mongo 2.18.2 → 2.19.0

data/lib/mongo/crypt/kms/gcp/credentials.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module GCP
+        # GCP Cloud Key Management Credentials object contains credentials for
+        # using GCP KMS provider.
+        #
+        # @api private
+        class Credentials
+          extend Forwardable
+          include KMS::Validations
+
+          # @return [ String ] GCP email to authenticate with.
+          attr_reader :email
+
+          # @return [ String ] GCP private key, base64 encoded DER format.
+          attr_reader :private_key
+
+          # @return [ String | nil ] GCP KMS endpoint.
+          attr_reader :endpoint
+
+          # @return [ String | nil ] GCP access token.
+          attr_reader :access_token
+
+          # @api private
+          def_delegator :@opts, :empty?
+
+          FORMAT_HINT = "GCP KMS provider options must be in the format: " +
+              "{ email: 'EMAIL', private_key: 'PRIVATE-KEY' }"
+
+          # Creates an GCP KMS credentials object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains credentials for
+          #   GCP KMS provider
+          # @option opts [ String ] :email GCP email.
+          # @option opts [ String ] :private_key GCP private key. This method accepts
+          #   private key in either base64 encoded DER format, or PEM format.
+          # @option opts [ String | nil ] :endpoint GCP endpoint, optional.
+          # @option opts [ String | nil ] :access_token GCP access token, optional.
+          #   If this option is not null, other options are ignored.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly
+          #   formatted.
+          def initialize(opts)
+            @opts = opts
+            return if empty?
+
+            if opts[:access_token]
+              @access_token = opts[:access_token]
+            else
+              @email = validate_param(:email, opts, FORMAT_HINT)
+              @private_key = begin
+                private_key_opt = validate_param(:private_key, opts, FORMAT_HINT)
+                if BSON::Environment.jruby?
+                  # We cannot really validate private key on JRuby, so we assume
+                  # it is in base64 encoded DER format.
+                  private_key_opt
+                else
+                  # Check if private key is in PEM format.
+                  pkey = OpenSSL::PKey::RSA.new(private_key_opt)
+                  # PEM it is, need to be converted to base64 encoded DER.
+                  der = if pkey.respond_to?(:private_to_der)
+                    pkey.private_to_der
+                  else
+                    pkey.to_der
+                  end
+                  Base64.encode64(der)
+                end
+              rescue OpenSSL::PKey::RSAError
+                # Check if private key is in DER.
+                begin
+                  OpenSSL::PKey.read(Base64.decode64(private_key_opt))
+                  # Private key is fine, use it.
+                  private_key_opt
+                rescue OpenSSL::PKey::PKeyError
+                  raise ArgumentError.new(
+                    "The private_key option must be either either base64 encoded DER format, or PEM format."
+                  )
+                end
+              end
+
+              @endpoint = validate_param(
+                :endpoint, opts, FORMAT_HINT, required: false
+              )
+            end
+          end
+
+          # Convert credentials object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] Azure KMS credentials in libmongocrypt format.
+          def to_document
+            return BSON::Document.new if empty?
+            if access_token
+              BSON::Document.new({ accessToken: access_token })
+            else
+              BSON::Document.new({
+                email: email,
+                privateKey: BSON::Binary.new(private_key, :generic),
+              }).tap do |bson|
+                unless endpoint.nil?
+                  bson.update({ endpoint: endpoint })
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/crypt/kms/gcp/credentials_retriever.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module GCP
+        # This class retrieves GPC credentials using Google Compute Engine
+        # metadata host. This should be used when the driver is used on the
+        # Google Compute Engine instance.
