mongo 2.17.2 → 2.18.1

data/spec/integration/client_side_encryption/auto_encryption_mongocryptd_spawn_spec.rb

@@ -51,7 +51,6 @@ describe 'Auto Encryption' do
         .with(
           hash_including(
             'insert' => 'users',
-            '$db' => 'auto_encryption',
             'ordered' => true,
             'lsid' => kind_of(Hash),
             'documents' => kind_of(Array),

data/spec/integration/client_side_encryption/auto_encryption_reconnect_spec.rb

@@ -21,6 +21,7 @@ describe 'Client with auto encryption #reconnect' do
         {
           auto_encryption_options: {
             kms_providers: kms_providers,
+            kms_tls_options: kms_tls_options,
             key_vault_namespace: key_vault_namespace,
             key_vault_client: key_vault_client_option,
             schema_map: { 'auto_encryption.users': schema_map },
@@ -197,6 +198,21 @@ describe 'Client with auto encryption #reconnect' do
       it_behaves_like 'an auto-encryption client that reconnects properly'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'an auto-encryption client that reconnects properly'
@@ -216,6 +232,21 @@ describe 'Client with auto encryption #reconnect' do
       it_behaves_like 'an auto-encryption client that reconnects properly'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'an auto-encryption client that reconnects properly'

data/spec/integration/client_side_encryption/auto_encryption_spec.rb

@@ -22,6 +22,7 @@ describe 'Auto Encryption' do
       SpecConfig.instance.test_options.merge(
         auto_encryption_options: {
           kms_providers: kms_providers,
+          kms_tls_options: kms_tls_options,
           key_vault_namespace: key_vault_namespace,
           schema_map: local_schema,
           bypass_auto_encryption: bypass_auto_encryption,
@@ -99,6 +100,48 @@ describe 'Auto Encryption' do
       end
     end
 
+    context 'with Azure KMS provider' do
+      include_context 'with Azure kms_providers'
+
+      context 'with validator' do
+        include_context 'jsonSchema validator on collection'
+        it_behaves_like 'it performs an encrypted command'
+      end
+
+      context 'with schema map' do
+        include_context 'schema map in client options'
+        it_behaves_like 'it performs an encrypted command'
+      end
+    end
+
+    context 'with GCP KMS provider' do
+      include_context 'with GCP kms_providers'
+
+      context 'with validator' do
+        include_context 'jsonSchema validator on collection'
+        it_behaves_like 'it performs an encrypted command'
+      end
+
+      context 'with schema map' do
+        include_context 'schema map in client options'
+        it_behaves_like 'it performs an encrypted command'
+      end
+    end
+
+    context 'with KMIP KMS provider' do
+      include_context 'with KMIP kms_providers'
+
+      context 'with validator' do
+        include_context 'jsonSchema validator on collection'
+        it_behaves_like 'it performs an encrypted command'
+      end
+
+      context 'with schema map' do
+        include_context 'schema map in client options'
+        it_behaves_like 'it performs an encrypted command'
+      end
+    end
+
     context 'with local KMS provider' do
       include_context 'with local kms_providers'
 
@@ -446,6 +489,22 @@ describe 'Auto Encryption' do
         it_behaves_like 'it obeys bypass_auto_encryption option'
       end
 
+      context 'with Azure KMS provider' do
+        include_context 'with Azure kms_providers'
+        it_behaves_like 'it obeys bypass_auto_encryption option'
+      end
+
+      context 'with GCP KMS provider' do
+        include_context 'with GCP kms_providers'
+        it_behaves_like 'it obeys bypass_auto_encryption option'
+      end
+
+      context 'with KMIP KMS provider' do
+        include_context 'with KMIP kms_providers'
+        it_behaves_like 'it obeys bypass_auto_encryption option'
+      end
+
+
       context 'with local KMS provider and ' do
         include_context 'with local kms_providers'
         it_behaves_like 'it obeys bypass_auto_encryption option'
@@ -493,6 +552,54 @@ describe 'Auto Encryption' do
         end
       end
 
