Skip to content

Commit e0f76bc

Browse files
durrandurran
committed
feat(NODE-4179): allow secureContext in KMS TLS options
1 parent 484adb9 commit e0f76bc

File tree

4 files changed

+217
-62
lines changed

4 files changed

+217
-62
lines changed

‎src/client-side-encryption/state_machine.ts

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ declare module 'mongodb-client-encryption' {
106106
*/
107107
export type ClientEncryptionTlsOptions = Pick<
108108
MongoClientOptions,
109-
'tlsCAFile' | 'tlsCertificateKeyFile' | 'tlsCertificateKeyFilePassword'
109+
'tlsCAFile' | 'tlsCertificateKeyFile' | 'tlsCertificateKeyFilePassword' | 'secureContext'
110110
>;
111111

112112
/** @public */
@@ -521,15 +521,20 @@ export class StateMachine {
521521
tlsOptions: ClientEncryptionTlsOptions,
522522
options: tls.ConnectionOptions
523523
): Promise<void> {
524-
if (tlsOptions.tlsCertificateKeyFile) {
525-
const cert = await fs.readFile(tlsOptions.tlsCertificateKeyFile);
526-
options.cert = options.key = cert;
527-
}
528-
if (tlsOptions.tlsCAFile) {
529-
options.ca = await fs.readFile(tlsOptions.tlsCAFile);
530-
}
531-
if (tlsOptions.tlsCertificateKeyFilePassword) {
532-
options.passphrase = tlsOptions.tlsCertificateKeyFilePassword;
524+
// If a secureContext is provided, it takes precedence over the other options.
525+
if (tlsOptions.secureContext) {
526+
options.secureContext = tlsOptions.secureContext;
527+
} else {
528+
if (tlsOptions.tlsCertificateKeyFile) {
529+
const cert = await fs.readFile(tlsOptions.tlsCertificateKeyFile);
530+
options.cert = options.key = cert;
531+
}
532+
if (tlsOptions.tlsCAFile) {
533+
options.ca = await fs.readFile(tlsOptions.tlsCAFile);
534+
}
535+
if (tlsOptions.tlsCertificateKeyFilePassword) {
536+
options.passphrase = tlsOptions.tlsCertificateKeyFilePassword;
537+
}
533538
}
534539
}
535540

‎test/integration/client-side-encryption/client_side_encryption.prose.test.js renamed to ‎test/integration/client-side-encryption/client_side_encryption.prose.test.ts

Lines changed: 66 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,24 @@
1-
'use strict';
2-
const BSON = require('bson');
3-
const { expect } = require('chai');
4-
const fs = require('fs');
5-
const path = require('path');
6-
7-
const { dropCollection, APMEventCollector } = require('../shared');
8-
9-
const { EJSON } = BSON;
10-
const { LEGACY_HELLO_COMMAND, MongoCryptError, MongoRuntimeError } = require('../../mongodb');
11-
const { MongoServerError, MongoServerSelectionError, MongoClient } = require('../../mongodb');
12-
const { getEncryptExtraOptions } = require('../../tools/utils');
13-
14-
const {
15-
externalSchema
16-
} = require('../../spec/client-side-encryption/external/external-schema.json');
17-
/* eslint-disable no-restricted-modules */
18-
const { ClientEncryption } = require('../../../src/client-side-encryption/client_encryption');
19-
const { getCSFLEKMSProviders } = require('../../csfle-kms-providers');
20-
const { AlpineTestConfiguration } = require('../../tools/runner/config');
21-
22-
const getKmsProviders = (localKey, kmipEndpoint, azureEndpoint, gcpEndpoint) => {
1+
import { BSON, EJSON } from 'bson';
2+
import { expect } from 'chai';
3+
import * as fs from 'fs/promises';
4+
import * as path from 'path';
5+
6+
// eslint-disable-next-line @typescript-eslint/no-restricted-imports
7+
import { ClientEncryption } from '../../../src/client-side-encryption/client_encryption';
8+
import { getCSFLEKMSProviders } from '../../csfle-kms-providers';
9+
import {
10+
LEGACY_HELLO_COMMAND,
11+
MongoClient,
12+
MongoCryptError,
13+
MongoRuntimeError,
14+
MongoServerError,
15+
MongoServerSelectionError
16+
} from '../../mongodb';
17+
import { AlpineTestConfiguration } from '../../tools/runner/config';
18+
import { getEncryptExtraOptions } from '../../tools/utils';
19+
import { APMEventCollector, dropCollection } from '../shared';
20+
21+
export const getKmsProviders = (localKey, kmipEndpoint, azureEndpoint, gcpEndpoint) => {
2322
const result = getCSFLEKMSProviders();
2423
if (localKey) {
2524
result.local = { key: localKey };
@@ -39,6 +38,7 @@ const getKmsProviders = (localKey, kmipEndpoint, azureEndpoint, gcpEndpoint) =>
3938
return result;
4039
};
4140

