SERVER-12748 Prevent invalid sslMode and clusterAuthMode combinations

2 files changed, 15 insertions, 2 deletions

diff --git a/src/mongo/db/commands/parameters.cpp b/src/mongo/db/commands/parameters.cpp
index daad441a30a..a1ad06d4f69 100644
--- a/src/mongo/db/commands/parameters.cpp
+++ b/src/mongo/db/commands/parameters.cpp
@@ -354,8 +354,15 @@ namespace mongo {
                 }
 
                 int oldMode = serverGlobalParams.clusterAuthMode.load();
+                int sslMode = sslGlobalParams.sslMode.load();
                 if (str == "sendX509" && 
                     oldMode == ServerGlobalParams::ClusterAuthMode_sendKeyFile) {
+                    if (sslMode == SSLGlobalParams::SSLMode_disabled ||
+                        sslMode == SSLGlobalParams::SSLMode_allowSSL) {
+                        return Status(ErrorCodes::BadValue, mongoutils::str::stream() <<
+                                    "Illegal state transition for clusterAuthMode, " <<
+                                    "need to enable SSL for outgoing connections");
+                    }
                     serverGlobalParams.clusterAuthMode.store
                         (ServerGlobalParams::ClusterAuthMode_sendX509);
 #ifdef MONGO_SSL
diff --git a/src/mongo/util/net/ssl_options.cpp b/src/mongo/util/net/ssl_options.cpp
index 8a75a7b36b9..64aa2c2b878 100644
--- a/src/mongo/util/net/ssl_options.cpp
+++ b/src/mongo/util/net/ssl_options.cpp
@@ -201,11 +201,17 @@ namespace mongo {
         if (clusterAuthMode == ServerGlobalParams::ClusterAuthMode_sendKeyFile ||
             clusterAuthMode == ServerGlobalParams::ClusterAuthMode_sendX509 ||
             clusterAuthMode == ServerGlobalParams::ClusterAuthMode_x509) {
-            if (sslGlobalParams.sslMode.load() == SSLGlobalParams::SSLMode_disabled){
+            if (sslGlobalParams.sslMode.load() == SSLGlobalParams::SSLMode_disabled) {
                 return Status(ErrorCodes::BadValue, "need to enable SSL via the sslMode flag");
+            } 
+        }
+        if (sslGlobalParams.sslMode.load() == SSLGlobalParams::SSLMode_allowSSL) {
+            if (clusterAuthMode == ServerGlobalParams::ClusterAuthMode_sendX509 ||
+                clusterAuthMode == ServerGlobalParams::ClusterAuthMode_x509) {
+                    return Status(ErrorCodes::BadValue,
+                                  "cannot have x.509 cluster authentication in allowSSL mode");
             }
         }
-
         return Status::OK();
     }