Skip to content

Commit b18c756

Browse files
abr-egnabr-egn
authored
RUST-1442 Azure KMS integration test (#875)
1 parent 9b70ffa commit b18c756

File tree

6 files changed

+180
-4
lines changed

6 files changed

+180
-4
lines changed

‎.evergreen/azure-kms-test/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Cargo.lock
2+
target

‎.evergreen/azure-kms-test/Cargo.toml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[package]
2+
name = "azure-kms-test"
3+
version = "0.1.0"
4+
edition = "2021"
5+
6+
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
7+
8+
[dependencies]
9+
tokio = "1.28.1"
10+
11+
[dependencies.mongodb]
12+
path = "../.."
13+
features = ["in-use-encryption-unstable", "azure-kms"]

‎.evergreen/azure-kms-test/src/main.rs

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
use mongodb::{
2+
bson::doc,
3+
Client, client_encryption::{ClientEncryption, MasterKey}, mongocrypt::ctx::KmsProvider, Namespace,
4+
error::Result,
5+
};
6+
7+
#[tokio::main]
8+
async fn main() -> Result<()> {
9+
let c = ClientEncryption::new(
10+
Client::with_uri_str("mongodb://localhost:27017").await?,
11+
Namespace::new("keyvault", "datakeys"),
12+
[(KmsProvider::Azure, doc! { }, None)],
13+
)?;
14+
15+
c.create_data_key(MasterKey::Azure {
16+
key_vault_endpoint: "https://keyvault-drivers-2411.vault.azure.net/keys/".to_string(),
17+
key_name: "KEY-NAME".to_string(),
18+
key_version: None,
19+
})
20+
.run()
21+
.await?;
22+
23+
println!("Azure KMS integration test passed!");
24+
25+
Ok(())
26+
}

‎.evergreen/config.yml

Lines changed: 83 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1246,6 +1246,16 @@ tasks:
12461246
- func: "build csfle expansions"
12471247
- func: "run csfle serverless tests"
12481248

1249+
- name: "test-azure-kms"
1250+
commands:
1251+
- command: shell.exec
1252+
params:
1253+
working_dir: "src"
1254+
script: |
1255+
${PREPARE_SHELL}
1256+
${AZURE_SHELL}
1257+
.evergreen/run-azure-kms-test.sh
1258+
12491259
- name: "test-atlas-connectivity"
12501260
tags: ["atlas-connect"]
12511261
commands:
@@ -1851,7 +1861,70 @@ task_groups:
18511861

18521862
tasks:
18531863
- ".serverless"
1854-
1864+
1865+
- name: azurekms_task_group
1866+
setup_group_can_fail_task: true
1867+
setup_group_timeout_secs: 1800 # 30 minutes
1868+
setup_group:
1869+
- func: "fetch source"
1870+
- func: "prepare resources"
1871+
- func: "windows fix"
1872+
- func: "fix absolute paths"
1873+
- func: "init test-results"
1874+
- func: "make files executable"
1875+
- func: "install rust"
1876+
- func: "install libmongocrypt"
1877+
- command: shell.exec
1878+
params:
1879+
shell: bash
1880+
script: |-
1881+
${PREPARE_SHELL}
1882+
set +o xtrace
1883+
echo '${testazurekms_publickey}' > /tmp/testazurekms_publickey
1884+
echo '${testazurekms_privatekey}' > /tmp/testazurekms_privatekey
1885+
# Set 600 permissions on private key file. Otherwise ssh / scp may error with permissions "are too open".
1886+
chmod 600 /tmp/testazurekms_privatekey
1887+
export AZUREKMS_CLIENTID=${testazurekms_clientid}
1888+
export AZUREKMS_TENANTID=${testazurekms_tenantid}
1889+
export AZUREKMS_SECRET=${testazurekms_secret}
1890+
export AZUREKMS_DRIVERS_TOOLS=$DRIVERS_TOOLS
1891+
export AZUREKMS_RESOURCEGROUP=${testazurekms_resourcegroup}
1892+
export AZUREKMS_PUBLICKEYPATH=/tmp/testazurekms_publickey
1893+
export AZUREKMS_PRIVATEKEYPATH=/tmp/testazurekms_privatekey
1894+
export AZUREKMS_SCOPE=${testazurekms_scope}
1895+
export AZUREKMS_VMNAME_PREFIX=rustdriver
1896+
set -o xtrace
1897+
$DRIVERS_TOOLS/.evergreen/csfle/azurekms/create-and-setup-vm.sh
1898+
- command: expansions.update
1899+
params:
1900+
file: testazurekms-expansions.yml
1901+
- command: shell.exec
1902+
params:
1903+
shell: bash
1904+
script: |-
1905+
cat <<EOT > azure_shell.yml
1906+
AZURE_SHELL: |
1907+
export AZUREKMS_VMNAME=${AZUREKMS_VMNAME}
1908+
export AZUREKMS_RESOURCEGROUP=${testazurekms_resourcegroup}
1909+
export AZUREKMS_PRIVATEKEYPATH=/tmp/testazurekms_privatekey
1910+
EOT
1911+
- command: expansions.update
1912+
params:
1913+
file: azure_shell.yml
1914+
teardown_group:
1915+
- command: expansions.update
1916+
params:
1917+
file: testazurekms-expansions.yml
1918+
- command: shell.exec
1919+
params:
1920+
shell: bash
1921+
script: |-
1922+
${PREPARE_SHELL}
1923+
${AZURE_SHELL}
1924+
set -o errexit
1925+
$DRIVERS_TOOLS/.evergreen/csfle/azurekms/delete-vm.sh
1926+
tasks:
1927+
- test-azure-kms
18551928

18561929
buildvariants:
18571930
-
@@ -2159,8 +2232,7 @@ buildvariants:
21592232
- ".6.0 .standalone"
21602233
- ".5.0 .standalone"
21612234

2162-
-
2163-
name: "lint"
2235+
- name: "lint"
21642236
display_name: "! Lint"
21652237
run_on:
21662238
- ubuntu1804-test
@@ -2171,3 +2243,11 @@ buildvariants:
21712243
- name: "check-manual"
21722244
- name: "check-cargo-deny"
21732245

2246+
- matrix_name: "azure-kms"
2247+
display_name: "Azure KMS"
2248+
matrix_spec:
2249+
os:
2250+
- ubuntu-20.04
2251+
tasks:
2252+
- name: "azurekms_task_group"
2253+
batchtime: 20160

‎.evergreen/run-azure-kms-test.sh

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/usr/bin/env bash
2+
3+
set -o errexit
4+
set -o pipefail
5+
6+
source ./.evergreen/configure-rust.sh
7+
8+
set -o xtrace
9+
10+
AZUREKMS_TOOLS=$DRIVERS_TOOLS/.evergreen/csfle/azurekms/
11+
12+
mkdir azurekms_remote
13+
cp -r $MONGOCRYPT_LIB_DIR azurekms_remote
14+
15+
pushd .evergreen/azure-kms-test
16+
cargo build
17+
popd
18+
cp .evergreen/azure-kms-test/target/debug/azure-kms-test azurekms_remote
19+
20+
tar czf azurekms_remote.tgz azurekms_remote
21+
AZUREKMS_SRC=azurekms_remote.tgz \
22+
AZUREKMS_DST="." \
23+
$AZUREKMS_TOOLS/copy-file.sh
24+
AZUREKMS_CMD="tar xvf azurekms_remote.tgz" $AZUREKMS_TOOLS/run-command.sh
25+
AZUREKMS_CMD="LD_LIBRARY_PATH=./azurekms_remote/lib ./azurekms_remote/azure-kms-test" \
26+
$AZUREKMS_TOOLS/run-command.sh

‎src/test/csfle.rs

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2931,7 +2931,36 @@ async fn azure_imds() -> Result<()> {
29312931
Ok(())
29322932
}
29332933

2934-
// TODO RUST-1442: implement prose test 19. Azure IMDS Credentials Integration Test
2934+
// Prose test 19. Azure IMDS Credentials Integration Test (case 1: failure)
2935+
#[cfg(feature = "azure-kms")]
2936+
#[cfg_attr(feature = "tokio-runtime", tokio::test)]
2937+
#[cfg_attr(feature = "async-std-runtime", async_std::test)]
2938+
async fn azure_imds_integration_failure() -> Result<()> {
2939+
if !check_env("azure_imds_integration_failure", false) {
2940+
return Ok(());
2941+
}
2942+
let _guard = LOCK.run_concurrently().await;
2943+
2944+
let c = ClientEncryption::new(
2945+
Client::test_builder().build().await.into_client(),
2946+
KV_NAMESPACE.clone(),
2947+
[(KmsProvider::Azure, doc! {}, None)],
2948+
)?;
2949+
2950+
let result = c
2951+
.create_data_key(MasterKey::Azure {
2952+
key_vault_endpoint: "https://keyvault-drivers-2411.vault.azure.net/keys/".to_string(),
2953+
key_name: "KEY-NAME".to_string(),
2954+
key_version: None,
2955+
})
2956+
.run()
2957+
.await;
2958+
2959+
assert!(result.is_err(), "expected error, got {:?}", result);
2960+
assert!(result.unwrap_err().is_auth_error());
2961+
2962+
Ok(())
2963+
}
29352964

29362965
// Prose test 20. Bypass creating mongocryptd client when shared library is loaded
29372966
#[cfg_attr(feature = "tokio-runtime", tokio::test)]

0 commit comments

Comments
 (0)