Skip to content

Parse options for automatic encryption using libmongocrypt #1071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jan 16, 2020

Conversation

alcaeus
Copy link
Member

@alcaeus alcaeus commented Dec 6, 2019

This PR covers PHPC-1498 and PHPC-1500. For now, it includes the commit of #1065 (PHPC-1496).

The test for autoEncryption driver options is a dummy that ensures that the settings can be parsed. It does not include any skips since we don't have tests set up where we compile without client-side encryption support. Since we don't expose any encryption settings yet, we just ensure that the manager can be created successfully.

@alcaeus alcaeus force-pushed the phpc-1498 branch 2 times, most recently from 538ccaa to ffcbe9d Compare December 12, 2019 14:37
@alcaeus alcaeus force-pushed the phpc-1498 branch 2 times, most recently from cc64973 to 9112d57 Compare December 20, 2019 16:18
Copy link
Member

@jmikola jmikola left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some small comments on test files. Everything else LGTM, so feel free to implement test changes and merge if you agree with my suggestions.

<?php exit(0); ?>
--EXPECTF--
OK: Got MongoDB\Driver\Exception\RuntimeException
Key vault namespace option required
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume these error messages originate from libmongocrypt or libmongoc, as I don't see them in this PR. It's unfortunate that they don't actually tell users what option key is missing, but I suppose there's no way around that. I'm not going to propose that we parse out these error messages and rewrite them 😛

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, those are errors from libmongoc. If we want to make those error messages more meaningful, we need to start checking error codes or something, which is a bigger undertaking.

?>
===DONE===
<?php exit(0); ?>
--EXPECTF--
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No patterns are used so this can just be --EXPECT--.


foreach ($tests as $driverOptions) {
$manager = new MongoDB\Driver\Manager(null, [], ['autoEncryption' => $driverOptions + $baseOptions]);
var_dump($manager);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd propose we remove this and change the expected output block to:

--EXPECT--
===DONE===

Looking at the current var_dump() output, there's nothing relevant to the autoEncryption actually being applied, so I think all we're testing for here is that an exception hasn't been thrown. We do have other tests that do the same (i.e. no output expected to demonstrate the code runs successfully).

['extraOptions' => ['mongocryptdBypassSpawn' => true]],
];

foreach ($tests as $driverOptions) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think $autoEncryptionOptions would be a better name, as the values in $tests above are all options that go within the autoEncryption key.

$driverOptions would be the third argument to the Manager constructor, so that name would make more sense if each value in $tests started with an autoEncryption key.

@@ -0,0 +1,83 @@
--TEST--
MongoDB\Driver\Manager::__construct(): auto encryption options
--FILE--
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If MONGOC_ENABLE_CLIENT_SIDE_ENCRYPTION is undefined, phongo_manager_set_auto_encryption_opts() throws the following if it finds a autoEncryption key in a non-null driverOptions:

phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT TSRMLS_CC, "Cannot enable automatic field-level encryption. Please recompile with support for libmongocrypt using the with-mongodb-client-side-encryption configure switch.");

This test will fail when FLE is not enabled. I propose you create a skip_if_not_libmongocrypt() function based on skip_if_not_libmongoc_crypto() and skip_if_not_libmongoc_ssl() in tests/utils/skipif.php. It will be simpler than those, as you won't need logic to check for specific libs.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the function, also added the counterpart and an additional test for when compiling without FLE as mentioned in the comment below.

@@ -0,0 +1,29 @@
--TEST--
MongoDB\Driver\Manager::__construct(): incomplete auto encryption options
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would also benefit from a --SKIPIF-- that calls skip_if_not_libmongocrypt().

I'll defer to you if you'd like to create a separate test for the phongo_manager_set_auto_encryption_opts() exception message when FLE is not available. If so, that would warrant creating another function: skip_if_libmongocrypt().

@alcaeus
Copy link
Member Author

alcaeus commented Jan 16, 2020

@jmikola just FYI, the session/bug1274-002 test failed on the SHARDED_CLUSTER_RS deployment but passed on a subsequent run. We may want to keep an eye on this one.

Diff:

========DIFF========
005+ Session is on server: no
005- Session is on server: yes
========DONE========
FAIL PHPC-1274: Session destruct should not end session from parent process [tests/session/bug1274-002.phpt] 

alcaeus added a commit that referenced this pull request Jan 16, 2020
@alcaeus alcaeus merged commit 08bac1e into mongodb:master Jan 16, 2020
@alcaeus alcaeus deleted the phpc-1498 branch January 16, 2020 08:50
@jmikola
Copy link
Member

jmikola commented Jan 16, 2020

Opened PHPC-1526 to deal with intermittent test failures. Thanks for catching that!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants