ex-kmip-18.c

#include <stdio.h>
#include <stdlib.h>
#include <memory.h>            
#include "p6com.h"                  // Basic COM definitions
#include "p6loader.h"               // Standalone Component Loader definitions
#include "p6keystore.h"             // Keystore interface defintions
#include "p6kmip.h"
#include "p6kmipclient.h"
#include "p6config.h"
#include "p6file.h"
#include "p6dir.h"
#include "p6genkeys.h"
#include "cconsolestream.h"

P6DECLARE_IID( p6ICom             );
P6DECLARE_IID( p6IKMIPRequest     );
P6DECLARE_CID( p6KMIPClient       );
P6DECLARE_IID( p6IKMIPClient      );
P6DECLARE_IID( p6ISafeString      );
P6DECLARE_CID( p6EntropySource    );
P6DECLARE_IID( p6IEntropySource   );
P6DECLARE_CID( p6Random           );
P6DECLARE_IID( p6IRandomInit      );
P6DECLARE_IID( p6IRandom          );
P6DECLARE_IID( p6IRunningIface    );
P6DECLARE_CID( p6Cert             );
P6DECLARE_IID( p6ICert            );
P6DECLARE_IID( p6ICertInit        );
P6DECLARE_CID( p6GenKeys          );
P6DECLARE_IID( p6IGenKeys         );
P6DECLARE_CID( p6Sign             );
P6DECLARE_IID( p6ISign            );
P6DECLARE_CID( p6SymmetricCrypto  );
P6DECLARE_IID( p6ISymmetricCrypto );
P6DECLARE_CID( p6CryptoKey        );
P6DECLARE_IID( p6ICryptoKey       );
P6DECLARE_IID( p6ICryptoKeyInit   );
P6DECLARE_CID( p6Dir              );
P6DECLARE_IID( p6IDir             );
P6DECLARE_CID( p6UnbufferedFile   );
P6DECLARE_IID( p6IUnbufferedFile  );
P6DECLARE_IID( p6IKeystoreInit    );
P6DECLARE_IID( p6IKeystore        );
P6DECLARE_CID( p6Keystore         );
P6DECLARE_IID( p6IKeystoreSSL     );
P6DECLARE_IID( p6IDataStream      );


// Global variables
static p6ISafeString      *m_pStr       = NULL;      // -> P6R generic string library
static p6IRandom          *m_pRandom    = NULL;      // -> crypto related to generate keys
static p6ICryptoKey       *m_pKey   = NULL;          // -> used to sign the contents of the keystore
static p6ISymmetricCrypto *m_pCrypto    = NULL;      // -> used to encrypt the contents of the keystore
static P6UINT32            m_port       = 0;         // -> KMIP server port to connect to
static P6UINT32            m_compatMask = 0;         // -> compatibility mask: 0 use TTLV message encoding, 1 TTLV over HTTP, 2 use XML message encoding, 4 use JSON message encoding
static P6WCHAR*            m_pHostName  = NULL;      // -> IP address or FQDN of KMIP server to connect to
static p6IKeystore        *m_pKeystore  = NULL;      // -> the KMIP client requires that a properly initialzed keystore is setup
static p6IKeystoreInit    *m_pStoreInit = NULL;      // -> keystore related


//
static P6ERR getSafeString( p6ISafeString **ppStr /*out*/ )
{
   P6ERR err = eFail;

   if ( P6SUCCEEDED( err = p6GetRuntimeIface( &IID_p6ISafeString, (P6VOID**)ppStr ))) 
        printf("getSafeString [ OK ]\n");   
   else printf("getSafeString [ FAILED ] %x\n",err);

   return err;
}


// Key generation requires an entropy source
static P6ERR getRNG( p6IRandom **ppRandom /*out*/ )
{
   P6ERR err = eFail;
   p6IEntropySource *pSource = NULL;
   p6IRandomInit *pInit = NULL;

   if (P6SUCCEEDED( err = p6CreateCryptoInstance( &CID_p6EntropySource, &IID_p6IEntropySource, (P6VOID**)&pSource ))) 
   {
       if (P6SUCCEEDED( err = pSource->lpVtbl->initialize( pSource, P6ENTROPY_HIGH ))) 
       {
           if (P6SUCCEEDED( err = p6CreateCryptoInstance( &CID_p6Random, &IID_p6IRandomInit, (P6VOID**)&pInit ))) 
           {
               if (P6SUCCEEDED( err = pInit->lpVtbl->initialize( pInit, P6RAND_NOFLAGS, pSource ))) {
                   err = pInit->lpVtbl->queryInterface( pInit, &IID_p6IRandom, (P6VOID**)ppRandom );
               }
           }
       }
   }

   if (NULL != pSource) pSource->lpVtbl->release( pSource );
   if (NULL != pInit  ) pInit->lpVtbl->release( pInit );
   return err;
}


// The contents of the keystore is protected by a key
P6ERR getIGenKeys( p6IGenKeys **ppGenKeys /*out*/ )
{
   P6ERR err = eFail;
   p6IGenKeys *pTempKeys = NULL;

   *ppGenKeys = NULL;

   // Create an instance of the p6IGenKeys interface and then initialize it for use
   if (P6SUCCEEDED( err = p6CreateCryptoInstance( &CID_p6GenKeys, &IID_p6IGenKeys, (P6VOID**)&pTempKeys ))) 
   {
      if (P6FAILED( err = pTempKeys->lpVtbl->initialize( pTempKeys, P6GENKEY_NOFLAGS, m_pRandom ))) {
           pTempKeys->lpVtbl->release( pTempKeys );
      }
      else {
         *ppGenKeys = pTempKeys;
      }
   }
   return err;
}


// Open an existing keystore that was previous loaded the required TLS credentials to connect to a KMIP server (see example 16).
// P6R's SSL looks into the keystore for certificates and the private key when it starts a connection to the KMIP server.
P6ERR openExistingKeystore( const P6WCHAR*    pKeystoreName,  /*in */
                      p6IKeystoreInit** ppInit,         /*out*/ 
                     p6IKeystore**     ppKeystore      /*out*/ 
                      )
{
   P6ERR err = eFail;

   *ppInit     = NULL;
   *ppKeystore = NULL;

   // -> the keys used to encrypt/sign the keystore was previously load from file(s) on disk
   if (P6FAILED( err = p6CreateInstance( NULL, &CID_p6Keystore, &IID_p6IKeystoreInit, (P6VOID**)ppInit ))) return err;

   err = (*ppInit)->lpVtbl->queryInterface( (*ppInit), &IID_p6IKeystore, (P6VOID**)ppKeystore );
   if (P6FAILED( err = (*ppInit)->lpVtbl->initialize( (*ppInit), P6KEYSTORE_NOFLAGS, m_pCrypto, SH_SHA256, m_pKey )))
   {
       if (NULL != (*ppKeystore)) (*ppKeystore)->lpVtbl->release( (*ppKeystore) );
       (*ppKeystore) = NULL;
       (*ppInit)->lpVtbl->release( (*ppInit) );
       (*ppInit) = NULL;
       return err;
   }


   /*
    * The first parameter of openSigned() is the file path where to create and access keystore databases.   
    * If NULL, then the keystore location will default to the P6R database directory (i.e., the "db" sub-directory). 
    * If the SKC is installed in a read-only directory then the first parameter will need to be set to
    * an existing read/write directory.
    */
   if (P6FAILED( err = (*ppInit)->lpVtbl->openSigned( (*ppInit), NULL, pKeystoreName )))
   {
       if (NULL != (*ppKeystore)) (*ppKeystore)->lpVtbl->release( (*ppKeystore) );
       (*ppKeystore) = NULL;
       (*ppInit)->lpVtbl->release( (*ppInit) );
       (*ppInit) = NULL;
       return err;
   }

   return eOk;
}


// Read a key from a file and return a properly initialized p6ICryptoKey object back.
//
P6ERR loadKeyFile( const P6WCHAR *pKeyPath, p6ICryptoKey **ppNewKey )
{
   p6ICryptoKeyInit *pKeyInit = NULL;
   P6ERR err = eOk;

   if (P6SUCCEEDED( err = p6CreateCryptoInstance( &CID_p6CryptoKey, &IID_p6ICryptoKeyInit, (P6VOID**)&pKeyInit )))
   {
       if (P6SUCCEEDED( err = pKeyInit->lpVtbl->initialize( pKeyInit, P6CKF_NONE, m_pRandom )))
       {
           if (P6SUCCEEDED( err = pKeyInit->lpVtbl->loadKey( pKeyInit, pKeyPath ))) {
               err = pKeyInit->lpVtbl->queryInterface( pKeyInit, &IID_p6ICryptoKey, (P6VOID**)ppNewKey );
           }
       }
   }
   return err;
}


// Clean up after the example is over
P6VOID freeGlobals()
{
   if (NULL != m_pStr      ) m_pStr->lpVtbl->release( m_pStr );
   if (NULL != m_pRandom   ) m_pRandom->lpVtbl->release( m_pRandom );
   if (NULL != m_pKey      ) m_pKey->lpVtbl->release( m_pKey );
   if (NULL != m_pCrypto   ) m_pCrypto->lpVtbl->release( m_pCrypto );
   if (NULL != m_pStoreInit) m_pStoreInit->lpVtbl->release( m_pStoreInit );
   if (NULL != m_pKeystore ) m_pKeystore->lpVtbl->release( m_pKeystore );
}


// Replace the host name of "fqdn.com" to the fully qualified domain name of the server you wish to connect to.
// Run example 16 first and use its generated "db" directory in this example to obtain an existing keystore to load.
P6ERR initialize()
{
   P6ERR         err                   = eOk;
   P6WCHAR       keyPath[P6MAXPATH+20] = {0};
   p6IDir*       pDir                  = NULL;

   // [A] Right now configuration is hard coded, but could read out of a config file later
   //     m_compatMask is set to zero for TTLV message encoding, set to 2 for XML message encoding, and set to 4 for JSON message encoding 
   //
   if (P6FAILED( err = getSafeString( &m_pStr ))) return err;
   if (P6FAILED( err = getRNG( &m_pRandom ))) return err;

   m_port       = 5696;
   m_compatMask = 0;
   if (P6FAILED( err = m_pStr->lpVtbl->wstrdup( m_pStr, (const P6WCHAR*)P6TEXT("fqdn.com"), &m_pHostName ))) return err;


   // [B] Load an existing key used to encrypt/sign a keystore from disk
   //  -> in this example only one key was used to both encrypt and sign an existing keystore
   if (P6FAILED( err = p6CreateInstance( NULL, &CID_p6Dir, &IID_p6IDir, (P6VOID**)&pDir ))) return err;
   if (P6FAILED( err = pDir->lpVtbl->initialize( pDir ))) {
      pDir->lpVtbl->release( pDir );
      return err;
   }

   keyPath[0] = '\0';
   if (P6FAILED( err = p6GetDirectory( P6D_DATA, keyPath, P6MAXPATH, NULL ))) {
      pDir->lpVtbl->release( pDir );
      return err;
   }
   if (P6FAILED( err = m_pStr->lpVtbl->wstrlcat( m_pStr, keyPath, P6CNTOF(keyPath), (const P6WCHAR*)P6TEXT("/db/KMIP12_keystorekey.txt"), NULL ))) {
      pDir->lpVtbl->release( pDir );
      return err;
   }
   pDir->lpVtbl->release( pDir );

   if (P6FAILED( err = loadKeyFile( keyPath, &m_pKey ))) return err;

   if (P6SUCCEEDED( err )) err = p6CreateCryptoInstance( &CID_p6SymmetricCrypto, &IID_p6ISymmetricCrypto, (P6VOID**)&m_pCrypto );
   if (P6SUCCEEDED( err )) err = m_pCrypto->lpVtbl->initialize( m_pCrypto, P6SYM_NOPADDING, CIPHER_AES_CFB );
   if (P6SUCCEEDED( err )) err = m_pCrypto->lpVtbl->setKey( m_pCrypto, m_pKey );
   if (P6FAILED( err )) return err;


   // [C] Open an existing keystore with keys and certificates provided to us by the KMIP server vendor
   //  -> *** Note *** to test this example run example 16 first can copy the "db" directory with all its contents into the example 17 Debug directory.
   //     That db directory holds an example configured keystore with its associated encryption key.
   return openExistingKeystore( (const P6WCHAR*)P6TEXT("KMIP12_keystore"), &m_pStoreInit, &m_pKeystore );
}


// The client creates an SSL connection to the KMIP server and then makes its requests
// Configure the client on how it is supposed to behave (e.g., protocol version, use TTLV or XML or JSON, how to encode keys PKCSXXX).
//
P6ERR setPreferences( P6KMIP_PREF *pPrefs, const P6WCHAR* pLogDir, P6UINT16 asynchronous, P6UINT32 privateKeyEncoding, P6UINT32 publicKeyEncoding,
                      P6UINT32 symmetricKeyEncoding, P6UINT32 maxBufferSize, P6UINT32 connectTimeout, P6UINT32 sendTimeout, P6UINT32 receiveTimeout,
                      P6UINT32 initialBufCount, P6UINT32 growBufsBy )
{
   m_pStr->lpVtbl->setMem( m_pStr, pPrefs, 0, sizeof( P6KMIP_PREF ));
   pPrefs->pVersion          = "1.2";                 pPrefs->pSubdirectory        = pLogDir;
   pPrefs->asynchronous      = asynchronous;          pPrefs->maxBufferSize        = maxBufferSize;
   pPrefs->connectTimeout    = connectTimeout;        pPrefs->sendTimeout          = sendTimeout;
   pPrefs->receiveTimeout    = receiveTimeout;        pPrefs->initialBufCount      = initialBufCount;
   pPrefs->growBufsBy        = growBufsBy;            pPrefs->privateKeyEncoding   = privateKeyEncoding;
   pPrefs->publicKeyEncoding = publicKeyEncoding;     pPrefs->symmetricKeyEncoding = symmetricKeyEncoding;
   pPrefs->compatibility1    = m_compatMask;
   return eOk;
}


// We just hard code the credentials (i.e., name and password) for a test if needed
P6ERR createSession( p6IKMIPClient *pClient, P6BOOL bWithCredentials )
{
   P6ERR err = eFail;
   P6KMIP_CREDENTIAL credential;

   // -> integration testing setups are often not production quality, some use IP addresses instead of FQDN and thus a non-secure setup
   // -> for production remove the flag P6SSF_VRFY_DISABLEHOSTMATCH
   if (P6FAILED( err = pClient->lpVtbl->setSSLOptions( pClient, NULL, (P6SSF_METHOD_TLS1 | P6SSF_SECURE_CLIENT | P6SSF_SECURE_CLIENT_AUTH | P6SSF_LOG_X509SUBJECTLOOKUPS | P6SSF_VRFY_DISABLEHOSTMATCH)))) return err;

   m_pStr->lpVtbl->setMem( m_pStr, &credential, 0, sizeof( P6KMIP_CREDENTIAL ));
   credential.type = 1;
   credential.value.password.userName.pString = "Fred";
   credential.value.password.userName.length  = 4;
   credential.value.password.password.pString = "password1";
   credential.value.password.password.length  = 9;

   return pClient->lpVtbl->open( pClient, m_pHostName, m_port, (bWithCredentials ? &credential : NULL));
}


