1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
// Test configuration parameter tlsClusterAuthX509ExtensionValue
// aka: net.tls.clusterAuthX509.extensionValue
// @tags: [ requires_fcv_70 ]
(function() {
'use strict';
load('jstests/ssl/libs/ssl_helpers.js');
if (determineSSLProvider() !== "openssl") {
jsTest.log('Test requires openssl based TLS support');
return;
}
// Fails when used without clusterAuthMode == 'X509'
{
const opts = {auth: '', tlsClusterAuthX509ExtensionValue: 'foo'};
const errmsg =
'net.tls.clusterAuthX509.extensionValue requires a clusterAuthMode which allows for usage of X509';
jsTest.log('No clusterAuthMode set');
clearRawMongoProgramOutput();
assert.throws(() => MongoRunner.runMongod(opts));
assert(rawMongoProgramOutput().includes(errmsg));
jsTest.log('clusterAuthMode == keyFile');
clearRawMongoProgramOutput();
opts.clusterAuthMode = 'keyFile';
assert.throws(() => MongoRunner.runMongod(opts));
assert(rawMongoProgramOutput().includes(errmsg));
}
function authAndDo(port, cert, cmd = ';') {
jsTest.log('Connecting to localhost using cert: ' + cert);
function x509auth(db) {
const ext = db.getSiblingDB('$external');
assert.commandWorked(ext.runCommand({authenticate: 1, mechanism: 'MONGODB-X509'}));
return ext.adminCommand({connectionStatus: 1});
}
clearRawMongoProgramOutput();
const shell = runMongoProgram('mongo',
'--host',
'localhost',
'--port',
port,
'--tls',
'--tlsCAFile',
'jstests/libs/ca.pem',
'--tlsCertificateKeyFile',
cert,
'--eval',
x509auth + ' x509auth(db); ' + cmd);
assert.eq(shell, 0);
}
function runTest(conn) {
const SERVER_RDN = 'CN=server,OU=Kernel,O=MongoDB,L=New York City,ST=New York,C=US';
const SERVER = 'jstests/libs/server.pem';
const FOO_MEMBER = 'jstests/ssl/libs/cluster-member-foo.pem';
const BAR_MEMBER = 'jstests/ssl/libs/cluster-member-bar.pem';
const FOO_MEMBER_ALT = 'jstests/ssl/libs/cluster-member-foo-alt-rdn.pem';
const FOO_MEMBER_ALT_RDN = 'CN=Doer,OU=Business,O=Company,L=Fakesville,ST=Example,C=ZZ';
const admin = conn.getDB('admin');
const ext = conn.getDB('$external');
// Ensure no localhost auth bypass available.
assert.commandWorked(admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['root']}));
assert(admin.auth('admin', 'admin'));
// Connect using server.pem which has the same RDN, but no custom extension.
// This will result in an unknown user condition because we are
// not recognized as a cluster member.
assert.throws(() => authAndDo(conn.port, SERVER));
const insertCmd = 'assert.writeOK(db.getSiblingDB("test").mycoll.insert({x:1}));';
// Connect using same RDN WITH custom extension.
authAndDo(conn.port, FOO_MEMBER, insertCmd);
// Connect using cert with membership extension, but wrong value.
assert.throws(() => authAndDo(conn.port, BAR_MEMBER));
// Connect using cert with right membership, but different RDN (allowed).
authAndDo(conn.port, FOO_MEMBER_ALT, insertCmd);
// Create a user who would have been a cluster member under name based rules.
// We should have basic privs, testing with read but not write.
const readCmd = 'db.getSiblingDB("test").mycoll.find({});';
const readRoles = [{db: 'admin', role: 'readAnyDatabase'}];
assert.commandWorked(ext.runCommand({createUser: SERVER_RDN, roles: readRoles}));
authAndDo(conn.port, SERVER, readCmd);
assert.throws(() => authAndDo(conn.port, SERVER, insertCmd));
// Create a user with FOO_MEMBER_ALT's RDN to validate enforceUserClusterSeparation.
authAndDo(conn.port, FOO_MEMBER_ALT);
assert.commandWorked(ext.runCommand({createUser: FOO_MEMBER_ALT_RDN, roles: readRoles}));
assert.throws(() => authAndDo(conn.port, FOO_MEMBER_ALT));
}
{
const opts = {
auth: '',
tlsMode: 'requireTLS',
tlsCertificateKeyFile: 'jstests/ssl/libs/cluster-member-foo.pem',
tlsCAFile: 'jstests/libs/ca.pem',
clusterAuthMode: 'x509',
tlsClusterAuthX509ExtensionValue: 'foo',
setParameter: {
enforceUserClusterSeparation: 'true',
},
};
const mongod = MongoRunner.runMongod(opts);
runTest(mongod);
MongoRunner.stopMongod(mongod);
}
})();
|
