Update upstream source from tag 'upstream/6.0.0'master

Update to upstream version '6.0.0'
with Debian dir 5604a80ec1c96ca76f25f40d78e6ef855abec322

5 files changed, 0 insertions, 362 deletions

diff --git a/jstests/ssl_linear/mongo_uri_secondaries.js b/jstests/ssl_linear/mongo_uri_secondaries.js
deleted file mode 100644
index 37e42332eaf..00000000000
--- a/jstests/ssl_linear/mongo_uri_secondaries.js
+++ /dev/null
@@ -1,86 +0,0 @@
-// On OSX this test assumes that jstests/libs/trusted-ca.pem has been added as a trusted
-// certificate to the login keychain of the evergreen user. See,
-// https://github.com/10gen/buildslave-cookbooks/commit/af7cabe5b6e0885902ebd4902f7f974b64cc8961
-// for details.
-// To install trusted-ca.pem for local testing on OSX, invoke the following at a console:
-//   security add-trusted-cert -d jstests/libs/trusted-ca.pem
-
-load('jstests/libs/python.js');
-
-const HOST_TYPE = getBuildInfo().buildEnvironment.target_os;
-if (HOST_TYPE == "windows") {
-    assert.eq(0, runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
-
-    // OpenSSL backed imports Root CA and intermediate CA
-    runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
-
-    // SChannel backed follows Windows rules and only trusts the Root store in Local Machine and
-    // Current User.
-    runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\trusted-ca.pem");
-}
-try {
-    const x509Options = {
-        sslMode: 'requireSSL',
-        sslPEMKeyFile: 'jstests/libs/trusted-server.pem',
-        sslCAFile: 'jstests/libs/trusted-ca.pem',
-        sslAllowInvalidCertificates: '',
-        sslWeakCertificateValidation: '',
-    };
-
-    const rst = new ReplSetTest({
-        nodes: 2,
-        name: "sslSet",
-        useHostName: false,
-        nodeOptions: x509Options,
-        waitForKeys: false
-    });
-    rst.startSet();
-    rst.initiate();
-
-    const subShellCommand = function(hosts) {
-        var Ms = [];
-        for (var i = 0; i < 10; i++) {
-            Ms.push(new Mongo("mongodb://" + hosts[0] + "," + hosts[1] +
-                              "/?ssl=true&replicaSet=sslSet"));
-        }
-
-        for (var i = 0; i < 10; i++) {
-            var db = Ms[i].getDB("test");
-            db.setSecondaryOk();
-            db.col.find().readPref("secondary").toArray();
-        }
-    };
-
-    const subShellCommandFormatter = function(replSet) {
-        var hosts = [];
-        replSet.nodes.forEach((node) => {
-            hosts.push("localhost:" + node.port);
-        });
-        let command = `
-                (function () {
-                    'use strict';
-                    let command = ${subShellCommand.toString()};
-                    let hosts = ${tojson(hosts)};
-                    command(hosts);
-                }());`;
-        return command;
-    };
-
-    function runWithEnv(args, env) {
-        const pid = _startMongoProgram({args: args, env: env});
-        return waitProgram(pid);
-    }
-
-    const subShellArgs = ['mongo', '--nodb', '--eval', subShellCommandFormatter(rst)];
-
-    const retVal = runWithEnv(subShellArgs, {"SSL_CERT_FILE": "jstests/libs/trusted-ca.pem"});
-    assert.eq(retVal, 0, 'mongo shell did not succeed with exit code 0');
-
-    rst.stopSet();
-} finally {
-    if (HOST_TYPE == "windows") {
-        const trusted_ca_thumbprint = cat('jstests/libs/ca.pem.digest.sha1');
-        runProgram("certutil.exe", "-delstore", "-f", "Root", trusted_ca_thumbprint);
-        runProgram("certutil.exe", "-delstore", "-user", "-f", "CA", trusted_ca_thumbprint);
-    }
-}
diff --git a/jstests/ssl_linear/repl_ssl_noca.js b/jstests/ssl_linear/repl_ssl_noca.js
deleted file mode 100644
index 700023a3f58..00000000000
--- a/jstests/ssl_linear/repl_ssl_noca.js
+++ /dev/null
@@ -1,83 +0,0 @@
-// On OSX this test assumes that jstests/libs/trusted-ca.pem has been added as a trusted
-// certificate to the login keychain of the evergreen user. See,
-// https://github.com/10gen/buildslave-cookbooks/commit/af7cabe5b6e0885902ebd4902f7f974b64cc8961
-// for details.