+      context 'with Azure KMS provider' do
+        include_context 'with Azure kms_providers and key alt names'
+        it 'encrypts the ssn field' do
+          expect(result).to be_ok
+          expect(result.inserted_ids.length).to eq(1)
+
+          id = result.inserted_ids.first
+
+          document = client['users'].find(_id: id).first
+          document.should_not be_nil
+          # Auto-encryption with key alt names only works with random encryption,
+          # so it will not generate the same result on every test run.
+          expect(document['ssn']).to be_ciphertext
+        end
+
+        context 'with GCP KMS provider' do
+          include_context 'with GCP kms_providers and key alt names'
+          it 'encrypts the ssn field' do
+            expect(result).to be_ok
+            expect(result.inserted_ids.length).to eq(1)
+
+            id = result.inserted_ids.first
+
+            document = client['users'].find(_id: id).first
+            document.should_not be_nil
+            # Auto-encryption with key alt names only works with random encryption,
+            # so it will not generate the same result on every test run.
+            expect(document['ssn']).to be_ciphertext
+          end
+        end
+
+        context 'with KMIP KMS provider' do
+          include_context 'with KMIP kms_providers and key alt names'
+          it 'encrypts the ssn field' do
+            expect(result).to be_ok
+            expect(result.inserted_ids.length).to eq(1)
+
+            id = result.inserted_ids.first
+
+            document = client['users'].find(_id: id).first
+            document.should_not be_nil
+            # Auto-encryption with key alt names only works with random encryption,
+            # so it will not generate the same result on every test run.
+            expect(document['ssn']).to be_ciphertext
+          end
+        end
+      end
+
       context 'with local KMS provider' do
         include_context 'with local kms_providers and key alt names'
         it 'encrypts the ssn field' do
@@ -548,7 +655,7 @@ describe 'Auto Encryption' do
       include_context 'encrypted document in collection'
 
       let(:result) do
-        encryption_client['users'].update_one({ ssn: ssn }, { ssn: '098-765-4321' })
+        encryption_client['users'].replace_one({ ssn: ssn }, { ssn: '098-765-4321' })
       end
 
       it 'encrypts the ssn field' do

data/spec/integration/client_side_encryption/bson_size_limit_spec.rb

@@ -33,7 +33,7 @@ describe 'Client-Side Encryption' do
             kms_providers: {
               local: { key: local_master_key },
             },
-            key_vault_namespace: 'admin.datakeys',
+            key_vault_namespace: 'keyvault.datakeys',
             # Spawn mongocryptd on non-default port for sharded cluster tests
             extra_options: extra_options,
           },
@@ -52,7 +52,7 @@ describe 'Client-Side Encryption' do
         }
       ].create
 
-      key_vault_collection = client.use('admin')['datakeys', write_concern: { w: :majority }]
+      key_vault_collection = client.use('keyvault')['datakeys', write_concern: { w: :majority }]
 
       key_vault_collection.drop
       key_vault_collection.insert_one(

data/spec/integration/client_side_encryption/bypass_mongocryptd_spawn_spec.rb

@@ -26,7 +26,7 @@ describe 'Client-Side Encryption' do
           SpecConfig.instance.test_options.merge(
             auto_encryption_options: {
               kms_providers: local_kms_providers,
-              key_vault_namespace: 'admin.datakeys',
+              key_vault_namespace: 'keyvault.datakeys',
               schema_map: { 'db.coll' => test_schema_map },
               extra_options: {
                 mongocryptd_bypass_spawn: true,
@@ -53,7 +53,7 @@ describe 'Client-Side Encryption' do
           SpecConfig.instance.test_options.merge(
             auto_encryption_options: {
               kms_providers: local_kms_providers,
-              key_vault_namespace: 'admin.datakeys',
+              key_vault_namespace: 'keyvault.datakeys',
               bypass_auto_encryption: true,
               extra_options: {
                 mongocryptd_spawn_args: [ "--pidfilepath=bypass-spawning-mongocryptd.pid", "--port=#{mongocryptd_port}"],

data/spec/integration/client_side_encryption/client_close_spec.rb

@@ -18,7 +18,7 @@ describe 'Auto encryption client' do
         SpecConfig.instance.test_options.merge(
           auto_encryption_options: {
             kms_providers: kms_providers,
-            key_vault_namespace: 'admin.datakeys',
+            key_vault_namespace: 'keyvault.datakeys',
             schema_map: { 'auto_encryption.users' => schema_map },
             # Spawn mongocryptd on non-default port for sharded cluster tests
             extra_options: extra_options,

data/spec/integration/client_side_encryption/corpus_spec.rb

@@ -15,7 +15,7 @@ describe 'Client-Side Encryption' do
 
     let(:key_vault_client) do
       client.with(
-        database: 'admin',
+        database: 'keyvault',
         write_concern: { w: :majority }
       )['datakeys']
     end
@@ -23,6 +23,9 @@ describe 'Client-Side Encryption' do
     let(:test_schema_map) { BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus-schema.json')) }
     let(:local_data_key) { BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus-key-local.json')) }
     let(:aws_data_key) { BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus-key-aws.json')) }
+    let(:azure_data_key) { BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus-key-azure.json')) }
+    let(:gcp_data_key) { BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus-key-gcp.json')) }
+    let(:kmip_data_key) { BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus-key-kmip.json')) }
 
     let(:client_encrypted) do
       new_local_client(
@@ -35,8 +38,27 @@ describe 'Client-Side Encryption' do
                 access_key_id: SpecConfig.instance.fle_aws_key,
                 secret_access_key: SpecConfig.instance.fle_aws_secret,
               },
+              azure: {
+                tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+                client_id: SpecConfig.instance.fle_azure_client_id,
+                client_secret: SpecConfig.instance.fle_azure_client_secret,
+              },
+              gcp: {
+                email: SpecConfig.instance.fle_gcp_email,
+                private_key: SpecConfig.instance.fle_gcp_private_key,
+              },
+              kmip: {
+                endpoint: SpecConfig.instance.fle_kmip_endpoint,
+              }
+            },
+            kms_tls_options: {
+              kmip: {
+                ssl_ca_cert: SpecConfig.instance.fle_kmip_tls_ca_file,
+                ssl_cert: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
+                ssl_key: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
+              }
             },
-            key_vault_namespace: 'admin.datakeys',
+            key_vault_namespace: 'keyvault.datakeys',
             schema_map: local_schema_map,
             # Spawn mongocryptd on non-default port for sharded cluster tests
             extra_options: extra_options,
@@ -55,9 +77,28 @@ describe 'Client-Side Encryption' do
             aws: {
               access_key_id: SpecConfig.instance.fle_aws_key,
               secret_access_key: SpecConfig.instance.fle_aws_secret,
+            },
+            azure: {
+              tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+              client_id: SpecConfig.instance.fle_azure_client_id,
+              client_secret: SpecConfig.instance.fle_azure_client_secret,
+            },
+            gcp: {
+              email: SpecConfig.instance.fle_gcp_email,
+              private_key: SpecConfig.instance.fle_gcp_private_key,
+            },
+            kmip: {
+              endpoint: SpecConfig.instance.fle_kmip_endpoint,
+            }
+          },
+          kms_tls_options: {
+            kmip: {
+              ssl_ca_cert: SpecConfig.instance.fle_kmip_tls_ca_file,
+              ssl_cert: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
+              ssl_key: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
             }
           },
-          key_vault_namespace: 'admin.datakeys',
+          key_vault_namespace: 'keyvault.datakeys',
         },
       )
     end
@@ -67,7 +108,7 @@ describe 'Client-Side Encryption' do
     end
 
