mongodb/jstests/ssl/x509_invalid.js

// Test X509 auth when --tlsAllowInvalidCertificates is enabled

const CLIENT_NAME = "CN=client,OU=KernelUser,O=MongoDB,L=New York City,ST=New York,C=US";
const CLIENT_CERT = 'jstests/libs/client.pem';
const SERVER_CERT = 'jstests/libs/server.pem';
const CA_CERT = 'jstests/libs/ca.pem';
const SELF_SIGNED_CERT = 'jstests/libs/client-self-signed.pem';

function hasX509AuthSucceeded(conn) {
    if (checkLog.checkContainsOnce(conn, 'No verified subject name available from client')) {
        return false;
    }

    if (checkLog.checkContainsOnce(conn, 'Successfully authenticated')) {
        return true;
    }
    print("Not yet clear what was the result...");
    return null;
}

function testClient(cert, name, shouldSucceed) {
    print("Starting mongod...");
    const conn = MongoRunner.runMongod({
        auth: '',
        tlsMode: 'requireTLS',
        tlsCertificateKeyFile: SERVER_CERT,
        tlsCAFile: CA_CERT,
        tlsAllowInvalidCertificates: '',
    });

    print("Creating admin user...");
    const admin = conn.getDB('admin');
    admin.createUser({user: "admin", pwd: "admin", roles: ["root"]});
    admin.auth('admin', 'admin');

    print("Creating external user...");
    const external = conn.getDB('$external');
    external.createUser({user: CLIENT_NAME, roles: [{'role': 'readWrite', 'db': 'test'}]});

    let auth = {mechanism: 'MONGODB-X509'};
    if (name !== null) {
        auth.user = name;
    }

    print("Running mongo shell script...");
    if (!shouldSucceed) {
        print("Note: following shell command is expected to fail");
    }

    const script = 'assert(db.getSiblingDB(\'$external\').auth(' + tojson(auth) + '));';
    const exitCode = runMongoProgram('mongo',
                                     '--tls',
                                     '--tlsAllowInvalidHostnames',
                                     '--tlsCertificateKeyFile',
                                     cert,
                                     '--tlsCAFile',
                                     CA_CERT,
                                     '--port',
                                     conn.port,
                                     '--eval',
                                     script);

    print("Analyzing results...");
    assert.eq(shouldSucceed, exitCode === 0, "exitCode = " + tojson(exitCode));
    assert.soon(() => hasX509AuthSucceeded(admin) !== null,
                "can not find in mongod logs whether it succeeded to authenticate",
                15000);
    assert.eq(shouldSucceed, hasX509AuthSucceeded(admin));

    print("Stopping mongod...");
    MongoRunner.stopMongod(conn);
}

testClient(CLIENT_CERT, CLIENT_NAME, true);
testClient(SELF_SIGNED_CERT, CLIENT_NAME, false);
testClient(CLIENT_CERT, null, true);
testClient(SELF_SIGNED_CERT, null, false);