mongo 2.5.3 → 2.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 13c197c0761d6af2fd32db77e0f9a91ae09175a4
-  data.tar.gz: 8c8c26637cfc0f51acfea88906da79376096d773
+SHA256:
+  metadata.gz: 8c5dc91c26dc7d6d0a6c9f50e39c6d7b53130d08e75611d9f2a81162ed5a53e2
+  data.tar.gz: ceb6c12c3e4a7e5b9552fa8501b8faa6835ce110a6f32e6df8e8c65f53599b76
 SHA512:
-  metadata.gz: 28f70edfe9d4c61a513b488f89ccf380f0148fe7f7c655ffb65202d6e0f03844a9e07c13919362656014593a21240398bbe24ed12744732b0cded6d8aa50bdcb
-  data.tar.gz: 8a60151b258110900492b62ef55c0f39df7dea2c143a8d437210adb91181f58212ddc1ca4c3c84d08a90cdf4981c12f4de8c2f18be13d1ea2cdf7d03dec029e2
+  metadata.gz: 94c8eeb0c0afa60bd77ad0fc8139bfa818e9b3d1ac1d7e1656d92cf91e50d0481d3e9bb275bd3f5143b540036e5acc314e573e79c5891ad85003b05eadfc695e
+  data.tar.gz: 94e7a7f089b67ec901c8182f96d9a020ba67143b5e0823d3c39f0fa7dfa8cc7e0132a40df65a64c2c308b2d255316dbac4e20180b70bbeaa5680b3ef55e6f70e

data/LICENSE

@@ -175,7 +175,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright (C) 2009-2017 MongoDB, Inc.
+   Copyright (C) 2009-2018 MongoDB, Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

data/README.md

@@ -5,7 +5,8 @@ The officially supported Ruby driver for [MongoDB](http://www.mongodb.org).
 Documentation
 -----
 
-Documentation is located [here](http://docs.mongodb.org/ecosystem/drivers/ruby/).
+High level documentation and usage examples are located
+[here](http://docs.mongodb.org/ecosystem/drivers/ruby/).
 
 API docs can be found [here](http://api.mongodb.org/ruby/).
 
@@ -65,7 +66,7 @@ Full release notes and release history are available [here](https://github.com/m
 License
 -----
 
- Copyright (C) 2009-2017 MongoDB, Inc.
+ Copyright (C) 2009-2018 MongoDB, Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

data/lib/mongo.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB, Inc.
+# Copyright (C) 2014-2018 MongoDB, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -27,11 +27,11 @@ require 'mongo/event'
 require 'mongo/address'
 require 'mongo/auth'
 require 'mongo/protocol'
-require 'mongo/client'
 require 'mongo/cluster'
 require 'mongo/cursor'
 require 'mongo/collection'
 require 'mongo/database'
+require 'mongo/client' # Purposely out-of-order so that database is loaded first
 require 'mongo/dbref'
 require 'mongo/grid'
 require 'mongo/index'

data/lib/mongo/address.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB, Inc.
+# Copyright (C) 2014-2018 MongoDB, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.
@@ -159,7 +159,15 @@ module Mongo
     #
     # @since 2.0.0
     def to_s
-      port ? "#{host}:#{port}" : host
+      if port
+        if host.include?(':')
+          "[#{host}]:#{port}"
+        else
+          "#{host}:#{port}"
+        end
+      else
+        host
+      end
     end
 
     # Connect a socket.

data/lib/mongo/address/ipv4.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB, Inc.
+# Copyright (C) 2014-2018 MongoDB, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.

data/lib/mongo/address/ipv6.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB, Inc.
+# Copyright (C) 2014-2018 MongoDB, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+require 'ipaddr'
+
 module Mongo
   class Address
 
@@ -38,7 +40,7 @@ module Mongo
       # Parse an IPv6 address into its host and port.
       #
       # @example Parse the address.
-      #   IPv4.parse("[::1]:28011")
+      #   IPv6.parse("[::1]:28011")
       #
       # @param [ String ] address The address to parse.
       #
@@ -46,9 +48,28 @@ module Mongo
       #
       # @since 2.0.0
       def self.parse(address)
-        parts = address.match(/\[(.+)\]:?(.+)?/)
-        host = parts[1]
-        port = (parts[2] || 27017).to_i
+        # IPAddr's parser handles IP address only, not port.
+        # Therefore we need to handle the port ourselves
+        if address =~ /[\[\]]/
+          parts = address.match(/\A\[(.+)\](?::(\d+))?\z/)
+          if parts.nil?
+            raise ArgumentError, "Invalid IPv6 address: #{address}"
+          end
+          host = parts[1]
+          port = (parts[2] || 27017).to_i
+        else
+          host = address
+          port = 27017
+        end
+        # Validate host.
+        # This will raise IPAddr::InvalidAddressError
+        # on newer rubies which is a subclass of ArgumentError
+        # if host is invalid
+        begin
+          IPAddr.new(host)
+        rescue ArgumentError
+          raise ArgumentError, "Invalid IPv6 address: #{address}"
+        end
         [ host, port ]
       end
 

data/lib/mongo/address/unix.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB, Inc.
+# Copyright (C) 2014-2018 MongoDB, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.

