SERVER-8510 Factored out ssl option registration and storage

15 files changed, 314 insertions, 199 deletions

diff --git a/src/mongo/SConscript b/src/mongo/SConscript
index dc2beab8a8a..679a0a091ba 100644
--- a/src/mongo/SConscript
+++ b/src/mongo/SConscript
@@ -221,6 +221,7 @@ commonFiles = [ "pch.cpp",
                 "util/stack_introspect.cpp",
                 "util/net/sock.cpp",
                 "util/net/ssl_manager.cpp",
+                "util/net/ssl_options.cpp",
                 "util/net/httpclient.cpp",
                 "util/net/message.cpp",
                 "util/net/message_port.cpp",
@@ -299,7 +300,9 @@ env.StaticLibrary('mongocommon', commonFiles,
                            'util/concurrency/thread_name',
                            '$BUILD_DIR/third_party/shim_pcrecpp',
                            '$BUILD_DIR/third_party/murmurhash3/murmurhash3',
-                           '$BUILD_DIR/third_party/shim_boost'] +
+                           '$BUILD_DIR/third_party/shim_boost',
+                           '$BUILD_DIR/mongo/util/options_parser/options_parser',
+                           ] +
                            extraCommonLibdeps)
 
 env.StaticLibrary("coredb", [
diff --git a/src/mongo/client/dbclient.cpp b/src/mongo/client/dbclient.cpp
index 4b1b23ffabd..18f1916bbed 100644
--- a/src/mongo/client/dbclient.cpp
+++ b/src/mongo/client/dbclient.cpp
@@ -32,11 +32,7 @@
 #include "mongo/util/assert_util.h"
 #include "mongo/util/md5.hpp"
 #include "mongo/util/net/ssl_manager.h"
-
-#ifdef MONGO_SSL
-// TODO: Remove references to cmdline from the client.
-#include "mongo/db/cmdline.h"
-#endif  // defined MONGO_SSL
+#include "mongo/util/net/ssl_options.h"
 
 namespace mongo {
 
@@ -896,7 +892,7 @@ namespace mongo {
         }
 
 #ifdef MONGO_SSL
-        if ( cmdLine.sslOnNormalPorts ) {
+        if (sslGlobalParams.sslOnNormalPorts) {
             return p->secure( sslManager() );
         }
 #endif
diff --git a/src/mongo/client/dbclient.h b/src/mongo/client/dbclient.h
index b2f4e1382fc..317ae7d1be0 100644
--- a/src/mongo/client/dbclient.h
+++ b/src/mongo/client/dbclient.h
@@ -36,5 +36,6 @@
 #include "mongo/client/gridfs.h"
 #include "mongo/client/sasl_client_authenticate.h"
 #include "mongo/client/syncclusterconnection.h"
+#include "mongo/util/net/ssl_options.h"
 
 #include "mongo/client/undef_macros.h"
diff --git a/src/mongo/client/examples/httpClientTest.cpp b/src/mongo/client/examples/httpClientTest.cpp
index b789f62ab36..554f84d7a20 100644
--- a/src/mongo/client/examples/httpClientTest.cpp
+++ b/src/mongo/client/examples/httpClientTest.cpp
@@ -47,7 +47,7 @@ void play( string url ) {
 int main( int argc, const char **argv, char **envp) {
 
 #ifdef MONGO_SSL
-    cmdLine.sslOnNormalPorts = true;
+    sslGlobalParams.sslOnNormalPorts = true;
     runGlobalInitializersOrDie(argc, argv, envp);
 #endif
 
diff --git a/src/mongo/db/cmdline.cpp b/src/mongo/db/cmdline.cpp
index e94a09b318b..66e2212cdf5 100644
--- a/src/mongo/db/cmdline.cpp
+++ b/src/mongo/db/cmdline.cpp
@@ -42,6 +42,7 @@
 #include "mongo/util/map_util.h"
 #include "mongo/util/mongoutils/str.h"
 #include "mongo/util/net/listen.h"
+#include "mongo/util/net/ssl_options.h"
 #include "mongo/util/options_parser/environment.h"
 #include "mongo/util/options_parser/option_section.h"
 #include "mongo/util/options_parser/options_parser.h"
@@ -464,78 +465,9 @@ namespace {
         }
 