     let(:corpus_encrypted_expected) do
-      BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus_encrypted.json'))
+      BSON::ExtJSON.parse(File.read('spec/support/crypt/corpus/corpus-encrypted.json'))
     end
 
     let(:corpus_copied) do
@@ -78,7 +119,7 @@ describe 'Client-Side Encryption' do
       # to encrypt that value.
       corpus_copied = BSON::Document.new
       corpus.each do |key, doc|
-        if ['_id', 'altname_aws', 'altname_local'].include?(key)
+        if ['_id', 'altname_aws', 'altname_azure', 'altname_gcp', 'altname_kmip', 'altname_local'].include?(key)
           corpus_copied[key] = doc
           next
         end
@@ -89,8 +130,14 @@ describe 'Client-Side Encryption' do
           options = if doc['identifier'] == 'id'
             key_id = if doc['kms'] == 'local'
               'LOCALAAAAAAAAAAAAAAAAA=='
-            else
+            elsif doc['kms'] == 'azure'
+              'AZUREAAAAAAAAAAAAAAAAA=='
+            elsif doc['kms'] == 'gcp'
+              'GCPAAAAAAAAAAAAAAAAAAA=='
+            elsif doc['kms'] == 'aws'
               'AWSAAAAAAAAAAAAAAAAAAA=='
+            elsif doc['kms'] == 'kmip'
+              'KMIPAAAAAAAAAAAAAAAAAA=='
             end
 
             { key_id: BSON::Binary.new(Base64.decode64(key_id), :uuid) }
@@ -117,7 +164,7 @@ describe 'Client-Side Encryption' do
             # If doc['allowed'] is false, this error was expected and the value
             # should be copied over without being encrypted.
             if doc['allowed']
-              raise "Unexpected error occured in client-side encryption " +
+              raise "Unexpected error occurred in client-side encryption " +
                 "corpus tests: #{e.class}: #{e.message}"
             end
 
@@ -132,10 +179,13 @@ describe 'Client-Side Encryption' do
     before do
       client.use('db')['coll'].drop
 
-      key_vault_collection = client.use('admin')['datakeys', write_concern: { w: :majority }]
+      key_vault_collection = client.use('keyvault')['datakeys', write_concern: { w: :majority }]
       key_vault_collection.drop
       key_vault_collection.insert_one(local_data_key)
       key_vault_collection.insert_one(aws_data_key)
+      key_vault_collection.insert_one(azure_data_key)
+      key_vault_collection.insert_one(gcp_data_key)
+      key_vault_collection.insert_one(kmip_data_key)
     end
 
     shared_context 'with jsonSchema collection validator' do
@@ -178,9 +228,6 @@ describe 'Client-Side Encryption' do
           .find(_id: corpus_encrypted_id)
           .first
 
-        # Check that the actual encrypted document matches the expected
-        # encrypted document.
-        expect(corpus_encrypted_actual.keys).to eq(corpus_encrypted_expected.keys)
 
         corpus_encrypted_actual.each do |key, value|
           # If it was deterministically encrypted, test the encrypted values
@@ -205,32 +252,14 @@ describe 'Client-Side Encryption' do
       end
     end
 
-    context 'with local KMS provider' do
-      include_context 'with local kms_providers'
-
-      context 'with collection validator' do
-        include_context 'with jsonSchema collection validator'
-        it_behaves_like 'a functioning encrypter'
-      end
-
-      context 'with schema map' do
-        include_context 'with local schema map'
-        it_behaves_like 'a functioning encrypter'
-      end
+    context 'with collection validator' do
+      include_context 'with jsonSchema collection validator'
+      it_behaves_like 'a functioning encrypter'
     end
 
