Skip to content

Commit 85695c4

Browse files
emadumemadum
authored
test: add tests for azure and GCP CSFLE, fix aws boto3 error (#2738)
This adds new tests, and modifies the test runner to account for the recent addition of Azure and GCP CSFLE support in the CSLFE specification. Also fixes a CI error resulting from an old boto3 dependency. NODE-2825 NODE-3056
1 parent f4698b5 commit 85695c4

File tree

111 files changed

+12098
-4118
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

111 files changed

+12098
-4118
lines changed

‎.evergreen/config.yml

+5-8
Original file line numberDiff line numberDiff line change
@@ -107,8 +107,7 @@ functions:
107107
if [ -n "${CLIENT_ENCRYPTION}" ]; then
108108
cat <<EOT > prepare_client_encryption.sh
109109
export CLIENT_ENCRYPTION=${CLIENT_ENCRYPTION}
110-
export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}"
111-
export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}"
110+
export CSFLE_KMS_PROVIDERS='${CSFLE_KMS_PROVIDERS}'
112111
EOT
113112
fi
114113
- command: shell.exec
@@ -283,6 +282,7 @@ functions:
283282
script: |
284283
${PREPARE_SHELL}
285284
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
285+
. ./activate_venv.sh
286286
${MONGODB_BINARIES}/mongo aws_e2e_regular_aws.js
287287
- command: shell.exec
288288
type: test
@@ -311,6 +311,7 @@ functions:
311311
script: |
312312
${PREPARE_SHELL}
313313
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
314+
. ./activate_venv.sh
314315
${MONGODB_BINARIES}/mongo aws_e2e_assume_role.js
315316
- command: shell.exec
316317
type: test
@@ -343,6 +344,7 @@ functions:
343344
script: |
344345
${PREPARE_SHELL}
345346
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
347+
. ./activate_venv.sh
346348
${MONGODB_BINARIES}/mongo aws_e2e_ec2.js
347349
- command: shell.exec
348350
type: test
@@ -415,6 +417,7 @@ functions:
415417
EOF
416418
417419
cat setup.js
420+
. ./activate_venv.sh
418421
mongo --nodb setup.js aws_e2e_ecs.js
419422
run-ocsp-test:
420423
- command: shell.exec
@@ -1125,9 +1128,6 @@ tasks:
11251128
- func: run aws auth test with regular aws credentials
11261129
- func: run aws auth test with assume role credentials
11271130
- func: run aws auth test with aws EC2 credentials
1128-
- func: run aws auth test with aws credentials as environment variables
1129-
- func: run aws auth test with aws credentials and session token as environment variables
1130-
- func: run aws ECS auth test
11311131
- name: aws-4.4-auth-test
11321132
commands:
11331133
- func: install dependencies
@@ -1141,9 +1141,6 @@ tasks:
11411141
- func: run aws auth test with regular aws credentials
11421142
- func: run aws auth test with assume role credentials
11431143
- func: run aws auth test with aws EC2 credentials
1144-
- func: run aws auth test with aws credentials as environment variables
1145-
- func: run aws auth test with aws credentials and session token as environment variables
1146-
- func: run aws ECS auth test
11471144
- name: run-checks
11481145
tags:
11491146
- run-checks

‎.evergreen/config.yml.in

+5-2
Original file line numberDiff line numberDiff line change
@@ -127,8 +127,7 @@ functions:
127127
if [ -n "${CLIENT_ENCRYPTION}" ]; then
128128
cat <<EOT > prepare_client_encryption.sh
129129
export CLIENT_ENCRYPTION=${CLIENT_ENCRYPTION}
130-
export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}"
131-
export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}"
130+
export CSFLE_KMS_PROVIDERS='${CSFLE_KMS_PROVIDERS}'
132131
EOT
133132
fi
134133
- command: shell.exec
@@ -317,6 +316,7 @@ functions:
317316
script: |
318317
${PREPARE_SHELL}
319318
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
319+
. ./activate_venv.sh
320320
${MONGODB_BINARIES}/mongo aws_e2e_regular_aws.js
321321
- command: shell.exec
322322
type: test
@@ -346,6 +346,7 @@ functions:
346346
script: |
347347
${PREPARE_SHELL}
348348
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
349+
. ./activate_venv.sh
349350
${MONGODB_BINARIES}/mongo aws_e2e_assume_role.js
350351
- command: shell.exec
351352
type: test
@@ -379,6 +380,7 @@ functions:
379380
script: |
380381
${PREPARE_SHELL}
381382
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
383+
. ./activate_venv.sh
382384
${MONGODB_BINARIES}/mongo aws_e2e_ec2.js
383385
- command: shell.exec
384386
type: test
@@ -454,6 +456,7 @@ functions:
454456
EOF
455457

456458
cat setup.js
459+
. ./activate_venv.sh
457460
mongo --nodb setup.js aws_e2e_ecs.js
458461

459462
"run-ocsp-test":

‎.evergreen/generate_evergreen_tasks.js

+4-3
Original file line numberDiff line numberDiff line change
@@ -396,9 +396,10 @@ AWS_AUTH_VERSIONS.forEach(VERSION => {
396396
{ func: 'run aws auth test with regular aws credentials' },
397397
{ func: 'run aws auth test with assume role credentials' },
398398
{ func: 'run aws auth test with aws EC2 credentials' },
399-
{ func: 'run aws auth test with aws credentials as environment variables' },
400-
{ func: 'run aws auth test with aws credentials and session token as environment variables' },
401-
{ func: 'run aws ECS auth test' }
399+
// FIXME: NODE-3113
400+
// { func: 'run aws auth test with aws credentials as environment variables' },
401+
// { func: 'run aws auth test with aws credentials and session token as environment variables' },
402+
// { func: 'run aws ECS auth test' }
402403
]
403404
});
404405
});

‎.evergreen/run-tests.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ if [[ -z "${CLIENT_ENCRYPTION}" ]]; then
5353
unset AWS_ACCESS_KEY_ID;
5454
unset AWS_SECRET_ACCESS_KEY;
5555
else
56-
npm install mongodb-client-encryption
56+
npm install mongodb-client-encryption@">=1.2.1"
5757
fi
5858

5959
MONGODB_UNIFIED_TOPOLOGY=${UNIFIED} MONGODB_URI=${MONGODB_URI} npm run ${TEST_NPM_SCRIPT}

‎src/connection_string.ts

+5-6
Original file line numberDiff line numberDiff line change
@@ -373,12 +373,11 @@ export function parseOptions(
373373
}
374374

375375
if (mongoOptions.credentials) {
376-
const gssapiOrX509 =
377-
mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_GSSAPI ||
378-
mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_X509;
379-
376+
const isGssapi = mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_GSSAPI;
377+
const isX509 = mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_X509;
378+
const isAws = mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_AWS;
380379
if (
381-
gssapiOrX509 &&
380+
(isGssapi || isX509) &&
382381
allOptions.has('authSource') &&
383382
mongoOptions.credentials.source !== '$external'
384383
) {
@@ -388,7 +387,7 @@ export function parseOptions(
388387
);
389388
}
390389

391-
if (!gssapiOrX509 && mongoOptions.dbName && !allOptions.has('authSource')) {
390+
if (!(isGssapi || isX509 || isAws) && mongoOptions.dbName && !allOptions.has('authSource')) {
392391
// inherit the dbName unless GSSAPI or X509, then silently ignore dbName
393392
// and there was no specific authSource given
394393
mongoOptions.credentials = MongoCredentials.merge(mongoOptions.credentials, {

‎test/functional/client_side_encryption/corpus.test.js

+33-15
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,21 @@ describe('Client Side Encryption Corpus', function () {
2121
return EJSON.parse(fs.readFileSync(path.resolve(corpusDir, filename)), { relaxed: false });
2222
}
2323

24+
const CSFLE_KMS_PROVIDERS = process.env.CSFLE_KMS_PROVIDERS;
25+
const kmsProviders = CSFLE_KMS_PROVIDERS ? EJSON.parse(CSFLE_KMS_PROVIDERS) : {};
26+
kmsProviders.local = {
27+
key: Buffer.from(
28+
'Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk',
29+
'base64'
30+
)
31+
};
32+
2433
// TODO: build this into EJSON
2534
// TODO: make a custom chai assertion for this
2635
function toComparableExtendedJSON(value) {
2736
return JSON.parse(EJSON.stringify({ value }, { relaxed: false }));
2837
}
2938

