Couchbase C Client  3.3.2
Asynchronous C Client for Couchbase

Shows how to use field-encryption API to decrypt JSON values.

/* -*- Mode: C; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
* Copyright 2018-2020 Couchbase, Inc.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* See the License for the specific language governing permissions and
* limitations under the License.
#include <stdio.h>
#include <stdlib.h>
#include <string.h> /* strlen */
#ifdef _WIN32
#define PRIx64 "I64x"
#include <inttypes.h>
#include "openssl_symmetric_provider.h"
static void die(lcb_INSTANCE *instance, const char *msg, lcb_STATUS err)
fprintf(stderr, "%s. Received code 0x%X (%s)\n", msg, err, lcb_strerror_short(err));
static void op_callback(lcb_INSTANCE *instance, int cbtype, const lcb_RESPBASE *rb)
if (rb->rc == LCB_SUCCESS) {
const lcb_RESPGET *rg = (const lcb_RESPGET *)rb;
lcbcrypto_FIELDSPEC field = {};
printf("VALUE: %.*s\n", (int)rg->nvalue, rg->value);
dcmd.version = 0;
dcmd.prefix = NULL;
dcmd.doc = rg->value;
dcmd.ndoc = rg->nvalue;
dcmd.out = NULL;
dcmd.nout = 0;
dcmd.nfields = 1;
dcmd.fields = &field; = "message";
field.alg = "AES-256-HMAC-SHA256";
err = lcbcrypto_decrypt_fields(instance, &dcmd);
if (err != LCB_SUCCESS) {
die(instance, "Couldn't decrypt field 'message'", err);
if (dcmd.out == NULL) {
die(instance, "Crypto provider returned success, but document is NULL", LCB_ERR_INVALID_ARGUMENT);
/* chop trailing LF for nicer look */
if (dcmd.out[dcmd.nout - 1] == '\n') {
dcmd.out[dcmd.nout - 1] = ' ';
printf("PLAIN: %.*s\n", (int)dcmd.nout, dcmd.out);
free(dcmd.out); // NOTE: it should be compatible with what providers use to allocate memory
printf("CAS: 0x%" PRIx64 "\n", rb->cas);
} else {
die(instance, lcb_strcbtype(cbtype), rb->rc);
static void get_encrypted(lcb_INSTANCE *instance, const char *key)
lcb_CMDGET cmd = {};
LCB_CMD_SET_KEY(&cmd, key, strlen(key));
printf("KEY: %s\n", key);
err = lcb_get3(instance, NULL, &cmd);
if (err != LCB_SUCCESS) {
die(instance, "Couldn't schedule get operation", err);
int main(int argc, char *argv[])
lcb_INSTANCE *instance;
struct lcb_create_st create_options = {};
create_options.version = 3;
if (argc < 2) {
fprintf(stderr, "Usage: %s couchbase://host/bucket [ password [ username ] ]\n", argv[0]);
create_options.v.v3.connstr = argv[1];
if (argc > 2) {
create_options.v.v3.passwd = argv[2];
if (argc > 3) {
create_options.v.v3.username = argv[3];
err = lcb_create(&instance, &create_options);
if (err != LCB_SUCCESS) {
die(NULL, "Couldn't create couchbase handle", err);
err = lcb_connect(instance);
if (err != LCB_SUCCESS) {
die(instance, "Couldn't schedule connection", err);
err = lcb_get_bootstrap_status(instance);
if (err != LCB_SUCCESS) {
die(instance, "Couldn't bootstrap from cluster", err);
lcb_install_callback3(instance, LCB_CALLBACK_GET, op_callback);
lcbcrypto_register(instance, "AES-256-HMAC-SHA256", osp_create());
get_encrypted(instance, "secret-1");
get_encrypted(instance, "secret-2");
get_encrypted(instance, "secret-3");
get_encrypted(instance, "secret-4");
get_encrypted(instance, "secret-5");
return 0;
Main header file for Couchbase.
void lcb_destroy(lcb_INSTANCE *instance)
Destroy (and release all allocated resources) an instance of lcb.
Field encryption.
lcbcrypto_FIELDSPEC * fields
list of field specs
Definition: crypto.h:142
char * out
pointer to output JSON document.
Definition: crypto.h:140
size_t ndoc
size of the input JSON document
Definition: crypto.h:139
const char * doc
pointer to the input JSON document
Definition: crypto.h:138
const char * prefix
prefix to encrypted field.
Definition: crypto.h:137
const char * name
field name (NUL-terminated)
Definition: crypto.h:106
uint16_t version
version of the structure, currently valid value is 0
Definition: crypto.h:136
size_t nout
size of the output JSON document
Definition: crypto.h:141
const char * alg
crypto provider alias (NUL-terminated)
Definition: crypto.h:107
size_t nfields
number of field specs
Definition: crypto.h:143
lcb_STATUS lcbcrypto_decrypt_fields(lcb_INSTANCE *instance, lcbcrypto_CMDDECRYPT *cmd)
Decrypt all specified fields in the JSON encoded object.
void lcbcrypto_register(lcb_INSTANCE *instance, const char *name, lcbcrypto_PROVIDER *provider)
Register crypto-provider for specified alias.
Command to decrypt JSON fields.
Definition: crypto.h:135
Structure for JSON field specification for encrypt/decrypt API.
Definition: crypto.h:105
LCB_INTERNAL_API const char * lcb_strerror_short(lcb_STATUS error)
Get a shorter textual description of an error message.
Error codes returned by the library.
Definition: error.h:212
struct lcb_RESPGET_ lcb_RESPGET
Command for retrieving a single item.
Definition: couchbase.h:687
lcb_STATUS lcb_get_bootstrap_status(lcb_INSTANCE *instance)
Gets the initial bootstrap status.
lcb_STATUS lcb_create(lcb_INSTANCE **instance, const lcb_CREATEOPTS *options)
Create an instance of lcb.
struct lcb_st lcb_INSTANCE
Library handle representing a connection to a cluster and its data buckets.
Definition: couchbase.h:35
lcb_STATUS lcb_connect(lcb_INSTANCE *instance)
Schedule the initial connection This function will schedule the initial connection for the handle.
const char * lcb_strcbtype(int cbtype)
Returns the type of the callback as a string.
Definition: couchbase.h:471
lcb_STATUS lcb_wait(lcb_INSTANCE *instance, lcb_WAITFLAGS flags)
Wait for completion of scheduled operations.
Behave like the old lcb_wait()
Definition: couchbase.h:1854
#define LCB_CMD_SET_KEY(cmd, keybuf, keylen)
Set the key for the command.
Definition: utils.h:52