mongo 2.10.5 → 2.15.1

data/lib/mongo/address.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.
@@ -15,6 +18,7 @@
 require 'mongo/address/ipv4'
 require 'mongo/address/ipv6'
 require 'mongo/address/unix'
+require 'mongo/address/validator'
 
 module Mongo
 
@@ -65,11 +69,16 @@ module Mongo
     # @param [ String ] seed The provided address.
     # @param [ Hash ] options The address options.
     #
+    # @option options [ Float ] :connect_timeout Connect timeout.
+    #
     # @since 2.0.0
     def initialize(seed, options = {})
+      if seed.nil?
+        raise ArgumentError, "address must be not nil"
+      end
       @seed = seed
       @host, @port = parse_host_port
-      @options = options
+      @options = Hash[options.map { |k, v| [k.to_sym, v] }]
     end
 
     # @return [ String ] seed The seed address.
@@ -81,6 +90,9 @@ module Mongo
     # @return [ Integer ] port The port.
     attr_reader :port
 
+    # @api private
+    attr_reader :options
+
     # Check equality of the address to another.
     #
     # @example Check address equality.
@@ -134,28 +146,108 @@ module Mongo
       "#<Mongo::Address:0x#{object_id} address=#{to_s}>"
     end
 
-    # Get a socket for the provided address, given the options.
-    #
-    # The address the socket connects to is determined by the algorithm described in the
-    # #intialize_resolver! documentation. Each time this method is called, #initialize_resolver!
-    # will be called, meaning that a new hostname lookup will occur. This is done so that any
-    # changes to which addresses the hostname resolves to will be picked up even if a socket has
-    # been connected to it before.
+    # Get a socket for the address stored in this object, given the options.
+    #
+    # If the address stored in this object looks like a Unix path, this method
+    # returns a Unix domain socket for this path.
+    #
+    # Otherwise, this method attempts to resolve the address stored in
+    # this object to IPv4 and IPv6 addresses using +Socket#getaddrinfo+, then
+    # connects to the resulting addresses and returns the socket of the first
+    # successful connection. The order in which address families (IPv4/IPV6)
+    # are tried is the same order in which the addresses are returned by
+    # +getaddrinfo+, and is determined by the host system.
+    #
+    # Name resolution is performed on each +socket+ call. This is done so that
+    # any changes to which addresses the host names used as seeds or in
+    # server configuration resolve to are immediately noticed by the driver,
+    # even if a socket has been connected to the affected host name/address
+    # before. However, note that DNS TTL values may still affect when a change
+    # to a host address is noticed by the driver.
+    #
+    # This method propagates any exceptions raised during DNS resolution and
+    # subsequent connection attempts. In case of a host name resolving to
+    # multiple IP addresses, the error raised by the last attempt is propagated
+    # to the caller. This method does not map exceptions to Mongo::Error
+    # subclasses, and may raise any subclass of Exception.
     #
     # @example Get a socket.
     #   address.socket(5, :ssl => true)
     #
     # @param [ Float ] socket_timeout The socket timeout.
-    # @param [ Hash ] ssl_options SSL options.
-    # @param [ Hash ] options The options.
-    #
-    # @option options [ Float ] :connect_timeout Connect timeout.
-    #
-    # @return [ Mongo::Socket::SSL, Mongo::Socket::TCP, Mongo::Socket::Unix ] The socket.
+    # @param [ Hash ] opts The options.
+    #
+    # @option opts [ Float ] :connect_timeout Connect timeout.
+    # @option opts [ true | false ] :ssl Whether to use SSL.
+    # @option opts [ String ] :ssl_ca_cert
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ Array<OpenSSL::X509::Certificate> ] :ssl_ca_cert_object
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ String ] :ssl_ca_cert_string
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ String ] :ssl_cert
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ OpenSSL::X509::Certificate ] :ssl_cert_object
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ String ] :ssl_cert_string
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ String ] :ssl_key
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ OpenSSL::PKey ] :ssl_key_object
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ String ] :ssl_key_pass_phrase
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ String ] :ssl_key_string
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ true, false ] :ssl_verify
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ true, false ] :ssl_verify_certificate
+    #   Same as the corresponding Client/Socket::SSL option.
+    # @option opts [ true, false ] :ssl_verify_hostname
+    #   Same as the corresponding Client/Socket::SSL option.
+    #
+    # @return [ Mongo::Socket::SSL | Mongo::Socket::TCP | Mongo::Socket::Unix ]
+    #   The socket.
+    #
+    # @raise [ Mongo::Error ] If network connection failed.
     #
     # @since 2.0.0
-    def socket(socket_timeout, ssl_options = {}, options = {})
-      create_resolver(ssl_options).socket(socket_timeout, ssl_options, options)
+    # @api private
+    def socket(socket_timeout, opts = {})
+      opts = {
+        connect_timeout: Server::CONNECT_TIMEOUT,
+      }.update(options).update(Hash[opts.map { |k, v| [k.to_sym, v] }])
+
+      map_exceptions do
+        if seed.downcase =~ Unix::MATCH
+          specific_address = Unix.new(seed.downcase)
+          return specific_address.socket(socket_timeout, opts)
+        end
+
+        # When the driver connects to "localhost", it only attempts IPv4
+        # connections. When the driver connects to other hosts, it will
+        # attempt both IPv4 and IPv6 connections.
+        family = (host == LOCALHOST) ? ::Socket::AF_INET : ::Socket::AF_UNSPEC
+        error = nil
+        # Sometimes Socket#getaddrinfo returns the same info more than once
+        # (multiple identical items in the returned array). It does not make
+        # sense to try to connect to the same address more than once, thus
+        # eliminate duplicates here.
+        infos = ::Socket.getaddrinfo(host, nil, family, ::Socket::SOCK_STREAM)
+        results = infos.map do |info|
+          [info[4], info[3]]
+        end.uniq
+        results.each do |family, address_str|
+          begin
+            specific_address = FAMILY_MAP[family].new(address_str, port, host)
+            socket = specific_address.socket(socket_timeout, opts)
+            return socket
+          rescue IOError, SystemCallError, Error::SocketTimeoutError, Error::SocketError => e
+            error = e
+          end
+        end
+        raise error
+      end
     end
 
