mongo 2.12.4 → 2.14.0.rc1

data/spec/mongo/auth/scram256/conversation_spec.rb

@@ -0,0 +1,171 @@
+require 'lite_spec_helper'
+require 'support/shared/scram_conversation'
+
+describe Mongo::Auth::Scram256::Conversation do
+  # Test uses global assertions
+  clean_slate_for_all_if_possible
+
+  include_context 'scram conversation context'
+
+  let(:conversation) do
+    described_class.new(user, double('connection'))
+  end
+
+  it_behaves_like 'scram conversation'
+
+  let(:user) do
+    Mongo::Auth::User.new(
+      database: Mongo::Database::ADMIN,
+      user: 'user',
+      password: 'pencil',
+      auth_mech: :scram256,
+    )
+  end
+
+  let(:mechanism) do
+    :scram256
+  end
+
+  describe '#start' do
+
+    let(:query) do
+      conversation.start(nil)
+    end
+
+    before do
+      expect(SecureRandom).to receive(:base64).once.and_return('rOprNGfwEbeRWgbNEkqO')
+    end
+
+    let(:selector) do
+      query.selector
+    end
+
+    it 'sets the sasl start flag' do
+      expect(selector[:saslStart]).to eq(1)
+    end
+
+    it 'sets the auto authorize flag' do
+      expect(selector[:autoAuthorize]).to eq(1)
+    end
+
+    it 'sets the mechanism' do
+      expect(selector[:mechanism]).to eq('SCRAM-SHA-256')
+    end
+
+    it 'sets the payload' do
+      expect(selector[:payload].data).to eq('n,,n=user,r=rOprNGfwEbeRWgbNEkqO')
+    end
+  end
+
+  describe '#continue' do
+    include_context 'scram continue and finalize replies'
+
+    before do
+      expect(SecureRandom).to receive(:base64).once.and_return('rOprNGfwEbeRWgbNEkqO')
+    end
+
+    context 'when the server rnonce starts with the nonce' do
+
+      let(:continue_payload) do
+        BSON::Binary.new(
+          'r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096'
+        )
+      end
+
+      let(:query) do
+        conversation.continue(continue_document, connection)
+      end
+
+      let(:selector) do
+        query.selector
+      end
+
+      it 'sets the conversation id' do
+        expect(selector[:conversationId]).to eq(1)
+      end
+
+      it 'sets the payload' do
+        expect(selector[:payload].data).to eq(
+          'c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=dHzbZapWIk4jUhN+Ute9ytag9zjfMHgsqmmiz7AndVQ='
+        )
+      end
+
+      it 'sets the continue flag' do
+        expect(selector[:saslContinue]).to eq(1)
+      end
+    end
+
+    context 'when the server nonce does not start with the nonce' do
+
+      let(:continue_payload) do
+        BSON::Binary.new(
+          'r=sOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096'
+        )
+      end
+
+      it 'raises an error' do
+        expect {
+          conversation.continue(continue_document, connection)
+        }.to raise_error(Mongo::Error::InvalidNonce)
+      end
+    end
+  end
+
+  describe '#finalize' do
+    include_context 'scram continue and finalize replies'
+
+    let(:continue_payload) do
+      BSON::Binary.new(
+        'r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096'
+      )
+    end
+
+    before do
+      expect(SecureRandom).to receive(:base64).once.and_return('rOprNGfwEbeRWgbNEkqO')
+    end
+
+    context 'when the verifier matches the server signature' do
+
+      let(:finalize_payload) do
+        BSON::Binary.new(' v=6rriTRBi23WpRR/wtup+mMhUZUn/dB5nLTJRsjl95G4=')
+      end
+
+      let(:query) do
+        conversation.continue(continue_document, connection)
+        conversation.process_continue_response(finalize_document)
+        conversation.finalize(connection)
+      end
+
+      let(:selector) do
+        query.selector
+      end
+
+      it 'sets the conversation id' do
+        expect(selector[:conversationId]).to eq(1)
+      end
+
+      it 'sets the empty payload' do
+        expect(selector[:payload].data).to eq('')
+      end
+
+      it 'sets the continue flag' do
+        expect(selector[:saslContinue]).to eq(1)
+      end
+    end
+
+    context 'when the verifier does not match the server signature' do
+
+      let(:finalize_payload) do
+        BSON::Binary.new('v=7rriTRBi23WpRR/wtup+mMhUZUn/dB5nLTJRsjl95G4=')
+      end
+
+      it 'raises an error' do
+        expect do
+          conversation.continue(continue_document, connection)
+          conversation.process_continue_response(finalize_document)
+          conversation.finalize(connection)
+        end.to raise_error(Mongo::Error::InvalidSignature)
+      end
+    end
+  end
+end

data/spec/mongo/auth/{scram/negotiation_spec.rb → scram_negotiation_spec.rb}

@@ -5,6 +5,7 @@ require 'spec_helper'
 
 describe 'SCRAM-SHA auth mechanism negotiation' do
   min_server_fcv '4.0'
+  require_no_external_user
   # Test uses global assertions
   clean_slate
 