// Just return the very first unique identifier from the enumerator
// Some calls can result in multiple unique identifiers returned at the same time (e.g., locate object)
P6ERR extractUniqueId( p6IKMIPStr *pEnum, P6NCSTR *pUniqueId )
{
   P6ERR   err    = eFail;
   P6CHAR* pGUID  = NULL;
   P6NCSTR buffer = { NULL, 0 };

   pUniqueId->pString = NULL;
   pUniqueId->length  = 0;

   err = pEnum->lpVtbl->reset( pEnum );
   err = pEnum->lpVtbl->next( pEnum, &buffer );

   if ( 0 < buffer.length )
   {
        if (NULL == (pGUID = (P6CHAR*)malloc( sizeof(P6CHAR) * (buffer.length + 2) ))) return eNoMemory;
        pGUID[0] = 0;
        buffer.pString  = pGUID;
        buffer.length  += 2;
        if (P6FAILED( err = pEnum->lpVtbl->next( pEnum, &buffer ))) return err;

        pUniqueId->pString = buffer.pString;
        pUniqueId->length  = buffer.length;
   }
   else err = eFail;

   return err;
}


// Given the 'Name' attribute value return the Unique Identifier for the managed object (in this case a symmetric key).
//
P6ERR locateByName( p6IKMIPClient *pClient, P6NCSTR *pKeyId, const P6CHAR *pName, P6UINT32 nameLength )
{
   P6KMIP_RESULT       resultCodes;
   P6KMIP_LOCATEPARAMS locateParams;
   P6KMIP_ATTRIBUTE    attributeList[5];
   p6IKMIPStr          *pUniqueId = NULL;
   P6ERR               err        = eOk;

   m_pStr->lpVtbl->setMem( m_pStr, &resultCodes,  0, sizeof( P6KMIP_RESULT       )); 
   m_pStr->lpVtbl->setMem( m_pStr, &locateParams, 0, sizeof( P6KMIP_LOCATEPARAMS )); 
       
   attributeList[0].type  = KMIP_ATTRIB_OBJECTTYPE;
   attributeList[0].index = 0;
   attributeList[0].value.objectType = KMIP_OBJECT_SYMMETRICKEY;
   attributeList[1].type  = KMIP_ATTRIB_NAME;
   attributeList[1].index = 0;
   attributeList[1].value.name.type = KMIP_NAME_TEXTSTR;
   attributeList[1].value.name.value.pString = pName;
   attributeList[1].value.name.value.length  = nameLength;
   locateParams.attribCount = 2;      
   locateParams.pAttributeList = attributeList;  

   if ( P6FAILED( err = pClient->lpVtbl->locateObject( pClient, locateParams, &pUniqueId, &resultCodes ))) {
        printf("\nCall to locateObject by Name has failed %x\n", err );
   }
   else if (KMIP_RESULT_SUCCESS != resultCodes.resultStatus) {
       printf("\nKMIP server returned an error when calling locateObject by Name [ %x]\n", resultCodes.resultReason);
      err = eFail;
   }
   else
   {    // -> extract the existing key's unique identifier from the enumerator
        if (NULL != pUniqueId)
        {
            err = extractUniqueId( pUniqueId, pKeyId );
          printf("\nExisting key found with Name attribute, has unique Id [%s]\n", pKeyId->pString );
            pUniqueId->lpVtbl->release( pUniqueId );
       }
    }
   return err;
}


// Given the 'Name' attribute of a key replace it with a new symmetric key which becomes associted with the 'Name' attribute.
//
P6ERR reKey( p6IKMIPClient *pClient, const P6CHAR *pName, P6UINT32 nameLength )
{
   P6KMIP_RESULT    resultCodes;
   P6KMIP_KEYPARAMS keyParams;
   P6KMIP_NEWOBJECT newKey;
   P6NCSTR          keyId   = {NULL, 0};
   P6NCSTR          reKeyId = {NULL, 0};
   P6ERR            err     = eOk;

   m_pStr->lpVtbl->setMem( m_pStr, &resultCodes, 0, sizeof( P6KMIP_RESULT    )); 
   m_pStr->lpVtbl->setMem( m_pStr, &keyParams,   0, sizeof( P6KMIP_KEYPARAMS )); 
   m_pStr->lpVtbl->setMem( m_pStr, &newKey,      0, sizeof( P6KMIP_NEWOBJECT )); 

   // -> use the 'Name' to find the server allocated Unique Identifier for the key
   if (P6SUCCEEDED( err = locateByName( pClient, &keyId, pName, nameLength )))
   {
       keyParams.uniqueId = keyId;
       if ( P6FAILED( err = pClient->lpVtbl->reKeyObject( pClient, keyParams, &newKey, &resultCodes ))) {
            printf("\nCall to reKeyObject has failed %x\n", err );
       }
       else if (KMIP_RESULT_SUCCESS != resultCodes.resultStatus) {
           printf("\nKMIP server returned an error when calling reKeyObject [%x]\n", resultCodes.resultReason);
          err = eFail;
       }
       else
       {    // -> extract the new key's unique identifier from the enumerator
            if (NULL != newKey.pUniqueId)
            {
                err = extractUniqueId( newKey.pUniqueId, &reKeyId );
              printf("\nNew key generated replacing old key has unique Id [%s]\n", reKeyId.pString );
                newKey.pUniqueId->lpVtbl->release( newKey.pUniqueId );
           }
        }
   }

   if (NULL != keyId.pString  ) free( (P6VOID*)keyId.pString   );
   if (NULL != reKeyId.pString) free( (P6VOID*)reKeyId.pString );
   return err;
}


// Given the 'Name' attribute of the key currently ineffect find the previous key that the
// KMIP ReKey operation replaced.   The Unique Identifier associated with a key is never changed
// so we return the unique identifier of the replaced key in case the application wants to get its
// key material.
//
// pReplacedObjId must point to a buffer large enough to hold the servers unique identifier
//
P6ERR findReplacedKey( p6IKMIPClient *pClient, const P6CHAR *pName, P6UINT32 nameLength, P6BSTR* pReplacedObjId )
{
   P6NCSTR                 attribNames[2];
   P6CHAR                  tempId[100];
   P6KMIP_RESULT           resultCodes;
   P6KMIP_ATTRIBRESULT     getResult;
   P6KMIP_GETATTRIBPARAMS  attribParams;
   P6KMIP_OBJECT_ATTRIBUTE objAttribute;
   P6UINT32                attribType = 0;
   P6UINT32                i          = 0;
   P6BOOL                  bFound     = P6FALSE;
   P6NCSTR                 keyId      = {NULL, 0};
   P6ERR                   err        = eOk;
   
   if (P6FAILED( err = locateByName( pClient, &keyId, pName, nameLength ))) return err;

   // [A] Follow the key's links to locate the key it replaced
   m_pStr->lpVtbl->setMem( m_pStr, &resultCodes,  0, sizeof( P6KMIP_RESULT  )); 
   m_pStr->lpVtbl->setMem( m_pStr, &getResult,    0, sizeof( P6KMIP_ATTRIBRESULT    )); 
   m_pStr->lpVtbl->setMem( m_pStr, &attribParams, 0, sizeof( P6KMIP_GETATTRIBPARAMS )); 

   attribNames[0].pString = "Link";
   attribNames[0].length  = 4;

   attribParams.uniqueId        = keyId;
   attribParams.attribCount     = 1;
   attribParams.pAttributeNames = attribNames;
   if ( P6FAILED( err = pClient->lpVtbl->getAttributes( pClient, attribParams, &getResult, &resultCodes ))) {
        printf("\nCall to getAttributes has failed %x\n", err );
   }
   else if (KMIP_RESULT_SUCCESS != resultCodes.resultStatus) {
        printf("\nKMIP server returned an error when calling getAttributes [%x]\n", resultCodes.resultReason);
        err = eFail;
   }
   
   if (P6FAILED( err )) {
      if (NULL != keyId.pString) free( (P6VOID*)keyId.pString );
      return err;
   }
   
