mongo 2.18.2 → 2.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44bd3e615b9e0e11f3803eae60a44b56fe5be326b7dd8f78b3c5aa42fbf7e621
-  data.tar.gz: 124bfd17f02e5b929e8b40dc797146770096270a83f7ea2389890efe83af1fbe
+  metadata.gz: 624436394458300bf64df3d0b424b75ea03746b8f1a53987c18be7e33f5d4f74
+  data.tar.gz: da54416a85f4a3e6318ec6833ae14997a864a5d490c8e0fe451aa2c0acd4fe71
 SHA512:
-  metadata.gz: 675df13e076a6a8b94e187e493cefb8fe4e1697cafdb4241898519f55b5abf3cceff7db1e9424bc2defdcba5a218e1bd8b149572ab891319c7c8a42f9699706a
-  data.tar.gz: 7593ef22c16038dc53e7e4e04c615dbc39c083bdffb6ef7d99f583d64613909079c7edb2b5e367117e0b3dca19a0a57ba3eb0ac92701bde48d750557a17cf567
+  metadata.gz: a4c15fae18c57a1c33f45cde07bf325f7d2c45f2fafdf99d521900d0277feb395f0947d422939eda0572d7f0a17819a94ba1e906b1939d83e1aaefc4b662b2a0
+  data.tar.gz: e0cc5f507b02f8e787c1793b8cb708cd17090505e6ac239db7ed02cd54367d9a0079a6f64f23bf2d661820c6bbbc2df82467a15b90e884a8d9bee88a84065abb

data/README.md

@@ -10,7 +10,7 @@ The Ruby driver supports Ruby 2.5-3.0 and JRuby 9.2.
 ## Documentation
 
 High level documentation and usage examples are located
-[here](http://docs.mongodb.org/ecosystem/drivers/ruby/).
+[here](https://www.mongodb.com/docs/ecosystem/drivers/ruby/).
 
 API documentation for the most recent release can be found
 [here](https://mongodb.com/docs/ruby-driver/current/api/).
@@ -58,7 +58,7 @@ is publicly visible.
 
 If you have identified a potential security-related issue in the Ruby driver
 (or any other MongoDB product), please report it by following the
-[instructions here](http://docs.mongodb.org/manual/tutorial/create-a-vulnerability-report).
+[instructions here](https://www.mongodb.com/docs/manual/tutorial/create-a-vulnerability-report).
 
 ## Product Feature Requests
 
@@ -67,6 +67,16 @@ affects more than the driver alone (for example, a feature which requires
 MongoDB server support), please submit your idea through the
 [MongoDB Feedback Forum](https://feedback.mongodb.com/forums/924286-drivers).
 
+## Maintenance and Bug Fix Policy
+
+New driver functionality is generally added in a backwards-compatible manner
+and results in new minor driver releases (2.x). Bug fixes are generally made on
+master first and are backported to the current minor driver release. Exceptions
+may be made on a case-by-case basis, for example security fixes may be
+backported to older stable branches. Only the most recent minor driver release
+is officially supported. Customers should use the most recent driver release in
+their applications.
+
 ## Running Tests
 
 Please refer to [spec/README.md](spec/README.md) for instructions on how

data/Rakefile

@@ -1,4 +1,5 @@
-# -*- mode: ruby -*-
+# frozen_string_literal: true
+# rubocop:todo all
 
 require 'bundler'
 require 'bundler/gem_tasks'
@@ -61,13 +62,13 @@ namespace :spec do
 
     client = ClientRegistry.instance.global_client('authorized')
     client.database.command(ping: 1)
-    deadline = Time.now + 300
+    deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 300
     loop do
       begin
         client.cluster.validate_session_support!
         break
       rescue Mongo::Error::SessionsNotSupported
-        if Time.now >= deadline
+        if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
           raise "Sessions did not become supported in 300 seconds"
         end
         client.cluster.scan!

data/bin/mongo_console

@@ -1,4 +1,6 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
+# rubocop:todo all
 
 $LOAD_PATH[0, 0] = File.join(File.dirname(__FILE__), '..', 'lib')
 

data/lib/mongo/active_support.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2019-2020 MongoDB Inc.
 #

data/lib/mongo/address/ipv4.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/address/ipv6.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/address/unix.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/address/validator.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2017-2020 MongoDB Inc.
 #

data/lib/mongo/address.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/aws/conversation.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -65,10 +65,6 @@ module Mongo
         # @return [ Integer ] The conversation id.
         attr_reader :conversation_id
 
