mongo 2.12.4 → 2.14.0.rc1

data/spec/integration/get_more_spec.rb

@@ -4,8 +4,16 @@ describe 'getMore operation' do
   # https://jira.mongodb.org/browse/RUBY-1987
   min_server_fcv '3.2'
 
+  let(:subscriber) { EventSubscriber.new }
+
+  let(:client) do
+    authorized_client.tap do |client|
+      client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+    end
+  end
+
   let(:collection) do
-    subscribed_client['get_more_spec']
+    client['get_more_spec']
   end
 
   let(:scope) do
@@ -16,11 +24,10 @@ describe 'getMore operation' do
     collection.delete_many
     collection.insert_one(a: 1)
     #collection.insert_one(a: 2)
-    EventSubscriber.clear_events!
   end
 
   let(:get_more_command) do
-    event = EventSubscriber.single_command_started_event('getMore')
+    event = subscriber.single_command_started_event('getMore')
     event.command['getMore']
   end
 

data/spec/integration/heartbeat_events_spec.rb

@@ -1,33 +1,14 @@
 require 'spec_helper'
 
-class TestHeartbeatSubscriber
-  def initialize
-    @started_events = []
-    @succeeded_events = []
-    @failed_events = []
-  end
-
-  attr_reader :started_events, :succeeded_events, :failed_events
-
-  def started(event)
-    @started_events << event
-  end
-
-  def succeeded(event)
-    @succeeded_events << event
-  end
-
-  def failed(event)
-    @failed_events << event
-  end
-end
-
 describe 'Heartbeat events' do
   class HeartbeatEventsSpecTestException < StandardError; end
 
+  # 4.4 has two monitors and thus issues heartbeats multiple times
+  max_server_version '4.2'
+
   clean_slate_for_all
 
-  let(:subscriber) { TestHeartbeatSubscriber.new }
+  let(:subscriber) { EventSubscriber.new }
 
   before do
     Mongo::Monitoring::Global.subscribe(Mongo::Monitoring::SERVER_HEARTBEAT, subscriber)
@@ -62,7 +43,7 @@ describe 'Heartbeat events' do
 
   it 'notifies on failed heartbeats' do
     exc = HeartbeatEventsSpecTestException.new
-    expect_any_instance_of(Mongo::Server::Monitor::Connection).to receive(:ismaster).at_least(:once).and_raise(exc)
+    expect_any_instance_of(Mongo::Server::Monitor).to receive(:ismaster).at_least(:once).and_raise(exc)
 
     expect do
       client.database.command(ismaster: 1)

data/spec/integration/ocsp_connectivity_spec.rb

@@ -0,0 +1,26 @@
+require 'lite_spec_helper'
+
+# These tests test the configurations described in
+# https://github.com/mongodb/specifications/blob/master/source/ocsp-support/tests/README.rst#integration-tests-permutations-to-be-tested
+describe 'OCSP connectivity' do
+  require_ocsp_connectivity
+  clear_ocsp_cache
+
+  let(:client) do
+    new_local_client(ENV.fetch('MONGODB_URI'),
+      server_selection_timeout: 5,
+    )
+  end
+
+  if ENV['OCSP_CONNECTIVITY'] == 'fail'
+    it 'fails to connect' do
+      lambda do
+        client.command(ping: 1)
+      end.should raise_error(Mongo::Error::NoServerAvailable, /UNKNOWN/)
+    end
+  else
+    it 'works' do
+      client.command(ping: 1)
+    end
+  end
+end

