mongo 2.12.4 → 2.14.0.rc1

data/lib/mongo/socket/ssl.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,13 +15,105 @@
 module Mongo
   class Socket
 
-    # Wrapper for SSL sockets.
+    # Wrapper for TLS sockets.
     #
     # @since 2.0.0
     class SSL < Socket
       include OpenSSL
 
-      # @return [ SSLContext ] context The ssl context.
+      # Initializes a new TLS socket.
+      #
+      # @example Create the TLS socket.
+      #   SSL.new('::1', 27017, 30)
+      #
+      # @param [ String ] host The hostname or IP address.
+      # @param [ Integer ] port The port number.
+      # @param [ Float ] timeout The socket timeout value.
+      # @param [ Integer ] family The socket family.
+      # @param [ Hash ] options The options.
+      #
+      # @option options [ Float ] :connect_timeout Connect timeout.
+      # @option options [ Address ] :connection_address Address of the
+      #   connection that created this socket.
+      # @option options [ Integer ] :connection_generation Generation of the
+      #   connection (for non-monitoring connections) that created this socket.
+      # @option options [ true | false ] :monitor Whether this socket was
+      #   created by a monitoring connection.
+      # @option options [ String ] :ssl_ca_cert The file containing concatenated
+      #   certificate authority certificates used to validate certs passed from the
+      #   other end of the connection. Intermediate certificates should NOT be
+      #   specified in files referenced by this option. One of :ssl_ca_cert,
+      #   :ssl_ca_cert_string or :ssl_ca_cert_object (in order of priority) is
+      #   required when using :ssl_verify.
+      # @option options [ Array<OpenSSL::X509::Certificate> ] :ssl_ca_cert_object
+      #   An array of OpenSSL::X509::Certificate objects representing the
+      #   certificate authority certificates used to validate certs passed from
+      #   the other end of the connection. Intermediate certificates should NOT
+      #   be specified in files referenced by this option. One of :ssl_ca_cert,
+      #   :ssl_ca_cert_string or :ssl_ca_cert_object (in order of priority)
+      #   is required when using :ssl_verify.
+      # @option options [ String ] :ssl_ca_cert_string A string containing
+      #   certificate authority certificate used to validate certs passed from the
+      #   other end of the connection. This option allows passing only one CA
+      #   certificate to the driver. Intermediate certificates should NOT
+      #   be specified in files referenced by this option. One of :ssl_ca_cert,
+      #   :ssl_ca_cert_string or :ssl_ca_cert_object (in order of priority) is
+      #   required when using :ssl_verify.
+      # @option options [ String ] :ssl_cert The certificate file used to identify
+      #   the connection against MongoDB. A certificate chain may be passed by
+      #   specifying the client certificate first followed by any intermediate
+      #   certificates up to the CA certificate. The file may also contain the
+      #   certificate's private key, which will be ignored. This option, if present,
+      #   takes precedence over the values of :ssl_cert_string and :ssl_cert_object
+      # @option options [ OpenSSL::X509::Certificate ] :ssl_cert_object The OpenSSL::X509::Certificate
+      #   used to identify the connection against MongoDB. Only one certificate
+      #   may be passed through this option.
+      # @option options [ String ] :ssl_cert_string A string containing the PEM-encoded
+      #   certificate used to identify the connection against MongoDB. A certificate
+      #   chain may be passed by specifying the client certificate first followed
+      #   by any intermediate certificates up to the CA certificate. The string
+      #   may also contain the certificate's private key, which will be ignored,
+      #   This option, if present, takes precedence over the value of :ssl_cert_object
+      # @option options [ String ] :ssl_key The private keyfile used to identify the
+      #   connection against MongoDB. Note that even if the key is stored in the same
+      #   file as the certificate, both need to be explicitly specified. This option,
+      #   if present, takes precedence over the values of :ssl_key_string and :ssl_key_object
+      # @option options [ OpenSSL::PKey ] :ssl_key_object The private key used to identify the
+      #   connection against MongoDB
+      # @option options [ String ] :ssl_key_pass_phrase A passphrase for the private key.
+      # @option options [ String ] :ssl_key_string A string containing the PEM-encoded private key
+      #   used to identify the connection against MongoDB. This parameter, if present,
+      #   takes precedence over the value of option :ssl_key_object
+      # @option options [ true, false ] :ssl_verify Whether to perform peer certificate validation and
+      #   hostname verification. Note that the decision of whether to validate certificates will be
+      #   overridden if :ssl_verify_certificate is set, and the decision of whether to validate
+      #   hostnames will be overridden if :ssl_verify_hostname is set.
+      # @option options [ true, false ] :ssl_verify_certificate Whether to perform peer certificate
+      #   validation. This setting overrides :ssl_verify with respect to whether certificate
+      #   validation is performed.
+      # @option options [ true, false ] :ssl_verify_hostname Whether to perform peer hostname
+      #   validation. This setting overrides :ssl_verify with respect to whether hostname validation
+      #   is performed.
+      #
+      # @since 2.0.0
+      # @api private
+      def initialize(host, port, host_name, timeout, family, options = {})
+        super(timeout, options)
+        @host, @port, @host_name = host, port, host_name
+        @context = create_context(options)
+        @family = family
+        @tcp_socket = ::Socket.new(family, SOCK_STREAM, 0)
+        begin
+          @tcp_socket.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
+          set_socket_options(@tcp_socket)
+          connect!
+        rescue
+          @tcp_socket.close
+          raise
+        end
+      end
+
+      # @return [ SSLContext ] context The TLS context.
       attr_reader :context
 
