mongo 2.12.4 → 2.13.0.beta1

data/lib/mongo/address/unix.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.
@@ -63,7 +63,6 @@ module Mongo
       #   address.socket(5)
       #
       # @param [ Float ] socket_timeout The socket timeout.
-      # @param [ Hash ] ssl_options SSL options - ignored.
       # @param [ Hash ] options The options.
       #
       # @option options [ Float ] :connect_timeout Connect timeout.
@@ -71,7 +70,8 @@ module Mongo
       # @return [ Mongo::Socket::Unix ] The socket.
       #
       # @since 2.0.0
-      def socket(socket_timeout, ssl_options = {}, options = {})
+      # @api private
+      def socket(socket_timeout, options = {})
         Socket::Unix.new(host, socket_timeout, options)
       end
     end

data/lib/mongo/address/validator.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2017-2019 MongoDB, Inc.
+# Copyright (C) 2017-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.

data/lib/mongo/auth.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,13 +13,20 @@
 # limitations under the License.
 
 require 'mongo/auth/credential_cache'
+require 'mongo/auth/stringprep'
+require 'mongo/auth/conversation_base'
+require 'mongo/auth/sasl_conversation_base'
+require 'mongo/auth/scram_conversation_base'
+require 'mongo/auth/user'
+require 'mongo/auth/roles'
+require 'mongo/auth/base'
+require 'mongo/auth/aws'
 require 'mongo/auth/cr'
+require 'mongo/auth/gssapi'
 require 'mongo/auth/ldap'
 require 'mongo/auth/scram'
-require 'mongo/auth/user'
+require 'mongo/auth/scram256'
 require 'mongo/auth/x509'
-require 'mongo/auth/roles'
-require 'mongo/auth/stringprep'
 
 module Mongo
 
@@ -32,43 +39,59 @@ module Mongo
     # The external database name.
     #
     # @since 2.0.0
+    # @api private
     EXTERNAL = '$external'.freeze
 
     # Constant for the nonce command.
     #
     # @since 2.0.0
+    # @api private
     GET_NONCE = { getnonce: 1 }.freeze
 
     # Constant for the nonce field.
     #
     # @since 2.0.0
+    # @api private
     NONCE = 'nonce'.freeze
 
     # Map the symbols parsed from the URI connection string to strategies.
     #
+    # @note This map is not frozen because when mongo_kerberos is loaded,
+    #   it mutates this map by adding the Kerberos authenticator.
+    #
     # @since 2.0.0
     SOURCES = {
+      aws: Aws,
+      gssapi: Gssapi,
       mongodb_cr: CR,
       mongodb_x509: X509,
       plain: LDAP,
-      scram: SCRAM,
-      scram256: SCRAM,
+      scram: Scram,
+      scram256: Scram256,
     }
 
-    # Get the authorization strategy for the provided auth mechanism.
+    # Get an authenticator for the provided user to authenticate over the
+    # provided connection.
     #
-    # @example Get the strategy.
-    #   Auth.get(user)
+    # @param [ Auth::User ] user The user to authenticate.
+    # @param [ Mongo::Connection ] connection The connection to authenticate over.
     #
-    # @param [ Auth::User ] user The user object.
+    # @option opts [ String | nil ] speculative_auth_client_nonce The client
+    #   nonce used in speculative auth on the specified connection that
+    #   produced the specified speculative auth result.
+    # @option opts [ BSON::Document | nil ] speculative_auth_result The
+    #   value of speculativeAuthenticate field of ismaster response of
+    #   the handshake on the specified connection.
     #
-    # @return [ CR, X509, LDAP, Kerberos ] The auth strategy.
+    # @return [ Auth::Aws | Auth::CR | Auth::Gssapi | Auth::LDAP |
+    #   Auth::Scram | Auth::Scram256 | Auth::X509 ] The authenticator.
     #
     # @since 2.0.0
-    def get(user)
+    # @api private
+    def get(user, connection, **opts)
       mechanism = user.mechanism
       raise InvalidMechanism.new(mechanism) if !SOURCES.has_key?(mechanism)
-      SOURCES[mechanism].new(user)
+      SOURCES[mechanism].new(user, connection, **opts)
     end
 
     # Raised when trying to authorize with an invalid configuration

data/lib/mongo/auth/aws.rb

@@ -0,0 +1,37 @@
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws < Base
+      MECHANISM = 'MONGODB-AWS'.freeze
+
+      # Log the user in on the current connection.
+      #
+      # @return [ BSON::Document ] The document of the authentication response.
+      def login
+        converse_2_step(connection, conversation)
+      end
+
+      # The AWS credential set.
+      #
+      # @api private
+      Credentials = Struct.new(:access_key_id, :secret_access_key, :session_token)
+    end
+  end
+end
+
+require 'mongo/auth/aws/conversation'
+require 'mongo/auth/aws/credentials_retriever'
+require 'mongo/auth/aws/request'