41+
// eslint-disable-next-line @typescript-eslint/no-empty-function
4242
const noop = () => {};
4343
/** @type { MongoDBMetadataUI } */
4444
const metadata = {
@@ -56,6 +56,24 @@ const eeMetadata = {
5656
}
5757
};
5858

59+
async function loadExternal(file) {
60+
return EJSON.parse(
61+
await fs.readFile(
62+
path.resolve(__dirname, '../../spec/client-side-encryption/external', file),
63+
'utf8'
64+
)
65+
);
66+
}
67+
68+
async function loadLimits(file) {
69+
return EJSON.parse(
70+
await fs.readFile(
71+
path.resolve(__dirname, '../../spec/client-side-encryption/limits', file),
72+
'utf8'
73+
)
74+
);
75+
}
76+
5977
// Tests for the ClientEncryption type are not included as part of the YAML tests.
6078

6179
// In the prose tests LOCAL_MASTERKEY refers to the following base64:
@@ -64,6 +82,9 @@ const eeMetadata = {
6482

6583
// Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk
6684
describe('Client Side Encryption Prose Tests', metadata, function () {
85+
let externalKey;
86+
let externalSchema;
87+
6788
const dataDbName = 'db';
6889
const dataCollName = 'coll';
6990
const dataNamespace = `${dataDbName}.${dataCollName}`;
@@ -76,6 +97,11 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
7697
'base64'
7798
);
7899

100+
before(async function () {
101+
externalKey = await loadExternal('external-key.json');
102+
externalSchema = await loadExternal('external-schema.json');
103+
});
104+
79105
describe('Data key and double encryption', function () {
80106
// Data key and double encryption
81107
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -351,18 +377,8 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
351377
// and confirming that the externalClient is firing off keyVault requests during
352378
// encrypted operations
353379
describe('External Key Vault Test', function () {
354-
function loadExternal(file) {
355-
return EJSON.parse(
356-
fs.readFileSync(path.resolve(__dirname, '../../spec/client-side-encryption/external', file))
357-
);
358-
}
359-
360-
const externalKey = loadExternal('external-key.json');
361-
const externalSchema = loadExternal('external-schema.json');
362-
363-
beforeEach(function () {
380+
beforeEach(async function () {
364381
this.client = this.configuration.newClient();
365-
366382
// 1. Create a MongoClient without encryption enabled (referred to as ``client``).
367383
return (
368384
this.client
@@ -552,15 +568,15 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
552568
});
553569

554570
describe('BSON size limits and batch splitting', function () {
555-
function loadLimits(file) {
556-
return EJSON.parse(
557-
fs.readFileSync(path.resolve(__dirname, '../../spec/client-side-encryption/limits', file))
558-
);
559-
}
560-
561-
const limitsSchema = loadLimits('limits-schema.json');
562-
const limitsKey = loadLimits('limits-key.json');
563-
const limitsDoc = loadLimits('limits-doc.json');
571+
let limitsSchema;
572+
let limitsKey;
573+
let limitsDoc;
574+
575+
before(async function () {
576+
limitsSchema = await loadLimits('limits-schema.json');
577+
limitsKey = await loadLimits('limits-key.json');
578+
limitsDoc = await loadLimits('limits-doc.json');
579+
});
564580

565581
let hasRunFirstTimeSetup = false;
566582

@@ -827,9 +843,9 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
827843

828844
describe('Corpus Test', function () {
829845
it('runs in a separate suite', () => {
830-
expect(() =>
831-
fs.statSync(path.resolve(__dirname, './client_side_encryption.prose.06.corpus.test.ts'))
832-
).not.to.throw();
846+
expect(async () => {
847+
await fs.stat(path.resolve(__dirname, './client_side_encryption.prose.06.corpus.test.ts'));
848+
}).not.to.throw();
833849
});
834850
});
835851