-        def client_first_payload
-          {payload: client_first_message}
-        end
-
         def client_first_data
           {
             r: BSON::Binary.new(client_nonce),

data/lib/mongo/auth/aws/credentials.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2023-present MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws
+      # The AWS credential set.
+      #
+      # @api private
+      Credentials = Struct.new(:access_key_id, :secret_access_key, :session_token, :expiration) do
+        # @return [ true | false ] Whether the credentials have expired.
+        def expired?
+          if expiration.nil?
+            false
+          else
+            # According to the spec, Credentials are considered
+            # valid if they are more than five minutes away from expiring.
+            Time.now.utc >= expiration - 300
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/aws/credentials_cache.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2023-present MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws
+      # Thread safe cache to store AWS credentials.
+      #
+      # @api private
+      class CredentialsCache
+        # Get or create the singleton instance of the cache.
+        #
+        # @return [ CredentialsCache ] The singleton instance.
+        def self.instance
+          @instance ||= new
+        end
+
+        def initialize
+          @lock = Mutex.new
+          @credentials = nil
+        end
+
+        # Set the credentials in the cache.
+        #
+        # @param [ Aws::Credentials ] credentials The credentials to cache.
+        def credentials=(credentials)
+          @lock.synchronize do
+            @credentials = credentials
+          end
+        end
+
+        # Get the credentials from the cache.
+        #
+        # @return [ Aws::Credentials ] The cached credentials.
+        def credentials
+          @lock.synchronize do
+            @credentials
+          end
+        end
+
+        # Fetch the credentials from the cache or yield to get them
+        # if they are not in the cache or have expired.
+        #
+        # @return [ Aws::Credentials ] The cached credentials.
+        def fetch
+          @lock.synchronize do
+            @credentials = yield if @credentials.nil? || @credentials.expired?
+            @credentials
+          end
+        end
+
+        # Clear the credentials from the cache.
+        def clear
+          @lock.synchronize do
+            @credentials = nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/aws/credentials_retriever.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -18,6 +18,14 @@
 module Mongo
   module Auth
     class Aws
+      # Raised when trying to authorize with an invalid configuration
+      #
+      # @api private
+      class CredentialsNotFound < Mongo::Error::AuthError
+        def initialize
+          super("Could not locate AWS credentials (checked Client URI and Ruby options, environment variables, ECS and EC2 metadata, and Web Identity)")
+        end
+      end
 
       # Retrieves AWS credentials from a variety of sources.
       #
@@ -27,6 +35,7 @@ module Mongo
       # - AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
       #   environment variables (commonly used by AWS SDKs and various tools,
       #   as well as AWS Lambda)
+      # - AssumeRoleWithWebIdentity API call
       # - EC2 metadata endpoint
       # - ECS metadata endpoint
       #
@@ -41,15 +50,17 @@ module Mongo
       #
       # @api private
       class CredentialsRetriever
-
         # Timeout for metadata operations, in seconds.
         #
         # The auth spec suggests a 10 second timeout but this seems
         # excessively long given that the endpoint is essentially local.
         METADATA_TIMEOUT = 5
 
-        def initialize(user = nil)
+        # @param [ Auth::User | nil ] user The user object, if one was provided.
+        # @param [ Auth::Aws::CredentialsCache ] credentials_cache The credentials cache.
+        def initialize(user = nil, credentials_cache: CredentialsCache.instance)
           @user = user
+          @credentials_cache = credentials_cache
         end
 
         # @return [ Auth::User | nil ] The user object, if one was provided.
@@ -60,49 +71,76 @@ module Mongo
         #
         # @return [ Auth::Aws::Credentials ] A valid set of credentials.
         #
-        # @raise Auth::InvalidConfiguration if credentials could not be
-        #   retrieved for any reason, or if a source contains an invalid set
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
         #   of credentials.
+        # @raise Auth::Aws::CredentialsNotFound if credentials could not be
+        #   retrieved from any source.
         def credentials
-          if user
-            credentials = Credentials.new(
-              user.name,
-              user.password,
-              user.auth_mech_properties['aws_session_token'],
-            )
-
-            if credentials_valid?(credentials, 'Mongo::Client URI or Ruby options')
-              return credentials
-            end
-          end
+          credentials = credentials_from_user(user)
+          return credentials unless credentials.nil?
 
