsBytes)
+        {
+            _credentialsBytes = credentialsBytes ?? throw new ArgumentNullException(nameof(credentialsBytes));
+        }
+
+        // internal methods
+        internal void SetCredentials(MongoCryptSafeHandle handle, Status status)
+        {
+            unsafe
+            {
+                fixed (byte* p = _credentialsBytes)
+                {
+                    IntPtr ptr = (IntPtr)p;
+                    using (PinnedBinary pinned = new PinnedBinary(ptr, (uint)_credentialsBytes.Length))
+                    {
+                        handle.Check(status, Library.mongocrypt_setopt_kms_providers(handle, pinned.Handle));
+                    }
+                }
+            }
+        }
+    }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/KmsKeyId.cs

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2020–present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+using System.Collections.Generic;
+using System.Linq;
+
+namespace MongoDB.Libmongocrypt
+{
+    /// <summary>
+    /// Represent a kms key.
+    /// </summary>
+    public class KmsKeyId
+    {
+        private readonly IReadOnlyList<byte[]> _alternateKeyNameBytes;
+        private readonly byte[] _dataKeyOptionsBytes;
+        private readonly byte[] _keyMaterialBytes;
+
+        /// <summary>
+        /// Creates an <see cref="KmsKeyId"/> class.
+        /// </summary>
+        /// <param name="dataKeyOptionsBytes">The byte representation of dataOptions bson document.</param>
+        /// <param name="alternateKeyNameBytes">The byte representation of alternate keyName.</param>
+        public KmsKeyId(
+            byte[] dataKeyOptionsBytes,
+            IEnumerable<byte[]> alternateKeyNameBytes = null,
+            byte[] keyMaterialBytes = null)
+        {
+            _dataKeyOptionsBytes = dataKeyOptionsBytes;
+            _alternateKeyNameBytes = (alternateKeyNameBytes ?? Enumerable.Empty<byte[]>()).ToList().AsReadOnly();
+            _keyMaterialBytes = keyMaterialBytes;
+        }
+
+        /// <summary>
+        /// Alternate key name bytes. 
+        /// </summary>
+        public IReadOnlyList<byte[]> AlternateKeyNameBytes => _alternateKeyNameBytes;
+
+        /// <summary>
+        /// Data key options bytes. 
+        /// </summary>
+        public byte[] DataKeyOptionsBytes => _dataKeyOptionsBytes;
+
+        /// <summary>
+        /// Key material bytes. 
+        /// </summary>
+        public byte[] KeyMaterialBytes => _keyMaterialBytes;
+
+        // internal methods
+        internal void SetCredentials(ContextSafeHandle context, Status status)
+        {
+            if (_dataKeyOptionsBytes != null)
+            {
+                PinnedBinary.RunAsPinnedBinary(context, _dataKeyOptionsBytes, status, (h, pb) => Library.mongocrypt_ctx_setopt_key_encryption_key(h, pb));
+            }
+
+            SetAlternateKeyNamesIfConfigured(context, status);
+
+            SetKeyMaterialIfConfigured(context, status);
+        }
+
+        // private methods
+        private void SetAlternateKeyNamesIfConfigured(ContextSafeHandle context, Status status)
+        {
+            foreach (var alternateKeyNameBytes in _alternateKeyNameBytes)
+            {
+                PinnedBinary.RunAsPinnedBinary(context, alternateKeyNameBytes, status, (h, pb) => Library.mongocrypt_ctx_setopt_key_alt_name(h, pb));
+            }
+        }
+
+        private void SetKeyMaterialIfConfigured(ContextSafeHandle context, Status status)
+        {
+            if (_keyMaterialBytes != null)
+            {
+                PinnedBinary.RunAsPinnedBinary(context, _keyMaterialBytes, status, (h, pb) => Library.mongocrypt_ctx_setopt_key_material(h, pb));
+            }
+        }
+    }
+}