Skip to content

[CDRIVER-4540] Define a success test for CreateEncryptedCollection #1176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jan 13, 2023
Merged

[CDRIVER-4540] Define a success test for CreateEncryptedCollection #1176

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2cc093d
Define a success test for CreateEncryptedCollection
vector-of-bool Jan 12, 2023
fbf8835
Update src/libmongoc/tests/test-mongoc-client-side-encryption.c
vector-of-bool Jan 12, 2023
35adada
Update src/libmongoc/tests/test-mongoc-client-side-encryption.c
vector-of-bool Jan 12, 2023
a9255bb
Conversion warning
vector-of-bool Jan 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
125 changes: 125 additions & 0 deletions src/libmongoc/tests/test-mongoc-client-side-encryption.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6417,6 +6417,122 @@ test_create_encrypted_collection_bad_keyId (void *unused)
mongoc_client_destroy (client);
}

// Implements Prose Test 21. Case: 4.
static void
test_create_encrypted_collection_insert (void *unused)
{
BSON_UNUSED (unused);
bson_error_t error = {0};
mongoc_client_t *const client = test_framework_new_default_client ();
bson_t *const kmsProviders = _make_kms_providers (false, true);

const char *const dbName = "cec-test-db";

// Drop prior data
{
mongoc_collection_t *const coll =
mongoc_client_get_collection (client, "keyvault", "datakeys");
if (coll) {
mongoc_collection_drop (coll, &error);
bool okay =
error.code == 0 || strstr (error.message, "ns not found") != NULL;
ASSERT_OR_PRINT (okay, error);
Comment on lines +6436 to +6439
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this just be (void)mongoc_collection_drop(...); as done in some other tests?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potentially, but any error other than "ns not found" will indicate that the remainder of the test will likely also fail.

}
mongoc_collection_destroy (coll);

mongoc_database_t *const db = mongoc_client_get_database (client, dbName);
ASSERT_OR_PRINT (mongoc_database_drop (db, &error), error);
mongoc_database_destroy (db);
}

// Create a CE
mongoc_client_encryption_opts_t *const ceOpts =
mongoc_client_encryption_opts_new ();
mongoc_client_encryption_opts_set_kms_providers (ceOpts, kmsProviders);
mongoc_client_encryption_opts_set_keyvault_namespace (
ceOpts, "keyvault", "datakeys");
mongoc_client_encryption_opts_set_keyvault_client (ceOpts, client);
mongoc_client_encryption_t *const ce =
mongoc_client_encryption_new (ceOpts, &error);
mongoc_client_encryption_opts_destroy (ceOpts);
ASSERT_OR_PRINT (ce, error);

// Create the encrypted collection
bsonBuildDecl (ccOpts,
kv ("encryptedFields",
doc (kv ("fields",
array (doc (kv ("path", cstr ("ssn")),
kv ("bsonType", cstr ("string")),
kv ("keyId", null)))))));
mongoc_database_t *const db = mongoc_client_get_database (client, dbName);
mongoc_client_encryption_datakey_opts_t *const dkOpts =
mongoc_client_encryption_datakey_opts_new ();
bson_t new_opts;
mongoc_collection_t *const coll =
mongoc_client_encryption_create_encrypted_collection (
ce, db, "testing1", &ccOpts, &new_opts, "local", dkOpts, &error);
ASSERT_OR_PRINT (coll, error);
bson_destroy (&ccOpts);

// Extract the encryption key ID that was generated by
// CreateEncryptedCollection:
bson_value_t new_keyid;
bsonParse (
new_opts,
require (
keyWithType ("encryptedFields", doc),
parse (require (
keyWithType ("fields", array),
visitEach (require (type (doc)),
parse (require (key ("keyId"),
require (type (binary)),
do({
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
do({
do ({

ClangFormat.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This appears to be a behavior change in Clang 16 :(

bson_value_copy (
bson_iter_value (
(bson_iter_t *) &bsonVisitIter),
&new_keyid);
}),
halt)))))));
ASSERT_CMPSTR (bsonParseError, NULL);

// Generate some plaintext:
bson_value_t plain;
plain.value_type = BSON_TYPE_UTF8;
plain.value.v_utf8.str = "123-45-6789";
plain.value.v_utf8.len = (uint32_t) strlen (plain.value.v_utf8.str);

// Encrypt the value using the new encryption key:
mongoc_client_encryption_encrypt_opts_t *eo =
mongoc_client_encryption_encrypt_opts_new ();
mongoc_client_encryption_encrypt_opts_set_keyid (eo, &new_keyid);
mongoc_client_encryption_encrypt_opts_set_algorithm (
eo, MONGOC_ENCRYPT_ALGORITHM_UNINDEXED);
bson_value_t ciphertext;
bool okay =
mongoc_client_encryption_encrypt (ce, &plain, eo, &ciphertext, &error);
ASSERT_OR_PRINT (okay, error);
mongoc_client_encryption_encrypt_opts_destroy (eo);
bson_value_destroy (&new_keyid);

// Insert the ciphertext:
bsonBuildDecl (doc, kv ("ssn", value (ciphertext)));
okay = mongoc_collection_insert_one (coll, &doc, NULL, NULL, &error);
ASSERT_OR_PRINT (okay, error);
// Success!

bson_destroy (&doc);
bson_value_destroy (&ciphertext);
bson_destroy (kmsProviders);
mongoc_client_encryption_datakey_opts_destroy (dkOpts);
mongoc_collection_destroy (coll);
mongoc_database_drop (db, &error);
mongoc_database_destroy (db);
mongoc_client_encryption_destroy (ce);
mongoc_client_destroy (client);
bson_destroy (&new_opts);
}


typedef struct listen_socket {
mongoc_socket_t *socket;
mongoc_cond_t cond;
Expand Down Expand Up @@ -6890,6 +7006,15 @@ test_client_side_encryption_install (TestSuite *suite)
test_framework_skip_if_no_client_side_encryption,
test_framework_skip_if_max_wire_version_less_than_17,
test_framework_skip_if_single);
TestSuite_AddFull (
suite,
"/client_side_encryption/createEncryptedCollection/insert",
test_create_encrypted_collection_insert,
NULL,
NULL,
test_framework_skip_if_no_client_side_encryption,
test_framework_skip_if_max_wire_version_less_than_17,
test_framework_skip_if_single);
TestSuite_AddFull (
suite,
"/client_side_encryption/bypass_mongocryptd_shared_library",
Expand Down