-          credentials = Credentials.new(
-            ENV['AWS_ACCESS_KEY_ID'],
-            ENV['AWS_SECRET_ACCESS_KEY'],
-            ENV['AWS_SESSION_TOKEN'],
-          )
+          credentials = credentials_from_environment
+          return credentials unless credentials.nil?
 
-          if credentials_valid?(credentials, 'environment variables')
-            return credentials
-          end
+          credentials = @credentials_cache.fetch { obtain_credentials_from_endpoints }
+          return credentials unless credentials.nil?
 
-          credentials = ecs_metadata_credentials
+          raise Auth::Aws::CredentialsNotFound
+        end
 
-          if credentials && credentials_valid?(credentials, 'ECS task metadata')
-            return credentials
-          end
+        private
 
-          credentials = ec2_metadata_credentials
+        # Returns credentials from the user object.
+        #
+        # @param [ Auth::User | nil ] user The user object, if one was provided.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
+        #   of credentials.
+        def credentials_from_user(user)
+          return nil unless user
 
-          if credentials && credentials_valid?(credentials, 'EC2 instance metadata')
-            return credentials
-          end
+          credentials = Credentials.new(
+            user.name,
+            user.password,
+            user.auth_mech_properties['aws_session_token']
+          )
+          return credentials if credentials_valid?(credentials, 'Mongo::Client URI or Ruby options')
+        end
 
-          raise Auth::InvalidConfiguration,
-            "Could not locate AWS credentials (checked Client URI and Ruby options, environment variables, ECS and EC2 metadata)"
+        # Returns credentials from environment variables.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed or the obtained credentials are invalid.
+        #
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
+        #   of credentials.
+        def credentials_from_environment
+          credentials = Credentials.new(
+            ENV['AWS_ACCESS_KEY_ID'],
+            ENV['AWS_SECRET_ACCESS_KEY'],
+            ENV['AWS_SESSION_TOKEN']
+          )
+          credentials if credentials && credentials_valid?(credentials, 'environment variables')
         end
 
-        private
+        # Returns credentials from the AWS metadata endpoints.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed or the obtained credentials are invalid.
+        #
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
+        #   of credentials.
+        def obtain_credentials_from_endpoints
+          if (credentials = web_identity_credentials) && credentials_valid?(credentials, 'Web identity token')
+            credentials
+          elsif (credentials = ecs_metadata_credentials) && credentials_valid?(credentials, 'ECS task metadata')
+            credentials
+          elsif (credentials = ec2_metadata_credentials) && credentials_valid?(credentials, 'EC2 instance metadata')
+            credentials
+          end
+        end
 
         # Returns credentials from the EC2 metadata endpoint. The credentials
         # could be empty, partial or invalid.
@@ -143,10 +181,11 @@ module Mongo
             payload['AccessKeyId'],
             payload['SecretAccessKey'],
             payload['Token'],
+            DateTime.parse(payload['Expiration']).to_time
           )
         # When trying to use the EC2 metadata endpoint on ECS:
         # Errno::EINVAL: Failed to open TCP connection to 169.254.169.254:80 (Invalid argument - connect(2) for "169.254.169.254" port 80)
-        rescue ::Timeout::Error, IOError, SystemCallError
+        rescue ::Timeout::Error, IOError, SystemCallError, TypeError
           return nil
         end
 
@@ -175,11 +214,107 @@ module Mongo
             payload['AccessKeyId'],
             payload['SecretAccessKey'],
             payload['Token'],
+            DateTime.parse(payload['Expiration']).to_time
           )
-        rescue ::Timeout::Error, IOError, SystemCallError
+        rescue ::Timeout::Error, IOError, SystemCallError, TypeError
           return nil
         end
 
