Skip to content

Commit c514699

Browse files
kevinAlbskevinAlbs
authored
GODRIVER-2746 replace CreateEncryptedCollection DataKeyOpts with masterKey (#1169)
* run prose test 21 with "aws" and "local" KMS providers * replace CEC DataKeyOpts with masterKey
1 parent 599b80a commit c514699

File tree

2 files changed

+124
-96
lines changed

2 files changed

+124
-96
lines changed

‎mongo/client_encryption.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func NewClientEncryption(keyVaultClient *Client, opts ...*options.ClientEncrypti
7777
// It returns the created collection and the encrypted fields document used to create it.
7878
func (ce *ClientEncryption) CreateEncryptedCollection(ctx context.Context,
7979
db *Database, coll string, createOpts *options.CreateCollectionOptions,
80-
kmsProvider string, dkOpts *options.DataKeyOptions) (*Collection, bson.M, error) {
80+
kmsProvider string, masterKey interface{}) (*Collection, bson.M, error) {
8181
if createOpts == nil {
8282
return nil, nil, errors.New("nil CreateCollectionOptions")
8383
}
@@ -107,6 +107,10 @@ func (ce *ClientEncryption) CreateEncryptedCollection(ctx context.Context,
107107
if f, ok := field.(bson.M); !ok {
108108
continue
109109
} else if v, ok := f["keyId"]; ok && v == nil {
110+
dkOpts := options.DataKey()
111+
if masterKey != nil {
112+
dkOpts.SetMasterKey(masterKey)
113+
}
110114
keyid, err := ce.CreateDataKey(ctx, kmsProvider, dkOpts)
111115
if err != nil {
112116
createOpts.EncryptedFields = m

‎mongo/integration/client_side_encryption_prose_test.go

Lines changed: 119 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -2080,120 +2080,144 @@ func TestClientSideEncryptionProse(t *testing.T) {
20802080
return client, clientEnc, nil
20812081
}
20822082

2083-
mt.Run("case 1: simple creation and validation", func(mt *mtest.T) {
2084-
client, clientEnc, err := setup()
2085-
assert.Nil(mt, err, "setup error: %v", err)
2086-
defer func() {
2087-
err := clientEnc.Close(context.Background())
2088-
assert.Nil(mt, err, "error in Close")
2089-
}()
2083+
type KMSProviderTestcase struct {
2084+
kmsProvider string
2085+
masterKey *bson.D
2086+
}
2087+
2088+
testcases := []KMSProviderTestcase{
2089+
{
2090+
kmsProvider: "local",
2091+
masterKey: nil,
2092+
},
2093+
{
2094+
kmsProvider: "aws",
2095+
masterKey: &bson.D{
2096+
{"region", "us-east-1"},
2097+
{"key", "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0"},
2098+
},
2099+
},
2100+
}
20902101

