summaryrefslogtreecommitdiff
path: root/jstests/ssl/peer_validation_without_cafile.js
diff options
context:
space:
mode:
Diffstat (limited to 'jstests/ssl/peer_validation_without_cafile.js')
-rw-r--r--jstests/ssl/peer_validation_without_cafile.js86
1 files changed, 0 insertions, 86 deletions
diff --git a/jstests/ssl/peer_validation_without_cafile.js b/jstests/ssl/peer_validation_without_cafile.js
deleted file mode 100644
index 9f1ed043525..00000000000
--- a/jstests/ssl/peer_validation_without_cafile.js
+++ /dev/null
@@ -1,86 +0,0 @@
-(function() {
-"use strict";
-
-if (getBuildInfo().buildEnvironment.target_os != "linux") {
- // these tests are specifically for linux
- return;
-}
-
-function testRS(opts, succeed) {
- const origSkipCheck = TestData.skipCheckDBHashes;
- const rsOpts = {
- // Use localhost so that SAN matches.
- useHostName: false,
- nodes: {node0: opts, node1: opts},
- };
- const rs = new ReplSetTest(rsOpts);
- rs.startSet({
- env: {
- SSL_CERT_FILE: 'jstests/libs/ca.pem',
- },
- });
- if (succeed) {
- rs.initiate();
- assert.commandWorked(rs.getPrimary().getDB('admin').runCommand({hello: 1}));
- } else {
- // By default, rs.initiate takes a very long time to timeout. We should shorten this
- // period, because we expect it to fail. ReplSetTest has both a static and local copy
- // of kDefaultTimeOutMS, so we must override both.
- const oldTimeout = ReplSetTest.kDefaultTimeoutMS;
- const shortTimeout = 2 * 60 * 1000;
- ReplSetTest.kDefaultTimeoutMS = shortTimeout;
- rs.kDefaultTimeoutMS = shortTimeout;
- // The rs.initiate will fail in an assert.soon, which would ordinarily trigger the hang
- // analyzer. We don't want that to happen, so we disable it here.
- MongoRunner.runHangAnalyzer.disable();
- try {
- assert.throws(function() {
- rs.initiate();
- });
- } finally {
- ReplSetTest.kDefaultTimeoutMS = oldTimeout;
- MongoRunner.runHangAnalyzer.enable();
- }
- TestData.skipCheckDBHashes = true;
- }
- rs.stopSet();
- TestData.skipCheckDBHashes = origSkipCheck;
-}
-
-// ca.pem signed client.pem and server.pem
-// trusted-ca.pem signed trusted-client.pem and trusted-server.pem
-
-// Sanity check that ca.pem can be used to properly authenticate.
-const options_manual_systemca = {
- tlsMode: 'requireTLS',
- tlsCAFile: 'jstests/libs/ca.pem',
- tlsCertificateKeyFile: 'jstests/libs/server.pem',
-
-};
-testRS(options_manual_systemca, true);
-
-// Ensure that we can authenticate with system CA.
-const options_systemca = {
- tlsMode: 'requireTLS',
- tlsCertificateKeyFile: 'jstests/libs/server.pem',
- setParameter: {tlsUseSystemCA: true},
-};
-testRS(options_systemca, true);
-
-// Sanity check that ca.pem can be used to properly fail to authenticate.
-const options_manual_systemca_nomatch = {
- tlsMode: 'requireTLS',
- tlsCAFile: 'jstests/libs/ca.pem',
- tlsCertificateKeyFile: 'jstests/libs/trusted-server.pem',
-};
-testRS(options_manual_systemca_nomatch, false);
-
-// Ensure that we can properly fail to authenticate with system CA.
-const options_systemca_nomatch = {
- tlsMode: 'requireTLS',
- tlsCertificateKeyFile: 'jstests/libs/trusted-server.pem',
- setParameter: {tlsUseSystemCA: true},
-};
-
-testRS(options_systemca_nomatch, false);
-}());