+        #
+        # @api private
+        class CredentialsRetriever
+          METADATA_HOST_ENV = 'GCE_METADATA_HOST'
+
+          DEFAULT_HOST = 'metadata.google.internal'
+
+          def self.fetch_access_token
+            host = ENV.fetch(METADATA_HOST_ENV) { DEFAULT_HOST }
+            uri = URI("http://#{host}/computeMetadata/v1/instance/service-accounts/default/token")
+            req = Net::HTTP::Get.new(uri)
+            req['Metadata-Flavor'] = 'Google'
+            resp = Net::HTTP.start(uri.hostname, uri.port, use_ssl: false) do |http|
+              http.request(req)
+            end
+            if resp.code != '200'
+              raise KMS::CredentialsNotFound,
+                "GCE metadata host responded with code #{resp.code}"
+            end
+            parsed_resp = JSON.parse(resp.body)
+            parsed_resp.fetch('access_token')
+          rescue JSON::ParserError, KeyError => e
+            raise KMS::CredentialsNotFound,
+              "GCE metadata response is invalid: '#{resp.body}'; #{e.class}: #{e.message}"
+            rescue ::Timeout::Error, IOError, SystemCallError, SocketError => e
+              raise KMS::CredentialsNotFound,
+                    "Could not receive GCP metadata response; #{e.class}: #{e.message}"
+          end
+        end
+      end
+    end
+  end
+end
+

data/lib/mongo/crypt/kms/gcp/master_document.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module GCP
+        # GCP KMS master key document object contains KMS master key parameters.
+        #
+        # @api private
+        class MasterKeyDocument
+          include KMS::Validations
+
+          # @return [ String ] GCP project id.
+          attr_reader :project_id
+
+          # @return [ String ] GCP location.
+          attr_reader :location
+
+          # @return [ String ] GCP KMS key ring.
+          attr_reader :key_ring
+
+          # @return [ String ] GCP KMS key name.
+          attr_reader :key_name
+
+          # @return [ String | nil ] GCP KMS key version.
+          attr_reader :key_version
+
+          # @return [ String | nil ] GCP KMS endpoint.
+          attr_reader :endpoint
+
+          FORMAT_HINT = "GCP key document  must be in the format: " +
+            "{ project_id: 'PROJECT_ID', location: 'LOCATION', " +
+            "key_ring: 'KEY-RING', key_name: 'KEY-NAME' }"
+
+          # Creates a master key document object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains master key options for
+          #   the GCP KMS provider.
+          # @option opts [ String ] :project_id GCP  project id.
+          # @option opts [ String ] :location GCP location.
+          # @option opts [ String ] :key_ring GCP KMS key ring.
+          # @option opts [ String ] :key_name GCP KMS key name.
+          # @option opts [ String | nil ] :key_version GCP KMS key version, optional.
+          # @option opts [ String | nil ] :endpoint GCP KMS key endpoint, optional.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly.
+          def initialize(opts)
+            if opts.empty?
+              @empty = true
+              return
+            end
+            @project_id = validate_param(:project_id, opts, FORMAT_HINT)
+            @location = validate_param(:location, opts, FORMAT_HINT)
+            @key_ring = validate_param(:key_ring, opts, FORMAT_HINT)
+            @key_name = validate_param(:key_name, opts, FORMAT_HINT)
+            @key_version = validate_param(:key_version, opts, FORMAT_HINT, required: false)
+            @endpoint = validate_param(:endpoint, opts, FORMAT_HINT, required: false)
+          end
+
+          # Convert master key document object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] GCP KMS credentials in libmongocrypt format.
+          def to_document
+            return BSON::Document.new({}) if @empty
+            BSON::Document.new({
+              provider: 'gcp',
+              projectId: project_id,
+              location: location,
+              keyRing: key_ring,
+              keyName: key_name
+            }).tap do |bson|
+              unless key_version.nil?
+                bson.update({ keyVersion: key_version })
+              end
+              unless endpoint.nil?
+                bson.update({ endpoint: endpoint })
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/crypt/kms/gcp.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -15,175 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-module Mongo
-  module Crypt
-    module KMS
-      module GCP
-        # GCP Cloud Key Management Credentials object contains credentials for
-        # using GCP KMS provider.
-        #
-        # @api private
-        class Credentials
-          extend Forwardable
-          include KMS::Validations
+require 'mongo/crypt/kms/gcp/credentials'
+require 'mongo/crypt/kms/gcp/credentials_retriever'
+require 'mongo/crypt/kms/gcp/master_document'
 
-          # @return [ String ] GCP email to authenticate with.
-          attr_reader :email
-
-          # @return [ String ] GCP private key, base64 encoded DER format.
-          attr_reader :private_key
-
-          # @return [ String | nil ] GCP KMS endpoint.