     # Get the address as a string.
@@ -178,37 +270,8 @@ module Mongo
       end
     end
 
-    # @api private
-    def connect_timeout
-      @connect_timeout ||= @options[:connect_timeout] || Server::CONNECT_TIMEOUT
-    end
-
     private
 
-    # To determine which address the socket will connect to, the driver will
-    # attempt to connect to each IP address returned by Socket::getaddrinfo in
-    # sequence. Once a successful connection is made, a resolver with that
-    # IP address specified is returned. If no successful connection is
-    # made, the error made by the last connection attempt is raised.
-    def create_resolver(ssl_options)
-      return Unix.new(seed.downcase) if seed.downcase =~ Unix::MATCH
-
-      family = (host == LOCALHOST) ? ::Socket::AF_INET : ::Socket::AF_UNSPEC
-      error = nil
-      ::Socket.getaddrinfo(host, nil, family, ::Socket::SOCK_STREAM).each do |info|
-        begin
-          specific_address = FAMILY_MAP[info[4]].new(info[3], port, host)
-          socket = specific_address.socket(
-            connect_timeout, ssl_options, connect_timeout: connect_timeout)
-          socket.close
-          return specific_address
-        rescue IOError, SystemCallError, Error::SocketTimeoutError, Error::SocketError => e
-          error = e
-        end
-      end
-      raise error
-    end
-
     def parse_host_port
       address = seed.downcase
       case address
@@ -217,5 +280,17 @@ module Mongo
         else IPv4.parse(address)
       end
     end
+
+    def map_exceptions
+      begin
+        yield
+      rescue Errno::ETIMEDOUT => e
+        raise Error::SocketTimeoutError, "#{e.class}: #{e} (for #{self})"
+      rescue IOError, SystemCallError => e
+        raise Error::SocketError, "#{e.class}: #{e} (for #{self})"
+      rescue OpenSSL::SSL::SSLError => e
+        raise Error::SocketError, "#{e.class}: #{e} (for #{self})"
+      end
+    end
   end
 end

