SERVER-53064: connection created using transient SSL params cannot be recycled

1 files changed, 14 insertions, 0 deletions

diff --git a/src/mongo/client/connpool.cpp b/src/mongo/client/connpool.cpp
index 946c5b8741d..3a396fa782b 100644
--- a/src/mongo/client/connpool.cpp
+++ b/src/mongo/client/connpool.cpp
@@ -43,6 +43,7 @@
 #include "mongo/client/dbclient_connection.h"
 #include "mongo/client/global_conn_pool.h"
 #include "mongo/client/replica_set_monitor.h"
+#include "mongo/config.h"
 #include "mongo/executor/connection_pool_stats.h"
 #include "mongo/logv2/log.h"
 #include "mongo/stdx/chrono.h"
@@ -138,6 +139,16 @@ auto PoolForHost::done(DBConnectionPool* pool, DBClientBase* c) -> ConnectionHea
               "socketTimeout"_attr = makeDuration(_socketTimeoutSecs),
               "numOpenConns"_attr = openConnections());
         return ConnectionHealth::kTooMany;
+#ifdef MONGO_CONFIG_SSL
+    } else if (c->isUsingTransientSSLParams()) {
+        LOGV2(53064,
+              "Ending idle connection to a host because it was authenticated with transient SSL "
+              "params",
+              "connString"_attr = _hostName,
+              "socketTimeout"_attr = makeDuration(_socketTimeoutSecs),
+              "numOpenConns"_attr = openConnections());
+        return ConnectionHealth::kFailed;
+#endif
     }
 
     // The connection is probably fine, save for later
@@ -178,6 +189,9 @@ DBClientBase* PoolForHost::get(DBConnectionPool* pool, double socketTimeout) {
         }
 
         verify(sc.conn->getSoTimeout() == socketTimeout);
+#ifdef MONGO_CONFIG_SSL
+        invariant(!sc.conn->isUsingTransientSSLParams());
+#endif
 
         ++_checkedOut;
         return sc.conn.release();