mongodb/mongo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SERVER-115288 Introduce SignatureValidator (#47624)

Browse Source 
GitOrigin-RevId: 733a6b648df19156dc4b7aca72d11ffbcd496135
This commit is contained in:
Santiago Roche 2026-02-18 10:26:48 -05:00 committed by MongoDB Bot
parent f5b27c20ad
commit d43d364bbf
15 changed files with 645 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
WORKSPACE.bazel
View File

@ -203,3 +203,7 @@ shfmt()
load("//bazel/gpg:gpg.bzl", "gpg")
gpg()
load("//bazel/mongot_extension_signing_key:mongot_extension_signing_key.bzl", "mongot_extension_signing_key")
mongot_extension_signing_key()

14
bazel/mongot_extension_signing_key/BUILD.bazel Normal file
View File

@ -0,0 +1,14 @@
package(default_visibility = ["//visibility:public"])
py_binary(
name = "gpg_export_armored_key",
srcs = ["gpg_export_armored_key.py"],
main = "gpg_export_armored_key.py",
visibility = ["//visibility:public"],
)
py_binary(
name = "generate_embedded_public_key_header",
srcs = ["generate_embedded_public_key_header.py"],
visibility = ["//visibility:public"],
)

8
bazel/mongot_extension_signing_key/OWNERS.yml Normal file
View File

@ -0,0 +1,8 @@
version: 1.0.0
filters:
- "*":
approvers:
- 10gen/query-integration-extensions-api
- "OWNERS.yml":
approvers:
- 10gen/query-integration-staff-leads

68
bazel/mongot_extension_signing_key/generate_embedded_public_key_header.py Normal file
View File

@ -0,0 +1,68 @@
#!/usr/bin/env python3
import argparse
FILE_HEADER = """/**
* Copyright (C) 2026-present MongoDB, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the Server Side Public License, version 1,
* as published by MongoDB, Inc.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* Server Side Public License for more details.
*
* You should have received a copy of the Server Side Public License
* along with this program. If not, see
* <http://www.mongodb.com/licensing/server-side-public-license>.
*
* As a special exception, the copyright holders give permission to link the
* code of portions of this program with the OpenSSL library under certain
* conditions as described in each individual source file and distribute
* linked combinations including the program with the OpenSSL library. You
* must comply with the Server Side Public License in all respects for
* all of the code used other than as permitted herein. If you modify file(s)
* with this exception, you may extend this exception to your version of the
* file(s), but you are not obligated to do so. If you do not wish to do so,
* delete this exception statement from your version. If you delete this
* exception statement from all source files in the program, then also delete
* it in the license file.
*/
// Generated file. Do not edit.
#pragma once
#include <string_view>
namespace mongo {
namespace extension{
namespace host {\n"""
FILE_FOOTER = """} // namespace host
} // namespace extension
} // namespace mongo
"""
def main():
ap = argparse.ArgumentParser()
ap.add_argument("--public_key_path", dest="public_key_path", required=True)
ap.add_argument("--embedded_key_header_path", required=True)
args = ap.parse_args()
with open(args.public_key_path, "r") as f:
public_key_contents = f.read()
# Write header
with open(args.embedded_key_header_path, "w") as h:
h.write(FILE_HEADER)
public_key_definition = """static constexpr std::string_view kMongoExtensionSigningPublicKey = R\"({0})\";\n""".format(
public_key_contents
)
h.write(public_key_definition)
h.write(FILE_FOOTER)
if __name__ == "__main__":
main()

137
bazel/mongot_extension_signing_key/gpg_export_armored_key.py Normal file
View File

