mongo 2.17.2 → 2.18.1

data/spec/mongo/crypt/auto_encrypter_spec.rb

@@ -2,6 +2,7 @@
 # encoding: utf-8
 
 require 'spec_helper'
+require 'tempfile'
 
 describe Mongo::Crypt::AutoEncrypter do
   require_libmongocrypt
@@ -15,12 +16,16 @@ describe Mongo::Crypt::AutoEncrypter do
     described_class.new(
       auto_encryption_options.merge(
         client: authorized_client.use(:auto_encryption),
-        # Spawn mongocryptd on non-default port for sharded cluster tests
-        extra_options: extra_options
+        extra_options: auto_encrypter_extra_options
       )
     )
   end
 
+  let(:auto_encrypter_extra_options) do
+    # Spawn mongocryptd on non-default port for sharded cluster tests
+    extra_options
+  end
+
   let(:client) { authorized_client }
 
   let(:db_name) { 'auto_encryption' }
@@ -98,12 +103,69 @@ describe Mongo::Crypt::AutoEncrypter do
     auto_encrypter.close
   end
 
-  context 'with schema map in auto encryption commands' do
+  describe '#initialize' do
+    include_context 'with local kms_providers'
+
+    let(:auto_encryption_options) do
+      {
+        kms_providers: local_kms_providers,
+        key_vault_namespace: key_vault_namespace,
+        schema_map: { "#{db_name}.#{collection_name}": schema_map },
+      }
+    end
+
+    let(:auto_encrypter) do
+      described_class.new(
+        auto_encryption_options.merge(
+          client: client,
+          # Spawn mongocryptd on non-default port for sharded cluster tests
+          extra_options: extra_options
+        )
+      )
+    end
+
+    context 'when client has an unlimited pool' do
+      let(:client) do
+        new_local_client_nmio(
+          SpecConfig.instance.addresses,
+          SpecConfig.instance.test_options.merge(
+            max_pool_size: 0,
+            database: 'auto_encryption'
+          ),
+        )
+      end
+
+      it 'reuses the client as key_vault_client and metadata_client' do
+        expect(auto_encrypter.key_vault_client).to eq(client)
+        expect(auto_encrypter.metadata_client).to eq(client)
+      end
+    end
+
+    context 'when client has a limited pool' do
+      let(:client) do
+        new_local_client_nmio(
+          SpecConfig.instance.addresses,
+          SpecConfig.instance.test_options.merge(
+            max_pool_size: 20,
+            database: 'auto_encryption'
+          ),
+        )
+      end
+
+      it 'creates new client for key_vault_client and metadata_client' do
+        expect(auto_encrypter.key_vault_client).not_to eq(client)
+        expect(auto_encrypter.metadata_client).not_to eq(client)
+      end
+    end
+  end
+
+  shared_examples 'with schema map in auto encryption commands' do
     include_context 'without jsonSchema validator'
 
     let(:auto_encryption_options) do
       {
         kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
         key_vault_namespace: key_vault_namespace,
         schema_map: { "#{db_name}.#{collection_name}": schema_map },
       }
@@ -114,18 +176,87 @@ describe Mongo::Crypt::AutoEncrypter do
       it_behaves_like 'a functioning auto encrypter'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with local KMS providers' do
+      include_context 'with local kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+  end
+
+  shared_examples 'with schema map file in auto encryption commands' do
+    include_context 'without jsonSchema validator'
+
+    let(:schema_map_file) do
+      file = Tempfile.new('schema_map.json')
+      file.write(JSON.dump(
+        {
+          "#{db_name}.#{collection_name}" => schema_map
+        }
+      ))
+      file.flush
+      file
+    end
+
+    after do
+      schema_map_file.close
+    end
+
+    let(:auto_encryption_options) do
+      {
+        kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
+        key_vault_namespace: key_vault_namespace,
+        schema_map_path: schema_map_file.path
+      }
+    end
+
+    context 'with AWS KMS providers' do
+      include_context 'with AWS kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'a functioning auto encrypter'
     end
   end
 