data/spec/integration/ocsp_verifier_cache_spec.rb

@@ -0,0 +1,188 @@
+require 'lite_spec_helper'
+require 'webrick'
+
+describe Mongo::Socket::OcspVerifier do
+  require_ocsp_verifier
+
+  shared_examples 'verifies' do
+    context 'mri' do
+      fails_on_jruby
+
+      it 'verifies the first time and reads from cache the second time' do
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+          verifier.verify_with_cache.should be true
+        end
+
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).not_to receive(:do_verify)
+
+          verifier.verify_with_cache.should be true
+        end
+      end
+    end
+
+    context 'jruby' do
+      require_jruby
+
+      # JRuby does not return OCSP endpoints, therefore we never perform
+      # any validation.
+      # https://github.com/jruby/jruby-openssl/issues/210
+      it 'does not verify' do
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+          verifier.verify.should be false
+        end
+
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+          verifier.verify.should be false
+        end
+      end
+    end
+  end
+
+  shared_examples 'fails verification' do
+    context 'mri' do
+      fails_on_jruby
+
+      it 'verifies the first time, reads from cache the second time, raises an exception in both cases' do
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+          lambda do
+            verifier.verify
+          # Redirect tests receive responses from port 8101,
+          # tests without redirects receive responses from port 8100.
+          end.should raise_error(Mongo::Error::ServerCertificateRevoked, %r,TLS certificate of 'foo' has been revoked according to 'http://localhost:810[01]/status',)
+        end
+
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).not_to receive(:do_verify)
+
+          lambda do
+            verifier.verify
+          # Redirect tests receive responses from port 8101,
+          # tests without redirects receive responses from port 8100.
+          end.should raise_error(Mongo::Error::ServerCertificateRevoked, %r,TLS certificate of 'foo' has been revoked according to 'http://localhost:810[01]/status',)
+        end
+      end
+    end
+
+    context 'jruby' do
+      require_jruby
+
+      # JRuby does not return OCSP endpoints, therefore we never perform
+      # any validation.
+      # https://github.com/jruby/jruby-openssl/issues/210
+      it 'does not verify' do
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+          verifier.verify.should be false
+        end
+
+        RSpec::Mocks.with_temporary_scope do
+          expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+          verifier.verify.should be false
+        end
+      end
+    end
+  end
+
+  shared_examples 'does not verify' do
+    it 'does not verify and does not raise an exception' do
+      RSpec::Mocks.with_temporary_scope do
+        expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+        verifier.verify.should be false
+      end
+
+      RSpec::Mocks.with_temporary_scope do
+        expect_any_instance_of(Mongo::Socket::OcspVerifier).to receive(:do_verify).and_call_original
+
+        verifier.verify.should be false
+      end
+    end
+  end
+
+  shared_context 'verifier' do |opts|
+    algorithm = opts[:algorithm]
+
+    let(:cert_path) { SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/server.pem") }
+    let(:ca_cert_path) { SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem") }
+
+    let(:cert) { OpenSSL::X509::Certificate.new(File.read(cert_path)) }
+    let(:ca_cert) { OpenSSL::X509::Certificate.new(File.read(ca_cert_path)) }
+
+    let(:cert_store) do
+      OpenSSL::X509::Store.new.tap do |store|
+        store.add_cert(ca_cert)
+      end
+    end
+
+    let(:verifier) do
+      described_class.new('foo', cert, ca_cert, cert_store, timeout: 3)
+    end
+  end
+
+  include_context 'verifier', algorithm: 'rsa'
+  algorithm = 'rsa'
+
+  %w(ca delegate).each do |responder_cert|
+    responder_cert_file_name = {
+      'ca' => 'ca',
+      'delegate' => 'ocsp-responder',
+    }.fetch(responder_cert)
+
+    context "when responder uses #{responder_cert} cert" do
+      context 'good response' do
+        with_ocsp_mock(
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+        )
+
+        include_examples 'verifies'
+
+        it 'does not wait for the timeout' do
+          lambda do
+            verifier.verify
+          end.should take_shorter_than 3
+        end
+      end
+
+      context 'revoked response' do
+        with_ocsp_mock(
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+          fault: 'revoked'
+        )
+
+        include_examples 'fails verification'
+      end
+
+      context 'unknown response' do
+        with_ocsp_mock(
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+          fault: 'unknown',
+        )
+
+        include_examples 'does not verify'
+
+        it 'does not wait for the timeout' do
+          lambda do
+            verifier.verify
+          end.should take_shorter_than 3
+        end
+      end
+    end
+  end
+end

