mirror of https://github.com/mongodb/mongo
61 lines
2.1 KiB
JavaScript
61 lines
2.1 KiB
JavaScript
// Test X509 auth when --sslAllowInvalidCertificates is enabled
|
|
|
|
(function() {
|
|
'use strict';
|
|
|
|
const CLIENT_NAME = "CN=client,OU=KernelUser,O=MongoDB,L=New York City,ST=New York,C=US";
|
|
const CLIENT_CERT = 'jstests/libs/client.pem';
|
|
const SERVER_CERT = 'jstests/libs/server.pem';
|
|
const CA_CERT = 'jstests/libs/ca.pem';
|
|
const SELF_SIGNED_CERT = 'jstests/libs/client-self-signed.pem';
|
|
|
|
function testClient(conn, cert, name, shouldSucceed) {
|
|
let auth = {mechanism: 'MONGODB-X509'};
|
|
if (name !== null) {
|
|
auth.user = name;
|
|
}
|
|
const script = 'assert(db.getSiblingDB(\'$external\').auth(' + tojson(auth) + '));';
|
|
clearRawMongoProgramOutput();
|
|
const exitCode = runMongoProgram('mongo',
|
|
'--ssl',
|
|
'--sslAllowInvalidHostnames',
|
|
'--sslPEMKeyFile',
|
|
cert,
|
|
'--sslCAFile',
|
|
CA_CERT,
|
|
'--port',
|
|
conn.port,
|
|
'--eval',
|
|
script);
|
|
|
|
assert.eq(shouldSucceed, exitCode === 0, "exitCode = " + tojson(exitCode));
|
|
assert.eq(!shouldSucceed,
|
|
rawMongoProgramOutput().includes('No verified subject name available from client'));
|
|
}
|
|
|
|
function runTest(conn) {
|
|
const admin = conn.getDB('admin');
|
|
admin.createUser({user: "admin", pwd: "admin", roles: ["root"]});
|
|
admin.auth('admin', 'admin');
|
|
|
|
const external = conn.getDB('$external');
|
|
external.createUser({user: CLIENT_NAME, roles: [{'role': 'readWrite', 'db': 'test'}]});
|
|
|
|
testClient(conn, CLIENT_CERT, CLIENT_NAME, true);
|
|
testClient(conn, SELF_SIGNED_CERT, CLIENT_NAME, false);
|
|
testClient(conn, CLIENT_CERT, null, true);
|
|
testClient(conn, SELF_SIGNED_CERT, null, false);
|
|
}
|
|
|
|
// Standalone.
|
|
const mongod = MongoRunner.runMongod({
|
|
auth: '',
|
|
sslMode: 'requireSSL',
|
|
sslPEMKeyFile: SERVER_CERT,
|
|
sslCAFile: CA_CERT,
|
|
sslAllowInvalidCertificates: '',
|
|
});
|
|
runTest(mongod);
|
|
MongoRunner.stopMongod(mongod);
|
|
})();
|