1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
// Tests that OCSP responder latency is logged for client-side verification.
// @tags: [
// requires_http_client,
// ]
load("jstests/ocsp/lib/mock_ocsp.js");
(function() {
"use strict";
// We only have custom logging output for openssl.
if (determineSSLProvider() !== "openssl") {
return;
}
const mongodOptions = (connectionHealthLoggingOn) => {
return {
sslMode: "requireSSL",
sslPEMKeyFile: OCSP_SERVER_CERT,
sslCAFile: OCSP_CA_PEM,
sslAllowInvalidHostnames: "",
setParameter: {
"failpoint.disableStapling": "{'mode':'alwaysOn'}",
"ocspEnabled": "true",
"enableDetailedConnectionHealthMetricLogLines": connectionHealthLoggingOn
}
};
};
let runTest = (options) => {
const {ocspFaultType = "", connectionHealthLoggingOn} = options;
let mock_ocsp = new MockOCSPServer("", 1);
mock_ocsp.start();
let conn = MongoRunner.runMongod(mongodOptions(connectionHealthLoggingOn));
let loggingShellArg =
`enableDetailedConnectionHealthMetricLogLines=${connectionHealthLoggingOn}`;
clearRawMongoProgramOutput();
// The desired log line will be printed by the shell. We run a parallel shell because
// 'rawMongoProgramOutput' will only return logs for subprocesses spawned by the shell.
let runParallelShellSuccess = startParallelShell(
() => {
jsTestLog(
"Established connection with server to test successful certification verification.");
},
conn.port,
null /*noConnect */,
"--setShellParameter",
loggingShellArg,
"--tls",
"--tlsCAFile",
OCSP_CA_PEM,
"--tlsCertificateKeyFile",
OCSP_CLIENT_CERT,
"--tlsAllowInvalidHostnames",
"--verbose",
1);
runParallelShellSuccess();
const successOutput = rawMongoProgramOutput();
let failOutput;
if (ocspFaultType != "") {
mock_ocsp.stop();
jsTestLog(`Restarting MockOCSPServer with ${ocspFaultType} option`);
mock_ocsp = new MockOCSPServer(ocspFaultType, 1);
mock_ocsp.start();
clearRawMongoProgramOutput();
assert.throws(startParallelShell(
(ocspFaultType) => {
jsTestLog("Something went wrong if we print this! Fault type: " + ocspFaultType);
},
conn.port,
null /*noConnect */,
"--setShellParameter",
loggingShellArg,
"--tls",
"--tlsCAFile",
OCSP_CA_PEM,
"--tlsCertificateKeyFile",
OCSP_CLIENT_CERT,
"--tlsAllowInvalidHostnames",
"--verbose",
1));
failOutput = rawMongoProgramOutput();
}
if (ocspFaultType == FAULT_REVOKED) {
// Assert that the shell fails due to certificate being revoked, and we still measure
// OCSP responder latency if logging is enabled.
assert.gt(failOutput.search(/OCSPCertificateStatusRevoked/), 0);
}
// This is javascript's string search -- returns the first position of the regex string in
// the source string if there is a match, else returns -1.
if (connectionHealthLoggingOn) {
assert.gte(successOutput.search(/"id":6840101/), 0, successOutput);
} else {
assert.eq(successOutput.search(/"id":6840101/), -1, successOutput);
}
if (failOutput) {
if (connectionHealthLoggingOn) {
assert.gte(failOutput.search(/"id":6840101/), 0, failOutput);
} else {
assert.eq(failOutput.search(/"id":6840101/), -1, failOutput);
}
}
MongoRunner.stopMongod(conn);
sleep(1000);
mock_ocsp.stop();
};
runTest({connectionHealthLoggingOn: true});
runTest({connectionHealthLoggingOn: false});
runTest({ocspFaultType: FAULT_REVOKED, connectionHealthLoggingOn: true});
}());
|
