summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/mongo/crypto/SConscript1
-rw-r--r--src/mongo/crypto/fle_crypto.cpp43
-rw-r--r--src/mongo/crypto/fle_crypto.h17
-rw-r--r--src/mongo/crypto/fle_crypto_test.cpp14
-rw-r--r--src/mongo/crypto/fle_field_schema.idl3
-rw-r--r--src/mongo/crypto/fle_fields_util.cpp48
-rw-r--r--src/mongo/crypto/fle_fields_util.h40
7 files changed, 122 insertions, 44 deletions
diff --git a/src/mongo/crypto/SConscript b/src/mongo/crypto/SConscript
index 459e8fccc82..4ce7ede944a 100644
--- a/src/mongo/crypto/SConscript
+++ b/src/mongo/crypto/SConscript
@@ -115,6 +115,7 @@ env.Library(
target="fle_fields",
source=[
"fle_field_schema.idl",
+ "fle_fields_util.cpp",
],
LIBDEPS=[
'$BUILD_DIR/mongo/idl/idl_parser',
diff --git a/src/mongo/crypto/fle_crypto.cpp b/src/mongo/crypto/fle_crypto.cpp
index f55db25f970..cdeb5c2566f 100644
--- a/src/mongo/crypto/fle_crypto.cpp
+++ b/src/mongo/crypto/fle_crypto.cpp
@@ -48,7 +48,6 @@
#include "mongo/base/data_range.h"
#include "mongo/base/data_range_cursor.h"
#include "mongo/base/data_type_endian.h"
-#include "mongo/base/data_type_validated.h"
#include "mongo/base/data_view.h"
#include "mongo/base/error_codes.h"
#include "mongo/base/status.h"
@@ -65,6 +64,7 @@
#include "mongo/crypto/encryption_fields_util.h"
#include "mongo/crypto/fle_data_frames.h"
#include "mongo/crypto/fle_field_schema_gen.h"
+#include "mongo/crypto/fle_fields_util.h"
#include "mongo/crypto/sha256_block.h"
#include "mongo/crypto/symmetric_key.h"
#include "mongo/db/exec/document_value/value.h"
@@ -154,17 +154,6 @@ PrfBlock blockToArray(const SHA256Block& block) {
return data;
}
-} // namespace
-
-PrfBlock PrfBlockfromCDR(ConstDataRange block) {
- uassert(6373501, "Invalid prf length", block.length() == sizeof(PrfBlock));
-
- PrfBlock ret;
- std::copy(block.data(), block.data() + block.length(), ret.data());
- return ret;
-}
-
-namespace {
ConstDataRange hmacKey(const KeyMaterial& keyMaterial) {
static_assert(kHmacKeyOffset + crypto::sym256KeySize <= crypto::kFieldLevelEncryptionKeySize);
invariant(crypto::kFieldLevelEncryptionKeySize == keyMaterial->size());
@@ -208,13 +197,6 @@ PrfBlock prf(ConstDataRange key, uint64_t value, int64_t value2) {
return blockToArray(block);
}
-ConstDataRange binDataToCDR(const BSONElement element) {
- uassert(6338501, "Expected binData BSON element", element.type() == BinData);
-
- int len;
- const char* data = element.binData(len);
- return ConstDataRange(data, data + len);
-}
ConstDataRange binDataToCDR(const BSONBinData binData) {
int len = binData.length;
@@ -251,14 +233,6 @@ void appendTag(PrfBlock block, BSONArrayBuilder* builder) {
builder->appendBinData(block.size(), BinDataType::BinDataGeneral, block.data());
}
-template <typename T>
-T parseFromCDR(ConstDataRange cdr) {
- ConstDataRangeCursor cdc(cdr);
- auto obj = cdc.readAndAdvance<Validated<BSONObj>>();
-
- IDLParserErrorContext ctx("root");
- return T::parse(ctx, obj);
-}
std::vector<uint8_t> vectorFromCDR(ConstDataRange cdr) {
std::vector<uint8_t> buf(cdr.length());
@@ -1192,6 +1166,14 @@ std::vector<uint8_t> toEncryptedVector(EncryptedBinDataType dt, const PrfBlock&
return buf;
}
+PrfBlock PrfBlockfromCDR(const ConstDataRange& block) {
+ uassert(6373501, "Invalid prf length", block.length() == sizeof(PrfBlock));
+
+ PrfBlock ret;
+ std::copy(block.data(), block.data() + block.length(), ret.data());
+ return ret;
+}
+
CollectionsLevel1Token FLELevel1TokenGenerator::generateCollectionsLevel1Token(
FLEIndexKey indexKey) {
return prf(hmacKey(indexKey.data), kLevel1Collection);
@@ -2517,4 +2499,11 @@ uint64_t CompactionHelpers::countDeleted(const std::vector<ECCDocument>& rangeLi
return sum;
}
+ConstDataRange binDataToCDR(BSONElement element) {
+ uassert(6338501, "Expected binData BSON element", element.type() == BinData);
+
+ int len;
+ const char* data = element.binData(len);
+ return ConstDataRange(data, data + len);
+}
} // namespace mongo
diff --git a/src/mongo/crypto/fle_crypto.h b/src/mongo/crypto/fle_crypto.h
index 5feac8ca2d3..1767988cbe8 100644
--- a/src/mongo/crypto/fle_crypto.h
+++ b/src/mongo/crypto/fle_crypto.h
@@ -37,6 +37,7 @@
#include <vector>
#include "mongo/base/data_range.h"
+#include "mongo/base/data_type_validated.h"
#include "mongo/base/secure_allocator.h"
#include "mongo/base/status_with.h"
#include "mongo/base/string_data.h"
@@ -1189,14 +1190,24 @@ struct ParsedFindPayload {
};
/**
- * Utility functions manipulating buffers
+ * Utility functions manipulating buffers.
*/
-PrfBlock PrfBlockfromCDR(ConstDataRange block);
+PrfBlock PrfBlockfromCDR(const ConstDataRange& block);
+
+ConstDataRange binDataToCDR(BSONElement element);
+
+template <typename T>
+T parseFromCDR(ConstDataRange cdr) {
+ ConstDataRangeCursor cdc(cdr);
+ auto obj = cdc.readAndAdvance<Validated<BSONObj>>();
+
+ IDLParserErrorContext ctx("root");
+ return T::parse(ctx, obj);
+}
std::vector<uint8_t> toEncryptedVector(EncryptedBinDataType dt, const PrfBlock& block);
BSONBinData toBSONBinData(const std::vector<uint8_t>& buf);
std::pair<EncryptedBinDataType, ConstDataRange> fromEncryptedBinData(const Value& value);
-
} // namespace mongo
diff --git a/src/mongo/crypto/fle_crypto_test.cpp b/src/mongo/crypto/fle_crypto_test.cpp
index 4c4355ebb9f..9e9b4d9269f 100644
--- a/src/mongo/crypto/fle_crypto_test.cpp
+++ b/src/mongo/crypto/fle_crypto_test.cpp
@@ -1018,20 +1018,6 @@ BSONObj transformBSON(
return frameStack.top().builder.obj();
}
-
-template <typename T>
-T parseFromCDR(ConstDataRange cdr) {
- ConstDataRangeCursor cdc(cdr);
- auto swObj = cdc.readAndAdvanceNoThrow<Validated<BSONObj>>();
-
- uassertStatusOK(swObj);
-
- BSONObj obj = swObj.getValue();
-
- IDLParserErrorContext ctx("root");
- return T::parse(ctx, obj);
-}
-
template <typename T>
std::vector<uint8_t> toEncryptedVector(EncryptedBinDataType dt, T t) {
BSONObj obj = t.toBSON();
diff --git a/src/mongo/crypto/fle_field_schema.idl b/src/mongo/crypto/fle_field_schema.idl
index 9ee522f367b..8840a4480d8 100644
--- a/src/mongo/crypto/fle_field_schema.idl
+++ b/src/mongo/crypto/fle_field_schema.idl
@@ -27,6 +27,8 @@
global:
cpp_namespace: "mongo"
+ cpp_includes:
+ - "mongo/crypto/fle_fields_util.h"
imports:
- "mongo/idl/basic_types.idl"
@@ -116,6 +118,7 @@ structs:
description: "Implements Encryption BinData (subtype 6) sub-subtype 0, the intent-to-encrypt
mapping. Contains a value to encrypt and a description of how it should be encrypted."
strict: true
+ cpp_validator_func: "validateIDLFLE2EncryptionPlaceholder"
fields:
t:
description: "The type number, determines what payload to replace the placeholder with"
diff --git a/src/mongo/crypto/fle_fields_util.cpp b/src/mongo/crypto/fle_fields_util.cpp
new file mode 100644
index 00000000000..96c49c1a7f5
--- /dev/null
+++ b/src/mongo/crypto/fle_fields_util.cpp
@@ -0,0 +1,48 @@
+/**
+ * Copyright (C) 2022-present MongoDB, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the Server Side Public License, version 1,
+ * as published by MongoDB, Inc.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * Server Side Public License for more details.
+ *
+ * You should have received a copy of the Server Side Public License
+ * along with this program. If not, see
+ * <http://www.mongodb.com/licensing/server-side-public-license>.
+ *
+ * As a special exception, the copyright holders give permission to link the
+ * code of portions of this program with the OpenSSL library under certain
+ * conditions as described in each individual source file and distribute
+ * linked combinations including the program with the OpenSSL library. You
+ * must comply with the Server Side Public License in all respects for
+ * all of the code used other than as permitted herein. If you modify file(s)
+ * with this exception, you may extend this exception to your version of the
+ * file(s), but you are not obligated to do so. If you do not wish to do so,
+ * delete this exception statement from your version. If you delete this
+ * exception statement from all source files in the program, then also delete
+ * it in the license file.
+ */
+
+#include "fle_fields_util.h"
+#include "mongo/bson/bsonelement.h"
+#include "mongo/bson/bsontypes.h"
+#include "mongo/crypto/fle_field_schema_gen.h"
+#include "mongo/idl/basic_types.h"
+
+namespace mongo {
+void validateIDLFLE2EncryptionPlaceholder(const FLE2EncryptionPlaceholder* placeholder) {
+ if (placeholder->getAlgorithm() == Fle2AlgorithmInt::kRange) {
+ auto val = placeholder->getValue().getElement();
+ uassert(6720200, "Range placeholder must be an array.", val.isABSONObj());
+ auto obj = val.Obj();
+ uassert(6720201, "Range placeholder must be an array.", obj.couldBeArray());
+ uassert(6720202,
+ "Range placeholder must hold an array with a min and max value.",
+ obj.nFields() == 2);
+ }
+}
+} // namespace mongo
diff --git a/src/mongo/crypto/fle_fields_util.h b/src/mongo/crypto/fle_fields_util.h
new file mode 100644
index 00000000000..dc4b60f0342
--- /dev/null
+++ b/src/mongo/crypto/fle_fields_util.h
@@ -0,0 +1,40 @@
+/**
+ * Copyright (C) 2022-present MongoDB, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the Server Side Public License, version 1,
+ * as published by MongoDB, Inc.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * Server Side Public License for more details.
+ *
+ * You should have received a copy of the Server Side Public License
+ * along with this program. If not, see
+ * <http://www.mongodb.com/licensing/server-side-public-license>.
+ *
+ * As a special exception, the copyright holders give permission to link the
+ * code of portions of this program with the OpenSSL library under certain
+ * conditions as described in each individual source file and distribute
+ * linked combinations including the program with the OpenSSL library. You
+ * must comply with the Server Side Public License in all respects for
+ * all of the code used other than as permitted herein. If you modify file(s)
+ * with this exception, you may extend this exception to your version of the
+ * file(s), but you are not obligated to do so. If you do not wish to do so,
+ * delete this exception statement from your version. If you delete this
+ * exception statement from all source files in the program, then also delete
+ * it in the license file.
+ */
+
+#pragma once
+
+namespace mongo {
+class FLE2EncryptionPlaceholder;
+
+/**
+ * Extra validation for the placeholder struct to verify that range placeholders have min/max
+ * endpoints. Will throw a uassert if the placeholder does not pass validation.
+ */
+void validateIDLFLE2EncryptionPlaceholder(const FLE2EncryptionPlaceholder* placeholder);
+} // namespace mongo
View Lorry Controller Status