diff options
Diffstat (limited to 'src/mongo/util/net/ssl_manager_apple.cpp')
| -rw-r--r-- | src/mongo/util/net/ssl_manager_apple.cpp | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/src/mongo/util/net/ssl_manager_apple.cpp b/src/mongo/util/net/ssl_manager_apple.cpp index ec77dc17722..014b8b6ab0a 100644 --- a/src/mongo/util/net/ssl_manager_apple.cpp +++ b/src/mongo/util/net/ssl_manager_apple.cpp @@ -1391,6 +1391,7 @@ SSLManagerApple::SSLManagerApple(const SSLParams& params, bool isServer) if (!params.sslClusterCAFile.empty()) { auto ca = uassertStatusOK(loadPEM(params.sslClusterCAFile, "", kLoadPEMStripKeys)); _serverCA = std::move(ca); + _sslConfiguration.hasCA = true; } else { // No inbound CA specified, share a reference with outbound CA. auto ca = _clientCA.get(); @@ -1592,7 +1593,7 @@ Future<SSLPeerInfo> SSLManagerApple::parseAndValidatePeerCertificate( return SSLPeerInfo(sniName); } else { if (status == ::errSecSuccess) { - return badCert(str::stream() << "no SSL certificate provided by peer: " + return badCert(str::stream() << "No SSL certificate provided by peer: " << stringFromOSStatus(status), _weakValidation); } else { @@ -1887,8 +1888,26 @@ MONGO_INITIALIZER_WITH_PREREQUISITES(SSLManager, ("EndStartupOptionHandling")) kMongoDBRolesOID = ::CFStringCreateWithCString( nullptr, mongodbRolesOID.identifier.c_str(), ::kCFStringEncodingUTF8); + // TODO SERVER-67419 This retry logic is a workaround; reconsider this approach after + // investigation. + constexpr int kMaxRetries = 10; if (!isSSLServer || (sslGlobalParams.sslMode.load() != SSLParams::SSLMode_disabled)) { - theSSLManagerCoordinator = new SSLManagerCoordinator(); + for (int i = 0; i < kMaxRetries; i++) { + try { + theSSLManagerCoordinator = new SSLManagerCoordinator(); + return; + } catch (const ExceptionFor<ErrorCodes::InvalidSSLConfiguration>& e) { + bool isRetriableError = nullptr != strstr(e.what(), "No keychain is available."); + if (!isRetriableError || i == kMaxRetries - 1) { + // Rethrow if a different error or we fail on final iteration + throw; + } + LOGV2_INFO(6741800, + "Caught exception during apple SSLManagerCoordinator creation, retrying", + "try"_attr = i, + "error"_attr = e.what()); + } + } } } |