mongo 2.22.0 → 2.24.0

data/lib/mongo/socket/ocsp_cache.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -17,11 +16,10 @@
 
 module Mongo
   class Socket
-
     # This module caches OCSP responses for their indicated validity time.
     #
     # The key is the CertificateId used for the OCSP request.
-    # The value is the SingleResponse.
+    # The value is an OcspVerifier::Response.
     #
     # @api private
     module OcspCache
@@ -45,16 +43,13 @@ module Mongo
         resp = responses.detect do |resp|
           resp.certid.cmp(cert_id)
         end
-        if resp
-          # Only expire responses with good status.
-          # Once a certificate is revoked, it should stay revoked forever,
-          # hence we should be able to cache revoked responses indefinitely.
-          if resp.cert_status == OpenSSL::OCSP::V_CERTSTATUS_GOOD &&
-            resp.next_update < Time.now
-          then
-            responses.delete(resp)
-            resp = nil
-          end
+        # Only expire responses with good status.
+        # Once a certificate is revoked, it should stay revoked forever,
+        # hence we should be able to cache revoked responses indefinitely.
+        if resp && resp.cert_status == OpenSSL::OCSP::V_CERTSTATUS_GOOD &&
+           resp.next_update < Time.now
+          responses.delete(resp)
+          resp = nil
         end
 
         # If we have connected to a server and cached the OCSP response for it,

data/lib/mongo/socket/ocsp_verifier.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -15,13 +14,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+require 'delegate'
+
 module Net
   autoload :HTTP, 'net/http'
 end
 
 module Mongo
   class Socket
-
     # OCSP endpoint verifier.
     #
     # After a TLS connection is established, this verifier inspects the
@@ -33,6 +33,19 @@ module Mongo
     #
     # @api private
     class OcspVerifier
+      # Wraps OpenSSL::OCSP::SingleResponse with the responder URI that supplied it.
+      #
+      # @api private
+      class Response < SimpleDelegator
+        attr_reader :uri, :original_uri
+
+        def initialize(single_response, uri, original_uri)
+          super(single_response)
+          @uri = uri
+          @original_uri = original_uri
+        end
+      end
+
       include Loggable
 
       # @param [ String ] host_name The host name being verified, for
@@ -56,11 +69,7 @@ module Mongo
         @options = opts
       end
 
-      attr_reader :host_name
-      attr_reader :cert
-      attr_reader :ca_cert
-      attr_reader :cert_store
-      attr_reader :options
+      attr_reader :host_name, :cert, :ca_cert, :cert_store, :options
 
       def timeout
         options[:timeout] || 5
@@ -92,7 +101,7 @@ module Mongo
         @cert_id ||= OpenSSL::OCSP::CertificateId.new(
           cert,
           ca_cert,
-          OpenSSL::Digest::SHA1.new,
+          OpenSSL::Digest.new('SHA1')
         )
       end
 
@@ -101,15 +110,11 @@ module Mongo
           return false if ocsp_uris.empty?
 
           resp = OcspCache.get(cert_id)
-          if resp
-            return return_ocsp_response(resp)
-          end
+          return return_ocsp_response(resp) if resp
 
           resp, errors = do_verify
 
-          if resp
-            OcspCache.set(cert_id, resp)
-          end
+          OcspCache.set(cert_id, resp) if resp
 
           return_ocsp_response(resp, errors)
         end
@@ -169,7 +174,7 @@ module Mongo
         threads.map(&:kill)
         threads.map(&:join)
 
