mongo 2.17.2 → 2.18.1

data/spec/mongo/crypt/handle_spec.rb

@@ -10,8 +10,44 @@ describe Mongo::Crypt::Handle do
   include_context 'define shared FLE helpers'
 
   describe '#initialize' do
-    let(:handle) { described_class.new(kms_providers, schema_map: schema_map) }
-    let(:schema_map) { nil }
+    let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+    let(:kms_tls_options) { {} }
+    let(:handle) do
+      described_class.new(
+        credentials,
+        kms_tls_options,
+        schema_map: schema_map,
+        schema_map_path: schema_map_path,
+        bypass_query_analysis: bypass_query_analysis,
+        crypt_shared_lib_path: crypt_shared_lib_path,
+        crypt_shared_lib_required: crypt_shared_lib_required,
+        explicit_encryption_only: explicit_encryption_only,
+      )
+    end
+
+    let(:schema_map) do
+      nil
+    end
+
+    let(:schema_map_path) do
+      nil
+    end
+
+    let(:bypass_query_analysis) do
+      nil
+    end
+
+    let(:crypt_shared_lib_path) do
+      nil
+    end
+
+    let(:crypt_shared_lib_required) do
+      nil
+    end
+
+    let(:explicit_encryption_only) do
+      nil
+    end
 
     shared_examples 'a functioning Mongo::Crypt::Handle' do
       context 'with valid schema map' do
@@ -20,11 +56,33 @@ describe Mongo::Crypt::Handle do
         end
       end
 
+      context 'with valid schema map in a file' do
+        let(:schema_map_path) do
+          schema_map_file_path
+        end
+
+        context 'without schema_map set' do
+          let(:schema_map) do
+            nil
+          end
+
+          it 'does not raise an exception' do
+            expect { handle }.not_to raise_error
+          end
+        end
+
+        context 'with schema_map set' do
+          it 'raises an exception' do
+            expect { handle }.to raise_error(ArgumentError, /Cannot set both schema_map and schema_map_path options/)
+          end
+        end
+      end
+
       context 'with invalid schema map' do
         let(:schema_map) { '' }
 
         it 'raises an exception' do
-          expect { handle }.to raise_error(ArgumentError, /schema_map must be a Hash or nil/)
+          expect { handle }.to raise_error(ArgumentError, /invalid schema_map; schema_map must be a Hash or nil/)
         end
       end
 
@@ -35,201 +93,159 @@ describe Mongo::Crypt::Handle do
           expect { handle }.not_to raise_error
         end
       end
-    end
-
-    context 'with empty kms_providers' do
-      let(:kms_providers) { {} }
 
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /must have one of the following keys: :aws, :local/)
-      end
-    end
+      context 'with crypt_shared_lib_path' do
+        min_server_version '6.0.0'
 
-    context 'with invalid aws kms_providers' do
-      let(:kms_providers) { { aws: {} } }
+        context 'with correct path' do
+          let(:crypt_shared_lib_path) do
+            SpecConfig.instance.crypt_shared_lib_path
+          end
 
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /kms_providers with :aws key must be in the format: { aws: { access_key_id: 'YOUR-ACCESS-KEY-ID', secret_access_key: 'SECRET-ACCESS-KEY' } }/)
-      end
-    end
+          it 'loads the crypt shared lib' do
+            expect(handle.crypt_shared_lib_version).not_to eq(0)
+          end
+        end
 
-    context 'with invalid kms_providers key' do
-      let(:kms_providers) { { random_kms_provider: {} } }
+        context 'with incorrect path' do
+          let(:crypt_shared_lib_path) do
+            '/some/bad/path/mongo_crypt_v1.so'
+          end
 
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /must have one of the following keys: :aws, :local/)
+          it 'raises an exception' do
+            expect { handle }.to raise_error(Mongo::Error::CryptError)
+          end
+        end
       end
-    end
 
-    context 'with empty local kms_providers' do
-      let(:kms_providers) { { local: {} } }
+      context 'with crypt_shared_lib_required' do
+        min_server_version '6.0.0'
 
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /kms_providers with :local key must be in the format: { local: { key: 'MASTER-KEY' } }/)
-      end
-    end
+        context 'set to true' do
+          let(:crypt_shared_lib_required) do
+            true
+          end
 
-    context 'with invalid local kms_providers' do
-      let(:kms_providers) { { local: { invalid_key: 'Some stuff' } } }
+          context 'when shared lib is available' do
+            let(:crypt_shared_lib_path) do
+              SpecConfig.instance.crypt_shared_lib_path
+            end
 
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /kms_providers with :local key must be in the format: { local: { key: 'MASTER-KEY' } }/)
-      end
-    end
+            it 'does not raise an exception' do
+              expect { handle }.not_to raise_error
+            end
+          end
 
-    context 'with invalid local kms master key' do
-      let(:kms_providers) do
-        {
-          local: {
-            key: 'ruby' * 23 # NOT 96 bytes
-          }
-        }
-      end
+          context 'when shared lib is not available' do
+            let(:crypt_shared_lib_path) do
+              '/some/bad/path/mongo_crypt_v1.so'
+            end
 
