Skip to content

Commit 33c8d31

Browse files
eramongodberamongodb
authored
CDRIVER-3927 add KMS TLS tests for client side encryption (#879)
* Support detailed certificate verify failure errors with OpenSSL * Support detailed certificate verify failure errors with Secure Channel * Move CSE tests into conditional compilation under MONGOC_ENABLE_SSL * Add Client Side Encryption KMS TLS tests * Fix CA certificate registration failure on Windows * Fix CA certificate registration failure on Red Hat * Add mock KMS servers to Evergreen * Document mock KMS server requirements for CSFLE tests * Disable CSE tests on RHEL until resolution of BUILD-14068
1 parent b2e1ae0 commit 33c8d31

13 files changed

+638
-188
lines changed

‎.evergreen/config.yml

Lines changed: 104 additions & 20 deletions
Large diffs are not rendered by default.

‎.evergreen/run-tests.sh

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,35 @@ fi
3131
if [ "$SSL" != "nossl" ]; then
3232
export MONGOC_TEST_SSL_WEAK_CERT_VALIDATION="off"
3333
export MONGOC_TEST_SSL_PEM_FILE="src/libmongoc/tests/x509gen/client.pem"
34-
sudo cp src/libmongoc/tests/x509gen/ca.pem /usr/local/share/ca-certificates/cdriver.crt || true
35-
if [ -f /usr/local/share/ca-certificates/cdriver.crt ]; then
36-
sudo update-ca-certificates
37-
else
38-
export MONGOC_TEST_SSL_CA_FILE="src/libmongoc/tests/x509gen/ca.pem"
39-
fi
34+
35+
case "$OS" in
36+
cygwin*)
37+
certutil.exe -addstore "Root" "src\libmongoc\tests\x509gen\ca.pem"
38+
;;
39+
*)
40+
if [ -f /etc/redhat-release ]; then
41+
echo "Copying CA certificate to /usr/share/pki/ca-trust-source/anchors..."
42+
sudo cp -v src/libmongoc/tests/x509gen/ca.pem /usr/share/pki/ca-trust-source/anchors/cdriver.crt || true
43+
if [ -f /usr/share/pki/ca-trust-source/anchors/cdriver.crt ]; then
44+
echo "Copying CA certificate to /usr/share/pki/ca-trust-source/anchors... done."
45+
sudo update-ca-trust extract --verbose
46+
else
47+
echo "Copying CA certificate to /usr/share/pki/ca-trust-source/anchors... failed."
48+
export MONGOC_TEST_SSL_CA_FILE="src/libmongoc/tests/x509gen/ca.pem"
49+
fi
50+
else
51+
echo "Copying CA certificate to /usr/local/share/ca-certificates..."
52+
sudo cp -v src/libmongoc/tests/x509gen/ca.pem /usr/local/share/ca-certificates/cdriver.crt || true
53+
if [ -f /usr/local/share/ca-certificates/cdriver.crt ]; then
54+
echo "Copying CA certificate to /usr/local/share/ca-certificates... done."
55+
sudo update-ca-certificates --verbose
56+
else
57+
echo "Copying CA certificate to /usr/local/share/ca-certificates... failed."
58+
export MONGOC_TEST_SSL_CA_FILE="src/libmongoc/tests/x509gen/ca.pem"
59+
fi
60+
fi
61+
;;
62+
esac
4063
fi
4164

4265
export MONGOC_ENABLE_MAJORITY_READ_CONCERN=on

‎CONTRIBUTING.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,15 @@ start mongocryptd on port 27020 and set the following:
251251

252252
* `MONGOC_TEST_MONGOCRYPTD_BYPASS_SPAWN=on`
253253

254+
KMS TLS tests for Client-Side Field Level Encryption require mock KMS servers to be running in the background according to the instructions given in the Client Side Encryption Tests specification.
255+
The set of mock KMS servers running in the background and their corresponding port number, CA file, and cert file must be as follows:
256+
257+
| Port | CA File | Cert File |
258+
| --- | --- | --- |
259+
| 7999 | ca.pem | server.pem |
260+
| 8000 | ca.pem | expired.pem |
261+
| 8001 | ca.pem | wrong-host.pem |
262+
254263
Specification tests may be filtered by their description:
255264

256265
* `MONGOC_JSON_SUBTEST=<string>`

‎build/evergreen_config_lib/functions.py

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -556,6 +556,15 @@
556556
fi
557557
''', test=False)
558558
)),
559+
('run kms servers', Function(
560+
shell_exec(r'''
561+
cd ./drivers-evergreen-tools/.evergreen/csfle
562+
. ./activate_venv.sh
563+
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/server.pem --port 7999 &
564+
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/expired.pem --port 8000 &
565+
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/wrong-host.pem --port 8001 &
566+
''', test=False, background=True),
567+
)),
559568
('start load balancer', Function(
560569
shell_exec(r'''
561570
export DRIVERS_TOOLS=./drivers-evergreen-tools

‎build/evergreen_config_lib/tasks.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,8 @@ def to_dict(self):
548548
extra = {}
549549
if self.cse:
550550
extra["CLIENT_SIDE_ENCRYPTION"] = "on"
551+
commands.append(func('clone drivers-evergreen-tools'))
552+
commands.append(func('run kms servers'))
551553
commands.append(run_tests(VALGRIND=self.on_off('valgrind'),
552554
ASAN='on' if self.sanitizer == 'asan' else 'off',
553555
AUTH=self.display('auth'),

‎build/evergreen_config_lib/variants.py

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -226,8 +226,8 @@ def days(n):
226226
'.debug-compile !.sspi .openssl',
227227
'.debug-compile !.sspi .nossl',
228228
'.authentication-tests .openssl',
229-
'.latest .openssl !.nosasl .server',
230-
'.latest .nossl'],
229+
'.latest .openssl !.nosasl .server !.client-side-encryption',
230+
'.latest .nossl !.client-side-encryption'],
231231
{'CC': 'gcc'}),
232232
Variant('gcc48rhel',
233233
'GCC 4.8 (RHEL 7.0)',
@@ -241,14 +241,14 @@ def days(n):
241241
'.authentication-tests .openssl',
242242
'.latest .openssl !.nosasl .server',
243243
'.latest .nossl',
244-
'.5.0 .openssl !.nosasl .server',
245-
'.4.4 .openssl !.nosasl .server',
246-
'.4.2 .openssl !.nosasl .server',
247-
'.4.0 .openssl !.nosasl .server',
248-
'.3.6 .openssl !.nosasl .server',
249-
'.3.4 .openssl !.nosasl .server',
250-
'.3.2 .openssl !.nosasl .server',
251-
'.3.0 .openssl !.nosasl !.auth'],
244+
'.5.0 .openssl !.nosasl .server !.client-side-encryption',
245+
'.4.4 .openssl !.nosasl .server !.client-side-encryption',
246+
'.4.2 .openssl !.nosasl .server !.client-side-encryption',
247+
'.4.0 .openssl !.nosasl .server !.client-side-encryption',
248+
'.3.6 .openssl !.nosasl .server !.client-side-encryption',
249+
'.3.4 .openssl !.nosasl .server !.client-side-encryption',
250+
'.3.2 .openssl !.nosasl .server !.client-side-encryption',
251+
'.3.0 .openssl !.nosasl !.auth !.client-side-encryption'],
252252
{'CC': 'gcc'}),
253253
Variant('gcc49',
254254
'GCC 4.9 (Debian 8.1)',
@@ -499,12 +499,12 @@ def days(n):
499499
'.debug-compile !.sspi .openssl',
500500
'.debug-compile !.sspi .openssl-static',
501501
'.debug-compile !.sspi .nossl',
502-
'.latest .openssl !.nosasl .server',
503-
'.latest .openssl-static !.nosasl .server',
502+
'.latest .openssl !.nosasl .server !.client-side-encryption',
503+
'.latest .openssl-static !.nosasl .server !.client-side-encryption',
504504
'.latest .nossl',
505-
'.5.0 .openssl !.nosasl .server',
506-
'.4.4 .openssl !.nosasl .server',
507-
'.4.2 .openssl !.nosasl .server',
505+
'.5.0 .openssl !.nosasl .server !.client-side-encryption',
506+
'.4.4 .openssl !.nosasl .server !.client-side-encryption',
507+
'.4.2 .openssl !.nosasl .server !.client-side-encryption',
508508
'test-dns-openssl'],
509509
{'CC': 'gcc'},
510510
batchtime=days(1)),
@@ -552,12 +552,12 @@ def days(n):
552552
'.debug-compile !.sspi .openssl',
553553
'.debug-compile !.sspi .nossl',
554554
'.authentication-tests .openssl',
555-
'.latest .openssl !.nosasl .server',
555+
'.latest .openssl !.nosasl .server !.client-side-encryption',
556556
'.latest .nossl',
557-
'.5.0 .openssl !.nosasl .server',
558-
'.4.4 .openssl !.nosasl .server',
559-
'.4.2 .openssl !.nosasl .server',
560-
'.4.0 .openssl !.nosasl .server'],
557+
'.5.0 .openssl !.nosasl .server !.client-side-encryption',
558+
'.4.4 .openssl !.nosasl .server !.client-side-encryption',
559+
'.4.2 .openssl !.nosasl .server !.client-side-encryption',
560+
'.4.0 .openssl !.nosasl .server !.client-side-encryption'],
561561
{'CC': 'gcc'},
562562
batchtime=days(1)),
563563
# Note, do not use Ubuntu 16.04 for valgrind, as the system valgrind