+        # Returns credentials associated with web identity token that is
+        # stored in a file. This authentication mechanism is used to authenticate
+        # inside EKS. See https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
+        # for further details.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed.
+        def web_identity_credentials
+          web_identity_token, role_arn, role_session_name = prepare_web_identity_inputs
+          return nil if web_identity_token.nil?
+          response = request_web_identity_credentials(
+            web_identity_token, role_arn, role_session_name
+          )
+          return if response.nil?
+          credentials_from_web_identity_response(response)
+        end
+
+        # Returns inputs for the AssumeRoleWithWebIdentity AWS API call.
+        #
+        # @return [ Array<String | nil, String | nil, String | nil> ] Web
+        #   identity token, role arn, and role session name.
+        def prepare_web_identity_inputs
+          token_file = ENV['AWS_WEB_IDENTITY_TOKEN_FILE']
+          role_arn = ENV['AWS_ROLE_ARN']
+          if token_file.nil? || role_arn.nil?
+            return nil
+          end
+          web_identity_token = File.open(token_file).read
+          role_session_name = ENV['AWS_ROLE_SESSION_NAME']
+          if role_session_name.nil?
+            role_session_name = "ruby-app-#{SecureRandom.alphanumeric(50)}"
+          end
+          [web_identity_token, role_arn, role_session_name]
+        rescue Errno::ENOENT, IOError, SystemCallError
+          nil
+        end
+
+        # Calls AssumeRoleWithWebIdentity to obtain credentials for the
+        # given web identity token.
+        #
+        # @param [ String ] token The OAuth 2.0 access token or
+        #   OpenID Connect ID token that is provided by the identity provider.
+        # @param [ String ] role_arn The Amazon Resource Name (ARN) of the role
+        #   that the caller is assuming.
+        # @param [ String ] role_session_name An identifier for the assumed
+        #   role session.
+        #
+        # @return [ Net::HTTPResponse | nil ] AWS API response if successful,
+        #   otherwise nil.
+        def request_web_identity_credentials(token, role_arn, role_session_name)
+          uri = URI('https://sts.amazonaws.com/')
+          params = {
+            'Action' => 'AssumeRoleWithWebIdentity',
+            'Version' => '2011-06-15',
+            'RoleArn' => role_arn,
+            'WebIdentityToken' => token,
+            'RoleSessionName' => role_session_name
+          }
+          uri.query = ::URI.encode_www_form(params)
+          req = Net::HTTP::Post.new(uri)
+          req['Accept'] = 'application/json'
+          resp = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |https|
+            https.request(req)
+          end
+          if resp.code != '200'
+            return nil
+          end
+          resp
+        rescue Errno::ENOENT, IOError, SystemCallError
+          nil
+        end
+
+        # Extracts credentials from AssumeRoleWithWebIdentity response.
+        #
+        # @param [ Net::HTTPResponse ] response AssumeRoleWithWebIdentity
+        #   call response.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if response parsing failed.
+        def credentials_from_web_identity_response(response)
+          payload = JSON.parse(response.body).dig(
+            'AssumeRoleWithWebIdentityResponse',
+            'AssumeRoleWithWebIdentityResult',
+            'Credentials'
+          ) || {}
+          Credentials.new(
+            payload['AccessKeyId'],
+            payload['SecretAccessKey'],
+            payload['SessionToken'],
+            Time.at(payload['Expiration'])
+          )
+        rescue JSON::ParserError, TypeError
+          nil
+        end
+
         def http_get(http, uri, metadata_token)
           req = Net::HTTP::Get.new(uri,
             {'x-aws-ec2-metadata-token' => metadata_token})

data/lib/mongo/auth/aws/request.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -215,7 +215,6 @@ module Mongo
         # @return [ String ] The signature.
         def signature
           hashed_canonical_request = Digest::SHA256.hexdigest(canonical_request)
-          hashed_body = Digest::SHA256.new.update(STS_REQUEST_BODY).hexdigest
           string_to_sign = "AWS4-HMAC-SHA256\n" +
             "#{formatted_time}\n" +
             "#{scope}\n" +

data/lib/mongo/auth/aws.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -25,16 +25,16 @@ module Mongo
       # @return [ BSON::Document ] The document of the authentication response.
       def login
         converse_2_step(connection, conversation)
+      rescue StandardError
+        CredentialsCache.instance.clear
+        raise
       end
-
-      # The AWS credential set.
-      #
-      # @api private
-      Credentials = Struct.new(:access_key_id, :secret_access_key, :session_token)
     end
   end
 end
 
 require 'mongo/auth/aws/conversation'
+require 'mongo/auth/aws/credentials'
+require 'mongo/auth/aws/credentials_cache'
 require 'mongo/auth/aws/credentials_retriever'
 require 'mongo/auth/aws/request'

data/lib/mongo/auth/base.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/conversation_base.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #

data/lib/mongo/auth/cr/conversation.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/cr.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/credential_cache.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2019-2020 MongoDB Inc.
 #

data/lib/mongo/auth/gssapi/conversation.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2015-2020 MongoDB Inc.
 #

data/lib/mongo/auth/gssapi.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB, Inc.
 #

data/lib/mongo/auth/ldap/conversation.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/ldap.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #