summaryrefslogtreecommitdiff
path: root/jstests/client_encrypt
diff options
context:
space:
mode:
authorclang-format-7.0.1 <adam.martin@10gen.com>2019-07-26 18:20:35 -0400
committerADAM David Alan Martin <adam.martin@10gen.com>2019-07-27 11:02:23 -0400
commit134a4083953270e8a11430395357fb70a29047ad (patch)
treedd428e1230e31d92b20b393dfdc17ffe7fa79cb6 /jstests/client_encrypt
parent1e46b5049003f427047e723ea5fab15b5a9253ca (diff)
downloadmongo-134a4083953270e8a11430395357fb70a29047ad.tar.gz
SERVER-41772 Apply clang-format 7.0.1 to the codebase
Diffstat (limited to 'jstests/client_encrypt')
-rw-r--r--jstests/client_encrypt/fle_auto_decrypt.js73
-rw-r--r--jstests/client_encrypt/fle_aws_faults.js210
-rw-r--r--jstests/client_encrypt/fle_command_line_encryption.js62
-rw-r--r--jstests/client_encrypt/fle_encrypt_decrypt_shell.js214
-rw-r--r--jstests/client_encrypt/fle_key_faults.js152
-rw-r--r--jstests/client_encrypt/fle_keys.js98
-rw-r--r--jstests/client_encrypt/fle_valid_fle_options.js90
-rw-r--r--jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js143
-rw-r--r--jstests/client_encrypt/lib/mock_kms.js10
9 files changed, 536 insertions, 516 deletions
diff --git a/jstests/client_encrypt/fle_auto_decrypt.js b/jstests/client_encrypt/fle_auto_decrypt.js
index 8122538c9f3..182c8af3ac4 100644
--- a/jstests/client_encrypt/fle_auto_decrypt.js
+++ b/jstests/client_encrypt/fle_auto_decrypt.js
@@ -5,52 +5,55 @@ load("jstests/client_encrypt/lib/mock_kms.js");
load('jstests/ssl/libs/ssl_helpers.js');
(function() {
- "use strict";
+"use strict";
- const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT};
+const x509_options = {
+ sslMode: "requireSSL",
+ sslPEMKeyFile: SERVER_CERT,
+ sslCAFile: CA_CERT
+};
- const conn = MongoRunner.runMongod(x509_options);
+const conn = MongoRunner.runMongod(x509_options);
- let localKMS = {
- key: BinData(
- 0,
- "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"),
- };
+let localKMS = {
+ key: BinData(
+ 0,
+ "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"),
+};
- const clientSideFLEOptions = {
- kmsProviders: {
- local: localKMS,
- },
- keyVaultNamespace: "test.coll",
- schemaMap: {}
- };
+const clientSideFLEOptions = {
+ kmsProviders: {
+ local: localKMS,
+ },
+ keyVaultNamespace: "test.coll",
+ schemaMap: {}
+};
- const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
+const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
- const shell = Mongo(conn.host, clientSideFLEOptions);
- const keyVault = shell.getKeyVault();
+const shell = Mongo(conn.host, clientSideFLEOptions);
+const keyVault = shell.getKeyVault();
- assert.writeOK(
- keyVault.createKey("local", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
+assert.writeOK(keyVault.createKey("local", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
- const clientEncrypt = shell.getClientEncryption();
- const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
+const clientEncrypt = shell.getClientEncryption();
+const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
- const encryptedStr = clientEncrypt.encrypt(keyId, "mongodb", deterministicAlgorithm);
+const encryptedStr = clientEncrypt.encrypt(keyId, "mongodb", deterministicAlgorithm);
- // Insert encrypted string into database
- const collection = conn.getDB("test").getCollection("collection");
+// Insert encrypted string into database
+const collection = conn.getDB("test").getCollection("collection");
- for (var i = 0; i < 150; i++) {
- assert.writeOK(collection.insert({string: encryptedStr, id: 1}));
- }
+for (var i = 0; i < 150; i++) {
+ assert.writeOK(collection.insert({string: encryptedStr, id: 1}));
+}
- // Ensure string is auto decrypted
- const encryptedCollection = shell.getDB("test").getCollection("collection");
- const result = encryptedCollection.find({id: 1}).toArray();
- result.forEach(function(entry) {
- assert.eq(entry.string, "mongodb");
- });
+// Ensure string is auto decrypted
+const encryptedCollection = shell.getDB("test").getCollection("collection");
+const result = encryptedCollection.find({id: 1}).toArray();
+result.forEach(function(entry) {
+ assert.eq(entry.string, "mongodb");
+});
- MongoRunner.stopMongod(conn);
+MongoRunner.stopMongod(conn);
}()); \ No newline at end of file
diff --git a/jstests/client_encrypt/fle_aws_faults.js b/jstests/client_encrypt/fle_aws_faults.js
index c7afb02513c..1d9a621b42a 100644
--- a/jstests/client_encrypt/fle_aws_faults.js
+++ b/jstests/client_encrypt/fle_aws_faults.js
