mongo 2.10.5 → 2.15.1

data/lib/mongo/auth/aws/request.rb

@@ -0,0 +1,286 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Net
+  autoload :HTTP, 'net/http'
+end
+
+module Mongo
+  module Auth
+    class Aws
+
+      # Helper class for working with AWS requests.
+      #
+      # The primary purpose of this class is to produce the canonical AWS
+      # STS request and calculate the signed headers and signature for it.
+      #
+      # @api private
+      class Request
+
+        # The body of the STS GetCallerIdentity request.
+        #
+        # This is currently the only request that this class supports making.
+        STS_REQUEST_BODY = "Action=GetCallerIdentity&Version=2011-06-15".freeze
+
+        # The timeout, in seconds, to use for validating credentials via STS.
+        VALIDATE_TIMEOUT = 10
+
+        # Constructs the request.
+        #
+        # @note By overriding the time, it is possible to create reproducible
+        #   requests (in other words, replay a request).
+        #
+        # @param [ String ] access_key_id The access key id.
+        # @param [ String ] secret_access_key The secret access key.
+        # @param [ String ] session_token The session token for temporary
+        #   credentials.
+        # @param [ String ] host The value of Host HTTP header to use.
+        # @param [ String ] server_nonce The server nonce binary string.
+        # @param [ Time ] time The time of the request.
+        def initialize(access_key_id:, secret_access_key:, session_token: nil,
+          host:, server_nonce:, time: Time.now
+        )
+          @access_key_id = access_key_id
+          @secret_access_key = secret_access_key
+          @session_token = session_token
+          @host = host
+          @server_nonce = server_nonce
+          @time = time
+
+          %i(access_key_id secret_access_key host server_nonce).each do |arg|
+            value = instance_variable_get("@#{arg}")
+            if value.nil? || value.empty?
+              raise Error::InvalidServerAuthResponse, "Value for '#{arg}' is required"
+            end
+          end
+
+          if host && host.length > 255
+              raise Error::InvalidServerAuthHost, "Value for 'host' is too long: #{@host}"
+          end
+        end
+
+        # @return [ String ] access_key_id The access key id.
+        attr_reader :access_key_id
+
+        # @return [ String ] secret_access_key The secret access key.
+        attr_reader :secret_access_key
+
+        # @return [ String ] session_token The session token for temporary
+        #   credentials.
+        attr_reader :session_token
+
+        # @return [ String ] host The value of Host HTTP header to use.
+        attr_reader :host
+
+        # @return [ String ] server_nonce The server nonce binary string.
+        attr_reader :server_nonce
+
+        # @return [ Time ] time The time of the request.
+        attr_reader :time
+
+        # @return [ String ] formatted_time ISO8601-formatted time of the
+        #   request, as would be used in X-Amz-Date header.
+        def formatted_time
+          @formatted_time ||= @time.getutc.strftime('%Y%m%dT%H%M%SZ')
+        end
+
+        # @return [ String ] formatted_date YYYYMMDD formatted date of the request.
+        def formatted_date
+          formatted_time[0, 8]
+        end
+
+        # @return [ String ] region The region of the host, derived from the host.
+        def region
+          # Common case
+          if host == 'sts.amazonaws.com'
+            return 'us-east-1'
+          end
+
+          if host.start_with?('.')
+            raise Error::InvalidServerAuthHost, "Host begins with a period: #{host}"
+          end
+          if host.end_with?('.')
+            raise Error::InvalidServerAuthHost, "Host ends with a period: #{host}"
+          end
+
+          parts = host.split('.')
+          if parts.any? { |part| part.empty? }
+            raise Error::InvalidServerAuthHost, "Host has an empty component: #{host}"
+          end
+
+          if parts.length == 1
+            'us-east-1'
+          else
+            parts[1]
+          end
+        end
+
+        # Returns the scope of the request, per the AWS signature V4 specification.
+        #
+        # @return [ String ] The scope.
+        def scope
+          "#{formatted_date}/#{region}/sts/aws4_request"
+        end
+
+        # Returns the hash containing the headers of the calculated canonical
+        # request.
+        #
+        # @note Not all of these headers are part of the signed headers list,
+        #   the keys of the hash are not necessarily ordered lexicographically,
+        #   and the keys may be in any case.
+        #
+        # @return [ <Hash> ] headers The headers.
+        def headers
+          headers = {
+            'content-length' => STS_REQUEST_BODY.length.to_s,
+            'content-type' => 'application/x-www-form-urlencoded',
+            'host' => host,
+            'x-amz-date' => formatted_time,
+            'x-mongodb-gs2-cb-flag' => 'n',
+            'x-mongodb-server-nonce' => Base64.encode64(server_nonce).gsub("\n", ''),
+          }
+          # Hash#compact is available as of Ruby 2.4
+          if session_token
+            headers['x-amz-security-token'] = session_token