data/lib/mongo/auth.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB, Inc.
+# Copyright (C) 2014-2018 MongoDB, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ require 'mongo/auth/scram'
 require 'mongo/auth/user'
 require 'mongo/auth/x509'
 require 'mongo/auth/roles'
+require 'mongo/auth/stringprep'
 
 module Mongo
 
@@ -49,7 +50,8 @@ module Mongo
       mongodb_cr: CR,
       mongodb_x509: X509,
       plain: LDAP,
-      scram: SCRAM
+      scram: SCRAM,
+      scram256: SCRAM,
     }
 
     # Get the authorization strategy for the provided auth mechanism.
@@ -65,7 +67,12 @@ module Mongo
     def get(user)
       mechanism = user.mechanism
       raise InvalidMechanism.new(mechanism) if !SOURCES.has_key?(mechanism)
-      SOURCES[mechanism].new(user)
+      case SOURCES[mechanism]
+      when SCRAM
+        SOURCES[mechanism].new(user, mechanism)
+      else
+        SOURCES[mechanism].new(user)
+      end
     end
 
     # Raised when trying to get an invalid authorization mechanism.

data/lib/mongo/auth/cr.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB Inc.
+# Copyright (C) 2014-2018 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,6 +20,9 @@ module Mongo
     # Defines behaviour for MongoDB-CR authentication.
     #
     # @since 2.0.0
+    # @deprecated MONGODB-CR authentication mechanism is deprecated
+    #   as of MongoDB 3.6. Support for it in the Ruby driver will be
+    #   removed in driver version 3.0. Please use SCRAM instead.
     class CR
 
       # The authentication mechinism string.

data/lib/mongo/auth/cr/conversation.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014 MongoDB Inc.
+# Copyright (C) 2014-2018 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,6 +20,9 @@ module Mongo
       # client and server.
       #
       # @since 2.0.0
+      # @deprecated MONGODB-CR authentication mechanism is deprecated
+      #   as of MongoDB 3.6. Support for it in the Ruby driver will be
+      #   removed in driver version 3.0. Please use SCRAM instead.
       class Conversation
 
         # The login message base.

data/lib/mongo/auth/ldap.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB Inc.
+# Copyright (C) 2014-2018 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

data/lib/mongo/auth/ldap/conversation.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014 MongoDB Inc.
+# Copyright (C) 2014-2018 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

data/lib/mongo/auth/roles.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017 MongoDB, Inc.
+# Copyright (C) 2014-2018 MongoDB, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

data/lib/mongo/auth/scram.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014 MongoDB Inc.
+# Copyright (C) 2014-2018 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,15 +17,29 @@ require 'mongo/auth/scram/conversation'
 module Mongo
   module Auth
 
-    # Defines behaviour for SCRAM-SHA1 authentication.
+    # Defines behaviour for SCRAM authentication.
     #
     # @since 2.0.0
     class SCRAM
 
-      # The authentication mechinism string.
+      # The authentication mechanism string for SCRAM-SHA-1.
       #
-      # @since 2.0.0
-      MECHANISM = 'SCRAM-SHA-1'.freeze
+      # @since 2.6.0
+      SCRAM_SHA_1_MECHANISM = 'SCRAM-SHA-1'.freeze
+
+      # The authentication mechanism string for SCRAM-SHA-256.
+      #
+      # @since 2.6.0
+      SCRAM_SHA_256_MECHANISM = 'SCRAM-SHA-256'.freeze
+
+
+      # Map the user-specified authentication mechanism to the proper names of the mechanisms.
+      #
+      # @since 2.6.0
+      MECHANISMS = {
+        scram: SCRAM_SHA_1_MECHANISM,
+        scram256: SCRAM_SHA_256_MECHANISM
+      }.freeze
 
       # @return [ Mongo::Auth::User ] The user to authenticate.
       attr_reader :user
@@ -49,12 +63,15 @@ module Mongo
       #
       # @param [ Mongo::Connection ] connection The connection to log into.
       #   on.
+      # @param [ String ] mechanism The auth mechanism to use (either 'SCRAM-SHA-1' or
+      #   'SCRAM-SHA-256');
       #
       # @return [ Protocol::Message ] The authentication response.
       #
       # @since 2.0.0
-      def login(connection)
-        conversation = Conversation.new(user)
+      def login(connection, mechanism = nil)
+        mechanism ||= user.mechanism || :scram
+        conversation = Conversation.new(user, MECHANISMS[mechanism])
         reply = connection.dispatch([ conversation.start(connection) ])
         connection.update_cluster_time(Operation::Result.new(reply))
         reply = connection.dispatch([ conversation.continue(reply, connection) ])

data/lib/mongo/auth/scram/conversation.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014 MongoDB Inc.
+# Copyright (C) 2014-2018 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -40,11 +40,6 @@ module Mongo
         # @since 2.0.0
         CLIENT_KEY = 'Client Key'.freeze
 
-        # The digest to use for encryption.
-        #
-        # @since 2.0.0
-        DIGEST = OpenSSL::Digest::SHA1.new.freeze
-
         # The key for the done field in the responses.
         #
         # @since 2.0.0
@@ -60,6 +55,13 @@ module Mongo
         # @since 2.0.0
         ITERATIONS = /i=(\d+)/.freeze
 
+        # The minimum iteration count for SCRAM-SHA-256.
+        #
+        # @api private
+        #
+        # @since 2.6.0
+        MIN_ITER_COUNT = 4096
+
         # The payload field.
         #
         # @since 2.0.0
@@ -178,7 +180,7 @@ module Mongo
         # @since 2.0.0
         def start(connection = nil)
           if connection && connection.features.op_msg_enabled?
-            selector = CLIENT_FIRST_MESSAGE.merge(payload: client_first_message, mechanism: SCRAM::MECHANISM)
+            selector = CLIENT_FIRST_MESSAGE.merge(payload: client_first_message, mechanism: @mechanism)
             selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
             cluster_time = connection.mongos? && connection.cluster_time
             selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
@@ -187,7 +189,7 @@ module Mongo
             Protocol::Query.new(
               user.auth_source,
               Database::COMMAND,
-              CLIENT_FIRST_MESSAGE.merge(payload: client_first_message, mechanism: SCRAM::MECHANISM),
+              CLIENT_FIRST_MESSAGE.merge(payload: client_first_message, mechanism: @mechanism),
               limit: -1
             )
           end
@@ -208,15 +210,16 @@ module Mongo
         # Create the new conversation.
         #
         # @example Create the new conversation.
-        #   Conversation.new(user)
+        #   Conversation.new(user, mechanism)
         #
         # @param [ Auth::User ] user The user to converse about.
         #
         # @since 2.0.0
-        def initialize(user)
+        def initialize(user, mechanism)
           @user = user
           @nonce = SecureRandom.base64
           @client_key = user.send(:client_key)
+          @mechanism = mechanism
         end
 
         private
@@ -339,12 +342,23 @@ module Mongo
         #
         # @since 2.0.0
         def hi(data)
-          OpenSSL::PKCS5.pbkdf2_hmac_sha1(
-            data,
-            Base64.strict_decode64(salt),
-            iterations,
-            digest.size
-          )
+          case @mechanism
+          when SCRAM::SCRAM_SHA_256_MECHANISM
+            OpenSSL::PKCS5.pbkdf2_hmac(
+              data,
+              Base64.strict_decode64(salt),
+              iterations,
+              digest.size,
+              digest
+            )
+          else
+            OpenSSL::PKCS5.pbkdf2_hmac_sha1(
+              data,
+              Base64.strict_decode64(salt),
+              iterations,
+              digest.size
+            )
+          end
         end
 
         # HMAC algorithm implementation.
@@ -364,7 +378,12 @@ module Mongo
         #
         # @since 2.0.0
         def iterations
-          @iterations ||= payload_data.match(ITERATIONS)[1].to_i
+          @iterations ||= payload_data.match(ITERATIONS)[1].to_i.tap do |i|
+            if i < MIN_ITER_COUNT
+              raise Error::InsufficientIterationCount.new(
+                Error::InsufficientIterationCount.message(MIN_ITER_COUNT, 1))
+            end
+          end
         end
 
         # Get the data from the returned payload.
@@ -402,7 +421,7 @@ module Mongo
         #
         # @since 2.0.0
         def salted_password
-          @salted_password ||= hi(user.hashed_password)
+          @salted_password ||= hi(hashed_password)
         end
 
         # Server key algorithm implementation.
@@ -492,8 +511,22 @@ module Mongo
 
         private
 
+        def hashed_password
+          case @mechanism
+          when SCRAM::SCRAM_SHA_256_MECHANISM
+            user.sasl_prepped_hashed_password
+          else
+            user.hashed_password
+          end
+        end
+
         def digest
-          @digest ||= OpenSSL::Digest::SHA1.new.freeze
+          @digest ||= case @mechanism
+                      when SCRAM::SCRAM_SHA_256_MECHANISM
+                        OpenSSL::Digest::SHA256.new.freeze
+                      else
+                        OpenSSL::Digest::SHA1.new.freeze
+                      end
         end
       end
     end