diff options
author | clang-format-7.0.1 <adam.martin@10gen.com> | 2019-07-26 18:20:35 -0400 |
---|---|---|
committer | ADAM David Alan Martin <adam.martin@10gen.com> | 2019-07-27 11:02:23 -0400 |
commit | 134a4083953270e8a11430395357fb70a29047ad (patch) | |
tree | dd428e1230e31d92b20b393dfdc17ffe7fa79cb6 /jstests/client_encrypt | |
parent | 1e46b5049003f427047e723ea5fab15b5a9253ca (diff) | |
download | mongo-134a4083953270e8a11430395357fb70a29047ad.tar.gz |
SERVER-41772 Apply clang-format 7.0.1 to the codebase
Diffstat (limited to 'jstests/client_encrypt')
-rw-r--r-- | jstests/client_encrypt/fle_auto_decrypt.js | 73 | ||||
-rw-r--r-- | jstests/client_encrypt/fle_aws_faults.js | 210 | ||||
-rw-r--r-- | jstests/client_encrypt/fle_command_line_encryption.js | 62 | ||||
-rw-r--r-- | jstests/client_encrypt/fle_encrypt_decrypt_shell.js | 214 | ||||
-rw-r--r-- | jstests/client_encrypt/fle_key_faults.js | 152 | ||||
-rw-r--r-- | jstests/client_encrypt/fle_keys.js | 98 | ||||
-rw-r--r-- | jstests/client_encrypt/fle_valid_fle_options.js | 90 | ||||
-rw-r--r-- | jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js | 143 | ||||
-rw-r--r-- | jstests/client_encrypt/lib/mock_kms.js | 10 |
9 files changed, 536 insertions, 516 deletions
diff --git a/jstests/client_encrypt/fle_auto_decrypt.js b/jstests/client_encrypt/fle_auto_decrypt.js index 8122538c9f3..182c8af3ac4 100644 --- a/jstests/client_encrypt/fle_auto_decrypt.js +++ b/jstests/client_encrypt/fle_auto_decrypt.js @@ -5,52 +5,55 @@ load("jstests/client_encrypt/lib/mock_kms.js"); load('jstests/ssl/libs/ssl_helpers.js'); (function() { - "use strict"; +"use strict"; - const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT}; +const x509_options = { + sslMode: "requireSSL", + sslPEMKeyFile: SERVER_CERT, + sslCAFile: CA_CERT +}; - const conn = MongoRunner.runMongod(x509_options); +const conn = MongoRunner.runMongod(x509_options); - let localKMS = { - key: BinData( - 0, - "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"), - }; +let localKMS = { + key: BinData( + 0, + "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"), +}; - const clientSideFLEOptions = { - kmsProviders: { - local: localKMS, - }, - keyVaultNamespace: "test.coll", - schemaMap: {} - }; +const clientSideFLEOptions = { + kmsProviders: { + local: localKMS, + }, + keyVaultNamespace: "test.coll", + schemaMap: {} +}; - const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; +const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; - const shell = Mongo(conn.host, clientSideFLEOptions); - const keyVault = shell.getKeyVault(); +const shell = Mongo(conn.host, clientSideFLEOptions); +const keyVault = shell.getKeyVault(); - assert.writeOK( - keyVault.createKey("local", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); +assert.writeOK(keyVault.createKey("local", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); - const clientEncrypt = shell.getClientEncryption(); - const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; +const clientEncrypt = shell.getClientEncryption(); +const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; - const encryptedStr = clientEncrypt.encrypt(keyId, "mongodb", deterministicAlgorithm); +const encryptedStr = clientEncrypt.encrypt(keyId, "mongodb", deterministicAlgorithm); - // Insert encrypted string into database - const collection = conn.getDB("test").getCollection("collection"); +// Insert encrypted string into database +const collection = conn.getDB("test").getCollection("collection"); - for (var i = 0; i < 150; i++) { - assert.writeOK(collection.insert({string: encryptedStr, id: 1})); - } +for (var i = 0; i < 150; i++) { + assert.writeOK(collection.insert({string: encryptedStr, id: 1})); +} - // Ensure string is auto decrypted - const encryptedCollection = shell.getDB("test").getCollection("collection"); - const result = encryptedCollection.find({id: 1}).toArray(); - result.forEach(function(entry) { - assert.eq(entry.string, "mongodb"); - }); +// Ensure string is auto decrypted +const encryptedCollection = shell.getDB("test").getCollection("collection"); +const result = encryptedCollection.find({id: 1}).toArray(); +result.forEach(function(entry) { + assert.eq(entry.string, "mongodb"); +}); - MongoRunner.stopMongod(conn); +MongoRunner.stopMongod(conn); }());
