mongo 2.17.4 → 2.21.0

data/spec/integration/client_side_encryption/data_key_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 
@@ -50,8 +50,27 @@ describe 'Client-Side Encryption' do
                 access_key_id: SpecConfig.instance.fle_aws_key,
                 secret_access_key: SpecConfig.instance.fle_aws_secret,
               },
+              azure: {
+                tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+                client_id: SpecConfig.instance.fle_azure_client_id,
+                client_secret: SpecConfig.instance.fle_azure_client_secret,
+              },
+              gcp: {
+                email: SpecConfig.instance.fle_gcp_email,
+                private_key: SpecConfig.instance.fle_gcp_private_key,
+              },
+              kmip: {
+                endpoint: SpecConfig.instance.fle_kmip_endpoint
+              }
             },
-            key_vault_namespace: 'admin.datakeys',
+            kms_tls_options: {
+              kmip: {
+                ssl_ca_cert: SpecConfig.instance.fle_kmip_tls_ca_file,
+                ssl_cert: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
+                ssl_key: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
+              }
+            },
+            key_vault_namespace: 'keyvault.datakeys',
             schema_map: test_schema_map,
             # Spawn mongocryptd on non-default port for sharded cluster tests
             extra_options: extra_options,
@@ -70,15 +89,34 @@ describe 'Client-Side Encryption' do
             aws: {
               access_key_id: SpecConfig.instance.fle_aws_key,
               secret_access_key: SpecConfig.instance.fle_aws_secret,
+            },
+            azure: {
+              tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+              client_id: SpecConfig.instance.fle_azure_client_id,
+              client_secret: SpecConfig.instance.fle_azure_client_secret,
+            },
+            gcp: {
+              email: SpecConfig.instance.fle_gcp_email,
+              private_key: SpecConfig.instance.fle_gcp_private_key,
+            },
+            kmip: {
+              endpoint: SpecConfig.instance.fle_kmip_endpoint
             }
           },
-          key_vault_namespace: 'admin.datakeys',
+          kms_tls_options: {
+            kmip: {
+              ssl_ca_cert: SpecConfig.instance.fle_kmip_tls_ca_file,
+              ssl_cert: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
+              ssl_key: SpecConfig.instance.fle_kmip_tls_certificate_key_file,
+            }
+          },
+          key_vault_namespace: 'keyvault.datakeys',
         },
       )
     end
 
     before do
-      client.use('admin')['datakeys'].drop
+      client.use('keyvault')['datakeys'].drop
       client.use('db')['coll'].drop
     end
 
@@ -91,7 +129,7 @@ describe 'Client-Side Encryption' do
 
         expect(data_key_id).to be_uuid
 
-        keys = client.use('admin')['datakeys'].find(_id: data_key_id)
+        keys = client.use('keyvault')['datakeys'].find(_id: data_key_id)
 
         expect(keys.count).to eq(1)
         expect(keys.first['masterKey']['provider']).to eq(kms_provider_name)
@@ -134,7 +172,7 @@ describe 'Client-Side Encryption' do
 
         expect do
           client_encrypted['coll'].insert_one(encrypted_placeholder: encrypted)
-        end.to raise_error(Mongo::Error::OperationFailure, /Cannot encrypt element of type binData/)
+        end.to raise_error(Mongo::Error::OperationFailure, /Cannot encrypt element of type(: encrypted binary data| binData)/)
       end
     end
 
