mongo 2.11.3 → 2.11.4

data/spec/mongo/socket/ssl_spec.rb

@@ -3,27 +3,18 @@ require 'spec_helper'
 # this test performs direct network connections without retries.
 # In case of intermittent network issues, retry the entire failing test.
 describe Mongo::Socket::SSL, retry: 3 do
+  clean_slate_for_all
   require_tls
 
-  let(:address) do
-    default_address.tap do
-      ClientRegistry.instance.close_all_clients
-    end
-  end
-
-  let!(:resolver) do
-    address.send(:create_resolver, {})
-  end
-
-  let(:socket_timeout) do
-    1
-  end
+  let(:host_name) { 'localhost' }
 
   let(:socket) do
-    resolver.socket(socket_timeout, options)
+    described_class.new('127.0.0.1', default_address.port,
+      host_name, 1, :INET, ssl_options.merge(
+        connect_timeout: 2.4))
   end
 
-  let(:options) do
+  let(:ssl_options) do
     SpecConfig.instance.ssl_options
   end
 
@@ -82,7 +73,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when a certificate and key are provided as strings' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_string => cert_string,
@@ -99,7 +90,7 @@ describe Mongo::Socket::SSL, retry: 3 do
     context 'when certificate and an encrypted key are provided as strings' do
       require_local_tls
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_string => cert_string,
@@ -116,7 +107,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when a certificate and key are provided as objects' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_object => cert_object,
@@ -132,7 +123,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when the certificate is specified using both a file and a PEM-encoded string' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_cert_string => 'This is a random string, not a PEM-encoded certificate'
         )
@@ -146,7 +137,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when the certificate is specified using both a file and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_cert_object => 'This is a string, not a certificate'
         )
@@ -160,7 +151,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when the certificate is specified using both a PEM-encoded string and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_string => cert_string,
@@ -178,7 +169,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when the key is specified using both a file and a PEM-encoded string' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_key_string => 'This is a normal string, not a PEM-encoded key'
         )
@@ -192,7 +183,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when the key is specified using both a file and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_cert_object => 'This is a string, not a key'
         )
@@ -206,7 +197,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when the key is specified using both a PEM-encoded string and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert => SpecConfig.instance.client_cert_path,
@@ -224,7 +215,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when a certificate is passed, but it is not of the right type' do
 
-      let(:options) do
+      let(:ssl_options) do
         cert = "This is a string, not an X.509 Certificate"
         {
           :ssl => true,
@@ -247,38 +238,27 @@ describe Mongo::Socket::SSL, retry: 3 do
       end
 
       context 'when the hostname is verified' do
-        it 'raises an error' do
-          error = nil
-          begin
-            described_class.new(
-              resolver.host,
-              resolver.port,
-              host_name,
-              30,
-              ::Socket::PF_INET,
-              options.merge(ssl_verify: false, ssl_verify_hostname: true)
-            )
-          rescue => e
-            error = e
-          end
 
-          expect(error).to be_a(Mongo::Error::SocketError)
-          expect(error.message).to eq('SSL handshake failed due to a hostname mismatch.')
+        let(:ssl_options) do
+          SpecConfig.instance.ssl_options.merge(ssl_verify: false, ssl_verify_hostname: true)
+        end
+
+        it 'raises an error' do
+          lambda do
+            socket
+          end.should raise_error(Mongo::Error::SocketError, /SSL handshake failed due to a hostname mismatch/)
         end
       end
 
       context 'when the hostname is not verified' do
-        it 'raises an error' do
-          expect {
-            described_class.new(
-              resolver.host,
-              resolver.port,
-              host_name,
-              30,
-              ::Socket::PF_INET,
-              options.merge(ssl_verify: false, ssl_verify_hostname: false)
-            )
-          }.not_to raise_error
+        let(:ssl_options) do
+          SpecConfig.instance.ssl_options.merge(ssl_verify: false, ssl_verify_hostname: false)
+        end
+
+        it 'does not raise an error' do
+          lambda do
+            socket
+          end.should_not raise_error
         end
       end
     end
@@ -288,7 +268,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'when a key is passed, but it is not of the right type' do
 
-        let(:options) do
+        let(:ssl_options) do
           key = "This is a string not a key"
           {
               :ssl => true,
@@ -315,7 +295,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'when a key is passed, but it is not of the right type' do
 
-        let(:options) do
+        let(:ssl_options) do
           key = "This is a string not a key"
           {
               :ssl => true,
@@ -347,35 +327,82 @@ describe Mongo::Socket::SSL, retry: 3 do
       end
     end
 