@@ -6,137 +6,137 @@ load("jstests/client_encrypt/lib/mock_kms.js");
load('jstests/ssl/libs/ssl_helpers.js');
(function() {
- "use strict";
+"use strict";
- const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT};
+const x509_options = {
+ sslMode: "requireSSL",
+ sslPEMKeyFile: SERVER_CERT,
+ sslCAFile: CA_CERT
+};
- const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
+const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
- const conn = MongoRunner.runMongod(x509_options);
- const test = conn.getDB("test");
- const collection = test.coll;
+const conn = MongoRunner.runMongod(x509_options);
+const test = conn.getDB("test");
+const collection = test.coll;
- function runKMS(mock_kms, func) {
- mock_kms.start();
+function runKMS(mock_kms, func) {
+ mock_kms.start();
- const awsKMS = {
- accessKeyId: "access",
- secretAccessKey: "secret",
- url: mock_kms.getURL(),
- };
+ const awsKMS = {
+ accessKeyId: "access",
+ secretAccessKey: "secret",
+ url: mock_kms.getURL(),
+ };
- const clientSideFLEOptions = {
- kmsProviders: {
- aws: awsKMS,
- },
- keyVaultNamespace: "test.coll",
- schemaMap: {}
- };
+ const clientSideFLEOptions = {
+ kmsProviders: {
+ aws: awsKMS,
+ },
+ keyVaultNamespace: "test.coll",
+ schemaMap: {}
+ };
- const shell = Mongo(conn.host, clientSideFLEOptions);
- const cleanCacheShell = Mongo(conn.host, clientSideFLEOptions);
+ const shell = Mongo(conn.host, clientSideFLEOptions);
+ const cleanCacheShell = Mongo(conn.host, clientSideFLEOptions);
- collection.drop();
+ collection.drop();
- func(shell, cleanCacheShell);
+ func(shell, cleanCacheShell);
- mock_kms.stop();
- }
+ mock_kms.stop();
+}
- function testBadEncryptResult(fault) {
- const mock_kms = new MockKMSServer(fault, false);
+function testBadEncryptResult(fault) {
+ const mock_kms = new MockKMSServer(fault, false);
- runKMS(mock_kms, (shell) => {
- const keyVault = shell.getKeyVault();
+ runKMS(mock_kms, (shell) => {
+ const keyVault = shell.getKeyVault();
- assert.throws(() => keyVault.createKey(
- "aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
- assert.eq(keyVault.getKeys("mongoKey").toArray().length, 0);
- });
- }
-
- testBadEncryptResult(FAULT_ENCRYPT);
- testBadEncryptResult(FAULT_ENCRYPT_WRONG_FIELDS);
- testBadEncryptResult(FAULT_ENCRYPT_BAD_BASE64);
+ assert.throws(
+ () => keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
+ assert.eq(keyVault.getKeys("mongoKey").toArray().length, 0);
+ });
+}
- function testBadEncryptError() {
- const mock_kms = new MockKMSServer(FAULT_ENCRYPT_CORRECT_FORMAT, false);
+testBadEncryptResult(FAULT_ENCRYPT);
+testBadEncryptResult(FAULT_ENCRYPT_WRONG_FIELDS);
+testBadEncryptResult(FAULT_ENCRYPT_BAD_BASE64);
- runKMS(mock_kms, (shell) => {
- const keyVault = shell.getKeyVault();
+function testBadEncryptError() {
+ const mock_kms = new MockKMSServer(FAULT_ENCRYPT_CORRECT_FORMAT, false);
- let error =
- assert.throws(() => keyVault.createKey(
- "aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
- assert.commandFailedWithCode(error, [51224]);
- assert.eq(
- error,
- "Error: AWS KMS failed to encrypt: NotFoundException : Error encrypting message");
- });
- }
-
- testBadEncryptError();
-
- function testBadDecryptResult(fault) {
- const mock_kms = new MockKMSServer(fault, false);
-
- runKMS(mock_kms, (shell) => {
- const keyVault = shell.getKeyVault();
- assert.writeOK(
- keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
- const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id;
- const str = "mongo";
- assert.throws(() => {
- const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm);
- });
- });
- }
+ runKMS(mock_kms, (shell) => {
+ const keyVault = shell.getKeyVault();
- testBadDecryptResult(FAULT_DECRYPT);
+ let error = assert.throws(
+ () => keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
+ assert.commandFailedWithCode(error, [51224]);
+ assert.eq(error,
+ "Error: AWS KMS failed to encrypt: NotFoundException : Error encrypting message");
+ });
+}
- function testBadDecryptKeyResult(fault) {
- const mock_kms = new MockKMSServer(fault, true);
+testBadEncryptError();
- runKMS(mock_kms, (shell, cleanCacheShell) => {
- const keyVault = shell.getKeyVault();
+function testBadDecryptResult(fault) {
+ const mock_kms = new MockKMSServer(fault, false);
- assert.writeOK(
- keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
- const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id;
- const str = "mongo";
+ runKMS(mock_kms, (shell) => {
+ const keyVault = shell.getKeyVault();