-      it 'raises an exception' do
-        expect { handle }.to raise_error(Mongo::Error::CryptError, 'local key must be 96 bytes (libmongocrypt error code 1)')
+            it 'raises an exception' do
+              expect { handle }.to raise_error(Mongo::Error::CryptError)
+            end
+          end
+        end
       end
-    end
 
-    context 'with valid local kms_providers' do
-      include_context 'with local kms_providers'
-      it_behaves_like 'a functioning Mongo::Crypt::Handle'
-    end
+      context 'if bypass_query_analysis is true' do
+        min_server_version '6.0.0'
 
-    context 'with nil AWS kms_provider' do
-      let(:kms_providers) {
-        {
-          aws: nil
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The :aws KMS provider must not be nil/)
-      end
-    end
+        let(:bypass_query_analysis) do
+          true
+        end
+
+        it 'does not load the crypt shared lib' do
+          expect_any_instance_of(Binding).not_to receive(:setopt_append_crypt_shared_lib_search_path)
 
-    context 'with empty AWS kms_provider' do
-      let(:kms_providers) {
-        {
-          aws: {}
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The specified aws kms_providers option is invalid/)
+          expect(handle.crypt_shared_lib_version).to eq(0)
+        end
       end
-    end
 
-    context 'with nil AWS access_key_id' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: nil,
-            secret_access_key: SpecConfig.instance.fle_aws_secret
-          }
-        }
-      }
+      context 'if explicit_encryption_only is true' do
+        min_server_version '6.0.0'
 
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; currently have nil/)
-      end
-    end
+        let(:explicit_encryption_only) do
+          true
+        end
 
-    context 'with non-string AWS access_key_id' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: 5,
-            secret_access_key: SpecConfig.instance.fle_aws_secret
-          }
-        }
-      }
+        it 'does not load the crypt shared lib' do
+          expect_any_instance_of(Binding).not_to receive(:setopt_append_crypt_shared_lib_search_path)
 
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; currently have 5/)
+          expect(handle.crypt_shared_lib_version).to eq(0)
+        end
       end
     end
 
-    context 'with empty string AWS access_key_id' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: '',
-            secret_access_key: SpecConfig.instance.fle_aws_secret
+    context 'local' do
+      context 'with invalid local kms master key' do
+        let(:kms_providers) do
+          {
+            local: {
+              key: 'ruby' * 23 # NOT 96 bytes
+            }
           }
-        }
-      }
+        end
 
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; it is currently an empty string/)
+        it 'raises an exception' do
+          expect { handle }.to raise_error(Mongo::Error::CryptError, 'local key must be 96 bytes (libmongocrypt error code 1)')
+        end
       end
-    end
 
+      context 'with valid local kms_providers' do
+        include_context 'with local kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
+      end
 
-    context 'with nil AWS secret_access_key' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: SpecConfig.instance.fle_aws_key,
-            secret_access_key: nil
-          }
-        }
-      }
+    end
 
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws secret_access_key option must be a String with at least one character; currently have nil/)
+    context 'AWS' do
+      context 'with valid AWS kms_providers' do
+        include_context 'with AWS kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
 
-    context 'with non-string AWS secret_access_key' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: SpecConfig.instance.fle_aws_key,
-            secret_access_key: 5
-          }
-        }
-      }
+    context 'Azure' do
+      context 'with valid azure kms_providers' do
+        include_context 'with Azure kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
+      end
+    end
 
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws secret_access_key option must be a String with at least one character; currently have 5/)
+    context 'GCP' do
+      context 'with valid gcp kms_providers' do
+        include_context 'with GCP kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
 
-    context 'with empty string AWS secret_access_key' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: SpecConfig.instance.fle_aws_key,
-            secret_access_key: ''
+    context 'GCP with PEM private key' do
+      require_mri
+
+      context 'with valid gcp kms_providers' do
+        include_context 'with GCP kms_providers'
+
+        let(:kms_providers) do
+          {
+            gcp: {
+              email: SpecConfig.instance.fle_gcp_email,
+              private_key: OpenSSL::PKey.read(
+                Base64.decode64(SpecConfig.instance.fle_gcp_private_key)
+              ).export,
+            }
           }
-        }
-      }
+        end
 
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws secret_access_key option must be a String with at least one character; it is currently an empty string/)
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
 
