libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/src/mc-dec128.test.cpp

@@ -0,0 +1,86 @@
+#include <mc-dec128.h>
+
+#include <cstdio>
+
+#if MONGOCRYPT_HAVE_DECIMAL128_SUPPORT
+
+#include <stdlib.h>
+
+#include <mlib/check.hpp>
+#define CHECK MLIB_CHECK
+
+inline std::ostream &
+operator<< (std::ostream &out, mc_dec128 d) noexcept
+{
+   auto s = mc_dec128_to_new_decimal_string (d);
+   out << s;
+   free (s);
+   return out;
+}
+
+#define OPER(Op, Fn)                                                \
+   inline auto operator Op (mc_dec128 a, mc_dec128 b) noexcept /**/ \
+      ->decltype (mc_dec128_##Fn (a, b))                            \
+   {                                                                \
+      return mc_dec128_##Fn (a, b);                                 \
+   }
+
+OPER (+, add)
+OPER (-, sub)
+OPER (*, mul)
+OPER (/, div)
+OPER (==, equal)
+OPER (>, greater)
+OPER (<, less)
+
+int
+main ()
+{
+   mc_dec128 a = MC_DEC128_ZERO;
+   CHECK (mc_dec128_is_zero (a));
+
+   mc_dec128 b = MC_DEC128_ZERO;
+   mc_dec128 c = a * b;
+   CHECK (c == MC_DEC128_ZERO);
+   CHECK (mc_dec128_is_zero (c));
+
+   b = MC_DEC128_C (1);
+   // 0 + 1 = 1
+   c = a + b;
+   CHECK (c == MC_DEC128_C (1));
+
+   // 1 + 1 = 2
+   c = b + b;
+   CHECK (c == MC_DEC128_C (2));
+
+   // 2 * 2 = 4
+   c = c * c;
+   CHECK (c == MC_DEC128_C (4));
+
+   // (4 + 1) / 2 = 2.5
+   c = (c + MC_DEC128_C (1)) / MC_DEC128_C (2);
+   CHECK (c == mc_dec128_from_string ("2.5"));
+
+   mc_dec128_string s = mc_dec128_to_string (c);
+   CHECK (std::string (s.str) == "+25E-1");
+
+   char *str = mc_dec128_to_new_decimal_string (c);
+   CHECK (std::string (str) == "2.5");
+   free (str);
+
+   mc_dec128 infin = MC_DEC128_POSITIVE_INFINITY;
+   CHECK (mc_dec128_is_inf (infin));
+
+   mc_dec128 nan = MC_DEC128_POSITIVE_NAN;
+   CHECK (mc_dec128_is_nan (nan));
+}
+
+#else
+
+int
+main ()
+{
+   std::puts ("@@ctest-skip@@\n Decimal128 support is not enabled\n");
+}
+
+#endif

data/ext/libmongocrypt/libmongocrypt/src/mc-efc-private.h

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef MC_EFC_PRIVATE_H
+#define MC_EFC_PRIVATE_H
+
+#include "mongocrypt-buffer-private.h"
+#include <bson/bson.h>
+
+typedef struct _mc_EncryptedField_t {
+   bool has_queries;
+   _mongocrypt_buffer_t keyId;
+   const char *path;
+   struct _mc_EncryptedField_t *next;
+} mc_EncryptedField_t;
+
+/* See
+ * https://github.com/mongodb/mongo/blob/591f49a64e96cea68bf3501320de31c51c31f412/src/mongo/crypto/encryption_fields.idl#L48-L112
+ * for the server IDL definition of EncryptedFieldConfig. */
+typedef struct {
+   mc_EncryptedField_t *fields;
+} mc_EncryptedFieldConfig_t;
+
+/* mc_EncryptedFieldConfig_parse parses a subset of the fields from @efc_bson
+ * into @efc. Fields are copied from @efc_bson. It is OK to free efc_bson after
+ * this call. Fields are appended in reverse order to @efc->fields. Extra
+ * unrecognized fields are not considered an error for forward compatibility. */
+bool
+mc_EncryptedFieldConfig_parse (mc_EncryptedFieldConfig_t *efc,
+                               const bson_t *efc_bson,
+                               mongocrypt_status_t *status);
+
+void
+mc_EncryptedFieldConfig_cleanup (mc_EncryptedFieldConfig_t *efc);
+
+#endif /* MC_EFC_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-efc.c

