Ross Lawley
11 months ago
committed by
Christoph Strobl
14 changed files with 829 additions and 26 deletions
@ -0,0 +1,373 @@
@@ -0,0 +1,373 @@
|
||||
/* |
||||
* Copyright 2023-2024 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.data.mongodb.core.encryption; |
||||
|
||||
import static java.util.Arrays.*; |
||||
import static org.assertj.core.api.Assertions.*; |
||||
import static org.springframework.data.mongodb.core.EncryptionAlgorithms.*; |
||||
import static org.springframework.data.mongodb.core.query.Criteria.*; |
||||
|
||||
import java.security.SecureRandom; |
||||
import java.util.Map; |
||||
import java.util.Objects; |
||||
import java.util.concurrent.atomic.AtomicReference; |
||||
import java.util.function.Supplier; |
||||
import java.util.stream.Collectors; |
||||
|
||||
import com.mongodb.AutoEncryptionSettings; |
||||
import com.mongodb.ClientEncryptionSettings; |
||||
import com.mongodb.ConnectionString; |
||||
import com.mongodb.MongoClientSettings; |
||||
import com.mongodb.MongoNamespace; |
||||
import com.mongodb.client.MongoClient; |
||||
import com.mongodb.client.MongoClients; |
||||
import com.mongodb.client.MongoCollection; |
||||
import com.mongodb.client.MongoDatabase; |
||||
import com.mongodb.client.model.CreateCollectionOptions; |
||||
import com.mongodb.client.model.CreateEncryptedCollectionParams; |
||||
import com.mongodb.client.model.Filters; |
||||
import com.mongodb.client.model.IndexOptions; |
||||
import com.mongodb.client.model.Indexes; |
||||
import com.mongodb.client.vault.ClientEncryption; |
||||
import com.mongodb.client.vault.ClientEncryptions; |
||||
|
||||
import org.assertj.core.api.Assumptions; |
||||
import org.bson.BsonArray; |
||||
import org.bson.BsonBinary; |
||||
import org.bson.BsonDocument; |
||||
import org.bson.BsonInt32; |
||||
import org.bson.BsonInt64; |
||||
import org.bson.BsonNull; |
||||
import org.bson.BsonString; |
||||
import org.bson.BsonValue; |
||||
import org.bson.Document; |
||||
import org.junit.jupiter.api.AfterEach; |
||||
import org.junit.jupiter.api.BeforeEach; |
||||
import org.junit.jupiter.api.Test; |
||||
import org.junit.jupiter.api.extension.ExtendWith; |
||||
import org.springframework.beans.factory.DisposableBean; |
||||
import org.springframework.beans.factory.annotation.Autowired; |
||||
import org.springframework.context.ApplicationContext; |
||||
import org.springframework.context.annotation.Bean; |
||||
import org.springframework.data.convert.PropertyValueConverterFactory; |
||||
import org.springframework.data.mongodb.config.AbstractMongoClientConfiguration; |
||||
import org.springframework.data.mongodb.core.MongoTemplate; |
||||
import org.springframework.data.mongodb.core.convert.MongoCustomConversions.MongoConverterConfigurationAdapter; |
||||
import org.springframework.data.mongodb.core.convert.encryption.MongoEncryptionConverter; |
||||
import org.springframework.data.mongodb.core.mapping.ExplicitEncrypted; |
||||
import org.springframework.data.mongodb.test.util.EnableIfMongoServerVersion; |
||||
import org.springframework.data.mongodb.test.util.EnableIfReplicaSetAvailable; |
||||
import org.springframework.data.mongodb.test.util.MongoClientExtension; |
||||
import org.springframework.data.mongodb.util.MongoClientVersion; |
||||
import org.springframework.data.util.Lazy; |
||||
import org.springframework.test.context.ContextConfiguration; |
||||
import org.springframework.test.context.junit.jupiter.SpringExtension; |
||||
|
||||
/** |
||||
* @author Ross Lawley |
||||
*/ |
||||
@ExtendWith({ MongoClientExtension.class, SpringExtension.class }) |
||||
@EnableIfMongoServerVersion(isGreaterThanEqual = "8.0") |
||||
@EnableIfReplicaSetAvailable |
||||