-    context 'when a bad certificate is provided' do
+    context 'when a bad certificate/key is provided' do
 
-      let(:options) do
-        super().merge(
-          :ssl_key => COMMAND_MONITORING_TESTS.first
-        )
+      shared_examples_for 'raises an exception' do
+        it 'raises an exception' do
+          expect do
+            socket
+          end.to raise_exception(*expected_exception)
+        end
       end
 
-      let(:expected_exception) do
-        if SpecConfig.instance.jruby?
-          # java.lang.ClassCastException: org.bouncycastle.asn1.DERApplicationSpecific cannot be cast to org.bouncycastle.asn1.ASN1Sequence
-          # https://github.com/jruby/jruby-openssl/issues/171
-          Exception
-        else
-          # mri
-          if RUBY_VERSION >= '2.4.0'
-            # OpenSSL::PKey::PKeyError: Could not parse PKey: no start line
-            OpenSSL::OpenSSLError
-          else
-            # ArgumentError: Could not parse PKey: no start line
-            ArgumentError
+      context 'mri' do
+        only_mri
+
+        context 'when a bad certificate is provided' do
+
+          let(:expected_exception) do
+            # OpenSSL::X509::CertificateError: nested asn1 error
+            [OpenSSL::OpenSSLError, /asn1 error/i]
+          end
+
+          let(:ssl_options) do
+            super().merge(
+              :ssl_cert => COMMAND_MONITORING_TESTS.first,
+              :ssl_key => nil,
+            )
+          end
+
+          it_behaves_like 'raises an exception'
+        end
+
+        context 'when a bad key is provided' do
+
+          let(:expected_exception) do
+            if RUBY_VERSION >= '2.4.0'
+              # OpenSSL::PKey::PKeyError: Could not parse PKey: no start line
+              [OpenSSL::OpenSSLError, /Could not parse PKey/]
+            else
+              # ArgumentError: Could not parse PKey: no start line
+              [ArgumentError, /Could not parse PKey/]
+            end
+          end
+
+          let(:ssl_options) do
+            super().merge(
+              :ssl_cert => nil,
+              :ssl_key => COMMAND_MONITORING_TESTS.first,
+            )
           end
+
+          it_behaves_like 'raises an exception'
         end
       end
 
-      it 'raises an exception' do
-        expect do
-          socket
-        end.to raise_exception(expected_exception)
+      context 'jruby' do
+        require_jruby
+
+        # On JRuby the key does not appear to be parsed, therefore only
+        # specifying the bad certificate produces an error.
+
+        context 'when a bad certificate is provided' do
+
+          let(:ssl_options) do
+            super().merge(
+              :ssl_cert => COMMAND_MONITORING_TESTS.first,
+              :ssl_key => nil,
+            )
+          end
+
+          let(:expected_exception) do
+            # java.lang.ClassCastException: org.bouncycastle.asn1.DERApplicationSpecific cannot be cast to org.bouncycastle.asn1.ASN1Sequence
+            # OpenSSL::X509::CertificateError: parsing issue: malformed PEM data: no header found
+            [OpenSSL::OpenSSLError, /malformed pem data/i]
+          end
+
+          it_behaves_like 'raises an exception'
+        end
       end
     end
 
@@ -384,7 +411,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'as a path to a file' do
 
-        let(:options) do
+        let(:ssl_options) do
           super().merge(
             :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
             :ssl_verify => true
@@ -398,7 +425,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'as a string containing the PEM-encoded certificate' do
 
-        let(:options) do
+        let(:ssl_options) do
           super().merge(
             :ssl_ca_cert_string => ca_cert_string,
             :ssl_verify => true
@@ -411,7 +438,7 @@ describe Mongo::Socket::SSL, retry: 3 do
       end
 
       context 'as an array of Certificate objects' do
-        let(:options) do
+        let(:ssl_options) do
           cert = [OpenSSL::X509::Certificate.new(ca_cert_string)]
           super().merge(
             :ssl_ca_cert_object => cert,
@@ -426,7 +453,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'both as a file and a PEM-encoded parameter' do
 
-        let(:options) do
+        let(:ssl_options) do
           super().merge(
             :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
             :ssl_ca_cert_string => 'This is a string, not a certificate',
@@ -442,7 +469,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'both as a file and as object parameter' do
 
-        let(:options) do
+        let(:ssl_options) do
           super().merge(
             :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
             :ssl_ca_cert_object => 'This is a string, not an array of certificates',
@@ -457,7 +484,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'both as a PEM-encoded string and as object parameter' do
 
