1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
|
load('jstests/multiVersion/libs/multi_rs.js');
//=== Shared SSL testing library functions and constants ===
var KEYFILE = "jstests/libs/key1";
var SERVER_CERT = "jstests/libs/server.pem";
var CA_CERT = "jstests/libs/ca.pem";
var CLIENT_CERT = "jstests/libs/client.pem";
// Note: "sslAllowInvalidCertificates" is enabled to avoid
// hostname conflicts with our testing certificates
var disabled = {sslMode: "disabled"};
var allowSSL = {
sslMode: "allowSSL",
sslAllowInvalidCertificates: "",
sslPEMKeyFile: SERVER_CERT,
sslCAFile: CA_CERT
};
var preferSSL = {
sslMode: "preferSSL",
sslAllowInvalidCertificates: "",
sslPEMKeyFile: SERVER_CERT,
sslCAFile: CA_CERT
};
var requireSSL = {
sslMode: "requireSSL",
sslAllowInvalidCertificates: "",
sslPEMKeyFile: SERVER_CERT,
sslCAFile: CA_CERT
};
// Test if ssl replset configs work
var replSetTestFile = "jstests/replsets/replset1.js";
var replShouldSucceed = function(name, opt1, opt2) {
ssl_options1 = opt1;
ssl_options2 = opt2;
ssl_name = name;
// try running this file using the given config
load(replSetTestFile);
};
// Test if ssl replset configs fail
var replShouldFail = function(name, opt1, opt2) {
ssl_options1 = opt1;
ssl_options2 = opt2;
ssl_name = name;
replTest = null;
assert.throws(load, [replSetTestFile], "This setup should have failed");
// clean up to continue running...
if (replTest) {
replTest.stopSet(15);
}
};
/**
* Test that $lookup works with a sharded source collection. This is tested because of
* the connections opened between mongos/shards and between the shards themselves.
*/
function testShardedLookup(shardingTest) {
var st = shardingTest;
assert(st.adminCommand({enableSharding: "lookupTest"}),
"error enabling sharding for this configuration");
assert(st.adminCommand({shardCollection: "lookupTest.foo", key: {_id: "hashed"}}),
"error sharding collection for this configuration");
var lookupdb = st.getDB("lookupTest");
// insert a few docs to ensure there are documents on multiple shards.
var fooBulk = lookupdb.foo.initializeUnorderedBulkOp();
var barBulk = lookupdb.bar.initializeUnorderedBulkOp();
var lookupShouldReturn = [];
for (var i = 0; i < 64; i++) {
fooBulk.insert({_id: i});
barBulk.insert({_id: i});
lookupShouldReturn.push({_id: i, bar_docs: [{_id: i}]});
}
assert.writeOK(fooBulk.execute());
assert.writeOK(barBulk.execute());
var docs =
lookupdb.foo
.aggregate([
{$sort: {_id: 1}},
{$lookup: {from: "bar", localField: "_id", foreignField: "_id", as: "bar_docs"}}
])
.toArray();
assert.eq(lookupShouldReturn, docs, "error $lookup failed in this configuration");
assert.commandWorked(lookupdb.dropDatabase());
}
/**
* Takes in two mongod/mongos configuration options and runs a basic
* sharding test to see if they can work together...
*/
function mixedShardTest(options1, options2, shouldSucceed) {
try {
// Start ShardingTest with enableBalancer because ShardingTest attempts to turn
// off the balancer otherwise, which it will not be authorized to do if auth is enabled.
// Once SERVER-14017 is fixed the "enableBalancer" line can be removed.
var st = new ShardingTest({
mongos: [options1],
config: [options1],
shards: [options1, options2],
other: {enableBalancer: true}
});
// Create admin user in case the options include auth
st.admin.createUser({user: 'admin', pwd: 'pwd', roles: ['root']});
st.admin.auth('admin', 'pwd');
st.stopBalancer();
// Test that $lookup works because it causes outgoing connections to be opened
testShardedLookup(st);
// Test mongos talking to config servers
var r = st.adminCommand({enableSharding: "test"});
assert.eq(r, true, "error enabling sharding for this configuration");
st.ensurePrimaryShard("test", "shard0000");
r = st.adminCommand({movePrimary: 'test', to: 'shard0001'});
assert.eq(r, true, "error movePrimary failed for this configuration");
var db1 = st.getDB("test");
r = st.adminCommand({shardCollection: "test.col", key: {_id: 1}});
assert.eq(r, true, "error sharding collection for this configuration");
// Test mongos talking to shards
var bigstr = Array(1024 * 1024).join("#");
var bulk = db1.col.initializeUnorderedBulkOp();
for (var i = 0; i < 128; i++) {
bulk.insert({_id: i, string: bigstr});
}
assert.writeOK(bulk.execute());
assert.eq(128, db1.col.count(), "error retrieving documents from cluster");
// Test shards talking to each other
r = st.getDB('test').adminCommand({moveChunk: 'test.col', find: {_id: 0}, to: 'shard0000'});
assert(r.ok, "error moving chunks: " + tojson(r));
db1.col.remove({});
} catch (e) {
if (shouldSucceed)
throw e;
// silence error if we should fail...
print("IMPORTANT! => Test failed when it should have failed...continuing...");
} finally {
// This has to be done in order for failure
// to not prevent future tests from running...
if (st) {
st.stop();
}
}
}
function detectDefaultTLSProtocol() {
const conn = MongoRunner.runMongod({
sslMode: 'allowSSL',
sslPEMKeyFile: SERVER_CERT,
sslDisabledProtocols: 'none',
useLogFiles: true,
tlsLogVersions: "TLS1_0,TLS1_1,TLS1_2,TLS1_3",
});
const res = conn.getDB("admin").serverStatus().transportSecurity;
MongoRunner.stopMongod(conn);
// Verify that the default protocol is either TLS1.2 or TLS1.3.
// No supported platform should default to an older protocol version.
assert.eq(0, res["1.0"]);
assert.eq(0, res["1.1"]);
assert.eq(0, res["unknown"]);
assert.neq(res["1.2"], res["1.3"]);
if (res["1.2"].tojson() != NumberLong(0).tojson()) {
return "TLS1_2";
} else {
return "TLS1_3";
}
}
|
