PYTHON-3096 Finish implementation and tests for GSSAPI options (mongodb#1985)

Author: blink1073

.evergreen/scripts/run-enterprise-auth-tests.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
+set -eu
 
 # Disable xtrace for security reasons (just in case it was accidentally set).
 set +x
 # Use the default python to bootstrap secrets.
-PYTHON_BINARY="" bash "${DRIVERS_TOOLS}"/.evergreen/auth_aws/setup_secrets.sh drivers/enterprise_auth
+bash "${DRIVERS_TOOLS}"/.evergreen/secrets_handling/setup-secrets.sh drivers/enterprise_auth
 TEST_ENTERPRISE_AUTH=1 AUTH=auth bash "${PROJECT_DIRECTORY}"/.evergreen/hatch.sh test:test-eg

doc/contributors.rst

@@ -103,3 +103,4 @@ The following is a list of people who have contributed to
 - Terry Patterson
 - Romain Morotti
 - Navjot Singh (navjots18)
+- Yuval Zaif (zaif-yuval)

pymongo/asynchronous/auth.py

@@ -177,13 +177,20 @@ def _auth_key(nonce: str, username: str, password: str) -> str:
     return md5hash.hexdigest()
 
 
-def _canonicalize_hostname(hostname: str) -> str:
+def _canonicalize_hostname(hostname: str, option: str | bool) -> str:
     """Canonicalize hostname following MIT-krb5 behavior."""
     # https://github.com/krb5/krb5/blob/d406afa363554097ac48646a29249c04f498c88e/src/util/k5test.py#L505-L520
+    if option in [False, "none"]:
+        return hostname
+
     af, socktype, proto, canonname, sockaddr = socket.getaddrinfo(
         hostname, None, 0, 0, socket.IPPROTO_TCP, socket.AI_CANONNAME
     )[0]
 
+    # For forward just to resolve the cname as dns.lookup() will not return it.
+    if option == "forward":
+        return canonname.lower()
+
     try:
         name = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD)
     except socket.gaierror:
@@ -205,9 +212,8 @@ async def _authenticate_gssapi(credentials: MongoCredential, conn: AsyncConnecti
         props = credentials.mechanism_properties
         # Starting here and continuing through the while loop below - establish
         # the security context. See RFC 4752, Section 3.1, first paragraph.
-        host = conn.address[0]
-        if props.canonicalize_host_name:
-            host = _canonicalize_hostname(host)
+        host = props.service_host or conn.address[0]
+        host = _canonicalize_hostname(host, props.canonicalize_host_name)
         service = props.service_name + "@" + host
         if props.service_realm is not None:
             service = service + "@" + props.service_realm

pymongo/asynchronous/pool.py

@@ -121,6 +121,12 @@ def _set_non_inheritable_non_atomic(fd: int) -> None:  # noqa: ARG001
         """Dummy function for platforms that don't provide fcntl."""
 
 
+try:
+    from python_socks import ProxyType
+    from python_socks.sync import Proxy
+except ImportError:
+    Proxy = ProxyType = None
+
 _IS_SYNC = False
 
 _MAX_TCP_KEEPIDLE = 120
@@ -838,7 +844,21 @@ def _create_connection(address: _Address, options: PoolOptions) -> socket.socket
             sock.settimeout(timeout)
             sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, True)
             _set_keepalive_times(sock)
-            sock.connect(sa)
+            if proxy := options.proxy:
+                if Proxy is None:
+                    raise RuntimeError(
+                        "In order to use SOCKS5 proxy, python_socks must be installed. "
+                        "This can be done by re-installing pymongo with `pip install pymongo[socks]`"
+                    )
+                proxy_host = proxy["host"]
+                proxy_port = proxy["port"] or 1080
+                sock.connect((proxy_host, proxy_port))
+                proxy = Proxy(
+                    ProxyType.SOCKS5, proxy_host, proxy_port, proxy["username"], proxy["password"]
+                )
+                proxy.connect(sa[0], dest_port=sa[1], _socket=sock)
+            else:
+                sock.connect(sa)
             return sock
         except OSError as e:
             err = e

pymongo/asynchronous/topology.py

@@ -967,6 +967,7 @@ def _create_pool_for_monitor(self, address: _Address) -> Pool:
             driver=options.driver,
             pause_enabled=False,
             server_api=options.server_api,
+            proxy=options.proxy,
         )
 
         return self._settings.pool_class(

pymongo/client_options.py

@@ -170,6 +170,15 @@ def _parse_pool_options(
     ssl_context, tls_allow_invalid_hostnames = _parse_ssl_options(options)
     load_balanced = options.get("loadbalanced")
     max_connecting = options.get("maxconnecting", common.MAX_CONNECTING)
+    if proxy_host := options.get("proxyHost"):
+        proxy = {
+            "host": proxy_host,
+            "port": options.get("proxyPort"),
+            "username": options.get("proxyUserName"),
+            "password": options.get("proxyPassword"),
+        }
+    else:
+        proxy = None
     return PoolOptions(
         max_pool_size,
         min_pool_size,
@@ -188,6 +197,7 @@ def _parse_pool_options(
         load_balanced=load_balanced,
         credentials=credentials,
         is_sync=is_sync,
+        proxy=proxy,
     )
 
 

pymongo/common.py

@@ -729,6 +729,10 @@ def validate_server_monitoring_mode(option: str, value: str) -> str:
     "srvmaxhosts": validate_non_negative_integer,
     "timeoutms": validate_timeoutms,
     "servermonitoringmode": validate_server_monitoring_mode,
+    "proxyhost": validate_string,
+    "proxyport": validate_positive_integer_or_none,
+    "proxyusername": validate_string_or_none,
+    "proxypassword": validate_string_or_none,
 }
 
 # Dictionary where keys are the names of URI options specific to pymongo,

pymongo/pool_options.py

@@ -312,6 +312,7 @@ class PoolOptions:
         "__server_api",
         "__load_balanced",
         "__credentials",
+        "__proxy",
     )
 
     def __init__(
@@ -334,6 +335,7 @@ def __init__(
         load_balanced: Optional[bool] = None,
         credentials: Optional[MongoCredential] = None,
         is_sync: Optional[bool] = True,
+        proxy: Optional[dict] = None,
     ):
         self.__max_pool_size = max_pool_size
         self.__min_pool_size = min_pool_size
@@ -353,7 +355,7 @@ def __init__(
         self.__load_balanced = load_balanced
         self.__credentials = credentials
         self.__metadata = copy.deepcopy(_METADATA)
-
+        self.__proxy = copy.deepcopy(proxy)
         if appname:
             self.__metadata["application"] = {"name": appname}
 
@@ -522,3 +524,8 @@ def server_api(self) -> Optional[ServerApi]:
     def load_balanced(self) -> Optional[bool]:
         """True if this Pool is configured in load balanced mode."""
         return self.__load_balanced
+
+    @property
+    def proxy(self) -> Optional[dict]:
+        """Proxy settings, if configured"""
+        return self.__proxy

pymongo/synchronous/auth.py

@@ -174,13 +174,20 @@ def _auth_key(nonce: str, username: str, password: str) -> str:
     return md5hash.hexdigest()
 
 
-def _canonicalize_hostname(hostname: str) -> str:
+def _canonicalize_hostname(hostname: str, option: str | bool) -> str:
     """Canonicalize hostname following MIT-krb5 behavior."""
     # https://github.com/krb5/krb5/blob/d406afa363554097ac48646a29249c04f498c88e/src/util/k5test.py#L505-L520
+    if option in [False, "none"]:
+        return hostname
+
     af, socktype, proto, canonname, sockaddr = socket.getaddrinfo(
         hostname, None, 0, 0, socket.IPPROTO_TCP, socket.AI_CANONNAME
     )[0]
 
+    # For forward just to resolve the cname as dns.lookup() will not return it.
+    if option == "forward":
+        return canonname.lower()
+
     try:
         name = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD)
     except socket.gaierror:
@@ -202,9 +209,8 @@ def _authenticate_gssapi(credentials: MongoCredential, conn: Connection) -> None
         props = credentials.mechanism_properties
         # Starting here and continuing through the while loop below - establish
         # the security context. See RFC 4752, Section 3.1, first paragraph.
-        host = conn.address[0]
-        if props.canonicalize_host_name:
-            host = _canonicalize_hostname(host)
+        host = props.service_host or conn.address[0]
+        host = _canonicalize_hostname(host, props.canonicalize_host_name)
         service = props.service_name + "@" + host
         if props.service_realm is not None:
             service = service + "@" + props.service_realm

pymongo/synchronous/pool.py

@@ -121,6 +121,12 @@ def _set_non_inheritable_non_atomic(fd: int) -> None:  # noqa: ARG001
         """Dummy function for platforms that don't provide fcntl."""
 
 
+try:
+    from python_socks import ProxyType
+    from python_socks.sync import Proxy
+except ImportError:
+    Proxy = ProxyType = None
+
 _IS_SYNC = True
 
 _MAX_TCP_KEEPIDLE = 120
@@ -836,7 +842,21 @@ def _create_connection(address: _Address, options: PoolOptions) -> socket.socket
             sock.settimeout(timeout)
             sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, True)
             _set_keepalive_times(sock)
-            sock.connect(sa)
+            if proxy := options.proxy:
+                if Proxy is None:
+                    raise RuntimeError(
+                        "In order to use SOCKS5 proxy, python_socks must be installed. "
+                        "This can be done by re-installing pymongo with `pip install pymongo[socks]`"
+                    )
+                proxy_host = proxy["host"]
+                proxy_port = proxy["port"] or 1080
+                sock.connect((proxy_host, proxy_port))
+                proxy = Proxy(
+                    ProxyType.SOCKS5, proxy_host, proxy_port, proxy["username"], proxy["password"]
+                )
+                proxy.connect(sa[0], dest_port=sa[1], _socket=sock)
+            else:
+                sock.connect(sa)
             return sock
         except OSError as e:
             err = e