+ assert.writeOK(
+ keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
+ const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id;
+ const str = "mongo";
+ assert.throws(() => {
const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm);
+ });
+ });
+}
+
+testBadDecryptResult(FAULT_DECRYPT);
- mock_kms.enableFaults();
+function testBadDecryptKeyResult(fault) {
+ const mock_kms = new MockKMSServer(fault, true);
- assert.throws(() => {
- var str = cleanCacheShell.decrypt(encStr);
- });
+ runKMS(mock_kms, (shell, cleanCacheShell) => {
+ const keyVault = shell.getKeyVault();
+ assert.writeOK(
+ keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
+ const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id;
+ const str = "mongo";
+ const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm);
+
+ mock_kms.enableFaults();
+
+ assert.throws(() => {
+ var str = cleanCacheShell.decrypt(encStr);
});
- }
-
- testBadDecryptKeyResult(FAULT_DECRYPT_WRONG_KEY);
-
- function testBadDecryptError() {
- const mock_kms = new MockKMSServer(FAULT_DECRYPT_CORRECT_FORMAT, false);
-
- runKMS(mock_kms, (shell) => {
- const keyVault = shell.getKeyVault();
- assert.writeOK(
- keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
- const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id;
- const str = "mongo";
- let error = assert.throws(() => {
- const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm);
- });
- assert.commandFailedWithCode(error, [51225]);
- assert.eq(
- error,
- "Error: AWS KMS failed to decrypt: NotFoundException : Error decrypting message");
+ });
+}
+
+testBadDecryptKeyResult(FAULT_DECRYPT_WRONG_KEY);
+
+function testBadDecryptError() {
+ const mock_kms = new MockKMSServer(FAULT_DECRYPT_CORRECT_FORMAT, false);
+
+ runKMS(mock_kms, (shell) => {
+ const keyVault = shell.getKeyVault();
+ assert.writeOK(
+ keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ["mongoKey"]));
+ const keyId = keyVault.getKeys("mongoKey").toArray()[0]._id;
+ const str = "mongo";
+ let error = assert.throws(() => {
+ const encStr = shell.getClientEncryption().encrypt(keyId, str, randomAlgorithm);
});
- }
+ assert.commandFailedWithCode(error, [51225]);
+ assert.eq(error,
+ "Error: AWS KMS failed to decrypt: NotFoundException : Error decrypting message");
+ });
+}
- testBadDecryptError();
+testBadDecryptError();
- MongoRunner.stopMongod(conn);
+MongoRunner.stopMongod(conn);
}()); \ No newline at end of file
diff --git a/jstests/client_encrypt/fle_command_line_encryption.js b/jstests/client_encrypt/fle_command_line_encryption.js
index 9113f9f2d74..1ad044b4d95 100644
--- a/jstests/client_encrypt/fle_command_line_encryption.js
+++ b/jstests/client_encrypt/fle_command_line_encryption.js
@@ -6,36 +6,40 @@ load('jstests/ssl/libs/ssl_helpers.js');
(function() {
- const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT};
- const conn = MongoRunner.runMongod(x509_options);
+const x509_options = {
+ sslMode: "requireSSL",
+ sslPEMKeyFile: SERVER_CERT,
+ sslCAFile: CA_CERT
+};
+const conn = MongoRunner.runMongod(x509_options);
- const shellOpts = [
- "mongo",
- "--host",
- conn.host,
- "--port",
- conn.port,
- "--tls",
- "--sslPEMKeyFile",
- CLIENT_CERT,
- "--sslCAFile",
- CA_CERT,
- "--tlsAllowInvalidHostnames",
- "--awsAccessKeyId",
- "access",
- "--awsSecretAccessKey",
- "secret",
- "--keyVaultNamespace",
- "test.coll",
- "--kmsURL",
- "https://localhost:8000",
- ];
+const shellOpts = [
+ "mongo",
+ "--host",
+ conn.host,
+ "--port",
+ conn.port,
+ "--tls",
+ "--sslPEMKeyFile",
+ CLIENT_CERT,
+ "--sslCAFile",
+ CA_CERT,
+ "--tlsAllowInvalidHostnames",
+ "--awsAccessKeyId",
+ "access",
+ "--awsSecretAccessKey",
+ "secret",
+ "--keyVaultNamespace",
+ "test.coll",
+ "--kmsURL",
+ "https://localhost:8000",
+];
- const testFiles = [
- "jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js",
- ];
+const testFiles = [
+ "jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js",
+];
- for (const file of testFiles) {
- runMongoProgram(...shellOpts, file);
- }
+for (const file of testFiles) {
+ runMongoProgram(...shellOpts, file);
+}
}()); \ No newline at end of file
diff --git a/jstests/client_encrypt/fle_encrypt_decrypt_shell.js b/jstests/client_encrypt/fle_encrypt_decrypt_shell.js
index fd7847c04dc..f67bc72dccc 100644
--- a/jstests/client_encrypt/fle_encrypt_decrypt_shell.js
+++ b/jstests/client_encrypt/fle_encrypt_decrypt_shell.js
@@ -5,117 +5,119 @@ load("jstests/client_encrypt/lib/mock_kms.js");
load('jstests/ssl/libs/ssl_helpers.js');
(function() {
- "use strict";
-
- const mock_kms = new MockKMSServer();
- mock_kms.start();
-
- const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT};
-
- const conn = MongoRunner.runMongod(x509_options);
- const test = conn.getDB("test");
- const collection = test.coll;
-
- const awsKMS = {
- accessKeyId: "access",
- secretAccessKey: "secret",
- url: mock_kms.getURL(),
- };
-
- let localKMS = {
- key: BinData(
- 0,
- "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"),
- };
-
- const clientSideFLEOptions = {
- kmsProviders: {
- aws: awsKMS,
- local: localKMS,
- },
- keyVaultNamespace: "test.coll",
- schemaMap: {}
- };
-
- const kmsTypes = ["aws", "local"];
-
- const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
- const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
- const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm];
-
- const passTestCases = [
- "mongo",
- NumberLong(13),
- NumberInt(23),
- UUID(),
- ISODate(),
- new Date('December 17, 1995 03:24:00'),
- BinData(0, '1234'),
- BinData(1, '1234'),
- BinData(3, '1234'),
- BinData(4, '1234'),
- BinData(5, '1234'),
- BinData(6, '1234'),
- new Timestamp(1, 2),
- new ObjectId(),
- new DBPointer("mongo", new ObjectId()),
- /test/
- ];
-
- const failDeterministic = [
- true,
- false,
- 12,
- NumberDecimal(0.1234),
- ["this is an array"],
- {"value": "mongo"},
- Code("function() { return true; }")
- ];
-
- const failTestCases =
- [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test"), BinData(2, '1234')];
-
- const shell = Mongo(conn.host, clientSideFLEOptions);
- const keyVault = shell.getKeyVault();
-
- // Testing for every combination of (kmsType, algorithm, javascriptVariable)
- for (const kmsType of kmsTypes) {
- for (const encryptionAlgorithm of encryptionAlgorithms) {
- collection.drop();
-
- assert.writeOK(
- keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
- const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
-
- let pass;
- let fail;
- if (encryptionAlgorithm === randomAlgorithm) {
- pass = [...passTestCases, ...failDeterministic];
- fail = failTestCases;
- } else if (encryptionAlgorithm === deterministicAlgorithm) {
- pass = passTestCases;
- fail = [...failTestCases, ...failDeterministic];
- }
+"use strict";
+
+const mock_kms = new MockKMSServer();
+mock_kms.start();
+
+const x509_options = {
+ sslMode: "requireSSL",
+ sslPEMKeyFile: SERVER_CERT,
+ sslCAFile: CA_CERT
+};
+
+const conn = MongoRunner.runMongod(x509_options);
+const test = conn.getDB("test");
+const collection = test.coll;
+
+const awsKMS = {
+ accessKeyId: "access",
+ secretAccessKey: "secret",
+ url: mock_kms.getURL(),
+};
+
+let localKMS = {
+ key: BinData(
+ 0,
+ "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"),
+};
+
+const clientSideFLEOptions = {
+ kmsProviders: {
+ aws: awsKMS,
+ local: localKMS,
+ },
+ keyVaultNamespace: "test.coll",
+ schemaMap: {}
+};
+
+const kmsTypes = ["aws", "local"];
+
+const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
+const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
+const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm];
+
+const passTestCases = [
+ "mongo",
+ NumberLong(13),
+ NumberInt(23),
+ UUID(),
+ ISODate(),
+ new Date('December 17, 1995 03:24:00'),
+ BinData(0, '1234'),
+ BinData(1, '1234'),
+ BinData(3, '1234'),
+ BinData(4, '1234'),
+ BinData(5, '1234'),
+ BinData(6, '1234'),
+ new Timestamp(1, 2),
+ new ObjectId(),
+ new DBPointer("mongo", new ObjectId()),
+ /test/
+];
+
+const failDeterministic = [
+ true,
+ false,
+ 12,
+ NumberDecimal(0.1234),
+ ["this is an array"],
+ {"value": "mongo"},
+ Code("function() { return true; }")
+];
+
+const failTestCases =
+ [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test"), BinData(2, '1234')];
+
+const shell = Mongo(conn.host, clientSideFLEOptions);
+const keyVault = shell.getKeyVault();
+
+// Testing for every combination of (kmsType, algorithm, javascriptVariable)
+for (const kmsType of kmsTypes) {
+ for (const encryptionAlgorithm of encryptionAlgorithms) {
+ collection.drop();
+
+ assert.writeOK(
+ keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
+ const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
+
+ let pass;
+ let fail;
+ if (encryptionAlgorithm === randomAlgorithm) {
+ pass = [...passTestCases, ...failDeterministic];
+ fail = failTestCases;
+ } else if (encryptionAlgorithm === deterministicAlgorithm) {
+ pass = passTestCases;
