mongo 2.18.2 → 2.19.3

data/lib/mongo/crypt/kms/aws/credentials.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module AWS
+
+        # AWS KMS Credentials object contains credentials for using AWS KMS provider.
+        #
+        # @api private
+        class Credentials
+          extend Forwardable
+          include KMS::Validations
+
+          # @return [ String ] AWS access key.
+          attr_reader :access_key_id
+
+          # @return [ String ] AWS secret access key.
+          attr_reader :secret_access_key
+
+          # @return [ String | nil ] AWS session token.
+          attr_reader :session_token
+
+          # @api private
+          def_delegator :@opts, :empty?
+
+          FORMAT_HINT = "AWS KMS provider options must be in the format: " +
+            "{ access_key_id: 'YOUR-ACCESS-KEY-ID', secret_access_key: 'SECRET-ACCESS-KEY' }"
+
+          # Creates an AWS KMS credentials object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains credentials for
+          #   AWS KMS provider
+          # @option opts [ String ] :access_key_id AWS access key id.
+          # @option opts [ String ] :secret_access_key AWS secret access key.
+          # @option opts [ String | nil ] :session_token AWS session token, optional.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly
+          #   formatted.
+          def initialize(opts)
+            @opts = opts
+            unless empty?
+              @access_key_id = validate_param(:access_key_id, opts, FORMAT_HINT)
+              @secret_access_key = validate_param(:secret_access_key, opts, FORMAT_HINT)
+              @session_token = validate_param(:session_token, opts, FORMAT_HINT, required: false)
+            end
+          end
+
+          # Convert credentials object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] AWS KMS credentials in libmongocrypt format.
+          def to_document
+            return BSON::Document.new if empty?
+            BSON::Document.new({
+              accessKeyId: access_key_id,
+              secretAccessKey: secret_access_key,
+            }).tap do |bson|
+              unless session_token.nil?
+                bson.update({ sessionToken: session_token })
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end
+

data/lib/mongo/crypt/kms/aws/master_document.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module AWS
+        # AWS KMS master key document object contains KMS master key parameters.
+        #
+        # @api private
+        class MasterKeyDocument
+          include KMS::Validations
+
+          # @return [ String ] AWS region.
+          attr_reader :region
+
+          # @return [ String ] AWS KMS key.
+          attr_reader :key
+
+          # @return [ String | nil ] AWS KMS endpoint.
+          attr_reader :endpoint
+
+          FORMAT_HINT = "AWS key document  must be in the format: " +
+                        "{ region: 'REGION', key: 'KEY' }"
+
+          # Creates a master key document object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains master key options for
+          #   the AWS KMS provider.
+          # @option opts [ String ] :region AWS region.
+          # @option opts [ String ] :key AWS KMS key.
+          # @option opts [ String | nil ] :endpoint AWS KMS endpoint, optional.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly.
+          def initialize(opts)
+            unless opts.is_a?(Hash)
+              raise ArgumentError.new(
+                'Key document options must contain a key named :master_key with a Hash value'
+              )
+            end
+            @region = validate_param(:region, opts, FORMAT_HINT)
+            @key = validate_param(:key, opts, FORMAT_HINT)
+            @endpoint = validate_param(:endpoint, opts, FORMAT_HINT, required: false)
+          end
+
+          # Convert master key document object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] AWS KMS master key document in libmongocrypt format.
+          def to_document
+            BSON::Document.new({
+              provider: 'aws',
+              region: region,
+              key: key,
+            }).tap do |bson|
+              unless endpoint.nil?
+                bson.update({ endpoint: endpoint })
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/crypt/kms/aws.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -15,122 +15,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-module Mongo
-  module Crypt
-    module KMS
-      module AWS
+require 'mongo/crypt/kms/aws/credentials'
+require 'mongo/crypt/kms/aws/master_document'
 
-        # AWS KMS Credentials object contains credentials for using AWS KMS provider.
-        #
-        # @api private
-        class Credentials
-          extend Forwardable
-          include KMS::Validations
-
-          # @return [ String ] AWS access key.
-          attr_reader :access_key_id
-
-          # @return [ String ] AWS secret access key.
-          attr_reader :secret_access_key
-
-          # @return [ String | nil ] AWS session token.
-          attr_reader :session_token
-
-          # @api private
-          def_delegator :@opts, :empty?
