diff options
Diffstat (limited to 'src/mongo/shell')
-rw-r--r-- | src/mongo/shell/kms.idl | 6 | ||||
-rw-r--r-- | src/mongo/shell/kms_aws.cpp | 24 |
2 files changed, 24 insertions, 6 deletions
diff --git a/src/mongo/shell/kms.idl b/src/mongo/shell/kms.idl index 0f37073f351..5cd0f6284a7 100644 --- a/src/mongo/shell/kms.idl +++ b/src/mongo/shell/kms.idl @@ -43,11 +43,12 @@ enums: structs: awsKMSError: description: "AWS KMS error" + strict: false fields: __type: type: string cpp_name: type - message: string + Message: string # Options passed to Mongo() javascript constructor awsKMS: @@ -97,6 +98,7 @@ structs: awsEncryptResponse: description: "Response from AWS KMS Encrypt request, i.e. TrentService.Encrypt" + strict: false fields: CiphertextBlob: type: string @@ -105,6 +107,8 @@ structs: awsDecryptResponse: description: "Response from AWS KMS Decrypt request, i.e. TrentService.Decrypt" + # Nov 13, 2019 they added EncryptionAlgorithm but it is not documented + strict: false fields: Plaintext: type: string diff --git a/src/mongo/shell/kms_aws.cpp b/src/mongo/shell/kms_aws.cpp index 34b185a4f62..307789d73c2 100644 --- a/src/mongo/shell/kms_aws.cpp +++ b/src/mongo/shell/kms_aws.cpp @@ -268,14 +268,21 @@ std::vector<uint8_t> AWSKMSService::encrypt(ConstDataRange cdr, StringData kmsKe auto field = obj["__type"]; if (!field.eoo()) { - auto awsResponse = AwsKMSError::parse(IDLParserErrorContext("root"), obj); + AwsKMSError awsResponse; + try { + awsResponse = AwsKMSError::parse(IDLParserErrorContext("awsEncryptError"), obj); + } catch (DBException& dbe) { + uasserted(51274, + str::stream() << "AWS KMS failed to parse error message: " << dbe.toString() + << ", Response : " << obj); + } uasserted(51224, str::stream() << "AWS KMS failed to encrypt: " << awsResponse.getType() << " : " << awsResponse.getMessage()); } - auto awsResponse = AwsEncryptResponse::parse(IDLParserErrorContext("root"), obj); + auto awsResponse = AwsEncryptResponse::parse(IDLParserErrorContext("awsEncryptResponse"), obj); auto blobStr = base64::decode(awsResponse.getCiphertextBlob().toString()); @@ -298,7 +305,7 @@ BSONObj AWSKMSService::encryptDataKey(ConstDataRange cdr, StringData keyId) { } SecureVector<uint8_t> AWSKMSService::decrypt(ConstDataRange cdr, BSONObj masterKey) { - auto awsMasterKey = AwsMasterKey::parse(IDLParserErrorContext("root"), masterKey); + auto awsMasterKey = AwsMasterKey::parse(IDLParserErrorContext("awsMasterKey"), masterKey); auto request = UniqueKmsRequest(kms_decrypt_request_new( reinterpret_cast<const uint8_t*>(cdr.data()), cdr.length(), nullptr)); @@ -321,14 +328,21 @@ SecureVector<uint8_t> AWSKMSService::decrypt(ConstDataRange cdr, BSONObj masterK auto field = obj["__type"]; if (!field.eoo()) { - auto awsResponse = AwsKMSError::parse(IDLParserErrorContext("root"), obj); + AwsKMSError awsResponse; + try { + awsResponse = AwsKMSError::parse(IDLParserErrorContext("awsDecryptError"), obj); + } catch (DBException& dbe) { + uasserted(51275, + str::stream() << "AWS KMS failed to parse error message: " << dbe.toString() + << ", Response : " << obj); + } uasserted(51225, str::stream() << "AWS KMS failed to decrypt: " << awsResponse.getType() << " : " << awsResponse.getMessage()); } - auto awsResponse = AwsDecryptResponse::parse(IDLParserErrorContext("root"), obj); + auto awsResponse = AwsDecryptResponse::parse(IDLParserErrorContext("awsDecryptResponse"), obj); auto blobStr = base64::decode(awsResponse.getPlaintext().toString()); |