@ContextConfiguration(classes = RangeEncryptionTests.EncryptionConfig.class) |
||||
class RangeEncryptionTests { |
||||
|
||||
@Autowired MongoTemplate template; |
||||
|
||||
@BeforeEach |
||||
void setUp() { |
||||
Assumptions.assumeThat(MongoClientVersion.isVersion5orNewer()).isTrue(); |
||||
} |
||||
|
||||
@AfterEach |
||||
void tearDown() { |
||||
template.getDb().getCollection("test").deleteMany(new BsonDocument()); |
||||
} |
||||
|
||||
@Test |
||||
void canGreaterThanEqualMatchRangeEncryptedField() { |
||||
Person source = createPerson(); |
||||
template.insert(source); |
||||
|
||||
Person loaded = template.query(Person.class).matching(where("encryptedInt").gte(source.encryptedInt)).firstValue(); |
||||
assertThat(loaded).isEqualTo(source); |
||||
} |
||||
|
||||
@Test |
||||
void canLesserThanEqualMatchRangeEncryptedField() { |
||||
Person source = createPerson(); |
||||
template.insert(source); |
||||
|
||||
Person loaded = template.query(Person.class).matching(where("encryptedInt").lte(source.encryptedInt)).firstValue(); |
||||
assertThat(loaded).isEqualTo(source); |
||||
} |
||||
|
||||
@Test |
||||
void canRangeMatchRangeEncryptedField() { |
||||
Person source = createPerson(); |
||||
template.insert(source); |
||||
|
||||
Person loaded = template.query(Person.class).matching(where("encryptedLong").lte(1001L).gte(1001L)).firstValue(); |
||||
assertThat(loaded).isEqualTo(source); |
||||
} |
||||
|
||||
@Test |
||||
void canUpdateRangeEncryptedField() { |
||||
Person source = createPerson(); |
||||
template.insert(source); |
||||
|
||||
source.encryptedInt = 123; |
||||
source.encryptedLong = 9999L; |
||||
template.save(source); |
||||
|
||||
Person loaded = template.query(Person.class).matching(where("id").is(source.id)).firstValue(); |
||||
assertThat(loaded).isEqualTo(source); |
||||
} |
||||
|
||||
@Test |
||||
void errorsWhenUsingNonRangeOperatorEqOnRangeEncryptedField() { |
||||
Person source = createPerson(); |
||||
template.insert(source); |
||||
|
||||
assertThatThrownBy( |
||||
() -> template.query(Person.class).matching(where("encryptedInt").is(source.encryptedInt)).firstValue()) |
||||
.isInstanceOf(AssertionError.class) |
||||
.hasMessageStartingWith("Not a valid range query. Querying a range encrypted field but " |
||||
+ "the query operator '$eq' for field path 'encryptedInt' is not a range query."); |
||||
|
||||
} |
||||
|
||||
@Test |
||||
void errorsWhenUsingNonRangeOperatorInOnRangeEncryptedField() { |
||||
Person source = createPerson(); |
||||
template.insert(source); |
||||
|
||||
assertThatThrownBy( |
||||
() -> template.query(Person.class).matching(where("encryptedLong").in(1001L, 9999L)).firstValue()) |
||||
.isInstanceOf(AssertionError.class) |
||||
.hasMessageStartingWith("Not a valid range query. Querying a range encrypted field but " |
||||
+ "the query operator '$in' for field path 'encryptedLong' is not a range query."); |
||||
|
||||
} |
||||
|
||||
private Person createPerson() { |
||||
Person source = new Person(); |
||||
source.id = "id-1"; |
||||
source.encryptedInt = 101; |
||||
source.encryptedLong = 1001L; |
||||
return source; |
||||
} |
||||
|
||||
protected static class EncryptionConfig extends AbstractMongoClientConfiguration { |
||||
|
||||
private static final String LOCAL_KMS_PROVIDER = "local"; |
||||
|
||||
private static final Lazy<Map<String, Map<String, Object>>> LAZY_KMS_PROVIDERS = Lazy.of(() -> { |
||||
byte[] localMasterKey = new byte[96]; |
||||
new SecureRandom().nextBytes(localMasterKey); |
||||
return Map.of(LOCAL_KMS_PROVIDER, Map.of("key", localMasterKey)); |
||||
}); |
||||
|
||||
@Autowired ApplicationContext applicationContext; |
||||
|
||||
@Override |
||||
protected String getDatabaseName() { |
||||
return "qe-test"; |
||||
} |
||||
|