+ fail = [...failTestCases, ...failDeterministic];
+ }
- const clientEncrypt = shell.getClientEncryption();
- for (const passTestCase of pass) {
- const encPassTestCase =
- clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm);
- assert.eq(passTestCase, clientEncrypt.decrypt(encPassTestCase));
+ const clientEncrypt = shell.getClientEncryption();
+ for (const passTestCase of pass) {
+ const encPassTestCase = clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm);
+ assert.eq(passTestCase, clientEncrypt.decrypt(encPassTestCase));
- if (encryptionAlgorithm === deterministicAlgorithm) {
- assert.eq(encPassTestCase,
- clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm));
- }
+ if (encryptionAlgorithm === deterministicAlgorithm) {
+ assert.eq(encPassTestCase,
+ clientEncrypt.encrypt(keyId, passTestCase, encryptionAlgorithm));
}
+ }
- for (const failTestCase of fail) {
- assert.throws(() =>
- clientEncrypt.encrypt(keyId, failTestCase, encryptionAlgorithm));
- }
+ for (const failTestCase of fail) {
+ assert.throws(() => clientEncrypt.encrypt(keyId, failTestCase, encryptionAlgorithm));
}
}
+}
- MongoRunner.stopMongod(conn);
- mock_kms.stop();
+MongoRunner.stopMongod(conn);
+mock_kms.stop();
}()); \ No newline at end of file
diff --git a/jstests/client_encrypt/fle_key_faults.js b/jstests/client_encrypt/fle_key_faults.js
index b81c1bcfa81..41b2505c8ba 100644
--- a/jstests/client_encrypt/fle_key_faults.js
+++ b/jstests/client_encrypt/fle_key_faults.js
@@ -6,89 +6,93 @@ load("jstests/client_encrypt/lib/mock_kms.js");
load('jstests/ssl/libs/ssl_helpers.js');
(function() {
- "use strict";
-
- const mock_kms = new MockKMSServer();
- mock_kms.start();
-
- const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT};
-
- const conn = MongoRunner.runMongod(x509_options);
- const test = conn.getDB("test");
- const collection = test.coll;
-
- const awsKMS = {
- accessKeyId: "access",
- secretAccessKey: "secret",
- url: mock_kms.getURL(),
- };
-
- var localKMS = {
- key: BinData(
- 0,
- "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"),
- };
-
- const clientSideFLEOptions = {
- kmsProviders: {
- aws: awsKMS,
- local: localKMS,
- },
- keyVaultNamespace: "test.coll",
- schemaMap: {}
- };
-
- function testFault(kmsType, func) {
- collection.drop();
-
- const shell = Mongo(conn.host, clientSideFLEOptions);
- const keyVault = shell.getKeyVault();
-
- assert.writeOK(
- keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
- const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
-
- func(keyId, shell);
- }
-
- function testFaults(func) {
- const kmsTypes = ["aws", "local"];
-
- for (const kmsType of kmsTypes) {
- testFault(kmsType, func);
- }
+"use strict";
+
+const mock_kms = new MockKMSServer();
+mock_kms.start();
+
+const x509_options = {
+ sslMode: "requireSSL",
+ sslPEMKeyFile: SERVER_CERT,
+ sslCAFile: CA_CERT
+};
+
+const conn = MongoRunner.runMongod(x509_options);
+const test = conn.getDB("test");
+const collection = test.coll;
+
+const awsKMS = {
+ accessKeyId: "access",
+ secretAccessKey: "secret",
+ url: mock_kms.getURL(),
+};
+
+var localKMS = {
+ key: BinData(
+ 0,
+ "tu9jUCBqZdwCelwE/EAm/4WqdxrSMi04B8e9uAV+m30rI1J2nhKZZtQjdvsSCwuI4erR6IEcEK+5eGUAODv43NDNIR9QheT2edWFewUfHKsl9cnzTc86meIzOmYl6drp"),
+};
+
+const clientSideFLEOptions = {
+ kmsProviders: {
+ aws: awsKMS,
+ local: localKMS,
+ },
+ keyVaultNamespace: "test.coll",
+ schemaMap: {}
+};
+
+function testFault(kmsType, func) {
+ collection.drop();
+
+ const shell = Mongo(conn.host, clientSideFLEOptions);
+ const keyVault = shell.getKeyVault();
+
+ assert.writeOK(
+ keyVault.createKey(kmsType, "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
+ const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
+
+ func(keyId, shell);
+}
+
+function testFaults(func) {
+ const kmsTypes = ["aws", "local"];
+
+ for (const kmsType of kmsTypes) {
+ testFault(kmsType, func);
}
+}
- // Negative - drop the key vault collection
- testFaults((keyId, shell) => {
- collection.drop();
+// Negative - drop the key vault collection
+testFaults((keyId, shell) => {
+ collection.drop();
- const str = "mongo";
- assert.throws(() => {
- const encStr = shell.getClientEncryption().encrypt(keyId, str);
- });
+ const str = "mongo";
+ assert.throws(() => {
+ const encStr = shell.getClientEncryption().encrypt(keyId, str);
});
+});
- // Negative - delete the keys
- testFaults((keyId, shell) => {
- collection.deleteMany({});
+// Negative - delete the keys
+testFaults((keyId, shell) => {
