libmongocrypt-helper 1.7.4.0.1002 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-cache-oauth.c

@@ -16,6 +16,7 @@
 
 #include "mongocrypt-cache-oauth-private.h"
 
+#include "mc-array-private.h"
 #include "mongocrypt-private.h"
 
 /* How long before the reported "expires_in" time cache entries get evicted.
@@ -24,103 +25,119 @@
  */
 #define MONGOCRYPT_OAUTH_CACHE_EVICTION_PERIOD_US 5000 * 1000
 
-_mongocrypt_cache_oauth_t *
-_mongocrypt_cache_oauth_new (void)
-{
-   _mongocrypt_cache_oauth_t *cache;
-
-   cache = bson_malloc0 (sizeof (_mongocrypt_cache_oauth_t));
-   _mongocrypt_mutex_init (&cache->mutex);
-   return cache;
+typedef struct {
+    char *kmsid;
+    char *access_token;
+    int64_t expiration_time_us;
+} mc_mapof_kmsid_to_token_entry_t;
+
+struct _mc_mapof_kmsid_to_token_t {
+    mc_array_t entries;
+    mongocrypt_mutex_t mutex; // Guards `entries`.
+};
+
+mc_mapof_kmsid_to_token_t *mc_mapof_kmsid_to_token_new(void) {
+    mc_mapof_kmsid_to_token_t *k2t = bson_malloc0(sizeof(mc_mapof_kmsid_to_token_t));
+    _mc_array_init(&k2t->entries, sizeof(mc_mapof_kmsid_to_token_entry_t));
+    _mongocrypt_mutex_init(&k2t->mutex);
+    return k2t;
 }
 
-void
-_mongocrypt_cache_oauth_destroy (_mongocrypt_cache_oauth_t *cache)
-{
-   BSON_ASSERT_PARAM (cache);
-
-   _mongocrypt_mutex_cleanup (&cache->mutex);
-   bson_destroy (cache->entry);
-   bson_free (cache->access_token);
-   bson_free (cache);
+void mc_mapof_kmsid_to_token_destroy(mc_mapof_kmsid_to_token_t *k2t) {
+    if (!k2t) {
+        return;
+    }
+    _mongocrypt_mutex_cleanup(&k2t->mutex);
+    for (size_t i = 0; i < k2t->entries.len; i++) {
+        mc_mapof_kmsid_to_token_entry_t k2te = _mc_array_index(&k2t->entries, mc_mapof_kmsid_to_token_entry_t, i);
+        bson_free(k2te.kmsid);
+        bson_free(k2te.access_token);
+    }
+    _mc_array_destroy(&k2t->entries);
+    bson_free(k2t);
 }
 
-bool
-_mongocrypt_cache_oauth_add (_mongocrypt_cache_oauth_t *cache,
-                             bson_t *oauth_response,
-                             mongocrypt_status_t *status)
-{
-   bson_iter_t iter;
-   int64_t expiration_time_us;
-   int64_t cache_time_us;
-   int64_t expires_in_s;
-   int64_t expires_in_us;
-   const char *access_token;
-
-   BSON_ASSERT_PARAM (cache);
-   BSON_ASSERT_PARAM (oauth_response);
-
-   /* The OAuth spec strongly implies that the value of expires_in is positive,
-    * so the overflow checks in this function don't consider negative values. */
-   if (!bson_iter_init_find (&iter, oauth_response, "expires_in") ||
-       !BSON_ITER_HOLDS_INT (&iter)) {
-      CLIENT_ERR ("OAuth response invalid, no 'expires_in' field.");
-      return false;
-   }
-   cache_time_us = bson_get_monotonic_time ();
-   expires_in_s = bson_iter_as_int64 (&iter);
-   BSON_ASSERT (expires_in_s <= INT64_MAX / 1000 / 1000);
-   expires_in_us = expires_in_s * 1000 * 1000;
-   BSON_ASSERT (expires_in_us <= INT64_MAX - cache_time_us &&
-                expires_in_us + cache_time_us >
-                   MONGOCRYPT_OAUTH_CACHE_EVICTION_PERIOD_US);
-   expiration_time_us =
-      expires_in_us + cache_time_us - MONGOCRYPT_OAUTH_CACHE_EVICTION_PERIOD_US;
-
-   if (!bson_iter_init_find (&iter, oauth_response, "access_token") ||
-       !BSON_ITER_HOLDS_UTF8 (&iter)) {
-      CLIENT_ERR ("OAuth response invalid, no 'access_token' field.");
-      return false;
-   }
-   access_token = bson_iter_utf8 (&iter, NULL);
-
-   _mongocrypt_mutex_lock (&cache->mutex);
-   if (expiration_time_us > cache->expiration_time_us) {
-      bson_destroy (cache->entry);
-      cache->entry = bson_copy (oauth_response);
-      cache->expiration_time_us = expiration_time_us;
-      bson_free (cache->access_token);
-      cache->access_token = bson_strdup (access_token);
-   }
-   _mongocrypt_mutex_unlock (&cache->mutex);
-   return true;
+char *mc_mapof_kmsid_to_token_get_token(mc_mapof_kmsid_to_token_t *k2t, const char *kmsid) {
+    BSON_ASSERT_PARAM(k2t);
+    BSON_ASSERT_PARAM(kmsid);
+
+    _mongocrypt_mutex_lock(&k2t->mutex);
+
+    for (size_t i = 0; i < k2t->entries.len; i++) {
+        mc_mapof_kmsid_to_token_entry_t k2te = _mc_array_index(&k2t->entries, mc_mapof_kmsid_to_token_entry_t, i);
+        if (0 == strcmp(k2te.kmsid, kmsid)) {
+            if (bson_get_monotonic_time() >= k2te.expiration_time_us) {
+                // Expired.
+                _mongocrypt_mutex_unlock(&k2t->mutex);
+                return NULL;
+            }
+            char *access_token = bson_strdup(k2te.access_token);
+            _mongocrypt_mutex_unlock(&k2t->mutex);
+            return access_token;
+        }
+    }
+
+    _mongocrypt_mutex_unlock(&k2t->mutex);
+    return NULL;
 }
 