+          end
+          headers
+        end
+
+        # Returns the hash containing the headers of the calculated canonical
+        # request that should be signed, in a ready to sign form.
+        #
+        # The differences between #headers and this method is this method:
+        #
+        # - Removes any headers that are not to be signed. Per AWS
+        #   specifications it should be possible to sign all headers, but
+        #   MongoDB server expects only some headers to be signed and will
+        #   not form the correct request if other headers are signed.
+        # - Lowercases all header names.
+        # - Orders the headers lexicographically in the hash.
+        #
+        # @return [ <Hash> ] headers The headers.
+        def headers_to_sign
+          headers_to_sign = {}
+          headers.keys.sort_by { |k| k.downcase }.each do |key|
+            write_key = key.downcase
+            headers_to_sign[write_key] = headers[key]
+          end
+          headers_to_sign
+        end
+
+        # Returns semicolon-separated list of names of signed headers, per
+        # the AWS signature V4 specification.
+        #
+        # @return [ String ] The signed header list.
+        def signed_headers_string
+          headers_to_sign.keys.join(';')
+        end
+
+        # Returns the canonical request used during calculation of AWS V4
+        # signature.
+        #
+        # @return [ String ] The canonical request.
+        def canonical_request
+          headers = headers_to_sign
+          serialized_headers = headers.map do |k, v|
+            "#{k}:#{v}"
+          end.join("\n")
+          hashed_payload = Digest::SHA256.new.update(STS_REQUEST_BODY).hexdigest
+          "POST\n/\n\n" +
+            # There are two newlines after serialized headers because the
+            # signature V4 specification treats each header as containing the
+            # terminating newline, and there is an additional newline
+            # separating headers from the signed header names.
+            "#{serialized_headers}\n\n" +
+            "#{signed_headers_string}\n" +
+            hashed_payload
+        end
+
+        # Returns the calculated signature of the canonical request, per
+        # the AWS signature V4 specification.
+        #
+        # @return [ String ] The signature.
+        def signature
+          hashed_canonical_request = Digest::SHA256.hexdigest(canonical_request)
+          hashed_body = Digest::SHA256.new.update(STS_REQUEST_BODY).hexdigest
+          string_to_sign = "AWS4-HMAC-SHA256\n" +
+            "#{formatted_time}\n" +
+            "#{scope}\n" +
+            hashed_canonical_request
+          # All of the intermediate HMAC operations are not hex-encoded.
+          mac = hmac("AWS4#{secret_access_key}", formatted_date)
+          mac = hmac(mac, region)
+          mac = hmac(mac, 'sts')
+          signing_key = hmac(mac, 'aws4_request')
+          # Only the final HMAC operation is hex-encoded.
+          hmac_hex(signing_key, string_to_sign)
+        end
+
+        # Returns the value of the Authorization header, per the AWS
+        # signature V4 specification.
+        #
+        # @return [ String ] Authorization header value.
+        def authorization
+          "AWS4-HMAC-SHA256 Credential=#{access_key_id}/#{scope}, SignedHeaders=#{signed_headers_string}, Signature=#{signature}"
+        end
+
+        # Validates the credentials and the constructed request components
+        # by sending a real STS GetCallerIdentity request.
+        #
+        # @return [ Hash ] GetCallerIdentity result.
+        def validate!
+          sts_request = Net::HTTP::Post.new("https://#{host}").tap do |req|
+            headers.each do |k, v|
+              req[k] = v
+            end
+            req['authorization'] = authorization
+            req['accept'] = 'application/json'
+            req.body = STS_REQUEST_BODY
+          end
+          http = Net::HTTP.new(host, 443)
+          http.use_ssl = true
+          http.start do
+            resp = Timeout.timeout(VALIDATE_TIMEOUT, Error::CredentialCheckError, 'GetCallerIdentity request timed out') do
+              http.request(sts_request)
+            end
+            payload = JSON.parse(resp.body)
+            if resp.code != '200'
+              aws_code = payload.fetch('Error').fetch('Code')
+              aws_message = payload.fetch('Error').fetch('Message')
+              msg = "Credential check for user #{access_key_id} failed with HTTP status code #{resp.code}: #{aws_code}: #{aws_message}"
+              msg += '.' unless msg.end_with?('.')
+              msg += " Please check that the credentials are valid, and if they are temporary (i.e. use the session token) that the session token is provided and not expired"
+              raise Error::CredentialCheckError, msg
+            end
+            payload.fetch('GetCallerIdentityResponse').fetch('GetCallerIdentityResult')
+          end
+        end
+
+        private
+
+        def hmac(key, data)
+          OpenSSL::HMAC.digest("SHA256", key, data)
+        end
+
+        def hmac_hex(key, data)
+          OpenSSL::HMAC.hexdigest("SHA256", key, data)
+        end
+
+      end
+    end
+  end
+end

