Skip to content

Commit 231c8bd

Browse files
kevinAlbskevinAlbs
committed
MONGOCRYPT-563 add CryptographicUsageMask to Register request (#603)
* format kms_kmip_request.c * fix error checks of `kms_kmip_request.*new` On error, the calls return a `kms_request_t*` with an error attached. * add `Cryptographic Usage Mask` attribute to KMIP `Register` request * change `Key Format Type` from `Raw` to `Opaque`. * update comments and test data * fix comment. SecretDataType used is Seed, not Password
1 parent 0caa1d3 commit 231c8bd

File tree

4 files changed

+78
-44
lines changed

4 files changed

+78
-44
lines changed

‎kms-message/src/kms_kmip_request.c‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@
2323
#include <stdint.h>
2424

2525
static void
26-
copy_writer_buffer (kms_request_t *req, kmip_writer_t *writer) {
26+
copy_writer_buffer (kms_request_t *req, kmip_writer_t *writer)
27+
{
2728
const uint8_t *buf;
2829
size_t buflen;
2930

@@ -54,11 +55,15 @@ kms_kmip_request_register_secretdata_new (void *reserved,
5455
<RequestPayload tag="0x420079" type="Structure">
5556
<ObjectType tag="0x420057" type="Enumeration" value="7"/>
5657
<TemplateAttribute tag="0x420091" type="Structure">
58+
<Attribute tag="0x420008" type="Structure">
59+
<AttributeName tag="0x42000a" type="TextString" value="Cryptographic
60+
Usage Mask"/> <AttributeValue tag="0x42000b" type="Integer" value="0"/>
61+
</Attribute>
5762
</TemplateAttribute>
5863
<SecretData tag="0x420085" type="Structure">
59-
<SecretDataType tag="0x420086" type="Enumeration" value="1"/>
64+
<SecretDataType tag="0x420086" type="Enumeration" value="2"/>
6065
<KeyBlock tag="0x420040" type="Structure">
61-
<KeyFormatType tag="0x420042" type="Enumeration" value="1"/>
66+
<KeyFormatType tag="0x420042" type="Enumeration" value="2"/>
6267
<KeyValue tag="0x420045" type="Structure">
6368
<KeyMaterial tag="0x420043" type="ByteString" value="..."/>
6469
</KeyValue>
@@ -101,15 +106,29 @@ kms_kmip_request_register_secretdata_new (void *reserved,
101106
/* 0x07 == SecretData */
102107
kmip_writer_write_enumeration (writer, KMIP_TAG_ObjectType, 0x07);
103108
kmip_writer_begin_struct (writer, KMIP_TAG_TemplateAttribute);
109+
// Add required Cryptographic Usage Mask attribute.
110+
{
111+
kmip_writer_begin_struct (writer, KMIP_TAG_Attribute);
112+
const char *cryptographicUsageMaskStr = "Cryptographic Usage Mask";
113+
kmip_writer_write_string (writer,
114+
KMIP_TAG_AttributeName,
115+
cryptographicUsageMaskStr,
116+
strlen (cryptographicUsageMaskStr));
117+
// Use 0 because the Secret Data object is not used in cryptographic
118+
// operations on the KMIP server.
119+
kmip_writer_write_integer (writer, KMIP_TAG_AttributeValue, 0);
120+
kmip_writer_close_struct (writer);
121+
}
104122
kmip_writer_close_struct (writer); /* KMIP_TAG_TemplateAttribute */
105123
kmip_writer_begin_struct (writer, KMIP_TAG_SecretData);
106-
/* 0x01 = Password */
124+
/* 0x02 = Seed */
107125
kmip_writer_write_enumeration (writer, KMIP_TAG_SecretDataType, 0x02);
108126
kmip_writer_begin_struct (writer, KMIP_TAG_KeyBlock);
109-
/* 0x01 = Raw */
110-
kmip_writer_write_enumeration (writer, KMIP_TAG_KeyFormatType, 0x01);
127+
/* 0x02 = Opaque */
128+
kmip_writer_write_enumeration (writer, KMIP_TAG_KeyFormatType, 0x02);
111129
kmip_writer_begin_struct (writer, KMIP_TAG_KeyValue);
112-
kmip_writer_write_bytes (writer, KMIP_TAG_KeyMaterial, (const char *) data, len);
130+
kmip_writer_write_bytes (
131+
writer, KMIP_TAG_KeyMaterial, (const char *) data, len);
113132
kmip_writer_close_struct (writer); /* KMIP_TAG_KeyValue */
114133
kmip_writer_close_struct (writer); /* KMIP_TAG_KeyBlock */
115134
kmip_writer_close_struct (writer); /* KMIP_TAG_SecretData */

