mongo 2.13.3 → 2.14.0.rc1

data/spec/spec_tests/data/uri_options/auth-options.yml

@@ -12,6 +12,31 @@ tests:
                 SERVICE_NAME: "other"
                 CANONICALIZE_HOST_NAME: true
             authSource: "$external"
+    -
+        description: "Mixed case in auth mechanism properties is preserved"
+        uri: "mongodb://foo:bar@example.com/?authMechanism=GSSAPI&authMechanismProperties=PropertyName:PropertyValue&authSource=$external"
+        valid: true
+        warning: false
+        hosts: ~
+        auth: ~
+        options:
+            authMechanism: "GSSAPI"
+            authMechanismProperties:
+                PropertyName: PropertyValue
+                service_name: mongodb
+            authSource: "$external"
+    -
+        description: "Auth mechanism properties are all invalid"
+        uri: "mongodb://foo:bar@example.com/?authMechanism=GSSAPI&authMechanismProperties=PropertyName&authSource=$external"
+        valid: true
+        warning: true
+        hosts: ~
+        auth: ~
+        options:
+            authMechanism: "GSSAPI"
+            authMechanismProperties:
+                service_name: mongodb
+            authSource: "$external"
     -
         description: "Valid auth options are parsed correctly (SCRAM-SHA-1)"
         uri: "mongodb://foo:bar@example.com/?authMechanism=SCRAM-SHA-1&authSource=authSourceDB"

data/spec/spec_tests/data/uri_options/compression-options.yml

@@ -28,7 +28,8 @@ tests:
         warning: true
         hosts: ~
         auth: ~
-        options: {}
+        # https://jira.mongodb.org/browse/DRIVERS-1368
+        options: ~
     -
         description: "Too low zlibCompressionLevel causes a warning"
         uri: "mongodb://example.com/?compressors=zlib&zlibCompressionLevel=-2"
@@ -36,7 +37,8 @@ tests:
         warning: true
         hosts: ~
         auth: ~
-        options: {}
+        # https://jira.mongodb.org/browse/DRIVERS-1368
+        options: ~
     -
         description: "Too high zlibCompressionLevel causes a warning"
         uri: "mongodb://example.com/?compressors=zlib&zlibCompressionLevel=10"
@@ -44,5 +46,6 @@ tests:
         warning: true
         hosts: ~
         auth: ~
-        options: {}
+        # https://jira.mongodb.org/browse/DRIVERS-1368
+        options: ~
 

data/spec/spec_tests/data/uri_options/read-preference-options.yml

@@ -15,6 +15,18 @@ tests:
                 -
                     dc: "ny"
             maxStalenessSeconds: 120
+    -
+        description: "Case is preserved in read preference tag names and values"
+        uri: "mongodb://example.com/?readPreference=secondary&readPreferenceTags=DataCenter:NewYork"
+        valid: true
+        warning: false
+        hosts: ~
+        auth: ~
+        options:
+            readPreference: "secondary"
+            readPreferenceTags:
+                - 
+                    DataCenter: NewYork
     -
         description: "Invalid readPreferenceTags causes a warning"
         uri: "mongodb://example.com/?readPreferenceTags=invalid"
@@ -23,6 +35,18 @@ tests:
         hosts: ~
         auth: ~
         options: {}
+    # https://jira.mongodb.org/browse/DRIVERS-1369
+    -
+        description: "Valid and invalid readPreferenceTags mix"
+        uri: "mongodb://example.com/?readPreferenceTags=a:b,invalid"
+        valid: true
+        warning: true
+        hosts: ~
+        auth: ~
+        options:
+            readPreferenceTags:
+                -
+                    a: b
     -
         description: "Non-numeric maxStalenessSeconds causes a warning"
         uri: "mongodb://example.com/?maxStalenessSeconds=invalid"

data/spec/spec_tests/data/uri_options/ruby-connection-options.yml

@@ -36,6 +36,7 @@ tests:
     options:
       directConnection: false
       connect: replica_set
+      replicaSet: foo
     