\ No newline at end of file diff --git a/jstests/client_encrypt/fle_aws_faults.js b/jstests/client_encrypt/fle_aws_faults.js index c7afb02513c..1d9a621b42a 100644 --- a/jstests/client_encrypt/fle_aws_faults.js +++ b/jstests/client_encrypt/fle_aws_faults.js @@ -6,137 +6,137 @@ load("jstests/client_encrypt/lib/mock_kms.js"); load('jstests/ssl/libs/ssl_helpers.js'); (function() { - "use strict"; +"use strict"; - const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT}; +const x509_options = { + sslMode: "requireSSL", + sslPEMKeyFile: SERVER_CERT, + sslCAFile: CA_CERT +}; - const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; +const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; - const conn = MongoRunner.runMongod(x509_options); - const test = conn.getDB("test"); - const collection = test.coll; +const conn = MongoRunner.runMongod(x509_options); +const test = conn.getDB("test"); +const collection = test.coll; - function runKMS(mock_kms, func) { - mock_kms.start(); +function runKMS(mock_kms, func) { + mock_kms.start(); - const awsKMS = { - accessKeyId: "access", - secretAccessKey: "secret", - url: mock_kms.getURL(), - }; + const awsKMS = { + accessKeyId: "access", + secretAccessKey: "secret", + url: mock_kms.getURL(), + }; - const clientSideFLEOptions = { - kmsProviders: { - aws: awsKMS, - }, - keyVaultNamespace: "test.coll", - schemaMap: {} - }; + const clientSideFLEOptions = { + kmsProviders: { + aws: awsKMS, + }, + keyVaultNamespace: "test.coll", + schemaMap: {} + }; - const shell = Mongo(conn.host, clientSideFLEOptions); - const cleanCacheShell = Mongo(conn.host, clientSideFLEOptions); + const shell = Mongo(conn.host, clientSideFLEOptions); + const cleanCacheShell = Mongo(conn.host, clientSideFLEOptions); - collection.drop(); + collection.drop(); - func(shell, cleanCacheShell); + func(shell, cleanCacheShell); - mock_kms.stop(); - } + mock_kms.stop(); +} - function testBadEncryptResult(fault) { - const mock_kms = new MockKMSServer(fault, false); +function testBadEncryptResult(fault) { + const mock_kms = new MockKMSServer(fault, false); - runKMS(mock_kms, (shell) => { - const keyVault = shell.getKeyVault(); + runKMS(mock_kms, (shell) => { + const keyVault = shell.getKeyVault(); - assert.throws(() => keyVault.createKey( - "aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); - assert.eq(keyVault.getKeys("mongoKey").toArray().length, 0); - }); - } - - testBadEncryptResult(FAULT_ENCRYPT); - testBadEncryptResult(FAULT_ENCRYPT_WRONG_FIELDS); - testBadEncryptResult(FAULT_ENCRYPT_BAD_BASE64); + assert.throws( + () => keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); + assert.eq(keyVault.getKeys("mongoKey").toArray().length, 0); + }); +} - function testBadEncryptError() { - const mock_kms = new MockKMSServer(FAULT_ENCRYPT_CORRECT_FORMAT, false); +testBadEncryptResult(FAULT_ENCRYPT); +testBadEncryptResult(FAULT_ENCRYPT_WRONG_FIELDS); +testBadEncryptResult(FAULT_ENCRYPT_BAD_BASE64); - runKMS(mock_kms, (shell) => { - const keyVault = shell.getKeyVault(); +function testBadEncryptError() { + const mock_kms = new MockKMSServer(FAULT_ENCRYPT_CORRECT_FORMAT, false); - let error = - assert.throws(() => keyVault.createKey( - "aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); - assert.commandFailedWithCode(error, [51224]); - assert.eq( - error, - "Error: AWS KMS failed to encrypt: NotFoundException : Error encrypting message"); - }); - } - - testBadEncryptError(); - - function testBadDecryptResult(fault) { - const mock_kms = new MockKMSServer(fault, false); - - runKMS(mock_kms, (shell) => { - const keyVault = shell.getKeyVault(); - assert.writeOK( - keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); - const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id; - const str = "mongo"; - assert.throws(() => { - const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm); - }); - }); - } + runKMS(mock_kms, (shell) => { + const keyVault = shell.getKeyVault(); - testBadDecryptResult(FAULT_DECRYPT); + let error = assert.throws( + () => keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); + assert.commandFailedWithCode(error, [51224]); + assert.eq(error, + "Error: AWS KMS failed to encrypt: NotFoundException : Error encrypting message"); + }); +} - function testBadDecryptKeyResult(fault) { - const mock_kms = new MockKMSServer(fault, true); +testBadEncryptError(); - runKMS(mock_kms, (shell, cleanCacheShell) => { - const keyVault = shell.getKeyVault(); +function testBadDecryptResult(fault) { + const mock_kms = new MockKMSServer(fault, false); - assert.writeOK( - keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); - const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id; - const str = "mongo"; + runKMS(mock_kms, (shell) => { + const