diff options
Diffstat (limited to 'src/mongo/util/net/ssl_manager_windows.cpp')
| -rw-r--r-- | src/mongo/util/net/ssl_manager_windows.cpp | 30 |
1 files changed, 14 insertions, 16 deletions
diff --git a/src/mongo/util/net/ssl_manager_windows.cpp b/src/mongo/util/net/ssl_manager_windows.cpp index 7169e1eef1f..adf86ae847f 100644 --- a/src/mongo/util/net/ssl_manager_windows.cpp +++ b/src/mongo/util/net/ssl_manager_windows.cpp @@ -1284,9 +1284,11 @@ Status SSLManagerWindows::_loadCertificates(const SSLParams& params) { _clientCertificates[0] = std::get<0>(_clusterPEMCertificate).get(); } - // If the user has specified --setParameter tlsUseSystemCA=true, then no params.sslCAFile nor - // params.sslClusterCAFile will be defined, and the SSL Manager will fall back to the System CA. if (!params.sslCAFile.empty()) { + // SChannel always has a CA even when the user does not specify one + // The openssl implementations uses this to decide if it wants to do certificate validation + // on the server side. + _sslConfiguration.hasCA = true; auto swChain = readCertChains(params.sslCAFile, params.sslCRLFile); if (!swChain.isOK()) { @@ -1349,8 +1351,10 @@ Status SSLManagerWindows::_loadCertificates(const SSLParams& params) { if (!params.sslCAFile.empty()) { LOGV2_WARNING(23271, "Mixing certs from the system certificate store and PEM files. This may " - "produce unexpected results."); + "produced unexpected results."); } + + _sslConfiguration.hasCA = true; } if (_sslCertificate) { @@ -2003,6 +2007,9 @@ Future<SSLPeerInfo> SSLManagerWindows::parseAndValidatePeerCertificate( recordTLSVersion(tlsVersionStatus.getValue(), hostForLogging); + if (!_sslConfiguration.hasCA && isSSLServer) + return Future<SSLPeerInfo>::makeReady(SSLPeerInfo(sni)); + SECURITY_STATUS ss = QueryContextAttributes(ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert); if (ss == SEC_E_NO_CREDENTIALS) { // no certificate presented by peer @@ -2062,19 +2069,10 @@ Future<SSLPeerInfo> SSLManagerWindows::parseAndValidatePeerCertificate( return Future<SSLPeerInfo>::makeReady(SSLPeerInfo(sni)); } - SecPkgContext_CipherInfo cipherInfo; - SECURITY_STATUS ssCipher = QueryContextAttributes(ssl, SECPKG_ATTR_CIPHER_INFO, &cipherInfo); - if (ssCipher != SEC_E_OK) { - return Status(ErrorCodes::SSLHandshakeFailed, - str::stream() - << "QueryContextAttributes for connection info failed with" << ssCipher); - } - const auto cipher = std::wstring(cipherInfo.szCipherSuite); - - LOGV2_INFO(6723802, - "Accepted TLS connection from peer", - "peerSubjectName"_attr = peerSubjectName, - "cipher"_attr = toUtf8String(cipher)); + LOGV2_DEBUG(23270, + 2, + "Accepted TLS connection from peer: {peerSubjectName}", + "peerSubjectName"_attr = peerSubjectName); // If this is a server and client and server certificate are the same, log a warning. if (remoteHost.empty() && _sslConfiguration.serverSubjectName() == peerSubjectName) { |