‎src/libmongoc/CMakeLists.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -939,7 +939,6 @@ set (test-libmongoc-sources
939939
${PROJECT_SOURCE_DIR}/tests/test-mongoc-change-stream.c
940940
${PROJECT_SOURCE_DIR}/tests/test-mongoc-client-pool.c
941941
${PROJECT_SOURCE_DIR}/tests/test-mongoc-client-session.c
942-
${PROJECT_SOURCE_DIR}/tests/test-mongoc-client-side-encryption.c
943942
${PROJECT_SOURCE_DIR}/tests/test-mongoc-client.c
944943
${PROJECT_SOURCE_DIR}/tests/test-mongoc-cluster.c
945944
${PROJECT_SOURCE_DIR}/tests/test-mongoc-cmd.c
@@ -1024,6 +1023,7 @@ set (test-libmongoc-sources
10241023
if (MONGOC_ENABLE_SSL)
10251024
set (test-libmongoc-sources ${test-libmongoc-sources}
10261025
${PROJECT_SOURCE_DIR}/tests/ssl-test.c
1026+
${PROJECT_SOURCE_DIR}/tests/test-mongoc-client-side-encryption.c
10271027
${PROJECT_SOURCE_DIR}/tests/test-mongoc-stream-tls-error.c
10281028
${PROJECT_SOURCE_DIR}/tests/test-mongoc-stream-tls.c
10291029
${PROJECT_SOURCE_DIR}/tests/test-mongoc-x509.c

‎src/libmongoc/src/mongoc/mongoc-secure-channel-private.h

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,13 +74,16 @@ mongoc_secure_channel_realloc_buf (size_t *size,
7474

7575
bool
7676
mongoc_secure_channel_handshake_step_1 (mongoc_stream_tls_t *tls,
77-
char *hostname);
77+
char *hostname,
78+
bson_error_t *error);
7879
bool
7980
mongoc_secure_channel_handshake_step_2 (mongoc_stream_tls_t *tls,
80-
char *hostname);
81+
char *hostname,
82+
bson_error_t *error);
8183
bool
8284
mongoc_secure_channel_handshake_step_3 (mongoc_stream_tls_t *tls,
83-
char *hostname);
85+
char *hostname,
86+
bson_error_t *error);
8487

8588

8689
BSON_END_DECLS

0 commit comments

Comments
 (0)