 #ifdef MONGO_SSL
-
-        if (params.count("ssl.PEMKeyFile")) {
-            cmdLine.sslPEMKeyFile = boost::filesystem::absolute(
-                                        params["ssl.PEMKeyFile"].as<string>()).generic_string();
-        }
-
-        if (params.count("ssl.PEMKeyPassword")) {
-            cmdLine.sslPEMKeyPassword = params["ssl.PEMKeyPassword"].as<string>();
-        }
-
-        if (params.count("ssl.clusterFile")) {
-            cmdLine.sslClusterFile = boost::filesystem::absolute(
-                                         params["ssl.clusterFile"].as<string>()).generic_string();
-        }
-
-        if (params.count("ssl.clusterPassword")) {
-            cmdLine.sslClusterPassword = params["ssl.clusterPassword"].as<string>();
-        }
-
-        if (params.count("ssl.CAFile")) {
-            cmdLine.sslCAFile = boost::filesystem::absolute(
-                                         params["ssl.CAFile"].as<std::string>()).generic_string();
-        }
-
-        if (params.count("ssl.CRLFile")) {
-            cmdLine.sslCRLFile = boost::filesystem::absolute(
-                                         params["ssl.CRLFile"].as<std::string>()).generic_string();
-        }
-
-        if (params.count("ssl.weakCertificateValidation")) {
-            cmdLine.sslWeakCertificateValidation = true;
-        }
-        if (params.count("ssl.sslOnNormalPorts")) {
-            cmdLine.sslOnNormalPorts = true;
-            if ( cmdLine.sslPEMKeyFile.size() == 0 ) {
-                return Status(ErrorCodes::BadValue,
-                              "need sslPEMKeyFile with sslOnNormalPorts");
-            }
-            if (cmdLine.sslWeakCertificateValidation &&
-                cmdLine.sslCAFile.empty()) {
-                return Status(ErrorCodes::BadValue,
-                              "need sslCAFile with sslWeakCertificateValidation");
-            }
-            if (!cmdLine.sslCRLFile.empty() &&
-                cmdLine.sslCAFile.empty()) {
-                return Status(ErrorCodes::BadValue, "need sslCAFile with sslCRLFile");
-            }
-            if (params.count("ssl.FIPSMode")) {
-                cmdLine.sslFIPSMode = true;
-            }
-        }
-        else if (cmdLine.sslPEMKeyFile.size() || 
-                 cmdLine.sslPEMKeyPassword.size() ||
-                 cmdLine.sslClusterFile.size() ||
-                 cmdLine.sslClusterPassword.size() ||
-                 cmdLine.sslCAFile.size() ||
-                 cmdLine.sslCRLFile.size() ||
-                 cmdLine.sslWeakCertificateValidation ||
-                 cmdLine.sslFIPSMode) {
-            return Status(ErrorCodes::BadValue, "need to enable sslOnNormalPorts");
-        }
-        if (cmdLine.clusterAuthMode == "sendKeyfile" || 
-            cmdLine.clusterAuthMode == "sendX509" || 
-            cmdLine.clusterAuthMode == "x509") {
-            if (!cmdLine.sslOnNormalPorts){
-                return Status(ErrorCodes::BadValue, "need to enable sslOnNormalPorts");
-            }
-        }
-        else if (params.count("clusterAuthMode") && cmdLine.clusterAuthMode != "keyfile") {
-            StringBuilder sb;
-            sb << "unsupported value for clusterAuthMode " << cmdLine.clusterAuthMode;
-            return Status(ErrorCodes::BadValue, sb.str());
+        ret = storeSSLServerOptions(params);
+        if (!ret.isOK()) {
+            return ret;
         }
 #else // ifdef MONGO_SSL
         // Keyfile is currently the only supported value if not using SSL 
diff --git a/src/mongo/db/cmdline.h b/src/mongo/db/cmdline.h
index 83b4c0fc238..e6a2d1f78ba 100644
--- a/src/mongo/db/cmdline.h
+++ b/src/mongo/db/cmdline.h
@@ -144,17 +144,6 @@ namespace mongo {
         ProcessId parentProc;      // --fork pid of initial process
         ProcessId leaderProc;      // --fork pid of leader process
 #endif
-#ifdef MONGO_SSL
-        bool sslOnNormalPorts;      // --sslOnNormalPorts
-        std::string sslPEMKeyFile;       // --sslPEMKeyFile
-        std::string sslPEMKeyPassword;   // --sslPEMKeyPassword
-        std::string sslClusterFile;       // --sslInternalKeyFile
-        std::string sslClusterPassword;   // --sslInternalKeyPassword
-        std::string sslCAFile;      // --sslCAFile
-        std::string sslCRLFile;     // --sslCRLFile
-        bool sslWeakCertificateValidation; // --sslWeakCertificateValidation
-        bool sslFIPSMode; // --sslFIPSMode
-#endif
 
         /**
          * Switches to enable experimental (unsupported) features.
@@ -216,10 +205,6 @@ namespace mongo {
 #if defined(_DURABLEDEFAULTOFF)
         dur = false;
 #endif
-
-#ifdef MONGO_SSL
-        sslOnNormalPorts = false;
-#endif
     }
 
     extern CmdLine cmdLine;
diff --git a/src/mongo/db/cmdline_test.cpp b/src/mongo/db/cmdline_test.cpp
index fba25377126..9fe03f309c9 100644
--- a/src/mongo/db/cmdline_test.cpp
+++ b/src/mongo/db/cmdline_test.cpp
@@ -39,6 +39,13 @@ namespace mongo {
 
     CmdLine cmdLine;
 
+#ifdef MONGO_SSL
+        Status storeSSLServerOptions(const optionenvironment::Environment& params) {
+            return Status(ErrorCodes::InternalError,
+                          "This is a storeSSLServerOptions stub and should not be called");
+        }
+#endif // ifdef MONGO_SSL
+
 namespace {
 
     namespace moe = mongo::optionenvironment;
diff --git a/src/mongo/db/mongod_options.cpp b/src/mongo/db/mongod_options.cpp
index 8024d15c2ef..7456a033c08 100644
--- a/src/mongo/db/mongod_options.cpp
+++ b/src/mongo/db/mongod_options.cpp
@@ -35,6 +35,7 @@
 #include "mongo/bson/util/builder.h"
 #include "mongo/db/module.h"
 #include "mongo/db/server_options.h"
+#include "mongo/util/net/ssl_options.h"
 #include "mongo/util/options_parser/option_description.h"
 #include "mongo/util/options_parser/option_section.h"
 
diff --git a/src/mongo/db/server_options.cpp b/src/mongo/db/server_options.cpp
index c3d2ecb0f9c..bbc4957ee66 100644
--- a/src/mongo/db/server_options.cpp
+++ b/src/mongo/db/server_options.cpp
@@ -252,54 +252,4 @@ namespace mongo {
         return Status::OK();
     }
 
-    Status addSSLServerOptions(moe::OptionSection* options) {
-        Status ret = options->addOption(OD("ssl.sslOnNormalPorts", "sslOnNormalPorts", moe::Switch,
-                    "use ssl on configured ports", true));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.PEMKeyFile", "sslPEMKeyFile", moe::String,
-                    "PEM file for ssl" , true));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.PEMKeyPassword", "sslPEMKeyPassword", moe::String,
-                    "PEM file password" , true, moe::Value(), moe::Value(std::string(""))));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.clusterFile", "sslClusterFile", moe::String,
-                    "Key file for internal SSL authentication" , true));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.clusterPassword", "sslClusterPassword", moe::String,
-                    "Internal authentication key file password" , true, moe::Value(), moe::Value(std::string(""))));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.CAFile", "sslCAFile", moe::String,
-                    "Certificate Authority file for SSL", true));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.CRLFile", "sslCRLFile", moe::String,
-                    "Certificate Revocation List file for SSL", true));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.weakCertificateValidation", "sslWeakCertificateValidation",
-                    moe::Switch, "allow client to connect without presenting a certificate", true));
-        if (!ret.isOK()) {
-            return ret;
-        }
-        ret = options->addOption(OD("ssl.FIPSMode", "sslFIPSMode", moe::Switch,
-                    "activate FIPS 140-2 mode at startup", true));
-        if (!ret.isOK()) {
-            return ret;
-        }
-
-        return Status::OK();
-    }
-
 } // namespace mongo
diff --git a/src/mongo/s/mongos_options.cpp b/src/mongo/s/mongos_options.cpp
index e3f3a699712..b73e5898e15 100644
--- a/src/mongo/s/mongos_options.cpp
+++ b/src/mongo/s/mongos_options.cpp
@@ -22,6 +22,7 @@
 #include "mongo/base/status.h"
 #include "mongo/bson/util/builder.h"
 #include "mongo/db/server_options.h"
+#include "mongo/util/net/ssl_options.h"
 #include "mongo/util/options_parser/option_description.h"
 #include "mongo/util/options_parser/option_section.h"
 