      
   // [B] There can be several different link attributes associated with a key
   //  -> we want the replaced key link attribute
   if (NULL != getResult.pAttribute)
   {
       while( P6SUCCEEDED( err = getResult.pAttribute->lpVtbl->next( getResult.pAttribute, &attribType )))
       {
          m_pStr->lpVtbl->setMem( m_pStr, &objAttribute, 0, sizeof( P6KMIP_OBJECT_ATTRIBUTE )); 
          if (KMIP_ATTRIB_LINK == attribType) 
          {
              objAttribute.value.link.linkObjectId.pString = tempId;
              objAttribute.value.link.linkObjectId.length  = 100;
              err = getResult.pAttribute->lpVtbl->getValue( getResult.pAttribute, &objAttribute );
              if (P6SUCCEEDED(err) && KMIP_LINK_REPLACED == objAttribute.value.link.linkType) 
           {
                  P6UINT32 linkLength = (P6UINT32) objAttribute.value.link.linkObjectId.length;
               for( i=0; i < linkLength; i++ ) pReplacedObjId->pString[i] = tempId[i];
                pReplacedObjId->length = linkLength;
              bFound = P6TRUE;
              break;
              }
          }
      }
       getResult.pAttribute->lpVtbl->release( getResult.pAttribute );
   }

   if (NULL != keyId.pString) free( (P6VOID*)keyId.pString );
   return (!bFound ? eNotFound : eOk);
}


// Demonstrate how to reKey an existing symmetric key.   Also show how to find the replaced key after
// the reKey operation is complete.
// Main client function
//
P6ERR run( p6IDataStream *pStreamDebug )
{
   P6UCHAR                  uniqueId[100];
   P6KMIP_ATTRIBUTE         attributeList[6];   
   P6KMIP_PREF              preferences;
   P6KMIP_RESULT            resultCodes;
   P6KMIP_NEWOBJECT         newKey;
   P6KMIP_KEYPARAMS         keyParams;
   P6KMIP_TEMPLATEATTRIBUTE attributes;
   P6BSTR                   replacedKeyId = { uniqueId, 100 };
   p6IKMIPClient            *pClient = NULL;  
   P6ERR                    err      = eOk;

   // [1] Initialize, "Rekey_Symmetric" directory created in the configured log directory to hold all logs for this example
   if (P6FAILED( err = p6CreateInstance( NULL, &CID_p6KMIPClient, &IID_p6IKMIPClient, (P6VOID**)&pClient ))) return err;
   setPreferences( &preferences, P6CTEXT("Rekey_Symmetric"), 0, 0, 0, 0, 5000, 2000, 2000, 120000, 2, 2 );
   if (P6FAILED( err = pClient->lpVtbl->initialize( pClient, (P6KMIPFLG_TRACE_MSGS | P6KMIPFLG_TRACE_FORMATXML), m_pKeystore, preferences ))) {   // -> logging messages has to be turned on it defaults off
      pClient->lpVtbl->release( pClient );
      return err;
   }

   // [2] Open a connection to the KMIP server via SSL
   if (P6FAILED( err = createSession( pClient, P6FALSE ))) {
      pClient->lpVtbl->release( pClient );
      return err;
   }

