Skip to content

Commit 701bd46

Browse files
qingyang-huqingyang-hu
committed
fix tests
1 parent 00e69f5 commit 701bd46

File tree

2 files changed

+114
-41
lines changed

2 files changed

+114
-41
lines changed

‎.evergreen/config.yml‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -554,9 +554,6 @@ functions:
554554
args: [*task-runner, evg-test-kmip]
555555

556556
start-kms-failpoint-server:
557-
- command: ec2.assume_role
558-
params:
559-
role_arn: ${aws_test_secrets_role}
560557
- command: subprocess.exec
561558
params:
562559
working_dir: src/go.mongodb.org/mongo-driver
@@ -578,15 +575,15 @@ functions:
578575
binary: "bash"
579576
env:
580577
GO_BUILD_TAGS: cse
581-
include_expansions_in_env: [AUTH, SSL, MONGODB_URI, TOPOLOGY,
582-
MONGO_GO_DRIVER_COMPRESSOR]
578+
include_expansions_in_env: [AUTH, SSL, MONGODB_URI, TOPOLOGY, MONGO_GO_DRIVER_COMPRESSOR]
583579
args: [*task-runner, setup-test]
584580
- command: subprocess.exec
585581
type: test
586582
params:
587583
binary: "bash"
588584
env:
589-
KMS_FAILPOINT_SERVERS_RUNNING: "true"
585+
KMS_FAILPOINT_CA_FILE: "${DRIVERS_TOOLS}/.evergreen/x509gen/ca.pem"
586+
KMS_FAILPOINT_SERVER_RUNNING: "true"
590587
args: [*task-runner, evg-test-retry-kms-requests]
591588

592589
run-fuzz-tests:
@@ -1532,10 +1529,6 @@ tasks:
15321529
SSL: "nossl"
15331530
- func: start-kms-failpoint-server
15341531
- func: run-retry-kms-requests
1535-
vars:
1536-
TOPOLOGY: "server"
1537-
AUTH: "noauth"
1538-
SSL: "nossl"
15391532

15401533
- name: "test-serverless"
15411534
tags: ["serverless"]

‎internal/integration/client_side_encryption_prose_test.go‎

Lines changed: 111 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2983,13 +2983,23 @@ func TestClientSideEncryptionProse(t *testing.T) {
29832983
})
29842984

29852985
mt.RunOpts("24. kms retry tests", noClientOpts, func(mt *mtest.T) {
2986-
kmsTlsTestcase := os.Getenv("KMS_FAILPOINT_SERVERS_RUNNING")
2986+
kmsTlsTestcase := os.Getenv("KMS_FAILPOINT_SERVER_RUNNING")
29872987
if kmsTlsTestcase == "" {
2988-
mt.Skipf("Skipping test as KMS_FAILPOINT_SERVERS_RUNNING is not set")
2988+
mt.Skipf("Skipping test as KMS_FAILPOINT_SERVER_RUNNING is not set")
29892989
}
29902990

2991-
tlsCfg := &tls.Config{
2992-
InsecureSkipVerify: true,
2991+
mt.Parallel()
2992+
2993+
var tlsCfg *tls.Config
2994+
if tlsCAFile := os.Getenv("KMS_FAILPOINT_CA_FILE"); tlsCAFile == "" {
2995+
require.Fail(mt, "failed to load CA file")
2996+
} else {
2997+
var err error
2998+
clientAndCATlsMap := map[string]interface{}{
2999+
"tlsCAFile": tlsCAFile,
3000+
}
3001+
tlsCfg, err = options.BuildTLSConfig(clientAndCATlsMap)
3002+
require.Nil(mt, err, "BuildTLSConfig error: %v", err)
29933003
}
29943004

29953005
setFailPoint := func(failure string, count int) error {
@@ -3012,39 +3022,109 @@ func TestClientSideEncryptionProse(t *testing.T) {
30123022
return res.Body.Close()
30133023
}
30143024

3015-
keyVaultClient, err := mongo.Connect(options.Client().ApplyURI(mtest.ClusterURI()))
3016-
require.NoError(mt, err, "error on Connect: %v", err)
3017-
3018-
ceo := options.ClientEncryption().
3019-
SetKeyVaultNamespace("keyvault.datakeys").
3020-
SetKmsProviders(fullKmsProvidersMap).
3021-
SetTLSConfig(map[string]*tls.Config{"aws": tlsCfg})
3022-
clientEncryption, err := mongo.NewClientEncryption(keyVaultClient, ceo)
3023-
require.NoError(mt, err, "error on NewClientEncryption: %v", err)
3024-
3025-
err = setFailPoint("network", 1)
3026-
require.NoError(mt, err, "mock server error: %v", err)
3025+
kmsProviders := map[string]map[string]interface{}{
3026+
"aws": {
3027+
"accessKeyId": awsAccessKeyID,
3028+
"secretAccessKey": awsSecretAccessKey,
3029+
},
3030+
"azure": {
3031+
"tenantId": azureTenantID,
3032+
"clientId": azureClientID,
3033+
"clientSecret": azureClientSecret,
3034+
"identityPlatformEndpoint": "127.0.0.1:9003",
3035+
},
3036+
"gcp": {
3037+
"email": gcpEmail,
3038+
"privateKey": gcpPrivateKey,
3039+
"endpoint": "127.0.0.1:9003",
3040+
},
3041+
}
30273042