diff --git a/src/mongo/shell/dbshell.cpp b/src/mongo/shell/dbshell.cpp
index f5f1e2112a0..df530dfac35 100644
--- a/src/mongo/shell/dbshell.cpp
+++ b/src/mongo/shell/dbshell.cpp
@@ -37,6 +37,7 @@
 #include "mongo/shell/shell_utils.h"
 #include "mongo/shell/shell_utils_launcher.h"
 #include "mongo/util/file.h"
+#include "mongo/util/net/ssl_options.h"
 #include "mongo/util/options_parser/environment.h"
 #include "mongo/util/options_parser/option_section.h"
 #include "mongo/util/options_parser/options_parser.h"
@@ -751,32 +752,7 @@ Status addMongoShellOptions(moe::OptionSection* options) {
         return ret;
     }
 #ifdef MONGO_SSL
-    ret = options->addOption(OD("ssl", "ssl", moe::Switch, "use SSL for all connections", true));
-    if (!ret.isOK()) {
-        return ret;
-    }
-    ret = options->addOption(OD("ssl.CAFile", "sslCAFile", moe::String,
-                "Certificate Authority for SSL" , true));
-    if (!ret.isOK()) {
-        return ret;
-    }
-    ret = options->addOption(OD("ssl.PEMKeyFile", "sslPEMKeyFile", moe::String,
-                "PEM certificate/key file for SSL" , true));
-    if (!ret.isOK()) {
-        return ret;
-    }
-    ret = options->addOption(OD("ssl.PEMKeyPassword", "sslPEMKeyPassword", moe::String,
-                "password for key in PEM file for SSL" , true));
-    if (!ret.isOK()) {
-        return ret;
-    }
-    ret = options->addOption(OD("ssl.CRLFile", "sslCRLFile", moe::String,
-                "Certificate Revocation List file for SSL", true));
-    if (!ret.isOK()) {
-        return ret;
-    }
-    ret = options->addOption(OD("ssl.FIPSMode", "sslFIPSMode", moe::Switch,
-                "activate FIPS 140-2 mode at startup", true));
+    ret = addSSLClientOptions(options);
     if (!ret.isOK()) {
         return ret;
     }
@@ -818,23 +794,9 @@ Status storeMongoShellOptions() {
         mongo::cmdLine.quiet = true;
     }
 #ifdef MONGO_SSL
-    if ( params.count( "ssl" ) ) {
-        mongo::cmdLine.sslOnNormalPorts = true;
-    }
-    if (params.count("ssl.PEMKeyFile")) {
-        mongo::cmdLine.sslPEMKeyFile = params["ssl.PEMKeyFile"].as<std::string>();
-    }
-    if (params.count("ssl.PEMKeyPassword")) {
-        mongo::cmdLine.sslPEMKeyPassword = params["ssl.PEMKeyPassword"].as<std::string>();
-    }
-    if (params.count("ssl.CAFile")) {
-        mongo::cmdLine.sslCAFile = params["ssl.CAFile"].as<std::string>();
-    }
-    if (params.count("ssl.CRLFile")) {
-        mongo::cmdLine.sslCRLFile = params["ssl.CRLFile"].as<std::string>();
-    }
-    if (params.count( "ssl.FIPSMode")) {
-        mongo::cmdLine.sslFIPSMode = true;
+    Status ret = storeSSLClientOptions(params);
+    if (!ret.isOK()) {
+        return ret;
     }
 #endif
     if ( params.count( "ipv6" ) ) {
diff --git a/src/mongo/tools/tool.cpp b/src/mongo/tools/tool.cpp
index dca18af4f7b..cd7b1117700 100644
--- a/src/mongo/tools/tool.cpp
+++ b/src/mongo/tools/tool.cpp
@@ -36,6 +36,7 @@
 #include "mongo/util/file_allocator.h"
 #include "mongo/util/options_parser/option_section.h"
 #include "mongo/util/password.h"
+#include "mongo/util/net/ssl_options.h"
 #include "mongo/util/text.h"
 #include "mongo/util/version.h"
 
