Skip to content

Commit ee2967b

Browse files
ShaneHarveyShaneHarvey
committed
PYTHON-2608 Test that KMS TLS connections verify peer certificates (mongodb#667)
Use bash for all evergreen scripts. (cherry picked from commit 834500d)
1 parent ef718b5 commit ee2967b

File tree

5 files changed

+79
-13
lines changed

5 files changed

+79
-13
lines changed

‎.evergreen/config.yml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@ functions:
291291
DISABLE_TEST_COMMANDS=${DISABLE_TEST_COMMANDS} \
292292
ORCHESTRATION_FILE=${ORCHESTRATION_FILE} \
293293
REQUIRE_API_VERSION=${REQUIRE_API_VERSION} \
294-
sh ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
294+
bash ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
295295
# run-orchestration generates expansion file with the MONGODB_URI for the cluster
296296
- command: expansions.update
297297
params:
@@ -309,23 +309,23 @@ functions:
309309
script: |
310310
set -o xtrace
311311
${PREPARE_SHELL}
312-
sh ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/build-mongohouse-local.sh
312+
bash ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/build-mongohouse-local.sh
313313
- command: shell.exec
314314
type: setup
315315
params:
316316
background: true
317317
script: |
318318
set -o xtrace
319319
${PREPARE_SHELL}
320-
sh ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/run-mongohouse-local.sh
320+
bash ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/run-mongohouse-local.sh
321321
322322
"stop mongo-orchestration":
323323
- command: shell.exec
324324
params:
325325
script: |
326326
set -o xtrace
327327
${PREPARE_SHELL}
328-
sh ${DRIVERS_TOOLS}/.evergreen/stop-orchestration.sh
328+
bash ${DRIVERS_TOOLS}/.evergreen/stop-orchestration.sh
329329
330330
"run mod_wsgi tests":
331331
- command: shell.exec
@@ -335,7 +335,7 @@ functions:
335335
script: |
336336
set -o xtrace
337337
${PREPARE_SHELL}
338-
PYTHON_BINARY=${PYTHON_BINARY} MOD_WSGI_VERSION=${MOD_WSGI_VERSION} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} sh ${PROJECT_DIRECTORY}/.evergreen/run-mod-wsgi-tests.sh
338+
PYTHON_BINARY=${PYTHON_BINARY} MOD_WSGI_VERSION=${MOD_WSGI_VERSION} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-mod-wsgi-tests.sh
339339
340340
"run mockupdb tests":
341341
- command: shell.exec
@@ -345,7 +345,7 @@ functions:
345345
script: |
346346
set -o xtrace
347347
${PREPARE_SHELL}
348-
PYTHON_BINARY=${PYTHON_BINARY} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} sh ${PROJECT_DIRECTORY}/.evergreen/run-mockupdb-tests.sh
348+
PYTHON_BINARY=${PYTHON_BINARY} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-mockupdb-tests.sh
349349
350350
"run cdecimal tests":
351351
- command: shell.exec
@@ -365,7 +365,7 @@ functions:
365365
script: |
366366
set -o xtrace
367367
${PREPARE_SHELL}
368-
PYTHON_BINARY=${PYTHON_BINARY} sh ${PROJECT_DIRECTORY}/.evergreen/run-doctests.sh
368+
PYTHON_BINARY=${PYTHON_BINARY} bash ${PROJECT_DIRECTORY}/.evergreen/run-doctests.sh
369369
370370
"run tests":
371371
- command: shell.exec
@@ -434,7 +434,7 @@ functions:
434434
SSL=${SSL} \
435435
DATA_LAKE=${DATA_LAKE} \
436436
MONGODB_API_VERSION=${MONGODB_API_VERSION} \
437-
sh ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh
437+
bash ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh
438438
439439
"run enterprise auth tests":
440440
- command: shell.exec
@@ -444,7 +444,7 @@ functions:
444444
working_dir: "src"
445445
script: |
446446
# DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
447-
PYTHON_BINARY=${PYTHON_BINARY} SASL_HOST=${sasl_host} SASL_PORT=${sasl_port} SASL_USER=${sasl_user} SASL_PASS=${sasl_pass} SASL_DB=${sasl_db} PRINCIPAL=${principal} GSSAPI_DB=${gssapi_db} KEYTAB_BASE64=${keytab_base64} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} sh ${PROJECT_DIRECTORY}/.evergreen/run-enterprise-auth-tests.sh
447+
PYTHON_BINARY=${PYTHON_BINARY} SASL_HOST=${sasl_host} SASL_PORT=${sasl_port} SASL_USER=${sasl_user} SASL_PASS=${sasl_pass} SASL_DB=${sasl_db} PRINCIPAL=${principal} GSSAPI_DB=${gssapi_db} KEYTAB_BASE64=${keytab_base64} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-enterprise-auth-tests.sh
448448
449449
"run atlas tests":
450450
- command: shell.exec
@@ -714,7 +714,7 @@ functions:
714714
${PREPARE_SHELL}
715715
file="${PROJECT_DIRECTORY}/.evergreen/install-dependencies.sh"
716716
# Don't use ${file} syntax here because evergreen treats it as an empty expansion.
717-
[ -f "$file" ] && sh $file || echo "$file not available, skipping"
717+
[ -f "$file" ] && bash $file || echo "$file not available, skipping"
718718
719719
"run-ocsp-test":
720720
- command: shell.exec
@@ -726,7 +726,7 @@ functions:
726726
PYTHON_BINARY=${PYTHON_BINARY} \
727727
CA_FILE="$DRIVERS_TOOLS/.evergreen/ocsp/${OCSP_ALGORITHM}/ca.pem" \
728728
OCSP_TLS_SHOULD_SUCCEED="${OCSP_TLS_SHOULD_SUCCEED}" \
729-
sh ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-tests.sh
729+
bash ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-tests.sh
730730
731731
run-valid-ocsp-server:
732732
- command: shell.exec

‎.evergreen/install-dependencies.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/bin/sh
1+
#!/bin/bash
22
set -o xtrace # Write all commands first to stderr
33
set -o errexit # Exit the script with error if any of the commands fail
44

‎.evergreen/run-mod-wsgi-tests.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/bin/sh
1+
#!/bin/bash
22
set -o xtrace
33
set -o errexit
44

‎.evergreen/run-tests.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,15 @@ if [ -n "$TEST_ENCRYPTION" ]; then
164164
# Get access to the AWS temporary credentials:
165165
# CSFLE_AWS_TEMP_ACCESS_KEY_ID, CSFLE_AWS_TEMP_SECRET_ACCESS_KEY, CSFLE_AWS_TEMP_SESSION_TOKEN
166166
. $DRIVERS_TOOLS/.evergreen/csfle/set-temp-creds.sh
167+
168+
# Start the mock KMS servers.
169+
if [ "$OS" != "Windows_NT" ]; then
170+
pushd ${DRIVERS_TOOLS}/.evergreen/csfle
171+
python -u lib/kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/expired.pem --port 8000 &
172+
python -u lib/kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/wrong-host.pem --port 8001 &
173+
trap 'kill $(jobs -p)' EXIT HUP
174+
popd
175+
fi
167176
fi
168177

169178
PYTHON_IMPL=$($PYTHON -c "import platform, sys; sys.stdout.write(platform.python_implementation())")

‎test/test_encryption.py

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import os
2020
import traceback
2121
import socket
22+
import ssl
2223
import sys
2324
import textwrap
2425
import uuid
@@ -50,6 +51,7 @@
5051
WriteError)
5152
from pymongo.mongo_client import MongoClient
5253
from pymongo.operations import InsertOne
54+
from pymongo.ssl_support import _ssl
5355
from pymongo.write_concern import WriteConcern
5456

5557
from test import unittest, IntegrationTest, PyMongoTestCase, client_context
@@ -61,6 +63,7 @@
6163
rs_or_single_client,
6264
wait_until)
6365
from test.utils_spec_runner import SpecRunner
66+
from test.test_ssl import CA_PEM
6467

6568

6669
def get_client_opts(client):
@@ -1630,5 +1633,59 @@ def test_bypassAutoEncryption(self):
16301633
mongocryptd_client.admin.command('ping')
16311634

16321635

1636+
# https://github.com/mongodb/specifications/tree/master/source/client-side-encryption/tests#kms-tls-tests
1637+
class TestKmsTLSProse(EncryptionIntegrationTest):
1638+
@unittest.skipIf(sys.platform == 'win32',
1639+
"Can't test system ca certs on Windows")
1640+
@unittest.skipIf(ssl.OPENSSL_VERSION.lower().startswith('libressl') and
1641+
sys.platform == 'darwin' and not _ssl.IS_PYOPENSSL,
1642+
"LibreSSL on OSX doesn't support setting CA certificates "
1643+
"using SSL_CERT_FILE environment variable.")
1644+
@unittest.skipUnless(any(AWS_CREDS.values()),
1645+
'AWS environment credentials are not set')
1646+
def setUp(self):
1647+
self.original_certs = os.environ.get('SSL_CERT_FILE')
1648+
def restore_certs():
1649+
if self.original_certs is None:
1650+
os.environ.pop('SSL_CERT_FILE')
1651+
else:
1652+
os.environ['SSL_CERT_FILE'] = self.original_certs
1653+
# Tell OpenSSL where CA certificates live.
1654+
os.environ['SSL_CERT_FILE'] = CA_PEM
1655+
self.addCleanup(restore_certs)
1656+
1657+
self.client_encrypted = ClientEncryption(
1658+
{'aws': AWS_CREDS}, 'keyvault.datakeys', self.client, OPTS)
1659+
self.addCleanup(self.client_encrypted.close)
1660+
1661+
def test_invalid_kms_certificate_expired(self):
1662+
key = {
1663+
"region": "us-east-1",
1664+
"key": "arn:aws:kms:us-east-1:579766882180:key/"
1665+
"89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
1666+
"endpoint": "mongodb://127.0.0.1:8000",
1667+
}
1668+
# Some examples:
1669+
# certificate verify failed: certificate has expired (_ssl.c:1129)
1670+
# amazon1-2018 Python 3.6: certificate verify failed (_ssl.c:852)
1671+
with self.assertRaisesRegex(
1672+
EncryptionError, 'expired|certificate verify failed'):
1673+
self.client_encrypted.create_data_key('aws', master_key=key)
1674+
1675+
def test_invalid_hostname_in_kms_certificate(self):
1676+
key = {
1677+
"region": "us-east-1",
1678+
"key": "arn:aws:kms:us-east-1:579766882180:key/"
1679+
"89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
1680+
"endpoint": "mongodb://127.0.0.1:8001",
1681+
}
1682+
# Some examples:
1683+
# certificate verify failed: IP address mismatch, certificate is not valid for '127.0.0.1'. (_ssl.c:1129)"
1684+
# hostname '127.0.0.1' doesn't match 'wronghost.com'
1685+
with self.assertRaisesRegex(
1686+
EncryptionError, 'IP address mismatch|wronghost'):
1687+
self.client_encrypted.create_data_key('aws', master_key=key)
1688+
1689+
16331690
if __name__ == "__main__":
16341691
unittest.main()

0 commit comments

Comments
 (0)