Skip to content

PYTHON-2096 Validate that mongocryptd is not spawned if bypassAutoEncryption=true #668

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 9, 2021
Merged

PYTHON-2096 Validate that mongocryptd is not spawned if bypassAutoEncryption=true #668

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions test/test_encryption.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
from bson.json_util import JSONOptions
from bson.son import SON

from pymongo import encryption
from pymongo.cursor import CursorType
from pymongo.encryption import (Algorithm,
ClientEncryption)
Expand All @@ -44,6 +45,7 @@
EncryptionError,
InvalidOperation,
OperationFailure,
ServerSelectionTimeoutError,
WriteError)
from pymongo.mongo_client import MongoClient
from pymongo.operations import InsertOne
Expand Down Expand Up @@ -1576,5 +1578,51 @@ def test_case_8(self):
self.assertEqual(len(self.topology_listener.results['opened']), 1)


# https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/tests/README.rst#bypass-spawning-mongocryptd
class TestBypassSpawningMongocryptdProse(EncryptionIntegrationTest):
def test_mongocryptd_bypass_spawn(self):
# Lower the mongocryptd timeout to reduce the test run time.
self._original_timeout = encryption._MONGOCRYPTD_TIMEOUT_MS
encryption._MONGOCRYPTD_TIMEOUT_MS = 500
def reset_timeout():
encryption._MONGOCRYPTD_TIMEOUT_MS = self._original_timeout
self.addCleanup(reset_timeout)

# Configure the encrypted field via the local schema_map option.
schemas = {'db.coll': json_data('external', 'external-schema.json')}
opts = AutoEncryptionOpts(
{'local': {'key': LOCAL_MASTER_KEY}},
'keyvault.datakeys',
schema_map=schemas,
mongocryptd_bypass_spawn=True,
mongocryptd_uri='mongodb://localhost:27027/',
mongocryptd_spawn_args=[
'--pidfilepath=bypass-spawning-mongocryptd.pid',
'--port=27027']
)
client_encrypted = rs_or_single_client(auto_encryption_opts=opts)
self.addCleanup(client_encrypted.close)
with self.assertRaisesRegex(EncryptionError, 'Timeout'):
client_encrypted.db.coll.insert_one({'encrypted': 'test'})

def test_bypassAutoEncryption(self):
opts = AutoEncryptionOpts(
{'local': {'key': LOCAL_MASTER_KEY}},
'keyvault.datakeys',
bypass_auto_encryption=True,
mongocryptd_spawn_args=[
'--pidfilepath=bypass-spawning-mongocryptd.pid',
'--port=27027']
)
client_encrypted = rs_or_single_client(auto_encryption_opts=opts)
self.addCleanup(client_encrypted.close)
client_encrypted.db.coll.insert_one({"unencrypted": "test"})
# Validate that mongocryptd was not spawned:
mongocryptd_client = MongoClient(
'mongodb://localhost:27027/?serverSelectionTimeoutMS=500')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor nit, feel free to ignore: suggest parameterizing the port number and using it here and in the mongocryptd_spawn_args definition to ensure they are always the same.

with self.assertRaises(ServerSelectionTimeoutError):
mongocryptd_client.admin.command('ping')


if __name__ == "__main__":
unittest.main()