-
-          FORMAT_HINT = "AWS KMS provider options must be in the format: " +
-                        "{ access_key_id: 'YOUR-ACCESS-KEY-ID', secret_access_key: 'SECRET-ACCESS-KEY' }"
-
-          # Creates an AWS KMS credentials object form a parameters hash.
-          #
-          # @param [ Hash ] opts A hash that contains credentials for
-          #   AWS KMS provider
-          # @option opts [ String ] :access_key_id AWS access key id.
-          # @option opts [ String ] :secret_access_key AWS secret access key.
-          # @option opts [ String | nil ] :session_token AWS session token, optional.
-          #
-          # @raise [ ArgumentError ] If required options are missing or incorrectly
-          #   formatted.
-          def initialize(opts)
-            @opts = opts
-            unless empty?
-              @access_key_id = validate_param(:access_key_id, opts, FORMAT_HINT)
-              @secret_access_key = validate_param(:secret_access_key, opts, FORMAT_HINT)
-              @session_token = validate_param(:session_token, opts, FORMAT_HINT, required: false)
-            end
-          end
-
-          # Convert credentials object to a BSON document in libmongocrypt format.
-          #
-          # @return [ BSON::Document ] AWS KMS credentials in libmongocrypt format.
-          def to_document
-            return BSON::Document.new if empty?
-            BSON::Document.new({
-              accessKeyId: access_key_id,
-              secretAccessKey: secret_access_key,
-            }).tap do |bson|
-              unless session_token.nil?
-                bson.update({ sessionToken: session_token })
-              end
-            end
-          end
-        end
-
-        # AWS KMS master key document object contains KMS master key parameters.
-        #
-        # @api private
-        class MasterKeyDocument
-          include KMS::Validations
-
-          # @return [ String ] AWS region.
-          attr_reader :region
-
-          # @return [ String ] AWS KMS key.
-          attr_reader :key
-
-          # @return [ String | nil ] AWS KMS endpoint.
-          attr_reader :endpoint
-
-          FORMAT_HINT = "AWS key document  must be in the format: " +
-                        "{ region: 'REGION', key: 'KEY' }"
-
-          # Creates a master key document object form a parameters hash.
-          #
-          # @param [ Hash ] opts A hash that contains master key options for
-          #   the AWS KMS provider.
-          # @option opts [ String ] :region AWS region.
-          # @option opts [ String ] :key AWS KMS key.
-          # @option opts [ String | nil ] :endpoint AWS KMS endpoint, optional.
-          #
-          # @raise [ ArgumentError ] If required options are missing or incorrectly.
-          def initialize(opts)
-            unless opts.is_a?(Hash)
-              raise ArgumentError.new(
-                'Key document options must contain a key named :master_key with a Hash value'
-              )
-            end
-            @region = validate_param(:region, opts, FORMAT_HINT)
-            @key = validate_param(:key, opts, FORMAT_HINT)
-            @endpoint = validate_param(:endpoint, opts, FORMAT_HINT, required: false)
-          end
-
-          # Convert master key document object to a BSON document in libmongocrypt format.
-          #
-          # @return [ BSON::Document ] AWS KMS master key document in libmongocrypt format.
-          def to_document
-            BSON::Document.new({
-              provider: 'aws',
-              region: region,
-              key: key,
-            }).tap do |bson|
-              unless endpoint.nil?
-                bson.update({ endpoint: endpoint })
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/mongo/crypt/kms/azure/access_token.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module Azure
+        # Azure access token for temporary credentials.
+        #
+        # @api private
+        class AccessToken
+          # @return [ String ] Azure access token.
+          attr_reader :access_token
+
+          # @return [ Integer ] Azure access token expiration time.
+          attr_reader :expires_in
+
+          # Creates an Azure access token object.
+          #
+          # @param [ String ] access_token Azure access token.
+          # @param [ Integer ] expires_in Azure access token expiration time.
+          def initialize(access_token, expires_in)
+            @access_token = access_token
+            @expires_in = expires_in
+            @expires_at = Time.now.to_i + @expires_in
+          end
+
+          # Checks if the access token is expired.
+          #
+          # The access token is considered expired if it is within 60 seconds
+          # of its expiration time.
+          #
+          # @return [ true | false ] Whether the access token is expired.
+          def expired?
+            Time.now.to_i >= @expires_at - 60
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/crypt/kms/azure/credentials.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module Azure
+        # Azure KMS Credentials object contains credentials for using Azure KMS provider.
+        #
+        # @api private
+        class Credentials
+          extend Forwardable
+          include KMS::Validations
+
+          # @return [ String ] Azure tenant id.
+          attr_reader :tenant_id
+
+          # @return [ String ] Azure client id.
+          attr_reader :client_id
+
+          # @return [ String ] Azure client secret.
+          attr_reader :client_secret
+
+          # @return [ String | nil ] Azure identity platform endpoint.
+          attr_reader :identity_platform_endpoint
+
+          # @return [ String | nil ] Azure access token.
+          attr_reader :access_token
+
+          # @api private
+          def_delegator :@opts, :empty?
+
+          FORMAT_HINT = 'Azure KMS provider options must be in the format: \
+            { tenant_id: "TENANT-ID", client_id: "TENANT_ID", client_secret: "CLIENT_SECRET" }'
+
+          # Creates an Azure KMS credentials object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains credentials for
+          #   Azure KMS provider
+          # @option opts [ String ] :tenant_id Azure tenant id.
+          # @option opts [ String ] :client_id Azure client id.
+          # @option opts [ String ] :client_secret Azure client secret.
+          # @option opts [ String | nil ] :identity_platform_endpoint Azure
+          #   identity platform endpoint, optional.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly
+          #   formatted.
+          def initialize(opts)
+            @opts = opts
+            return if empty?
+
+            if opts[:access_token]
+              @access_token = opts[:access_token]
+            else
+              @tenant_id = validate_param(:tenant_id, opts, FORMAT_HINT)
+              @client_id = validate_param(:client_id, opts, FORMAT_HINT)
+              @client_secret = validate_param(:client_secret, opts, FORMAT_HINT)
+              @identity_platform_endpoint = validate_param(
+                :identity_platform_endpoint, opts, FORMAT_HINT, required: false
+              )
+            end
+          end
+
+          # Convert credentials object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] Azure KMS credentials in libmongocrypt format.
+          def to_document
+            return BSON::Document.new if empty?
+
+            if access_token
+              BSON::Document.new({ accessToken: access_token })
+            else
+              BSON::Document.new(
+                {
+                  tenantId: @tenant_id,
+                  clientId: @client_id,
+                  clientSecret: @client_secret
+                }
+              ).tap do |bson|
+                unless identity_platform_endpoint.nil?
+                  bson.update({ identityPlatformEndpoint: identity_platform_endpoint })
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/crypt/kms/azure/credentials_retriever.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module Azure
+        # This class retrieves Azure credentials using Azure
+        # metadata host. This should be used when the driver is used on the
+        # Azure environment.
+        #
+        # @api private
+        class CredentialsRetriever
+          # Default host to obtain Azure metadata.
+          DEFAULT_HOST = '169.254.169.254'
+
+          # Fetches Azure credentials from Azure metadata host.
+          #
+          # @param [Hash] extra_headers Extra headers to be passed to the
+          #   request. This is used for testing.
+          # @param [String | nil] metadata_host Azure metadata host. This
+          #   is used for testing.
+          #
+          # @return [ KMS::Azure::AccessToken ] Azure access token.
+          #
+          # @raise [KMS::CredentialsNotFound] If credentials could not be found.
+          def self.fetch_access_token(extra_headers: {}, metadata_host: nil)
+            uri, req = prepare_request(extra_headers, metadata_host)
+            parsed_response = fetch_response(uri, req)
+            Azure::AccessToken.new(
+              parsed_response.fetch('access_token'),
+              Integer(parsed_response.fetch('expires_in'))
+            )
+          rescue KeyError, ArgumentError => e
+            raise KMS::CredentialsNotFound,
+                  "Azure metadata response is invalid: '#{parsed_response}'; #{e.class}: #{e.message}"
+          end
+
+          # Prepares a request to Azure metadata host.
+          #
+          # @param [Hash] extra_headers Extra headers to be passed to the
+          #   request. This is used for testing.
+          # @param [String | nil] metadata_host Azure metadata host. This
+          #   is used for testing.
+          #
+          # @return [Array<URI, Net::HTTP::Get>] URI and request object.
+          def self.prepare_request(extra_headers, metadata_host)
+            host = metadata_host || DEFAULT_HOST
+            host = DEFAULT_HOST if host.empty?
+            uri = URI("http://#{host}/metadata/identity/oauth2/token")
+            uri.query = ::URI.encode_www_form(
+              'api-version' => '2018-02-01',
+              'resource' => 'https://vault.azure.net'
+            )
+            req = Net::HTTP::Get.new(uri)
+            req['Metadata'] = 'true'
+            req['Accept'] = 'application/json'
+            extra_headers.each { |k, v| req[k] = v }
+            [uri, req]
+          end
+          private_class_method :prepare_request
+
+          # Fetches response from Azure metadata host.
+          #
+          # @param [URI] uri URI to Azure metadata host.
+          # @param [Net::HTTP::Get] req Request object.
+          #
+          # @return [Hash] Parsed response.
+          #
+          # @raise [KMS::CredentialsNotFound] If cannot fetch response or
+          #   response is invalid.
+          def self.fetch_response(uri, req)
+            resp = do_request(uri, req)
+            if resp.code != '200'
+              raise KMS::CredentialsNotFound,
+                    "Azure metadata host responded with code #{resp.code}"
+            end
+            JSON.parse(resp.body)
+          rescue JSON::ParserError => e
+            raise KMS::CredentialsNotFound,
+                  "Azure metadata response is invalid: '#{resp.body}'; #{e.class}: #{e.message}"
+          end
+          private_class_method :fetch_response
+
+          # Performs a request to Azure metadata host.
+          #
+          # @param [URI] uri URI to Azure metadata host.
+          # @param [Net::HTTP::Get] req Request object.
+          #
+          # @return [Net::HTTPResponse] Response object.
+          #
+          # @raise [KMS::CredentialsNotFound] If cannot execute request.
+          def self.do_request(uri, req)
+            ::Timeout.timeout(10) do
+              Net::HTTP.start(uri.hostname, uri.port, use_ssl: false) do |http|
+                http.request(req)
+              end
+            end
+          rescue ::Timeout::Error, IOError, SystemCallError, SocketError => e
+            raise KMS::CredentialsNotFound,
+                  "Could not receive Azure metadata response; #{e.class}: #{e.message}"
+          end
+          private_class_method :do_request
+        end
+      end
+    end
+  end
+end

data/lib/mongo/crypt/kms/azure/master_document.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2019-2021 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Crypt
+    module KMS
+      module Azure
+        # Azure KMS master key document object contains KMS master key parameters.
+        #
+        # @api private
+        class MasterKeyDocument
+          include KMS::Validations
+
+          # @return [ String ] Azure key vault endpoint.
+          attr_reader :key_vault_endpoint
+
+          # @return [ String ] Azure KMS key name.
+          attr_reader :key_name
+
+          # @return [ String | nil ] Azure KMS key version.
+          attr_reader :key_version
+
+          FORMAT_HINT = "Azure key document  must be in the format: " +
+                        "{ key_vault_endpoint: 'KEY_VAULT_ENDPOINT', key_name: 'KEY_NAME' }"
+
+        # Creates a master key document object form a parameters hash.
+        #
+        # @param [ Hash ] opts A hash that contains master key options for
+        #   the Azure KMS provider.
+        # @option opts [ String ] :key_vault_endpoint Azure key vault endpoint.
+        # @option opts [ String ] :key_name Azure KMS key name.
+        # @option opts [ String | nil ] :key_version Azure KMS key version, optional.
+        #
+        # @raise [ ArgumentError ] If required options are missing or incorrectly.
+          def initialize(opts)
+            unless opts.is_a?(Hash)
+              raise ArgumentError.new(
+                'Key document options must contain a key named :master_key with a Hash value'
+              )
+            end
+            @key_vault_endpoint = validate_param(:key_vault_endpoint, opts, FORMAT_HINT)
+            @key_name = validate_param(:key_name, opts, FORMAT_HINT)
+            @key_version = validate_param(:key_version, opts, FORMAT_HINT, required: false)
+          end
+
+          # Convert master key document object to a BSON document in libmongocrypt format.
+          #
+          # @return [ BSON::Document ] Azure KMS credentials in libmongocrypt format.
+          def to_document
+            BSON::Document.new({
+              provider: 'azure',
+              keyVaultEndpoint: key_vault_endpoint,
+              keyName: key_name,
+            }).tap do |bson|
+              unless key_version.nil?
+                bson.update({ keyVersion: key_version })
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end
+