Skip to content

CDRIVER-4584 support Queryable Encryption v2 #1228

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kevinAlbs merged 14 commits into from
Apr 6, 2023
Merged

CDRIVER-4584 support Queryable Encryption v2 #1228

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
aa82b19
add setfle2parameter.py workaround
kevinAlbs Mar 30, 2023
db13c19
remove `fle2-*` tests
kevinAlbs Mar 30, 2023
8c4bd22
add `fle2v2-*` tests
kevinAlbs Mar 30, 2023
65c6f85
call `mongocrypt_setopt_fle2v2` to enable QEv2
kevinAlbs Mar 30, 2023
521f7b7
format test-mongoc-client-side-encryption.c
kevinAlbs Mar 30, 2023
1e45855
skip QE prose tests on server < 7.0.0 and serverless
kevinAlbs Mar 30, 2023
5851073
use libmongocrypt 1.8.0-alpha0
kevinAlbs Mar 30, 2023
56bfe11
require libmongocrypt 1.8.0
kevinAlbs Mar 31, 2023
acb4284
use macro for skips
kevinAlbs Mar 31, 2023
7db4bcf
Simplify error messages
kevinAlbs Apr 3, 2023
aee8b36
check for error on mongocrypt_setopt_fle2v2
kevinAlbs Apr 3, 2023
f3f7ebc
use skip functions for consistency
kevinAlbs Apr 3, 2023
bd7c24a
remove extra whitespace
kevinAlbs Apr 3, 2023
ca32612
Revert "add setfle2parameter.py workaround"
kevinAlbs Apr 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 1 addition & 10 deletions .evergreen/scripts/compile-libmongocrypt.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,16 +5,7 @@ compile_libmongocrypt() {
declare -r mongoc_dir="${2:?}"
declare -r install_dir="${3:?}"

git clone -q --depth=1 https://github.com/mongodb/libmongocrypt --branch 1.7.0 || return

# TODO: remove once latest libmongocrypt release contains commit c6f65fe6.
{
pushd libmongocrypt || return
echo "1.7.0+c6f65fe6" >|VERSION_CURRENT
git fetch -q origin master || return
git checkout -q c6f65fe6 || return # Allows -DENABLE_MONGOC=OFF.
popd || return # libmongocrypt
}
git clone -q --depth=1 https://github.com/mongodb/libmongocrypt --branch 1.8.0-alpha0 || return

declare -a crypt_cmake_flags=(
"-DMONGOCRYPT_MONGOC_DIR=${mongoc_dir}"
Expand Down
18 changes: 18 additions & 0 deletions .evergreen/scripts/integration-tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,24 @@ find orchestration_configs -name \*.json | xargs perl -p -i -e "s|/tmp/orchestra
export ORCHESTRATION_FILE="orchestration_configs/${TOPOLOGY}s/${ORCHESTRATION_FILE}.json"
export ORCHESTRATION_URL="http://localhost:8889/v1/${TOPOLOGY}s"

if [ "$CLIENT_SIDE_ENCRYPTION" = "on" -a "$MONGODB_VERSION" = "latest" ]; then
# This is a temporary workaround until featureFlagFLE2ProtocolVersion2 is enabled by default in SERVER-69563. Once latest server builds have SERVER-69563, this if block may be removed.
# DRIVERS-2590 tracks removal of this workaround.
echo "SERVER-69563: rewrite orchestration config to add setParameter featureFlagFLE2ProtocolVersion2=1 ... begin"
# Only attempt to enable the feature flag if the server is 7.0.0. The 'latest' builds may not be updated to 7.0 yet.
ACTUAL_MONGODB_VERSION=$(./mongodb/bin/mongod --version | head -1 | awk '{print $3}')
case $ACTUAL_MONGODB_VERSION in
v7*)
python $DIR/setfle2parameter.py $ORCHESTRATION_FILE > $ORCHESTRATION_FILE.modified
mv $ORCHESTRATION_FILE.modified $ORCHESTRATION_FILE
;;
*)
echo "mongod version $ACTUAL_MONGODB_VERSION is not v7. Not enabling featureFlagFLE2ProtocolVersion2"
;;
esac
echo "SERVER-69563: rewrite orchestration config to add setParameter featureFlagFLE2ProtocolVersion2=1 ... end"
fi

export TMPDIR=$MONGO_ORCHESTRATION_HOME/db
echo From shell `date` > $MONGO_ORCHESTRATION_HOME/server.log

Expand Down
184 changes: 184 additions & 0 deletions .evergreen/scripts/setfle2parameter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,184 @@
#!/usr/bin/env python3
"""
setfle2parameter.py modifies and prints an orchestration config file to add the `--setParameter featureFlagFLE2ProtocolVersion2=1` option to mongod and mongos.
Usage: setfle2parameter.py <orchestration config file path>
This file is a temporary workaround until featureFlagFLE2ProtocolVersion2 is enabled by default in SERVER-69563. Once latest server builds have SERVER-69563, this file may be removed.
DRIVERS-2590 tracks removal of this file.
"""

import json
import sys
import unittest
import os


def do_rewrite(config):
did_rewrite = False

def rewrite_server(server):
if "procParams" in server:
if "setParameter" in server["procParams"]:
server["procParams"]["setParameter"]["featureFlagFLE2ProtocolVersion2"] = "1"
else:
server["procParams"]["setParameter"] = {
"featureFlagFLE2ProtocolVersion2": "1"
}
return True
return False
Copy link
Contributor

@vector-of-bool vector-of-bool Apr 5, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if "procParams" in server:
if "setParameter" in server["procParams"]:
server["procParams"]["setParameter"]["featureFlagFLE2ProtocolVersion2"] = "1"
else:
server["procParams"]["setParameter"] = {
"featureFlagFLE2ProtocolVersion2": "1"
}
return True
return False
params = server.get("procParams")
if params is None:
return False
setParams = params.setdefault("setParameter", {})
setParams["featureFlagFLE2ProtocolVersion2"] = "1"
return True

Dict.get returns None if the key is absent. Dict.setdefault(K, V) returns the existing value if present or performs Dict[K] = V, and then returns Dict[V]. dicts are by-reference mutable.


# Rewrite for a server.
if rewrite_server(config):
did_rewrite = True
# Rewrite for each member in a replica set.
if "members" in config:
for server in config["members"]:
if rewrite_server(server):
did_rewrite = True
# Rewrite each shard.
if "shards" in config:
for shard in config["shards"]:
if "shardParams" in shard:
if "members" in shard["shardParams"]:
for server in shard["shardParams"]["members"]:
if rewrite_server (server):
did_rewrite = True
# Rewrite each router.
if "routers" in config:
for router in config["routers"]:
# routers do not use `procParams`. Use setParameter directly.
if "setParameter" in router:
router["setParameter"]["featureFlagFLE2ProtocolVersion2"] = "1"
else:
router["setParameter"] = {
"featureFlagFLE2ProtocolVersion2": "1"
}
did_rewrite = True
Copy link
Contributor

@vector-of-bool vector-of-bool Apr 5, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I got nerd-sniped into flattening this code :)

Suggested change
# Rewrite for a server.
if rewrite_server(config):
did_rewrite = True
# Rewrite for each member in a replica set.
if "members" in config:
for server in config["members"]:
if rewrite_server(server):
did_rewrite = True
# Rewrite each shard.
if "shards" in config:
for shard in config["shards"]:
if "shardParams" in shard:
if "members" in shard["shardParams"]:
for server in shard["shardParams"]["members"]:
if rewrite_server (server):
did_rewrite = True
# Rewrite each router.
if "routers" in config:
for router in config["routers"]:
# routers do not use `procParams`. Use setParameter directly.
if "setParameter" in router:
router["setParameter"]["featureFlagFLE2ProtocolVersion2"] = "1"
else:
router["setParameter"] = {
"featureFlagFLE2ProtocolVersion2": "1"
}
did_rewrite = True
import itertools
# We will rewrite the root config:
root = [config]
# And any top-level members:
root_members = config.get("members", [])
# As well as the members within any defined shards:
shards = config.get("shards", [])
# Get a list of lists of membres:
shard_member_lists = (s.get("shardParams", {}).get("members", []) for s in shards)
# Flatten the list of lists:
shard_members = itertools.chain.from_iterable(shard_member_lists)
# For all members in all groups:
all_members = itertools.chain(root, root_members, shard_members)
# Rewrite them all:
all_rewrites = list(map(rewrite_server, all_members))
# Did we actually rewrite anything?
did_rewrite = any(all_rewrites)
# Rewrite each router.
for rtr in config.get("routers", []):
ps = rtr.setdefault("setParameter", {})
ps["featureFlagFLE2ProtocolVersion2"] = "1"
did_rewrite = True

itertools.chain reference

Copy link
Collaborator Author

@kevinAlbs kevinAlbs Apr 6, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh that is really neat. I did not know about itertools.chain.



if not did_rewrite:
raise Exception(
"Did not add setParameter. Does the orchestration config have `procParams`?"
)
pass
Copy link
Contributor

@vector-of-bool vector-of-bool Apr 5, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
pass



class TestRewrite(unittest.TestCase):
def test_rewrite(self):
# Test that setParameter is added for a server.
input = {
"procParams": {}
}
do_rewrite (input)
self.assertEqual (input, {
"procParams": {
"setParameter": {
"featureFlagFLE2ProtocolVersion2": "1"
}
}
})

# Test that other setParameter values are kept for a server.
input = {
"procParams": {
"setParameter": {
"foo": "bar"
}
}
}
do_rewrite (input)
self.assertEqual (input, {
"procParams": {
"setParameter": {
"foo": "bar",
"featureFlagFLE2ProtocolVersion2": "1"
}
}
})

# Test that setParameter is added for a replica_set.
input = {
"members": [
{"procParams": {}},
{"procParams": {}},
]
}
do_rewrite(input)
self.assertEqual(
input,
{
"members": [
{
"procParams": {
"setParameter": {"featureFlagFLE2ProtocolVersion2": "1"}
}
},
{
"procParams": {
"setParameter": {"featureFlagFLE2ProtocolVersion2": "1"}
}
},
]
},
)

# Test that setParameter is added for shards and routers.
input = {
"shards": [
{"shardParams": {"members": [{"procParams": {}}, {"procParams": {}}]}}
],
"routers": [{}, {}],
}

do_rewrite(input)
self.assertEqual(
input,
{
"shards": [
{
"shardParams": {
"members": [
{
"procParams": {
"setParameter": {
"featureFlagFLE2ProtocolVersion2": "1"
}
}
},
{
"procParams": {
"setParameter": {
"featureFlagFLE2ProtocolVersion2": "1"
}
}
},
]
}
}
],
"routers": [
{"setParameter": {"featureFlagFLE2ProtocolVersion2": "1"}},
{"setParameter": {"featureFlagFLE2ProtocolVersion2": "1"}},
],
},
)


if __name__ == "__main__":
if os.environ.get("SELFTEST", "OFF") == "ON":
print("Doing self test")
unittest.main()
sys.exit(0)

if len(sys.argv) != 2:
print(
"Error: expected path to orchestration config file path as first argument"
)
print("Usage: setfle2parameter.py <orchestration config file path>")
sys.exit(1)

path = sys.argv[1]
with open(path, "r") as file:
config = json.loads(file.read())
do_rewrite(config)
print (json.dumps(config, indent=4))

4 changes: 2 additions & 2 deletions src/libmongoc/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -441,10 +441,10 @@ elseif (NOT ENABLE_CLIENT_SIDE_ENCRYPTION STREQUAL OFF)
find_package (mongocrypt QUIET)
endif ()