   // -> just for this test create a key so we can reKey it 
   // -> if your key already exists then you don't need to do this createObject call
   m_pStr->lpVtbl->setMem( m_pStr, &resultCodes, 0, sizeof( P6KMIP_RESULT    ));
   m_pStr->lpVtbl->setMem( m_pStr, &newKey,      0, sizeof( P6KMIP_NEWOBJECT ));
   m_pStr->lpVtbl->setMem( m_pStr, &keyParams,   0, sizeof( P6KMIP_KEYPARAMS ));
   m_pStr->lpVtbl->setMem( m_pStr, &attributes,  0, sizeof( P6KMIP_TEMPLATEATTRIBUTE ));
   attributeList[0].type  = KMIP_ATTRIB_CRYPTOALGORITHM;
   attributeList[0].index = 0;
   attributeList[0].value.cryptoAlgorithm = KMIP_AES;
   attributeList[1].type  = KMIP_ATTRIB_CRYPTOLENGTH;
   attributeList[1].index = 0;
   attributeList[1].value.cryptoLength = 128;
   attributeList[2].type  = KMIP_ATTRIB_CRYPTOUSAGEMASK;
   attributeList[2].index = 0;
   attributeList[2].value.cryptoUsageMask = KMIP_USE_ENCRYPT | KMIP_USE_DECRYPT;
   attributeList[3].type  = KMIP_ATTRIB_NAME;
   attributeList[3].index = 0;
   attributeList[3].value.name.type = KMIP_NAME_TEXTSTR;
   attributeList[3].value.name.value.pString = "Place-your-unique-name-here2";
   attributeList[3].value.name.value.length  = 28;
   attributes.attribCount = 4;      
   attributes.pAttributeList = attributeList;  
   keyParams.pAttributes = &attributes;
   if ( P6FAILED( err = pClient->lpVtbl->createKeyObject( pClient, keyParams, &newKey, &resultCodes ))) {
        printf("\nCall to createKeyObject has failed %x\n", err );
   }
   else if (KMIP_RESULT_SUCCESS != resultCodes.resultStatus) {
       printf("\nKMIP server returned an error when calling createKeyObject [%x]\n", resultCodes.resultReason);
       err = eFail;
   }
   else
   {    if (NULL != newKey.pUniqueId) newKey.pUniqueId->lpVtbl->release( newKey.pUniqueId );
   }
 
  
   // [3] Current key's epioc is over time to rekey   
   if (P6SUCCEEDED( err = reKey( pClient, "Place-your-unique-name-here2", 28 ))) 
   {
       // -> the key that was replaced by the reKey KMIP operation still exists, find it
       err = findReplacedKey( pClient, "Place-your-unique-name-here2", 28, &replacedKeyId );
      // -> if successful the replacedKeyId is returned to we could go get the key material here if desired
   }
   
   err = pClient->lpVtbl->close( pClient );
   pClient->lpVtbl->release( pClient );
   return err;
}


//
P6VOID KMIP_ReKey_SymmetricKey( p6IDataStream *pDataStream )
{
   P6CHAR szTmp[32];
   P6ERR  err = eNotInitialized;

   if (P6SUCCEEDED( err = initialize())) {
       err = run( pDataStream );
   }

   freeGlobals();
   printf( "KMIP client result: [ %s ]\n", p6ErrToStr(err, &szTmp[0], P6CHARCNT(szTmp)) );
}


//
int main(int argc,char *argv[])
{
   P6ERR err = eFail;
   p6IDataStream *pDataStream = NULL;

   if (P6FAILED( err = createStream( &pDataStream ))) {
      printf("ERROR: Failed to create a datastream [ %x ]\n", err );
      return 1;
   }

   if ( P6SUCCEEDED( err = p6InitializeLoader( pDataStream, 9, P6SCLF_ALLLOG )))
   {
        KMIP_ReKey_SymmetricKey( pDataStream );
        p6CleanupLoader();
   }
   else printf("ERROR: Failed to initialize the loader [ %x ]\n", err );

   return 0;
}