mirror of https://github.com/mongodb/mongo
90 lines
3.0 KiB
JavaScript
90 lines
3.0 KiB
JavaScript
// Test that we can safely use entries in the user cache created by old connections.
|
|
|
|
const SERVER_CERT = "jstests/libs/server.pem";
|
|
const CA_CERT = "jstests/libs/ca.pem";
|
|
const CLIENT_CERT = "jstests/libs/client_roles.pem";
|
|
|
|
function runTest(port) {
|
|
// Run given test function in a parallel shell.
|
|
const runShell = function (func) {
|
|
const res = runMongoProgram(
|
|
"mongo",
|
|
"--host",
|
|
"localhost",
|
|
"--port",
|
|
port,
|
|
"--tls",
|
|
"--tlsCAFile",
|
|
CA_CERT,
|
|
"--tlsCertificateKeyFile",
|
|
CLIENT_CERT,
|
|
"--eval",
|
|
`(${func.toString()})();`,
|
|
);
|
|
|
|
assert.eq(0, res, "Connection attempt failed");
|
|
};
|
|
|
|
// Log in as the user for the first time, then kill the connection. This will store a user
|
|
// object in the cache which references the SSLPeerInfo object stored on the now-dead session.
|
|
jsTest.log("Creating initial user cache entry");
|
|
runShell(() => {
|
|
let ret = db.getSiblingDB("$external").auth({
|
|
mechanism: "MONGODB-X509",
|
|
user: "CN=Kernel Client Peer Role,OU=Kernel Users,O=MongoDB,L=New York City,ST=New York,C=US",
|
|
});
|
|
assert.eq(ret, 1, "Auth failed");
|
|
});
|
|
jsTest.log("Attempt to use old user entry");
|
|
runShell(`() => {
|
|
// When we log in, we acquire the aforementioned user object.
|
|
let ret = db.getSiblingDB("$external").auth({
|
|
mechanism: "MONGODB-X509",
|
|
user: "CN=Kernel Client Peer Role,OU=Kernel Users,O=MongoDB,L=New York City,ST=New York,C=US"
|
|
});
|
|
assert.eq(ret, 1, "Auth failed");
|
|
|
|
// Invalidate the cache by creating a role as an admin user
|
|
const res = runMongoProgram("mongo",
|
|
"--host",
|
|
"localhost",
|
|
"--port",
|
|
${port},
|
|
"--tls",
|
|
"--tlsCAFile",
|
|
"${CA_CERT}",
|
|
"--tlsCertificateKeyFile",
|
|
"${CLIENT_CERT}",
|
|
"--eval",
|
|
\`const admin = db.getSiblingDB('admin');
|
|
assert(admin.auth('admin', 'admin'));
|
|
assert.commandWorked(admin.runCommand({ createRole: "roleabc", roles: [], privileges: [] }));
|
|
\`);
|
|
assert.eq(0, res);
|
|
|
|
// Now reacquire the user. Because our user object was just invalidated, we will use the SSLPeerInfo on the acquired user object to generate a user cache key.
|
|
db["test"].find({});
|
|
}`);
|
|
}
|
|
|
|
const setup = function (conn) {
|
|
// Create an admin user, which we will later use to invalidate the user cache.
|
|
const admin = conn.getDB("admin");
|
|
admin.createUser({user: "admin", pwd: "admin", roles: ["root"]});
|
|
assert(admin.auth("admin", "admin"));
|
|
};
|
|
|
|
let mongo = MongoRunner.runMongod({
|
|
tlsMode: "requireTLS",
|
|
tlsCertificateKeyFile: SERVER_CERT,
|
|
tlsCAFile: CA_CERT,
|
|
auth: "",
|
|
});
|
|
jsTest.log("Setup");
|
|
setup(mongo);
|
|
|
|
jsTest.log("Test");
|
|
runTest(mongo.port);
|
|
|
|
MongoRunner.stopMongod(mongo);
|