mirror of https://github.com/mongodb/mongo
57 lines
2.1 KiB
JavaScript
57 lines
2.1 KiB
JavaScript
(function() {
|
|
'use strict';
|
|
if (_isWindows()) {
|
|
// OpenSSL backed imports Root CA and intermediate CA
|
|
runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
|
|
|
|
// SChannel backed follows Windows rules and only trusts the Root store in Local Machine and
|
|
// Current User.
|
|
runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\trusted-ca.pem");
|
|
}
|
|
|
|
var replTest = new ReplSetTest({
|
|
name: "ssltest",
|
|
nodes: 1,
|
|
nodeOptions: {
|
|
sslMode: "requireSSL",
|
|
sslPEMKeyFile: "jstests/libs/trusted-server.pem",
|
|
},
|
|
host: "localhost",
|
|
useHostName: false,
|
|
});
|
|
|
|
replTest.startSet({
|
|
env: {
|
|
SSL_CERT_FILE: 'jstests/libs/trusted-ca.pem',
|
|
},
|
|
});
|
|
replTest.initiate();
|
|
|
|
var nodeList = replTest.nodeList().join();
|
|
|
|
var checkShellOkay = function(url) {
|
|
// Should not be able to authenticate with x509.
|
|
// Authenticate call will return 1 on success, 0 on error.
|
|
var argv = ['mongo', url, '--eval', ('db.runCommand({replSetGetStatus: 1})')];
|
|
if (!_isWindows()) {
|
|
// On Linux we override the default path to the system CA store to point to our
|
|
// "trusted" CA. On Windows, this CA will have been added to the user's trusted CA list
|
|
argv.unshift("env", "SSL_CERT_FILE=jstests/libs/trusted-ca.pem");
|
|
}
|
|
return runMongoProgram(...argv);
|
|
};
|
|
|
|
var noMentionSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}`;
|
|
jsTestLog(`Replica set url (doesn't mention SSL): ${noMentionSSLURL}`);
|
|
assert.neq(checkShellOkay(noMentionSSLURL), 0, "shell correctly failed to connect without SSL");
|
|
|
|
var useSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}&ssl=true`;
|
|
jsTestLog(`Replica set url (uses SSL): ${useSSLURL}`);
|
|
assert.eq(checkShellOkay(useSSLURL), 0, "successfully connected with SSL");
|
|
|
|
var disableSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}&ssl=false`;
|
|
jsTestLog(`Replica set url (doesnt use SSL): ${disableSSLURL}`);
|
|
assert.neq(checkShellOkay(disableSSLURL), 0, "shell correctly failed to connect without SSL");
|
|
replTest.stopSet();
|
|
})();
|