data/lib/mongo/auth/aws/conversation.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws
+
+      # Defines behavior around a single MONGODB-AWS conversation between the
+      # client and server.
+      #
+      # @see https://github.com/mongodb/specifications/blob/master/source/auth/auth.rst#mongodb-aws
+      #
+      # @api private
+      class Conversation < SaslConversationBase
+
+        # Continue the AWS conversation. This sends the client final message
+        # to the server after setting the reply from the previous server
+        # communication.
+        #
+        # @param [ BSON::Document ] reply_document The reply document of the
+        #   previous message.
+        # @param [ Server::Connection ] connection The connection being
+        #   authenticated.
+        #
+        # @return [ Protocol::Message ] The next message to send.
+        def continue(reply_document, connection)
+          @conversation_id = reply_document[:conversationId]
+          payload = reply_document[:payload].data
+          payload = BSON::Document.from_bson(BSON::ByteBuffer.new(payload))
+          @server_nonce = payload[:s].data
+          validate_server_nonce!
+          @sts_host = payload[:h]
+          unless (1..255).include?(@sts_host.bytesize)
+            raise Error::InvalidServerAuthConfiguration, "STS host name length is not in 1..255 bytes range: #{@sts_host}"
+          end
+
+          selector = CLIENT_CONTINUE_MESSAGE.merge(
+            payload: BSON::Binary.new(client_final_payload),
+            conversationId: conversation_id,
+          )
+          build_message(connection, user.auth_source, selector)
+        end
+
+        private
+
+        # @return [ String ] The server nonce.
+        attr_reader :server_nonce
+
+        # Get the id of the conversation.
+        #
+        # @return [ Integer ] The conversation id.
+        attr_reader :conversation_id
+
+        def client_first_payload
+          {payload: client_first_message}
+        end
+
+        def client_first_data
+          {
+            r: BSON::Binary.new(client_nonce),
+            p: 110,
+          }
+        end
+
+        def client_first_payload
+          client_first_data.to_bson.to_s
+        end
+
+        def wrap_data(data)
+          BSON::Binary.new(data.to_bson.to_s)
+        end
+
+        def client_nonce
+          @client_nonce ||= SecureRandom.random_bytes(32)
+        end
+
+        def client_final_payload
+          credentials = CredentialsRetriever.new(user).credentials
+          request = Request.new(
+            access_key_id: credentials.access_key_id,
+            secret_access_key: credentials.secret_access_key,
+            session_token: credentials.session_token,
+            host: @sts_host,
+            server_nonce: server_nonce,
+          )
+
+          # Uncomment this line to validate obtained credentials on the
+          # client side prior to sending them to the server.
+          # This generally produces informative diagnostics as to why
+          # the credentials are not valid (e.g., they could be expired)
+          # whereas the server normally does not elaborate on why
+          # authentication failed (but the reason usually is logged into
+          # the server logs).
+          #
+          # Note that credential validation requires that the client is
+          # able to access AWS STS. If this is not permitted by firewall
+          # rules, validation will fail but credentials may be perfectly OK
+          # and the server may be able to authenticate using them just fine
+          # (provided the server is allowed to communicate with STS).
+          #request.validate!
+
+          payload = {
+            a: request.authorization,
+            d: request.formatted_time,
+          }
+          if credentials.session_token
+            payload[:t] = credentials.session_token
+          end
+          payload.to_bson.to_s
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/aws/credentials_retriever.rb

