mirror of https://github.com/mongodb/mongo
82 lines
2.5 KiB
JavaScript
82 lines
2.5 KiB
JavaScript
// Test X509 auth when --tlsAllowInvalidCertificates is enabled
|
|
|
|
const CLIENT_NAME = "CN=client,OU=KernelUser,O=MongoDB,L=New York City,ST=New York,C=US";
|
|
const CLIENT_CERT = "jstests/libs/client.pem";
|
|
const SERVER_CERT = "jstests/libs/server.pem";
|
|
const CA_CERT = "jstests/libs/ca.pem";
|
|
const SELF_SIGNED_CERT = "jstests/libs/client-self-signed.pem";
|
|
|
|
function hasX509AuthSucceeded(conn) {
|
|
if (checkLog.checkContainsOnce(conn, "No verified subject name available from client")) {
|
|
return false;
|
|
}
|
|
|
|
if (checkLog.checkContainsOnce(conn, "Successfully authenticated")) {
|
|
return true;
|
|
}
|
|
print("Not yet clear what was the result...");
|
|
return null;
|
|
}
|
|
|
|
function testClient(cert, name, shouldSucceed) {
|
|
print("Starting mongod...");
|
|
const conn = MongoRunner.runMongod({
|
|
auth: "",
|
|
tlsMode: "requireTLS",
|
|
tlsCertificateKeyFile: SERVER_CERT,
|
|
tlsCAFile: CA_CERT,
|
|
tlsAllowInvalidCertificates: "",
|
|
});
|
|
|
|
print("Creating admin user...");
|
|
const admin = conn.getDB("admin");
|
|
admin.createUser({user: "admin", pwd: "admin", roles: ["root"]});
|
|
admin.auth("admin", "admin");
|
|
|
|
print("Creating external user...");
|
|
const external = conn.getDB("$external");
|
|
external.createUser({user: CLIENT_NAME, roles: [{"role": "readWrite", "db": "test"}]});
|
|
|
|
let auth = {mechanism: "MONGODB-X509"};
|
|
if (name !== null) {
|
|
auth.user = name;
|
|
}
|
|
|
|
print("Running mongo shell script...");
|
|
if (!shouldSucceed) {
|
|
print("Note: following shell command is expected to fail");
|
|
}
|
|
|
|
const script = "assert(db.getSiblingDB('$external').auth(" + tojson(auth) + "));";
|
|
const exitCode = runMongoProgram(
|
|
"mongo",
|
|
"--tls",
|
|
"--tlsAllowInvalidHostnames",
|
|
"--tlsCertificateKeyFile",
|
|
cert,
|
|
"--tlsCAFile",
|
|
CA_CERT,
|
|
"--port",
|
|
conn.port,
|
|
"--eval",
|
|
script,
|
|
);
|
|
|
|
print("Analyzing results...");
|
|
assert.eq(shouldSucceed, exitCode === 0, "exitCode = " + tojson(exitCode));
|
|
assert.soon(
|
|
() => hasX509AuthSucceeded(admin) !== null,
|
|
"can not find in mongod logs whether it succeeded to authenticate",
|
|
15000,
|
|
);
|
|
assert.eq(shouldSucceed, hasX509AuthSucceeded(admin));
|
|
|
|
print("Stopping mongod...");
|
|
MongoRunner.stopMongod(conn);
|
|
}
|
|
|
|
testClient(CLIENT_CERT, CLIENT_NAME, true);
|
|
testClient(SELF_SIGNED_CERT, CLIENT_NAME, false);
|
|
testClient(CLIENT_CERT, null, true);
|
|
testClient(SELF_SIGNED_CERT, null, false);
|