data/lib/mongo/auth/aws.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws < Base
+      MECHANISM = 'MONGODB-AWS'.freeze
+
+      # Log the user in on the current connection.
+      #
+      # @return [ BSON::Document ] The document of the authentication response.
+      def login
+        converse_2_step(connection, conversation)
+      end
+
+      # The AWS credential set.
+      #
+      # @api private
+      Credentials = Struct.new(:access_key_id, :secret_access_key, :session_token)
+    end
+  end
+end
+
+require 'mongo/auth/aws/conversation'
+require 'mongo/auth/aws/credentials_retriever'
+require 'mongo/auth/aws/request'

data/lib/mongo/auth/base.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+
+    # Base class for authenticators.
+    #
+    # Each authenticator is instantiated for authentication over a particular
+    # connection.
+    #
+    # @api private
+    class Base
+
+      # @return [ Mongo::Auth::User ] The user to authenticate.
+      attr_reader :user
+
+      # @return [ Mongo::Connection ] The connection to authenticate over.
+      attr_reader :connection
+
+      # Initializes the authenticator.
+      #
+      # @param [ Auth::User ] user The user to authenticate.
+      # @param [ Mongo::Connection ] connection The connection to authenticate
+      #   over.
+      def initialize(user, connection, **opts)
+        @user = user
+        @connection = connection
+      end
+
+      def conversation
+        @conversation ||= self.class.const_get(:Conversation).new(user, connection)
+      end
+
+      private
+
+      # Performs a single-step conversation on the given connection.
+      def converse_1_step(connection, conversation)
+        msg = conversation.start(connection)
+        dispatch_msg(connection, conversation, msg)
+      end
+
+      # Performs a two-step conversation on the given connection.
+      #
+      # The implementation is very similar to +converse_multi_step+, but
+      # conversations using this method do not involve the server replying
+      # with {done: true} to indicate the end of the conversation.
+      def converse_2_step(connection, conversation)
+        msg = conversation.start(connection)
+        reply_document = dispatch_msg(connection, conversation, msg)
+        msg = conversation.continue(reply_document, connection)
+        dispatch_msg(connection, conversation, msg)
+      end
+
+      # Performs the variable-length SASL conversation on the given connection.
+      #
+      # @param [ Server::Connection ] connection The connection.
+      # @param [ Auth::*::Conversation ] conversation The conversation.
+      # @param [ BSON::Document | nil ] speculative_auth_result The
+      #   value of speculativeAuthenticate field of hello response of
+      #   the handshake on the specified connection.
+      def converse_multi_step(connection, conversation,
+        speculative_auth_result: nil
+      )
+        # Although the SASL conversation in theory can have any number of
+        # steps, all defined authentication methods have a predefined number
+        # of steps, and therefore all of our authenticators have a fixed set
+        # of methods that generate payloads with one method per step.
+        # We support a maximum of 3 total exchanges (start, continue and
+        # finalize) and in practice the first two exchanges always happen.
+        if speculative_auth_result
+          reply_document = speculative_auth_result
+        else
+          msg = conversation.start(connection)
+          reply_document = dispatch_msg(connection, conversation, msg)
+        end
+        msg = conversation.continue(reply_document, connection)
+        reply_document = dispatch_msg(connection, conversation, msg)
+        conversation.process_continue_response(reply_document)
+        unless reply_document[:done]
+          msg = conversation.finalize(connection)
+          reply_document = dispatch_msg(connection, conversation, msg)
+        end
+        unless reply_document[:done]
+          raise Error::InvalidServerAuthResponse,
+            'Server did not respond with {done: true} after finalizing the conversation'
+        end
+        reply_document
+      end
+
+      def dispatch_msg(connection, conversation, msg)
+        context = Operation::Context.new(options: {
+          server_api: connection.options[:server_api],
+        })
+        if server_api = context.server_api
+          msg = msg.maybe_add_server_api(server_api)
+        end
+        reply = connection.dispatch([msg], context)
+        reply_document = reply.documents.first
+        validate_reply!(connection, conversation, reply_document)
+        result = Operation::Result.new(reply, connection.description)
+        connection.update_cluster_time(result)
+        reply_document
+      end
+
+      # Checks whether reply is successful (i.e. has {ok: 1} set) and
+      # raises Unauthorized if not.
+      def validate_reply!(connection, conversation, doc)
+        if doc[:ok] != 1
+          message = Error::Parser.build_message(
+            code: doc[:code],
+            code_name: doc[:codeName],
+            message: doc[:errmsg],
+          )
+          raise Unauthorized.new(user,
+            used_mechanism: self.class.const_get(:MECHANISM),
+            message: message,
+            server: connection.server,
+          )
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/conversation_base.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+
+    # Defines common behavior around authentication conversations between
+    # the client and the server.
+    #
+    # @api private
+    class ConversationBase
+
+      # Create the new conversation.
+      #
+      # @param [ Auth::User ] user The user to authenticate.
+      # @param [ Mongo::Connection ] connection The connection to authenticate
+      #   over.
+      def initialize(user, connection, **opts)
+        @user = user
+        @connection = connection
+      end
+
+      # @return [ Auth::User ] user The user for the conversation.
+      attr_reader :user
+
+      # @return [ Mongo::Connection ] The connection to authenticate over.
+      attr_reader :connection
+
+      # Returns the hash to provide to the server in the handshake
+      # as value of the speculativeAuthenticate key.
+      #
+      # If the auth mechanism does not support speculative authentication,
+      # this method returns nil.
+      #
+      # @return [ Hash | nil ] Speculative authentication document.
+      def speculative_auth_document
+        nil
+      end
+
+      # @return [ Protocol::Message ] The message to send.
+      def build_message(connection, auth_source, selector)
+        if connection && connection.features.op_msg_enabled?
+          selector = selector.dup
+          selector[Protocol::Msg::DATABASE_IDENTIFIER] = auth_source
+          cluster_time = connection.mongos? && connection.cluster_time
+          if cluster_time
+            selector[Operation::CLUSTER_TIME] = cluster_time
+          end
+          Protocol::Msg.new([], {}, selector)
+        else
+          Protocol::Query.new(
+            auth_source,
+            Database::COMMAND,
+            selector,
+            limit: -1,
+          )
+        end
+      end
+
+      def validate_external_auth_source
+        if user.auth_source != '$external'
+          user_name_msg = if user.name
+            " #{user.name}"
+          else
+            ''
+          end
+          mechanism = user.mechanism
+          raise Auth::InvalidConfiguration, "User#{user_name_msg} specifies auth source '#{user.auth_source}', but the only valid auth source for #{mechanism} is '$external'"
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/cr/conversation.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -23,118 +26,50 @@ module Mongo
       # @deprecated MONGODB-CR authentication mechanism is deprecated
       #   as of MongoDB 3.6. Support for it in the Ruby driver will be
       #   removed in driver version 3.0. Please use SCRAM instead.
-      class Conversation
+      # @api private
+      class Conversation < ConversationBase
 