-        [resp, @resp_errors]
+        [ resp, @resp_errors ]
       end
 
       def verify_one_responder(uri)
@@ -177,15 +182,13 @@ module Mongo
         redirect_count = 0
         http_response = nil
         loop do
-          http_response = begin
+          begin
             uri = URI(uri)
-            Net::HTTP.start(uri.hostname, uri.port) do |http|
+            http_response = Net::HTTP.start(uri.hostname, uri.port) do |http|
               path = uri.path
-              if path.empty?
-                path = '/'
-              end
+              path = '/' if path.empty?
               http.post(path, @serialized_req,
-                'content-type' => 'application/ocsp-request')
+                        'content-type' => 'application/ocsp-request')
             end
           rescue IOError, SystemCallError => e
             @resp_errors << "OCSP request to #{report_uri(original_uri, uri)} failed: #{e.class}: #{e}"
@@ -205,14 +208,16 @@ module Mongo
           end
 
           if code >= 400
-            @resp_errors << "OCSP request to #{report_uri(original_uri, uri)} failed with HTTP status code #{http_response.code}" + report_response_body(http_response.body)
+            @resp_errors << ("OCSP request to #{report_uri(original_uri,
+                                                           uri)} failed with HTTP status code #{http_response.code}" + report_response_body(http_response.body))
             return false
           end
 
           if code != 200
             # There must be a body provided with the response, if one isn't
             # provided the response cannot be verified.
-            @resp_errors << "OCSP request to #{report_uri(original_uri, uri)} failed with unexpected HTTP status code #{http_response.code}" + report_response_body(http_response.body)
+            @resp_errors << ("OCSP request to #{report_uri(original_uri,
+                                                           uri)} failed with unexpected HTTP status code #{http_response.code}" + report_response_body(http_response.body))
             return false
           end
 
@@ -225,10 +230,11 @@ module Mongo
           return false
         end
         resp = resp.basic
-        unless resp.verify([ca_cert], cert_store)
+        unless resp.verify([ ca_cert ], cert_store)
           # Ruby's OpenSSL binding discards error information - see
           # https://github.com/ruby/openssl/issues/395
-          @resp_errors << "OCSP response from #{report_uri(original_uri, uri)} failed signature verification; set `OpenSSL.debug = true` to see why"
+          @resp_errors << "OCSP response from #{report_uri(original_uri,
+                                                           uri)} failed signature verification; set `OpenSSL.debug = true` to see why"
           return false
         end
 
@@ -237,20 +243,17 @@ module Mongo
           return false
         end
 
-        resp = resp.find_response(cert_id)
-        unless resp
-          @resp_errors << "OCSP response from #{report_uri(original_uri, uri)} did not include information about the requested certificate"
+        single_response = resp.find_response(cert_id)
+        unless single_response
+          @resp_errors << "OCSP response from #{report_uri(original_uri,
+                                                           uri)} did not include information about the requested certificate"
           return false
         end
-        # TODO make a new class instead of patching the stdlib one?
-        resp.instance_variable_set('@uri', uri)
-        resp.instance_variable_set('@original_uri', original_uri)
-        class << resp
-          attr_reader :uri, :original_uri
-        end
+        resp = Response.new(single_response, uri, original_uri)
 
         unless resp.check_validity
-          @resp_errors << "OCSP response from #{report_uri(original_uri, uri)} was invalid: this_update was in the future or next_update time has passed"
+          @resp_errors << "OCSP response from #{report_uri(original_uri,
+                                                           uri)} was invalid: this_update was in the future or next_update time has passed"
           return false
         end
 
@@ -258,70 +261,66 @@ module Mongo
           OpenSSL::OCSP::V_CERTSTATUS_GOOD,
           OpenSSL::OCSP::V_CERTSTATUS_REVOKED,
         ].include?(resp.cert_status)
-          @resp_errors << "OCSP response from #{report_uri(original_uri, uri)} had a non-definitive status: #{resp.cert_status}"
+          @resp_errors << "OCSP response from #{report_uri(original_uri,
+                                                           uri)} had a non-definitive status: #{resp.cert_status}"
           return false
         end
 
         # Note this returns the redirected URI
         @resp_queue << resp
-      rescue => exc
-        Utils.warn_bg_exception("Error performing OCSP verification for '#{host_name}' via '#{uri}'", exc,
-          logger: options[:logger],
-          log_prefix: options[:log_prefix],
-          bg_error_backtrace: options[:bg_error_backtrace],
-        )
+      rescue StandardError => e
+        Utils.warn_bg_exception("Error performing OCSP verification for '#{host_name}' via '#{uri}'", e,
+                                logger: options[:logger],
+                                log_prefix: options[:log_prefix],
+                                bg_error_backtrace: options[:bg_error_backtrace])
         false
       ensure
         @outstanding_requests_lock.synchronize do
           @outstanding_requests -= 1
-          if @outstanding_requests == 0
-            @resp_queue << nil
-          end
+          @resp_queue << nil if @outstanding_requests == 0
         end
       end
 
       def return_ocsp_response(resp, errors = nil)
         if resp
-          if resp.cert_status == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
-            raise_revoked_error(resp)
-          end
+          raise_revoked_error(resp) if resp.cert_status == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
           true
         else
           reasons = []
           errors.length.times do
             reasons << errors.shift
           end
-          if reasons.empty?
-            msg = "No responses from responders: #{ocsp_uris.join(', ')} within #{timeout} seconds"
-          else
-            msg = "For responders #{ocsp_uris.join(', ')} with a timeout of #{timeout} seconds: #{reasons.join(', ')}"
-          end
+          msg = if reasons.empty?
+                  "No responses from responders: #{ocsp_uris.join(', ')} within #{timeout} seconds"
+                else
+                  "For responders #{ocsp_uris.join(', ')} with a timeout of #{timeout} seconds: #{reasons.join(', ')}"
+                end
           log_warn("TLS certificate of '#{host_name}' could not be definitively verified via OCSP: #{msg}")
           false
         end
       end
 
       def handle_exceptions
-        begin
-          yield
-        rescue Error::ServerCertificateRevoked
-          raise
-        rescue => exc
-          Utils.warn_bg_exception(
-            "Error performing OCSP verification for '#{host_name}'",
-            exc,
-            **options)
-          false
-        end
+        yield
+      rescue Error::ServerCertificateRevoked
+        raise
+      rescue StandardError => e
+        Utils.warn_bg_exception(
+          "Error performing OCSP verification for '#{host_name}'",
+          e,
+          **options
+        )
+        false
       end
 
       def raise_revoked_error(resp)
-        if resp.uri == resp.original_uri
-          redirect = ''
-        else
-          redirect = " (redirected from #{resp.original_uri})"
-        end
-        raise Error::ServerCertificateRevoked, "TLS certificate of '#{host_name}' has been revoked according to '#{resp.uri}'#{redirect} for reason '#{resp.revocation_reason}' at '#{resp.revocation_time}'"
+        redirect = if resp.uri == resp.original_uri
+                     ''
+                   else
+                     " (redirected from #{resp.original_uri})"
+                   end
+        raise Error::ServerCertificateRevoked,
+              "TLS certificate of '#{host_name}' has been revoked according to '#{resp.uri}'#{redirect} for reason '#{resp.revocation_reason}' at '#{resp.revocation_time}'"
       end
 
       def report_uri(original_uri, uri)

data/lib/mongo/socket/ssl.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #
@@ -17,7 +16,6 @@
 
 module Mongo
   class Socket
-
     # Wrapper for TLS sockets.
     #
     # @since 2.0.0
@@ -113,7 +111,7 @@ module Mongo
           run_tls_context_hooks
 
           connect!
-        rescue
+        rescue StandardError
           @tcp_socket.close
           raise
         end
@@ -154,7 +152,8 @@ module Mongo
               # solution, even though it is known to be not very reliable.
               raise Error::SocketTimeoutError, 'connect_timeout expired' if connect_timeout < 0
 