@@ -1687,6 +1703,7 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
16871703
context(
16881704
'Case 5: `tlsDisableOCSPEndpointCheck` is permitted',
16891705
metadata,
1706+
// eslint-disable-next-line @typescript-eslint/no-empty-function
16901707
function () {}
16911708
).skipReason = 'TODO(NODE-4840): Node does not support any OCSP options';
16921709

@@ -1907,12 +1924,12 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
19071924
beforeEach(async function () {
19081925
// Load the file encryptedFields.json as encryptedFields.
19091926
encryptedFields = EJSON.parse(
1910-
await fs.promises.readFile(path.join(data, 'encryptedFields.json')),
1927+
await fs.readFile(path.join(data, 'encryptedFields.json'), 'utf8'),
19111928
{ relaxed: false }
19121929
);
19131930
// Load the file key1-document.json as key1Document.
19141931
key1Document = EJSON.parse(
1915-
await fs.promises.readFile(path.join(data, 'keys', 'key1-document.json')),
1932+
await fs.readFile(path.join(data, 'keys', 'key1-document.json'), 'utf8'),
19161933
{ relaxed: false }
19171934
);
19181935
// Read the "_id" field of key1Document as key1ID.
@@ -2308,15 +2325,13 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
23082325
kmip: {},
23092326
local: undefined
23102327
};
2311-
/** @type {import('../../mongodb').MongoClient} */
23122328
let client1;
2313-
/** @type {import('../../mongodb').MongoClient} */
23142329
let client2;
23152330

23162331
describe('Case 1: Rewrap with separate ClientEncryption', function () {
23172332
/**
2318-
* Run the following test case for each pair of KMS providers (referred to as ``srcProvider`` and ``dstProvider``).
2319-
* Include pairs where ``srcProvider`` equals ``dstProvider``.
2333+
* Run the following test case for each pair of KMS providers (referred to as `srcProvider` and `dstProvider`).
2334+
* Include pairs where `srcProvider` equals `dstProvider`.
23202335
*/
23212336
function* generateTestCombinations() {
23222337
const providers = Object.keys(masterKeys);

‎test/integration/client-side-encryption/driver.test.ts

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
import { UUID } from 'bson';
22
import { expect } from 'chai';
33
import * as crypto from 'crypto';
4+
import * as fs from 'fs/promises';
45
import * as sinon from 'sinon';
56
import { setTimeout } from 'timers/promises';
7+
import * as tls from 'tls';
68