30-
const localKey = Buffer.from(
31-
'Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk',
32-
'base64'
33-
);
34-
3539
// Filters out tests that have to do with dbPointer
3640
// TODO: fix dbpointer and get rid of this.
3741
function filterImportedObject(object) {
@@ -50,6 +54,8 @@ describe('Client Side Encryption Corpus', function () {
5054
const corpusSchema = loadCorpusData('corpus-schema.json');
5155
const corpusKeyLocal = loadCorpusData('corpus-key-local.json');
5256
const corpusKeyAws = loadCorpusData('corpus-key-aws.json');
57+
const corpusKeyAzure = loadCorpusData('corpus-key-azure.json');
58+
const corpusKeyGcp = loadCorpusData('corpus-key-gcp.json');
5359
const corpusAll = filterImportedObject(loadCorpusData('corpus.json'));
5460
const corpusEncryptedExpectedAll = filterImportedObject(loadCorpusData('corpus-encrypted.json'));
5561

@@ -66,13 +72,23 @@ describe('Client Side Encryption Corpus', function () {
6672
]);
6773
const identifierMap = new Map([
6874
['local', corpusKeyLocal._id],
69-
['aws', corpusKeyAws._id]
75+
['aws', corpusKeyAws._id],
76+
['azure', corpusKeyAzure._id],
77+
['gcp', corpusKeyGcp._id]
7078
]);
7179
const keyAltNameMap = new Map([
7280
['local', 'local'],
73-
['aws', 'aws']
81+
['aws', 'aws'],
82+
['azure', 'azure'],
83+
['gcp', 'gcp']
84+
]);
85+
const copyOverValues = new Set([
86+
'_id',
87+
'altname_aws',
88+
'altname_local',
89+
'altname_azure',
90+
'altname_gcp'
7491
]);
75-
const copyOverValues = new Set(['_id', 'altname_aws', 'altname_local']);
7692

7793
let client;
7894

@@ -99,7 +115,7 @@ describe('Client Side Encryption Corpus', function () {
99115
break;
100116
}
101117
default: {
102-
throw new Error('how did you get here?');
118+
throw new Error('Unexpected algorithm: ' + expected.algo);
103119
}
104120
}
105121

@@ -119,7 +135,7 @@ describe('Client Side Encryption Corpus', function () {
119135
} else if (expected.allowed === false) {
120136
expect(actualJSON).to.deep.equal(expectedJSON);
121137
} else {
122-
throw new Error('how did you get here?');
138+
throw new Error('Unexpected value for allowed: ' + expected.allowed);
123139
}
124140
}
125141

@@ -136,7 +152,9 @@ describe('Client Side Encryption Corpus', function () {
136152
.then(() => keyDb.dropCollection(keyVaultCollName))
137153
.catch(() => {})
138154
.then(() => keyDb.collection(keyVaultCollName))
139-
.then(keyColl => keyColl.insertMany([corpusKeyLocal, corpusKeyAws]));
155+
.then(keyColl =>
156+
keyColl.insertMany([corpusKeyLocal, corpusKeyAws, corpusKeyAzure, corpusKeyGcp])
157+
);
140158
});
141159
});
142160

@@ -179,7 +197,7 @@ describe('Client Side Encryption Corpus', function () {
179197
// Configure both objects with ``keyVaultNamespace`` set to ``keyvault.datakeys``.
180198
const autoEncryption = {
181199
keyVaultNamespace,
182-
kmsProviders: this.configuration.kmsProviders(null, localKey)
200+
kmsProviders
183201
};
184202
if (useClientSideSchema) {
185203
autoEncryption.schemaMap = {
@@ -192,7 +210,7 @@ describe('Client Side Encryption Corpus', function () {
192210
clientEncryption = new mongodbClientEncryption.ClientEncryption(client, {
193211
bson: BSON,
194212
keyVaultNamespace,
195-
kmsProviders: this.configuration.kmsProviders(null, localKey)
213+
kmsProviders
196214
});
197215
});
198216
});
@@ -257,7 +275,7 @@ describe('Client Side Encryption Corpus', function () {
257275
} else if (field.identifier === 'altname') {
258276
encryptOptions.keyAltName = keyAltNameMap.get(field.kms);
259277
} else {
260-
throw new Error('wtf how did u get here?');
278+
throw new Error('Unexpected identifier: ' + field.identifier);
261279
}
262280

263281
return Promise.resolve()
@@ -282,7 +300,7 @@ describe('Client Side Encryption Corpus', function () {
282300
);
283301
}
284302

285-
throw new Error('how did u get here?');
303+
throw new Error('Unexpected method: ' + field.method);
286304
});
287305
})
288306
.then(() => {

0 commit comments

Comments
 (0)