2091-
var encryptedFields bson.Raw
2092-
err = bson.UnmarshalExtJSON([]byte(`{
2102+
for _, tc := range testcases {
2103+
mt.Run(tc.kmsProvider, func(mt *mtest.T) {
2104+
2105+
mt.Run("case 1: simple creation and validation", func(mt *mtest.T) {
2106+
client, clientEnc, err := setup()
2107+
assert.Nil(mt, err, "setup error: %v", err)
2108+
defer func() {
2109+
err := clientEnc.Close(context.Background())
2110+
assert.Nil(mt, err, "error in Close")
2111+
}()
2112+
2113+
var encryptedFields bson.Raw
2114+
err = bson.UnmarshalExtJSON([]byte(`{
20932115
"fields": [{
20942116
"path": "ssn",
20952117
"bsonType": "string",
20962118
"keyId": null
20972119
}]
20982120
}`), true /* canonical */, &encryptedFields)
2099-
assert.Nil(mt, err, "Unmarshal error: %v", err)
2100-
2101-
coll, _, err := clientEnc.CreateEncryptedCollection(
2102-
context.Background(),
2103-
client.Database("db"),
2104-
"testing1", options.CreateCollection().SetEncryptedFields(encryptedFields),
2105-
"local", nil,
2106-
)
2107-
assert.Nil(mt, err, "CreateCollection error: %v", err)
2108-
2109-
_, err = coll.InsertOne(context.Background(), bson.D{{"ssn", "123-45-6789"}})
2110-
assert.ErrorContains(mt, err, "Document failed validation")
2111-
})
2112-
mt.Run("case 2: missing encryptedFields", func(mt *mtest.T) {
2113-
client, clientEnc, err := setup()
2114-
assert.Nil(mt, err, "setup error: %v", err)
2115-
defer func() {
2116-
err := clientEnc.Close(context.Background())
2117-
assert.Nil(mt, err, "error in Close")
2118-
}()
2119-
2120-
coll, _, err := clientEnc.CreateEncryptedCollection(
2121-
context.Background(),
2122-
client.Database("db"),
2123-
"testing1", options.CreateCollection(),
2124-
"local", nil,
2125-
)
2126-
assert.Nil(mt, coll, "expect nil collection")
2127-
assert.EqualError(mt, err, "no EncryptedFields defined for the collection")
2128-
})
2129-
mt.Run("case 3: invalid keyId", func(mt *mtest.T) {
2130-
client, clientEnc, err := setup()
2131-
assert.Nil(mt, err, "setup error: %v", err)
2132-
defer func() {
2133-
err := clientEnc.Close(context.Background())
2134-
assert.Nil(mt, err, "error in Close")
2135-
}()
2136-
2137-
var encryptedFields bson.Raw
2138-
err = bson.UnmarshalExtJSON([]byte(`{
2121+
assert.Nil(mt, err, "Unmarshal error: %v", err)
2122+
2123+
coll, _, err := clientEnc.CreateEncryptedCollection(
2124+
context.Background(),
2125+
client.Database("db"),
2126+
"testing1", options.CreateCollection().SetEncryptedFields(encryptedFields),
2127+
"local", nil,
2128+
)
2129+
assert.Nil(mt, err, "CreateCollection error: %v", err)
2130+
2131+
_, err = coll.InsertOne(context.Background(), bson.D{{"ssn", "123-45-6789"}})
2132+
assert.ErrorContains(mt, err, "Document failed validation")
2133+
})
2134+
mt.Run("case 2: missing encryptedFields", func(mt *mtest.T) {
2135+
client, clientEnc, err := setup()
2136+
assert.Nil(mt, err, "setup error: %v", err)
2137+
defer func() {
2138+
err := clientEnc.Close(context.Background())
2139+
assert.Nil(mt, err, "error in Close")
2140+
}()
2141+
2142+
coll, _, err := clientEnc.CreateEncryptedCollection(
2143+
context.Background(),
2144+
client.Database("db"),
2145+
"testing1", options.CreateCollection(),
2146+
"local", nil,
2147+
)
2148+
assert.Nil(mt, coll, "expect nil collection")
2149+
assert.EqualError(mt, err, "no EncryptedFields defined for the collection")
2150+
})
2151+
mt.Run("case 3: invalid keyId", func(mt *mtest.T) {
2152+
client, clientEnc, err := setup()
2153+
assert.Nil(mt, err, "setup error: %v", err)
2154+
defer func() {
2155+
err := clientEnc.Close(context.Background())
2156+
assert.Nil(mt, err, "error in Close")
2157+
}()
2158+
2159+
var encryptedFields bson.Raw
2160+
err = bson.UnmarshalExtJSON([]byte(`{
21392161
"fields": [{
21402162
"path": "ssn",
21412163
"bsonType": "string",
21422164
"keyId": false
21432165
}]
21442166
}`), true /* canonical */, &encryptedFields)
2145-
assert.Nil(mt, err, "Unmarshal error: %v", err)
2146-
2147-
_, _, err = clientEnc.CreateEncryptedCollection(