         # The login message base.
         #
         # @since 2.0.0
         LOGIN = { authenticate: 1 }.freeze
 
-        # @return [ Protocol::Message ] reply The current reply in the
-        #   conversation.
-        attr_reader :reply
-
         # @return [ String ] database The database to authenticate against.
         attr_reader :database
 
         # @return [ String ] nonce The initial auth nonce.
         attr_reader :nonce
 
-        # @return [ User ] user The user for the conversation.
-        attr_reader :user
-
-        # Continue the CR conversation. This sends the client final message
-        # to the server after setting the reply from the previous server
-        # communication.
-        #
-        # @example Continue the conversation.
-        #   conversation.continue(reply)
-        #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        # @param [ Mongo::Server::Connection ] connection The connection being authenticated.
-        #
-        # @return [ Protocol::Query ] The next message to send.
-        #
-        # @since 2.0.0
-        def continue(reply, connection = nil)
-          validate!(reply)
-          if connection && connection.features.op_msg_enabled?
-            selector = LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce))
-            selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
-            cluster_time = connection.mongos? && connection.cluster_time
-            selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
-            Protocol::Msg.new([], {}, selector)
-          else
-            Protocol::Query.new(
-              user.auth_source,
-              Database::COMMAND,
-              LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce)),
-              limit: -1
-            )
-          end
-        end
-
-        # Finalize the CR conversation. This is meant to be iterated until
-        # the provided reply indicates the conversation is finished.
-        #
-        # @example Finalize the conversation.
-        #   conversation.finalize(reply)
-        #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        #
-        # @return [ Protocol::Query ] The next message to send.
-        #
-        # @since 2.0.0
-        def finalize(reply, connection = nil)
-          validate!(reply)
-        end
-
         # Start the CR conversation. This returns the first message that
         # needs to be sent to the server.
         #
-        # @example Start the conversation.
-        #   conversation.start
+        # @param [ Server::Connection ] connection The connection being
+        #   authenticated.
         #
-        # @return [ Protocol::Query ] The first CR conversation message.
+        # @return [ Protocol::Message ] The first CR conversation message.
         #
         # @since 2.0.0
-        def start(connection = nil)
-          if connection && connection.features.op_msg_enabled?
-            selector = Auth::GET_NONCE.merge(Protocol::Msg::DATABASE_IDENTIFIER => user.auth_source)
-            cluster_time = connection.mongos? && connection.cluster_time
-            selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
-            Protocol::Msg.new([], {}, selector)
-          else
-            Protocol::Query.new(
-              user.auth_source,
-              Database::COMMAND,
-              Auth::GET_NONCE,
-              limit: -1)
-          end
+        def start(connection)
+          selector = Auth::GET_NONCE
+          build_message(connection, user.auth_source, selector)
         end
 
-        # Create the new conversation.
+        # Continue the CR conversation. This sends the client final message
+        # to the server after setting the reply from the previous server
+        # communication.
         #
-        # @example Create the new conversation.
-        #   Conversation.new(user, "admin")
+        # @param [ BSON::Document ] reply_document The reply document of the
+        #   previous message.
+        # @param [ Mongo::Server::Connection ] connection The connection being
+        #   authenticated.
         #
-        # @param [ Auth::User ] user The user to converse about.
+        # @return [ Protocol::Message ] The next message to send.
         #
         # @since 2.0.0
-        def initialize(user)
-          @user = user
-        end
-
-        private
-
-        def validate!(reply)
-          if reply.documents[0][Operation::Result::OK] != 1
-            raise Unauthorized.new(user, MECHANISM)
-          end
-          @nonce = reply.documents[0][Auth::NONCE]
-          @reply = reply
+        def continue(reply_document, connection)
+          @nonce = reply_document[Auth::NONCE]
+          selector = LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce))
+          build_message(connection, user.auth_source, selector)
         end
       end
     end