mongo 2.11.4 → 2.12.3

data/spec/integration/client_side_encryption/custom_endpoint_spec.rb

@@ -0,0 +1,132 @@
+require 'spec_helper'
+
+describe 'Client-Side Encryption' do
+  describe 'Prose tests: Data key and double encryption' do
+    require_libmongocrypt
+    require_enterprise
+    min_server_fcv '4.2'
+
+    include_context 'define shared FLE helpers'
+
+    let(:client) do
+      new_local_client(
+        SpecConfig.instance.addresses,
+        SpecConfig.instance.test_options
+      )
+    end
+
+    let(:client_encryption) do
+      Mongo::ClientEncryption.new(
+        client,
+        {
+          kms_providers: aws_kms_providers,
+          key_vault_namespace: 'admin.datakeys',
+        },
+      )
+    end
+
+    let(:data_key_id) do
+      client_encryption.create_data_key('aws', master_key: master_key)
+    end
+
+    shared_examples 'a functioning data key' do
+      it 'can encrypt and decrypt a string' do
+        encrypted = client_encryption.encrypt(
+          'test',
+          {
+            key_id: data_key_id,
+            algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+          }
+        )
+
+        expect(encrypted).to be_ciphertext
+
+        decrypted = client_encryption.decrypt(encrypted)
+        expect(decrypted).to eq('test')
+      end
+    end
+
+    context 'with region and key options' do
+      let(:master_key) do
+        {
+          region: "us-east-1",
+          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0"
+        }
+      end
+
+      it_behaves_like 'a functioning data key'
+    end
+
+    context 'with region, key, and endpoint options' do
+      let(:master_key) do
+        {
+          region: "us-east-1",
+          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
+          endpoint: "kms.us-east-1.amazonaws.com"
+        }
+      end
+
+      it_behaves_like 'a functioning data key'
+    end
+
+    context 'with region, key, and endpoint with valid port' do
+      let(:master_key) do
+        {
+          region: "us-east-1",
+          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
+          endpoint: "kms.us-east-1.amazonaws.com:443"
+        }
+      end
+
+      it_behaves_like 'a functioning data key'
+    end
+
+    context 'with region, key, and endpoint with invalid port' do
+      let(:master_key) do
+        {
+          region: "us-east-1",
+          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
+          endpoint: "kms.us-east-1.amazonaws.com:12345"
+        }
+      end
+
+      it 'throws an exception' do
+        expect do
+          data_key_id
+        end.to raise_error(Mongo::Error::KmsError, /Connection refused/)
+      end
+    end
+
+    context 'with region, key, and endpoint with invalid region' do
+      let(:master_key) do
+        {
+          region: "us-east-1",
+          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
+          endpoint: "kms.us-east-2.amazonaws.com"
+        }
+      end
+
+      it 'throws an exception' do
+        expect do
+          data_key_id
+        end.to raise_error(Mongo::Error::KmsError, /us-east-1/)
+      end
+    end
+
+    context 'with region, key, and endpoint at incorrect domain' do
+      let(:master_key) do
+        {
+          region: "us-east-1",
+          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
+          endpoint: "example.com"
+        }
+      end
+
+      it 'throws an exception' do
+        expect do
+          data_key_id
+        end.to raise_error(Mongo::Error::KmsError, /parse error/)
+      end
+    end
+  end
+end