       # @return [ String ] host The host to connect to.
@@ -45,18 +137,19 @@ module Mongo
       #
       # @since 2.0.0
       def connect!
-        Timeout.timeout(options[:connect_timeout], Error::SocketTimeoutError) do
-          handle_errors do
+        Timeout.timeout(options[:connect_timeout], Error::SocketTimeoutError, "The socket took over #{options[:connect_timeout]} seconds to connect") do
+          map_exceptions do
             @tcp_socket.connect(::Socket.pack_sockaddr_in(port, host))
           end
           @socket = OpenSSL::SSL::SSLSocket.new(@tcp_socket, context)
           begin
             @socket.hostname = @host_name
             @socket.sync_close = true
-            handle_errors do
+            map_exceptions do
               @socket.connect
             end
             verify_certificate!(@socket)
+            verify_ocsp_endpoint!(@socket)
           rescue
             @socket.close
             @socket = nil
@@ -67,35 +160,6 @@ module Mongo
       end
       private :connect!
 
-      # Initializes a new SSL socket.
-      #
-      # @example Create the SSL socket.
-      #   SSL.new('::1', 27017, 30)
-      #
-      # @param [ String ] host The hostname or IP address.
-      # @param [ Integer ] port The port number.
-      # @param [ Float ] timeout The socket timeout value.
-      # @param [ Integer ] family The socket family.
-      # @param [ Hash ] options The options.
-      #
-      # @option options [ Float ] :connect_timeout Connect timeout.
-      #
-      # @since 2.0.0
-      def initialize(host, port, host_name, timeout, family, options = {})
-        @host, @port, @host_name, @timeout, @options = host, port, host_name, timeout, options
-        @context = create_context(options)
-        @family = family
-        @tcp_socket = ::Socket.new(family, SOCK_STREAM, 0)
-        begin
-          @tcp_socket.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
-          set_socket_options(@tcp_socket)
-          connect!
-        rescue
-          @tcp_socket.close
-          raise
-        end
-      end
-
       # Read a single byte from the socket.
       #
       # @example Read a single byte.
@@ -105,7 +169,7 @@ module Mongo
       #
       # @since 2.0.0
       def readbyte
-        handle_errors do
+        map_exceptions do
           byte = socket.read(1).bytes.to_a[0]
           byte.nil? ? raise(EOFError) : byte
         end
@@ -114,29 +178,36 @@ module Mongo
       private
 
