New upstream version 6.0.20upstream

5 files changed, 57 insertions, 0 deletions

diff --git a/jstests/ssl_linear/mongo_uri_secondaries.js b/jstests/ssl_linear/mongo_uri_secondaries.js
index 374693d4667..37e42332eaf 100644
--- a/jstests/ssl_linear/mongo_uri_secondaries.js
+++ b/jstests/ssl_linear/mongo_uri_secondaries.js
@@ -5,8 +5,12 @@
 // To install trusted-ca.pem for local testing on OSX, invoke the following at a console:
 //   security add-trusted-cert -d jstests/libs/trusted-ca.pem
 
+load('jstests/libs/python.js');
+
 const HOST_TYPE = getBuildInfo().buildEnvironment.target_os;
 if (HOST_TYPE == "windows") {
+    assert.eq(0, runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
+
     // OpenSSL backed imports Root CA and intermediate CA
     runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
 
diff --git a/jstests/ssl_linear/repl_ssl_noca.js b/jstests/ssl_linear/repl_ssl_noca.js
index 93b0e24a39f..700023a3f58 100644
--- a/jstests/ssl_linear/repl_ssl_noca.js
+++ b/jstests/ssl_linear/repl_ssl_noca.js
@@ -7,7 +7,11 @@
 // TODO BUILD-17503 Remove this tag
 // @tags: [incompatible_with_macos]
 
+load('jstests/libs/python.js');
+
 if (_isWindows()) {
+    assert.eq(0, runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
+
     // OpenSSL backed imports Root CA and intermediate CA
     runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\ca.pem");
 
diff --git a/jstests/ssl_linear/ssl_cert_selector.js b/jstests/ssl_linear/ssl_cert_selector.js
index 2579273b5b1..d52e5d1d5fb 100644
--- a/jstests/ssl_linear/ssl_cert_selector.js
+++ b/jstests/ssl_linear/ssl_cert_selector.js
@@ -3,12 +3,16 @@
  * server.
  */
 
+load('jstests/libs/python.js');
 load('jstests/ssl/libs/ssl_helpers.js');
 
 requireSSLProvider('windows', function() {
     'use strict';
 
     if (_isWindows()) {
+        assert.eq(0,
+                  runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
+
         // SChannel backed follows Windows rules and only trusts Root in LocalMachine
         runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\ca.pem");
         // Import a pfx file since it contains both a cert and private key and is easy to import
diff --git a/jstests/ssl_linear/ssl_with_system_ca.js b/jstests/ssl_linear/ssl_with_system_ca.js
index a9eef168978..5a4e0334699 100644
--- a/jstests/ssl_linear/ssl_with_system_ca.js
+++ b/jstests/ssl_linear/ssl_with_system_ca.js
@@ -7,10 +7,14 @@
 (function() {
 'use strict';
 
+load('jstests/libs/python.js');
+
 const HOST_TYPE = getBuildInfo().buildEnvironment.target_os;
 jsTest.log("HOST_TYPE = " + HOST_TYPE);
 
 if (HOST_TYPE == "windows") {
+    assert.eq(0, runProgram(getPython3Binary(), "jstests/ssl_linear/windows_castore_cleanup.py"));
+
     // OpenSSL backed imports Root CA and intermediate CA
     runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
 
diff --git a/jstests/ssl_linear/windows_castore_cleanup.py b/jstests/ssl_linear/windows_castore_cleanup.py
new file mode 100644
index 00000000000..ff9de13219c
--- /dev/null
+++ b/jstests/ssl_linear/windows_castore_cleanup.py
@@ -0,0 +1,41 @@
+import subprocess
+import sys
+import re
+
+def findMongoCertsFromStore(store):
+    command = ["certutil", "-store", store]
+    subject_pattern = re.compile(r"Subject:.*O=MongoDB")
+    cn_pattern = re.compile(r"CN=([^,]+)")
+    cns = []
+
+    try:
+        output = subprocess.check_output(command, shell=True).decode("utf-8")
+    except subprocess.CalledProcessError as e:
+        print(f"Command {command} failed with error: {e}", file=sys.stderr)
+        sys.exit(1)
+
+    filtered = [s for s in output.splitlines() if re.match(subject_pattern, s)]
+    for line in filtered:
+        cn_match = re.search(cn_pattern, line)
+        if cn_match:
+            cns.append(cn_match.group(1))
+    return cns
+
+def deleteCertsByCNFromStore(store, cns):
+    command = ["certutil", "-delstore", "-f", store, "cn"]
+    for cn in cns:
+        command[4] = cn
+        try:
+            print(f"Deleting 'CN={cn}' from the '{store}' certificate store:\n\t{' ' .join(command)}")
+            subprocess.check_call(command, shell=True)
+        except subprocess.CalledProcessError as e:
+            print(f"Command {command} failed with error: {e}", file=sys.stderr)
+            sys.exit(1)
+
+my_cns = findMongoCertsFromStore("My")
+root_cns = findMongoCertsFromStore("Root")
+
+if my_cns + root_cns:
+    print(f"Unexpected MongoDB certs found on host. Clearing them from the system cert stores.")
+deleteCertsByCNFromStore("My", my_cns)
+deleteCertsByCNFromStore("Root", root_cns)
\ No newline at end of file