mongo 2.12.1 → 2.13.0

data/spec/README.md

@@ -302,30 +302,50 @@ The driver test suite includes a number of Kerberos-related integration tests
 in the `spec/kerberos` directory. These require a provisioned Kerberos
 deployment and appropriately configured MongoDB deployment. One such deployment
 is provided internally by MongoDB and is used in the driver's Evergreen
-configuration; it is also possible to provision a test deployment locally.
+configuration; it is also possible to provision a test deployment locally,
+either via the Docker tooling provided by the driver test suite or manually.
+
+#### Via Docker
+
+Run:
+
+    ./.evergreen/test-on-docker -s .evergreen/run-tests-kerberos-integration.sh -pd rhel70
+
+When `SASL_HOST` environment variable is not set, the Kerberos integration
+test script `.evergreen/run-tests-kerberos-integration.sh` provisions a
+local Kerberos deployment in the Docker container and configures the test suite
+to use it.
+
+Note: the tooling is currently set up to provision a working `rhel70`
+container. Ubuntu distros are not presently supported.
+
+#### Locally
 
 The following additional environment variables must be set to run the
 Kerberos integration tests:
 
 - `MONGO_RUBY_DRIVER_KERBEROS_INTEGRATION=1`
-- `SASL_HOST`: the host name of the MongoDB server that is configured to
+- `SASL_HOST`: the FQDN host name of the MongoDB server that is configured to
 use Kerberos. Note that this is NOT the Kerberos domain controller (KDC).
+- `SASL_REALM`: the Kerberos realm. Depending on how Kerberos is configured,
+this can be the same as or different from `SASL_HOST`. The Evergreen
+configuration uses the same host and realm; Docker configuration provided
+by the Ruby driver uses different host and realm.
 - `SASL_PORT`: the port number that the Kerberized MongoDB server is
-listenin on.
+listening on.
 - `SASL_USER`: the username to provide to MongoDB for authentication.
-- `SASL_PASS`: the password to provide to MongoDB for authentication.
+This must match the username of the principal.
 - `SASL_DB`: the database that stores the user used for authentication. This
 is the "auth soure" in MongoDB parlance. Normally this should be `$external`.
 - `PRINCIPAL`: the Kerberos principal to use for authentication, in the
 form of `username@realm`. Note that the realm is commonly uppercased.
 - `KERBEROS_DB`: the database that the user has access to.
-- `KEYTAB_BASE64`: Base64 encoded keytab for the user. Used instead of the
-password.
 
-There are several steps that must be taken in order to set up Kerberos on
-the client side before it is usable by the driver for authentication against
-a Kerberized server. Consult the `.evergreen/run-tests-kerberos-integration.sh`
-file for details.
+Note that the driver does not directly provide a password to the MongoDB
+server when using Kerberos authentication, and because of this there is no
+user password provided to the test suite either when Kerberos authentication
+is used. Instead, there must be a local session established via e.g. `kinit`.
+Consult the `.evergreen/run-tests-kerberos-integration.sh` file for details.
 
 ## Client-Side Encryption
 
@@ -470,11 +490,44 @@ set names:
 However, as noted in the caveats section, changing the database name used by
 the test suite is not supported.
 
+## Special Tests
+
 Some tests require internet connectivity, for example to test DNS seed lists
 and SRV URIs. These tests can be skipped by setting the following environment
 variable:
 
-    EXTERNAL_DISABLED=true
+    EXTERNAL_DISABLED=1
+
+Some tests are designed to validate the driver's behavior under load, or
+otherwise execute a large number of operations which may take a sizable amount
+of time. Such tests are skipped by default and can be run by setting the
+following environment variable:
+
+    STRESS=1
+
+Some tests fork the process to validate the driver's behavior when forking is
+involved. These tests are skipped by default and can be run by setting the
+following environment variable:
+
+    FORK=1
+
+## Debug Logging
+
+The test suite is run with the driver log level set to `WARN` by default.
+This produces a fair amount of output as many tests trigger various conditions
+resulting in the driver outputting warnings. This is expected behavior.
+
+To increase the driver log level to `DEBUG`, set the
+`MONGO_RUBY_DRIVER_CLIENT_DEBUG` environment variable to `1`, `true` or `yes`.
+This will produce additional log output pertaining to, for example, SDAM
+events and transitions performed by the driver, as well as log all
+commands sent to and responses received from the database.
+
+To debug authentication and user management commands, set the
+`MONGO_RUBY_DRIVER_UNREDACT_EVENTS` environment variable to `1`, `true` or
+`yes`. This will disable redaction of command monitoring payloads for sensitive
+commands. Normally this environment variable should be used with
+`MONGO_RUBY_DRIVER_CLIENT_DEBUG` to see the command payloads.
 