       def verify_certificate?
-        @verify_certificate ||=
-          # If ssl_verify_certificate is not present, disable only if ssl_verify is
-          # explicitly set to false.
-          if options[:ssl_verify_certificate].nil?
-            options[:ssl_verify] != false
-          # If ssl_verify_certificate is present, enable or disable based on its value.
-          else
-            !!options[:ssl_verify_certificate]
-          end
+        # If ssl_verify_certificate is not present, disable only if
+        # ssl_verify is explicitly set to false.
+        if options[:ssl_verify_certificate].nil?
+          options[:ssl_verify] != false
+        # If ssl_verify_certificate is present, enable or disable based on its value.
+        else
+          !!options[:ssl_verify_certificate]
+        end
       end
 
       def verify_hostname?
-        @verify_hostname ||=
-          # If ssl_verify_hostname is not present, disable only if ssl_verify is
-          # explicitly set to false.
-          if options[:ssl_verify_hostname].nil?
-            options[:ssl_verify] != false
-          # If ssl_verify_hostname is present, enable or disable based on its value.
-          else
-            !!options[:ssl_verify_hostname]
-          end
+        # If ssl_verify_hostname is not present, disable only if ssl_verify is
+        # explicitly set to false.
+        if options[:ssl_verify_hostname].nil?
+          options[:ssl_verify] != false
+        # If ssl_verify_hostname is present, enable or disable based on its value.
+        else
+          !!options[:ssl_verify_hostname]
+        end
       end
 
+      def verify_ocsp_endpoint?
+        if !options[:ssl_verify_ocsp_endpoint].nil?
+          options[:ssl_verify_ocsp_endpoint] != false
+        elsif !options[:ssl_verify_certificate].nil?
+          options[:ssl_verify_certificate] != false
+        else
+          options[:ssl_verify] != false
+        end
+      end
 
       def create_context(options)
         OpenSSL::SSL::SSLContext.new.tap do |context|
@@ -281,18 +352,31 @@ module Mongo
       def verify_certificate!(socket)
         if verify_hostname?
           unless OpenSSL::SSL.verify_certificate_identity(socket.peer_cert, host_name)
-            raise Error::SocketError, 'SSL handshake failed due to a hostname mismatch.'
+            raise Error::SocketError, 'TLS handshake failed due to a hostname mismatch.'
           end
         end
       end
 
+      def verify_ocsp_endpoint!(socket)
+        unless verify_ocsp_endpoint?
+          return
+        end
+
+        cert = socket.peer_cert
+        ca_cert = socket.peer_cert_chain.last
+
+        verifier = OcspVerifier.new(@host_name, cert, ca_cert, context.cert_store,
+          **Utils.shallow_symbolize_keys(options))
+        verifier.verify_with_cache
+      end
+
       def read_buffer_size
-        # Buffer size for SSL reads.
+        # Buffer size for TLS reads.
         # Capped at 16k due to https://linux.die.net/man/3/ssl_read
         16384
       end
 
-      def address
+      def human_address
         "#{host}:#{port} (#{host_name}:#{port}, TLS)"
       end
     end

data/lib/mongo/socket/tcp.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,34 +20,6 @@ module Mongo
     # @since 2.0.0
     class TCP < Socket
 
-      # @return [ String ] host The host to connect to.
-      attr_reader :host
-
-      # @return [ Integer ] port The port to connect to.
-      attr_reader :port
-
-      # Establishes a socket connection.
-      #
-      # @example Connect the socket.
-      #   sock.connect!
-      #
-      # @note This method mutates the object by setting the socket
-      #   internally.
-      #
-      # @return [ TCP ] The connected socket instance.
-      #
-      # @since 2.0.0
-      def connect!
-        Timeout.timeout(options[:connect_timeout], Error::SocketTimeoutError) do
-          socket.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
-          handle_errors do
-            socket.connect(::Socket.pack_sockaddr_in(port, host))
-          end
-          self
-        end
-      end
-      private :connect!
-
       # Initializes a new TCP socket.
       #
       # @example Create the TCP socket.
@@ -61,10 +33,18 @@ module Mongo
       # @param [ Hash ] options The options.
       #
       # @option options [ Float ] :connect_timeout Connect timeout.
+      # @option options [ Address ] :connection_address Address of the
+      #   connection that created this socket.
+      # @option options [ Integer ] :connection_generation Generation of the
+      #   connection (for non-monitoring connections) that created this socket.
+      # @option options [ true | false ] :monitor Whether this socket was
+      #   created by a monitoring connection.
       #
       # @since 2.0.0
+      # @api private
       def initialize(host, port, timeout, family, options = {})
-        @host, @port, @timeout, @options = host, port, timeout, options
+        super(timeout, options)
+        @host, @port = host, port
         @family = family
         @socket = ::Socket.new(family, SOCK_STREAM, 0)
         begin
@@ -76,9 +56,37 @@ module Mongo
         end
       end
 