data/spec/integration/ocsp_verifier_spec.rb

@@ -0,0 +1,334 @@
+require 'lite_spec_helper'
+require 'webrick'
+
+describe Mongo::Socket::OcspVerifier do
+  require_ocsp_verifier
+
+  shared_examples 'verifies' do
+    context 'mri' do
+      fails_on_jruby
+
+      it 'verifies' do
+        verifier.verify.should be true
+      end
+    end
+
+    context 'jruby' do
+      require_jruby
+
+      # JRuby does not return OCSP endpoints, therefore we never perform
+      # any validation.
+      # https://github.com/jruby/jruby-openssl/issues/210
+      it 'does not verify' do
+        verifier.verify.should be false
+      end
+    end
+  end
+
+  shared_examples 'fails verification' do
+    context 'mri' do
+      fails_on_jruby
+
+      it 'raises an exception' do
+        lambda do
+          verifier.verify
+        # Redirect tests receive responses from port 8101,
+        # tests without redirects receive responses from port 8100.
+        end.should raise_error(Mongo::Error::ServerCertificateRevoked, %r,TLS certificate of 'foo' has been revoked according to 'http://localhost:810[01]/status',)
+      end
+
+      it 'does not wait for the timeout' do
+        lambda do
+          lambda do
+            verifier.verify
+          end.should raise_error(Mongo::Error::ServerCertificateRevoked)
+        end.should take_shorter_than 3
+      end
+    end
+
+    context 'jruby' do
+      require_jruby
+
+      # JRuby does not return OCSP endpoints, therefore we never perform
+      # any validation.
+      # https://github.com/jruby/jruby-openssl/issues/210
+      it 'does not verify' do
+        verifier.verify.should be false
+      end
+    end
+  end
+
+  shared_examples 'does not verify' do
+    it 'does not verify and does not raise an exception' do
+      verifier.verify.should be false
+    end
+  end
+
+  shared_context 'basic verifier' do
+
+    let(:cert) { OpenSSL::X509::Certificate.new(File.read(cert_path)) }
+    let(:ca_cert) { OpenSSL::X509::Certificate.new(File.read(ca_cert_path)) }
+
+    let(:cert_store) do
+      OpenSSL::X509::Store.new.tap do |store|
+        store.add_cert(ca_cert)
+      end
+    end
+
+    let(:verifier) do
+      described_class.new('foo', cert, ca_cert, cert_store, timeout: 3)
+    end
+  end
+
+  shared_context 'verifier' do |opts|
+    algorithm = opts[:algorithm]
+
+    let(:cert_path) { SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/server.pem") }
+    let(:ca_cert_path) { SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem") }
+
+    include_context 'basic verifier'
+  end
+
+  %w(rsa ecdsa).each do |algorithm|
+    context "when using #{algorithm} cert" do
+      include_context 'verifier', algorithm: algorithm
+
+      context 'responder not responding' do
+        include_examples 'does not verify'
+
+        it 'does not wait for the timeout' do
+          # Loopback interface should be refusing connections, which will make
+          # the operation complete quickly.
+          lambda do
+            verifier.verify
+          end.should take_shorter_than 3
+        end
+      end
+
+      %w(ca delegate).each do |responder_cert|
+        responder_cert_file_name = {
+          'ca' => 'ca',
+          'delegate' => 'ocsp-responder',
+        }.fetch(responder_cert)
+
+        context "when responder uses #{responder_cert} cert" do
+          context 'good response' do
+            with_ocsp_mock(
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+            )
+
+            include_examples 'verifies'
+
+            it 'does not wait for the timeout' do
+              lambda do
+                verifier.verify
+              end.should take_shorter_than 3
+            end
+          end
+
+          context 'revoked response' do
+            with_ocsp_mock(
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+              fault: 'revoked'
+            )
+
+            include_examples 'fails verification'
+          end
+
+          context 'unknown response' do
+            with_ocsp_mock(
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+              SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+              fault: 'unknown',
+            )
+
+            include_examples 'does not verify'
+
+            it 'does not wait for the timeout' do
+              lambda do
+                verifier.verify
+              end.should take_shorter_than 3
+            end
+          end
+        end