@@ -126,7 +127,7 @@ namespace mongo {
 
 #ifdef MONGO_SSL
         if (_params.count("ssl")) {
-            mongo::cmdLine.sslOnNormalPorts = true;
+            sslGlobalParams.sslOnNormalPorts = true;
         }
 #endif
 
diff --git a/src/mongo/util/net/ssl_manager.cpp b/src/mongo/util/net/ssl_manager.cpp
index f0b8b401aa7..0fb645e988c 100644
--- a/src/mongo/util/net/ssl_manager.cpp
+++ b/src/mongo/util/net/ssl_manager.cpp
@@ -24,10 +24,10 @@
 
 #include "mongo/base/init.h"
 #include "mongo/bson/util/atomic_int.h"
-#include "mongo/db/cmdline.h"
 #include "mongo/util/concurrency/mutex.h"
 #include "mongo/util/mongoutils/str.h"
 #include "mongo/util/net/sock.h"
+#include "mongo/util/net/ssl_options.h"
 #include "mongo/util/scopeguard.h"
 
 #ifdef MONGO_SSL
@@ -35,6 +35,9 @@
 #endif
 
 namespace mongo {
+
+    SSLGlobalParams sslGlobalParams;
+
 #ifndef MONGO_SSL   
     const std::string getSSLVersion(const std::string &prefix, const std::string &suffix) {
         return "";
@@ -271,16 +274,16 @@ namespace mongo {
     
     MONGO_INITIALIZER(SSLManager)(InitializerContext* context) {
         SimpleMutex::scoped_lock lck(sslManagerMtx);
-        if (cmdLine.sslOnNormalPorts) {
+        if (sslGlobalParams.sslOnNormalPorts) {
             const Params params(
-                cmdLine.sslPEMKeyFile,
-                cmdLine.sslPEMKeyPassword,
-                cmdLine.sslClusterFile,
-                cmdLine.sslClusterPassword,
-                cmdLine.sslCAFile,
-                cmdLine.sslCRLFile,
-                cmdLine.sslWeakCertificateValidation,
-                cmdLine.sslFIPSMode);
+                sslGlobalParams.sslPEMKeyFile,
+                sslGlobalParams.sslPEMKeyPassword,
+                sslGlobalParams.sslClusterFile,
+                sslGlobalParams.sslClusterPassword,
+                sslGlobalParams.sslCAFile,
+                sslGlobalParams.sslCRLFile,
+                sslGlobalParams.sslWeakCertificateValidation,
+                sslGlobalParams.sslFIPSMode);
             theSSLManager = new SSLManager(params, isSSLServer);
         }
         return Status::OK();
diff --git a/src/mongo/util/net/ssl_options.cpp b/src/mongo/util/net/ssl_options.cpp
new file mode 100644
index 00000000000..ee1900dbb75
--- /dev/null
+++ b/src/mongo/util/net/ssl_options.cpp
@@ -0,0 +1,217 @@
+/* Copyright 2013 10gen Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mongo/util/net/ssl_options.h"
+
+#include <boost/filesystem/operations.hpp>
+
+#include "mongo/base/status.h"
+#include "mongo/db/cmdline.h"
+#include "mongo/util/options_parser/environment.h"
+#include "mongo/util/options_parser/option_description.h"
+#include "mongo/util/options_parser/option_section.h"
+
+namespace mongo {
+
+    typedef moe::OptionDescription OD;
+    typedef moe::PositionalOptionDescription POD;
+
+    Status addSSLServerOptions(moe::OptionSection* options) {
+        Status ret = options->addOption(OD("ssl.sslOnNormalPorts", "sslOnNormalPorts", moe::Switch,
+                    "use ssl on configured ports", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.PEMKeyFile", "sslPEMKeyFile", moe::String,
+                    "PEM file for ssl", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.PEMKeyPassword", "sslPEMKeyPassword", moe::String,
+                    "PEM file password", true, moe::Value(), moe::Value(std::string(""))));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.clusterFile", "sslClusterFile", moe::String,
+                    "Key file for internal SSL authentication", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.clusterPassword", "sslClusterPassword", moe::String,
+                    "Internal authentication key file password", true, moe::Value(),
+                    moe::Value(std::string(""))));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.CAFile", "sslCAFile", moe::String,
+                    "Certificate Authority file for SSL", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.CRLFile", "sslCRLFile", moe::String,
+                    "Certificate Revocation List file for SSL", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.weakCertificateValidation", "sslWeakCertificateValidation",
+                    moe::Switch, "allow client to connect without presenting a certificate", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.FIPSMode", "sslFIPSMode", moe::Switch,
+                    "activate FIPS 140-2 mode at startup", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+
+        return Status::OK();
+    }
+
+    Status addSSLClientOptions(moe::OptionSection* options) {
+        Status ret = options->addOption(OD("ssl", "ssl", moe::Switch, "use SSL for all connections",
+                    true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.CAFile", "sslCAFile", moe::String,
+                    "Certificate Authority file for SSL", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.PEMKeyFile", "sslPEMKeyFile", moe::String,
+                    "PEM certificate/key file for SSL", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.PEMKeyPassword", "sslPEMKeyPassword", moe::String,
+                    "password for key in PEM file for SSL", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.CRLFile", "sslCRLFile", moe::String,
+                    "Certificate Revocation List file for SSL", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+        ret = options->addOption(OD("ssl.FIPSMode", "sslFIPSMode", moe::Switch,
+                    "activate FIPS 140-2 mode at startup", true));
+        if (!ret.isOK()) {
+            return ret;
+        }
+
+        return Status::OK();
+    }
+
+    Status storeSSLServerOptions(const moe::Environment& params) {
+
+        if (params.count("ssl.PEMKeyFile")) {
+            sslGlobalParams.sslPEMKeyFile = boost::filesystem::absolute(
+                                        params["ssl.PEMKeyFile"].as<string>()).generic_string();
+        }
+
+        if (params.count("ssl.PEMKeyPassword")) {
+            sslGlobalParams.sslPEMKeyPassword = params["ssl.PEMKeyPassword"].as<string>();
+        }
+
+        if (params.count("ssl.clusterFile")) {
+            sslGlobalParams.sslClusterFile = boost::filesystem::absolute(
+                                         params["ssl.clusterFile"].as<string>()).generic_string();
+        }
+