‎kms-message/test/test_kms_kmip_request.c‎

Lines changed: 29 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,20 @@
1313
</RequestHeader>
1414
<BatchItem tag="0x42000f" type="Structure">
1515
<Operation tag="0x42005c" type="Enumeration" value="3"/>
16-
<UniqueBatchItemID tag="0x420093" type="ByteString" value="41"/>
1716
<RequestPayload tag="0x420079" type="Structure">
1817
<ObjectType tag="0x420057" type="Enumeration" value="7"/>
1918
<TemplateAttribute tag="0x420091" type="Structure">
19+
<Attribute tag="0x420008" type="Structure">
20+
<AttributeName tag="0x42000a" type="TextString" value="Cryptographic Usage
21+
Mask"/> <AttributeValue tag="0x42000b" type="Integer" value="0"/>
22+
</Attribute>
2023
</TemplateAttribute>
2124
<SecretData tag="0x420085" type="Structure">
22-
<SecretDataType tag="0x420086" type="Enumeration" value="1"/>
25+
<SecretDataType tag="0x420086" type="Enumeration" value="2"/>
2326
<KeyBlock tag="0x420040" type="Structure">
24-
<KeyFormatType tag="0x420042" type="Enumeration" value="1"/>
27+
<KeyFormatType tag="0x420042" type="Enumeration" value="2"/>
2528
<KeyValue tag="0x420045" type="Structure">
26-
<KeyMaterial tag="0x420043" type="ByteString"
29+
<KeyMaterial tag="0x420043" type="ByteString"
2730
value="ffa8cc79e8c3763b0121fcd06bb3488c8bf42c0774604640279b16b264194030eeb08396241defcc4d32d16ea831ad777138f08e2f985664c004c2485d6f4991eb3d9ec32802537836a9066b4e10aeb56a5ccf6aa46901e625e3400c7811d2ec"/>
2831
</KeyValue>
2932
</KeyBlock>
@@ -33,30 +36,35 @@ value="ffa8cc79e8c3763b0121fcd06bb3488c8bf42c0774604640279b16b264194030eeb083962
3336
</RequestMessage>
3437
*/
3538
#define REGISTER_SECRETDATA_REQUEST \
36-
0x42, 0x00, 0x78, 0x01, 0x00, 0x00, 0x01, 0x18, 0x42, 0x00, 0x77, 0x01, \
39+
0x42, 0x00, 0x78, 0x01, 0x00, 0x00, 0x01, 0x50, 0x42, 0x00, 0x77, 0x01, \
3740
0x00, 0x00, 0x00, 0x38, 0x42, 0x00, 0x69, 0x01, 0x00, 0x00, 0x00, 0x20, \
3841
0x42, 0x00, 0x6a, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, \
3942
0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x6b, 0x02, 0x00, 0x00, 0x00, 0x04, \
4043
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x0d, 0x02, \
4144
0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, \
42-
0x42, 0x00, 0x0f, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x42, 0x00, 0x5c, 0x05, \
45+
0x42, 0x00, 0x0f, 0x01, 0x00, 0x00, 0x01, 0x08, 0x42, 0x00, 0x5c, 0x05, \
4346
0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, \
44-
0x42, 0x00, 0x79, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x42, 0x00, 0x57, 0x05, \
47+
0x42, 0x00, 0x79, 0x01, 0x00, 0x00, 0x00, 0xf0, 0x42, 0x00, 0x57, 0x05, \
4548