+ collection.deleteMany({});
- const str = "mongo";
- assert.throws(() => {
- const encStr = shell.getClientEncryption().encrypt(keyId, str);
- });
+ const str = "mongo";
+ assert.throws(() => {
+ const encStr = shell.getClientEncryption().encrypt(keyId, str);
});
+});
- // Negative - corrupt the master key with an unkown provider
- testFaults((keyId, shell) => {
- collection.updateMany({}, {$set: {"masterKey.provider": "fake"}});
+// Negative - corrupt the master key with an unkown provider
+testFaults((keyId, shell) => {
+ collection.updateMany({}, {$set: {"masterKey.provider": "fake"}});
- const str = "mongo";
- assert.throws(() => {
- const encStr = shell.getClientEncryption().encrypt(keyId, str);
- });
+ const str = "mongo";
+ assert.throws(() => {
+ const encStr = shell.getClientEncryption().encrypt(keyId, str);
});
+});
- MongoRunner.stopMongod(conn);
- mock_kms.stop();
+MongoRunner.stopMongod(conn);
+mock_kms.stop();
}()); \ No newline at end of file
diff --git a/jstests/client_encrypt/fle_keys.js b/jstests/client_encrypt/fle_keys.js
index 875615ac9a8..646b95141ad 100644
--- a/jstests/client_encrypt/fle_keys.js
+++ b/jstests/client_encrypt/fle_keys.js
@@ -6,70 +6,74 @@ load("jstests/client_encrypt/lib/mock_kms.js");
load('jstests/ssl/libs/ssl_helpers.js');
(function() {
- "use strict";
+"use strict";
- const mock_kms = new MockKMSServer();
- mock_kms.start();
+const mock_kms = new MockKMSServer();
+mock_kms.start();
- const x509_options = {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT};
+const x509_options = {
+ sslMode: "requireSSL",
+ sslPEMKeyFile: SERVER_CERT,
+ sslCAFile: CA_CERT
+};
- const conn = MongoRunner.runMongod(x509_options);
- const test = conn.getDB("test");
- const collection = test.coll;
+const conn = MongoRunner.runMongod(x509_options);
+const test = conn.getDB("test");
+const collection = test.coll;
- const awsKMS = {
- accessKeyId: "access",
- secretAccessKey: "secret",
- url: mock_kms.getURL(),
- };
+const awsKMS = {
+ accessKeyId: "access",
+ secretAccessKey: "secret",
+ url: mock_kms.getURL(),
+};
- const clientSideFLEOptions = {
- kmsProviders: {
- aws: awsKMS,
- },
- keyVaultNamespace: "test.coll",
- schemaMap: {}
- };
+const clientSideFLEOptions = {
+ kmsProviders: {
+ aws: awsKMS,
+ },
+ keyVaultNamespace: "test.coll",
+ schemaMap: {}
+};
- const conn_str = "mongodb://" + conn.host + "/?ssl=true";
- const shell = Mongo(conn_str, clientSideFLEOptions);
- const keyVault = shell.getKeyVault();
+const conn_str = "mongodb://" + conn.host + "/?ssl=true";
+const shell = Mongo(conn_str, clientSideFLEOptions);
+const keyVault = shell.getKeyVault();
- var key = keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']);
- assert.eq(1, keyVault.getKeys().itcount());
+var key = keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']);
+assert.eq(1, keyVault.getKeys().itcount());
- var result = keyVault.createKey("aws", "arn:aws:kms:us-east-4:fake:fake:fake", {});
- assert.eq("TypeError: key alternate names must be of Array type.", result);
+var result = keyVault.createKey("aws", "arn:aws:kms:us-east-4:fake:fake:fake", {});
+assert.eq("TypeError: key alternate names must be of Array type.", result);
- result = keyVault.createKey("aws", "arn:aws:kms:us-east-5:fake:fake:fake", [1]);
- assert.eq("TypeError: items in key alternate names must be of String type.", result);
+result = keyVault.createKey("aws", "arn:aws:kms:us-east-5:fake:fake:fake", [1]);
+assert.eq("TypeError: items in key alternate names must be of String type.", result);
- assert.eq(1, keyVault.getKeyByAltName("mongoKey").itcount());
+assert.eq(1, keyVault.getKeyByAltName("mongoKey").itcount());
- var keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
+var keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
- keyVault.addKeyAlternateName(keyId, "mongoKey2");
+keyVault.addKeyAlternateName(keyId, "mongoKey2");
- assert.eq(1, keyVault.getKeyByAltName("mongoKey2").itcount());
- assert.eq(2, keyVault.getKey(keyId).toArray()[0].keyAltNames.length);
- assert.eq(1, keyVault.getKeys().itcount());
+assert.eq(1, keyVault.getKeyByAltName("mongoKey2").itcount());
+assert.eq(2, keyVault.getKey(keyId).toArray()[0].keyAltNames.length);
+assert.eq(1, keyVault.getKeys().itcount());
- result = keyVault.addKeyAlternateName(keyId, [2]);
- assert.eq("TypeError: key alternate name cannot be object or array type.", result);
+result = keyVault.addKeyAlternateName(keyId, [2]);
+assert.eq("TypeError: key alternate name cannot be object or array type.", result);