+        if (params.count("ssl.clusterPassword")) {
+            sslGlobalParams.sslClusterPassword = params["ssl.clusterPassword"].as<string>();
+        }
+
+        if (params.count("ssl.CAFile")) {
+            sslGlobalParams.sslCAFile = boost::filesystem::absolute(
+                                         params["ssl.CAFile"].as<std::string>()).generic_string();
+        }
+
+        if (params.count("ssl.CRLFile")) {
+            sslGlobalParams.sslCRLFile = boost::filesystem::absolute(
+                                         params["ssl.CRLFile"].as<std::string>()).generic_string();
+        }
+
+        if (params.count("ssl.weakCertificateValidation")) {
+            sslGlobalParams.sslWeakCertificateValidation = true;
+        }
+        if (params.count("ssl.sslOnNormalPorts")) {
+            sslGlobalParams.sslOnNormalPorts = true;
+            if (sslGlobalParams.sslPEMKeyFile.size() == 0) {
+                return Status(ErrorCodes::BadValue,
+                              "need sslPEMKeyFile with sslOnNormalPorts");
+            }
+            if (sslGlobalParams.sslWeakCertificateValidation &&
+                sslGlobalParams.sslCAFile.empty()) {
+                return Status(ErrorCodes::BadValue,
+                              "need sslCAFile with sslWeakCertificateValidation");
+            }
+            if (!sslGlobalParams.sslCRLFile.empty() &&
+                sslGlobalParams.sslCAFile.empty()) {
+                return Status(ErrorCodes::BadValue, "need sslCAFile with sslCRLFile");
+            }
+            if (params.count("ssl.FIPSMode")) {
+                sslGlobalParams.sslFIPSMode = true;
+            }
+        }
+        else if (sslGlobalParams.sslPEMKeyFile.size() ||
+                 sslGlobalParams.sslPEMKeyPassword.size() ||
+                 sslGlobalParams.sslClusterFile.size() ||
+                 sslGlobalParams.sslClusterPassword.size() ||
+                 sslGlobalParams.sslCAFile.size() ||
+                 sslGlobalParams.sslCRLFile.size() ||
+                 sslGlobalParams.sslWeakCertificateValidation ||
+                 sslGlobalParams.sslFIPSMode) {
+            return Status(ErrorCodes::BadValue, "need to enable sslOnNormalPorts");
+        }
+        if (cmdLine.clusterAuthMode == "sendKeyfile" ||
+            cmdLine.clusterAuthMode == "sendX509" ||
+            cmdLine.clusterAuthMode == "x509") {
+            if (!sslGlobalParams.sslOnNormalPorts){
+                return Status(ErrorCodes::BadValue, "need to enable sslOnNormalPorts");
+            }
+        }
+        else if (params.count("clusterAuthMode") && cmdLine.clusterAuthMode != "keyfile") {
+            StringBuilder sb;
+            sb << "unsupported value for clusterAuthMode " << cmdLine.clusterAuthMode;
+            return Status(ErrorCodes::BadValue, sb.str());
+        }
+
+        return Status::OK();
+    }
+
+    Status storeSSLClientOptions(const moe::Environment& params) {
+        if (params.count("ssl")) {
+            sslGlobalParams.sslOnNormalPorts = true;
+        }
+        if (params.count("ssl.PEMKeyFile")) {
+            sslGlobalParams.sslPEMKeyFile = params["ssl.PEMKeyFile"].as<std::string>();
+        }
+        if (params.count("ssl.PEMKeyPassword")) {
+            sslGlobalParams.sslPEMKeyPassword = params["ssl.PEMKeyPassword"].as<std::string>();
+        }
+        if (params.count("ssl.CAFile")) {
+            sslGlobalParams.sslCAFile = params["ssl.CAFile"].as<std::string>();
+        }
+        if (params.count("ssl.CRLFile")) {
+            sslGlobalParams.sslCRLFile = params["ssl.CRLFile"].as<std::string>();
+        }
+        if (params.count("ssl.FIPSMode")) {
+            sslGlobalParams.sslFIPSMode = true;
+        }
+        return Status::OK();
+    }
+
+} // namespace mongo
diff --git a/src/mongo/util/net/ssl_options.h b/src/mongo/util/net/ssl_options.h
new file mode 100644
index 00000000000..c21e166db81
--- /dev/null
+++ b/src/mongo/util/net/ssl_options.h
@@ -0,0 +1,56 @@
+/* Copyright 2013 10gen Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "mongo/base/status.h"
+
+namespace mongo {
+
+    namespace optionenvironment {
+        class OptionSection;
+        class Environment;
+    } // namespace optionenvironment
+
+    namespace moe = mongo::optionenvironment;
+
+    extern moe::Environment sslParsedOptions;
+
+    struct SSLGlobalParams {
+        bool sslOnNormalPorts;      // --sslOnNormalPorts
+        std::string sslPEMKeyFile;       // --sslPEMKeyFile
+        std::string sslPEMKeyPassword;   // --sslPEMKeyPassword
+        std::string sslClusterFile;       // --sslInternalKeyFile
+        std::string sslClusterPassword;   // --sslInternalKeyPassword
+        std::string sslCAFile;      // --sslCAFile
+        std::string sslCRLFile;     // --sslCRLFile
+        bool sslWeakCertificateValidation; // --sslWeakCertificateValidation
+        bool sslFIPSMode; // --sslFIPSMode
+
+        SSLGlobalParams() {
+            sslOnNormalPorts = false;
+        }
+    };
+
+    extern SSLGlobalParams sslGlobalParams;
+
+    Status addSSLServerOptions(moe::OptionSection* options);
+
+    Status addSSLClientOptions(moe::OptionSection* options);
+
+    Status storeSSLServerOptions(const moe::Environment& params);
+
+    Status storeSSLClientOptions(const moe::Environment& params);
+}