-        let(:options) do
+        let(:ssl_options) do
           cert = File.read(SpecConfig.instance.local_ca_cert_path)
           super().merge(
             :ssl_ca_cert_string => cert,
@@ -480,11 +507,11 @@ describe Mongo::Socket::SSL, retry: 3 do
       end
 
       let(:connection) do
-        Mongo::Server::Connection.new(server, options.merge(socket_timeout: 2))
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
       end
 
       context 'as a file' do
-        let(:options) do
+        let(:ssl_options) do
           SpecConfig.instance.test_options.merge(
             ssl: true,
             ssl_cert: SpecConfig.instance.client_cert_path,
@@ -511,11 +538,11 @@ describe Mongo::Socket::SSL, retry: 3 do
       end
 
       let(:connection) do
-        Mongo::Server::Connection.new(server, options.merge(socket_timeout: 2))
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
       end
 
       context 'as a file' do
-        let(:options) do
+        let(:ssl_options) do
           SpecConfig.instance.test_options.merge(
             ssl: true,
             ssl_cert: SpecConfig.instance.client_cert_path,
@@ -537,7 +564,7 @@ describe Mongo::Socket::SSL, retry: 3 do
     context 'when a CA certificate is not provided' do
       require_local_tls
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_verify => true
         )
@@ -566,12 +593,12 @@ describe Mongo::Socket::SSL, retry: 3 do
       end
 
       let(:connection) do
-        Mongo::Server::Connection.new(server, options.merge(socket_timeout: 2))
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
       end
 
       context 'as a path to a file' do
         context 'standalone' do
-          let(:options) do
+          let(:ssl_options) do
             SpecConfig.instance.test_options.merge(
               ssl_cert: SpecConfig.instance.second_level_cert_path,
               ssl_key: SpecConfig.instance.second_level_key_path,
@@ -581,6 +608,13 @@ describe Mongo::Socket::SSL, retry: 3 do
           end
 
           it 'fails' do
+            # This test provides a second level client certificate to the
+            # server *without* providing the intermediate certificate.
+            # If the server performs certificate verification, it will
+            # reject the connection (seen from the driver as a SocketError)
+            # and the test will succeed. If the server does not perform
+            # certificate verification, it will accept the connection,
+            # no SocketError will be raised and the test will fail.
             connection
             expect do
               connection.connect!
@@ -593,7 +627,7 @@ describe Mongo::Socket::SSL, retry: 3 do
           # https://github.com/jruby/jruby-openssl/issues/181
           only_mri
 
-          let(:options) do
+          let(:ssl_options) do
             SpecConfig.instance.test_options.merge(
               ssl: true,
               ssl_cert: SpecConfig.instance.second_level_cert_bundle_path,
@@ -614,7 +648,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
       context 'as a string' do
         context 'standalone' do
-          let(:options) do
+          let(:ssl_options) do
             SpecConfig.instance.test_options.merge(
               ssl_cert: nil,
               ssl_cert_string: File.read(SpecConfig.instance.second_level_cert_path),
@@ -638,7 +672,7 @@ describe Mongo::Socket::SSL, retry: 3 do
           # https://github.com/jruby/jruby-openssl/issues/181
           only_mri
 
-          let(:options) do
+          let(:ssl_options) do
             SpecConfig.instance.test_options.merge(
               ssl: true,
               ssl_cert: nil,
@@ -668,11 +702,11 @@ describe Mongo::Socket::SSL, retry: 3 do
       end
 
       let(:connection) do
-        Mongo::Server::Connection.new(server, options.merge(socket_timeout: 2))
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
       end
 
-      let(:options) do
-        SpecConfig.instance.test_options.merge(
+      let(:ssl_options) do
+        SpecConfig.instance.ssl_options.merge(
           ssl: true,
           ssl_cert: SpecConfig.instance.client_pem_path,
           ssl_key: SpecConfig.instance.client_pem_path,
@@ -692,7 +726,7 @@ describe Mongo::Socket::SSL, retry: 3 do
     context 'when ssl_verify is not specified' do
       require_local_tls
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path
         ).tap { |options| options.delete(:ssl_verify) }
@@ -706,7 +740,7 @@ describe Mongo::Socket::SSL, retry: 3 do
     context 'when ssl_verify is true' do
       require_local_tls
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
           :ssl_verify => true
@@ -720,7 +754,7 @@ describe Mongo::Socket::SSL, retry: 3 do
 
     context 'when ssl_verify is false' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_ca_cert => 'invalid',
           :ssl_verify => false