0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, \
46-
0x42, 0x00, 0x91, 0x01, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x85, 0x01, \
47-
0x00, 0x00, 0x00, 0x98, 0x42, 0x00, 0x86, 0x05, 0x00, 0x00, 0x00, 0x04, \
48-
0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x40, 0x01, \
49-
0x00, 0x00, 0x00, 0x80, 0x42, 0x00, 0x42, 0x05, 0x00, 0x00, 0x00, 0x04, \
50-
0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x45, 0x01, \
51-
0x00, 0x00, 0x00, 0x68, 0x42, 0x00, 0x43, 0x08, 0x00, 0x00, 0x00, 0x60, \
52-
0xff, 0xa8, 0xcc, 0x79, 0xe8, 0xc3, 0x76, 0x3b, 0x01, 0x21, 0xfc, 0xd0, \
53-
0x6b, 0xb3, 0x48, 0x8c, 0x8b, 0xf4, 0x2c, 0x07, 0x74, 0x60, 0x46, 0x40, \
54-
0x27, 0x9b, 0x16, 0xb2, 0x64, 0x19, 0x40, 0x30, 0xee, 0xb0, 0x83, 0x96, \
55-
0x24, 0x1d, 0xef, 0xcc, 0x4d, 0x32, 0xd1, 0x6e, 0xa8, 0x31, 0xad, 0x77, \
56-
0x71, 0x38, 0xf0, 0x8e, 0x2f, 0x98, 0x56, 0x64, 0xc0, 0x04, 0xc2, 0x48, \
57-
0x5d, 0x6f, 0x49, 0x91, 0xeb, 0x3d, 0x9e, 0xc3, 0x28, 0x02, 0x53, 0x78, \
58-
0x36, 0xa9, 0x06, 0x6b, 0x4e, 0x10, 0xae, 0xb5, 0x6a, 0x5c, 0xcf, 0x6a, \
59-
0xa4, 0x69, 0x01, 0xe6, 0x25, 0xe3, 0x40, 0x0c, 0x78, 0x11, 0xd2, 0xec
49+
0x42, 0x00, 0x91, 0x01, 0x00, 0x00, 0x00, 0x38, 0x42, 0x00, 0x08, 0x01, \
50+
0x00, 0x00, 0x00, 0x30, 0x42, 0x00, 0x0a, 0x07, 0x00, 0x00, 0x00, 0x18, \
51+
0x43, 0x72, 0x79, 0x70, 0x74, 0x6f, 0x67, 0x72, 0x61, 0x70, 0x68, 0x69, \
52+
0x63, 0x20, 0x55, 0x73, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x61, 0x73, 0x6b, \
53+
0x42, 0x00, 0x0b, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, \
54+
0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x85, 0x01, 0x00, 0x00, 0x00, 0x98, \
55+
0x42, 0x00, 0x86, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, \
56+
0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x40, 0x01, 0x00, 0x00, 0x00, 0x80, \
57+
0x42, 0x00, 0x42, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, \
58+
0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x45, 0x01, 0x00, 0x00, 0x00, 0x68, \
59+
0x42, 0x00, 0x43, 0x08, 0x00, 0x00, 0x00, 0x60, 0xff, 0xa8, 0xcc, 0x79, \
60+
0xe8, 0xc3, 0x76, 0x3b, 0x01, 0x21, 0xfc, 0xd0, 0x6b, 0xb3, 0x48, 0x8c, \
61+
0x8b, 0xf4, 0x2c, 0x07, 0x74, 0x60, 0x46, 0x40, 0x27, 0x9b, 0x16, 0xb2, \
62+
0x64, 0x19, 0x40, 0x30, 0xee, 0xb0, 0x83, 0x96, 0x24, 0x1d, 0xef, 0xcc, \
63+
0x4d, 0x32, 0xd1, 0x6e, 0xa8, 0x31, 0xad, 0x77, 0x71, 0x38, 0xf0, 0x8e, \
64+
0x2f, 0x98, 0x56, 0x64, 0xc0, 0x04, 0xc2, 0x48, 0x5d, 0x6f, 0x49, 0x91, \
65+
0xeb, 0x3d, 0x9e, 0xc3, 0x28, 0x02, 0x53, 0x78, 0x36, 0xa9, 0x06, 0x6b, \
66+
0x4e, 0x10, 0xae, 0xb5, 0x6a, 0x5c, 0xcf, 0x6a, 0xa4, 0x69, 0x01, 0xe6, \
67+
0x25, 0xe3, 0x40, 0x0c, 0x78, 0x11, 0xd2, 0xec
6068