- keyVault.removeKeyAlternateName(keyId, "mongoKey2");
- assert.eq(1, keyVault.getKey(keyId).toArray()[0].keyAltNames.length);
+keyVault.removeKeyAlternateName(keyId, "mongoKey2");
+assert.eq(1, keyVault.getKey(keyId).toArray()[0].keyAltNames.length);
- result = keyVault.deleteKey(keyId);
- assert.eq(0, keyVault.getKey(keyId).itcount());
- assert.eq(0, keyVault.getKeys().itcount());
+result = keyVault.deleteKey(keyId);
+assert.eq(0, keyVault.getKey(keyId).itcount());
+assert.eq(0, keyVault.getKeys().itcount());
- assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake1"));
- assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-2:fake:fake:fake2"));
- assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-3:fake:fake:fake3"));
+assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake1"));
+assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-2:fake:fake:fake2"));
+assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-3:fake:fake:fake3"));
- assert.eq(3, keyVault.getKeys().itcount());
+assert.eq(3, keyVault.getKeys().itcount());
- MongoRunner.stopMongod(conn);
- mock_kms.stop();
+MongoRunner.stopMongod(conn);
+mock_kms.stop();
}()); \ No newline at end of file
diff --git a/jstests/client_encrypt/fle_valid_fle_options.js b/jstests/client_encrypt/fle_valid_fle_options.js
index 9bdabaf4875..08a44f18725 100644
--- a/jstests/client_encrypt/fle_valid_fle_options.js
+++ b/jstests/client_encrypt/fle_valid_fle_options.js
@@ -3,60 +3,64 @@ load("jstests/client_encrypt/lib/mock_kms.js");
load('jstests/ssl/libs/ssl_helpers.js');
(function() {
- "use strict";
+"use strict";
- const mock_kms = new MockKMSServer();
- mock_kms.start();
+const mock_kms = new MockKMSServer();
+mock_kms.start();
- const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
- const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
+const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
+const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
- const x509_options =
- {sslMode: "requireSSL", sslPEMKeyFile: SERVER_CERT, sslCAFile: CA_CERT, vvvvv: ""};
+const x509_options = {
+ sslMode: "requireSSL",
+ sslPEMKeyFile: SERVER_CERT,
+ sslCAFile: CA_CERT,
+ vvvvv: ""
+};
- const conn = MongoRunner.runMongod(x509_options);
- const unencryptedDatabase = conn.getDB("test");
- const collection = unencryptedDatabase.keystore;
+const conn = MongoRunner.runMongod(x509_options);
+const unencryptedDatabase = conn.getDB("test");
+const collection = unencryptedDatabase.keystore;
- const awsKMS = {
- accessKeyId: "access",
- secretAccessKey: "secret",
- url: mock_kms.getURL(),
- };
+const awsKMS = {
+ accessKeyId: "access",
+ secretAccessKey: "secret",
+ url: mock_kms.getURL(),
+};
- const clientSideFLEOptionsFail = [
- {
- kmsProviders: {
- aws: awsKMS,
- },
- schemaMap: {},
+const clientSideFLEOptionsFail = [
+ {
+ kmsProviders: {
+ aws: awsKMS,
},
- {
- keyVaultNamespace: "test.keystore",
- schemaMap: {},
- },
- ];
+ schemaMap: {},
+ },
+ {
+ keyVaultNamespace: "test.keystore",
+ schemaMap: {},
+ },
+];
- clientSideFLEOptionsFail.forEach(element => {
- assert.throws(Mongo, [conn.host, element]);
- });
+clientSideFLEOptionsFail.forEach(element => {
+ assert.throws(Mongo, [conn.host, element]);
+});
- const clientSideFLEOptionsPass = [
- {
- kmsProviders: {
- aws: awsKMS,
- },
- keyVaultNamespace: "test.keystore",
- schemaMap: {},
+const clientSideFLEOptionsPass = [
+ {
+ kmsProviders: {
+ aws: awsKMS,
},
- ];
+ keyVaultNamespace: "test.keystore",
+ schemaMap: {},
+ },
+];
- clientSideFLEOptionsPass.forEach(element => {
- assert.doesNotThrow(() => {
- Mongo(conn.host, element);
- });
+clientSideFLEOptionsPass.forEach(element => {
+ assert.doesNotThrow(() => {
+ Mongo(conn.host, element);
});
+});
- MongoRunner.stopMongod(conn);
- mock_kms.stop();
+MongoRunner.stopMongod(conn);
+mock_kms.stop();
}());
diff --git a/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js b/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js
index 0ca10b2057c..da83d69c87b 100644
--- a/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js
+++ b/jstests/client_encrypt/lib/fle_command_line_explicit_encryption.js
@@ -1,84 +1,83 @@
/**
-* Check the functionality of encrypt and decrypt functions in KeyVault.js. This test is run by
-* jstests/fle/fle_command_line_encryption.js.
-*/
+ * Check the functionality of encrypt and decrypt functions in KeyVault.js. This test is run by
+ * jstests/fle/fle_command_line_encryption.js.
+ */
load("jstests/client_encrypt/lib/mock_kms.js");
(function() {
- "use strict";
-
- const mock_kms = new MockKMSServer();
- mock_kms.start();
-
- const shell = Mongo();
- const keyVault = shell.getKeyVault();
-
- const test = shell.getDB("test");
- const collection = test.coll;
-
- const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
- const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
- const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm];
-
- const passTestCases = [
- "mongo",
- NumberLong(13),
- NumberInt(23),
- UUID(),
- ISODate(),
- new Date('December 17, 1995 03:24:00'),
- BinData(2, '1234'),
- new Timestamp(1, 2),
- new ObjectId(),
- new DBPointer("mongo", new ObjectId()),
- /test/
- ];
-
- const failDeterministic = [
- true,
- false,
- 12,
- NumberDecimal(0.1234),
- ["this is an array"],
- {"value": "mongo"},
- Code("function() { return true; }")
- ];
-
- const failTestCases = [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test")];
-
- // Testing for every combination of (algorithm, javascriptVariable)
- for (const encryptionAlgorithm of encryptionAlgorithms) {
- collection.drop();
-
- assert.writeOK(
- keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
- const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
-
- let pass;
- let fail;
- if (encryptionAlgorithm === randomAlgorithm) {
- pass = [...passTestCases, ...failDeterministic];
- fail = failTestCases;
- } else if (encryptionAlgorithm === deterministicAlgorithm) {
- pass = passTestCases;
- fail = [...failTestCases, ...failDeterministic];
- }
+"use strict";
+
+const mock_kms = new MockKMSServer();
+mock_kms.start();
+
+const shell = Mongo();
+const keyVault = shell.getKeyVault();
+
+const test = shell.getDB("test");
+const collection = test.coll;
+
+const randomAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
+const deterministicAlgorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
+const encryptionAlgorithms = [randomAlgorithm, deterministicAlgorithm];
+
+const passTestCases = [
+ "mongo",
+ NumberLong(13),
+ NumberInt(23),
+ UUID(),
+ ISODate(),
+ new Date('December 17, 1995 03:24:00'),
+ BinData(2, '1234'),
+ new Timestamp(1, 2),
+ new ObjectId(),
+ new DBPointer("mongo", new ObjectId()),
+ /test/
+];
+
+const failDeterministic = [
+ true,
+ false,
+ 12,
+ NumberDecimal(0.1234),
+ ["this is an array"],
+ {"value": "mongo"},
+ Code("function() { return true; }")
+];
+
+const failTestCases = [null, undefined, MinKey(), MaxKey(), DBRef("test", "test", "test")];
+
+// Testing for every combination of (algorithm, javascriptVariable)
+for (const encryptionAlgorithm of encryptionAlgorithms) {
+ collection.drop();
+
+ assert.writeOK(keyVault.createKey("aws", "arn:aws:kms:us-east-1:fake:fake:fake", ['mongoKey']));
+ const keyId = keyVault.getKeyByAltName("mongoKey").toArray()[0]._id;
+
+ let pass;
+ let fail;
+ if (encryptionAlgorithm === randomAlgorithm) {
+ pass = [...passTestCases, ...failDeterministic];
+ fail = failTestCases;
+ } else if (encryptionAlgorithm === deterministicAlgorithm) {
+ pass = passTestCases;
+ fail = [...failTestCases, ...failDeterministic];
+ }
- for (const passTestCase of pass) {
- const encPassTestCase = shell.encrypt(keyId, passTestCase, encryptionAlgorithm);
- assert.eq(passTestCase, shell.decrypt(encPassTestCase));
+ for (const passTestCase of pass) {
+ const encPassTestCase = shell.encrypt(keyId, passTestCase, encryptionAlgorithm);
+ assert.eq(passTestCase, shell.decrypt(encPassTestCase));
- if (encryptionAlgorithm == deterministicAlgorithm) {
- assert.eq(encPassTestCase, shell.encrypt(keyId, passTestCase, encryptionAlgorithm));
- }
+ if (encryptionAlgorithm == deterministicAlgorithm) {
+ assert.eq(encPassTestCase, shell.encrypt(keyId, passTestCase, encryptionAlgorithm));
}
+ }
- for (const failTestCase of fail) {
- assert.throws(shell.encrypt, [keyId, failTestCase, encryptionAlgorithm]);
- }
+ for (const failTestCase of fail) {
+ assert.throws(shell.encrypt, [keyId, failTestCase, encryptionAlgorithm]);
}
+}
- mock_kms.stop();
- print("Test completed with no errors.");
+mock_kms.stop();
+print("Test completed with no errors.");
}()); \ No newline at end of file
diff --git a/jstests/client_encrypt/lib/mock_kms.js b/jstests/client_encrypt/lib/mock_kms.js
index a7f34c37312..25556379c4a 100644
--- a/jstests/client_encrypt/lib/mock_kms.js
+++ b/jstests/client_encrypt/lib/mock_kms.js
@@ -18,11 +18,11 @@ const ENABLE_FAULTS = "enable_faults";
class MockKMSServer {
/**
- * Create a new webserver.
- *
- * @param {string} fault_type
- * @param {bool} disableFaultsOnStartup optionally disable fault on startup
- */
+ * Create a new webserver.
+ *
+ * @param {string} fault_type
+ * @param {bool} disableFaultsOnStartup optionally disable fault on startup
+ */
constructor(fault_type, disableFaultsOnStartup) {
this.python = "python3";
this.disableFaultsOnStartup = disableFaultsOnStartup || false;