@@ -156,8 +194,60 @@ describe 'Client-Side Encryption' do
       let(:data_key_options) do
         {
           master_key: {
-            region: "us-east-1",
-            key: "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0"
+            region: SpecConfig.instance.fle_aws_region,
+            key: SpecConfig.instance.fle_aws_arn,
+          }
+        }
+      end
+
+      it_behaves_like 'can create and use a data key'
+    end
+
+    context 'with Azure KMS options' do
+      include_context 'with Azure kms_providers'
+
+      let(:key_alt_name) { 'azure_altname' }
+      let(:value_to_encrypt) { 'hello azure' }
+      let(:data_key_options) do
+        {
+          master_key: {
+            key_vault_endpoint: SpecConfig.instance.fle_azure_key_vault_endpoint,
+            key_name: SpecConfig.instance.fle_azure_key_name,
+          }
+        }
+      end
+
+      it_behaves_like 'can create and use a data key'
+    end
+
+    context 'with GCP KMS options' do
+      include_context 'with GCP kms_providers'
+
+      let(:key_alt_name) { 'gcp_altname' }
+      let(:value_to_encrypt) { 'hello gcp' }
+      let(:data_key_options) do
+        {
+          master_key: {
+            project_id: SpecConfig.instance.fle_gcp_project_id,
+            location: SpecConfig.instance.fle_gcp_location,
+            key_ring: SpecConfig.instance.fle_gcp_key_ring,
+            key_name: SpecConfig.instance.fle_gcp_key_name,
+          }
+        }
+      end
+
+      it_behaves_like 'can create and use a data key'
+    end
+
+    context 'with KMIP KMS options' do
+      include_context 'with KMIP kms_providers'
+
+      let(:key_alt_name) { 'kmip_altname' }
+      let(:value_to_encrypt) { 'hello kmip' }
+      let(:data_key_options) do
+        {
+          master_key: {
+            key_id: "1"
           }
         }
       end

data/spec/integration/client_side_encryption/decryption_events_prose_spec.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'Decryption events' do
+  require_enterprise
+  min_server_fcv '4.2'
+  require_libmongocrypt
+  include_context 'define shared FLE helpers'
+  require_topology :replica_set
+  min_server_version '7.0.0-rc0'
+
+  let(:setup_client) do
+    ClientRegistry.instance.new_local_client(
+      SpecConfig.instance.addresses,
+      SpecConfig.instance.test_options.merge(
+        database: SpecConfig.instance.test_db
+      )
+    )
+  end
+
+  let(:collection_name) do
+    'decryption_event'
+  end
+
+  let(:client_encryption) do
+    Mongo::ClientEncryption.new(
+      setup_client,
+      key_vault_namespace: "#{key_vault_db}.#{key_vault_coll}",
+      kms_providers: local_kms_providers
+    )
+  end
+
+  let(:key_id) do
+    client_encryption.create_data_key('local')
+  end
+
+  let(:unencrypted_value) do
+    'hello'
+  end
+
+  let(:ciphertext) do
+    client_encryption.encrypt(
+      unencrypted_value,
+      key_id: key_id,
+      algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+    )
+  end
+
+  let(:malformed_ciphertext) do
+    ciphertext.dup.tap do |obj|
+      obj.data[-1] = 0.chr
+    end
+  end
+
+  let(:encrypted_client) do
+    ClientRegistry.instance.new_local_client(
+      SpecConfig.instance.addresses,
+      SpecConfig.instance.test_options.merge(
+        auto_encryption_options: {
+          key_vault_namespace: "#{key_vault_db}.#{key_vault_coll}",
+          kms_providers: local_kms_providers,
+          extra_options: extra_options,
+        },
+        database: SpecConfig.instance.test_db,
+        retry_reads: false,
+        max_read_retries: 0
+      )
+    )
+  end
+
+  let(:collection) do
+    encrypted_client[collection_name]
+  end
+
+  let(:subscriber) { Mrss::EventSubscriber.new }
+
+  let(:command_error) do
+    {
+      'configureFailPoint' => 'failCommand',
+      'mode' => { 'times' => 1 },
+      'data' => {
+        'errorCode' => 123,
+        'failCommands' => [ 'aggregate' ]
+      }
+    }
+  end
+
+  let(:network_error) do
+    {
+      'configureFailPoint' => 'failCommand',
+      'mode' => { 'times' => 1 },
+      'data' => {
+        'errorCode' => 123,
+        'closeConnection' => true,
+        'failCommands' => [ 'aggregate' ]
+      }
+    }
+  end
+
+  let(:aggregate_event) do
+    subscriber.succeeded_events.detect do |evt|
+      evt.command_name == 'aggregate'
+    end
+  end
+
+  before do
+    setup_client[collection_name].drop
+    setup_client[collection_name].create
+
+    encrypted_client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+  end
+
+  it 'tests command error' do
+    setup_client.use(:admin).command(command_error)
+
+    expect do
+      collection.aggregate([]).to_a
+    end.to raise_error(Mongo::Error::OperationFailure, /Failing command (?:via|due to) 'failCommand' failpoint/)
+    expect(subscriber.failed_events.length).to be 1
+  end
+
+  it 'tests network error' do
+    setup_client.use(:admin).command(network_error)
+
+    expect do
+      collection.aggregate([]).to_a
+    end.to raise_error(Mongo::Error::SocketError)
+    expect(subscriber.failed_events.length).to be 1
+  end
+
+  context 'when decrypt error' do
+    before do
+      collection.insert_one(encrypted: malformed_ciphertext)
+    end
+
+    it 'fails' do
+      expect { collection.aggregate([]).to_a }.to raise_error(Mongo::Error::CryptError)
+      expect(aggregate_event).not_to be_nil
+      expect(
+        aggregate_event.reply.dig('cursor', 'firstBatch')&.first&.dig('encrypted')
+      ).to be_a(BSON::Binary)
+    end
+  end
+
+  context 'when decrypt success' do
+    before do
+      collection.insert_one(encrypted: ciphertext)
+    end
+
+    it 'succeeds' do
+      expect { collection.aggregate([]).to_a }.not_to raise_error
+      expect(aggregate_event).not_to be_nil
+      expect(
+        aggregate_event.reply.dig('cursor', 'firstBatch')&.first&.dig('encrypted')
+      ).to be_a(BSON::Binary)
+    end
+  end
+end

data/spec/integration/client_side_encryption/explicit_encryption_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 
@@ -12,6 +12,7 @@ describe 'Explicit Encryption' do
   let(:client_encryption_opts) do
     {
       kms_providers: kms_providers,
+      kms_tls_options: kms_tls_options,
       key_vault_namespace: key_vault_namespace
     }
   end
@@ -72,6 +73,28 @@ describe 'Explicit Encryption' do
 
     context 'with AWS KMS provider' do
       include_context 'with AWS kms_providers'
+      retry_test
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with Azure KMS provider' do
+      include_context 'with Azure kms_providers'
+      retry_test
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with GCP KMS provider' do
+      include_context 'with GCP kms_providers'
+      retry_test
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with KMIP KMS provider' do
+      include_context 'with KMIP kms_providers'
+      retry_test
 
       it_behaves_like 'an explicit encrypter'
     end
@@ -92,6 +115,24 @@ describe 'Explicit Encryption' do
       it_behaves_like 'an explicit encrypter'
     end
 
+    context 'with Azure KMS provider' do
+      include_context 'with Azure kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with GCP KMS provider' do
+      include_context 'with GCP kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with KMIP KMS provider' do
+      include_context 'with KMIP kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
     context 'with local KMS provider' do
       include_context 'with local kms_providers'
 
@@ -108,6 +149,24 @@ describe 'Explicit Encryption' do
       it_behaves_like 'an explicit encrypter'
     end
 