-/* Returns a copy of the base64 encoded oauth token, or NULL if nothing is
- * cached. */
-char *
-_mongocrypt_cache_oauth_get (_mongocrypt_cache_oauth_t *cache)
-{
-   char *access_token;
-
-   BSON_ASSERT_PARAM (cache);
-
-   _mongocrypt_mutex_lock (&cache->mutex);
-   if (!cache->entry) {
-      _mongocrypt_mutex_unlock (&cache->mutex);
-      return NULL;
-   }
-
-   if (bson_get_monotonic_time () >= cache->expiration_time_us) {
-      bson_destroy (cache->entry);
-      cache->entry = NULL;
-      cache->expiration_time_us = 0;
-      _mongocrypt_mutex_unlock (&cache->mutex);
-      return NULL;
-   }
-
-   access_token = bson_strdup (cache->access_token);
-   _mongocrypt_mutex_unlock (&cache->mutex);
-
-   return access_token;
+bool mc_mapof_kmsid_to_token_add_response(mc_mapof_kmsid_to_token_t *k2t,
+                                          const char *kmsid,
+                                          bson_t *response,
+                                          mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(k2t);
+    BSON_ASSERT_PARAM(kmsid);
+    BSON_ASSERT_PARAM(response);
+
+    // Parse access token before locking.
+    const char *access_token;
+    int64_t expiration_time_us;
+    {
+        bson_iter_t iter;
+        int64_t cache_time_us;
+        int64_t expires_in_s;
+        int64_t expires_in_us;
+
+        /* The OAuth spec strongly implies that the value of expires_in is positive,
+         * so the overflow checks in this function don't consider negative values. */
+        if (!bson_iter_init_find(&iter, response, "expires_in") || !BSON_ITER_HOLDS_INT(&iter)) {
+            CLIENT_ERR("OAuth response invalid, no 'expires_in' field.");
+            return false;
+        }
+        cache_time_us = bson_get_monotonic_time();
+        expires_in_s = bson_iter_as_int64(&iter);
+        BSON_ASSERT(expires_in_s <= INT64_MAX / 1000 / 1000);
+        expires_in_us = expires_in_s * 1000 * 1000;
+        BSON_ASSERT(expires_in_us <= INT64_MAX - cache_time_us
+                    && expires_in_us + cache_time_us > MONGOCRYPT_OAUTH_CACHE_EVICTION_PERIOD_US);
+        expiration_time_us = expires_in_us + cache_time_us - MONGOCRYPT_OAUTH_CACHE_EVICTION_PERIOD_US;
+
+        if (!bson_iter_init_find(&iter, response, "access_token") || !BSON_ITER_HOLDS_UTF8(&iter)) {
+            CLIENT_ERR("OAuth response invalid, no 'access_token' field.");
+            return false;
+        }
+        access_token = bson_iter_utf8(&iter, NULL);
+    }
+
+    _mongocrypt_mutex_lock(&k2t->mutex);
+
+    // Check if there is an existing entry.
+    for (size_t i = 0; i < k2t->entries.len; i++) {
+        mc_mapof_kmsid_to_token_entry_t *k2te = &_mc_array_index(&k2t->entries, mc_mapof_kmsid_to_token_entry_t, i);
+        if (0 == strcmp(k2te->kmsid, kmsid)) {
+            // Update entry.
+            bson_free(k2te->access_token);
+            k2te->access_token = bson_strdup(access_token);
+            k2te->expiration_time_us = expiration_time_us;
+            _mongocrypt_mutex_unlock(&k2t->mutex);
+            return true;
+        }
+    }
+    // Create an entry.
+    mc_mapof_kmsid_to_token_entry_t to_put = {.kmsid = bson_strdup(kmsid),
+                                              .access_token = bson_strdup(access_token),
+                                              .expiration_time_us = expiration_time_us};
+    _mc_array_append_val(&k2t->entries, to_put);
+    _mongocrypt_mutex_unlock(&k2t->mutex);
+    return true;
 }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-cache-private.h