6169
#define REGISTER_SECRETDATA_SECRETDATA \
6270
0xff, 0xa8, 0xcc, 0x79, 0xe8, 0xc3, 0x76, 0x3b, 0x01, 0x21, 0xfc, 0xd0, \
@@ -93,7 +101,6 @@ kms_kmip_request_register_secretdata_test (void)
93101
void
94102
kms_kmip_request_register_secretdata_invalid_test (void)
95103
{
96-
97104
kms_request_t *req;
98105
uint8_t secret_data[KMS_KMIP_REQUEST_SECRETDATA_LENGTH] = {0};
99106

‎src/mongocrypt-kms-ctx.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1646,7 +1646,7 @@ _mongocrypt_kms_ctx_init_kmip_register (mongocrypt_kms_ctx_t *kms_ctx,
16461646
kms_ctx->req = kms_kmip_request_register_secretdata_new (
16471647
NULL /* reserved */, secretdata, secretdata_len);
16481648

1649-
if (!kms_ctx->req) {
1649+
if (kms_request_get_error (kms_ctx->req)) {
16501650
CLIENT_ERR ("Error creating KMIP register request: %s",
16511651
kms_request_get_error (kms_ctx->req));
16521652
goto done;
@@ -1687,7 +1687,7 @@ _mongocrypt_kms_ctx_init_kmip_activate (mongocrypt_kms_ctx_t *kms_ctx,
16871687
kms_ctx->req =
16881688
kms_kmip_request_activate_new (NULL /* reserved */, unique_identifier);
16891689

1690-
if (!kms_ctx->req) {
1690+
if (kms_request_get_error (kms_ctx->req)) {
16911691
CLIENT_ERR ("Error creating KMIP activate request: %s",
16921692
kms_request_get_error (kms_ctx->req));
16931693
goto done;
@@ -1728,7 +1728,7 @@ _mongocrypt_kms_ctx_init_kmip_get (mongocrypt_kms_ctx_t *kms_ctx,
17281728
kms_ctx->req =
17291729
kms_kmip_request_get_new (NULL /* reserved */, unique_identifier);
17301730

1731-
if (!kms_ctx->req) {
1731+
if (kms_request_get_error (kms_ctx->req)) {
17321732
CLIENT_ERR ("Error creating KMIP get request: %s",
17331733
kms_request_get_error (kms_ctx->req));
17341734
goto done;