2148-
context.Background(),
2149-
client.Database("db"),
2150-
"testing1", options.CreateCollection().SetEncryptedFields(encryptedFields),
2151-
"local", nil,
2152-
)
2153-
assert.ErrorContains(mt, err, "BSON field 'create.encryptedFields.fields.keyId' is the wrong type 'bool', expected type 'binData'")
2154-
})
2155-
mt.Run("case 4: insert encrypted value", func(mt *mtest.T) {
2156-
client, clientEnc, err := setup()
2157-
assert.Nil(mt, err, "setup error: %v", err)
2158-
defer func() {
2159-
err := clientEnc.Close(context.Background())
2160-
assert.Nil(mt, err, "error in Close")
2161-
}()
2162-
2163-
var encryptedFields bson.Raw
2164-
err = bson.UnmarshalExtJSON([]byte(`{
2167+
assert.Nil(mt, err, "Unmarshal error: %v", err)
2168+
2169+
_, _, err = clientEnc.CreateEncryptedCollection(
2170+
context.Background(),
2171+
client.Database("db"),
2172+
"testing1", options.CreateCollection().SetEncryptedFields(encryptedFields),
2173+
"local", nil,
2174+
)
2175+
assert.ErrorContains(mt, err, "BSON field 'create.encryptedFields.fields.keyId' is the wrong type 'bool', expected type 'binData'")
2176+
})
2177+
mt.Run("case 4: insert encrypted value", func(mt *mtest.T) {
2178+
client, clientEnc, err := setup()
2179+
assert.Nil(mt, err, "setup error: %v", err)
2180+
defer func() {
2181+
err := clientEnc.Close(context.Background())
2182+
assert.Nil(mt, err, "error in Close")
2183+
}()
2184+
2185+
var encryptedFields bson.Raw
2186+
err = bson.UnmarshalExtJSON([]byte(`{
21652187
"fields": [{
21662188
"path": "ssn",
21672189
"bsonType": "string",
21682190
"keyId": null
21692191
}]
21702192
}`), true /* canonical */, &encryptedFields)
2171-
assert.Nil(mt, err, "Unmarshal error: %v", err)
2172-
2173-
coll, ef, err := clientEnc.CreateEncryptedCollection(
2174-
context.Background(),
2175-
client.Database("db"),
2176-
"testing1", options.CreateCollection().SetEncryptedFields(encryptedFields),
2177-
"local", nil,
2178-
)
2179-
assert.Nil(mt, err, "CreateCollection error: %v", err)
2180-
2181-
keyid := ef["fields"].(bson.A)[0].(bson.M)["keyId"].(primitive.Binary)
2182-
rawValueType, rawValueData, err := bson.MarshalValue("123-45-6789")
2183-
assert.Nil(mt, err, "MarshalValue error: %v", err)
2184-
rawValue := bson.RawValue{Type: rawValueType, Value: rawValueData}
2185-
encryptionOpts := options.Encrypt().
2186-
SetAlgorithm("Unindexed").
2187-
SetKeyID(keyid)
2188-
encryptedField, err := clientEnc.Encrypt(
2189-
context.Background(),
2190-
rawValue,
2191-
encryptionOpts)
2192-
assert.Nil(mt, err, "Encrypt error: %v", err)
2193-
2194-
_, err = coll.InsertOne(context.Background(), bson.D{{"ssn", encryptedField}})
2195-
assert.Nil(mt, err, "InsertOne error: %v", err)
2196-
})
2193+
assert.Nil(mt, err, "Unmarshal error: %v", err)
2194+
2195+
coll, ef, err := clientEnc.CreateEncryptedCollection(
2196+
context.Background(),
2197+
client.Database("db"),
2198+
"testing1", options.CreateCollection().SetEncryptedFields(encryptedFields),
2199+
"local", nil,
2200+
)
2201+
assert.Nil(mt, err, "CreateCollection error: %v", err)
2202+
2203+
keyid := ef["fields"].(bson.A)[0].(bson.M)["keyId"].(primitive.Binary)
2204+
rawValueType, rawValueData, err := bson.MarshalValue("123-45-6789")
2205+
assert.Nil(mt, err, "MarshalValue error: %v", err)
2206+
rawValue := bson.RawValue{Type: rawValueType, Value: rawValueData}
2207+
encryptionOpts := options.Encrypt().
2208+
SetAlgorithm("Unindexed").
2209+
SetKeyID(keyid)
2210+
encryptedField, err := clientEnc.Encrypt(
2211+
context.Background(),
2212+
rawValue,
2213+
encryptionOpts)
2214+
assert.Nil(mt, err, "Encrypt error: %v", err)
2215+
2216+
_, err = coll.InsertOne(context.Background(), bson.D{{"ssn", encryptedField}})
2217+
assert.Nil(mt, err, "InsertOne error: %v", err)
2218+
})
2219+
})
2220+
}
21972221
})
21982222

21992223
rangeRunOpts := mtest.NewOptions().MinServerVersion("6.2").Topologies(mtest.ReplicaSet, mtest.Sharded, mtest.LoadBalanced, mtest.ShardedReplicaSet)

0 commit comments

Comments
 (0)