Skip to content

Commit 8d27699

Browse files
blink1073blink1073
authored
PYTHON-3096 Finish implementation and tests for GSSAPI options (#1985)
1 parent b3ce932 commit 8d27699

File tree

5 files changed

+144
-19
lines changed

5 files changed

+144
-19
lines changed

‎.evergreen/scripts/run-enterprise-auth-tests.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
#!/bin/bash
2+
set -eu
23

34
# Disable xtrace for security reasons (just in case it was accidentally set).
45
set +x
56
# Use the default python to bootstrap secrets.
6-
PYTHON_BINARY="" bash "${DRIVERS_TOOLS}"/.evergreen/auth_aws/setup_secrets.sh drivers/enterprise_auth
7+
bash "${DRIVERS_TOOLS}"/.evergreen/secrets_handling/setup-secrets.sh drivers/enterprise_auth
78
TEST_ENTERPRISE_AUTH=1 AUTH=auth bash "${PROJECT_DIRECTORY}"/.evergreen/hatch.sh test:test-eg

‎pymongo/asynchronous/auth.py‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -177,13 +177,20 @@ def _auth_key(nonce: str, username: str, password: str) -> str:
177177
return md5hash.hexdigest()
178178

179179

180-
def _canonicalize_hostname(hostname: str) -> str:
180+
def _canonicalize_hostname(hostname: str, option: str | bool) -> str:
181181
"""Canonicalize hostname following MIT-krb5 behavior."""
182182
# https://github.com/krb5/krb5/blob/d406afa363554097ac48646a29249c04f498c88e/src/util/k5test.py#L505-L520
183+
if option in [False, "none"]:
184+
return hostname
185+
183186
af, socktype, proto, canonname, sockaddr = socket.getaddrinfo(
184187
hostname, None, 0, 0, socket.IPPROTO_TCP, socket.AI_CANONNAME
185188
)[0]
186189

190+
# For forward just to resolve the cname as dns.lookup() will not return it.
191+
if option == "forward":
192+
return canonname.lower()
193+
187194
try:
188195
name = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD)
189196
except socket.gaierror:
@@ -205,9 +212,8 @@ async def _authenticate_gssapi(credentials: MongoCredential, conn: AsyncConnecti
205212
props = credentials.mechanism_properties
206213
# Starting here and continuing through the while loop below - establish
207214
# the security context. See RFC 4752, Section 3.1, first paragraph.
208-
host = conn.address[0]
209-
if props.canonicalize_host_name:
210-
host = _canonicalize_hostname(host)
215+
host = props.service_host or conn.address[0]
216+
host = _canonicalize_hostname(host, props.canonicalize_host_name)
211217
service = props.service_name + "@" + host
212218
if props.service_realm is not None:
213219
service = service + "@" + props.service_realm

‎pymongo/synchronous/auth.py‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -174,13 +174,20 @@ def _auth_key(nonce: str, username: str, password: str) -> str:
174174
return md5hash.hexdigest()
175175

176176

177-
def _canonicalize_hostname(hostname: str) -> str:
177+
def _canonicalize_hostname(hostname: str, option: str | bool) -> str:
178178
"""Canonicalize hostname following MIT-krb5 behavior."""
179179
# https://github.com/krb5/krb5/blob/d406afa363554097ac48646a29249c04f498c88e/src/util/k5test.py#L505-L520
180+
if option in [False, "none"]:
181+
return hostname
182+
180183
af, socktype, proto, canonname, sockaddr = socket.getaddrinfo(
181184
hostname, None, 0, 0, socket.IPPROTO_TCP, socket.AI_CANONNAME
182185
)[0]
183186

187+
# For forward just to resolve the cname as dns.lookup() will not return it.
188+
if option == "forward":
189+
return canonname.lower()
190+
184191
try:
185192
name = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD)
186193
except socket.gaierror:
@@ -202,9 +209,8 @@ def _authenticate_gssapi(credentials: MongoCredential, conn: Connection) -> None
202209
props = credentials.mechanism_properties
203210
# Starting here and continuing through the while loop below - establish
204211
# the security context. See RFC 4752, Section 3.1, first paragraph.
205-
host = conn.address[0]
206-
if props.canonicalize_host_name:
207-
host = _canonicalize_hostname(host)
212+
host = props.service_host or conn.address[0]
213+
host = _canonicalize_hostname(host, props.canonicalize_host_name)
208214
service = props.service_name + "@" + host
209215
if props.service_realm is not None:
210216
service = service + "@" + props.service_realm

‎test/asynchronous/test_auth.py‎

Lines changed: 61 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
import pytest
3636

3737
from pymongo import AsyncMongoClient, monitoring
38-
from pymongo.asynchronous.auth import HAVE_KERBEROS
38+
from pymongo.asynchronous.auth import HAVE_KERBEROS, _canonicalize_hostname
3939
from pymongo.auth_shared import _build_credentials_tuple
4040
from pymongo.errors import OperationFailure
4141
from pymongo.hello import HelloCompat
@@ -96,10 +96,11 @@ def setUpClass(cls):
9696
cls.service_realm_required = (
9797
GSSAPI_SERVICE_REALM is not None and GSSAPI_SERVICE_REALM not in GSSAPI_PRINCIPAL
9898
)
99-
mech_properties = f"SERVICE_NAME:{GSSAPI_SERVICE_NAME}"
100-
mech_properties += f",CANONICALIZE_HOST_NAME:{GSSAPI_CANONICALIZE}"
99+
mech_properties = dict(
100+
SERVICE_NAME=GSSAPI_SERVICE_NAME, CANONICALIZE_HOST_NAME=GSSAPI_CANONICALIZE
101+
)
101102
if GSSAPI_SERVICE_REALM is not None:
102-
mech_properties += f",SERVICE_REALM:{GSSAPI_SERVICE_REALM}"
103+
mech_properties["SERVICE_REALM"] = GSSAPI_SERVICE_REALM
103104
cls.mech_properties = mech_properties
104105

105106
async def test_credentials_hashing(self):
@@ -167,7 +168,10 @@ async def test_gssapi_simple(self):
167168
await client[GSSAPI_DB].collection.find_one()
168169

169170
# Log in using URI, with authMechanismProperties.
170-
mech_uri = uri + f"&authMechanismProperties={self.mech_properties}"
171+
mech_properties_str = ""
172+
for key, value in self.mech_properties.items():
173+
mech_properties_str += f"{key}:{value},"
174+
mech_uri = uri + f"&authMechanismProperties={mech_properties_str[:-1]}"
171175
client = self.simple_client(mech_uri)
172176
await client[GSSAPI_DB].collection.find_one()
173177

@@ -268,6 +272,58 @@ async def test_gssapi_threaded(self):
268272
thread.join()
269273
self.assertTrue(thread.success)
270274

275+
async def test_gssapi_canonicalize_host_name(self):
276+
# Test the low level method.
277+
assert GSSAPI_HOST is not None
278+
result = _canonicalize_hostname(GSSAPI_HOST, "forward")
279+
if "compute-1.amazonaws.com" not in result:
280+
self.assertEqual(result, GSSAPI_HOST)
281+
result = _canonicalize_hostname(GSSAPI_HOST, "forwardAndReverse")
282+
self.assertEqual(result, GSSAPI_HOST)
283+
284+
# Use the equivalent named CANONICALIZE_HOST_NAME.
285+
props = self.mech_properties.copy()
286+
if props["CANONICALIZE_HOST_NAME"] == "true":
287+
props["CANONICALIZE_HOST_NAME"] = "forwardAndReverse"
288+
else:
289+
props["CANONICALIZE_HOST_NAME"] = "none"
290+
client = self.simple_client(
291+
GSSAPI_HOST,
292+
GSSAPI_PORT,
293+
username=GSSAPI_PRINCIPAL,
294+
password=GSSAPI_PASS,
295+
authMechanism="GSSAPI",
296+
authMechanismProperties=props,
297+
)
298+
await client.server_info()
299+
300+
async def test_gssapi_host_name(self):
301+
props = self.mech_properties
302+
props["SERVICE_HOST"] = "example.com"
303+
304+
# Authenticate with authMechanismProperties.
305+
client = self.simple_client(
306+
GSSAPI_HOST,
307+
GSSAPI_PORT,
308+
username=GSSAPI_PRINCIPAL,
309+
password=GSSAPI_PASS,
310+
authMechanism="GSSAPI",
311+
authMechanismProperties=self.mech_properties,
312+
)
313+
with self.assertRaises(OperationFailure):
314+
await client.server_info()
315+
316+
props["SERVICE_HOST"] = GSSAPI_HOST
317+
client = self.simple_client(
318+
GSSAPI_HOST,
319+
GSSAPI_PORT,
320+
username=GSSAPI_PRINCIPAL,
321+
password=GSSAPI_PASS,
322+
authMechanism="GSSAPI",
323+
authMechanismProperties=self.mech_properties,
324+
)
325+
await client.server_info()
326+
271327