@@ -0,0 +1,127 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+#include "mc-efc-private.h"
+
+#include "mongocrypt-private.h"
+#include "mongocrypt-util-private.h" // mc_iter_document_as_bson
+
+/* _parse_field parses and prepends one field document to efc->fields. */
+static bool
+_parse_field (mc_EncryptedFieldConfig_t *efc,
+              bson_t *field,
+              mongocrypt_status_t *status)
+{
+   bool has_queries = false;
+   bson_iter_t field_iter;
+
+   BSON_ASSERT_PARAM (efc);
+   BSON_ASSERT_PARAM (field);
+
+   if (!bson_iter_init_find (&field_iter, field, "keyId")) {
+      CLIENT_ERR ("unable to find 'keyId' in 'field' document");
+      return false;
+   }
+   if (!BSON_ITER_HOLDS_BINARY (&field_iter)) {
+      CLIENT_ERR ("expected 'fields.keyId' to be type binary, got: %d",
+                  bson_iter_type (&field_iter));
+      return false;
+   }
+   _mongocrypt_buffer_t field_keyid;
+   if (!_mongocrypt_buffer_from_uuid_iter (&field_keyid, &field_iter)) {
+      CLIENT_ERR ("unable to parse uuid key from 'fields.keyId'");
+      return false;
+   }
+
+   const char *field_path;
+   if (!bson_iter_init_find (&field_iter, field, "path")) {
+      CLIENT_ERR ("unable to find 'path' in 'field' document");
+      return false;
+   }
+   if (!BSON_ITER_HOLDS_UTF8 (&field_iter)) {
+      CLIENT_ERR ("expected 'fields.path' to be type UTF-8, got: %d",
+                  bson_iter_type (&field_iter));
+      return false;
+   }
+   field_path = bson_iter_utf8 (&field_iter, NULL /* length */);
+
+   if (bson_iter_init_find (&field_iter, field, "queries")) {
+      has_queries = true;
+   }
+
+   /* Prepend a new mc_EncryptedField_t */
+   mc_EncryptedField_t *ef = bson_malloc0 (sizeof (mc_EncryptedField_t));
+   _mongocrypt_buffer_copy_to (&field_keyid, &ef->keyId);
+   ef->path = bson_strdup (field_path);
+   ef->next = efc->fields;
+   ef->has_queries = has_queries;
+   efc->fields = ef;
+
+   return true;
+}
+
+bool
+mc_EncryptedFieldConfig_parse (mc_EncryptedFieldConfig_t *efc,
+                               const bson_t *efc_bson,
+                               mongocrypt_status_t *status)
+{
+   bson_iter_t iter;
+
+   BSON_ASSERT_PARAM (efc);
+   BSON_ASSERT_PARAM (efc_bson);
+
+   memset (efc, 0, sizeof (*efc));
+   if (!bson_iter_init_find (&iter, efc_bson, "fields")) {
+      CLIENT_ERR ("unable to find 'fields' in encrypted_field_config");
+      return false;
+   }
+   if (!BSON_ITER_HOLDS_ARRAY (&iter)) {
+      CLIENT_ERR ("expected 'fields' to be type array, got: %d",
+                  bson_iter_type (&iter));
+      return false;
+   }
+   if (!bson_iter_recurse (&iter, &iter)) {
+      CLIENT_ERR ("unable to recurse into encrypted_field_config 'fields'");
+      return false;
+   }
+   while (bson_iter_next (&iter)) {
+      bson_t field;
+      if (!mc_iter_document_as_bson (&iter, &field, status)) {
+         return false;
+      }
+      if (!_parse_field (efc, &field, status)) {
+         return false;
+      }
+   }
+   return true;
+}
+
+void
+mc_EncryptedFieldConfig_cleanup (mc_EncryptedFieldConfig_t *efc)
+{
+   if (!efc) {
+      return;
+   }
+   mc_EncryptedField_t *ptr = efc->fields;
+   while (ptr != NULL) {
+      mc_EncryptedField_t *ptr_next = ptr->next;
+      _mongocrypt_buffer_cleanup (&ptr->keyId);
+      bson_free ((char *) ptr->path);
+      bson_free (ptr);
+      ptr = ptr_next;
+   }
+}