 ## Caveats
 
@@ -515,12 +568,6 @@ enabled. This is accomplished by starting `mongod` with the following option:
 
     --setParameter enableTestCommands=1
 
-### Log Output
-
-The test suite is run with the driver log level set to WARN by default.
-This produces a fair amount of output as many tests trigger various conditions
-resulting in the driver outputting warnings. This is expected behavior.
-
 ## Running Individual Examples
 
 Individual examples can be run by invoking `rspec` instead of `rake`. Prior

data/spec/integration/auth_spec.rb

@@ -1,6 +1,10 @@
 require 'spec_helper'
 
 describe 'Auth' do
+  # User creation with a password fails on the server if, for example,
+  # only MONGODB-AWS auth mechanism is allowed in server configuration.
+  require_no_external_user
+
   describe 'Unauthorized exception message' do
     let(:server) do
       authorized_client.cluster.next_primary
@@ -173,7 +177,7 @@ describe 'Auth' do
     context 'attempting to connect to a tls server without tls' do
       require_tls
 
-      let(:options) { {} }
+      let(:options) { {ssl: false} }
 
       it 'reports host, port and tls status' do
         begin
@@ -191,19 +195,13 @@ describe 'Auth' do
     end
   end
 
-  describe 'scram-sha-1 client key caching' do
-    clean_slate
-    min_server_version '3.0'
-    require_no_x509_auth
-
-    let(:client) { authorized_client.with(max_pool_size: 2) }
-
+  shared_examples_for 'caches client key' do
     it 'caches' do
       client.close
       Mongo::Auth::CredentialCache.clear
 
       RSpec::Mocks.with_temporary_scope do
-        expect_any_instance_of(Mongo::Auth::SCRAM::Conversation).to receive(:hi).exactly(:once).and_call_original
+        expect_any_instance_of(conversation_class).to receive(:hi).exactly(:once).and_call_original
 
         client.reconnect
         server = client.cluster.next_primary
@@ -216,6 +214,28 @@ describe 'Auth' do
     end
   end
 
+  describe 'scram-sha-1 client key caching' do
+    clean_slate
+    min_server_version '3.0'
+    require_no_external_user
+
+    let(:client) { authorized_client.with(max_pool_size: 2, auth_mech: :scram) }
+    let(:conversation_class) { Mongo::Auth::Scram::Conversation }
+
+    it_behaves_like 'caches client key'
+  end
+
+  describe 'scram-sha-256 client key caching' do
+    clean_slate
+    min_server_version '4.0'
+    require_no_external_user
+
+    let(:client) { authorized_client.with(max_pool_size: 2, auth_mech: :scram256) }
+    let(:conversation_class) { Mongo::Auth::Scram256::Conversation }
+
+    it_behaves_like 'caches client key'
+  end
+
   context 'when only auth source is specified' do
     require_no_auth
 

data/spec/integration/awaited_ismaster_spec.rb

@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe 'awaited ismaster' do
+  min_server_fcv '4.4'
+
+  # If we send the consecutive ismasters to different mongoses,
+  # they have different process ids, and so the awaited one would return
+  # immediately.
+  require_no_multi_shard
+
+  let(:client) { authorized_client }
+
+  it 'waits' do
+    # Perform a regular ismaster to get topology version
+    resp = client.database.command(ismaster: 1)
+    doc = resp.replies.first.documents.first
+    tv = Mongo::TopologyVersion.new(doc['topologyVersion'])
+    tv.should be_a(BSON::Document)
+
+    elapsed_time = Benchmark.realtime do
+      resp = client.database.command(ismaster: 1,
+        topologyVersion: tv.to_doc, maxAwaitTimeMS: 500)
+    end
+    doc = resp.replies.first.documents.first
+
+    elapsed_time.should > 0.5
+  end
+end