@@ -199,11 +200,12 @@ describe 'SCRAM-SHA auth mechanism negotiation' do
           it 'authenticates successfully' do
             RSpec::Mocks.with_temporary_scope do
               mechanism = nil
-              expect(Mongo::Auth).to receive(:get).and_wrap_original do |m, user|
+              # With speculative auth, Auth is instantiated twice.
+              expect(Mongo::Auth).to receive(:get).at_least(:once).at_most(:twice).and_wrap_original do |m, user, connection|
                 # copy mechanism here rather than whole user
                 # in case something mutates mechanism later
                 mechanism = user.mechanism
-                m.call(user)
+                m.call(user, connection)
               end
 
               expect do
@@ -227,11 +229,12 @@ describe 'SCRAM-SHA auth mechanism negotiation' do
           it 'authenticates successfully with SCRAM-SHA-256' do
             RSpec::Mocks.with_temporary_scope do
               mechanism = nil
-              expect(Mongo::Auth).to receive(:get).and_wrap_original do |m, user|
+              # With speculative auth, Auth is instantiated twice.
+              expect(Mongo::Auth).to receive(:get).at_least(:once).at_most(:twice).and_wrap_original do |m, user, connection|
                 # copy mechanism here rather than whole user
                 # in case something mutates mechanism later
                 mechanism = user.mechanism
-                m.call(user)
+                m.call(user, connection)
               end
 
               expect { result }.not_to raise_error
@@ -479,11 +482,12 @@ describe 'SCRAM-SHA auth mechanism negotiation' do
           it 'authenticates successfully' do
             RSpec::Mocks.with_temporary_scope do
               mechanism = nil
-              expect(Mongo::Auth).to receive(:get).and_wrap_original do |m, user|
+              # With speculative auth, Auth is instantiated twice.
+              expect(Mongo::Auth).to receive(:get).at_least(:once).at_most(:twice).and_wrap_original do |m, user, connection|
                 # copy mechanism here rather than whole user
                 # in case something mutates mechanism later
                 mechanism = user.mechanism
-                m.call(user)
+                m.call(user, connection)
               end
 
               expect { result }.not_to raise_error
@@ -505,11 +509,12 @@ describe 'SCRAM-SHA auth mechanism negotiation' do
           it 'authenticates successfully with SCRAM-SHA-256' do
             RSpec::Mocks.with_temporary_scope do
               mechanism = nil
-              expect(Mongo::Auth).to receive(:get).and_wrap_original do |m, user|
+              # With speculative auth, Auth is instantiated twice.
+              expect(Mongo::Auth).to receive(:get).at_least(:once).at_most(:twice).and_wrap_original do |m, user, connection|
                 # copy mechanism here rather than whole user
                 # in case something mutates mechanism later
                 mechanism = user.mechanism
-                m.call(user)
+                m.call(user, connection)
               end
 
               expect { result }.not_to raise_error

data/spec/mongo/auth/scram_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
-describe Mongo::Auth::SCRAM do
-  require_no_x509_auth
+describe Mongo::Auth::Scram do
+  require_no_external_user
 
   let(:server) do
     authorized_client.cluster.next_primary
@@ -29,8 +29,7 @@ describe Mongo::Auth::SCRAM do
     end
   end
 
-  context 'when SCRAM-SHA-1 is used' do
-    min_server_fcv '3.0'
+  shared_examples_for 'works correctly' do
 
     before do
       connection.connect!
@@ -45,18 +44,18 @@ describe Mongo::Auth::SCRAM do
             database: 'driver',
             user: 'notauser',
             password: 'password',
-            auth_mech: :scram,
+            auth_mech: auth_mech,
           )
         end
 
         let(:authenticator) do
-          described_class.new(user)
+          described_class.new(user, connection)
         end
 
         it 'raises an exception' do
-          expect {
-            authenticator.login(connection)
-          }.to raise_error(Mongo::Auth::Unauthorized)
+          expect do
+            authenticator.login
+          end.to raise_error(Mongo::Auth::Unauthorized)
         end
 
         context 'when compression is used' do
@@ -66,7 +65,7 @@ describe Mongo::Auth::SCRAM do
           it 'does not compress the message' do
             expect(Mongo::Protocol::Compressed).not_to receive(:new)
             expect {
-              authenticator.login(connection)
+              authenticator.login
             }.to raise_error(Mongo::Auth::Unauthorized)
           end
         end
@@ -75,11 +74,11 @@ describe Mongo::Auth::SCRAM do
       context 'when the user is authorized for the database' do
 
         let(:authenticator) do
-          described_class.new(test_user)
+          described_class.new(test_user, connection)
         end
 
         let(:login) do
-          authenticator.login(connection).documents[0]
+          authenticator.login
         end
 
         it 'logs the user into the connection' do
@@ -89,71 +88,32 @@ describe Mongo::Auth::SCRAM do
         it_behaves_like 'caches scram credentials', :salted_password
         it_behaves_like 'caches scram credentials', :client_key
         it_behaves_like 'caches scram credentials', :server_key
-      end
-    end
-  end
-
-  context 'when SCRAM-SHA-256 is used' do
-    min_server_fcv '4.0'
-
-    before do
-      connection.connect!
-    end
-
-    describe '#login' do
-
-      context 'when the user is not authorized' do
-
-        let(:user) do
-          Mongo::Auth::User.new(
-            database: 'driver',
-            user: 'notauser',
-            password: 'password',
-            auth_mech: :scram256,
-          )
-        end
-
-        let(:authenticator) do
-          described_class.new(user)
-        end
-
-        it 'raises an exception' do
-          expect {
-            authenticator.login(connection)
-          }.to raise_error(Mongo::Auth::Unauthorized)
-        end
 
-        context 'when compression is used' do
-          require_compression
-          min_server_fcv '3.6'
-
-          it 'does not compress the message' do
-            expect(Mongo::Protocol::Compressed).not_to receive(:new)
-            expect {
-              authenticator.login(connection)
-            }.to raise_error(Mongo::Auth::Unauthorized)
+        context 'if conversation has not verified server signature' do
+          it 'raises an exception' do
+            expect_any_instance_of(Mongo::Auth::ScramConversationBase).to receive(:server_verified?).and_return(false)
+            lambda do
+              login
+            end.should raise_error(Mongo::Error::MissingScramServerSignature)
           end
         end
       end
+    end
+  end
 
-      context 'when the user is authorized for the database' do
+  context 'when SCRAM-SHA-1 is used' do
+    min_server_fcv '3.0'
 
-        let(:authenticator) do
-          described_class.new(test_user)
-        end
+    let(:auth_mech) { :scram }
 
-        let(:login) do
-          authenticator.login(connection).documents[0]
-        end
+    it_behaves_like 'works correctly'
+  end
 
-        it 'logs the user into the connection' do
-          expect(login['ok']).to eq(1)
-        end
+  context 'when SCRAM-SHA-256 is used' do
+    min_server_fcv '4.0'
 
-        it_behaves_like 'caches scram credentials', :salted_password
-        it_behaves_like 'caches scram credentials', :client_key
-        it_behaves_like 'caches scram credentials', :server_key
-      end
-    end
+    let(:auth_mech) { :scram256 }
+
+    it_behaves_like 'works correctly'
   end
 end

data/spec/mongo/auth/user_spec.rb

@@ -47,7 +47,7 @@ describe Mongo::Auth::User do
       it 'raises ArgumentError' do
         expect do
           user
-        end.to raise_error(Mongo::Auth::InvalidMechanism, ":invalid is invalid, please use one of the following mechanisms: :mongodb_cr, :mongodb_x509, :plain, :scram, :scram256")
+        end.to raise_error(Mongo::Auth::InvalidMechanism, ":invalid is invalid, please use one of the following mechanisms: :aws, :gssapi, :mongodb_cr, :mongodb_x509, :plain, :scram, :scram256")
       end
     end
 

data/spec/mongo/auth/x509/conversation_spec.rb

@@ -10,7 +10,7 @@ describe Mongo::Auth::X509::Conversation do
   end
 
   let(:conversation) do
-    described_class.new(user)
+    described_class.new(user, double('connection'))
   end
 
   describe '#start' do

data/spec/mongo/auth/x509_spec.rb

@@ -23,7 +23,7 @@ describe Mongo::Auth::X509 do
       end
 
       it 'works' do
-        described_class.new(user)
+        described_class.new(user, connection)
       end
     end
 
@@ -35,7 +35,7 @@ describe Mongo::Auth::X509 do
 
       it 'raises InvalidConfiguration' do
         expect do
-          described_class.new(user)
+          described_class.new(user, connection)
         end.to raise_error(Mongo::Auth::InvalidConfiguration, /User specifies auth source 'foo', but the only valid auth source for X.509 is '\$external'/)
       end
     end
@@ -44,7 +44,7 @@ describe Mongo::Auth::X509 do
   describe '#login' do
     # When x509 auth is configured, the login would work and this test
     # requires the login to fail.
-    require_no_x509_auth
+    require_no_external_user
 
     context 'when the user is not authorized for the database' do
 
@@ -53,17 +53,17 @@ describe Mongo::Auth::X509 do
       end
 
       let(:x509) do
-        described_class.new(user)
+        described_class.new(user, connection)
       end
 
       let(:login) do
-        x509.login(connection).documents[0]
+        x509.login.documents[0]
       end
 
       it 'attempts to log the user into the connection' do
-        expect {
-          x509.login(connection)
-        }.to raise_error(Mongo::Auth::Unauthorized)
+        expect do
+          x509.login
+        end.to raise_error(Mongo::Auth::Unauthorized)
       end
     end
   end