data/spec/integration/client_side_encryption/data_key_spec.rb

@@ -0,0 +1,165 @@
+require 'spec_helper'
+
+describe 'Client-Side Encryption' do
+  describe 'Prose tests: Data key and double encryption' do
+    require_libmongocrypt
+    require_enterprise
+    min_server_fcv '4.2'
+
+    include_context 'define shared FLE helpers'
+
+    let(:subscriber) { EventSubscriber.new }
+
+    let(:client) do
+      new_local_client(
+        SpecConfig.instance.addresses,
+        SpecConfig.instance.test_options
+      ).tap do |client|
+        client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+      end
+    end
+
+    let(:test_schema_map) do
+      {
+        "db.coll": {
+          "bsonType": "object",
+          "properties": {
+            "encrypted_placeholder": {
+              "encrypt": {
+                "keyId": "/placeholder",
+                "bsonType": "string",
+                "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
+              }
+            }
+          }
+        }
+      }
+    end
+
+    let(:client_encrypted) do
+      new_local_client(
+        SpecConfig.instance.addresses,
+        SpecConfig.instance.test_options.merge(
+          auto_encryption_options: {
+            kms_providers: {
+              local: { key: local_master_key },
+              aws: {
+                access_key_id: SpecConfig.instance.fle_aws_key,
+                secret_access_key: SpecConfig.instance.fle_aws_secret,
+              },
+            },
+            key_vault_namespace: 'admin.datakeys',
+            schema_map: test_schema_map,
+            # Spawn mongocryptd on non-default port for sharded cluster tests
+            extra_options: extra_options,
+          },
+          database: 'db',
+        )
+      )
+    end
+
+    let(:client_encryption) do
+      Mongo::ClientEncryption.new(
+        client,
+        {
+          kms_providers: {
+            local: { key: local_master_key },
+            aws: {
+              access_key_id: SpecConfig.instance.fle_aws_key,
+              secret_access_key: SpecConfig.instance.fle_aws_secret,
+            }
+          },
+          key_vault_namespace: 'admin.datakeys',
+        },
+      )
+    end
+
+    before do
+      client.use('admin')['datakeys'].drop
+      client.use('db')['coll'].drop
+    end
+
+    shared_examples 'can create and use a data key' do
+      it 'creates a data key and uses it for encryption' do
+        data_key_id = client_encryption.create_data_key(
+          kms_provider_name,
+          data_key_options.merge(key_alt_names: [key_alt_name])
+        )
+
+        expect(data_key_id).to be_uuid
+
+        keys = client.use('admin')['datakeys'].find(_id: data_key_id)
+
+        expect(keys.count).to eq(1)
+        expect(keys.first['masterKey']['provider']).to eq(kms_provider_name)
+
+        command_started_event = subscriber.started_events.find do |event|
+          event.command_name == 'find'
+        end
+
+        expect(command_started_event).not_to be_nil
+
+        encrypted = client_encryption.encrypt(
+          value_to_encrypt,
+          {
+            key_id: data_key_id,
+            algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+          }
+        )
+
+        expect(encrypted).to be_ciphertext
+
+        client_encrypted['coll'].insert_one(
+          _id: kms_provider_name,
+          value: encrypted,
+        )
+
+        document = client_encrypted['coll'].find(_id: kms_provider_name).first
+
+        expect(document['value']).to eq(value_to_encrypt)
+
+        encrypted_with_alt_name = client_encryption.encrypt(
+          value_to_encrypt,
+          {
+            key_alt_name: key_alt_name,
+            algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+          }
+        )
+
+        expect(encrypted_with_alt_name).to be_ciphertext
+        expect(encrypted_with_alt_name).to eq(encrypted)
+
+        expect do
+          client_encrypted['coll'].insert_one(encrypted_placeholder: encrypted)
+        end.to raise_error(Mongo::Error::OperationFailure, /Cannot encrypt element of type binData/)
+      end
+    end
+
+    context 'with local KMS options' do
+      include_context 'with local kms_providers'
+
+      let(:key_alt_name) { 'local_altname' }
+      let(:data_key_options) { {} }
+      let(:value_to_encrypt) { 'hello local' }
+
+      it_behaves_like 'can create and use a data key'
+    end
+
+    context 'with AWS KMS options' do
+      include_context 'with AWS kms_providers'
+
+      let(:key_alt_name) { 'aws_altname' }
+      let(:value_to_encrypt) { 'hello aws' }
+      let(:data_key_options) do
+        {
+          master_key: {
+            region: "us-east-1",
+            key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0"
+          }
+        }
+      end
+
+      it_behaves_like 'can create and use a data key'
+    end
+  end
+end

data/spec/integration/client_side_encryption/explicit_encryption_spec.rb

@@ -0,0 +1,114 @@
+require 'spec_helper'
+
+describe 'Explicit Encryption' do
+  require_libmongocrypt
+  include_context 'define shared FLE helpers'
+
+  let(:client) { ClientRegistry.instance.new_local_client(SpecConfig.instance.addresses) }
+
+  let(:client_encryption_opts) do
+    {
+      kms_providers: kms_providers,
+      key_vault_namespace: key_vault_namespace
+    }
+  end
+
+  let(:client_encryption) do
+    Mongo::ClientEncryption.new(
+      client,
+      client_encryption_opts
+    )
+  end
+
+  before do
+    client.use(key_vault_db)[key_vault_coll].drop
+  end
+
+  shared_examples 'an explicit encrypter' do
+    it 'encrypts and decrypts the value using key_id' do
+      data_key_id = client_encryption.create_data_key(
+        kms_provider_name,
+        data_key_options
+      )
+
+      encrypted = client_encryption.encrypt(
+        value,
+        {
+          key_id: data_key_id,
+          algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic',
+        }
+      )
+
+      decrypted = client_encryption.decrypt(encrypted)
+      expect(decrypted).to eq(value)
+      expect(decrypted).to be_a_kind_of(value.class)
+    end
+
+    it 'encrypts and decrypts the value using key_alt_name' do
+      data_key_id = client_encryption.create_data_key(
+        kms_provider_name,
+        data_key_options.merge(key_alt_names: [key_alt_name])
+      )
+
+      encrypted = client_encryption.encrypt(
+        value,
+        {
+          key_alt_name: key_alt_name,
+          algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic',
+        }
+      )
+
+      decrypted = client_encryption.decrypt(encrypted)
+      expect(decrypted).to eq(value)
+      expect(decrypted).to be_a_kind_of(value.class)
+    end
+  end
+
+  context 'value is a string' do
+    let(:value) { 'Hello, world!' }
+
+    context 'with AWS KMS provider' do
+      include_context 'with AWS kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with local KMS provider' do
+      include_context 'with local kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+  end
+
+  context 'value is an integer' do
+    let(:value) { 42 }
+
+    context 'with AWS KMS provider' do
+      include_context 'with AWS kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with local KMS provider' do
+      include_context 'with local kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+  end
+
+  context 'value is an symbol' do
+    let(:value) { BSON::Symbol::Raw.new(:hello_world) }
+
+    context 'with AWS KMS provider' do
+      include_context 'with AWS kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with local KMS provider' do
+      include_context 'with local kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+  end
+end