||||
@Bean |
||||
public MongoClient mongoClient() { |
||||
return super.mongoClient(); |
||||
} |
||||
|
||||
@Override |
||||
protected void configureConverters(MongoConverterConfigurationAdapter converterConfigurationAdapter) { |
||||
converterConfigurationAdapter |
||||
.registerPropertyValueConverterFactory(PropertyValueConverterFactory.beanFactoryAware(applicationContext)) |
||||
.useNativeDriverJavaTimeCodecs(); |
||||
} |
||||
|
||||
@Bean |
||||
MongoEncryptionConverter encryptingConverter(MongoClientEncryption mongoClientEncryption) { |
||||
Lazy<Map<String, BsonBinary>> lazyDataKeyMap = Lazy.of(() -> { |
||||
try (MongoClient client = mongoClient()) { |
||||
MongoDatabase database = client.getDatabase(getDatabaseName()); |
||||
database.getCollection("test").drop(); |
||||
|
||||
ClientEncryption clientEncryption = mongoClientEncryption.getClientEncryption(); |
||||
BsonDocument encryptedFields = new BsonDocument().append("fields", |
||||
new BsonArray(asList( |
||||
new BsonDocument("keyId", BsonNull.VALUE).append("path", new BsonString("encryptedInt")) |
||||
.append("bsonType", new BsonString("int")) |
||||
.append("queries", |
||||
new BsonDocument("queryType", new BsonString("range")).append("contention", new BsonInt64(0L)) |
||||
.append("trimFactor", new BsonInt32(1)).append("sparsity", new BsonInt64(1)) |
||||
.append("min", new BsonInt32(0)).append("max", new BsonInt32(200))), |
||||
new BsonDocument("keyId", BsonNull.VALUE).append("path", new BsonString("encryptedLong")) |
||||
.append("bsonType", new BsonString("long")).append("queries", |
||||
new BsonDocument("queryType", new BsonString("range")).append("contention", new BsonInt64(0L)) |
||||
.append("trimFactor", new BsonInt32(1)).append("sparsity", new BsonInt64(1)) |
||||
.append("min", new BsonInt64(1000)).append("max", new BsonInt64(9999)))))); |
||||
|
||||
BsonDocument local = clientEncryption.createEncryptedCollection(database, "test", |
||||
new CreateCollectionOptions().encryptedFields(encryptedFields), |
||||
new CreateEncryptedCollectionParams(LOCAL_KMS_PROVIDER)); |
||||
|
||||
return local.getArray("fields").stream().map(BsonValue::asDocument).collect( |
||||
Collectors.toMap(field -> field.getString("path").getValue(), field -> field.getBinary("keyId"))); |
||||
} |
||||
}); |
||||
return new MongoEncryptionConverter(mongoClientEncryption, EncryptionKeyResolver |
||||
.annotated((ctx) -> EncryptionKey.keyId(lazyDataKeyMap.get().get(ctx.getProperty().getFieldName())))); |
||||
} |
||||
|
||||
@Bean |
||||
CachingMongoClientEncryption clientEncryption(ClientEncryptionSettings encryptionSettings) { |
||||
return new CachingMongoClientEncryption(() -> ClientEncryptions.create(encryptionSettings)); |
||||
} |
||||
|
||||
@Override |
||||
protected void configureClientSettings(MongoClientSettings.Builder builder) { |
||||
try (MongoClient client = MongoClients.create()) { |
||||
ClientEncryptionSettings clientEncryptionSettings = encryptionSettings(client); |
||||
|
||||
builder.autoEncryptionSettings(AutoEncryptionSettings.builder() //
|
||||
.kmsProviders(clientEncryptionSettings.getKmsProviders()) //
|
||||
.keyVaultNamespace(clientEncryptionSettings.getKeyVaultNamespace()) //
|
||||
.bypassQueryAnalysis(true).build()); |
||||
} |
||||
} |
||||
|
||||
@Bean |
||||
ClientEncryptionSettings encryptionSettings(MongoClient mongoClient) { |
||||
MongoNamespace keyVaultNamespace = new MongoNamespace("encryption.testKeyVault"); |
||||
MongoCollection<Document> keyVaultCollection = mongoClient.getDatabase(keyVaultNamespace.getDatabaseName()) |
||||
.getCollection(keyVaultNamespace.getCollectionName()); |
||||
keyVaultCollection.drop(); |
||||
// Ensure that two data keys cannot share the same keyAltName.
