1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
runOn:
- minServerVersion: "4.1.10"
database_name: &database_name "default"
collection_name: &collection_name "default"
data:
- &doc0_encrypted { _id: 1, encrypted_string: {'$binary': {'base64': 'AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==', 'subType': '06'}} }
json_schema: {'properties': {'encrypted_w_altname': {'encrypt': {'keyId': '/altname', 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'random': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string_equivalent': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
key_vault_data: [{'status': 1, '_id': {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}, 'masterKey': {'provider': 'aws', 'key': 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0', 'region': 'us-east-1'}, 'updateDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyMaterial': {'$binary': {'base64': 'AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO', 'subType': '00'}}, 'creationDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyAltNames': ['altname', 'another_altname']}]
tests:
- description: "Aggregate with deterministic encryption"
skipReason: "SERVER-39395"
clientOptions:
autoEncryptOpts:
kmsProviders:
aws: {} # Credentials filled in from environment.
operations:
- name: aggregate
arguments:
pipeline:
- { $match: { encrypted_string: "457-55-5642" } }
result:
- &doc0 { _id: 1, encrypted_string: "string0" }
expectations:
# Auto encryption will request the collection info.
- command_started_event:
command:
listCollections: 1
filter:
name: *collection_name
command_name: listCollections
# Then key is fetched from the key vault.
- command_started_event:
command:
find: datakeys
filter: {"$or": [{"_id": {"$in": [ {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}} ] }}, {"keyAltNames": {"$in": []}}]}
$db: keyvault
readConcern: { level: "majority" }
command_name: find
- command_started_event:
command:
aggregate: *collection_name
pipeline:
- { $match: { encrypted_string: "457-55-5642" } }
command_name: aggregate
outcome:
collection:
# Outcome is checked using a separate MongoClient without auto encryption.
data:
- *doc0_encrypted
- description: "Aggregate with empty pipeline"
skipReason: "SERVER-40829 hides agg support behind enableTestCommands flag."
clientOptions:
autoEncryptOpts:
kmsProviders:
aws: {} # Credentials filled in from environment.
operations:
- name: aggregate
arguments:
pipeline: []
result:
- { _id: 1, encrypted_string: "string0" }
expectations:
# Auto encryption will request the collection info.
- command_started_event:
command:
listCollections: 1
filter:
name: *collection_name
command_name: listCollections
- command_started_event:
command:
aggregate: *collection_name
pipeline: []
cursor: {}
command_name: aggregate
# Needs to fetch key when decrypting results
# Then key is fetched from the key vault.
- command_started_event:
command:
find: datakeys
filter: {"$or": [{"_id": {"$in": [ {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}} ] }}, {"keyAltNames": {"$in": []}}]}
$db: keyvault
readConcern: { level: "majority" }
command_name: find
outcome:
collection:
# Outcome is checked using a separate MongoClient without auto encryption.
data:
- *doc0_encrypted
- description: "Aggregate should fail with random encryption"
skipReason: "SERVER-39395"
clientOptions:
autoEncryptOpts:
kmsProviders:
aws: {} # Credentials filled in from environment.
operations:
- name: aggregate
arguments:
pipeline:
- { $match: { random: "abc" } }
result:
errorContains: "Cannot query on fields encrypted with the randomized encryption"
- description: "Database aggregate should fail"
clientOptions:
autoEncryptOpts:
kmsProviders:
aws: {} # Credentials filled in from environment.
operations:
- name: aggregate
object: database
arguments:
pipeline:
- $currentOp: { allUsers: false, idleConnections: false, localOps: true }
- $match: { command.aggregate: { $eq: 1 } }
- $project: { command: 1 }
- $project: { command.lsid: 0 }
result:
errorContains: "non-collection command not supported for auto encryption: aggregate"
|