-          attr_reader :endpoint
-
-          # @api private
-          def_delegator :@opts, :empty?
-
-          FORMAT_HINT = "GCP KMS provider options must be in the format: " +
-              "{ email: 'EMAIL', private_key: 'PRIVATE-KEY' }"
-
-          # Creates an GCP KMS credentials object form a parameters hash.
-          #
-          # @param [ Hash ] opts A hash that contains credentials for
-          #   GCP KMS provider
-          # @option opts [ String ] :email GCP email.
-          # @option opts [ String ] :private_key GCP private key. This method accepts
-          #   private key in either base64 encoded DER format, or PEM format.
-          # @option opts [ String | nil ] :endpoint GCP endpoint, optional.
-          #
-          # @raise [ ArgumentError ] If required options are missing or incorrectly
-          #   formatted.
-          def initialize(opts)
-            @opts = opts
-            return if empty?
-
-            @email = validate_param(:email, opts, FORMAT_HINT)
-            @private_key = begin
-              private_key_opt = validate_param(:private_key, opts, FORMAT_HINT)
-              if BSON::Environment.jruby?
-                # We cannot really validate private key on JRuby, so we assume
-                # it is in base64 encoded DER format.
-                private_key_opt
-              else
-                # Check if private key is in PEM format.
-                pkey = OpenSSL::PKey::RSA.new(private_key_opt)
-                # PEM it is, need to be converted to base64 encoded DER.
-                der = if pkey.respond_to?(:private_to_der)
-                  pkey.private_to_der
-                else
-                  pkey.to_der
-                end
-                Base64.encode64(der)
-              end
-            rescue OpenSSL::PKey::RSAError
-              # Check if private key is in DER.
-              begin
-                OpenSSL::PKey.read(Base64.decode64(private_key_opt))
-                # Private key is fine, use it.
-                private_key_opt
-              rescue OpenSSL::PKey::PKeyError
-                raise ArgumentError.new(
-                  "The private_key option must be either either base64 encoded DER format, or PEM format."
-                )
-              end
-            end
-
-            @endpoint = validate_param(
-              :endpoint, opts, FORMAT_HINT, required: false
-            )
-          end
-
-          # Convert credentials object to a BSON document in libmongocrypt format.
-          #
-          # @return [ BSON::Document ] Azure KMS credentials in libmongocrypt format.
-          def to_document
-            return BSON::Document.new if empty?
-            BSON::Document.new({
-              email: email,
-              privateKey: BSON::Binary.new(private_key, :generic),
-            }).tap do |bson|
-              unless endpoint.nil?
-                bson.update({ endpoint: endpoint })
-              end
-            end
-          end
-        end
-
-        # GCP KMS master key document object contains KMS master key parameters.
-        #
-        # @api private
-        class MasterKeyDocument
-          include KMS::Validations
-
-          # @return [ String ] GCP project id.
-          attr_reader :project_id
-
-          # @return [ String ] GCP location.
-          attr_reader :location
-
-          # @return [ String ] GCP KMS key ring.
-          attr_reader :key_ring
-
-          # @return [ String ] GCP KMS key name.
-          attr_reader :key_name
-
-          # @return [ String | nil ] GCP KMS key version.
-          attr_reader :key_version
-
-          # @return [ String | nil ] GCP KMS endpoint.
-          attr_reader :endpoint
-
-          FORMAT_HINT = "GCP key document  must be in the format: " +
-                        "{ project_id: 'PROJECT_ID', location: 'LOCATION', " +
-                        "key_ring: 'KEY-RING', key_name: 'KEY-NAME' }"
-
-        # Creates a master key document object form a parameters hash.
-        #
-        # @param [ Hash ] opts A hash that contains master key options for
-        #   the GCP KMS provider.
-        # @option opts [ String ] :project_id GCP  project id.
-        # @option opts [ String ] :location GCP location.
-        # @option opts [ String ] :key_ring GCP KMS key ring.
-        # @option opts [ String ] :key_name GCP KMS key name.
-        # @option opts [ String | nil ] :key_version GCP KMS key version, optional.
-        # @option opts [ String | nil ] :endpoint GCP KMS key endpoint, optional.
-        #
-        # @raise [ ArgumentError ] If required options are missing or incorrectly.