+      end
+    end
+  end
+
+  context 'when OCSP responder redirects' do
+    algorithm = 'rsa'
+    responder_cert_file_name = 'ca'
+    let(:algorithm) { 'rsa' }
+    let(:responder_cert_file_name) { 'ca' }
+
+    context 'one time' do
+
+      around do |example|
+        server = WEBrick::HTTPServer.new(Port: 8100)
+        server.mount_proc '/' do |req, res|
+          res.status = 303
+          res['locAtion'] = "http://localhost:8101#{req.path}"
+          res.body = "See http://localhost:8101#{req.path}"
+        end
+        Thread.new { server.start }
+        begin
+          example.run
+        ensure
+          server.shutdown
+        end
+      end
+
+      include_context 'verifier', algorithm: algorithm
+
+      context 'good response' do
+        with_ocsp_mock(
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+          port: 8101,
+        )
+
+        include_examples 'verifies'
+
+        it 'does not wait for the timeout' do
+          lambda do
+            verifier.verify
+          end.should take_shorter_than 3
+        end
+      end
+
+      context 'revoked response' do
+        with_ocsp_mock(
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+          fault: 'revoked',
+          port: 8101,
+        )
+
+        include_examples 'fails verification'
+      end
+
+      context 'unknown response' do
+        with_ocsp_mock(
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+          SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+          fault: 'unknown',
+          port: 8101,
+        )
+
+        include_examples 'does not verify'
+
+        it 'does not wait for the timeout' do
+          lambda do
+            verifier.verify
+          end.should take_shorter_than 3
+        end
+      end
+    end
+
+    context 'infinitely' do
+      with_ocsp_mock(
+        SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/ca.pem"),
+        SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.crt"),
+        SpecConfig.instance.ocsp_files_dir.join("#{algorithm}/#{responder_cert_file_name}.key"),
+        port: 8101,
+      )
+
+      around do |example|
+        server = WEBrick::HTTPServer.new(Port: 8100)
+        server.mount_proc '/' do |req, res|
+          res.status = 303
+          res['locAtion'] = req.path
+          res.body = "See #{req.path} indefinitely"
+        end
+        Thread.new { server.start }
+        begin
+          example.run
+        ensure
+          server.shutdown
+        end
+      end
+
+      include_context 'verifier', algorithm: algorithm
+      include_examples 'does not verify'
+    end
+  end
+
+  context 'responder returns unexpected status code' do
+
+    include_context 'verifier', algorithm: 'rsa'
+
+    context '40x / 50x' do
+      around do |example|
+        server = WEBrick::HTTPServer.new(Port: 8100)
+        server.mount_proc '/' do |req, res|
+          res.status = code
+          res.body = "HTTP #{code}"
+        end
+        Thread.new { server.start }
+        begin
+          example.run
+        ensure
+          server.shutdown
+        end
+      end
+
+      [400, 404, 500, 503].each do |_code|
+        context "code #{_code}" do
+          let(:code) { _code }
+          include_examples 'does not verify'
+        end
+      end
+    end
+
+    context '204' do
+      around do |example|
+        server = WEBrick::HTTPServer.new(Port: 8100)
+        server.mount_proc '/' do |req, res|
+          res.status = 204
+        end
+        Thread.new { server.start }
+        begin
+          example.run
+        ensure
+          server.shutdown
+        end
+      end
+
+      context "code 204" do
+        let(:code) { 204 }
+        include_examples 'does not verify'
+      end
+    end
+  end
+
+  context 'responder URI has no path' do
+    require_external_connectivity
+
+    include_context 'basic verifier'
+
+    let(:cert_path) { File.join(File.dirname(__FILE__), '../support/certificates/atlas-ocsp.crt') }
+    let(:ca_cert_path) { File.join(File.dirname(__FILE__), '../support/certificates/atlas-ocsp-ca.crt') }
+    let(:cert_store) do
+      OpenSSL::X509::Store.new.tap do |store|
+        store.set_default_paths
+      end
+    end
+
+    before do
+      URI.parse(verifier.ocsp_uris.first).path.should == ''
+    end
+
+    it 'verifies' do
+      # TODO This test might fail if the certificate expires?
+      verifier.verify.should be true
+    end
+  end
+end