3028-
dkOpts := options.DataKey().SetMasterKey(
3029-
bson.D{
3043+
dataKeys := []struct {
3044+
provider string
3045+
masterKey interface{}
3046+
}{
3047+
{"aws", bson.D{
30303048
{"region", "foo"},
30313049
{"key", "bar"},
30323050
{"endpoint", "127.0.0.1:9003"},
3033-
},
3034-
)
3035-
var keyID bson.Binary
3036-
keyID, err = clientEncryption.CreateDataKey(context.Background(), "aws", dkOpts)
3037-
require.NoError(mt, err, "error in CreateDataKey: %v", err)
3051+
}},
3052+
{"azure", bson.D{
3053+
{"keyVaultEndpoint", "127.0.0.1:9003"},
3054+
{"keyName", "foo"},
3055+
}},
3056+
{"gcp", bson.D{
3057+
{"projectId", "foo"},
3058+
{"location", "bar"},
3059+
{"keyRing", "baz"},
3060+
{"keyName", "qux"},
3061+
{"endpoint", "127.0.0.1:9003"},
3062+
}},
3063+
}
30383064

3039-
err = setFailPoint("network", 1)
3040-
require.NoError(mt, err, "mock server error: %v", err)
3065+
testCases := []struct {
3066+
name string
3067+
failure string
3068+
}{
3069+
{"Case 1: createDataKey and encrypt with TCP retry", "network"},
3070+
{"Case 2: createDataKey and encrypt with HTTP retry", "http"},
3071+
}
30413072

3042-
testVal := bson.RawValue{Type: bson.TypeInt32, Value: bsoncore.AppendInt32(nil, 123)}
3043-
eo := options.Encrypt().
3044-
SetKeyID(keyID).
3045-
SetAlgorithm("AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic")
3046-
_, err = clientEncryption.Encrypt(context.Background(), testVal, eo)
3047-
assert.NoError(mt, err, "error in Encrypt: %v", err)
3073+
for _, tc := range testCases {
3074+
for _, dataKey := range dataKeys {
3075+
mt.Run(fmt.Sprintf("%s_%s", tc.name, dataKey.provider), func(mt *mtest.T) {
3076+
keyVaultClient, err := mongo.Connect(options.Client().ApplyURI(mtest.ClusterURI()))
3077+
require.NoError(mt, err, "error on Connect: %v", err)
3078+
3079+
ceo := options.ClientEncryption().
3080+
SetKeyVaultNamespace(kvNamespace).
3081+
SetKmsProviders(kmsProviders).
3082+
SetTLSConfig(map[string]*tls.Config{dataKey.provider: tlsCfg})
3083+
clientEncryption, err := mongo.NewClientEncryption(keyVaultClient, ceo)
3084+
require.NoError(mt, err, "error on NewClientEncryption: %v", err)
3085+
3086+
err = setFailPoint(tc.failure, 1)
3087+
require.NoError(mt, err, "mock server error: %v", err)
3088+
3089+
dkOpts := options.DataKey().SetMasterKey(dataKey.masterKey)
3090+
var keyID bson.Binary
3091+
keyID, err = clientEncryption.CreateDataKey(context.Background(), dataKey.provider, dkOpts)
3092+
require.NoError(mt, err, "error in CreateDataKey: %v", err)
3093+
3094+
err = setFailPoint(tc.failure, 1)
3095+
require.NoError(mt, err, "mock server error: %v", err)
3096+
3097+
testVal := bson.RawValue{Type: bson.TypeInt32, Value: bsoncore.AppendInt32(nil, 123)}
3098+
eo := options.Encrypt().
3099+
SetKeyID(keyID).
3100+
SetAlgorithm("AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic")
3101+
_, err = clientEncryption.Encrypt(context.Background(), testVal, eo)
3102+
assert.NoError(mt, err, "error in Encrypt: %v", err)
3103+
})
3104+
}
3105+
}
3106+
3107+
for _, dataKey := range dataKeys {
3108+
mt.Run(fmt.Sprintf("Case 3: createDataKey fails after too many retries_%s", dataKey.provider), func(mt *mtest.T) {
3109+
keyVaultClient, err := mongo.Connect(options.Client().ApplyURI(mtest.ClusterURI()))
3110+
require.NoError(mt, err, "error on Connect: %v", err)
3111+
3112+
ceo := options.ClientEncryption().
3113+
SetKeyVaultNamespace(kvNamespace).
3114+
SetKmsProviders(fullKmsProvidersMap).
3115+
SetTLSConfig(map[string]*tls.Config{dataKey.provider: tlsCfg})
3116+
clientEncryption, err := mongo.NewClientEncryption(keyVaultClient, ceo)
3117+
require.NoError(mt, err, "error on NewClientEncryption: %v", err)
3118+
3119+
err = setFailPoint("network", 4)
3120+
require.NoError(mt, err, "mock server error: %v", err)
3121+
3122+
dkOpts := options.DataKey().SetMasterKey(dataKey.masterKey)
3123+
_, err = clientEncryption.CreateDataKey(context.Background(), dataKey.provider, dkOpts)
3124+
require.Error(mt, err)
3125+
mt.Logf("CreateDataKey error: %v", err)
3126+
})
3127+
}
30483128
})
30493129
}
30503130

0 commit comments

Comments
 (0)