keyVault = shell.getKeyVault(); + assert.writeOK( + keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); + const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id; + const str = "mongo"; + assert.throws(() => { const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm); + }); + }); +} + +testBadDecryptResult(FAULT_DECRYPT); - mock_kms.enableFaults(); +function testBadDecryptKeyResult(fault) { + const mock_kms = new MockKMSServer(fault, true); - assert.throws(() => { - var str = cleanCacheShell.decrypt(encStr); - }); + runKMS(mock_kms, (shell, cleanCacheShell) => { + const keyVault = shell.getKeyVault(); + assert.writeOK( + keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); + const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id; + const str = "mongo"; + const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm); + + mock_kms.enableFaults(); + + assert.throws(() => { + var str = cleanCacheShell.decrypt(encStr); }); - } - - testBadDecryptKeyResult(FAULT_DECRYPT_WRONG_KEY); - - function testBadDecryptError() { - const mock_kms = new MockKMSServer(FAULT_DECRYPT_CORRECT_FORMAT, false); - - runKMS(mock_kms, (shell) => { - const keyVault = shell.getKeyVault(); - assert.writeOK( - keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); - const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id; - const str = "mongo"; - let error = assert.throws(() => { - const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm); - }); - assert.commandFailedWithCode(error, [51225]); - assert.eq( - error, - "Error: AWS KMS failed to decrypt: NotFoundException : Error decrypting message"); + }); +} + +testBadDecryptKeyResult(FAULT_DECRYPT_WRONG_KEY); + +function testBadDecryptError() { + const mock_kms = new MockKMSServer(FAULT_DECRYPT_CORRECT_FORMAT, false); + + runKMS(mock_kms, (shell) => { + const keyVault = shell.getKeyVault(); + assert.writeOK( + keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"])); + const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id; + const str = "mongo"; + let error = assert.throws(() => { + const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm); }); - } + assert.commandFailedWithCode(error, [51225]); + assert.eq(error, + "Error: AWS KMS failed to decrypt: NotFoundException : Error decrypting message"); + }); +} - testBadDecryptError(); +testBadDecryptError(); - MongoRunner.stopMongod(conn); +MongoRunner.stopMongod(conn); }());
\ No newline at end of file diff --git a/jstests/client_encrypt/fle_command_line_encryption.js b/jstests/client_encrypt/fle_command_line_encryption.js index 9113f9f2d74..1ad044b4d95 100644 --- a/jstests/client_encrypt/fle_command_line_encryption.js +++ b/jstests/client_encrypt/fle_command_line_encryption.js @@ -6,36 +6,40 @@ load('jstests/ssl/libs/ssl_helpers.js'); (function() { - const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT}; - const conn = MongoRunner.runMongod(x509_options); +const x509_options = { + sslMode: "requireSSL", + sslPEMKeyFile: SERVER_CERT, + sslCAFile: CA_CERT +}; +const conn = MongoRunner.runMongod(x509_options); - const shellOpts = [ - "mongo", - "--host", - conn.host, - "--port", - conn.port, - "--tls", - "--sslPEMKeyFile", - CLIENT_CERT, - "--sslCAFile", - CA_CERT, - "--tlsAllowInvalidHostnames", - "--awsAccessKeyId", - "access", - "--awsSecretAccessKey", - "secret", - "--keyVaultNamespace", - "test.coll", - "--kmsURL", - "https://localhost:8000", - ]; +const shellOpts = [ + "mongo", + "--host", + conn.host, + "--port", + conn.port, + "--tls", + "--sslPEMKeyFile", + CLIENT_CERT, + "--sslCAFile", + CA_CERT, + "--tlsAllowInvalidHostnames", + "--awsAccessKeyId", + "access", + "--awsSecretAccessKey", + "secret", + "--keyVaultNamespace", + "test.coll", + "--kmsURL", + "https://localhost:8000", +]; - const testFiles = [ - "jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js", - ]; +const testFiles = [ + "jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js", +]; - for (const file of testFiles) { - runMongoProgram(...shellOpts, file); - } +for (const file of testFiles) { + runMongoProgram(...shellOpts, file); +} }());
