Repository navigation
Conversation
blink1073
commented
Sep 8, 2026
blink1073
force-pushed
the
PYTHON-5805
branch
2 times, most recently
from
September 25, 2026 13:44
d6ea9c2 to
47e250c
Compare
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…odb#3054) Co-authored-by: Noah Stapp <noah@noahstapp.com>
…odb#3051) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jeffrey 'Alex' Clark <aclark@aclark.net>
Co-authored-by: mongodb-drivers-pr-bot[bot] <147046816+mongodb-drivers-pr-bot[bot]@users.noreply.github.com> Co-authored-by: Steven Silvester <steve.silvester@mongodb.com>
…k into _AgnosticClientBulkBase/_AgnosticBulkBase (mongodb#3087)
…n the GitHub Actions reference (mongodb#3075)
Add a kms_connect_callback option to AutoEncryptionOpts, ClientEncryption, and AsyncClientEncryption. The callable receives a KMSConnectContext (host, port, timeout) and returns a connected, unwrapped socket over which the driver performs the KMS TLS handshake, so verification still targets the KMS host rather than the peer reached. This enables routing KMS requests through custom channels such as proxies. Split TLS wrapping out of the configured socket helpers so the callback path reuses it, and shield the async wrap so a cancelled or timed-out wait still closes a late-produced socket.
- Add a regression test that the KMS TLS handshake verifies against the KMS address, not the callback's connected peer. - Drop the stale prose-test references in test_encryption.py comments; prose tests moved with the PYTHON-6147 split. - Correct the KMSConnectContext.timeout docstring: it is the default KMS connect timeout capped by any active operation timeout.
Extract the repeated listener/socketpair setup, TLS context construction, and the flavor-aware run-blocking wrapper into shared helpers, and collapse the fixed-value callbacks into a factory.
The synchronous API waits for the callback without enforcing the CSOT deadline; state the flavor-neutral contract instead (callback honors context.timeout). Addresses Copilot review discussion_r4185118746.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PYTHON-5805
Changes in this PR
Lets CSFLE and Queryable Encryption route KMS traffic through an HTTP proxy via a user-supplied connect callback, while still performing the KMS TLS handshake end to end against the KMS host.
kms_connect_callbacktoAutoEncryptionOpts,ClientEncryption, andAsyncClientEncryption, plus aKMSConnectContext.HTTPProxyKMSConnect/AsyncHTTPProxyKMSConnecthelpers.pymongo/pool_shared.py, leaving existing connection paths unchanged.Test Plan
Ran the encryption prose suite against the drivers-evergreen-tools proxies: 10 passed, 2 skipped.
just lint,just typing, andjust docsclean.Checklist
Checklist for Author
Checklist for Reviewer