@@ -27,70 +27,51 @@
  * "attribute-value" pairs.
  * https://en.wikipedia.org/wiki/Attribute%E2%80%93value_pair
  */
-typedef bool (*cache_compare_fn) (void *thing_a, void *thing_b, int *out);
-typedef void (*cache_destroy_fn) (void *thing);
-typedef void *(*cache_copy_fn) (void *thing);
-typedef void (*cache_dump_fn) (void *thing);
+typedef bool (*cache_compare_fn)(void *thing_a, void *thing_b, int *out);
+typedef void (*cache_destroy_fn)(void *thing);
+typedef void *(*cache_copy_fn)(void *thing);
+typedef void (*cache_dump_fn)(void *thing);
 
 typedef struct __mongocrypt_cache_pair_t {
-   void *attr;
-   void *value;
-   struct __mongocrypt_cache_pair_t *next;
-   int64_t last_updated;
+    void *attr;
+    void *value;
+    struct __mongocrypt_cache_pair_t *next;
+    int64_t last_updated;
 } _mongocrypt_cache_pair_t;
 
 typedef struct {
-   cache_dump_fn dump_attr;
-   cache_compare_fn cmp_attr;
-   cache_copy_fn copy_attr;
-   cache_destroy_fn destroy_attr;
-   cache_copy_fn copy_value;
-   cache_destroy_fn destroy_value;
-   _mongocrypt_cache_pair_t *pair;
-   mongocrypt_mutex_t mutex; /* global lock of cache. */
-   uint64_t expiration;
+    cache_dump_fn dump_attr;
+    cache_compare_fn cmp_attr;
+    cache_copy_fn copy_attr;
+    cache_destroy_fn destroy_attr;
+    cache_copy_fn copy_value;
+    cache_destroy_fn destroy_value;
+    _mongocrypt_cache_pair_t *pair;
+    mongocrypt_mutex_t mutex; /* global lock of cache. */
+    uint64_t expiration;
 } _mongocrypt_cache_t;
 
-
 /* Attempt to get an entry.
  * Returns boolean indicating success.
  */
-bool
-_mongocrypt_cache_get (_mongocrypt_cache_t *cache,
-                       void *attr,
-                       void **value) MONGOCRYPT_WARN_UNUSED_RESULT;
-
-bool
-_mongocrypt_cache_add_copy (_mongocrypt_cache_t *cache,
-                            void *attr,
-                            void *value,
-                            mongocrypt_status_t *status)
-   MONGOCRYPT_WARN_UNUSED_RESULT;
+bool _mongocrypt_cache_get(_mongocrypt_cache_t *cache, void *attr, void **value) MONGOCRYPT_WARN_UNUSED_RESULT;
 
+bool _mongocrypt_cache_add_copy(_mongocrypt_cache_t *cache, void *attr, void *value, mongocrypt_status_t *status)
+    MONGOCRYPT_WARN_UNUSED_RESULT;
 
 /* Steals the value instead of copying. Caller relinquishes value when calling.
  */
-bool
-_mongocrypt_cache_add_stolen (_mongocrypt_cache_t *cache,
-                              void *attr,
-                              void *value,
-                              mongocrypt_status_t *status)
-   MONGOCRYPT_WARN_UNUSED_RESULT;
+bool _mongocrypt_cache_add_stolen(_mongocrypt_cache_t *cache, void *attr, void *value, mongocrypt_status_t *status)
+    MONGOCRYPT_WARN_UNUSED_RESULT;
 
-
-void
-_mongocrypt_cache_cleanup (_mongocrypt_cache_t *cache);
+void _mongocrypt_cache_cleanup(_mongocrypt_cache_t *cache);
 
 /* A helper debug function to dump the state of the cache. */
-void
-_mongocrypt_cache_dump (_mongocrypt_cache_t *cache);
+void _mongocrypt_cache_dump(_mongocrypt_cache_t *cache);
 
 /* Tests may override the default expiration */
-void
-_mongocrypt_cache_set_expiration (_mongocrypt_cache_t *cache, uint64_t milli);
-
-uint32_t
-_mongocrypt_cache_num_entries (_mongocrypt_cache_t *cache);
+void _mongocrypt_cache_set_expiration(_mongocrypt_cache_t *cache, uint64_t milli);
 
+uint32_t _mongocrypt_cache_num_entries(_mongocrypt_cache_t *cache);
 
 #endif /* MONGOCRYPT_CACHE_PRIVATE */