-    context 'with AWS KMS provider' do
-      include_context 'with AWS kms_providers'
-
-      context 'with collection validator' do
-        include_context 'with jsonSchema collection validator'
-        it_behaves_like 'a functioning encrypter'
-      end
-
-      context 'with schema map' do
-        include_context 'with local schema map'
-        it_behaves_like 'a functioning encrypter'
-      end
+    context 'with schema map' do
+      include_context 'with local schema map'
+      it_behaves_like 'a functioning encrypter'
     end
   end
 end

data/spec/integration/client_side_encryption/custom_endpoint_spec.rb

@@ -23,11 +23,18 @@ describe 'Client-Side Encryption' do
         client,
         {
           kms_providers: aws_kms_providers,
-          key_vault_namespace: 'admin.datakeys',
+          key_vault_namespace: 'keyvault.datakeys',
         },
       )
     end
 
+    let(:master_key_template) do
+      {
+        region: "us-east-1",
+        key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0"
+      }
+    end
+
     let(:data_key_id) do
       client_encryption.create_data_key('aws', master_key: master_key)
     end
@@ -51,10 +58,7 @@ describe 'Client-Side Encryption' do
 
     context 'with region and key options' do
       let(:master_key) do
-        {
-          region: "us-east-1",
-          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0"
-        }
+        master_key_template
       end
 
       it_behaves_like 'a functioning data key'
@@ -62,11 +66,7 @@ describe 'Client-Side Encryption' do
 
     context 'with region, key, and endpoint options' do
       let(:master_key) do
-        {
-          region: "us-east-1",
-          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-          endpoint: "kms.us-east-1.amazonaws.com"
-        }
+        master_key_template.merge({endpoint: "kms.us-east-1.amazonaws.com"})
       end
 
       it_behaves_like 'a functioning data key'
@@ -74,62 +74,59 @@ describe 'Client-Side Encryption' do
 
     context 'with region, key, and endpoint with valid port' do
       let(:master_key) do
-        {
-          region: "us-east-1",
-          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-          endpoint: "kms.us-east-1.amazonaws.com:443"
-        }
+        master_key_template.merge({endpoint: "kms.us-east-1.amazonaws.com:443"})
       end
 
       it_behaves_like 'a functioning data key'
     end
 
+    shared_examples 'raising a KMS error' do
+      it 'throws an exception' do
+        expect do
+          data_key_id
+        end.to raise_error(Mongo::Error::KmsError, error_regex)
+      end
+    end
+
     context 'with region, key, and endpoint with invalid port' do
       let(:master_key) do
-        {
-          region: "us-east-1",
-          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-          endpoint: "kms.us-east-1.amazonaws.com:12345"
-        }
+        master_key_template.merge({endpoint: "kms.us-east-1.amazonaws.com:12345"})
       end
 
-      it 'throws an exception' do
-        expect do
-          data_key_id
-        end.to raise_error(Mongo::Error::KmsError, /Connection refused/)
+      let(:error_regex) do
+        if BSON::Environment.jruby?
+          /SocketError/
+        else
+          /Connection refused/
+        end
       end
+
+      it_behaves_like 'raising a KMS error'
     end
 
+
     context 'with region, key, and endpoint with invalid region' do
       let(:master_key) do
-        {
-          region: "us-east-1",
-          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-          endpoint: "kms.us-east-2.amazonaws.com"
-        }
+        master_key_template.merge({endpoint: "kms.us-east-2.amazonaws.com"})
       end
 
-      it 'throws an exception' do
-        expect do
-          data_key_id
-        end.to raise_error(Mongo::Error::KmsError, /us-east-1/)
+      let(:error_regex) do
+        //
       end
+
+      it_behaves_like 'raising a KMS error'
     end
 
     context 'with region, key, and endpoint at incorrect domain' do
       let(:master_key) do
-        {
-          region: "us-east-1",
-          key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-          endpoint: "example.com"
-        }
+        master_key_template.merge({endpoint: "example.com"})
       end
 
-      it 'throws an exception' do
-        expect do
-          data_key_id
-        end.to raise_error(Mongo::Error::KmsError, /parse error/)
+      let(:error_regex) do
+        /parse error/
       end
+
+      it_behaves_like 'raising a KMS error'
     end
   end
 end