-// To install trusted-ca.pem for local testing on OSX, invoke the following at a console:
-//   security add-trusted-cert -d jstests/libs/trusted-ca.pem
-// TODO BUILD-17503 Remove this tag
-// @tags: [incompatible_with_macos]
-
-load('jstests/libs/python.js');
-
-if (_isWindows()) {
-    assert.eq(0, runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
-
-    // OpenSSL backed imports Root CA and intermediate CA
-    runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\ca.pem");
-
-    // SChannel backed follows Windows rules and only trusts the Root store in Local Machine and
-    // Current User.
-    runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\ca.pem");
-}
-
-try {
-    var replTest = new ReplSetTest({
-        name: "ssltest",
-        nodes: 1,
-        nodeOptions: {
-            sslMode: "requireSSL",
-            sslPEMKeyFile: "jstests/libs/server.pem",
-            setParameter: {tlsUseSystemCA: true},
-        },
-        host: "localhost",
-        useHostName: false,
-    });
-
-    replTest.startSet({
-        env: {
-            SSL_CERT_FILE: 'jstests/libs/ca.pem',
-        },
-    });
-
-    replTest.initiate();
-
-    var nodeList = replTest.nodeList().join();
-
-    var checkShell = function(url) {
-        // Should not be able to authenticate with x509.
-        // Authenticate call will return 1 on success, 0 on error.
-        var argv = ['mongo', url, '--eval', ('db.runCommand({replSetGetStatus: 1})')];
-
-        if (url.endsWith('&ssl=true')) {
-            argv.push('--tls', '--tlsCertificateKeyFile', 'jstests/libs/client.pem');
-        }
-
-        if (!_isWindows()) {
-            // On Linux we override the default path to the system CA store to point to our
-            // system CA. On Windows, this CA will have been added to the user's trusted CA list
-            argv.unshift("env", "SSL_CERT_FILE=jstests/libs/ca.pem");
-        }
-        var ret = runMongoProgram(...argv);
-        return ret;
-    };
-
-    jsTest.log("Testing with no ssl specification...");
-    var noMentionSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}`;
-    assert.neq(checkShell(noMentionSSLURL), 0, "shell correctly failed to connect without SSL");
-
-    jsTest.log("Testing with ssl specified false...");
-    var disableSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}&ssl=false`;
-    assert.neq(checkShell(disableSSLURL), 0, "shell correctly failed to connect without SSL");
-
-    jsTest.log("Testing with ssl specified true...");
-    var useSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}&ssl=true`;
-    assert.eq(checkShell(useSSLURL), 0, "successfully connected with SSL");
-
-    replTest.stopSet();
-} finally {
-    if (_isWindows()) {
-        const ca_thumbprint = cat('jstests/libs/ca.pem.digest.sha1');
-        runProgram("certutil.exe", "-delstore", "-f", "Root", ca_thumbprint);
-        runProgram("certutil.exe", "-delstore", "-user", "-f", "CA", ca_thumbprint);
-    }
-}
diff --git a/jstests/ssl_linear/ssl_cert_selector.js b/jstests/ssl_linear/ssl_cert_selector.js
deleted file mode 100644
index d52e5d1d5fb..00000000000
--- a/jstests/ssl_linear/ssl_cert_selector.js
+++ /dev/null
@@ -1,71 +0,0 @@
-/**
- * Validate that the shell can load certificates from the certificate store and connect to the
- * server.
- */
-
-load('jstests/libs/python.js');
-load('jstests/ssl/libs/ssl_helpers.js');
-
-requireSSLProvider('windows', function() {
-    'use strict';
-
-    if (_isWindows()) {
-        assert.eq(0,
-                  runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
-
-        // SChannel backed follows Windows rules and only trusts Root in LocalMachine
-        runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\ca.pem");
-        // Import a pfx file since it contains both a cert and private key and is easy to import
-        // via command line.
-        runProgram("certutil.exe",
-                   "-importpfx",
-                   "-f",
-                   "-p",
-                   "qwerty",
-                   "jstests\\libs\\trusted-client.pfx");
-    }
-
-    try {
-        const conn = MongoRunner.runMongod({
-            sslMode: 'requireSSL',
-            sslPEMKeyFile: "jstests\\libs\\trusted-server.pem",
-            setParameter: {tlsUseSystemCA: true},
-        });
-
-        const testWithCert = function(certSelector) {
-            jsTest.log(`Testing with SSL cert ${certSelector}`);
-            const argv = [
-                'mongo',
-                '--ssl',
-                '--sslCertificateSelector',
-                certSelector,
-                '--port',
-                conn.port,
-                '--eval',
-                'db.runCommand({buildInfo: 1})'
-            ];
-
-            const exitStatus = runMongoProgram.apply(null, argv);
-            assert.eq(exitStatus, 0, "successfully connected with SSL");
-        };
-
-        const trusted_client_thumbprint = cat('jstests/libs/trusted-client.pem.digest.sha1');
-
-        assert.doesNotThrow(function() {
-            testWithCert("thumbprint=" + trusted_client_thumbprint);
-        });
-
-        assert.doesNotThrow(function() {
-            testWithCert("subject=Trusted Kernel Test Client");
-        });
-
-        MongoRunner.stopMongod(conn);
-    } finally {
-        if (_isWindows()) {
-            const trusted_ca_thumbprint = cat('jstests/libs/trusted-ca.pem.digest.sha1');
-            runProgram("certutil.exe", "-delstore", "-f", "Root", trusted_ca_thumbprint);
-            const ca_thumbprint = cat('jstests/libs/ca.pem.digest.sha1');
-            runProgram("certutil.exe", "-delstore", "-f", "Root", ca_thumbprint);
-        }
-    }
-});
diff --git a/jstests/ssl_linear/ssl_with_system_ca.js b/jstests/ssl_linear/ssl_with_system_ca.js
deleted file mode 100644
index 5a4e0334699..00000000000
--- a/jstests/ssl_linear/ssl_with_system_ca.js
+++ /dev/null
@@ -1,81 +0,0 @@
-// On OSX this test assumes that jstests/libs/trusted-ca.pem has been added as a trusted
-// certificate to the login keychain of the evergreen user. See,
-// https://github.com/10gen/buildslave-cookbooks/commit/af7cabe5b6e0885902ebd4902f7f974b64cc8961
-// for details.
-// To install trusted-ca.pem for local testing on OSX, invoke the following at a console:
-//   security add-trusted-cert -d jstests/libs/trusted-ca.pem
-(function() {
-'use strict';
-
-load('jstests/libs/python.js');
-
-const HOST_TYPE = getBuildInfo().buildEnvironment.target_os;
-jsTest.log("HOST_TYPE = " + HOST_TYPE);
-
-if (HOST_TYPE == "windows") {
-    assert.eq(0, runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
-
-    // OpenSSL backed imports Root CA and intermediate CA
-    runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
-
-    // SChannel backed follows Windows rules and only trusts the Root store in Local Machine and
-    // Current User.
-    runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\trusted-ca.pem");
-}
-function testWithCerts(prefix) {
-    jsTest.log("Starting mongod blindly...");
-    // allowTLS to get a non-TLS control connection.