-  context 'with schema map collection validator' do
+  shared_examples 'with schema map collection validator' do
     include_context 'with jsonSchema validator'
 
     let(:auto_encryption_options) do
       {
         kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
         key_vault_namespace: key_vault_namespace
       }
     end
@@ -135,18 +266,53 @@ describe Mongo::Crypt::AutoEncrypter do
       it_behaves_like 'a functioning auto encrypter'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with GCP KMS providers and PEM key' do
+      require_mri
+
+      include_context 'with GCP kms_providers'
+
+      let(:kms_providers) do
+        {
+          gcp: {
+            email: SpecConfig.instance.fle_gcp_email,
+            private_key: OpenSSL::PKey.read(
+              Base64.decode64(SpecConfig.instance.fle_gcp_private_key)
+            ).export,
+          }
+        }
+      end
+
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'a functioning auto encrypter'
     end
   end
 
-  context 'with no validator or client option' do
+  shared_examples 'with no validator or client option' do
     include_context 'without jsonSchema validator'
 
     let(:auto_encryption_options) do
       {
         kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
         key_vault_namespace: key_vault_namespace,
       }
     end
@@ -169,6 +335,60 @@ describe Mongo::Crypt::AutoEncrypter do
       end
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+
+      describe '#encrypt' do
+        it 'does not perform encryption' do
+          result = auto_encrypter.encrypt(db_name, command)
+          expect(result).to eq(command)
+        end
+      end
+
+      describe '#decrypt' do
+        it 'still performs decryption' do
+          result = auto_encrypter.decrypt(encrypted_command)
+          expect(result).to eq(command)
+        end
+      end
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+
+      describe '#encrypt' do
+        it 'does not perform encryption' do
+          result = auto_encrypter.encrypt(db_name, command)
+          expect(result).to eq(command)
+        end
+      end
+
+      describe '#decrypt' do
+        it 'still performs decryption' do
+          result = auto_encrypter.decrypt(encrypted_command)
+          expect(result).to eq(command)
+        end
+      end
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+
+      describe '#encrypt' do
+        it 'does not perform encryption' do
+          result = auto_encrypter.encrypt(db_name, command)
+          expect(result).to eq(command)
+        end
+      end
+
+      describe '#decrypt' do
+        it 'still performs decryption' do
+          result = auto_encrypter.decrypt(encrypted_command)
+          expect(result).to eq(command)
+        end
+      end
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
 
@@ -187,4 +407,35 @@ describe Mongo::Crypt::AutoEncrypter do
       end
     end
   end
+
+  context 'when using crypt shared library' do
+    min_server_version '6.0.0'
+
+    let(:auto_encrypter_extra_options) do
+      {
+        crypt_shared_lib_path: SpecConfig.instance.crypt_shared_lib_path
+      }
+    end
+
+    let(:auto_encryption_options) do
+      {
+        kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
+        key_vault_namespace: key_vault_namespace,
+        schema_map: { "#{db_name}.#{collection_name}": schema_map },
+      }
+    end
+
+    it_behaves_like 'with schema map in auto encryption commands'
+    it_behaves_like 'with schema map file in auto encryption commands'
+    it_behaves_like 'with schema map collection validator'
+    it_behaves_like 'with no validator or client option'
+  end
+
+  context 'when using mongocryptd' do
+    it_behaves_like 'with schema map in auto encryption commands'
+    it_behaves_like 'with schema map file in auto encryption commands'
+    it_behaves_like 'with schema map collection validator'
+    it_behaves_like 'with no validator or client option'
+  end
 end

data/spec/mongo/crypt/auto_encryption_context_spec.rb

@@ -8,7 +8,8 @@ describe Mongo::Crypt::AutoEncryptionContext do
   require_libmongocrypt
   include_context 'define shared FLE helpers'
 
-  let(:mongocrypt) { Mongo::Crypt::Handle.new(kms_providers, logger: logger) }
+  let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+  let(:mongocrypt) { Mongo::Crypt::Handle.new(credentials, logger: logger) }
   let(:context) { described_class.new(mongocrypt, io, db_name, command) }
 
   let(:logger) { nil }
@@ -79,6 +80,21 @@ describe Mongo::Crypt::AutoEncryptionContext do
       it_behaves_like 'a functioning AutoEncryptionContext'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning AutoEncryptionContext'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning AutoEncryptionContext'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning AutoEncryptionContext'
+    end
+
     context 'with verbose logging' do
       include_context 'with local kms_providers'
 

data/spec/mongo/crypt/binding/context_spec.rb

@@ -6,17 +6,34 @@ require_relative '../helpers/mongo_crypt_spec_helper'
 