data/lib/mongo/auth/aws/conversation.rb

@@ -0,0 +1,128 @@
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws
+
+      # Defines behavior around a single MONGODB-AWS conversation between the
+      # client and server.
+      #
+      # @see https://github.com/mongodb/specifications/blob/master/source/auth/auth.rst#mongodb-aws
+      #
+      # @api private
+      class Conversation < SaslConversationBase
+
+        # Continue the AWS conversation. This sends the client final message
+        # to the server after setting the reply from the previous server
+        # communication.
+        #
+        # @param [ BSON::Document ] reply_document The reply document of the
+        #   previous message.
+        # @param [ Server::Connection ] connection The connection being
+        #   authenticated.
+        #
+        # @return [ Protocol::Message ] The next message to send.
+        def continue(reply_document, connection)
+          @conversation_id = reply_document[:conversationId]
+          payload = reply_document[:payload].data
+          payload = BSON::Document.from_bson(BSON::ByteBuffer.new(payload))
+          @server_nonce = payload[:s].data
+          validate_server_nonce!
+          @sts_host = payload[:h]
+          unless (1..255).include?(@sts_host.bytesize)
+            raise Error::InvalidServerAuthConfiguration, "STS host name length is not in 1..255 bytes range: #{@sts_host}"
+          end
+
+          selector = CLIENT_CONTINUE_MESSAGE.merge(
+            payload: BSON::Binary.new(client_final_payload),
+            conversationId: conversation_id,
+          )
+          selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
+          cluster_time = connection.mongos? && connection.cluster_time
+          selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
+          Protocol::Msg.new([], {}, selector)
+        end
+
+        private
+
+        # @return [ String ] The server nonce.
+        attr_reader :server_nonce
+
+        # Get the id of the conversation.
+        #
+        # @return [ Integer ] The conversation id.
+        attr_reader :conversation_id
+
+        def client_first_payload
+          {payload: client_first_message}
+        end
+
+        def client_first_data
+          {
+            r: BSON::Binary.new(client_nonce),
+            p: 110,
+          }
+        end
+
+        def client_first_payload
+          client_first_data.to_bson.to_s
+        end
+
+        def wrap_data(data)
+          BSON::Binary.new(data.to_bson.to_s)
+        end
+
+        def client_nonce
+          @client_nonce ||= SecureRandom.random_bytes(32)
+        end
+
+        def client_final_payload
+          credentials = CredentialsRetriever.new(user).credentials
+          request = Request.new(
+            access_key_id: credentials.access_key_id,
+            secret_access_key: credentials.secret_access_key,
+            session_token: credentials.session_token,
+            host: @sts_host,
+            server_nonce: server_nonce,
+          )
+
+          # Uncomment this line to validate obtained credentials on the
+          # client side prior to sending them to the server.
+          # This generally produces informative diagnostics as to why
+          # the credentials are not valid (e.g., they could be expired)
+          # whereas the server normally does not elaborate on why
+          # authentication failed (but the reason usually is logged into
+          # the server logs).
+          #
+          # Note that credential validation requires that the client is
+          # able to access AWS STS. If this is not permitted by firewall
+          # rules, validation will fail but credentials may be perfectly OK
+          # and the server may be able to authenticate using them just fine
+          # (provided the server is allowed to communicate with STS).
+          #request.validate!
+
+          payload = {
+            a: request.authorization,
+            d: request.formatted_time,
+          }
+          if credentials.session_token
+            payload[:t] = credentials.session_token
+          end
+          payload.to_bson.to_s
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/aws/credentials_retriever.rb