+    context 'with Azure KMS provider' do
+      include_context 'with Azure kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with GCP KMS provider' do
+      include_context 'with GCP kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
+    context 'with KMIP KMS provider' do
+      include_context 'with KMIP kms_providers'
+
+      it_behaves_like 'an explicit encrypter'
+    end
+
     context 'with local KMS provider' do
       include_context 'with local kms_providers'
 

data/spec/integration/client_side_encryption/explicit_queryable_encryption_spec.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+# No need to rewrite existing specs to make the examples shorter, until/unless
+# we revisit these specs and need to make substantial changes.
+# rubocop:disable RSpec/ExampleLength
+describe 'Explicit Queryable Encryption' do
+  require_libmongocrypt
+  min_server_version '7.0.0-rc0'
+  require_topology :replica_set, :sharded, :load_balanced
+
+  include_context 'define shared FLE helpers'
+
+  let(:key1_id) do
+    key1_document['_id']
+  end
+
+  let(:encrypted_coll) do
+    'explicit_encryption'
+  end
+
+  let(:value) do
+    'encrypted indexed value'
+  end
+
+  let(:unindexed_value) do
+    'encrypted unindexed value'
+  end
+
+  let(:key_vault_client) do
+    ClientRegistry.instance.new_local_client(SpecConfig.instance.addresses)
+  end
+
+  let(:client_encryption_opts) do
+    {
+      kms_providers: local_kms_providers,
+      kms_tls_options: kms_tls_options,
+      key_vault_namespace: key_vault_namespace
+    }
+  end
+
+  let(:client_encryption) do
+    Mongo::ClientEncryption.new(
+      key_vault_client,
+      client_encryption_opts
+    )
+  end
+
+  let(:encrypted_client) do
+    ClientRegistry.instance.new_local_client(
+      SpecConfig.instance.addresses,
+      auto_encryption_options: {
+        key_vault_namespace: "#{key_vault_db}.#{key_vault_coll}",
+        kms_providers: local_kms_providers,
+        bypass_query_analysis: true
+      },
+      database: SpecConfig.instance.test_db
+    )
+  end
+
+  before do
+    authorized_client[encrypted_coll].drop(encrypted_fields: encrypted_fields)
+    authorized_client[encrypted_coll].create(encrypted_fields: encrypted_fields)
+    authorized_client.use(key_vault_db)[key_vault_coll].drop
+    authorized_client.use(key_vault_db)[key_vault_coll, write_concern: { w: :majority }].insert_one(key1_document)
+  end
+
+  after do
+    authorized_client[encrypted_coll].drop(encrypted_fields: encrypted_fields)
+    authorized_client.use(key_vault_db)[key_vault_coll].drop
+  end
+
+  it 'can insert encrypted indexed and find' do
+    insert_payload = client_encryption.encrypt(
+      value, key_id: key1_id, algorithm: 'Indexed', contention_factor: 0
+    )
+    encrypted_client[encrypted_coll].insert_one(
+      'encryptedIndexed' => insert_payload
+    )
+    find_payload = client_encryption.encrypt(
+      value, key_id: key1_id, algorithm: 'Indexed', query_type: 'equality', contention_factor: 0
+    )
+    find_results = encrypted_client[encrypted_coll]
+                   .find('encryptedIndexed' => find_payload)
+                   .to_a
+    expect(find_results.size).to eq(1)
+    expect(find_results.first['encryptedIndexed']).to eq(value)
+  end
+
+  it 'can insert encrypted indexed and find with non-zero contention' do
+    10.times do
+      insert_payload = client_encryption.encrypt(
+        value, key_id: key1_id, algorithm: 'Indexed', contention_factor: 10
+      )
+      encrypted_client[encrypted_coll].insert_one(
+        'encryptedIndexed' => insert_payload
+      )
+    end
+    find_payload = client_encryption.encrypt(
+      value, key_id: key1_id, algorithm: 'Indexed', query_type: 'equality', contention_factor: 0
+    )
+    find_results = encrypted_client[encrypted_coll]
+                   .find('encryptedIndexed' => find_payload)
+                   .to_a
+    expect(find_results.size).to be < 10
+    find_results.each do |doc|
+      expect(doc['encryptedIndexed']).to eq(value)
+    end
+    find_payload2 = client_encryption.encrypt(
+      value, key_id: key1_id, algorithm: 'Indexed', query_type: 'equality', contention_factor: 10
+    )
+    find_results2 = encrypted_client[encrypted_coll]
+                    .find('encryptedIndexed' => find_payload2)
+                    .to_a
+    expect(find_results2.size).to eq(10)
+    find_results2.each do |doc|
+      expect(doc['encryptedIndexed']).to eq(value)
+    end
+  end
+
+  it 'can insert encrypted unindexed' do
+    insert_payload = client_encryption.encrypt(
+      unindexed_value, key_id: key1_id, algorithm: 'Unindexed'
+    )
+    encrypted_client[encrypted_coll].insert_one(
+      '_id' => 1, 'encryptedUnindexed' => insert_payload
+    )
+    find_results = encrypted_client[encrypted_coll].find('_id' => 1).to_a
+    expect(find_results.size).to eq(1)
+    expect(find_results.first['encryptedUnindexed']).to eq(unindexed_value)
+  end
+
+  it 'can roundtrip encrypted indexed' do
+    payload = client_encryption.encrypt(
+      value, key_id: key1_id, algorithm: 'Indexed', contention_factor: 0
+    )
+    decrypted_value = client_encryption.decrypt(payload)
+    expect(decrypted_value).to eq(value)
+  end
+
+  it 'can roundtrip encrypted unindexed' do
+    payload = client_encryption.encrypt(
+      unindexed_value, key_id: key1_id, algorithm: 'Unindexed'
+    )
+    decrypted_value = client_encryption.decrypt(payload)
+    expect(decrypted_value).to eq(unindexed_value)
+  end
+end
+# rubocop:enable RSpec/ExampleLength