data/ext/libmongocrypt/libmongocrypt/src/mc-fle-blob-subtype-private.h

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MC_FLE_BLOB_SUBTYPE_PRIVATE_H
+#define MC_FLE_BLOB_SUBTYPE_PRIVATE_H
+
+/* FLE Blob Subtype is the first byte of a BSON Binary Subtype 6.
+ * FLE1 Blob Subtypes are defined in:
+ * https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/subtype6.rst
+ * FLE2 Blob Subtypes are currently defined in:
+ * https://github.com/markbenvenuto/mongo-enterprise-modules/blob/fle2/fle_protocol.md#reference-bindata-6-subtypes.
+ */
+
+typedef enum {
+   MC_SUBTYPE_FLE1EncryptionPlaceholder = 0,
+   MC_SUBTYPE_FLE1DeterministicEncryptedValue = 1,
+   MC_SUBTYPE_FLE1RandomEncryptedValue = 2,
+   MC_SUBTYPE_FLE2EncryptionPlaceholder = 3,
+   MC_SUBTYPE_FLE2InsertUpdatePayload = 4,
+   MC_SUBTYPE_FLE2FindEqualityPayload = 5,
+   MC_SUBTYPE_FLE2UnindexedEncryptedValue = 6,
+   MC_SUBTYPE_FLE2IndexedEqualityEncryptedValue = 7,
+   MC_SUBTYPE_FLE2IndexedRangeEncryptedValue = 9,
+   MC_SUBTYPE_FLE2FindRangePayload = 10
+} mc_fle_blob_subtype_t;
+
+#endif /* MC_FLE_BLOB_SUBTYPE_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-encryption-placeholder-private.h

