Update upstream source from tag 'upstream/6.0.0'master

Update to upstream version '6.0.0'
with Debian dir 5604a80ec1c96ca76f25f40d78e6ef855abec322

1 files changed, 14 insertions, 16 deletions

diff --git a/src/mongo/util/net/ssl_manager_windows.cpp b/src/mongo/util/net/ssl_manager_windows.cpp
index 7169e1eef1f..adf86ae847f 100644
--- a/src/mongo/util/net/ssl_manager_windows.cpp
+++ b/src/mongo/util/net/ssl_manager_windows.cpp
@@ -1284,9 +1284,11 @@ Status SSLManagerWindows::_loadCertificates(const SSLParams& params) {
         _clientCertificates[0] = std::get<0>(_clusterPEMCertificate).get();
     }
 
-    // If the user has specified --setParameter tlsUseSystemCA=true, then no params.sslCAFile nor
-    // params.sslClusterCAFile will be defined, and the SSL Manager will fall back to the System CA.
     if (!params.sslCAFile.empty()) {
+        // SChannel always has a CA even when the user does not specify one
+        // The openssl implementations uses this to decide if it wants to do certificate validation
+        // on the server side.
+        _sslConfiguration.hasCA = true;
 
         auto swChain = readCertChains(params.sslCAFile, params.sslCRLFile);
         if (!swChain.isOK()) {
@@ -1349,8 +1351,10 @@ Status SSLManagerWindows::_loadCertificates(const SSLParams& params) {
         if (!params.sslCAFile.empty()) {
             LOGV2_WARNING(23271,
                           "Mixing certs from the system certificate store and PEM files. This may "
-                          "produce unexpected results.");
+                          "produced unexpected results.");
         }
+
+        _sslConfiguration.hasCA = true;
     }
 
     if (_sslCertificate) {
@@ -2003,6 +2007,9 @@ Future<SSLPeerInfo> SSLManagerWindows::parseAndValidatePeerCertificate(
 
     recordTLSVersion(tlsVersionStatus.getValue(), hostForLogging);
 
+    if (!_sslConfiguration.hasCA && isSSLServer)
+        return Future<SSLPeerInfo>::makeReady(SSLPeerInfo(sni));
+
     SECURITY_STATUS ss = QueryContextAttributes(ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert);
 
     if (ss == SEC_E_NO_CREDENTIALS) {  // no certificate presented by peer
@@ -2062,19 +2069,10 @@ Future<SSLPeerInfo> SSLManagerWindows::parseAndValidatePeerCertificate(
         return Future<SSLPeerInfo>::makeReady(SSLPeerInfo(sni));
     }
 
-    SecPkgContext_CipherInfo cipherInfo;
-    SECURITY_STATUS ssCipher = QueryContextAttributes(ssl, SECPKG_ATTR_CIPHER_INFO, &cipherInfo);
-    if (ssCipher != SEC_E_OK) {
-        return Status(ErrorCodes::SSLHandshakeFailed,
-                      str::stream()
-                          << "QueryContextAttributes for connection info failed with" << ssCipher);
-    }
-    const auto cipher = std::wstring(cipherInfo.szCipherSuite);
-
-    LOGV2_INFO(6723802,
-               "Accepted TLS connection from peer",
-               "peerSubjectName"_attr = peerSubjectName,
-               "cipher"_attr = toUtf8String(cipher));
+    LOGV2_DEBUG(23270,
+                2,
+                "Accepted TLS connection from peer: {peerSubjectName}",
+                "peerSubjectName"_attr = peerSubjectName);
 
     // If this is a server and client and server certificate are the same, log a warning.
     if (remoteHost.empty() && _sslConfiguration.serverSubjectName() == peerSubjectName) {