   -
     description: directConnection=true and connect=sharded

data/spec/spec_tests/data/uri_options/tls-options.yml

@@ -149,7 +149,8 @@ tests:
         warning: false
         hosts: ~
         auth: ~
-        options: {}
+        # https://jira.mongodb.org/browse/DRIVERS-1368
+        options: ~
     -
         description: "tls=false and ssl=false doesn't warn"
         uri: "mongodb://example.com/?tls=false&ssl=false"
@@ -157,7 +158,8 @@ tests:
         warning: false
         hosts: ~
         auth: ~
-        options: {}
+        # https://jira.mongodb.org/browse/DRIVERS-1368
+        options: ~
     -
         description: "ssl=true and tls=true doesn't warn"
         uri: "mongodb://example.com/?ssl=true&tls=true"
@@ -165,7 +167,8 @@ tests:
         warning: false
         hosts: ~
         auth: ~
-        options: {}
+        # https://jira.mongodb.org/browse/DRIVERS-1368
+        options: ~
     -
         description: "ssl=false and tls=false doesn't warn"
         uri: "mongodb://example.com/?ssl=false&tls=false"
@@ -173,7 +176,8 @@ tests:
         warning: false
         hosts: ~
         auth: ~
-        options: {}
+        # https://jira.mongodb.org/browse/DRIVERS-1368
+        options: ~
     -
         description: "tls=false and ssl=true raises error"
         uri: "mongodb://example.com/?tls=false&ssl=true"
@@ -206,3 +210,155 @@ tests:
         hosts: ~
         auth: ~
         options: {}
+    -
+        description: "tlsDisableOCSPEndpointCheck can be set to true"
+        uri: "mongodb://example.com/?tls=true&tlsDisableOCSPEndpointCheck=true"
+        valid: true
+        warning: false
+        hosts: ~
+        auth: ~
+        options:
+            tls: true
+            tlsDisableOCSPEndpointCheck: true
+    -
+        description: "tlsDisableOCSPEndpointCheck can be set to false"
+        uri: "mongodb://example.com/?tls=true&tlsDisableOCSPEndpointCheck=false"
+        valid: true
+        warning: false
+        hosts: ~
+        auth: ~
+        options:
+            tls: true
+            tlsDisableOCSPEndpointCheck: false
+    # 4 permutations of [tlsInsecure=true/false, tlsDisableOCSPEndpointCheck=true/false]
+    -
+        description: "tlsInsecure and tlsDisableOCSPEndpointCheck both present (and true) raises an error"
+        uri: "mongodb://example.com/?tlsInsecure=true&tlsDisableOCSPEndpointCheck=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsInsecure=true and tlsDisableOCSPEndpointCheck=false raises an error"
+        uri: "mongodb://example.com/?tlsInsecure=true&tlsDisableOCSPEndpointCheck=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsInsecure=false and tlsDisableOCSPEndpointCheck=true raises an error"
+        uri: "mongodb://example.com/?tlsInsecure=false&tlsDisableOCSPEndpointCheck=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsInsecure and tlsDisableOCSPEndpointCheck both present (and false) raises an error"
+        uri: "mongodb://example.com/?tlsInsecure=false&tlsDisableOCSPEndpointCheck=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    # 4 permutations of [tlsDisableOCSPEndpointCheck=true/false, tlsInsecure=true/false]
+    -
+        description: "tlsDisableOCSPEndpointCheck and tlsInsecure both present (and true) raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=true&tlsInsecure=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsDisableOCSPEndpointCheck=true and tlsInsecure=false raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=true&tlsInsecure=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsDisableOCSPEndpointCheck=false and tlsInsecure=true raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=false&tlsInsecure=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsDisableOCSPEndpointCheck and tlsInsecure both present (and false) raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=false&tlsInsecure=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    # 4 permutations of [tlsAllowInvalidCertificates=true/false, tlsDisableOCSPEndpointCheck=true/false]
+    -
+        description: "tlsAllowInvalidCertificates and tlsDisableOCSPEndpointCheck both present (and true) raises an error"
+        uri: "mongodb://example.com/?tlsAllowInvalidCertificates=true&tlsDisableOCSPEndpointCheck=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsAllowInvalidCertificates=true and tlsDisableOCSPEndpointCheck=false raises an error"
+        uri: "mongodb://example.com/?tlsAllowInvalidCertificates=true&tlsDisableOCSPEndpointCheck=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsAllowInvalidCertificates=false and tlsDisableOCSPEndpointCheck=true raises an error"
+        uri: "mongodb://example.com/?tlsAllowInvalidCertificates=false&tlsDisableOCSPEndpointCheck=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsAllowInvalidCertificates and tlsDisableOCSPEndpointCheck both present (and false) raises an error"
+        uri: "mongodb://example.com/?tlsAllowInvalidCertificates=false&tlsDisableOCSPEndpointCheck=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    # 4 permutations of [tlsDisableOCSPEndpointCheck=true/false, tlsAllowInvalidCertificates=true/false]
+    -
+        description: "tlsDisableOCSPEndpointCheck and tlsAllowInvalidCertificates both present (and true) raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=true&tlsAllowInvalidCertificates=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsDisableOCSPEndpointCheck=true and tlsAllowInvalidCertificates=false raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=true&tlsAllowInvalidCertificates=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsDisableOCSPEndpointCheck=false and tlsAllowInvalidCertificates=true raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=false&tlsAllowInvalidCertificates=true"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}
+    -
+        description: "tlsDisableOCSPEndpointCheck and tlsAllowInvalidCertificates both present (and false) raises an error"
+        uri: "mongodb://example.com/?tlsDisableOCSPEndpointCheck=false&tlsAllowInvalidCertificates=false"
+        valid: false
+        warning: false
+        hosts: ~
+        auth: ~
+        options: {}