+      # @return [ String ] host The host to connect to.
+      attr_reader :host
+
+      # @return [ Integer ] port The port to connect to.
+      attr_reader :port
+
+      # Establishes a socket connection.
+      #
+      # @example Connect the socket.
+      #   sock.connect!
+      #
+      # @note This method mutates the object by setting the socket
+      #   internally.
+      #
+      # @return [ TCP ] The connected socket instance.
+      #
+      # @since 2.0.0
+      def connect!
+        Timeout.timeout(options[:connect_timeout], Error::SocketTimeoutError, "The socket took over #{options[:connect_timeout]} seconds to connect") do
+          socket.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
+          map_exceptions do
+            socket.connect(::Socket.pack_sockaddr_in(port, host))
+          end
+          self
+        end
+      end
+      private :connect!
+
       private
 
-      def address
+      def human_address
         "#{host}:#{port} (no TLS)"
       end
     end

data/lib/mongo/socket/unix.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,9 +20,6 @@ module Mongo
     # @since 2.0.0
     class Unix < Socket
 
-      # @return [ String ] path The path to connect to.
-      attr_reader :path
-
       # Initializes a new Unix socket.
       #
       # @example Create the Unix socket.
@@ -33,17 +30,28 @@ module Mongo
       # @param [ Hash ] options The options.
       #
       # @option options [ Float ] :connect_timeout Connect timeout (unused).
+      # @option options [ Address ] :connection_address Address of the
+      #   connection that created this socket.
+      # @option options [ Integer ] :connection_generation Generation of the
+      #   connection (for non-monitoring connections) that created this socket.
+      # @option options [ true | false ] :monitor Whether this socket was
+      #   created by a monitoring connection.
       #
       # @since 2.0.0
+      # @api private
       def initialize(path, timeout, options = {})
-        @path, @timeout, @options = path, timeout, options
+        super(timeout, options)
+        @path = path
         @socket = ::UNIXSocket.new(path)
         set_socket_options(@socket)
       end
 
+      # @return [ String ] path The path to connect to.
+      attr_reader :path
+
       private
 
-      def address
+      def human_address
         path
       end
     end

data/lib/mongo/srv.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2019 MongoDB, Inc.
+# Copyright (C) 2019-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.

data/lib/mongo/srv/monitor.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -34,24 +34,18 @@ module Mongo
       # Creates the SRV monitor.
       #
       # @param [ Cluster ] cluster The cluster.
-      # @param [ Hash ] options The cluster options.
       #
-      # @option options [ Float ] :timeout The timeout to use for DNS lookups.
-      # @option options [ URI::SRVProtocol ] :srv_uri The SRV URI to monitor.
-      # @option options [ Hash ] :resolv_options For internal driver use only.
+      # @option opts [ Float ] :timeout The timeout to use for DNS lookups.
+      # @option opts [ URI::SRVProtocol ] :srv_uri The SRV URI to monitor.
+      # @option opts [ Hash ] :resolv_options For internal driver use only.
       #   Options to pass through to Resolv::DNS constructor for SRV lookups.
-      def initialize(cluster, options = nil)
-        options = if options
-          options.dup
-        else
-          {}
-        end
+      def initialize(cluster, **opts)
         @cluster = cluster
-        @resolver = Srv::Resolver.new(options)
-        unless @srv_uri = options.delete(:srv_uri)
+        unless @srv_uri = opts.delete(:srv_uri)
           raise ArgumentError, 'SRV URI is required'
         end
-        @options = options.freeze
+        @options = opts.freeze
+        @resolver = Srv::Resolver.new(**opts)
         @last_result = @srv_uri.srv_result
         @stop_semaphore = Semaphore.new
       end