if (mongocrypt_FOUND AND "${mongocrypt_VERSION}" VERSION_LESS 1.7.0)
if (mongocrypt_FOUND AND "${mongocrypt_VERSION}" VERSION_LESS 1.8.0)
message ("-- libmongocrypt found at ${mongocrypt_DIR}")
message ("-- libmongocrypt version ${mongocrypt_VERSION} found")
message ("-- libmongocrypt version 1.7.0 is required to enable Client-Side Field Level Encryption Support.")
message ("-- libmongocrypt version 1.8.0 is required to enable Client-Side Field Level Encryption Support.")
set (REQUIRED_MONGOCRYPT_VERSION_FOUND OFF)
elseif (mongocrypt_FOUND)
set (REQUIRED_MONGOCRYPT_VERSION_FOUND ON)
Expand Down
3 changes: 3 additions & 0 deletions src/libmongoc/src/mongoc/mongoc-crypt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1326,6 +1326,9 @@ _mongoc_crypt_new (const bson_t *kms_providers,
crypt = bson_malloc0 (sizeof (*crypt));
crypt->handle = mongocrypt_new ();

// Enable the QEv2 protocol.
mongocrypt_setopt_fle2v2 (crypt->handle, true);

// Stash away a copy of the user's kmsProviders in case we need to lazily
// load credentials.
bson_copy_to (kms_providers, &crypt->kms_providers);
Expand Down
77 changes: 8 additions & 69 deletions ...tion/legacy/fle2-BypassQueryAnalysis.json → ...on/legacy/fle2v2-BypassQueryAnalysis.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,12 @@
{
"runOn": [
{
"minServerVersion": "6.0.0",
"minServerVersion": "7.0.0",
"serverless": "forbid",
"topology": [
"replicaset",
"sharded"
"sharded",
"load-balanced"
]
}
],
Expand Down Expand Up @@ -74,36 +76,6 @@
"masterKey": {
"provider": "local"
}
},
{
"_id": {
"$binary": {
"base64": "q83vqxI0mHYSNBI0VniQEg==",
"subType": "04"
}
},
"keyMaterial": {
"$binary": {
"base64": "HBk9BWihXExNDvTp1lUxOuxuZK2Pe2ZdVdlsxPEBkiO1bS4mG5NNDsQ7zVxJAH8BtdOYp72Ku4Y3nwc0BUpIKsvAKX4eYXtlhv5zUQxWdeNFhg9qK7qb8nqhnnLeT0f25jFSqzWJoT379hfwDeu0bebJHr35QrJ8myZdPMTEDYF08QYQ48ShRBli0S+QzBHHAQiM2iJNr4svg2WR8JSeWQ==",
"subType": "00"
}
},
"creationDate": {
"$date": {
"$numberLong": "1648914851981"
}
},
"updateDate": {
"$date": {
"$numberLong": "1648914851981"
}
},
"status": {
"$numberInt": "0"
},
"masterKey": {
"provider": "local"
}
}
],
"tests": [
Expand Down Expand Up @@ -132,7 +104,7 @@
"_id": 1,
"encryptedIndexed": {
"$binary": {
"base64": "BHEBAAAFZAAgAAAAAHb62aV7+mqmaGcotPLdG3KP7S8diFwWMLM/5rYtqLrEBXMAIAAAAAAVJ6OWHRv3OtCozHpt3ZzfBhaxZirLv3B+G8PuaaO4EgVjACAAAAAAsZXWOWA+UiCBbrJNB6bHflB/cn7pWSvwWN2jw4FPeIUFcABQAAAAAMdD1nV2nqeI1eXEQNskDflCy8I7/HvvqDKJ6XxjhrPQWdLqjz+8GosGUsB7A8ee/uG9/guENuL25XD+Fxxkv1LLXtavHOlLF7iW0u9yabqqBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AE0AAAAAq83vqxI0mHYSNBI0VniQEkzZZBBDgeZh+h+gXEmOrSFtVvkUcnHWj/rfPW7iJ0G3UJ8zpuBmUM/VjOMJCY4+eDqdTiPIwX+/vNXegc8FZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsAA==",
"base64": "C18BAAAFZAAgAAAAANnt+eLTkv4GdDPl8IAfJOvTzArOgFJQ2S/DcLza4W0DBXMAIAAAAAD2u+omZme3P2gBPehMQyQHQ153tPN1+z7bksYA9jKTpAVwADAAAAAAUnCOQqIvmR65YKyYnsiVfVrg9hwUVO3RhhKExo3RWOzgaS0QdsBL5xKFS0JhZSoWBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AFAAAAAAEjRWeBI0mHYSNBI0VniQEpQbp/ZJpWBKeDtKLiXb0P2E9wvc0g3f373jnYQYlJquOrlPOoEy3ngsHPJuSUijvWDsrQzqYa349K7G/66qaXEFZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsBWwAIAAAAACkm0o9bj6j0HuADKc0svbqO2UHj6GrlNdF6yKNxh63xRJrAAAAAAAAAAAAAA==",
"subType": "06"
}
}
Expand All @@ -149,7 +121,7 @@
"result": [
{
"_id": 1,
"encryptedIndexed": "value123"
"encryptedIndexed": "123"
}
]
}
Expand All @@ -175,7 +147,7 @@
"_id": 1,
"encryptedIndexed": {
"$binary": {
"base64": "BHEBAAAFZAAgAAAAAHb62aV7+mqmaGcotPLdG3KP7S8diFwWMLM/5rYtqLrEBXMAIAAAAAAVJ6OWHRv3OtCozHpt3ZzfBhaxZirLv3B+G8PuaaO4EgVjACAAAAAAsZXWOWA+UiCBbrJNB6bHflB/cn7pWSvwWN2jw4FPeIUFcABQAAAAAMdD1nV2nqeI1eXEQNskDflCy8I7/HvvqDKJ6XxjhrPQWdLqjz+8GosGUsB7A8ee/uG9/guENuL25XD+Fxxkv1LLXtavHOlLF7iW0u9yabqqBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AE0AAAAAq83vqxI0mHYSNBI0VniQEkzZZBBDgeZh+h+gXEmOrSFtVvkUcnHWj/rfPW7iJ0G3UJ8zpuBmUM/VjOMJCY4+eDqdTiPIwX+/vNXegc8FZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsAA==",
"base64": "C18BAAAFZAAgAAAAANnt+eLTkv4GdDPl8IAfJOvTzArOgFJQ2S/DcLza4W0DBXMAIAAAAAD2u+omZme3P2gBPehMQyQHQ153tPN1+z7bksYA9jKTpAVwADAAAAAAUnCOQqIvmR65YKyYnsiVfVrg9hwUVO3RhhKExo3RWOzgaS0QdsBL5xKFS0JhZSoWBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AFAAAAAAEjRWeBI0mHYSNBI0VniQEpQbp/ZJpWBKeDtKLiXb0P2E9wvc0g3f373jnYQYlJquOrlPOoEy3ngsHPJuSUijvWDsrQzqYa349K7G/66qaXEFZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsBWwAIAAAAACkm0o9bj6j0HuADKc0svbqO2UHj6GrlNdF6yKNxh63xRJrAAAAAAAAAAAAAA==",
"subType": "06"
}
}
Expand Down Expand Up @@ -229,39 +201,6 @@
},
"command_name": "find"
}
},
{
"command_started_event": {
"command": {
"find": "datakeys",
"filter": {
"$or": [
{
"_id": {
"$in": [
{
"$binary": {
"base64": "q83vqxI0mHYSNBI0VniQEg==",
"subType": "04"
}
}
]
}
},
{
"keyAltNames": {
"$in": []
}
}
]
},
"$db": "keyvault",
"readConcern": {
"level": "majority"
}
},
"command_name": "find"
}
}
],
"outcome": {
Expand All @@ -275,7 +214,7 @@
"__safeContent__": [
{
"$binary": {
"base64": "ThpoKfQ8AkOzkFfNC1+9PF0pY2nIzfXvRdxQgjkNbBw=",
"base64": "31eCYlbQoVboc5zwC8IoyJVSkag9PxREka8dkmbXJeY=",
"subType": "00"
}
}
Expand Down
6 changes: 4 additions & 2 deletions ..._side_encryption/legacy/fle2-Compact.json → ...ide_encryption/legacy/fle2v2-Compact.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,12 @@
{
"runOn": [
{
"minServerVersion": "6.0.0",
"minServerVersion": "7.0.0",
"serverless": "forbid",
"topology": [
"replicaset",
"sharded"
"sharded",
"load-balanced"
]
}
],
Expand Down
Loading