\ No newline at end of file diff --git a/jstests/client_encrypt/fle_encrypt_decrypt_shell.js b/jstests/client_encrypt/fle_encrypt_decrypt_shell.js index fd7847c04dc..f67bc72dccc 100644 --- a/jstests/client_encrypt/fle_encrypt_decrypt_shell.js +++ b/jstests/client_encrypt/fle_encrypt_decrypt_shell.js @@ -5,117 +5,119 @@ load("jstests/client_encrypt/lib/mock_kms.js"); load('jstests/ssl/libs/ssl_helpers.js'); (function() { - "use strict"; - - const mock_kms = new MockKMSServer(); - mock_kms.start(); - - const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT}; - - const conn = MongoRunner.runMongod(x509_options); - const test = conn.getDB("test"); - const collection = test.coll; - - const awsKMS = { - accessKeyId: "access", - secretAccessKey: "secret", - url: mock_kms.getURL(), - }; - - let localKMS = { - key: BinData( - 0, - "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"), - }; - - const clientSideFLEOptions = { - kmsProviders: { - aws: awsKMS, - local: localKMS, - }, - keyVaultNamespace: "test.coll", - schemaMap: {} - }; - - const kmsTypes = ["aws", "local"]; - - const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; - const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; - const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm]; - - const passTestCases = [ - "mongo", - NumberLong(13), - NumberInt(23), - UUID(), - ISODate(), - new Date('December 17, 1995 03:24:00'), - BinData(0, '1234'), - BinData(1, '1234'), - BinData(3, '1234'), - BinData(4, '1234'), - BinData(5, '1234'), - BinData(6, '1234'), - new Timestamp(1, 2), - new ObjectId(), - new DBPointer("mongo", new ObjectId()), - /test/ - ]; - - const failDeterministic = [ - true, - false, - 12, - NumberDecimal(0.1234), - ["this is an array"], - {"value": "mongo"}, - Code("function() { return true; }") - ]; - - const failTestCases = - [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test"), BinData(2, '1234')]; - - const shell = Mongo(conn.host, clientSideFLEOptions); - const keyVault = shell.getKeyVault(); - - // Testing for every combination of (kmsType, algorithm, javascriptVariable) - for (const kmsType of kmsTypes) { - for (const encryptionAlgorithm of encryptionAlgorithms) { - collection.drop(); - - assert.writeOK( - keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); - const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; - - let pass; - let fail; - if (encryptionAlgorithm === randomAlgorithm) { - pass = [...passTestCases, ...failDeterministic]; - fail = failTestCases; - } else if (encryptionAlgorithm === deterministicAlgorithm) { - pass = passTestCases; - fail = [...failTestCases, ...failDeterministic]; - } +"use strict"; + +const mock_kms = new MockKMSServer(); +mock_kms.start(); + +const x509_options = { + sslMode: "requireSSL", + sslPEMKeyFile: SERVER_CERT, + sslCAFile: CA_CERT +}; + +const conn = MongoRunner.runMongod(x509_options); +const test = conn.getDB("test"); +const collection = test.coll; + +const awsKMS = { + accessKeyId: "access", + secretAccessKey: "secret", + url: mock_kms.getURL(), +}; + +let localKMS = { + key: BinData( + 0, + "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"), +}; + +const clientSideFLEOptions = { + kmsProviders: { + aws: awsKMS, + local: localKMS, + }, + keyVaultNamespace: "test.coll", + schemaMap: {} +}; + +const kmsTypes = ["aws", "local"]; + +const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; +const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; +const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm]; + +const passTestCases = [ + "mongo", + NumberLong(13), + NumberInt(23), + UUID(), + ISODate(), + new Date('December 17, 1995 03:24:00'), + BinData(0, '1234'), + BinData(1, '1234'), + BinData(3, '1234'), + BinData(4, '1234'), + BinData(5, '1234'), + BinData(6, '1234'), + new Timestamp(1, 2), + new ObjectId(), + new DBPointer("mongo", new ObjectId()), + /test/ +]; + +const failDeterministic = [ + true, + false, + 12, + NumberDecimal(0.1234), + ["this is an array"], + {"value": "mongo"}, + Code("function() { return true; }") +]; + +const failTestCases = + [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test"), BinData(2, '1234')]; + +const shell = Mongo(conn.host, clientSideFLEOptions); +const keyVault = shell.getKeyVault(); + +// Testing for every combination of (kmsType, algorithm, javascriptVariable) +for (const kmsType of kmsTypes) { + for (const encryptionAlgorithm of encryptionAlgorithms) { + collection.drop(); + + assert.writeOK( + keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); + const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; + + let pass; + let fail; + if (encryptionAlgorithm === randomAlgorithm) { + pass = [...passTestCases, ...failDeterministic]; + fail = failTestCases; + } else if (encryptionAlgorithm === deterministicAlgorithm) { + pass = passTestCases; + fail = [...failTestCases, ...failDeterministic]; + } - const clientEncrypt = shell.getClientEncryption(); - for (const passTestCase of pass) { - const encPassTestCase = - clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm); - assert.eq(passTestCase, clientEncrypt.decrypt(encPassTestCase)); + const clientEncrypt = shell.getClientEncryption(); + for (const passTestCase of pass) { + const encPassTestCase = clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm); + assert.eq(passTestCase, clientEncrypt.decrypt(encPassTestCase)); - if (encryptionAlgorithm === deterministicAlgorithm) { - assert.eq(encPassTestCase, - clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm)); - } + if (encryptionAlgorithm === deterministicAlgorithm) { + assert.eq(encPassTestCase, + clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm)); } + } - for (const failTestCase of fail) { - assert.throws(() => - clientEncrypt.encrypt(keyId, failTestCase, encryptionAlgorithm)); - } + for (const failTestCase of fail) { + assert.throws(() => clientEncrypt.encrypt(keyId, failTestCase, encryptionAlgorithm)); } } +} - MongoRunner.stopMongod(conn); - mock_kms.stop(); +MongoRunner.stopMongod(conn); +mock_kms.stop(); }());
\ No newline at end of file diff --git a/jstests/client_encrypt/fle_key_faults.js b/jstests/client_encrypt/fle_key_faults.js index b81c1bcfa81..41b2505c8ba 100644 --- a/jstests/client_encrypt/fle_key_faults.js +++ b/jstests/client_encrypt/fle_key_faults.js @@ -6,89 +6,93 @@ load("jstests/client_encrypt/lib/mock_kms.js"); load('jstests/ssl/libs/ssl_helpers.js'); (function() { - "use strict"; - - const mock_kms = new MockKMSServer(); - mock_kms.start(); - - const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT}; - - const conn = MongoRunner.runMongod(x509_options); - const test = conn.getDB("test"); - const collection = test.coll; - - const awsKMS = { - accessKeyId: "access", - secretAccessKey: "secret", - url: mock_kms.getURL(), - }; - - var localKMS = { - key: BinData( - 0, - "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"), - }; - - const clientSideFLEOptions = { - kmsProviders: { - aws: awsKMS, - local: localKMS, - }, - keyVaultNamespace: "test.coll", - schemaMap: {} - }; - - function testFault(kmsType, func) { - collection.drop(); - - const shell = Mongo(conn.host, clientSideFLEOptions); - const keyVault = shell.getKeyVault(); - - assert.writeOK( - keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); - const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; - - func(keyId, shell); - } - - function testFaults(func) { - const kmsTypes = ["aws", "local"]; - - for (const kmsType of kmsTypes) { - testFault(kmsType, func); - } +"use strict"; + +const mock_kms = new MockKMSServer(); +mock_kms.start(); + +const x509_options = { + sslMode: "requireSSL", + sslPEMKeyFile: SERVER_CERT, + sslCAFile: CA_CERT +}; + +const conn = MongoRunner.runMongod(x509_options); +const test = conn.getDB("test"); +const collection = test.coll; + +const awsKMS = { + accessKeyId: "access", + secretAccessKey: "secret", + url: mock_kms.getURL(), +}; + +var localKMS = { + key: BinData( + 0, + "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"), +}; + +const clientSideFLEOptions = { + kmsProviders: { + aws: awsKMS, + local: localKMS, + }, + keyVaultNamespace: "test.coll", + schemaMap: {} +}; + +function testFault(kmsType, func) { + collection.drop(); + + const shell = Mongo(conn.host, clientSideFLEOptions); + const keyVault = shell.getKeyVault(); + + assert.writeOK( + keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); + const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; + + func(keyId, shell); +} + +function testFaults(func) { + const kmsTypes = ["aws", "local"]; + + for (const kmsType of kmsTypes) { + testFault(kmsType, func); } +} - // Negative - drop the key vault collection - testFaults((keyId, shell) => { - collection.drop(); +// Negative - drop the key vault collection +testFaults((keyId, shell) => { + collection.drop(); - const str = "mongo"; - assert.throws(() => { - const encStr = shell.getClientEncryption().encrypt(keyId, str); - }); + const str = "mongo"; + assert.throws(() => { + const encStr = shell.getClientEncryption().encrypt(keyId, str); }); +}); - // Negative - delete the keys - testFaults((keyId, shell) => { - collection.deleteMany({}); +// Negative - delete the keys +testFaults((keyId, shell) => { + collection.deleteMany({}); - const str = "mongo"; - assert.throws(() => { - const encStr = shell.getClientEncryption().encrypt(keyId, str); - }); + const str = "mongo"; + assert.throws(() => { + const encStr = shell.getClientEncryption().encrypt(keyId, str); }); +}); - // Negative - corrupt the master key with an unkown provider - testFaults((keyId, shell) => { - collection.updateMany({}, {$set: {"masterKey.provider": "fake"}}); +// Negative - corrupt the master key with an unkown provider +testFaults((keyId, shell) => { + collection.updateMany({}, {$set: {"masterKey.provider": "fake"}}); - const str = "mongo"; - assert.throws(() => { - const encStr = shell.getClientEncryption().encrypt(keyId, str); - }); + const str = "mongo"; + assert.throws(() => { + const encStr = shell.getClientEncryption().encrypt(keyId, str); }); +}); - MongoRunner.stopMongod(conn); - mock_kms.stop(); +MongoRunner.stopMongod(conn); +mock_kms.stop(); }());
\ No newline at end of file diff --git a/jstests/client_encrypt/fle_keys.js b/jstests/client_encrypt/fle_keys.js index 875615ac9a8..646b95141ad 100644 --- a/jstests/client_encrypt/fle_keys.js +++ b/jstests/client_encrypt/fle_keys.js @@ -6,70 +6,74 @@ load("jstests/client_encrypt/lib/mock_kms.js"); load('jstests/ssl/libs/ssl_helpers.js'); (function() { - "use strict"; +"use strict"; - const mock_kms = new MockKMSServer(); - mock_kms.start(); +const mock_kms = new MockKMSServer(); +mock_kms.start(); - const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT}; +const x509_options = { + sslMode: "requireSSL", + sslPEMKeyFile: SERVER_CERT, + sslCAFile: CA_CERT +}; - const conn = MongoRunner.runMongod(x509_options); - const test = conn.getDB("test"); - const collection = test.coll; +const conn = MongoRunner.runMongod(x509_options); +const test = conn.getDB("test"); +const collection = test.coll; - const awsKMS = { - accessKeyId: "access", - secretAccessKey: "secret", - url: mock_kms.getURL(), - }; +const awsKMS = { + accessKeyId: "access", + secretAccessKey: "secret", + url: mock_kms.getURL(), +}; - const clientSideFLEOptions = { - kmsProviders: { - aws: awsKMS, - }, - keyVaultNamespace: "test.coll", - schemaMap: {} - }; +const clientSideFLEOptions = { + kmsProviders: { + aws: awsKMS, + }, + keyVaultNamespace: "test.coll", + schemaMap: {} +}; - const conn_str = "mongodb://" + conn.host + "/?ssl=true"; - const shell = Mongo(conn_str, clientSideFLEOptions); - const keyVault = shell.getKeyVault(); +const conn_str = "mongodb://" + conn.host + "/?ssl=true"; +const shell = Mongo(conn_str, clientSideFLEOptions); +const keyVault = shell.getKeyVault(); - var key = keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']); - assert.eq(1, keyVault.getKeys().itcount()); +var key = keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']); +assert.eq(1, keyVault.getKeys().itcount()); - var result = keyVault.createKey("aws", "arn:aws:kms:us-east-4:fake:fake:fake", {}); - assert.eq("TypeError: key alternate names must be of Array type.", result); +var result = keyVault.createKey("aws", "arn:aws:kms:us-east-4:fake:fake:fake", {}); +assert.eq("TypeError: key alternate names must be of Array type.", result); - result = keyVault.createKey("aws", "arn:aws:kms:us-east-5:fake:fake:fake", [1]); - assert.eq("TypeError: items in key alternate names must be of String type.", result); +result = keyVault.createKey("aws", "arn:aws:kms:us-east-5:fake:fake:fake", [1]); +assert.eq("TypeError: items in key alternate names must be of String type.", result); - assert.eq(1, keyVault.getKeyByAltName("mongoKey").itcount()); +assert.eq(1, keyVault.getKeyByAltName("mongoKey").itcount()); - var keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; +var keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; - keyVault.addKeyAlternateName(keyId, "mongoKey2"); +keyVault.addKeyAlternateName(keyId, "mongoKey2"); - assert.eq(1, keyVault.getKeyByAltName("mongoKey2").itcount()); - assert.eq(2, keyVault.getKey(keyId).toArray()[0].keyAltNames.length); - assert.eq(1, keyVault.getKeys().itcount()); +assert.eq(1, keyVault.getKeyByAltName("mongoKey2").itcount()); +assert.eq(2, keyVault.getKey(keyId).toArray()[0].keyAltNames.length); +assert.eq(1, keyVault.getKeys().itcount()); - result = keyVault.addKeyAlternateName(keyId, [2]); - assert.eq("TypeError: key alternate name cannot be object or array type.", result); +result = keyVault.addKeyAlternateName(keyId, [2]); +assert.eq("TypeError: key alternate name cannot be object or array type.", result); - keyVault.removeKeyAlternateName(keyId, "mongoKey2"); - assert.eq(1, keyVault.getKey(keyId).toArray()[0].keyAltNames.length); +keyVault.removeKeyAlternateName(keyId, "mongoKey2"); +assert.eq(1, keyVault.getKey(keyId).toArray()[0].keyAltNames.length); - result = keyVault.deleteKey(keyId); - assert.eq(0, keyVault.getKey(keyId).itcount()); - assert.eq(0, keyVault.getKeys().itcount()); +result = keyVault.deleteKey(keyId); +assert.eq(0, keyVault.getKey(keyId).itcount()); +assert.eq(0, keyVault.getKeys().itcount()); - assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake1")); - assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-2:fake:fake:fake2")); - assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-3:fake:fake:fake3")); +assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake1")); +assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-2:fake:fake:fake2")); +assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-3:fake:fake:fake3")); - assert.eq(3, keyVault.getKeys().itcount()); +assert.eq(3, keyVault.getKeys().itcount()); - MongoRunner.stopMongod(conn); - mock_kms.stop(); +MongoRunner.stopMongod(conn); +mock_kms.stop(); }());
\ No newline at end of file diff --git a/jstests/client_encrypt/fle_valid_fle_options.js b/jstests/client_encrypt/fle_valid_fle_options.js index 9bdabaf4875..08a44f18725 100644 --- a/jstests/client_encrypt/fle_valid_fle_options.js +++ b/jstests/client_encrypt/fle_valid_fle_options.js @@ -3,60 +3,64 @@ load("jstests/client_encrypt/lib/mock_kms.js"); load('jstests/ssl/libs/ssl_helpers.js'); (function() { - "use strict"; +"use strict"; - const mock_kms = new MockKMSServer(); - mock_kms.start(); +const mock_kms = new MockKMSServer(); +mock_kms.start(); - const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; - const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; +const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; +const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; - const x509_options = - {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT, vvvvv: ""}; +const x509_options = { + sslMode: "requireSSL", + sslPEMKeyFile: SERVER_CERT, + sslCAFile: CA_CERT, + vvvvv: "" +}; - const conn = MongoRunner.runMongod(x509_options); - const unencryptedDatabase = conn.getDB("test"); - const collection = unencryptedDatabase.keystore; +const conn = MongoRunner.runMongod(x509_options); +const unencryptedDatabase = conn.getDB("test"); +const collection = unencryptedDatabase.keystore; - const awsKMS = { - accessKeyId: "access", - secretAccessKey: "secret", - url: mock_kms.getURL(), - }; +const awsKMS = { + accessKeyId: "access", + secretAccessKey: "secret", + url: mock_kms.getURL(), +}; - const clientSideFLEOptionsFail = [ - { - kmsProviders: { - aws: awsKMS, - }, - schemaMap: {}, +const clientSideFLEOptionsFail = [ + { + kmsProviders: { + aws: awsKMS, }, - { - keyVaultNamespace: "test.keystore", - schemaMap: {}, - }, - ]; + schemaMap: {}, + }, + { + keyVaultNamespace: "test.keystore", + schemaMap: {}, + }, +]; - clientSideFLEOptionsFail.forEach(element => { - assert.throws(Mongo, [conn.host, element]); - }); +clientSideFLEOptionsFail.forEach(element => { + assert.throws(Mongo, [conn.host, element]); +}); - const clientSideFLEOptionsPass = [ - { - kmsProviders: { - aws: awsKMS, - }, - keyVaultNamespace: "test.keystore", - schemaMap: {}, +const clientSideFLEOptionsPass = [ + { + kmsProviders: { + aws: awsKMS, }, - ]; + keyVaultNamespace: "test.keystore", + schemaMap: {}, + }, +]; - clientSideFLEOptionsPass.forEach(element => { - assert.doesNotThrow(() => { - Mongo(conn.host, element); - }); +clientSideFLEOptionsPass.forEach(element => { + assert.doesNotThrow(() => { + Mongo(conn.host, element); }); +}); - MongoRunner.stopMongod(conn); - mock_kms.stop(); +MongoRunner.stopMongod(conn); +mock_kms.stop(); }()); diff --git a/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js b/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js index 0ca10b2057c..da83d69c87b 100644 --- a/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js +++ b/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js @@ -1,84 +1,83 @@ /** -* Check the functionality of encrypt and decrypt functions in KeyVault.js. This test is run by -* jstests/fle/fle_command_line_encryption.js. -*/ + * Check the functionality of encrypt and decrypt functions in KeyVault.js. This test is run by + * jstests/fle/fle_command_line_encryption.js. + */ load("jstests/client_encrypt/lib/mock_kms.js"); (function() { - "use strict"; - - const mock_kms = new MockKMSServer(); - mock_kms.start(); - - const shell = Mongo(); - const keyVault = shell.getKeyVault(); - - const test = shell.getDB("test"); - const collection = test.coll; - - const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; - const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; - const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm]; - - const passTestCases = [ - "mongo", - NumberLong(13), - NumberInt(23), - UUID(), - ISODate(), - new Date('December 17, 1995 03:24:00'), - BinData(2, '1234'), - new Timestamp(1, 2), - new ObjectId(), - new DBPointer("mongo", new ObjectId()), - /test/ - ]; - - const failDeterministic = [ - true, - false, - 12, - NumberDecimal(0.1234), - ["this is an array"], - {"value": "mongo"}, - Code("function() { return true; }") - ]; - - const failTestCases = [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test")]; - - // Testing for every combination of (algorithm, javascriptVariable) - for (const encryptionAlgorithm of encryptionAlgorithms) { - collection.drop(); - - assert.writeOK( - keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); - const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; - - let pass; - let fail; - if (encryptionAlgorithm === randomAlgorithm) { - pass = [...passTestCases, ...failDeterministic]; - fail = failTestCases; - } else if (encryptionAlgorithm === deterministicAlgorithm) { - pass = passTestCases; - fail = [...failTestCases, ...failDeterministic]; - } +"use strict"; + +const mock_kms = new MockKMSServer(); +mock_kms.start(); + +const shell = Mongo(); +const keyVault = shell.getKeyVault(); + +const test = shell.getDB("test"); +const collection = test.coll; + +const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random"; +const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"; +const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm]; + +const passTestCases = [ + "mongo", + NumberLong(13), + NumberInt(23), + UUID(), + ISODate(), + new Date('December 17, 1995 03:24:00'), + BinData(2, '1234'), + new Timestamp(1, 2), + new ObjectId(), + new DBPointer("mongo", new ObjectId()), + /test/ +]; + +const failDeterministic = [ + true, + false, + 12, + NumberDecimal(0.1234), + ["this is an array"], + {"value": "mongo"}, + Code("function() { return true; }") +]; + +const failTestCases = [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test")]; + +// Testing for every combination of (algorithm, javascriptVariable) +for (const encryptionAlgorithm of encryptionAlgorithms) { + collection.drop(); + + assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey'])); + const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id; + + let pass; + let fail; + if (encryptionAlgorithm === randomAlgorithm) { + pass = [...passTestCases, ...failDeterministic]; + fail = failTestCases; + } else if (encryptionAlgorithm === deterministicAlgorithm) { + pass = passTestCases; + fail = [...failTestCases, ...failDeterministic]; + } - for (const passTestCase of pass) { - const encPassTestCase = shell.encrypt(keyId, passTestCase, encryptionAlgorithm); - assert.eq(passTestCase, shell.decrypt(encPassTestCase)); + for (const passTestCase of pass) { + const encPassTestCase = shell.encrypt(keyId, passTestCase, encryptionAlgorithm); + assert.eq(passTestCase, shell.decrypt(encPassTestCase)); - if (encryptionAlgorithm == deterministicAlgorithm) { - assert.eq(encPassTestCase, shell.encrypt(keyId, passTestCase, encryptionAlgorithm)); - } + if (encryptionAlgorithm == deterministicAlgorithm) { + assert.eq(encPassTestCase, shell.encrypt(keyId, passTestCase, encryptionAlgorithm)); } + } - for (const failTestCase of fail) { - assert.throws(shell.encrypt, [keyId, failTestCase, encryptionAlgorithm]); - } + for (const failTestCase of fail) { + assert.throws(shell.encrypt, [keyId, failTestCase, encryptionAlgorithm]); } +} - mock_kms.stop(); - print("Test completed with no errors."); +mock_kms.stop(); +print("Test completed with no errors."); }());
\ No newline at end of file diff --git a/jstests/client_encrypt/lib/mock_kms.js b/jstests/client_encrypt/lib/mock_kms.js index a7f34c37312..25556379c4a 100644 --- a/jstests/client_encrypt/lib/mock_kms.js +++ b/jstests/client_encrypt/lib/mock_kms.js @@ -18,11 +18,11 @@ const ENABLE_FAULTS = "enable_faults"; class MockKMSServer { /** - * Create a new webserver. - * - * @param {string} fault_type - * @param {bool} disableFaultsOnStartup optionally disable fault on startup - */ + * Create a new webserver. + * + * @param {string} fault_type + * @param {bool} disableFaultsOnStartup optionally disable fault on startup + */ constructor(fault_type, disableFaultsOnStartup) { this.python = "python3"; this.disableFaultsOnStartup = disableFaultsOnStartup || false; |