-    var opts = {
-        tlsMode: 'preferTLS',
-        tlsCertificateKeyFile: 'jstests/libs/' + prefix + 'server.pem',
-        waitForConnect: false,
-        setParameter: {tlsUseSystemCA: true},
-        env: {"SSL_CERT_FILE": "jstests/libs/" + prefix + "ca.pem"},
-    };
-    const conn = MongoRunner.runMongod(opts);
-
-    jsTest.log("Waiting for mongod to be non-TLS connectable...");
-    let argv = ['mongo', '--port', conn.port, '--eval', ';'];
-
-    assert.soon((exitCode) => {
-        exitCode = runMongoProgram.apply(null, argv);
-        return 0 == exitCode;
-    });
-
-    jsTest.log("Testing connection with " + prefix + "client.pem ...");
-    argv = [
-        'mongo',
-        '--tls',
-        '--port',
-        conn.port,
-        '--tlsCertificateKeyFile',
-        'jstests/libs/' + prefix + 'client.pem',
-        '--eval',
-        ';'
-    ];
-
-    if (HOST_TYPE == "linux") {
-        // On Linux we override the default path to the system CA store to point to our
-        // "trusted" CA. On Windows, this CA will have been added to the user's trusted CA list
-        argv.unshift("env", "SSL_CERT_FILE=jstests/libs/trusted-ca.pem");
-    }
-
-    let exitCode = runMongoProgram.apply(null, argv);
-
-    jsTest.log("Stopping mongod...");
-    MongoRunner.stopMongod(conn);
-
-    return exitCode;
-}
-
-try {
-    assert.neq(0, testWithCerts(''), 'Certs signed with untrusted CA');
-    assert.eq(0, testWithCerts('trusted-'), 'Certs signed with trusted CA');
-} finally {
-    if (HOST_TYPE == "windows") {
-        const trusted_ca_thumbprint = cat('jstests/libs/trusted-ca.pem.digest.sha1');
-        runProgram("certutil.exe", "-delstore", "-f", "Root", trusted_ca_thumbprint);
-        runProgram("certutil.exe", "-delstore", "-user", "-f", "CA", trusted_ca_thumbprint);
-    }
-}
-})();
diff --git a/jstests/ssl_linear/windows_castore_cleanup.py b/jstests/ssl_linear/windows_castore_cleanup.py
deleted file mode 100644
index ff9de13219c..00000000000
--- a/jstests/ssl_linear/windows_castore_cleanup.py
+++ /dev/null
@@ -1,41 +0,0 @@
-import subprocess
-import sys
-import re
-
-def findMongoCertsFromStore(store):
-    command = ["certutil", "-store", store]
-    subject_pattern = re.compile(r"Subject:.*O=MongoDB")
-    cn_pattern = re.compile(r"CN=([^,]+)")
-    cns = []
-
-    try:
-        output = subprocess.check_output(command, shell=True).decode("utf-8")
-    except subprocess.CalledProcessError as e:
-        print(f"Command {command} failed with error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-    filtered = [s for s in output.splitlines() if re.match(subject_pattern, s)]
-    for line in filtered:
-        cn_match = re.search(cn_pattern, line)
-        if cn_match:
-            cns.append(cn_match.group(1))
-    return cns
-
-def deleteCertsByCNFromStore(store, cns):
-    command = ["certutil", "-delstore", "-f", store, "cn"]
-    for cn in cns:
-        command[4] = cn
-        try:
-            print(f"Deleting 'CN={cn}' from the '{store}' certificate store:\n\t{' ' .join(command)}")
-            subprocess.check_call(command, shell=True)
-        except subprocess.CalledProcessError as e:
-            print(f"Command {command} failed with error: {e}", file=sys.stderr)
-            sys.exit(1)
-
-my_cns = findMongoCertsFromStore("My")
-root_cns = findMongoCertsFromStore("Root")
-
-if my_cns + root_cns:
-    print(f"Unexpected MongoDB certs found on host. Clearing them from the system cert stores.")
-deleteCertsByCNFromStore("My", my_cns)
-deleteCertsByCNFromStore("Root", root_cns)
\ No newline at end of file