data/spec/integration/aws_auth_request_spec.rb

@@ -0,0 +1,74 @@
+require 'lite_spec_helper'
+require 'net/http'
+
+describe Mongo::Auth::Aws::Request do
+  require_aws_auth
+
+  before(:all) do
+    if ENV['AUTH'] =~ /aws-(ec2|ecs)/
+      skip "This test requires explicit credentials to be provided"
+    end
+  end
+
+  let(:access_key_id) { ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_ACCESS_KEY_ID') }
+  let(:secret_access_key) { ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_SECRET_ACCESS_KEY') }
+  let(:session_token) { ENV['MONGO_RUBY_DRIVER_AWS_AUTH_SESSION_TOKEN'] }
+
+  describe '#authorization' do
+    let(:request) do
+      described_class.new(
+        access_key_id: access_key_id,
+        secret_access_key: secret_access_key,
+        session_token: session_token,
+        host: 'sts.amazonaws.com',
+        server_nonce: 'aaaaaaaaaaafake',
+      )
+    end
+
+    let(:sts_request) do
+      Net::HTTP::Post.new("https://sts.amazonaws.com").tap do |req|
+        request.headers.each do |k, v|
+          req[k] = v
+        end
+        req['authorization'] = request.authorization
+        req['accept'] = 'application/json'
+        req.body = described_class::STS_REQUEST_BODY
+      end
+    end
+
+    let(:sts_response) do
+      http = Net::HTTP.new('sts.amazonaws.com', 443)
+      http.use_ssl = true
+
+      # Uncomment to log complete request headers and the response.
+      # WARNING: do not enable this in Evergreen as this can expose real
+      # AWS credentias.
+      #http.set_debug_output(STDERR)
+
+      http.start do
+        resp = http.request(sts_request)
+      end
+    end
+
+    let(:sts_response_payload) do
+      JSON.parse(sts_response.body)
+    end
+
+    let(:result) do
+      sts_response_payload['GetCallerIdentityResponse']['GetCallerIdentityResult']
+    end
+
+    it 'is usable' do
+      # This assertion intentionally does not use payload so that if it fails,
+      # the entire response is printed for diagnostic purposes.
+      sts_response.body.should_not =~ /"Error"/
+
+      sts_response.code.should == '200'
+      result['Arn'].should =~ /^arn:aws:(iam|sts)::/
+      result['Account'].should be_a(String)
+      result['UserId'].should =~ /^A/
+
+      puts "STS request successful with ARN #{result['Arn']}"
+    end
+  end
+end