-    context 'with valid AWS kms_providers' do
-      include_context 'with AWS kms_providers'
-      it_behaves_like 'a functioning Mongo::Crypt::Handle'
+    context 'KMIP' do
+      context 'with valid kmip kms_providers' do
+        include_context 'with KMIP kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
+      end
     end
   end
 end

data/spec/mongo/crypt/hooks_spec.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'mongo'
+require 'base64'
+require 'lite_spec_helper'
+
+describe Mongo::Crypt::Hooks do
+  context '#rsaes_pkcs_signature' do
+    let(:private_key_data_b64) do
+      'MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4JOyv5z05cL18ztpknRC7CFY2gYol4DAKerdVUoDJxCTmFMf39dVUEqD0WDiw/qcRtSO1/FRut08PlSPmvbyKetsLoxlpS8lukSzEFpFK7+L+R4miFOl6HvECyg7lbC1H/WGAhIz9yZRlXhRo9qmO/fB6PV9IeYtU+1xYuXicjCDPp36uuxBAnCz7JfvxJ3mdVc0vpSkbSb141nWuKNYR1mgyvvL6KzxO6mYsCo4hRAdhuizD9C4jDHk0V2gDCFBk0h8SLEdzStX8L0jG90/Og4y7J1b/cPo/kbYokkYisxe8cPlsvGBf+rZex7XPxc1yWaP080qeABJb+S88O//LAgMBAAECggEBAKVxP1m3FzHBUe2NZ3fYCc0Qa2zjK7xl1KPFp2u4CU+9sy0oZJUqQHUdm5CMprqWwIHPTftWboFenmCwrSXFOFzujljBO7Z3yc1WD3NJl1ZNepLcsRJ3WWFH5V+NLJ8Bdxlj1DMEZCwr7PC5+vpnCuYWzvT0qOPTl9RNVaW9VVjHouJ9Fg+s2DrShXDegFabl1iZEDdI4xScHoYBob06A5lw0WOCTayzw0Naf37lM8Y4psRAmI46XLiF/Vbuorna4hcChxDePlNLEfMipICcuxTcei1RBSlBa2t1tcnvoTy6cuYDqqImRYjp1KnMKlKQBnQ1NjS2TsRGm+F0FbreVCECgYEA4IDJlm8q/hVyNcPe4OzIcL1rsdYN3bNm2Y2O/YtRPIkQ446ItyxD06d9VuXsQpFp9jNACAPfCMSyHpPApqlxdc8z/xATlgHkcGezEOd1r4E7NdTpGg8y6Rj9b8kVlED6v4grbRhKcU6moyKUQT3+1B6ENZTOKyxuyDEgTwZHtFECgYEA0fqdv9h9s77d6eWmIioP7FSymq93pC4umxf6TVicpjpMErdD2ZfJGulN37dq8FOsOFnSmFYJdICj/PbJm6p1i8O21lsFCltEqVoVabJ7/0alPfdG2U76OeBqI8ZubL4BMnWXAB/VVEYbyWCNpQSDTjHQYs54qa2I0dJB7OgJt1sCgYEArctFQ02/7H5Rscl1yo3DBXO94SeiCFSPdC8f2Kt3MfOxvVdkAtkjkMACSbkoUsgbTVqTYSEOEc2jTgR3iQ13JgpHaFbbsq64V0QP3TAxbLIQUjYGVgQaF1UfLOBv8hrzgj45z/ST/G80lOl595+0nCUbmBcgG1AEWrmdF0/3RmECgYAKvIzKXXB3+19vcT2ga5Qq2l3TiPtOGsppRb2XrNs9qKdxIYvHmXo/9QP1V3SRW0XoD7ez8FpFabp42cmPOxUNk3FK3paQZABLxH5pzCWI9PzIAVfPDrm+sdnbgG7vAnwfL2IMMJSA3aDYGCbF9EgefG+STcpfqq7fQ6f5TBgLFwKBgCd7gn1xYL696SaKVSm7VngpXlczHVEpz3kStWR5gfzriPBxXgMVcWmcbajRser7ARpCEfbxM1UJyv6oAYZWVSNErNzNVb4POqLYcCNySuC6xKhs9FrEQnyKjyk8wI4VnrEMGrQ8e+qYSwYk9Gh6dKGoRMAPYVXQAO0fIsHF/T0a'
+    end
+
+    let(:signature) do
+      Base64.decode64(
+        'VocBRhpMmQ2XCzVehWSqheQLnU889gf3dhU4AnVnQTJjsKx/CM23qKDPkZDd2A/BnQsp99SN7ksIX5Raj0TPwyN5OCN/YrNFNGoOFlTsGhgP/hyE8X3Duiq6sNO0SMvRYNPFFGlJFsp1Fw3Z94eYMg4/Wpw5s4+Jo5Zm/qY7aTJIqDKDQ3CNHLeJgcMUOc9sz01/GzoUYKDVODHSxrYEk5ireFJFz9vP8P7Ha+VDUZuQIQdXer9NBbGFtYmWprY3nn4D3Dw93Sn0V0dIqYeIo91oKyslvMebmUM95S2PyIJdEpPb2DJDxjvX/0LLwSWlSXRWy9gapWoBkb4ynqZBsg=='
+      )
+    end
+
+    let(:input) do
+      'data to sign'
+    end
+
+    it 'signs data with private key' do
+      expect(
+        subject.rsaes_pkcs_signature(private_key_data_b64, input)
+      ).to eq(signature)
+    end
+  end
+end