272328
class TestSASLPlain(AsyncPyMongoTestCase):
273329
@classmethod

‎test/test_auth.py‎

Lines changed: 61 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
from pymongo.hello import HelloCompat
4141
from pymongo.read_preferences import ReadPreference
4242
from pymongo.saslprep import HAVE_STRINGPREP
43-
from pymongo.synchronous.auth import HAVE_KERBEROS
43+
from pymongo.synchronous.auth import HAVE_KERBEROS, _canonicalize_hostname
4444

4545
_IS_SYNC = True
4646

@@ -96,10 +96,11 @@ def setUpClass(cls):
9696
cls.service_realm_required = (
9797
GSSAPI_SERVICE_REALM is not None and GSSAPI_SERVICE_REALM not in GSSAPI_PRINCIPAL
9898
)
99-
mech_properties = f"SERVICE_NAME:{GSSAPI_SERVICE_NAME}"
100-
mech_properties += f",CANONICALIZE_HOST_NAME:{GSSAPI_CANONICALIZE}"
99+
mech_properties = dict(
100+
SERVICE_NAME=GSSAPI_SERVICE_NAME, CANONICALIZE_HOST_NAME=GSSAPI_CANONICALIZE
101+
)
101102
if GSSAPI_SERVICE_REALM is not None:
102-
mech_properties += f",SERVICE_REALM:{GSSAPI_SERVICE_REALM}"
103+
mech_properties["SERVICE_REALM"] = GSSAPI_SERVICE_REALM
103104
cls.mech_properties = mech_properties
104105

105106
def test_credentials_hashing(self):
@@ -167,7 +168,10 @@ def test_gssapi_simple(self):
167168
client[GSSAPI_DB].collection.find_one()
168169

169170
# Log in using URI, with authMechanismProperties.
170-
mech_uri = uri + f"&authMechanismProperties={self.mech_properties}"
171+
mech_properties_str = ""
172+
for key, value in self.mech_properties.items():
173+
mech_properties_str += f"{key}:{value},"
174+
mech_uri = uri + f"&authMechanismProperties={mech_properties_str[:-1]}"
171175
client = self.simple_client(mech_uri)
172176
client[GSSAPI_DB].collection.find_one()
173177

@@ -268,6 +272,58 @@ def test_gssapi_threaded(self):
268272
thread.join()
269273
self.assertTrue(thread.success)
270274

275+
def test_gssapi_canonicalize_host_name(self):
276+
# Test the low level method.
277+
assert GSSAPI_HOST is not None
278+
result = _canonicalize_hostname(GSSAPI_HOST, "forward")
279+
if "compute-1.amazonaws.com" not in result:
280+
self.assertEqual(result, GSSAPI_HOST)
281+
result = _canonicalize_hostname(GSSAPI_HOST, "forwardAndReverse")
282+
self.assertEqual(result, GSSAPI_HOST)
283+
284+
# Use the equivalent named CANONICALIZE_HOST_NAME.
285+
props = self.mech_properties.copy()
286+
if props["CANONICALIZE_HOST_NAME"] == "true":
287+
props["CANONICALIZE_HOST_NAME"] = "forwardAndReverse"
288+
else:
289+
props["CANONICALIZE_HOST_NAME"] = "none"
290+
client = self.simple_client(
291+
GSSAPI_HOST,
292+
GSSAPI_PORT,
293+
username=GSSAPI_PRINCIPAL,
294+
password=GSSAPI_PASS,
295+
authMechanism="GSSAPI",
296+
authMechanismProperties=props,
297+
)
298+
client.server_info()
299+
300+
def test_gssapi_host_name(self):
301+
props = self.mech_properties
302+
props["SERVICE_HOST"] = "example.com"
303+
304+
# Authenticate with authMechanismProperties.
305+
client = self.simple_client(
306+
GSSAPI_HOST,
307+
GSSAPI_PORT,
308+
username=GSSAPI_PRINCIPAL,
309+
password=GSSAPI_PASS,
310+
authMechanism="GSSAPI",
311+
authMechanismProperties=self.mech_properties,
312+
)
313+
with self.assertRaises(OperationFailure):
314+
client.server_info()
315+
316+
props["SERVICE_HOST"] = GSSAPI_HOST
317+
client = self.simple_client(
318+
GSSAPI_HOST,
319+
GSSAPI_PORT,
320+
username=GSSAPI_PRINCIPAL,
321+
password=GSSAPI_PASS,
322+
authMechanism="GSSAPI",
323+
authMechanismProperties=self.mech_properties,
324+
)
325+
client.server_info()
326+
271327

272328
class TestSASLPlain(PyMongoTestCase):
273329
@classmethod

0 commit comments

Comments
 (0)