data/spec/integration/aws_credentials_retriever_spec.rb

@@ -0,0 +1,103 @@
+require 'lite_spec_helper'
+require 'support/aws_utils'
+
+describe Mongo::Auth::Aws::CredentialsRetriever do
+  require_aws_auth
+
+  let(:retriever) do
+    described_class.new(user)
+  end
+
+  let(:credentials) do
+    retriever.credentials
+  end
+
+  context 'when user is not given' do
+    let(:user) do
+      Mongo::Auth::User.new(auth_mech: :aws)
+    end
+
+    shared_examples_for 'retrieves the credentials' do
+      it 'retrieves' do
+        credentials.should be_a(Mongo::Auth::Aws::Credentials)
+
+        # When user is not given, credentials retrieved are always temporary.
+        retriever.credentials.access_key_id.should =~ /^ASIA/
+        retriever.credentials.secret_access_key.should =~ /./
+        retriever.credentials.session_token.should =~ /./
+      end
+
+      let(:request) do
+        Mongo::Auth::Aws::Request.new(
+          access_key_id: credentials.access_key_id,
+          secret_access_key: credentials.secret_access_key,
+          session_token: credentials.session_token,
+          host: 'sts.amazonaws.com',
+          server_nonce: 'test',
+        )
+      end
+
+      it 'produces valid credentials' do
+        result = request.validate!
+        puts "STS request successful with ARN #{result['Arn']}"
+      end
+    end
+
+    context 'ec2 instance role' do
+      require_ec2_host
+
+      before(:all) do
+        unless ENV['AUTH'] == 'aws-ec2'
+          skip "Set AUTH=aws-ec2 in environment to run EC2 instance role tests"
+        end
+      end
+
+      context 'when instance profile is not assigned' do
+        before(:all) do
+          orchestrator = AwsUtils::Orchestrator.new(
+            region: ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_REGION'),
+            access_key_id: ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_ACCESS_KEY_ID'),
+            secret_access_key: ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_SECRET_ACCESS_KEY'),
+          )
+
+          orchestrator.clear_instance_profile(Utils.ec2_instance_id)
+          Utils.wait_for_no_instance_profile
+        end
+
+        it 'raises an error' do
+          lambda do
+            credentials
+          end.should raise_error(Mongo::Auth::InvalidConfiguration, /Could not locate AWS credentials/)
+        end
+      end
+
+      context 'when instance profile is assigned' do
+        before(:all) do
+          orchestrator = AwsUtils::Orchestrator.new(
+            region: ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_REGION'),
+            access_key_id: ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_ACCESS_KEY_ID'),
+            secret_access_key: ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_SECRET_ACCESS_KEY'),
+          )
+
+          orchestrator.set_instance_profile(Utils.ec2_instance_id,
+            instance_profile_name: nil,
+            instance_profile_arn: ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_INSTANCE_PROFILE_ARN'),
+          )
+          Utils.wait_for_instance_profile
+        end
+
+        it_behaves_like 'retrieves the credentials'
+      end
+    end
+
+    context 'ecs task role' do
+      before(:all) do
+        unless ENV['AUTH'] == 'aws-ecs'
+          skip "Set AUTH=aws-ecs in environment to run ECS task role tests"
+        end
+      end
+
+      it_behaves_like 'retrieves the credentials'
+    end
+  end
+end

data/spec/integration/bulk_write_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe 'Bulk writes' do
+  before do
+    authorized_collection.drop
+  end
+
+  context 'when bulk write is larger than 48MB' do
+    let(:operations) do
+      [ { insert_one: { text: 'a' * 1000 * 1000 } } ] * 48
+    end
+
+    it 'succeeds' do
+      expect do
+        authorized_collection.bulk_write(operations)
+      end.not_to raise_error
+    end
+  end
+end

data/spec/integration/change_stream_examples_spec.rb

@@ -174,8 +174,10 @@ describe 'change streams examples in Ruby' do
 
         # Start Changestream Example 4
 
-        pipeline = [ {'$match' => { '$or' => [{ 'fullDocument.username' => 'alice' },
-                                              { 'operationType' => 'delete' }] } }]
+        pipeline = [
+          { "$match" => { 'fullDocument.username' => 'alice' } },
+          { "$addFields" => { 'newField' => 'this is an added field!' } }
+        ];
         cursor = inventory.watch(pipeline).to_enum
         cursor.next
 
@@ -191,6 +193,8 @@ describe 'change streams examples in Ruby' do
       expect(change['fullDocument']).not_to be_nil
       expect(change['fullDocument']['_id']).not_to be_nil
       expect(change['fullDocument']['username']).to eq('alice')
+      expect(change['newField']).not_to be_nil
+      expect(change['newField']).to eq('this is an added field!')
       expect(change['ns']).not_to be_nil
       expect(change['ns']['db']).to eq(SpecConfig.instance.test_db)
       expect(change['ns']['coll']).to eq(inventory.name)

data/spec/integration/change_stream_spec.rb

@@ -85,16 +85,20 @@ describe 'Change stream integration', retry: 4 do
       min_server_fcv '4.0'
       clear_fail_point_before
 
+      let(:client) do
+        authorized_client_without_any_retries
+      end
+
       before do
-        authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
+        client.use(:admin).command(fail_point_base_command.merge(
           :mode => {:times => 1},
-          :data => {:failCommands => ['aggregate'], errorCode: 100}))
+          :data => {:failCommands => ['aggregate'], errorCode: 10107}))
       end
 
       it 'watch raises error' do
         expect do
-          authorized_collection.watch
-        end.to raise_error(Mongo::Error::OperationFailure, /Failing command due to 'failCommand' failpoint \(100\)/)
+          client['change-stream'].watch
+        end.to raise_error(Mongo::Error::OperationFailure, /Failing command due to 'failCommand' failpoint \(10107\)/)
       end
     end
 
@@ -105,35 +109,51 @@ describe 'Change stream integration', retry: 4 do
       context 'error on first getMore' do
         before do
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 1},
-            :data => {:failCommands => ['getMore'], errorCode: errorCode}))
+            mode: {times: 1},
+            data: {
+              failCommands: ['getMore'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
         end
 
         context 'when the error is resumable' do
-          let(:errorCode) do
-            100
-          end
+          let(:error_code) { 10107 }
+
+          let(:error_labels) { ["ResumableChangeStreamError"] }
+
           it_behaves_like 'returns a change document'
         end
 
         context 'when the error is Interrupted' do
-          let(:errorCode) do
-            11601
-          end
+          let(:error_code) { 11601 }
+
+          let(:error_labels) { [] }
+
           it_behaves_like 'raises an exception'
         end
 
         context 'when the error is CappedPositionLost' do
-          let(:errorCode) do
-            136
-          end
+          let(:error_code) { 136 }
+
+          let(:error_labels) { [] }
+
           it_behaves_like 'raises an exception'
         end
 
         context 'when the error is CursorKilled' do
-          let(:errorCode) do
-            237
-          end
+          let(:error_code) { 237 }
+
+          let(:error_labels) { [] }
+
+          it_behaves_like 'raises an exception'
+        end
+
+        context 'when the error is ElectionInProgress' do
+          let(:error_code) { 216 }
+
+          let(:error_labels) { [] }
+
           it_behaves_like 'raises an exception'
         end
       end
@@ -150,35 +170,43 @@ describe 'Change stream integration', retry: 4 do
           authorized_collection.insert_one(:a => 1)
 
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 1},
-            :data => {:failCommands => ['getMore'], errorCode: errorCode}))
+            mode: {times: 1},
+            data: {
+              failCommands: ['getMore'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
         end
 
         context 'when the error is resumable' do
-          let(:errorCode) do
-            100
-          end
+          let(:error_code) { 10107 }
+
+          let(:error_labels) { ["ResumableChangeStreamError"] }
+
           it_behaves_like 'returns a change document'
         end
 
         context 'when the error is Interrupted' do
-          let(:errorCode) do
-            11601
-          end
+          let(:error_code) { 11601 }
+
+          let(:error_labels) { [] }
+
           it_behaves_like 'raises an exception'
         end
 
         context 'when the error is CappedPositionLost' do
-          let(:errorCode) do
-            136
-          end
+          let(:error_code) { 136 }
+
+          let(:error_labels) { [] }
+
           it_behaves_like 'raises an exception'
         end
 
         context 'when the error is CursorKilled' do
-          let(:errorCode) do
-            237
-          end
+          let(:error_code) { 237 }
+
+          let(:error_labels) { [] }
+
           it_behaves_like 'raises an exception'
         end
       end
@@ -188,11 +216,19 @@ describe 'Change stream integration', retry: 4 do
       min_server_fcv '4.0'
       clear_fail_point_before
 
-      context 'error of first getMores' do
+      let(:error_code) { 10107 }
+
+      let(:error_labels) { ["ResumableChangeStreamError"] }
+
+      context 'error on first getMore' do
         before do
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 2},
-            :data => {:failCommands => ['getMore'], errorCode: 100}))
+            mode: {times: 2},
+            data: {
+              failCommands: ['getMore'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
         end
 
         # this retries twice because aggregation resets retry count,
@@ -212,8 +248,12 @@ describe 'Change stream integration', retry: 4 do
           authorized_collection.insert_one(:a => 1)
 