data/spec/integration/client_side_encryption/external_key_vault_spec.rb

@@ -0,0 +1,141 @@
+require 'spec_helper'
+
+describe 'Client-Side Encryption' do
+  describe 'Prose tests: External Key Vault Test' do
+    require_libmongocrypt
+    require_enterprise
+    min_server_fcv '4.2'
+
+    include_context 'define shared FLE helpers'
+
+    let(:client) do
+      new_local_client(
+        SpecConfig.instance.addresses,
+        SpecConfig.instance.test_options
+      )
+    end
+
+    let(:test_schema_map) do
+      {
+        'db.coll' => BSON::ExtJSON.parse(File.read('spec/support/crypt/external/external-schema.json'))
+      }
+    end
+
+    let(:external_key_vault_client) do
+      new_local_client(
+        SpecConfig.instance.addresses,
+        SpecConfig.instance.test_options.merge(
+          user: 'fake-user',
+          password: 'fake-pwd'
+        )
+      )
+    end
+
+    let(:data_key_id) do
+      BSON::Binary.new(Base64.decode64('LOCALAAAAAAAAAAAAAAAAA=='), :uuid)
+    end
+
+    before do
+      client.use('admin')['datakeys'].drop
+      client.use('db')['coll'].drop
+
+      data_key = BSON::ExtJSON.parse(File.read('spec/support/crypt/external/external-key.json'))
+      client.use('admin')['datakeys', write_concern: { w: :majority }].insert_one(data_key)
+    end
+
+    context 'with default key vault client' do
+      let(:client_encrypted) do
+        new_local_client(
+          SpecConfig.instance.addresses,
+          SpecConfig.instance.test_options.merge(
+            auto_encryption_options: {
+              kms_providers: local_kms_providers,
+              key_vault_namespace: 'admin.datakeys',
+              schema_map: test_schema_map,
+              # Spawn mongocryptd on non-default port for sharded cluster tests
+              extra_options: extra_options,
+            },
+            database: 'db',
+          )
+        )
+      end
+
+      let(:client_encryption) do
+        Mongo::ClientEncryption.new(
+          client,
+          {
+            kms_providers: local_kms_providers,
+            key_vault_namespace: 'admin.datakeys',
+          }
+        )
+      end
+
+      it 'inserts an encrypted document with client' do
+        result = client_encrypted['coll'].insert_one(encrypted: 'test')
+        expect(result).to be_ok
+
+        encrypted = client.use('db')['coll'].find.first['encrypted']
+        expect(encrypted).to be_ciphertext
+      end
+
+      it 'encrypts a value with client encryption' do
+        encrypted = client_encryption.encrypt(
+          'test',
+          {
+            key_id: data_key_id,
+            algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic',
+          }
+        )
+
+        expect(encrypted).to be_ciphertext
+      end
+    end
+
+    context 'with external key vault client' do
+      let(:client_encrypted) do
+        new_local_client(
+          SpecConfig.instance.addresses,
+          SpecConfig.instance.test_options.merge(
+            auto_encryption_options: {
+              kms_providers: local_kms_providers,
+              key_vault_namespace: 'admin.datakeys',
+              schema_map: test_schema_map,
+              key_vault_client: external_key_vault_client,
+              # Spawn mongocryptd on non-default port for sharded cluster tests
+              extra_options: extra_options,
+            },
+            database: 'db',
+          )
+        )
+      end
+
+      let(:client_encryption) do
+        Mongo::ClientEncryption.new(
+          external_key_vault_client,
+          {
+            kms_providers: local_kms_providers,
+            key_vault_namespace: 'admin.datakeys',
+          }
+        )
+      end
+
+       it 'raises an authentication exception when auto encrypting' do
+        expect do
+          client_encrypted['coll'].insert_one(encrypted: 'test')
+        end.to raise_error(Mongo::Auth::Unauthorized, /fake-user/)
+      end
+
+      it 'raises an authentication exception when explicit encrypting' do
+        expect do
+          client_encryption.encrypt(
+            'test',
+            {
+              key_id: data_key_id,
+              algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic',
+            }
+          )
+        end.to raise_error(Mongo::Auth::Unauthorized, /fake-user/)
+      end
+    end
+  end
+end