data/spec/integration/client_side_encryption/external_key_vault_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 
@@ -39,11 +39,11 @@ describe 'Client-Side Encryption' do
     end
 
     before do
-      client.use('admin')['datakeys'].drop
+      client.use('keyvault')['datakeys'].drop
       client.use('db')['coll'].drop
 
       data_key = BSON::ExtJSON.parse(File.read('spec/support/crypt/external/external-key.json'))
-      client.use('admin')['datakeys', write_concern: { w: :majority }].insert_one(data_key)
+      client.use('keyvault')['datakeys', write_concern: { w: :majority }].insert_one(data_key)
     end
 
     context 'with default key vault client' do
@@ -53,7 +53,7 @@ describe 'Client-Side Encryption' do
           SpecConfig.instance.test_options.merge(
             auto_encryption_options: {
               kms_providers: local_kms_providers,
-              key_vault_namespace: 'admin.datakeys',
+              key_vault_namespace: 'keyvault.datakeys',
               schema_map: test_schema_map,
               # Spawn mongocryptd on non-default port for sharded cluster tests
               extra_options: extra_options,
@@ -68,7 +68,7 @@ describe 'Client-Side Encryption' do
           client,
           {
             kms_providers: local_kms_providers,
-            key_vault_namespace: 'admin.datakeys',
+            key_vault_namespace: 'keyvault.datakeys',
           }
         )
       end
@@ -101,7 +101,7 @@ describe 'Client-Side Encryption' do
           SpecConfig.instance.test_options.merge(
             auto_encryption_options: {
               kms_providers: local_kms_providers,
-              key_vault_namespace: 'admin.datakeys',
+              key_vault_namespace: 'keyvault.datakeys',
               schema_map: test_schema_map,
               key_vault_client: external_key_vault_client,
               # Spawn mongocryptd on non-default port for sharded cluster tests
@@ -117,7 +117,7 @@ describe 'Client-Side Encryption' do
           external_key_vault_client,
           {
             kms_providers: local_kms_providers,
-            key_vault_namespace: 'admin.datakeys',
+            key_vault_namespace: 'keyvault.datakeys',
           }
         )
       end