From bbf86a67be7c46a9dc98a30bb5e3cd4d0f993388 Mon Sep 17 00:00:00 2001
From: Wayne Werner <wwerner@vmware.com>
Date: Tue, 15 Feb 2022 16:38:01 -0600
Subject: [PATCH] Add ssl argument to MongoClient for mongo returner

---
 salt/returners/mongo_return.py                |  6 +-
 .../unit/returners/test_mongo_return.py       | 77 +++++++++++++++++++
 2 files changed, 81 insertions(+), 2 deletions(-)
 create mode 100644 tests/pytests/unit/returners/test_mongo_return.py

diff --git a/salt/returners/mongo_return.py b/salt/returners/mongo_return.py
index 91d0b508a67..571763aba88 100644
--- a/salt/returners/mongo_return.py
+++ b/salt/returners/mongo_return.py
@@ -107,6 +107,7 @@ def _get_options(ret):
     attrs = {
         "host": "host",
         "port": "port",
+        "ssl": "ssl",
         "db": "db",
         "user": "user",
         "password": "password",
@@ -127,6 +128,7 @@ def _get_conn(ret):
 
     host = _options.get("host")
     port = _options.get("port")
+    ssl = _options.get("ssl") or False
     db_ = _options.get("db")
     user = _options.get("user")
     password = _options.get("password")
@@ -136,8 +138,8 @@ def _get_conn(ret):
     # pymongo versions < 2.3 until then there are
     # a bunch of these sections that need to be supported
 
-    if PYMONGO_VERSION > Version("2.3"):
-        conn = pymongo.MongoClient(host, port)
+    if PYMONGO_VERSION > _LooseVersion("2.3"):
+        conn = pymongo.MongoClient(host=host, port=port, ssl=ssl)
     else:
         conn = pymongo.Connection(host, port)
     mdb = conn[db_]
diff --git a/tests/pytests/unit/returners/test_mongo_return.py b/tests/pytests/unit/returners/test_mongo_return.py
new file mode 100644
index 00000000000..7322a5d247b
--- /dev/null
+++ b/tests/pytests/unit/returners/test_mongo_return.py
@@ -0,0 +1,77 @@
+import pytest
+import salt.returners.mongo_return as mongo_return
+from tests.support.mock import patch
+
+
+@pytest.fixture
+def configure_loader_modules():
+    fake_opts = {"mongo.host": "fnord", "mongo.port": "fnordport"}
+    return {
+        mongo_return: {
+            "__opts__": fake_opts,
+            "__salt__": {"config.option": fake_opts.get},
+        }
+    }
+
+
+@pytest.mark.parametrize(
+    "expected_ssl, use_ssl",
+    [
+        (True, {"fnord.mongo.ssl": True}),
+        (False, {"fnord.mongo.ssl": False}),
+        (False, {"fnord.mongo.ssl": None}),
+        (False, {}),
+    ],
+)
+def test_mongo_returner_should_correctly_pass_ssl_to_MongoClient_when_ret_is_set(
+    expected_ssl, use_ssl
+):
+    with patch(
+        "salt.returners.mongo_return.pymongo", create=True
+    ) as fake_mongo, patch.object(
+        mongo_return,
+        "PYMONGO_VERSION",
+        mongo_return._LooseVersion("99999"),
+        create=True,
+    ), patch.dict(
+        "salt.returners.mongo_return.__opts__",
+        {
+            **use_ssl,
+            **{"fnord.mongo.host": "fnordfnord", "fnord.mongo.port": "fnordfnordport"},
+        },
+    ):
+        mongo_return._get_conn(ret={"ret_config": "fnord"})
+        fake_mongo.MongoClient.assert_called_with(
+            host="fnordfnord", port="fnordfnordport", ssl=expected_ssl
+        )
+
+
+@pytest.mark.parametrize(
+    "expected_ssl, use_ssl",
+    [
+        (True, {"mongo.ssl": True}),
+        (False, {"mongo.ssl": False}),
+        (False, {"mongo.ssl": None}),
+        (False, {}),
+    ],
+)
+def test_mongo_returner_should_correctly_pass_ssl_to_MongoClient(expected_ssl, use_ssl):
+    # Here these fnord.X.Y config options should be ignored
+    with patch(
+        "salt.returners.mongo_return.pymongo", create=True
+    ) as fake_mongo, patch.object(
+        mongo_return,
+        "PYMONGO_VERSION",
+        mongo_return._LooseVersion("99999"),
+        create=True,
+    ), patch.dict(
+        "salt.returners.mongo_return.__opts__",
+        {
+            **use_ssl,
+            **{"fnord.mongo.host": "fnordfnord", "fnord.mongo.port": "fnordfnordport"},
+        },
+    ):
+        mongo_return._get_conn(ret=None)
+        fake_mongo.MongoClient.assert_called_with(
+            host="fnord", port="fnordport", ssl=expected_ssl
+        )