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 2},
-            :data => {:failCommands => ['getMore'], errorCode: 100}))
+            mode: {times: 2},
+            data: {
+              failCommands: ['getMore'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
         end
 
         # this retries twice because aggregation resets retry count,
@@ -282,6 +322,10 @@ describe 'Change stream integration', retry: 4 do
       end
     end
 
+    let(:error_code) { 10107 }
+
+    let(:error_labels) { ["ResumableChangeStreamError"] }
+
     context 'one error on getMore' do
       min_server_fcv '4.0'
       clear_fail_point_before
@@ -289,8 +333,12 @@ describe 'Change stream integration', retry: 4 do
       context 'error on first getMore' do
         before do
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 1},
-            :data => {:failCommands => ['getMore'], errorCode: 100}))
+            mode: {times: 1},
+            data: {
+              failCommands: ['getMore'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
         end
 
         it_behaves_like 'returns a change document'
@@ -304,8 +352,12 @@ describe 'Change stream integration', retry: 4 do
           authorized_collection.insert_one(:a => 1)
 
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 1},
-            :data => {:failCommands => ['getMore'], errorCode: 100}))
+            mode: {times: 1},
+            data: {
+              failCommands: ['getMore'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
         end
 
         it_behaves_like 'returns a change document'
@@ -323,8 +375,12 @@ describe 'Change stream integration', retry: 4 do
         # getMore as no errors actually happen.
         # 4.0.5-dev server appears to correctly set the fail point.
         authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-          :mode => {:times => 2},
-          :data => {:failCommands => ['getMore'], errorCode: 100}))
+          mode: {times: 2},
+          data: {
+            failCommands: ['getMore'],
+            errorCode: error_code,
+            errorLabels: error_labels,
+          }))
       end
 
       # this retries twice because aggregation resets retry count,
@@ -347,14 +403,18 @@ describe 'Change stream integration', retry: 4 do
           enum = change_stream.to_enum
 
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 3},
-            :data => {:failCommands => ['getMore', 'aggregate'], errorCode: 101}))
+            mode: {times: 3},
+            data: {
+              failCommands: ['getMore', 'aggregate'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
 
           sleep 0.5
 
           expect do
             enum.try_next
-          end.to raise_error(Mongo::Error::OperationFailure, /Failing command due to 'failCommand' failpoint \(101\)/)
+          end.to raise_error(Mongo::Error::OperationFailure, /Failing command due to 'failCommand' failpoint \(10107\)/)
         end
       end
 
@@ -370,14 +430,18 @@ describe 'Change stream integration', retry: 4 do
           enum = change_stream.to_enum
 
           authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-            :mode => {:times => 3},
-            :data => {:failCommands => ['getMore', 'aggregate'], errorCode: 101}))
+            mode: {times: 3},
+            data: {
+              failCommands: ['getMore', 'aggregate'],
+              errorCode: error_code,
+              errorLabels: error_labels,
+            }))
 
           sleep 0.5
 
           expect do
             enum.try_next
-          end.to raise_error(Mongo::Error::OperationFailure, /Failing command due to 'failCommand' failpoint \(101\)/)
+          end.to raise_error(Mongo::Error::OperationFailure, /Failing command due to 'failCommand' failpoint \(10107\)/)
         end
       end
     end
@@ -487,11 +551,19 @@ describe 'Change stream integration', retry: 4 do
 
         authorized_collection.insert_one(x: 1)
         authorized_collection.client.use(:admin).command(fail_point_base_command.merge(
-          :mode => {:times => 1},
-          :data => {:failCommands => ['getMore'], errorCode: 100}))
+          mode: {times: 1},
+          data: {
+            failCommands: ['getMore'],
+            errorCode: error_code,
+            errorLabels: error_labels,
+          }))
         stream.to_enum.next
       end
 
+      let(:error_code) { 10107 }
+
+      let(:error_labels) { ["ResumableChangeStreamError"] }
+
       it 'does not startAfter even when passed in' do
         expect(events.size == 2).to eq(true)