-          def initialize(opts)
-            if opts.empty?
-              @empty = true
-              return
-            end
-            @project_id = validate_param(:project_id, opts, FORMAT_HINT)
-            @location = validate_param(:location, opts, FORMAT_HINT)
-            @key_ring = validate_param(:key_ring, opts, FORMAT_HINT)
-            @key_name = validate_param(:key_name, opts, FORMAT_HINT)
-            @key_version = validate_param(:key_version, opts, FORMAT_HINT, required: false)
-            @endpoint = validate_param(:endpoint, opts, FORMAT_HINT, required: false)
-          end
-
-          # Convert master key document object to a BSON document in libmongocrypt format.
-          #
-          # @return [ BSON::Document ] GCP KMS credentials in libmongocrypt format.
-          def to_document
-            return BSON::Document.new({}) if @empty
-            BSON::Document.new({
-              provider: 'gcp',
-              projectId: project_id,
-              location: location,
-              keyRing: key_ring,
-              keyName: key_name
-            }).tap do |bson|
-              unless key_version.nil?
-                bson.update({ keyVersion: key_version })
-              end
-              unless endpoint.nil?
-                bson.update({ endpoint: endpoint })
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/mongo/crypt/kms/kmip/credentials.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module KMIP
+        # KMIP KMS Credentials object contains credentials for a
+        # remote KMIP KMS provider.
+        #
+        # @api private
+        class Credentials
+          extend Forwardable
+          include KMS::Validations
+
+          # @return [ String ] KMIP KMS endpoint with optional port.
+          attr_reader :endpoint
+
+          # @api private
+          def_delegator :@opts, :empty?
+
+          FORMAT_HINT = "KMIP KMS provider options must be in the format: " +
+                        "{ endpoint: 'ENDPOINT' }"
+
+          # Creates a KMIP KMS credentials object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains credentials for
+          #   KMIP KMS provider.
+          # @option opts [ String ] :endpoint KMIP endpoint.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly
+          #   formatted.
+          def initialize(opts)
+            @opts = opts
+            unless empty?
+              @endpoint = validate_param(:endpoint, opts, FORMAT_HINT)
+            end
+          end
+
+          # Convert credentials object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] Local KMS credentials in libmongocrypt format.
+          def to_document
+            return BSON::Document.new({}) if empty?
+            BSON::Document.new({
+              endpoint: endpoint,
+            })
+          end
+        end
+      end
+    end
+  end
+end
+

data/lib/mongo/crypt/kms/kmip/master_document.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module KMIP
+        # KMIP KMS master key document object contains KMS master key parameters.
+        #
+        # @api private
+        class MasterKeyDocument
+          include KMS::Validations
+
+          # @return [ String | nil ] The KMIP Unique Identifier to a 96 byte
+          #   KMIP Secret Data managed object.
+          attr_reader :key_id
+
+          # @return [ String | nil ] KMIP KMS endpoint with optional port.
+          attr_reader :endpoint
+
+          FORMAT_HINT = "KMIP KMS key document must be in the format: " +
+                        "{ key_id: 'KEY-ID', endpoint: 'ENDPOINT' }"
+
+          # Creates a master key document object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains master key options for
+          #   KMIP KMS provider
+          # @option opts [ String | nil ] :key_id KMIP Unique Identifier to
+          #   a 96 byte KMIP Secret Data managed object, optional. If key_id
+          #   is omitted, the driver creates a random 96 byte identifier.
+          # @option opts [ String | nil ] :endpoint KMIP endpoint, optional.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly
+          #   formatted.
+          def initialize(opts = {})
+            @key_id = validate_param(
+              :key_id, opts, FORMAT_HINT, required: false
+            )
+            @endpoint = validate_param(
+              :endpoint, opts, FORMAT_HINT, required: false
+            )
+          end
+
+          # Convert master key document object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] KMIP KMS credentials in libmongocrypt format.
+          def to_document
+            BSON::Document.new({
+              provider: 'kmip',
+            }).tap do |bson|
+              bson.update({ endpoint: endpoint }) unless endpoint.nil?
+              bson.update({ keyId: key_id }) unless key_id.nil?
+            end
+          end
+        end
+      end
+    end
+  end
+end
+