79
// eslint-disable-next-line @typescript-eslint/no-restricted-imports
810
import { ClientEncryption } from '../../../src/client-side-encryption/client_encryption';
@@ -1242,4 +1244,136 @@ describe('CSOT', function () {
12421244
);
12431245
});
12441246
});
1247+
1248+
context('when providing node specific TLS options', function () {
1249+
const dataDbName = 'db';
1250+
const dataCollName = 'coll';
1251+
const dataNamespace = `${dataDbName}.${dataCollName}`;
1252+
const keyVaultDbName = 'keyvault';
1253+
const keyVaultCollName = 'datakeys';
1254+
const keyVaultNamespace = `${keyVaultDbName}.${keyVaultCollName}`;
1255+
const masterKey = {
1256+
region: 'us-east-1',
1257+
key: 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0'
1258+
};
1259+
const schemaMap = {
1260+
[dataNamespace]: {
1261+
bsonType: 'object',
1262+
properties: {
1263+
encrypted_placeholder: {
1264+
encrypt: {
1265+
keyId: '/placeholder',
1266+
bsonType: 'string',
1267+
algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'
1268+
}
1269+
}
1270+
}
1271+
}
1272+
};
1273+
let secureContextOptions;
1274+
1275+
beforeEach(async function () {
1276+
const caFile = await fs.readFile(process.env.CSFLE_TLS_CA_FILE);
1277+
const certFile = await fs.readFile(process.env.CSFLE_TLS_CLIENT_CERT_FILE);
1278+
secureContextOptions = {
1279+
ca: caFile,
1280+
key: certFile,
1281+
cert: certFile
1282+
};
1283+
});
1284+
1285+
context('when no driver specific TLS options are provided', function () {
1286+
let client;
1287+
let clientEncryption;
1288+
const options = {
1289+
keyVaultNamespace,
1290+
kmsProviders: { aws: getCSFLEKMSProviders().aws },
1291+
tlsOptions: {
1292+
aws: {
1293+
secureContext: tls.createSecureContext(secureContextOptions)
1294+
}
1295+
},
1296+
extraOptions: getEncryptExtraOptions()
1297+
};
1298+
1299+
beforeEach(async function () {
1300+
client = this.configuration.newClient({}, { autoEncryption: { ...options, schemaMap } });
1301+
clientEncryption = new ClientEncryption(client, options);
1302+
await client.connect();
1303+
});
1304+
1305+
afterEach(async function () {
1306+
await client.db(keyVaultDbName).collection(keyVaultCollName).deleteMany();
1307+
await client.close();
1308+
});
1309+
1310+
it('succeeds to connect', metadata, async function () {
1311+
// Use client encryption to create a data key. If this succeeds, then TLS worked.
1312+
const awsDatakeyId = await clientEncryption.createDataKey('aws', {
1313+
masterKey,
1314+
keyAltNames: ['aws_altname']
1315+
});
1316+
expect(awsDatakeyId).to.have.property('sub_type', 4);
1317+
// Use the client to get the data key. If this succeeds, then the TLS connection
1318+
// for auto encryption worked.
1319+
const results = await client
1320+
.db(keyVaultDbName)
1321+
.collection(keyVaultCollName)
1322+
.find({ _id: awsDatakeyId })
1323+
.toArray();
1324+
expect(results)
1325+
.to.have.a.lengthOf(1)
1326+
.and.to.have.nested.property('0.masterKey.provider', 'aws');
1327+
});
1328+
});
1329+
1330+
context('when driver specific TLS options are provided', function () {
1331+
let client;
1332+
let clientEncryption;
1333+
// Note we set tlsCAFile and tlsCertificateKeyFile to 'nofilename' to also
1334+
// test that the driver does not attempt to read these files in this case.
1335+
const options = {
1336+
keyVaultNamespace,
1337+
kmsProviders: { aws: getCSFLEKMSProviders().aws },
1338+
tlsOptions: {
1339+
aws: {
1340+
secureContext: tls.createSecureContext(secureContextOptions),
1341+
tlsCAFile: 'nofilename',
1342+
tlsCertificateKeyFile: 'nofilename'
1343+
}
1344+
},
1345+
extraOptions: getEncryptExtraOptions()
1346+
};
1347+
1348+
beforeEach(async function () {
1349+
client = this.configuration.newClient({}, { autoEncryption: { ...options, schemaMap } });
1350+
clientEncryption = new ClientEncryption(client, options);
1351+
await client.connect();
1352+
});
1353+
1354+
afterEach(async function () {
1355+
await client.db(keyVaultDbName).collection(keyVaultCollName).deleteMany();
1356+
await client.close();
1357+
});
1358+
1359+
it('succeeds to connect', metadata, async function () {
1360+
// Use client encryption to create a data key. If this succeeds, then TLS worked.
1361+
const awsDatakeyId = await clientEncryption.createDataKey('aws', {
1362+
masterKey,
1363+
keyAltNames: ['aws_altname']
1364+
});
1365+
expect(awsDatakeyId).to.have.property('sub_type', 4);
1366+
// Use the client to get the data key. If this succeeds, then the TLS connection
1367+
// for auto encryption worked.
1368+
const results = await client
1369+
.db(keyVaultDbName)
1370+
.collection(keyVaultCollName)
1371+
.find({ _id: awsDatakeyId })
1372+
.toArray();
1373+
expect(results)
1374+
.to.have.a.lengthOf(1)
1375+
.and.to.have.nested.property('0.masterKey.provider', 'aws');
1376+
});
1377+
});
1378+
});
12451379
});

‎test/tsconfig.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
"compilerOptions": {
44
"strict": false,
55
"allowJs": true,
6-
"checkJs": false
6+
"checkJs": false,
7+
"resolveJsonModule": true
78
},
89
"include": [
910
"../node_modules/@types/mocha/index.d.ts",

0 commit comments

Comments
 (0)