‎test/test-mongocrypt-kms-ctx.c‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,15 @@
3434
<RequestPayload tag="0x420079" type="Structure">
3535
<ObjectType tag="0x420057" type="Enumeration" value="7"/>
3636
<TemplateAttribute tag="0x420091" type="Structure">
37+
<Attribute tag="0x420008" type="Structure">
38+
<AttributeName tag="0x42000a" type="TextString" value="Cryptographic Usage
39+
Mask"/> <AttributeValue tag="0x42000b" type="Integer" value="0"/>
40+
</Attribute>
3741
</TemplateAttribute>
3842
<SecretData tag="0x420085" type="Structure">
3943
<SecretDataType tag="0x420086" type="Enumeration" value="2"/>
4044
<KeyBlock tag="0x420040" type="Structure">
41-
<KeyFormatType tag="0x420042" type="Enumeration" value="1"/>
45+
<KeyFormatType tag="0x420042" type="Enumeration" value="2"/>
4246
<KeyValue tag="0x420045" type="Structure">
4347
<KeyMaterial tag="0x420043" type="ByteString"
4448
value="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"/>
@@ -50,29 +54,33 @@ value="0000000000000000000000000000000000000000000000000000000000000000000000000
5054
</RequestMessage>
5155
*/
5256
static const uint8_t REGISTER_REQUEST[] = {
53-
0x42, 0x00, 0x78, 0x01, 0x00, 0x00, 0x01, 0x18, 0x42, 0x00, 0x77, 0x01, 0x00,
57+
0x42, 0x00, 0x78, 0x01, 0x00, 0x00, 0x01, 0x50, 0x42, 0x00, 0x77, 0x01, 0x00,
5458
0x00, 0x00, 0x38, 0x42, 0x00, 0x69, 0x01, 0x00, 0x00, 0x00, 0x20, 0x42, 0x00,
5559
0x6a, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
5660
0x00, 0x42, 0x00, 0x6b, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
5761
0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x0d, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00,
5862
0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x0f, 0x01, 0x00, 0x00,
59-
0x00, 0xd0, 0x42, 0x00, 0x5c, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
60-
0x03, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x79, 0x01, 0x00, 0x00, 0x00, 0xb8,
63+
0x01, 0x08, 0x42, 0x00, 0x5c, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
64+
0x03, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x79, 0x01, 0x00, 0x00, 0x00, 0xf0,
6165
0x42, 0x00, 0x57, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x07, 0x00,
62-
0x00, 0x00, 0x00, 0x42, 0x00, 0x91, 0x01, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00,
63-
0x85, 0x01, 0x00, 0x00, 0x00, 0x98, 0x42, 0x00, 0x86, 0x05, 0x00, 0x00, 0x00,
64-
0x04, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x40, 0x01,
65-
0x00, 0x00, 0x00, 0x80, 0x42, 0x00, 0x42, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00,
66-
0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x45, 0x01, 0x00, 0x00,
67-
0x00, 0x68, 0x42, 0x00, 0x43, 0x08, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00,
68-
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
66+
0x00, 0x00, 0x00, 0x42, 0x00, 0x91, 0x01, 0x00, 0x00, 0x00, 0x38, 0x42, 0x00,
67+
0x08, 0x01, 0x00, 0x00, 0x00, 0x30, 0x42, 0x00, 0x0a, 0x07, 0x00, 0x00, 0x00,
68+
0x18, 0x43, 0x72, 0x79, 0x70, 0x74, 0x6f, 0x67, 0x72, 0x61, 0x70, 0x68, 0x69,
69+
0x63, 0x20, 0x55, 0x73, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x61, 0x73, 0x6b, 0x42,
70+
0x00, 0x0b, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
71+
0x00, 0x00, 0x42, 0x00, 0x85, 0x01, 0x00, 0x00, 0x00, 0x98, 0x42, 0x00, 0x86,
72+
0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
73+
0x42, 0x00, 0x40, 0x01, 0x00, 0x00, 0x00, 0x80, 0x42, 0x00, 0x42, 0x05, 0x00,
74+
0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00,
75+
0x45, 0x01, 0x00, 0x00, 0x00, 0x68, 0x42, 0x00, 0x43, 0x08, 0x00, 0x00, 0x00,
76+
0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
6977
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
7078
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
7179
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
7280
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
7381
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
7482
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
75-
0x00, 0x00};
83+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
7684

7785
/*
7886
<ResponseMessage tag="0x42007b" type="Structure">

0 commit comments

Comments
 (0)