@@ -0,0 +1,152 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MC_FLE2_ENCRYPTION_PLACEHOLDER_PRIVATE_H
+#define MC_FLE2_ENCRYPTION_PLACEHOLDER_PRIVATE_H
+
+#include <bson/bson.h>
+
+#include "mongocrypt.h"
+#include "mongocrypt-private.h"
+#include "mc-fle2-find-range-payload-private.h"
+#include "mc-optional-private.h"
+
+/** FLE2RangeFindSpecEdgesInfo represents the information needed to generate
+ * edges for a range find query. It is encoded inside an FLE2RangeFindSpec. See
+ * https://github.com/mongodb/mongo/blob/master/src/mongo/crypto/fle_field_schema.idl
+ * for the representation in the MongoDB server.
+ *
+ * Bounds on range queries are referred to as lowerBound or lb, and upperBound
+ * or ub. Bounds on an underlying range index are referred to as min and max.
+ */
+typedef struct {
+   // lowerBound is the lower bound for an encrypted range query.
+   bson_iter_t lowerBound;
+   // lbIncluded indicates if the lower bound should be included in the range.
+   bool lbIncluded;
+   // upperBound is the upperBound for an encrypted range query.
+   bson_iter_t upperBound;
+   // ubIncluded indicates if the upper bound should be included in the range.
+   bool ubIncluded;
+   // indexMin is the minimum value for the encrypted index that this query is
+   // using.
+   bson_iter_t indexMin;
+   // indexMax is the maximum value for the encrypted index that this query is
+   // using.
+   bson_iter_t indexMax;
+   // precision determines the number of digits after the decimal point for
+   // floating point values.
+   mc_optional_uint32_t precision;
+} mc_FLE2RangeFindSpecEdgesInfo_t;
+
+/** FLE2RangeFindSpec represents the range find specification that is encoded
+ * inside of a FLE2EncryptionPlaceholder. See
+ * https://github.com/mongodb/mongo/blob/master/src/mongo/crypto/fle_field_schema.idl
+ * for the representation in the MongoDB server.
+ */
+typedef struct {
+   // edgesInfo is the information about the edges in an FLE2 find payload.
+   struct {
+      mc_FLE2RangeFindSpecEdgesInfo_t value;
+      bool set;
+   } edgesInfo;
+   // payloadId Id of payload - must be paired with another payload.
+   int32_t payloadId;
+   // firstOperator represents the first query operator for which this payload
+   // was generated.
+   mc_FLE2RangeOperator_t firstOperator;
+   // secondOperator represents the second query operator for which this payload
+   // was generated. Only populated for two-sided ranges. It is 0 if unset.
+   mc_FLE2RangeOperator_t secondOperator;
+} mc_FLE2RangeFindSpec_t;
+
+bool
+mc_FLE2RangeFindSpec_parse (mc_FLE2RangeFindSpec_t *out,
+                            const bson_iter_t *in,
+                            mongocrypt_status_t *status);
+
+/** mc_FLE2RangeInsertSpec_t represents the range insert specification that is
+ * encoded inside of a FLE2EncryptionPlaceholder. See
+ * https://github.com/mongodb/mongo/blob/master/src/mongo/crypto/fle_field_schema.idl#L364
+ * for the representation in the MongoDB server. */
+typedef struct {
+   // v is the value to encrypt.
+   bson_iter_t v;
+   // min is the Queryable Encryption min bound for range.
+   bson_iter_t min;
+   // max is the Queryable Encryption max bound for range.
+   bson_iter_t max;
+   // precision determines the number of digits after the decimal point for
+   // floating point values.
+   mc_optional_uint32_t precision;
+} mc_FLE2RangeInsertSpec_t;
+
+bool
+mc_FLE2RangeInsertSpec_parse (mc_FLE2RangeInsertSpec_t *out,
+                              const bson_iter_t *in,
+                              mongocrypt_status_t *status);
+
+/** FLE2EncryptionPlaceholder implements Encryption BinData (subtype 6)
+ * sub-subtype 0, the intent-to-encrypt mapping. Contains a value to encrypt and
+ * a description of how it should be encrypted.
+ *
+ * For automatic encryption, FLE2EncryptionPlaceholder is created by query
+ * analysis (mongocryptd or mongo_crypt shared library). For explicit
+ * encryption, FLE2EncryptionPlaceholder is created by libmongocrypt.
+ *
+ * FLE2EncryptionPlaceholder is processed by libmongocrypt into a payload
+ * suitable to send to the MongoDB server (mongod/mongos).
+ *
+ * See
+ * https://github.com/mongodb/mongo/blob/d870dda33fb75983f628636ff8f849c7f1c90b09/src/mongo/crypto/fle_field_schema.idl#L133
+ * for the representation in the MongoDB server.
+ */
+
+typedef struct {
+   mongocrypt_fle2_placeholder_type_t type;
+   mongocrypt_fle2_encryption_algorithm_t algorithm;
+   bson_iter_t v_iter;
+   _mongocrypt_buffer_t index_key_id;
+   _mongocrypt_buffer_t user_key_id;
+   int64_t maxContentionCounter;
+   // sparsity is the Queryable Encryption range hypergraph sparsity factor
+   int64_t sparsity;
+} mc_FLE2EncryptionPlaceholder_t;
+
+void
+mc_FLE2EncryptionPlaceholder_init (mc_FLE2EncryptionPlaceholder_t *placeholder);
+
+bool
+mc_FLE2EncryptionPlaceholder_parse (mc_FLE2EncryptionPlaceholder_t *out,
+                                    const bson_t *in,
+                                    mongocrypt_status_t *status);
+
+void
+mc_FLE2EncryptionPlaceholder_cleanup (
+   mc_FLE2EncryptionPlaceholder_t *placeholder);
+
+/* mc_validate_contention is used to check that contention is a valid
+ * value. contention may come from the 'cm' field in FLE2EncryptionPlaceholder
+ * or from mongocrypt_ctx_setopt_contention_factor. */
+bool
+mc_validate_contention (int64_t contention, mongocrypt_status_t *status);
+
+/* mc_validate_sparsity is used to check that sparsity is a valid
+ * value. */
+bool
+mc_validate_sparsity (int64_t sparsity, mongocrypt_status_t *status);
+
+#endif /* MC_FLE2_ENCRYPTION_PLACEHOLDER_PRIVATE_H */