@@ -0,0 +1,219 @@
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws
+
+      # Retrieves AWS credentials from a variety of sources.
+      #
+      # This class provides for AWS credentials retrieval from:
+      # - the passed user (which receives the credentials passed to the
+      #   client via URI options and Ruby options)
+      # - AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
+      #   environment variables (commonly used by AWS SDKs and various tools,
+      #   as well as AWS Lambda)
+      # - EC2 metadata endpoint
+      # - ECS metadata endpoint
+      #
+      # The sources listed above are consulted in the order specified.
+      # The first source that contains any of the three credential components
+      # (access key id, secret access key or session token) is used.
+      # The credential components must form a valid set if any of the components
+      # is specified; meaning, access key id and secret access key must
+      # always be provided together, and if a session token is provided
+      # the key id and secret key must also be provided. If a source provides
+      # partial credentials, credential retrieval fails with an exception.
+      #
+      # @api private
+      class CredentialsRetriever
+
+        # Timeout for metadata operations, in seconds.
+        #
+        # The auth spec suggests a 10 second timeout but this seems
+        # excessively long given that the endpoint is essentially local.
+        METADATA_TIMEOUT = 5
+
+        def initialize(user = nil)
+          @user = user
+        end
+
+        # @return [ Auth::User | nil ] The user object, if one was provided.
+        attr_reader :user
+
+        # Retrieves a valid set of credentials, if possible, or raises
+        # Auth::InvalidConfiguration.
+        #
+        # @return [ Auth::Aws::Credentials ] A valid set of credentials.
+        #
+        # @raise Auth::InvalidConfiguration if credentials could not be
+        #   retrieved for any reason, or if a source contains an invalid set
+        #   of credentials.
+        def credentials
+          if user
+            credentials = Credentials.new(
+              user.name,
+              user.password,
+              user.auth_mech_properties['aws_session_token'],
+            )
+
+            if credentials_valid?(credentials, 'Mongo::Client URI or Ruby options')
+              return credentials
+            end
+          end
+
+          credentials = Credentials.new(
+            ENV['AWS_ACCESS_KEY_ID'],
+            ENV['AWS_SECRET_ACCESS_KEY'],
+            ENV['AWS_SESSION_TOKEN'],
+          )
+
+          if credentials_valid?(credentials, 'environment variables')
+            return credentials
+          end
+
+          credentials = ecs_metadata_credentials
+
+          if credentials && credentials_valid?(credentials, 'ECS task metadata')
+            return credentials
+          end
+
+          credentials = ec2_metadata_credentials
+
+          if credentials && credentials_valid?(credentials, 'EC2 instance metadata')
+            return credentials
+          end
+
+          raise Auth::InvalidConfiguration,
+            "Could not locate AWS credentials (checked Client URI and Ruby options, environment variables, ECS and EC2 metadata)"
+        end
+
+        private
+
+        # Returns credentials from the EC2 metadata endpoint. The credentials
+        # could be empty, partial or invalid.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed.
+        def ec2_metadata_credentials
+          http = Net::HTTP.new('169.254.169.254')
+          req = Net::HTTP::Put.new('/latest/api/token',
+            # The TTL is required in order to obtain the metadata token.
+            {'x-aws-ec2-metadata-token-ttl-seconds' => '30'})
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http.request(req)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          metadata_token = resp.body
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http_get(http, '/latest/meta-data/iam/security-credentials', metadata_token)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          role_name = resp.body
+          escaped_role_name = CGI.escape(role_name).gsub('+', '%20')
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http_get(http, "/latest/meta-data/iam/security-credentials/#{escaped_role_name}", metadata_token)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          payload = JSON.parse(resp.body)
+          unless payload['Code'] == 'Success'
+            return nil
+          end
+          Credentials.new(
+            payload['AccessKeyId'],
+            payload['SecretAccessKey'],
+            payload['Token'],
+          )
+        # When trying to use the EC2 metadata endpoint on ECS:
+        # Errno::EINVAL: Failed to open TCP connection to 169.254.169.254:80 (Invalid argument - connect(2) for "169.254.169.254" port 80)
+        rescue ::Timeout::Error, IOError, SystemCallError
+          return nil
+        end
+
+        def ecs_metadata_credentials
+          relative_uri = ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
+          if relative_uri.nil? || relative_uri.empty?
+            return nil
+          end
+
+          http = Net::HTTP.new('169.254.170.2')
+          # Per https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+          # the value in AWS_CONTAINER_CREDENTIALS_RELATIVE_URI includes
+          # the leading slash.
+          # The current language in MONGODB-AWS specification implies that
+          # a leading slash must be added by the driver, but this is not
+          # in fact needed.
+          req = Net::HTTP::Get.new(relative_uri)
+          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+            http.request(req)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          payload = JSON.parse(resp.body)
+          Credentials.new(
+            payload['AccessKeyId'],
+            payload['SecretAccessKey'],
+            payload['Token'],
+          )
+        rescue ::Timeout::Error, IOError, SystemCallError
+          return nil
+        end
+
+        def http_get(http, uri, metadata_token)
+          req = Net::HTTP::Get.new(uri,
+            {'x-aws-ec2-metadata-token' => metadata_token})
+          http.request(req)
+        end
+
+        # Checks whether the credentials provided are valid.
+        #
+        # Returns true if they are valid, false if they are empty, and
+        # raises Auth::InvalidConfiguration if the credentials are
+        # incomplete (i.e. some of the components are missing).
+        def credentials_valid?(credentials, source)
+          unless credentials.access_key_id || credentials.secret_access_key ||
+            credentials.session_token
+          then
+            return false
+          end
+
+          if credentials.access_key_id || credentials.secret_access_key
+            if credentials.access_key_id && !credentials.secret_access_key
+              raise Auth::InvalidConfiguration,
+                "Access key ID is provided without secret access key (source: #{source})"
+            end
+
+            if credentials.secret_access_key && !credentials.access_key_id
+              raise Auth::InvalidConfiguration,
+                "Secret access key is provided without access key ID (source: #{source})"
+            end
+
+          elsif credentials.session_token
+            raise Auth::InvalidConfiguration,
+              "Session token is provided without access key ID or secret access key (source: #{source})"
+          end
+
+          true
+        end
+      end
+    end
+  end
+end