@@ -0,0 +1,222 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws
+
+      # Retrieves AWS credentials from a variety of sources.
+      #
+      # This class provides for AWS credentials retrieval from:
+      # - the passed user (which receives the credentials passed to the
+      #   client via URI options and Ruby options)
+      # - AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
+      #   environment variables (commonly used by AWS SDKs and various tools,
+      #   as well as AWS Lambda)
+      # - EC2 metadata endpoint
+      # - ECS metadata endpoint
+      #
+      # The sources listed above are consulted in the order specified.
+      # The first source that contains any of the three credential components
+      # (access key id, secret access key or session token) is used.
+      # The credential components must form a valid set if any of the components
+      # is specified; meaning, access key id and secret access key must
+      # always be provided together, and if a session token is provided
+      # the key id and secret key must also be provided. If a source provides
+      # partial credentials, credential retrieval fails with an exception.
+      #
+      # @api private
+      class CredentialsRetriever
+
+        # Timeout for metadata operations, in seconds.
+        #
+        # The auth spec suggests a 10 second timeout but this seems
+        # excessively long given that the endpoint is essentially local.
+        METADATA_TIMEOUT = 5
+
+        def initialize(user = nil)
+          @user = user
+        end
+
+        # @return [ Auth::User | nil ] The user object, if one was provided.
+        attr_reader :user
+
+        # Retrieves a valid set of credentials, if possible, or raises
+        # Auth::InvalidConfiguration.
+        #
+        # @return [ Auth::Aws::Credentials ] A valid set of credentials.
+        #
+        # @raise Auth::InvalidConfiguration if credentials could not be
+        #   retrieved for any reason, or if a source contains an invalid set
+        #   of credentials.
+        def credentials
+          if user
+            credentials = Credentials.new(
+              user.name,
+              user.password,
+              user.auth_mech_properties['aws_session_token'],
+            )
+
+            if credentials_valid?(credentials, 'Mongo::Client URI or Ruby options')
+              return credentials
+            end
+          end
+
+          credentials = Credentials.new(
+            ENV['AWS_ACCESS_KEY_ID'],
+            ENV['AWS_SECRET_ACCESS_KEY'],
+            ENV['AWS_SESSION_TOKEN'],
+          )
+
+          if credentials_valid?(credentials, 'environment variables')
+            return credentials
+          end
+
+          credentials = ecs_metadata_credentials
+
+          if credentials && credentials_valid?(credentials, 'ECS task metadata')
+            return credentials
+          end
+
+          credentials = ec2_metadata_credentials
+
+          if credentials && credentials_valid?(credentials, 'EC2 instance metadata')
+            return credentials
+          end
+
+          raise Auth::InvalidConfiguration,
+            "Could not locate AWS credentials (checked Client URI and Ruby options, environment variables, ECS and EC2 metadata)"
+        end
+
+        private
+
+        # Returns credentials from the EC2 metadata endpoint. The credentials
+        # could be empty, partial or invalid.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed.
+        def ec2_metadata_credentials
+          http = Net::HTTP.new('169.254.169.254')
+          req = Net::HTTP::Put.new('/latest/api/token',
+            # The TTL is required in order to obtain the metadata token.
+            {'x-aws-ec2-metadata-token-ttl-seconds' => '30'})
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http.request(req)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          metadata_token = resp.body
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http_get(http, '/latest/meta-data/iam/security-credentials', metadata_token)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          role_name = resp.body
+          escaped_role_name = CGI.escape(role_name).gsub('+', '%20')
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http_get(http, "/latest/meta-data/iam/security-credentials/#{escaped_role_name}", metadata_token)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          payload = JSON.parse(resp.body)
+          unless payload['Code'] == 'Success'
+            return nil
+          end
+          Credentials.new(
+            payload['AccessKeyId'],
+            payload['SecretAccessKey'],
+            payload['Token'],
+          )
+        # When trying to use the EC2 metadata endpoint on ECS:
+        # Errno::EINVAL: Failed to open TCP connection to 169.254.169.254:80 (Invalid argument - connect(2) for "169.254.169.254" port 80)
+        rescue ::Timeout::Error, IOError, SystemCallError
+          return nil
+        end
+
+        def ecs_metadata_credentials
+          relative_uri = ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
+          if relative_uri.nil? || relative_uri.empty?
+            return nil
+          end
+
+          http = Net::HTTP.new('169.254.170.2')
+          # Per https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+          # the value in AWS_CONTAINER_CREDENTIALS_RELATIVE_URI includes
+          # the leading slash.
+          # The current language in MONGODB-AWS specification implies that
+          # a leading slash must be added by the driver, but this is not
+          # in fact needed.
+          req = Net::HTTP::Get.new(relative_uri)
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http.request(req)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          payload = JSON.parse(resp.body)
+          Credentials.new(
+            payload['AccessKeyId'],
+            payload['SecretAccessKey'],
+            payload['Token'],
+          )
+        rescue ::Timeout::Error, IOError, SystemCallError
+          return nil
+        end
+
+        def http_get(http, uri, metadata_token)
+          req = Net::HTTP::Get.new(uri,
+            {'x-aws-ec2-metadata-token' => metadata_token})
+          http.request(req)
+        end
+
+        # Checks whether the credentials provided are valid.
+        #
+        # Returns true if they are valid, false if they are empty, and
+        # raises Auth::InvalidConfiguration if the credentials are
+        # incomplete (i.e. some of the components are missing).
+        def credentials_valid?(credentials, source)
+          unless credentials.access_key_id || credentials.secret_access_key ||
+            credentials.session_token
+          then
+            return false
+          end
+
+          if credentials.access_key_id || credentials.secret_access_key
+            if credentials.access_key_id && !credentials.secret_access_key
+              raise Auth::InvalidConfiguration,
+                "Access key ID is provided without secret access key (source: #{source})"
+            end
+
+            if credentials.secret_access_key && !credentials.access_key_id
+              raise Auth::InvalidConfiguration,
+                "Secret access key is provided without access key ID (source: #{source})"
+            end
+
+          elsif credentials.session_token
+            raise Auth::InvalidConfiguration,
+              "Session token is provided without access key ID or secret access key (source: #{source})"
+          end
+
+          true
+        end
+      end
+    end
+  end
+end