@ -0,0 +1,137 @@
#!/usr/bin/env python3
"""Action helper to export a dearmored pgp public key in armored mode using GPG.
Args (positional):
1) GPG: path to the gpg binary to execute
2) KEY: path to the public key file to import
3) PASSPHRASE: optional path to a file containing the passphrase (or "" if none)
4) ARMORED_KEY_OUTPUT_FILE: output armored public key path
"""
from __future__ import annotations
import os
import shutil
import subprocess
import sys
import tempfile
from typing import List, Optional
debug = False # manually change to enable verbose output
def _debug(msg: str) -> None:
if debug:
print(msg, file=sys.stderr)
def _run(argv: List[str], *, capture_stdout: bool = False) -> subprocess.CompletedProcess:
if capture_stdout:
return subprocess.run(
argv, check=True, text=True, stdout=subprocess.PIPE, stderr=sys.stderr
)
if not debug:
with open(os.devnull, "wb") as null:
return subprocess.run(argv, check=True, stdout=null, stderr=null)
else:
return subprocess.run(argv, check=True)
def _extract_fingerprint(colons_output: str) -> Optional[str]:
# gpg --with-colons output: lines like "fpr:::::::::FINGERPRINT:"
for line in colons_output.splitlines():
if not line.startswith("fpr:"):
continue
parts = line.split(":")
if len(parts) > 9 and parts[9]:
return parts[9]
return None
def main(argv: List[str]) -> int:
_debug("Starting gpg_export_armored_key.py")
if len(argv) != 5:
print(
"usage: gpg_export_armored_key.py <gpg> <key> <passphrase_file_or_empty> <armored_key_output_file>",
file=sys.stderr,
)
return 2
gpg = argv[1]
key = argv[2]
passphrase_file = argv[3] or None
armored_key_output_file = argv[4]
# Use helpers from the same bundle as `gpg` to avoid accidentally picking up system gpg-agent/gpgconf,
# especially under remote execution.
bindir = os.path.dirname(gpg)
gpg_agent = os.path.join(bindir, "gpg-agent")
gpgconf = os.path.join(bindir, "gpgconf")
# Unique temp homedir for this action.
base_tmp = os.environ.get("TMPDIR") or os.getcwd()
gpgdir = tempfile.mkdtemp(prefix="gpg.", dir=base_tmp)
os.chmod(gpgdir, 0o700)
try:
# Disable agent caching for this home directory.
with open(os.path.join(gpgdir, "gpg-agent.conf"), "w", encoding="utf-8") as fh:
fh.write(
"default-cache-ttl 0\n"
"max-cache-ttl 0\n"
"ignore-cache-for-signing\n"
"allow-loopback-pinentry\n"
"disable-scdaemon\n"
)
_debug("Starting gpg-agent")
# Inherit stdout/stderr so logs show up in action output (like the old shell script).
_run([gpg_agent, "--homedir", gpgdir, "--daemon", "--verbose"])
_debug("gpg-agent importing key to home dir")
# Import the private key into the temp homedir.
_run([gpg, "--homedir", gpgdir, "--batch", "--import", key])
_debug("gpg-agent imported the key!")
# Find fingerprint.
cp = _run([gpg, "--homedir", gpgdir, "--list-keys", "--with-colons"], capture_stdout=True)
fpr = _extract_fingerprint(cp.stdout)
if not fpr:
print(
"Failed to determine key fingerprint from gpg --with-colons output", file=sys.stderr
)
return 1
_debug("gpg-agent extracted fingerprint: " + fpr)
# Build passphrase options if provided.
pass_opts: List[str] = []
if passphrase_file:
pass_opts = ["--pinentry-mode", "loopback", "--passphrase-file", passphrase_file]
cp = _run(
[
gpg,
"--homedir",
gpgdir,
"--batch",
*pass_opts,
"--armor",
"--export",
fpr,
],
capture_stdout=True,
)
with open(armored_key_output_file, "w+") as outf:
outf.write(cp.stdout)
return 0
finally:
# Cleanup.
try:
subprocess.run([gpgconf, "--homedir", gpgdir, "--kill", "gpg-agent"], check=False)
finally:
shutil.rmtree(gpgdir, ignore_errors=True)
if __name__ == "__main__":
raise SystemExit(main(sys.argv))

89
bazel/mongot_extension_signing_key/mongot_extension_signing_key.bzl Normal file
View File

@ -0,0 +1,89 @@
"""Rules for downloading and embedding mongot_extension_signing_key"""
# This is the mongot-extension's signing public key. It is managed by garasign, and used by the
# SignatureValidator in secure builds (i.e MONGO_CONFIG_EXT_SIG_SECURE) to verify the authenticity
# of extensions before loading them into the server process. Whenever the remote file changes, the
# corresponding sha256 must be changed.
def _impl(ctx):
ctx.download(
url = "https://pgp.mongodb.com/mongot-extension.pub",
sha256 = "2a15e6a2d9f6c0d8141dad515d9360f6cf01e1a11f7e2c3bc0820e18c5e9d0b7",
output = "mongot-extension.pub",
)
ctx.file("BUILD.bazel", 'exports_files(["mongot-extension.pub"])')
mongot_extension_signing_key_repo = repository_rule(implementation = _impl)
def mongot_extension_signing_key():
mongot_extension_signing_key_repo(name = "mongot_extension_signing_key")
def _gpg_export_armored_key_impl(ctx):
key = ctx.file.key
armored_key_output_file = ctx.outputs.armored_key_output_file
pass_file = ctx.file.passphrase
# Collect tool files from the filegroups
bin_files = ctx.attr.gpg_bins.files.to_list()
lib_files = ctx.attr.gpg_libs.files.to_list()
# Find the gpg executable
gpg_bin = None
for f in bin_files:
if f.basename == "gpg":
gpg_bin = f
break
if gpg_bin == None:
fail("gpg binary not found in @gpg//:gpg_bins")
# Compute libs dir next to the bundle’s bin dir:
# …/gpg_bundle-*/bin/gpg -> …/gpg_bundle-*/libs
p = gpg_bin.path
bin_dir = p[:p.rfind("/")]
bundle_dir = bin_dir[:bin_dir.rfind("/")]
libs_dir = bundle_dir + "/libs"
# Arguments your Python helper expects: <gpg> <key> <passphrase_or_empty> <armored_key_output_file>
args = [
gpg_bin.path,
key.path,
pass_file.path if pass_file else "",
armored_key_output_file.path,
]
# Create the action; stage bins/libs as tools for the exec platform
ctx.actions.run(
executable = ctx.executable.script,
arguments = args,
inputs = [key] + ([pass_file] if pass_file else []),
tools = bin_files + lib_files + [ctx.executable.script],
outputs = [armored_key_output_file],
env = {"LD_LIBRARY_PATH": libs_dir},
mnemonic = "GpgExportArmored",
progress_message = "Export armored key to %s" % armored_key_output_file.path,
)
gpg_export_armored_key = rule(
implementation = _gpg_export_armored_key_impl,
attrs = {
"key": attr.label(allow_single_file = True, mandatory = True),
"passphrase": attr.label(allow_single_file = True),
"armored_key_output_file": attr.output(mandatory = True),
"script": attr.label(
default = Label("//bazel/mongot_extension_signing_key:gpg_export_armored_key"),
executable = True,
cfg = "exec",
),
# Treat these as tools (exec config)
"gpg_bins": attr.label(
default = Label("@gpg//:gpg_bins"),
allow_files = True,
cfg = "exec",
),
"gpg_libs": attr.label(
default = Label("@gpg//:gpg_libs"),
allow_files = True,
cfg = "exec",
),
},
)

104
src/mongo/db/extension/host/BUILD.bazel
View File

@ -1,4 +1,5 @@
load("//bazel:mongo_src_rules.bzl", "mongo_cc_library", "mongo_cc_unit_test")
load("//bazel/mongot_extension_signing_key:mongot_extension_signing_key.bzl", "gpg_export_armored_key")
package(default_visibility = ["//visibility:public"])
@ -87,6 +88,43 @@ mongo_cc_library(
],
)
gpg_export_armored_key(
name = "mongot_extension_signing_key_asc",
armored_key_output_file = "mongot-extension.asc",
key = "@mongot_extension_signing_key//:mongot-extension.pub",
target_compatible_with = select({
"@platforms//os:linux": [],
"//conditions:default": ["@platforms//:incompatible"],
}),
)
genrule(
name = "embed_mongot_key",
srcs = [":mongot_extension_signing_key_asc"],
outs = ["mongot_extension_signing_key.h"],
cmd = "$(execpath //bazel/mongot_extension_signing_key:generate_embedded_public_key_header) --public_key_path $(location :mongot_extension_signing_key_asc) --embedded_key_header_path $@",
target_compatible_with = select({
"@platforms//os:linux": [],
"//conditions:default": ["@platforms//:incompatible"],
}),
tools = ["//bazel/mongot_extension_signing_key:generate_embedded_public_key_header"],
)
mongo_cc_library(
name = "signature_validator",
srcs = [
"signature_validator.cpp",
],
hdrs = [":embed_mongot_key"],
target_compatible_with = select({
"@platforms//os:linux": [],
"//conditions:default": ["@platforms//:incompatible"],
}),
deps = [
"//src/mongo:base",
],
)
mongo_cc_library(
name = "extension_loader",
srcs = [
@ -99,7 +137,10 @@ mongo_cc_library(
"//src/mongo:base",
"//src/mongo/db/query:query_knobs",
"//src/third_party/yaml-cpp:yaml",
],
] + select({
"//bazel/config:not_linux": [],
"//conditions:default": [":signature_validator"],
}),
)
mongo_cc_unit_test(
@ -111,36 +152,37 @@ mongo_cc_unit_test(
# Data lists the targets that must be built to generate extension shared libraries, which are
# loaded in the unit tests.
data = [
"//src/mongo/db/extension/test_examples:bar_mongo_extension",
"//src/mongo/db/extension/test_examples:duplicate_stage_descriptor_bad_extension",
"//src/mongo/db/extension/test_examples:duplicate_version_bad_extension",
"//src/mongo/db/extension/test_examples:explain_mongo_extension",
"//src/mongo/db/extension/test_examples:extension_errors_mongo_extension",
"//src/mongo/db/extension/test_examples:foo_mongo_extension",
"//src/mongo/db/extension/test_examples:host_version_fails_bad_extension",
"//src/mongo/db/extension/test_examples:host_version_succeeds_mongo_extension",
"//src/mongo/db/extension/test_examples:initialize_version_fails_bad_extension",
"//src/mongo/db/extension/test_examples:limit_mongo_extension",
"//src/mongo/db/extension/test_examples:load_highest_compatible_version_mongo_extension",
"//src/mongo/db/extension/test_examples:load_two_stages_mongo_extension",
"//src/mongo/db/extension/test_examples:major_version_max_int_bad_extension",
"//src/mongo/db/extension/test_examples:major_version_too_high_bad_extension",
"//src/mongo/db/extension/test_examples:major_version_too_low_bad_extension",
"//src/mongo/db/extension/test_examples:match_topN_mongo_extension",
"//src/mongo/db/extension/test_examples:minor_version_too_high_bad_extension",
"//src/mongo/db/extension/test_examples:mongothost_extension",
"//src/mongo/db/extension/test_examples:native_vector_search_mongo_extension",
"//src/mongo/db/extension/test_examples:no_compatible_version_bad_extension",
"//src/mongo/db/extension/test_examples:no_symbol_bad_extension",
"//src/mongo/db/extension/test_examples:null_initialize_function_bad_extension",
"//src/mongo/db/extension/test_examples:null_mongo_extension_bad_extension",
"//src/mongo/db/extension/test_examples:null_stage_descriptor_bad_extension",
"//src/mongo/db/extension/test_examples:parse_options_mongo_extension",
"//src/mongo/db/extension/test_examples:read_n_documents_mongo_extension",
"//src/mongo/db/extension/test_examples:sharded_execution_serialization_mongo_extension",
"//src/mongo/db/extension/test_examples:test_options_mongo_extension",
"//src/mongo/db/extension/test_examples:toaster_mongo_extension",
"//src/mongo/db/extension/test_examples:vector_search_optimization_mongo_extension",
"//src/mongo/db/extension/test_examples:bar_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:duplicate_stage_descriptor_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:duplicate_version_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:explain_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:extension_errors_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:foo_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:host_version_fails_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:host_version_succeeds_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:initialize_version_fails_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:limit_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:load_highest_compatible_version_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:load_two_stages_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:major_version_max_int_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:major_version_too_high_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:major_version_too_low_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:match_topN_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:minor_version_too_high_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:mongothost_extension_signed_lib",
"//src/mongo/db/extension/test_examples:native_vector_search_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:no_compatible_version_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:no_symbol_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:null_initialize_function_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:null_mongo_extension_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:null_stage_descriptor_bad_extension_signed_lib",
"//src/mongo/db/extension/test_examples:parse_options_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:read_n_documents_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:sharded_execution_serialization_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:test_options_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:toaster_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples:vector_search_optimization_mongo_extension_signed_lib",
"//src/mongo/db/extension/test_examples/test_extensions_signing_keys:test_extensions_signing_public_key.asc",
],
tags = ["mongo_unittest_seventh_group"],
target_compatible_with = select({

32
src/mongo/db/extension/host/load_extension.cpp
View File

@ -50,6 +50,10 @@
#include <stdexcept>
#include <string>
#ifdef __linux
#include "mongo/db/extension/host/signature_validator.h"
#endif
#define MONGO_LOGV2_DEFAULT_COMPONENT ::mongo::logv2::LogComponent::kExtension
namespace mongo::extension::host {
@ -58,7 +62,7 @@ namespace {
const std::filesystem::path& getExtensionConfDir() {
// Use /tmp/mongo/extensions in test environments, otherwise use /etc/mongo/extensions.
static const std::filesystem::path kExtensionConfDir = getTestCommandsEnabled()
? std::filesystem::temp_directory_path() / "mongo" / "extensions"
? std::filesystem::temp_directory_path() / ExtensionLoader::kExtensionConfigPathSuffix
: ExtensionLoader::kExtensionConfigPath;
return kExtensionConfDir;
@ -134,13 +138,14 @@ bool loadExtensions(const std::vector<std::string>& extensionNames) {
// Register fallback stub parsers before loading extensions.
registerUnloadedExtensionStubParsers();
SignatureValidator signatureValidator;
for (const auto& extension : extensionNames) {
LOGV2(10668501, "Loading extension", "extensionName"_attr = extension);
try {
const ExtensionConfig config = ExtensionLoader::loadExtensionConfig(extension);
ExtensionLoader::load(extension, config);
ExtensionLoader::load(extension, config, signatureValidator);
} catch (...) {
LOGV2_ERROR(10668502,
"Error loading extension",
@ -203,13 +208,29 @@ ExtensionConfig ExtensionLoader::loadExtensionConfig(const std::string& extensio
void ExtensionLoader::load(const std::string& name, const ExtensionConfig& config) {
#ifdef __linux
SignatureValidator signatureValidator;
return ExtensionLoader::load(name, config, signatureValidator);
#else
LOGV2(11901201,
"Loading extensions on non-linux platforms is not supported - skipping loading.");
#endif
}
#ifdef __linux
void ExtensionLoader::load(const std::string& name,
const ExtensionConfig& config,
const SignatureValidator& signatureValidator) {
uassert(10845400,
str::stream() << "Loading extension '" << name << "' failed: "
<< "Extension has already been loaded",
!loadedExtensions.contains(name));
const auto& extensionPath = config.sharedLibraryPath;
uassert(11528800,
str::stream() << "Loading extension '" << name << "' failed, path: " << extensionPath
<< " does not exist.",
std::filesystem::exists(extensionPath));
signatureValidator.validateExtensionSignature(name, extensionPath);
StatusWith<std::unique_ptr<SharedLibrary>> swExtensionLib =
SharedLibrary::create(extensionPath);
uassert(10615500,
@ -244,11 +265,8 @@ void ExtensionLoader::load(const std::string& name, const ExtensionConfig& confi
YAML::Dump(extOptionsWithMongotHost),
std::move(hostPortal)};
extHandle->initialize(&portal, &host_connector::HostServicesAdapter::get());
#else
LOGV2(11901201,
"Loading extensions on non-linux platforms is not supported - skipping loading.");
#endif
}
#endif
stdx::unordered_map<std::string, ExtensionConfig> ExtensionLoader::getLoadedExtensions() {
stdx::unordered_map<std::string, ExtensionConfig> result;

11
src/mongo/db/extension/host/load_extension.h
View File

@ -34,6 +34,7 @@
#include "mongo/stdx/unordered_map.h"
#include "mongo/util/modules.h"
#include <filesystem>
#include <string>
#include <yaml-cpp/yaml.h>
@ -75,7 +76,11 @@ public:
* compatibility, and calls the extension initialization function.
*/
static void load(const std::string& name, const ExtensionConfig& config);
#ifdef __linux
static void load(const std::string& name,
const ExtensionConfig& config,
const class SignatureValidator& signatureValidator);
#endif
/**
* Returns the names and configurations of the currently registered extensions.
@ -95,11 +100,13 @@ public:
*/
static void unload_forTest(const std::string& name);
static inline const std::filesystem::path kExtensionConfigPathSuffix{"mongo/extensions"};
/**
* Central path for all extension configuration files. Also holds
* aggregation_stage_fallback_parsers.json.
*/
static inline const std::filesystem::path kExtensionConfigPath{"/etc/mongo/extensions"};
static inline const std::filesystem::path kExtensionConfigPath =
std::filesystem::path("/etc") / kExtensionConfigPathSuffix;
private:
// Used to keep loaded extension 'SharedLibrary' objects alive for the lifetime of the server

29
src/mongo/db/extension/host/load_extension_test.cpp
View File

@ -33,6 +33,7 @@
#include "mongo/db/extension/host/document_source_extension_optimizable.h"
#include "mongo/db/extension/host/load_extension_test_util.h"
#include "mongo/db/extension/host/load_stub_parsers.h"
#include "mongo/db/extension/host/signature_validator.h"
#include "mongo/db/pipeline/document_source.h"
#include "mongo/db/pipeline/document_source_limit.h"
#include "mongo/db/pipeline/document_source_match.h"
@ -42,14 +43,24 @@
#include "mongo/db/pipeline/lite_parsed_document_source.h"
#include "mongo/db/pipeline/pipeline_factory.h"
#include "mongo/db/query/search/mongot_options.h"
#include "mongo/db/server_options.h"
#include "mongo/idl/server_parameter_test_controller.h"
#include "mongo/unittest/death_test.h"
#include "mongo/unittest/temp_dir.h"
#include "mongo/unittest/unittest.h"
#include <filesystem>
namespace mongo::extension::host {
namespace {
const std::string& getPublicKeyPath() {
static std::string kPublicKeyPath = mongo::extension::host::test_util::getExtensionDirectory() /
"test_extensions_signing_keys" / "test_extensions_signing_public_key.asc";
return kPublicKeyPath;
}
} // namespace
class LoadExtensionsTest : public unittest::Test {
protected:
LoadExtensionsTest() : expCtx(make_intrusive<ExpressionContextForTest>()) {}
@ -63,7 +74,16 @@ protected:
static inline const std::string kMatchTopNStageName = "$matchTopN";
static inline const std::string kMatchTopNLibExtensionPath = "libmatch_topN_mongo_extension.so";
void setUp() override {
_previousExtensionsSignaturePublicKeyPath =
serverGlobalParams.extensionsSignaturePublicKeyPath;
serverGlobalParams.extensionsSignaturePublicKeyPath = getPublicKeyPath();
}
void tearDown() override {
if (!_previousExtensionsSignaturePublicKeyPath.empty()) {
serverGlobalParams.extensionsSignaturePublicKeyPath =
_previousExtensionsSignaturePublicKeyPath;
}
LiteParsedDocumentSource::unregisterParser_forTest(kTestFooStageName);
ExtensionLoader::unload_forTest("foo");
LiteParsedDocumentSource::unregisterParser_forTest(kMatchTopNStageName);
@ -92,6 +112,7 @@ protected:
private:
RAIIServerParameterControllerForTest _featureFlag{"featureFlagExtensionsAPI", true};
std::string _previousExtensionsSignaturePublicKeyPath{""};
};
TEST_F(LoadExtensionsTest, LoadExtensionErrorCases) {
@ -103,22 +124,22 @@ TEST_F(LoadExtensionsTest, LoadExtensionErrorCases) {
// Test that various non-existent extension cases fail with the proper error code.
ASSERT_THROWS_CODE(ExtensionLoader::load("src", test_util::makeEmptyExtensionConfig("src/")),
AssertionException,
10615500);
11528800);
ASSERT_THROWS_CODE(ExtensionLoader::load("notanextension",
test_util::makeEmptyExtensionConfig("notanextension")),
AssertionException,
10615500);
11528800);
ASSERT_THROWS_CODE(
ExtensionLoader::load(
"extension", test_util::makeEmptyExtensionConfig("path/to/nonexistent/extension.so")),
AssertionException,
10615500);
11528800);
ASSERT_THROWS_CODE(
ExtensionLoader::load("notanextension",
test_util::makeEmptyExtensionConfig("libnotanextension.so")),
AssertionException,
10615500);
11528800);
// no_symbol_bad_extension is missing the get_mongodb_extension symbol definition.
ASSERT_THROWS_CODE(

4
src/mongo/db/extension/host/load_extension_test_util.h
View File

@ -40,14 +40,14 @@ static inline const std::filesystem::path runFilesDir = std::getenv("RUNFILES_DI
* Returns the directory containing extension shared libraries built for tests.
*/
inline std::filesystem::path getExtensionDirectory() {
return "_main/src/mongo/db/extension/test_examples";
return runFilesDir / "_main/src/mongo/db/extension/test_examples";
}
/**
* Computes the absolute path to a specific test extension shared library.
*/
inline std::filesystem::path getExtensionPath(const std::string& extensionFileName) {
return runFilesDir / getExtensionDirectory() / extensionFileName;
return getExtensionDirectory() / extensionFileName;
}
/**

114
src/mongo/db/extension/host/signature_validator.cpp Normal file
View File

@ -0,0 +1,114 @@
/**
* Copyright (C) 2026-present MongoDB, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the Server Side Public License, version 1,
* as published by MongoDB, Inc.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* Server Side Public License for more details.
*
* You should have received a copy of the Server Side Public License
* along with this program. If not, see
* <http://www.mongodb.com/licensing/server-side-public-license>.
*
* As a special exception, the copyright holders give permission to link the
* code of portions of this program with the OpenSSL library under certain
* conditions as described in each individual source file and distribute
* linked combinations including the program with the OpenSSL library. You
* must comply with the Server Side Public License in all respects for
* all of the code used other than as permitted herein. If you modify file(s)
* with this exception, you may extend this exception to your version of the
* file(s), but you are not obligated to do so. If you do not wish to do so,
* delete this exception statement from your version. If you delete this
* exception statement from all source files in the program, then also delete
* it in the license file.
*/
#include "mongo/db/extension/host/signature_validator.h"
#include "mongo/db/extension/host/mongot_extension_signing_key.h"
#include "mongo/db/server_options.h"
#include "mongo/logv2/log.h"
#include "mongo/util/str.h"
#include <fstream>
#include <fmt/format.h>
#define MONGO_LOGV2_DEFAULT_COMPONENT ::mongo::logv2::LogComponent::kExtension
namespace mongo::extension::host {
namespace {
// Note, this function should only be called if we are not skipping validation, since we expect a
// non-empty extensionValidationPublicKeyPath.
// TODO SERVER-115289: Revisit public key management depending on library implementation.
const std::string& getValidationPublicKey() {
#ifndef MONGO_CONFIG_EXT_SIG_SECURE
static const std::string kPublicKey = []() {
const auto& extensionValidationPublicKeyPath =
serverGlobalParams.extensionsSignaturePublicKeyPath;
tassert(11528801,
"extensionsSignaturePublicKeyPath was empty!",
!extensionValidationPublicKeyPath.empty());
LOGV2_DEBUG(11528803,
4,
"SignatureValidator using public key path",
"extensionValidationPublicKeyPath"_attr = extensionValidationPublicKeyPath);
std::ifstream in(extensionValidationPublicKeyPath);
tassert(11528802,
fmt::format("Failed to open signature file: {}", extensionValidationPublicKeyPath),
in);
std::string contents((std::istreambuf_iterator<char>(in)),
std::istreambuf_iterator<char>());
return contents;
}();
#else
static const std::string kPublicKey(kMongoExtensionSigningPublicKey);
#endif
return kPublicKey;
}
} // namespace
SignatureValidator::SignatureValidator()
: _skipValidation([]() {
// TODO SERVER-115289: Remove ENABLE_SIGNATURE_VALIDATOR guard for skipValidation.
#ifdef ENABLE_SIGNATURE_VALIDATOR
#ifndef MONGO_CONFIG_EXT_SIG_SECURE
return serverGlobalParams.extensionsSignaturePublicKeyPath.empty();
#else
return false;
#endif
#else
return true;
#endif
}()) {
LOGV2_DEBUG(11528804, 4, "Initializing SignatureValidator");
if (_skipValidation) {
LOGV2_DEBUG(11528805, 4, "Skipping signature validation");
return;
}
// TODO SERVER-115289: Initialize implementation specific context and import key into keyring.
}
SignatureValidator::~SignatureValidator() {
if (_skipValidation) {
return;
}
}
void SignatureValidator::validateExtensionSignature(const std::string& extensionName,
const std::string& extensionPath) const {
if (_skipValidation) {
LOGV2_DEBUG(11528806, 4, "Skipping signature validation");
return;
}
// TODO SERVER-115289: Implement signature validation.
}
} // namespace mongo::extension::host

70
src/mongo/db/extension/host/signature_validator.h Normal file
View File

@ -0,0 +1,70 @@
/**
* Copyright (C) 2026-present MongoDB, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the Server Side Public License, version 1,
* as published by MongoDB, Inc.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* Server Side Public License for more details.
*
* You should have received a copy of the Server Side Public License
* along with this program. If not, see
* <http://www.mongodb.com/licensing/server-side-public-license>.
*
* As a special exception, the copyright holders give permission to link the
* code of portions of this program with the OpenSSL library under certain
* conditions as described in each individual source file and distribute
* linked combinations including the program with the OpenSSL library. You
* must comply with the Server Side Public License in all respects for
* all of the code used other than as permitted herein. If you modify file(s)
* with this exception, you may extend this exception to your version of the
* file(s), but you are not obligated to do so. If you do not wish to do so,
* delete this exception statement from your version. If you delete this
* exception statement from all source files in the program, then also delete
* it in the license file.
*/
#pragma once
#include "mongo/util/modules.h"
#include <string>
namespace mongo::extension::host {
/**
* SignatureValidator is responsible for validating an extension's signature file against a public
* key.
*
* This class respects the compile-time pre-processor flag MONGO_CONFIG_EXT_SIG_SECURE and server
* options (i.e extensionsSignaturePublicKeyPath) when determining which validation public key to
* use for signature verification. Note, this class is always safe to instantiate, even if signature
* verification is disabled (i.e extensionsSignaturePublicKeyPath is empty).
*
* Note: SignatureValidator is currently always disabled for the time being.
* TODO SERVER-115289: Update comment with implementation specific details regarding signature
* verification library.
*/
class SignatureValidator {
public:
SignatureValidator();
SignatureValidator(const SignatureValidator&) = delete;
SignatureValidator& operator=(const SignatureValidator&) = delete;
~SignatureValidator();
/**
* Validates the extension's detached signature file against the validation public key.
* Note, extensionPath must be guaranteed to exist prior to calling this method. If the
* signature is not validated succesfully, an exception is thrown.
*/
void validateExtensionSignature(const std::string& extensionName,
const std::string& extensionPath) const;
private:
const bool _skipValidation;
};
} // namespace mongo::extension::host

7
src/mongo/db/extension/test_examples/test_extensions_signing_keys/BUILD.bazel
View File

@ -1,4 +1,9 @@
package(default_visibility = ["//visibility:public"])
exports_files(
["test_extensions_signing_private_key.asc"],
[
"test_extensions_signing_private_key.asc",
"test_extensions_signing_public_key.asc",
],
visibility = ["//visibility:public"],
)

5
src/mongo/shell/servers.js
View File

@ -58,10 +58,7 @@ MongoRunner.getMongoShellPath = function () {
};
MongoRunner.getExtensionPath = function (shared_library_name) {
if (!jsTestOptions().inEvergreen) {
return MongoRunner.getInstallPath("..", "lib", shared_library_name);
}
return shared_library_name;
return MongoRunner.getInstallPath("..", "lib", shared_library_name);
};
MongoRunner.parsePort = function (...args) {