Skip to content

Commit 834500d

Browse files
ShaneHarveyShaneHarvey
authored
PYTHON-2608 Test that KMS TLS connections verify peer certificates (#667)
Use bash for all evergreen scripts.
1 parent 98b64ee commit 834500d

File tree

5 files changed

+79
-13
lines changed

5 files changed

+79
-13
lines changed

‎.evergreen/config.yml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ functions:
292292
DISABLE_TEST_COMMANDS=${DISABLE_TEST_COMMANDS} \
293293
ORCHESTRATION_FILE=${ORCHESTRATION_FILE} \
294294
REQUIRE_API_VERSION=${REQUIRE_API_VERSION} \
295-
sh ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
295+
bash ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
296296
# run-orchestration generates expansion file with the MONGODB_URI for the cluster
297297
- command: expansions.update
298298
params:
@@ -310,23 +310,23 @@ functions:
310310
script: |
311311
set -o xtrace
312312
${PREPARE_SHELL}
313-
sh ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/build-mongohouse-local.sh
313+
bash ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/build-mongohouse-local.sh
314314
- command: shell.exec
315315
type: setup
316316
params:
317317
background: true
318318
script: |
319319
set -o xtrace
320320
${PREPARE_SHELL}
321-
sh ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/run-mongohouse-local.sh
321+
bash ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/run-mongohouse-local.sh
322322
323323
"stop mongo-orchestration":
324324
- command: shell.exec
325325
params:
326326
script: |
327327
set -o xtrace
328328
${PREPARE_SHELL}
329-
sh ${DRIVERS_TOOLS}/.evergreen/stop-orchestration.sh
329+
bash ${DRIVERS_TOOLS}/.evergreen/stop-orchestration.sh
330330
331331
"run mod_wsgi tests":
332332
- command: shell.exec
@@ -336,7 +336,7 @@ functions:
336336
script: |
337337
set -o xtrace
338338
${PREPARE_SHELL}
339-
PYTHON_BINARY=${PYTHON_BINARY} MOD_WSGI_VERSION=${MOD_WSGI_VERSION} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} sh ${PROJECT_DIRECTORY}/.evergreen/run-mod-wsgi-tests.sh
339+
PYTHON_BINARY=${PYTHON_BINARY} MOD_WSGI_VERSION=${MOD_WSGI_VERSION} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-mod-wsgi-tests.sh
340340
341341
"run mockupdb tests":
342342
- command: shell.exec
@@ -346,7 +346,7 @@ functions:
346346
script: |
347347
set -o xtrace
348348
${PREPARE_SHELL}
349-
PYTHON_BINARY=${PYTHON_BINARY} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} sh ${PROJECT_DIRECTORY}/.evergreen/run-mockupdb-tests.sh
349+
PYTHON_BINARY=${PYTHON_BINARY} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-mockupdb-tests.sh
350350
351351
"run doctests":
352352
- command: shell.exec
@@ -356,7 +356,7 @@ functions:
356356
script: |
357357
set -o xtrace
358358
${PREPARE_SHELL}
359-
PYTHON_BINARY=${PYTHON_BINARY} sh ${PROJECT_DIRECTORY}/.evergreen/run-doctests.sh
359+
PYTHON_BINARY=${PYTHON_BINARY} bash ${PROJECT_DIRECTORY}/.evergreen/run-doctests.sh
360360
361361
"run tests":
362362
- command: shell.exec
@@ -425,7 +425,7 @@ functions:
425425
SSL=${SSL} \
426426
DATA_LAKE=${DATA_LAKE} \
427427
MONGODB_API_VERSION=${MONGODB_API_VERSION} \
428-
sh ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh
428+
bash ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh
429429
430430
"run enterprise auth tests":
431431
- command: shell.exec
@@ -435,7 +435,7 @@ functions:
435435
working_dir: "src"
436436
script: |
437437
# DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
438-
PYTHON_BINARY=${PYTHON_BINARY} SASL_HOST=${sasl_host} SASL_PORT=${sasl_port} SASL_USER=${sasl_user} SASL_PASS=${sasl_pass} SASL_DB=${sasl_db} PRINCIPAL=${principal} GSSAPI_DB=${gssapi_db} KEYTAB_BASE64=${keytab_base64} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} sh ${PROJECT_DIRECTORY}/.evergreen/run-enterprise-auth-tests.sh
438+
PYTHON_BINARY=${PYTHON_BINARY} SASL_HOST=${sasl_host} SASL_PORT=${sasl_port} SASL_USER=${sasl_user} SASL_PASS=${sasl_pass} SASL_DB=${sasl_db} PRINCIPAL=${principal} GSSAPI_DB=${gssapi_db} KEYTAB_BASE64=${keytab_base64} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-enterprise-auth-tests.sh
439439
440440
"run atlas tests":
441441
- command: shell.exec
@@ -705,7 +705,7 @@ functions:
705705
${PREPARE_SHELL}
706706
file="${PROJECT_DIRECTORY}/.evergreen/install-dependencies.sh"
707707
# Don't use ${file} syntax here because evergreen treats it as an empty expansion.
708-
[ -f "$file" ] && sh $file || echo "$file not available, skipping"
708+
[ -f "$file" ] && bash $file || echo "$file not available, skipping"
709709
710710
"run-ocsp-test":
711711
- command: shell.exec
@@ -717,7 +717,7 @@ functions:
717717
PYTHON_BINARY=${PYTHON_BINARY} \
718718
CA_FILE="$DRIVERS_TOOLS/.evergreen/ocsp/${OCSP_ALGORITHM}/ca.pem" \
719719
OCSP_TLS_SHOULD_SUCCEED="${OCSP_TLS_SHOULD_SUCCEED}" \
720-
sh ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-tests.sh
720+
bash ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-tests.sh
721721
722722
run-valid-ocsp-server:
723723
- command: shell.exec