|
||||
keyVaultCollection.createIndex(Indexes.ascending("keyAltNames"), |
||||
new IndexOptions().unique(true).partialFilterExpression(Filters.exists("keyAltNames"))); |
||||
|
||||
mongoClient.getDatabase(getDatabaseName()).getCollection("test").drop(); // Clear old data
|
||||
|
||||
// Create the ClientEncryption instance
|
||||
return ClientEncryptionSettings.builder() //
|
||||
.keyVaultMongoClientSettings( |
||||
MongoClientSettings.builder().applyConnectionString(new ConnectionString("mongodb://localhost")).build()) //
|
||||
.keyVaultNamespace(keyVaultNamespace.getFullName()) //
|
||||
.kmsProviders(LAZY_KMS_PROVIDERS.get()) //
|
||||
.build(); |
||||
} |
||||
} |
||||
|
||||
static class CachingMongoClientEncryption extends MongoClientEncryption implements DisposableBean { |
||||
|
||||
static final AtomicReference<ClientEncryption> cache = new AtomicReference<>(); |
||||
|
||||
CachingMongoClientEncryption(Supplier<ClientEncryption> source) { |
||||
super(() -> { |
||||
ClientEncryption clientEncryption = cache.get(); |
||||
if (clientEncryption == null) { |
||||
clientEncryption = source.get(); |
||||
cache.set(clientEncryption); |
||||
} |
||||
|
||||
return clientEncryption; |
||||
}); |
||||
} |
||||
|
||||
@Override |
||||
public void destroy() { |
||||
ClientEncryption clientEncryption = cache.get(); |
||||
if (clientEncryption != null) { |
||||
clientEncryption.close(); |
||||
cache.set(null); |
||||
} |
||||
} |
||||
} |
||||
|
||||
@org.springframework.data.mongodb.core.mapping.Document("test") |
||||
static class Person { |
||||
|
||||
String id; |
||||
String name; |
||||
|
||||
@ExplicitEncrypted(algorithm = RANGE, contentionFactor = 0L, |
||||
rangeOptions = "{\"min\": 0, \"max\": 200, \"trimFactor\": 1, \"sparsity\": 1}") Integer encryptedInt; |
||||
@ExplicitEncrypted(algorithm = RANGE, contentionFactor = 0L, |
||||
rangeOptions = "{\"min\": {\"$numberLong\": \"1000\"}, \"max\": {\"$numberLong\": \"9999\"}, \"trimFactor\": 1, \"sparsity\": 1}") Long encryptedLong; |
||||
|
||||
public String getId() { |
||||
return this.id; |
||||
} |
||||
|
||||
public void setId(String id) { |
||||
this.id = id; |
||||
} |
||||
|
||||
public String getName() { |
||||
return this.name; |
||||
} |
||||
|
||||
public void setName(String name) { |
||||
this.name = name; |
||||
} |
||||
|
||||
public Integer getEncryptedInt() { |
||||
return this.encryptedInt; |
||||
} |
||||
|
||||
public void setEncryptedInt(Integer encryptedInt) { |
||||
this.encryptedInt = encryptedInt; |
||||
} |
||||
|
||||
public Long getEncryptedLong() { |
||||
return this.encryptedLong; |
||||
} |
||||
|
||||
public void setEncryptedLong(Long encryptedLong) { |
||||
this.encryptedLong = encryptedLong; |
||||
} |
||||
|
||||
@Override |
||||
public boolean equals(Object o) { |
||||
if (this == o) |
||||
return true; |
||||
if (o == null || getClass() != o.getClass()) |
||||
return false; |
||||
|
||||
Person person = (Person) o; |
||||
return Objects.equals(id, person.id) && Objects.equals(name, person.name) |
||||
&& Objects.equals(encryptedInt, person.encryptedInt) && Objects.equals(encryptedLong, person.encryptedLong); |
||||
} |
||||
|
||||
@Override |
||||
public int hashCode() { |
||||
int result = Objects.hashCode(id); |
||||
result = 31 * result + Objects.hashCode(name); |
||||
result = 31 * result + Objects.hashCode(encryptedInt); |
||||
result = 31 * result + Objects.hashCode(encryptedLong); |
||||
return result; |
||||
} |
||||
|
||||
@Override |
||||
public String toString() { |
||||
return "Person{" + "id='" + id + '\'' + ", name='" + name + '\'' + ", encryptedInt=" + encryptedInt |
||||
+ ", encryptedLong=" + encryptedLong + '}'; |
||||
} |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue