mirror of https://github.com/mongodb/mongo
117 lines
4.5 KiB
JavaScript
117 lines
4.5 KiB
JavaScript
// Test configuration parameter tlsClusterAuthX509ExtensionValue
|
|
// aka: net.tls.clusterAuthX509.extensionValue
|
|
// @tags: [ requires_fcv_70 ]
|
|
|
|
(function() {
|
|
'use strict';
|
|
|
|
load('jstests/ssl/libs/ssl_helpers.js');
|
|
if (determineSSLProvider() !== "openssl") {
|
|
jsTest.log('Test requires openssl based TLS support');
|
|
return;
|
|
}
|
|
|
|
// Fails when used without clusterAuthMode == 'X509'
|
|
{
|
|
const opts = {auth: '', tlsClusterAuthX509ExtensionValue: 'foo'};
|
|
const errmsg =
|
|
'net.tls.clusterAuthX509.extensionValue requires a clusterAuthMode which allows for usage of X509';
|
|
|
|
jsTest.log('No clusterAuthMode set');
|
|
clearRawMongoProgramOutput();
|
|
assert.throws(() => MongoRunner.runMongod(opts));
|
|
assert(rawMongoProgramOutput().includes(errmsg));
|
|
|
|
jsTest.log('clusterAuthMode == keyFile');
|
|
clearRawMongoProgramOutput();
|
|
opts.clusterAuthMode = 'keyFile';
|
|
assert.throws(() => MongoRunner.runMongod(opts));
|
|
assert(rawMongoProgramOutput().includes(errmsg));
|
|
}
|
|
|
|
function authAndDo(port, cert, cmd = ';') {
|
|
jsTest.log('Connecting to localhost using cert: ' + cert);
|
|
function x509auth(db) {
|
|
const ext = db.getSiblingDB('$external');
|
|
assert.commandWorked(ext.runCommand({authenticate: 1, mechanism: 'MONGODB-X509'}));
|
|
return ext.adminCommand({connectionStatus: 1});
|
|
}
|
|
clearRawMongoProgramOutput();
|
|
const shell = runMongoProgram('mongo',
|
|
'--host',
|
|
'localhost',
|
|
'--port',
|
|
port,
|
|
'--tls',
|
|
'--tlsCAFile',
|
|
'jstests/libs/ca.pem',
|
|
'--tlsCertificateKeyFile',
|
|
cert,
|
|
'--eval',
|
|
x509auth + ' x509auth(db); ' + cmd);
|
|
assert.eq(shell, 0);
|
|
}
|
|
|
|
function runTest(conn) {
|
|
const SERVER_RDN = 'CN=server,OU=Kernel,O=MongoDB,L=New York City,ST=New York,C=US';
|
|
const SERVER = 'jstests/libs/server.pem';
|
|
const FOO_MEMBER = 'jstests/ssl/libs/cluster-member-foo.pem';
|
|
const BAR_MEMBER = 'jstests/ssl/libs/cluster-member-bar.pem';
|
|
const FOO_MEMBER_ALT = 'jstests/ssl/libs/cluster-member-foo-alt-rdn.pem';
|
|
const FOO_MEMBER_ALT_RDN = 'CN=Doer,OU=Business,O=Company,L=Fakesville,ST=Example,C=ZZ';
|
|
|
|
const admin = conn.getDB('admin');
|
|
const ext = conn.getDB('$external');
|
|
|
|
// Ensure no localhost auth bypass available.
|
|
assert.commandWorked(admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['root']}));
|
|
assert(admin.auth('admin', 'admin'));
|
|
|
|
// Connect using server.pem which has the same RDN, but no custom extension.
|
|
// This will result in an unknown user condition because we are
|
|
// not recognized as a cluster member.
|
|
assert.throws(() => authAndDo(conn.port, SERVER));
|
|
|
|
const insertCmd = 'assert.writeOK(db.getSiblingDB("test").mycoll.insert({x:1}));';
|
|
// Connect using same RDN WITH custom extension.
|
|
authAndDo(conn.port, FOO_MEMBER, insertCmd);
|
|
|
|
// Connect using cert with membership extension, but wrong value.
|
|
assert.throws(() => authAndDo(conn.port, BAR_MEMBER));
|
|
|
|
// Connect using cert with right membership, but different RDN (allowed).
|
|
authAndDo(conn.port, FOO_MEMBER_ALT, insertCmd);
|
|
|
|
// Create a user who would have been a cluster member under name based rules.
|
|
// We should have basic privs, testing with read but not write.
|
|
const readCmd = 'db.getSiblingDB("test").mycoll.find({});';
|
|
const readRoles = [{db: 'admin', role: 'readAnyDatabase'}];
|
|
assert.commandWorked(ext.runCommand({createUser: SERVER_RDN, roles: readRoles}));
|
|
authAndDo(conn.port, SERVER, readCmd);
|
|
assert.throws(() => authAndDo(conn.port, SERVER, insertCmd));
|
|
|
|
// Create a user with FOO_MEMBER_ALT's RDN to validate enforceUserClusterSeparation.
|
|
authAndDo(conn.port, FOO_MEMBER_ALT);
|
|
assert.commandWorked(ext.runCommand({createUser: FOO_MEMBER_ALT_RDN, roles: readRoles}));
|
|
assert.throws(() => authAndDo(conn.port, FOO_MEMBER_ALT));
|
|
}
|
|
|
|
{
|
|
const opts = {
|
|
auth: '',
|
|
tlsMode: 'requireTLS',
|
|
tlsCertificateKeyFile: 'jstests/ssl/libs/cluster-member-foo.pem',
|
|
tlsCAFile: 'jstests/libs/ca.pem',
|
|
clusterAuthMode: 'x509',
|
|
tlsClusterAuthX509ExtensionValue: 'foo',
|
|
setParameter: {
|
|
enforceUserClusterSeparation: 'true',
|
|
},
|
|
};
|
|
|
|
const mongod = MongoRunner.runMongod(opts);
|
|
runTest(mongod);
|
|
MongoRunner.stopMongod(mongod);
|
|
}
|
|
})();
|