-              Timeout.timeout(connect_timeout, Error::SocketTimeoutError, "The socket took over #{options[:connect_timeout]} seconds to connect") do
+              Timeout.timeout(connect_timeout, Error::SocketTimeoutError,
+                              "The socket took over #{options[:connect_timeout]} seconds to connect") do
                 connect_without_timeout(sockaddr)
               end
             else
@@ -170,7 +169,7 @@ module Mongo
           end
         end
         self
-      rescue
+      rescue StandardError
         @socket&.close
         @socket = nil
         raise
@@ -223,11 +222,12 @@ module Mongo
         if deadline <= Utils.monotonic_time
           raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
         end
+
         begin
           @tcp_socket.connect_nonblock(sockaddr)
         rescue IO::WaitWritable
           with_select_timeout(deadline, connect_timeout) do |select_timeout|
-            IO.select(nil, [@tcp_socket], nil, select_timeout)
+            IO.select(nil, [ @tcp_socket ], nil, select_timeout)
           end
           retry
         rescue Errno::EISCONN
@@ -239,6 +239,7 @@ module Mongo
         if deadline <= Utils.monotonic_time
           raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
         end
+
         @socket = OpenSSL::SSL::SSLSocket.new(@tcp_socket, context)
         @socket.hostname = @host_name
         @socket.sync_close = true
@@ -248,12 +249,12 @@ module Mongo
           @socket.connect_nonblock
         rescue IO::WaitReadable, OpenSSL::SSL::SSLErrorWaitReadable
           with_select_timeout(deadline, connect_timeout) do |select_timeout|
-            IO.select([@socket], nil, nil, select_timeout)
+            IO.select([ @socket ], nil, nil, select_timeout)
           end
           retry
         rescue IO::WaitWritable, OpenSSL::SSL::SSLErrorWaitWritable
           with_select_timeout(deadline, connect_timeout) do |select_timeout|
-            IO.select(nil, [@socket], nil, select_timeout)
+            IO.select(nil, [ @socket ], nil, select_timeout)
           end
           retry
         rescue Errno::EISCONN
@@ -264,15 +265,16 @@ module Mongo
       # Raises +Error::SocketTimeoutError+ exception if deadline reached or the
       # block returns nil. The block should call +IO.select+ with the
       # +connect_timeout+ value. It returns nil if the +connect_timeout+ expires.
-      def with_select_timeout(deadline, connect_timeout, &block)
+      def with_select_timeout(deadline, connect_timeout)
         select_timeout = deadline - Utils.monotonic_time
         if select_timeout <= 0
           raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
         end
-        rv = block.call(select_timeout)
-        if rv.nil?
-          raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
-        end
+
+        rv = yield(select_timeout)
+        return unless rv.nil?
+
+        raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
       end
 
       def verify_certificate?
@@ -319,15 +321,14 @@ module Mongo
             # In JRuby we must allow one call as this callback is invoked for
             # the initial connection also, not just for renegotiations -
             # https://github.com/jruby/jruby-openssl/issues/180
-            if BSON::Environment.jruby?
-              allowed_calls = 1
-            else
-              allowed_calls = 0
-            end
-            context.renegotiation_cb = lambda do |ssl|
-              if allowed_calls <= 0
-                raise RuntimeError, 'Client renegotiation disabled'
-              end
+            allowed_calls = if BSON::Environment.jruby?
+                              1
+                            else
+                              0
+                            end
+            context.renegotiation_cb = lambda do |_ssl|
+              raise 'Client renegotiation disabled' if allowed_calls <= 0
+
               allowed_calls -= 1
             end
           end
@@ -412,19 +413,17 @@ module Mongo
 
       def load_private_key(text, passphrase)
         args = if passphrase
-          [text, passphrase]
-        else
-          [text]
-        end
+                 [ text, passphrase ]
+               else
+                 [ text ]
+               end
         # On JRuby, PKey.read does not grok cert+key bundles.
         # https://github.com/jruby/jruby-openssl/issues/176
         if BSON::Environment.jruby?
-          [OpenSSL::PKey::RSA, OpenSSL::PKey::DSA].each do |cls|
-            begin
-              return cls.send(:new, *args)
-            rescue OpenSSL::PKey::PKeyError
-              # ignore
-            end
+          [ OpenSSL::PKey::RSA, OpenSSL::PKey::DSA ].each do |cls|
+            return cls.send(:new, *args)
+          rescue OpenSSL::PKey::PKeyError
+            # ignore
           end
           # Neither RSA nor DSA worked, fall through to trying PKey
         end
@@ -439,8 +438,11 @@ module Mongo
         elsif options[:ssl_ca_cert_string]
           cert_store.add_cert(OpenSSL::X509::Certificate.new(options[:ssl_ca_cert_string]))
         elsif options[:ssl_ca_cert_object]
-          raise TypeError("Option :ssl_ca_cert_object should be an array of OpenSSL::X509:Certificate objects") unless options[:ssl_ca_cert_object].is_a? Array
-          options[:ssl_ca_cert_object].each {|cert| cert_store.add_cert(cert)}
+          unless options[:ssl_ca_cert_object].is_a? Array
+            raise TypeError('Option :ssl_ca_cert_object should be an array of OpenSSL::X509:Certificate objects')
+          end
+
+          options[:ssl_ca_cert_object].each { |cert| cert_store.add_cert(cert) }
         else
           cert_store.set_default_paths
         end
@@ -448,11 +450,10 @@ module Mongo
       end
 
       def verify_certificate!(socket)
-        if verify_hostname?
-          unless OpenSSL::SSL.verify_certificate_identity(socket.peer_cert, host_name)
-            raise Error::SocketError, 'TLS handshake failed due to a hostname mismatch.'
-          end
-        end
+        return unless verify_hostname?
+        return if OpenSSL::SSL.verify_certificate_identity(socket.peer_cert, host_name)
+
+        raise Error::SocketError, 'TLS handshake failed due to a hostname mismatch.'
       end
 
       def verify_ocsp_endpoint!(socket, timeout = nil)
@@ -467,14 +468,14 @@ module Mongo
         end
 
         verifier = OcspVerifier.new(@host_name, cert, ca_cert, context.cert_store,
-          **Utils.shallow_symbolize_keys(options).merge(timeout: timeout))
+                                    **Utils.shallow_symbolize_keys(options), timeout: timeout)
         verifier.verify_with_cache
       end
 
       def read_buffer_size
         # Buffer size for TLS reads.
         # Capped at 16k due to https://linux.die.net/man/3/ssl_read
-        16384
+        16_384
       end
 
       def human_address
@@ -487,8 +488,8 @@ module Mongo
         end
       end
 
-      BEGIN_CERT = "-----BEGIN CERTIFICATE-----"
-      END_CERT = "-----END CERTIFICATE-----"
+      BEGIN_CERT = '-----BEGIN CERTIFICATE-----'
+      END_CERT = '-----END CERTIFICATE-----'
 
       # This was originally a scan + regex, but the regex was particularly
       # inefficient and was flagged as a concern by static analysis.

data/lib/mongo/socket/tcp.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #
@@ -17,12 +16,10 @@
 
 module Mongo
   class Socket
-
     # Wrapper for TCP sockets.
     #
     # @since 2.0.0
     class TCP < Socket
-
       # Initializes a new TCP socket.
       #
       # @example Create the TCP socket.
@@ -46,9 +43,8 @@ module Mongo
       # @since 2.0.0
       # @api private
       def initialize(host, port, timeout, family, options = {})
-        if family.nil?
-          raise ArgumentError, 'family must be specified'
-        end
+        raise ArgumentError, 'family must be specified' if family.nil?
+
         super(timeout, options)
         @host, @port = host, port
         @family = family
@@ -56,7 +52,7 @@ module Mongo
         begin
           set_socket_options(@socket)
           connect!
-        rescue
+        rescue StandardError
           @socket.close
           raise
         end
@@ -113,7 +109,8 @@ module Mongo
           if select_timeout <= 0
             raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
           end
-          if IO.select(nil, [socket], nil, select_timeout)
+
+          if IO.select(nil, [ socket ], nil, select_timeout)
             retry
           else
             socket.close

data/lib/mongo/socket/unix.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #
@@ -17,12 +16,10 @@
 
 module Mongo
   class Socket
-
     # Wrapper for Unix sockets.
     #
     # @since 2.0.0
     class Unix < Socket
-
       # Initializes a new Unix socket.
       #
       # @example Create the Unix socket.
@@ -60,4 +57,3 @@ module Mongo
     end
   end
 end
-