1 files changed, 42 insertions, 0 deletions
diff --git a/src/mongo/util/net/ssl_options.cpp b/src/mongo/util/net/ssl_options.cpp
index 9b5408849ae..147bf971998 100644
--- a/src/mongo/util/net/ssl_options.cpp
+++ b/src/mongo/util/net/ssl_options.cpp
@@ -107,6 +107,14 @@ Status addSSLServerOptions(moe::OptionSection* options) {
         moe::String,
         "Comma separated list of TLS protocols to disable [TLS1_0,TLS1_1,TLS1_2]");
 
+    options
+        ->addOptionChaining(
+            "net.tls.logVersions",
+            "tlsLogVersions",
+            moe::String,
+            "Comma separated list of TLS protocols to log on connect [TLS1_0,TLS1_1,TLS1_2]")
+        .hidden();
+
     options->addOptionChaining("net.ssl.weakCertificateValidation",
                                "sslWeakCertificateValidation",
                                moe::Switch,
@@ -135,6 +143,33 @@ Status addSSLServerOptions(moe::OptionSection* options) {
     return Status::OK();
 }
 
+Status storeTLSLogVersion(const std::string& loggedProtocols) {
+    // The tlsLogVersion field is composed of a comma separated list of protocols to
+    // log. First, tokenize the field.
+    const auto tokens = StringSplitter::split(loggedProtocols, ",");
+
+    // All universally accepted tokens, and their corresponding enum representation.
+    const std::map<std::string, SSLParams::Protocols> validConfigs{
+        {"TLS1_0", SSLParams::Protocols::TLS1_0},
+        {"TLS1_1", SSLParams::Protocols::TLS1_1},
+        {"TLS1_2", SSLParams::Protocols::TLS1_2},
+    };
+
+    // Map the tokens to their enum values, and push them onto the list of logged protocols.
+    for (const std::string& token : tokens) {
+        auto mappedToken = validConfigs.find(token);
+        if (mappedToken != validConfigs.end()) {
+            sslGlobalParams.tlsLogVersions.push_back(mappedToken->second);
+            continue;
+        }
+
+        return Status(ErrorCodes::BadValue, "Unrecognized tlsLogVersions '" + token + "'");
+    }
+
+    return Status::OK();
+}
+
+
 Status addSSLClientOptions(moe::OptionSection* options) {
     options->addOptionChaining("ssl", "ssl", moe::Switch, "use SSL for all connections");
 
@@ -368,6 +403,13 @@ Status storeSSLServerOptions(const moe::Environment& params) {
         }
     }
 
+    if (params.count("net.tls.logVersions")) {
+        const auto status = storeTLSLogVersion(params["net.tls.logVersions"].as<string>());
+        if (!status.isOK()) {
+            return status;
+        }
+    }
+
     if (params.count("net.ssl.weakCertificateValidation")) {
         sslGlobalParams.sslWeakCertificateValidation =
             params["net.ssl.weakCertificateValidation"].as<bool>();