 shared_context 'initialized for data key creation' do
   let(:master_key) { "ru\xfe\x00" * 24 }
-  let(:binary) { MongoCryptSpecHelper.mongocrypt_binary_t_from(master_key)}
+
+  let(:kms_providers) do
+    BSON::Document.new({
+      local: {
+        key: BSON::Binary.new(master_key, :generic),
+      }
+    })
+  end
+
+  let(:binary) do
+    MongoCryptSpecHelper.mongocrypt_binary_t_from(kms_providers.to_bson.to_s)
+  end
+
+  let(:key_document) do
+    MongoCryptSpecHelper.mongocrypt_binary_t_from(
+      BSON::Document.new({provider: 'local'}).to_bson.to_s)
+  end
 
   before do
-    Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
+    Mongo::Crypt::Binding.mongocrypt_setopt_kms_providers(mongocrypt, binary)
     MongoCryptSpecHelper.bind_crypto_hooks(mongocrypt)
     Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
 
-    Mongo::Crypt::Binding.mongocrypt_ctx_setopt_masterkey_local(context)
+    Mongo::Crypt::Binding.mongocrypt_ctx_setopt_key_encryption_key(context, key_document)
   end
 
   after do
+    Mongo::Crypt::Binding.mongocrypt_binary_destroy(key_document)
     Mongo::Crypt::Binding.mongocrypt_binary_destroy(binary)
   end
 end
@@ -84,20 +101,6 @@ describe 'Mongo::Crypt::Binding' do
       end
     end
 
-    describe '#mongocrypt_ctx_setopt_masterkey_local' do
-      let(:result) do
-        Mongo::Crypt::Binding.mongocrypt_ctx_setopt_masterkey_local(context)
-      end
-
-      before do
-        Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
-      end
-
-      it 'returns true' do
-        expect(result).to be true
-      end
-    end
-
     describe '#mongocrypt_ctx_datakey_init' do
       let(:result) do
         Mongo::Crypt::Binding.mongocrypt_ctx_datakey_init(context)
@@ -251,5 +254,52 @@ describe 'Mongo::Crypt::Binding' do
         end
       end
     end
+
+    describe '#mongocrypt_ctx_setopt_query_type' do
+      let(:result) do
+        Mongo::Crypt::Binding.mongocrypt_ctx_setopt_query_type(
+          context,
+          query_type,
+          -1
+        )
+      end
+
+      before do
+        Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
+      end
+
+      context 'with equality query type' do
+        let(:query_type) do
+          "equality"
+        end
+
+        it 'returns true' do
+          expect(result).to be true
+        end
+      end
+    end
+
+    describe '#mongocrypt_ctx_setopt_contention_factor' do
+      let(:result) do
+        Mongo::Crypt::Binding.mongocrypt_ctx_setopt_contention_factor(
+          context,
+          contention_factor
+        )
+      end
+
+      before do
+        Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
+      end
+
+      context 'with non zero contention factor' do
+        let(:contention_factor) do
+          10
+        end
+
+        it 'returns true' do
+          expect(result).to be true
+        end
+      end
+    end
   end
 end

data/spec/mongo/crypt/binding/mongocrypt_spec.rb

@@ -20,52 +20,29 @@ describe 'Mongo::Crypt::Binding' do
       end
     end
 
-    describe '#mongocrypt_setopt_kms_provider_local' do
-      let(:mongocrypt) { Mongo::Crypt::Binding.mongocrypt_new }
-
-      let(:binary) do
-        p = FFI::MemoryPointer.new(key_bytes.size)
-              .write_array_of_type(FFI::TYPE_UINT8, :put_uint8, key_bytes)
-
-        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(p, key_bytes.length)
-      end
-
-      after do
-        Mongo::Crypt::Binding.mongocrypt_binary_destroy(binary)
-      end
-
-      context 'with valid key' do
-        let(:key_bytes) { [114, 117, 98, 121] * 24 } # 96 bytes
-
-        it 'returns true' do
-          expect(Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)).to be true
-        end
-      end
-
-      context 'with invalid key' do
-        let(:key_bytes) { [114, 117, 98, 121] * 23 } # NOT 96 bytes
-
-        it 'returns false' do
-          expect(Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)).to be false
-        end
-      end
-    end
-
     describe '#mongocrypt_init' do
       let(:key_bytes) { [114, 117, 98, 121] * 24 } # 96 bytes
 