data/spec/spec_tests/dns_seedlist_discovery_spec.rb

@@ -60,7 +60,15 @@ describe 'DNS Seedlist Discovery' do
         end
 
         it 'creates a client with the correct options' do
-          expect(test.client).to match_options(test)
+          mapped = Mongo::URI::OptionsMapper.new.ruby_to_smc(test.client.options)
+          # Connection string spec tests do not use canonical URI option names
+          actual = Utils.downcase_keys(mapped)
+          expected = Utils.downcase_keys(test.options)
+          # SRV tests use ssl URI option instead of tls one
+          if expected.key?('ssl') && !expected.key?('tls')
+            expected['tls'] = expected.delete('ssl')
+          end
+          actual.should == expected
         end
       end
     end

data/spec/spec_tests/uri_options_spec.rb

@@ -2,7 +2,7 @@ require 'lite_spec_helper'
 
 require 'runners/connection_string'
 
-describe 'Uri Options' do
+describe 'URI options' do
   include Mongo::ConnectionString
 
   # Since the tests issue global assertions on Mongo::Logger,
@@ -22,39 +22,23 @@ describe 'Uri Options' do
             require_mongo_kerberos
           end
 
-          context 'when the uri should warn', if: test.warn? do
+          if test.valid?
 
-            before do
-              expect(Mongo::Logger.logger).to receive(:warn)
-            end
-
-            it 'warns' do
-              expect(test.client).to be_a(Mongo::Client)
-            end
-          end
-
-          context 'when the uri is invalid', unless: test.valid? do
-
-            it 'raises an error' do
-              expect{
-                test.uri
-              }.to raise_exception(Mongo::Error::InvalidURI)
-            end
-          end
-
-          context 'when the uri should not warn', if: !test.warn? && test.valid? do
-
-            before do
-              expect(Mongo::Logger.logger).not_to receive(:warn)
+            # The warning assertion needs to be first because the test caches
+            # the client instance, and subsequent examples don't instantiate it
+            # again.
+            if test.warn?
+              it 'warns' do
+                expect(Mongo::Logger.logger).to receive(:warn)#.and_call_original
+                expect(test.client).to be_a(Mongo::Client)
+              end
+            else
+              it 'does not warn' do
+                expect(Mongo::Logger.logger).not_to receive(:warn)
+                expect(test.client).to be_a(Mongo::Client)
+              end
             end
 
-            it 'does not raise an exception or warning' do
-              expect(test.client).to be_a(Mongo::Client)
-            end
-          end
-
-          context 'when the uri is valid', if: test.valid? do
-
             if test.hosts
               it 'creates a client with the correct hosts' do
                 expect(test.client).to have_hosts(test, test.hosts)
@@ -65,8 +49,22 @@ describe 'Uri Options' do
               expect(test.client).to match_auth(test)
             end
 
-            it 'creates a client with the correct options' do
-              expect(test.client).to match_options(test)
+            if test.options
+              it 'creates a client with the correct options' do
+                mapped = Mongo::URI::OptionsMapper.new.ruby_to_smc(test.client.options)
+                expected = Mongo::ConnectionString.adjust_expected_mongo_client_options(
+                  test.options,
+                )
+                mapped.should == expected
+              end
+            end
+
+          else
+
+            it 'raises an error' do
+              expect{
+                test.uri
+              }.to raise_exception(Mongo::Error::InvalidURI)
             end
           end
         end

data/spec/support/certificates/atlas-ocsp-ca.crt

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg
+U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83
+nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd
+KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f
+/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX
+kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0
+/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6
+Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1
+oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD
+QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v
+d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh
+xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB
+CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl
+5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA
+8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC
+2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit
+c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0
+j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz
+-----END CERTIFICATE-----
+

data/spec/support/certificates/atlas-ocsp.crt

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHOjCCBiKgAwIBAgIQBHwKuME6qrWYg7D7VTlKYjANBgkqhkiG9w0BAQsFADBN
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
+aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTgwMjA3MDAwMDAwWhcN
+MjEwNTA3MDAwMDAwWjB7MQswCQYDVQQGEwJVUzERMA8GA1UECBMITmV3IFlvcmsx
+ETAPBgNVBAcTCE5ldyBZb3JrMRYwFAYDVQQKEw1Nb25nb0RCLCBJbmMuMRIwEAYD
+VQQLEwlDbG91ZCBTUkUxGjAYBgNVBAMMESoubW9uZ29kYi1kZXYubmV0MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0oEdsION7ajeosGKBaZ4szN58kFz
+4EHBrgGs7N5X+4weolk4LouU0nUO2SDwjdJL5Kpbb1rUb3satTVAuNj2CDp3LynW
+Zggtf3OCbBHMKmFUMxYiriEGU/BCHo+qKlWj0eM1qRWC/9qjbg5+pvnhYEOYZgMw
+rIjD8V/j/8fO2mfBTpK+5xXeLXaIZKLgFlHWhLueTBONhSjGCHCKuI9xL6lBys3s
+QqsSMZY1weecD4jP8nVxuHpOnwdWOo2BH8d4nh8PowQYSjbrKm2n1cDGnak7oqZ4
+hpR4zjG04zOrLzw9p5uzUj4ofPhsaUC9K4sLAh01PZRnIl9tIvQkp0Xc8QIDAQAB
+o4ID5jCCA+IwHwYDVR0jBBgwFoAUD4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0O
+BBYEFCN2C7OPPJfzGKESo8DdeuMzXWFLMC0GA1UdEQQmMCSCESoubW9uZ29kYi1k
+ZXYubmV0gg9tb25nb2RiLWRldi5uZXQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBrBgNVHR8EZDBiMC+gLaArhilodHRwOi8v
+Y3JsMy5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc2LmNybDAvoC2gK4YpaHR0cDov
+L2NybDQuZGlnaWNlcnQuY29tL3NzY2Etc2hhMi1nNi5jcmwwTAYDVR0gBEUwQzA3
+BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQu
+Y29tL0NQUzAIBgZngQwBAgIwfAYIKwYBBQUHAQEEcDBuMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC5kaWdpY2VydC5jb20wRgYIKwYBBQUHMAKGOmh0dHA6Ly9jYWNl
+cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS5jcnQw
+DAYDVR0TAQH/BAIwADCCAfkGCisGAQQB1nkCBAIEggHpBIIB5QHjAHcApLkJkLQY
+WBSHuxOizGdwCjw1mAT5G9+443fNDsgN3BAAAAFhcQh6hAAABAMASDBGAiEAsBwl
+EUAJoqWKGHlG1Iw+Z9hr3RPPySoPT4PBjWRnWpcCIQC7V9EFENl7Pk6NOwRo1joZ
+OB4UNyZh1YVlQOXyZK0tUgB2AId1v+dZfPiMQ5lfvfNu/1aNR1Y2/0q1YMG06v9e
+oIMPAAABYXEIep0AAAQDAEcwRQIhALvaijTUDDPJgr79QDHN7102E3hpilLEmV02
+D5jbI3efAiB18NNDifebYBRBALyVFZf5TPwMJ4Hb//roHdTf+dqbVwB3ALvZ37wf
+inG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABYXEIehQAAAQDAEgwRgIhAJao
+S5aKuudv9ZA4dUD/gEzdHZsF3M9xsa+KZHZzinT1AiEA1zAQMKp2pa8/Or5soC7M
+HrsykWEXY3lpFCsyQM+RPHUAdwBvU3asMfAxGdiZAKRRFf93FRwR2QLBACkGjbII
+mjfZEwAAAWFxCHyrAAAEAwBIMEYCIQDhtxcQCz916LqV/RKhTNOi39LW4dMPAl7Q
+eWPTaUk3dAIhAOgQiFAYkgJvun9hZk/wWZ8PaZJOGnKnkLdTM3j7ZdTNMA0GCSqG
+SIb3DQEBCwUAA4IBAQB6rK1wA1IsQCZVSXooVt79EgF3JMlgyCRZKTFD1KZtkKG7
+n9YI0Aatw3hvKpo8OV4KC1Iw1Ie6JwbVTczyHApROLSeSHTtxbfiNXmYqNVECSQt
+I+dHAYc38EKCb/XgxqfFra0vJRcCzd1yHLKJ6uERI6cJ7/vkLqJiRScHNh49Py8Y
+Osijdqd0BZnwAdFKpPtmvPNPH9JWu8RlcfWUukJKF1YgzeCjz50DL47Ykqh7C8aA
+T9B5yzkDNBg65zZSeDnX6FFo0ZC8BMxqN+kCyk3favP3NP8FBmkEZPqY0wMh3Xsd
+OdSNdcGPBlN4MiTOIkWW6JrZl6y/hQ83ktYG8wwY
+-----END CERTIFICATE-----

data/spec/support/client_registry.rb

@@ -188,14 +188,10 @@ class ClientRegistry
   end
   private :new_global_client
 
-  def new_local_client(*args, &block)
-    if block_given?
-      Mongo::Client.new(*args, &block)
-    else
-      Mongo::Client.new(*args).tap do |client|
-        @lock.synchronize do
-          @local_clients << client
-        end
+  def new_local_client(*args)
+    Mongo::Client.new(*args).tap do |client|
+      @lock.synchronize do
+        @local_clients << client
       end
     end
   end

data/spec/support/client_registry_macros.rb

@@ -1,9 +1,9 @@
 module ClientRegistryMacros
-  def new_local_client(address, options=nil, &block)
-    ClientRegistry.instance.new_local_client(address, options, &block)
+  def new_local_client(address, options=nil)
+    ClientRegistry.instance.new_local_client(address, options)
   end
 
-  def new_local_client_nmio(address, options=nil, &block)
+  def new_local_client_nmio(address, options=nil)
     # Avoid type converting options.
     base_options = {monitoring_io: false}
     if BSON::Document === options || options&.keys&.any? { |key| String === key }
@@ -14,7 +14,7 @@ module ClientRegistryMacros
     else
       base_options
     end
-    new_local_client(address, options, &block)
+    new_local_client(address, options)
   end
 
   def close_local_clients

data/spec/support/common_shortcuts.rb

@@ -96,6 +96,51 @@ module CommonShortcuts
         end
       end
     end
+
+    def clear_ocsp_cache
+      before do
+        Mongo.clear_ocsp_cache
+      end
+    end
+
+    def with_ocsp_mock(ca_file_path, responder_cert_path, responder_key_path,
+      fault: nil, port: 8100
+    )
+      clear_ocsp_cache
+
+      around do |example|
+        args = [
+          SpecConfig.instance.ocsp_files_dir.join('ocsp_mock.py').to_s,
+          '--ca_file', ca_file_path.to_s,
+          '--ocsp_responder_cert', responder_cert_path.to_s,
+          '--ocsp_responder_key', responder_key_path.to_s,
+          '-p', port.to_s,
+        ]
+        if SpecConfig.instance.client_debug?
+          # Use when debugging - tests run faster without -v.
+          args << '-v'
+        end
+        if fault
+          args += ['--fault', fault]
+        end
+        process = ChildProcess.new(*args)
+
+        process.io.inherit!
+        process.start
+
+        begin
+          sleep 0.4
+          example.run
+        ensure
+          if process.exited?
+            raise "Spawned process exited before we stopped it"
+          end
+
+          process.stop
+          process.wait
+        end
+      end
+    end
   end
 
   module InstanceMethods

data/spec/support/constraints.rb

@@ -101,8 +101,18 @@ module Constraints
     end
   end
 
+  # Some tests hardcode the TLS certificates shipped with the driver's
+  # test suite, and will fail when using TLS connections that use other
+  # certificates.
   def require_local_tls
     require_tls
+
+    before(:all) do
+      # TODO This isn't actually the foolproof check
+      if ENV['OCSP_ALGORITHM']
+        skip 'Driver TLS certificate required, OCSP certificates are not acceptable'
+      end
+    end
   end
 
   def require_no_retry_writes
@@ -260,4 +270,17 @@ module Constraints
       end
     end
   end
+
+  # Some tests perform assertions on what the driver is logging.
+  # Some test configurations, for example OCSP with unknown response,
+  # produce warnings due to optional checks failing.
+  # This constraint skips tests that issue logging assertions on configurations
+  # that may produce non-test-originated log entries.
+  def require_warning_clean
+    before(:all) do
+      if ENV['OCSP_STATUS'] == 'unknown'
+        skip 'Unknown OCSP status is not global warning-clean'
+      end
+    end
+  end
 end

data/spec/support/lite_constraints.rb

@@ -138,4 +138,28 @@ module LiteConstraints
       end
     end
   end
+
+  def require_ocsp
+    before(:all) do
+      if !SpecConfig.instance.ocsp?
+        skip 'Set OCSP=1 in environment to run OCSP tests'
+      end
+    end
+  end
+
+  def require_ocsp_verifier
+    before(:all) do
+      if !SpecConfig.instance.ocsp_verifier?
+        skip 'Set OCSP_VERIFIER=1 in environment to run OCSP verifier tests'
+      end
+    end
+  end
+
+  def require_ocsp_connectivity
+    before(:all) do
+      if !SpecConfig.instance.ocsp_connectivity?
+        skip 'Set OCSP_CONNECTIVITY=pass or OCSP_CONNECTIVITY=fail in environment to run OCSP connectivity tests'
+      end
+    end
+  end
 end

data/spec/support/matchers.rb

@@ -54,3 +54,19 @@ RSpec::Matchers.define :be_uuid do
     object.is_a?(BSON::Binary) && object.type == :uuid
   end
 end
+
+RSpec::Matchers.define :take_longer_than do |min_expected_time|
+  match do |proc|
+    start_time = Time.now
+    proc.call
+    (Time.now - start_time).should > min_expected_time
+  end
+end
+
+RSpec::Matchers.define :take_shorter_than do |min_expected_time|
+  match do |proc|
+    start_time = Time.now
+    proc.call
+    (Time.now - start_time).should < min_expected_time
+  end
+end

data/spec/support/ocsp

@@ -0,0 +1 @@
+spec/support/../../.mod/drivers-evergreen-tools/.evergreen/ocsp