‎.evergreen/install-dependencies.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/bin/sh
1+
#!/bin/bash
22
set -o xtrace # Write all commands first to stderr
33
set -o errexit # Exit the script with error if any of the commands fail
44

‎.evergreen/run-mod-wsgi-tests.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/bin/sh
1+
#!/bin/bash
22
set -o xtrace
33
set -o errexit
44

‎.evergreen/run-tests.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,15 @@ if [ -n "$TEST_ENCRYPTION" ]; then
144144
# Get access to the AWS temporary credentials:
145145
# CSFLE_AWS_TEMP_ACCESS_KEY_ID, CSFLE_AWS_TEMP_SECRET_ACCESS_KEY, CSFLE_AWS_TEMP_SESSION_TOKEN
146146
. $DRIVERS_TOOLS/.evergreen/csfle/set-temp-creds.sh
147+
148+
# Start the mock KMS servers.
149+
if [ "$OS" != "Windows_NT" ]; then
150+
pushd ${DRIVERS_TOOLS}/.evergreen/csfle
151+
python -u lib/kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/expired.pem --port 8000 &
152+
python -u lib/kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/wrong-host.pem --port 8001 &
153+
trap 'kill $(jobs -p)' EXIT HUP
154+
popd
155+
fi
147156
fi
148157

149158
if [ -z "$DATA_LAKE" ]; then

‎test/test_encryption.py

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import os
2020
import traceback
2121
import socket
22+
import ssl
2223
import sys
2324
import textwrap
2425
import uuid
@@ -49,6 +50,7 @@
4950
WriteError)
5051
from pymongo.mongo_client import MongoClient
5152
from pymongo.operations import InsertOne
53+
from pymongo.ssl_support import _ssl
5254
from pymongo.write_concern import WriteConcern
5355

5456
from test import unittest, IntegrationTest, PyMongoTestCase, client_context
@@ -60,6 +62,7 @@
6062
rs_or_single_client,
6163
wait_until)
6264
from test.utils_spec_runner import SpecRunner
65+
from test.test_ssl import CA_PEM
6366

6467

6568
def get_client_opts(client):
@@ -1624,5 +1627,59 @@ def test_bypassAutoEncryption(self):
16241627
mongocryptd_client.admin.command('ping')
16251628

16261629

1630+
# https://github.com/mongodb/specifications/tree/master/source/client-side-encryption/tests#kms-tls-tests
1631+
class TestKmsTLSProse(EncryptionIntegrationTest):
1632+
@unittest.skipIf(sys.platform == 'win32',
1633+
"Can't test system ca certs on Windows")
1634+
@unittest.skipIf(ssl.OPENSSL_VERSION.lower().startswith('libressl') and
1635+
sys.platform == 'darwin' and not _ssl.IS_PYOPENSSL,
1636+
"LibreSSL on OSX doesn't support setting CA certificates "
1637+
"using SSL_CERT_FILE environment variable.")
1638+
@unittest.skipUnless(any(AWS_CREDS.values()),
1639+
'AWS environment credentials are not set')
1640+
def setUp(self):
1641+
self.original_certs = os.environ.get('SSL_CERT_FILE')
1642+
def restore_certs():
1643+
if self.original_certs is None:
1644+
os.environ.pop('SSL_CERT_FILE')
1645+
else:
1646+
os.environ['SSL_CERT_FILE'] = self.original_certs
1647+
# Tell OpenSSL where CA certificates live.
1648+
os.environ['SSL_CERT_FILE'] = CA_PEM
1649+
self.addCleanup(restore_certs)
1650+
1651+
self.client_encrypted = ClientEncryption(
1652+
{'aws': AWS_CREDS}, 'keyvault.datakeys', self.client, OPTS)
1653+
self.addCleanup(self.client_encrypted.close)
1654+
1655+
def test_invalid_kms_certificate_expired(self):
1656+
key = {
1657+
"region": "us-east-1",
1658+
"key": "arn:aws:kms:us-east-1:579766882180:key/"
1659+
"89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
1660+
"endpoint": "mongodb://127.0.0.1:8000",
1661+
}
1662+
# Some examples:
1663+
# certificate verify failed: certificate has expired (_ssl.c:1129)
1664+
# amazon1-2018 Python 3.6: certificate verify failed (_ssl.c:852)
1665+
with self.assertRaisesRegex(
1666+
EncryptionError, 'expired|certificate verify failed'):
1667+
self.client_encrypted.create_data_key('aws', master_key=key)
1668+
1669+
def test_invalid_hostname_in_kms_certificate(self):
1670+
key = {
1671+
"region": "us-east-1",
1672+
"key": "arn:aws:kms:us-east-1:579766882180:key/"
1673+
"89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
1674+
"endpoint": "mongodb://127.0.0.1:8001",
1675+
}
1676+
# Some examples:
1677+
# certificate verify failed: IP address mismatch, certificate is not valid for '127.0.0.1'. (_ssl.c:1129)"
1678+
# hostname '127.0.0.1' doesn't match 'wronghost.com'
1679+
with self.assertRaisesRegex(
1680+
EncryptionError, 'IP address mismatch|wronghost'):
1681+
self.client_encrypted.create_data_key('aws', master_key=key)
1682+
1683+
16271684
if __name__ == "__main__":
16281685
unittest.main()

0 commit comments

Comments
 (0)