-      let(:binary) do
-        p = FFI::MemoryPointer.new(key_bytes.size)
-              .write_array_of_type(FFI::TYPE_UINT8, :put_uint8, key_bytes)
+      let(:kms_providers) do
+        BSON::Document.new({
+          local: {
+            key: BSON::Binary.new(key_bytes.pack('C*'), :generic),
+          }
+        })
+      end
 
-        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(p, key_bytes.length)
+      let(:binary) do
+        data = kms_providers.to_bson.to_s
+        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(
+          FFI::MemoryPointer.from_string(data),
+          data.bytesize,
+        )
       end
 
       let(:mongocrypt) do
-        mongocrypt = Mongo::Crypt::Binding.mongocrypt_new
-        Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
-
-        mongocrypt
+        Mongo::Crypt::Binding.mongocrypt_new.tap do |mongocrypt|
+          Mongo::Crypt::Binding.mongocrypt_setopt_kms_providers(mongocrypt, binary)
+        end
       end
 
       after do
@@ -82,12 +59,6 @@ describe 'Mongo::Crypt::Binding' do
         end
       end
 
-      context 'without binding crypto hooks' do
-        it 'returns false' do
-          expect(Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)).to be false
-        end
-      end
-
       context 'with invalid kms option' do
         before do
           MongoCryptSpecHelper.bind_crypto_hooks(mongocrypt)
@@ -131,7 +102,7 @@ describe 'Mongo::Crypt::Binding' do
         end
 
         it 'returns a error_client status' do
-          Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
+          Mongo::Crypt::Binding.mongocrypt_setopt_kms_providers(mongocrypt, binary)
 
           Mongo::Crypt::Binding.mongocrypt_status(mongocrypt, status)
           expect(Mongo::Crypt::Binding.mongocrypt_status_type(status)).to eq(:error_client)

data/spec/mongo/crypt/binding/version_spec.rb

@@ -17,4 +17,37 @@ describe 'Mongo::Crypt::Binding' do
       expect(version).to match(/\A(\d+.){2}(\d+)?(-[A-Za-z\+\d]+)?\z/)
     end
   end
+
+  describe '#validate_version' do
+    context 'when not satisfied' do
+      let(:older_version) do
+        Mongo::Crypt::Binding::MIN_LIBMONGOCRYPT_VERSION.to_s.sub(/^\d+/, '0')
+      end
+
+      it 'raises an error' do
+        expect do
+          Mongo::Crypt::Binding.validate_version(older_version)
+        end.to raise_error(LoadError, /libmongocrypt version .* or above is required, but version .* was found./)
+      end
+    end
+
+    context 'when satisfied' do
+      let(:newer_version) do
+        Mongo::Crypt::Binding::MIN_LIBMONGOCRYPT_VERSION.bump.to_s
+      end
+      it 'does not raise and error' do
+        expect do
+          Mongo::Crypt::Binding.validate_version(newer_version)
+        end.not_to raise_error(LoadError, /libmongocrypt version .* or above is required, but version .* was found./)
+      end
+    end
+
+    context 'when in a non-parsable format' do
+      it 'does not raise ArgumentError' do
+        expect do
+          Mongo::Crypt::Binding.validate_version("1.5.3-dev+20220730git8f8675fa11")
+        end.not_to raise_error(ArgumentError, /Malformed version number string/)
+      end
+    end
+  end
 end

data/spec/mongo/crypt/binding_unloaded_spec.rb

@@ -6,8 +6,22 @@ require 'lite_spec_helper'
 describe 'Mongo::Crypt::Binding' do
   require_no_libmongocrypt
 
+  before(:all) do
+    if ENV['FLE'] == 'helper'
+      skip 'FLE=helper is incompatible with unloaded binding tests'
+    end
+  end
+
   context 'when load fails' do
 
+    # JRuby 9.3.2.0 converts our custom LoadErrors to generic NameErrors
+    # and trashes the exception messages.
+    # https://github.com/jruby/jruby/issues/7070
+    # JRuby 9.2 works correctly, this test is skipped on all JRuby versions
+    # because we intend to remove JRuby support altogether and therefore
+    # adding logic to condition on JRuby versions does not make sense.
+    fails_on_jruby
+
     it 'retries loading at the next reference' do
       lambda do
         Mongo::Crypt::Binding