Skip to content

Commit 5e3b2ed

Browse files
christkvchristkv
committed
NODE-951 Added support for sslCRL option and added a test case for it
1 parent a7fb4ea commit 5e3b2ed

File tree

7 files changed

+66
-5
lines changed

7 files changed

+66
-5
lines changed

‎docs/reference/content/tutorials/connect/ssl.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ The following TLS/SSL options are available.
142142
| `ssl` | {Boolean, default: false} | Use ssl connection |
143143
| `sslValidate` | {Boolean, default: true} | Validate server certificate against certificate authority. |
144144
| `sslCA` | {Buffer[]\|string[], default: null} | Array of valid certificates for Certificate Authority either as Buffers or Strings. |
145+
| `sslCRL` | {Buffer[]\|string[], default: null} | Array of revocation certificates as Buffers or Strings. |
145146
| `sslCert` | {Buffer\|string, default: null} | String or buffer containing the client certificate. |
146147
| `sslPass` | {Buffer\|string, default: null} | String or buffer containing the client certificate password. |
147148

‎lib/mongo_client.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ var parse = require('./url_parser')
2727
* });
2828
*/
2929
var validOptionNames = ['poolSize', 'ssl', 'sslValidate', 'sslCA', 'sslCert',
30-
'sslKey', 'sslPass', 'autoReconnect', 'noDelay', 'keepAlive', 'connectTimeoutMS',
30+
'sslKey', 'sslPass', 'sslCRL', 'autoReconnect', 'noDelay', 'keepAlive', 'connectTimeoutMS',
3131
'socketTimeoutMS', 'reconnectTries', 'reconnectInterval', 'ha', 'haInterval',
3232
'replicaSet', 'secondaryAcceptableLatencyMS', 'acceptableLatencyMS',
3333
'connectWithNoPrimary', 'authSource', 'w', 'wtimeout', 'j', 'forceServerObjectId',
@@ -85,6 +85,7 @@ function MongoClient() {
8585
* @param {number} [options.poolSize=5] poolSize The maximum size of the individual server pool.
8686
* @param {boolean} [options.ssl=false] Enable SSL connection.
8787
* @param {Buffer} [options.sslCA=undefined] SSL Certificate store binary buffer
88+
* @param {Buffer} [options.sslCRL=undefined] SSL Certificate revocation list binary buffer
8889
* @param {Buffer} [options.sslCert=undefined] SSL Certificate binary buffer
8990
* @param {Buffer} [options.sslKey=undefined] SSL Key file binary buffer
9091
* @param {string} [options.sslPass=undefined] SSL Certificate pass phrase
@@ -146,6 +147,7 @@ var define = MongoClient.define = new Define('MongoClient', MongoClient, false);
146147
* @param {number} [options.poolSize=5] poolSize The maximum size of the individual server pool.
147148
* @param {boolean} [options.ssl=false] Enable SSL connection.
148149
* @param {Buffer} [options.sslCA=undefined] SSL Certificate store binary buffer
150+
* @param {Buffer} [options.sslCRL=undefined] SSL Certificate revocation list binary buffer
149151
* @param {Buffer} [options.sslCert=undefined] SSL Certificate binary buffer
150152
* @param {Buffer} [options.sslKey=undefined] SSL Key file binary buffer
151153
* @param {string} [options.sslPass=undefined] SSL Certificate pass phrase

‎lib/mongos.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ var release = os.release();
4949
// Allowed parameters
5050
var legalOptionNames = ['ha', 'haInterval', 'acceptableLatencyMS'
5151
, 'poolSize', 'ssl', 'checkServerIdentity', 'sslValidate'
52-
, 'sslCA', 'sslCert', 'sslKey', 'sslPass', 'socketOptions', 'bufferMaxEntries'
52+
, 'sslCA', 'sslCRL', 'sslCert', 'sslKey', 'sslPass', 'socketOptions', 'bufferMaxEntries'
5353
, 'store', 'auto_reconnect', 'autoReconnect', 'emitError'
5454
, 'keepAlive', 'noDelay', 'connectTimeoutMS', 'socketTimeoutMS'
5555
, 'loggerLevel', 'logger', 'reconnectTries', 'appname', 'domainsEnabled'
@@ -69,6 +69,7 @@ var release = os.release();
6969
* @param {boolean|function} [options.checkServerIdentity=true] Ensure we check server identify during SSL, set to false to disable checking. Only works for Node 0.12.x or higher. You can pass in a boolean or your own checkServerIdentity override function.
7070
* @param {object} [options.sslValidate=true] Validate mongod server certificate against ca (needs to have a mongod server with ssl support, 2.4 or higher)
7171
* @param {array} [options.sslCA=null] Array of valid certificates either as Buffers or Strings (needs to have a mongod server with ssl support, 2.4 or higher)
72+
* @param {array} [options.sslCRL=null] Array of revocation certificates either as Buffers or Strings (needs to have a mongod server with ssl support, 2.4 or higher)
7273
* @param {(Buffer|string)} [options.sslCert=null] String or buffer containing the certificate we wish to present (needs to have a mongod server with ssl support, 2.4 or higher)
7374
* @param {(Buffer|string)} [options.sslKey=null] String or buffer containing the certificate private key we wish to present (needs to have a mongod server with ssl support, 2.4 or higher)
7475
* @param {(Buffer|string)} [options.sslPass=null] String or buffer containing the certificate password (needs to have a mongod server with ssl support, 2.4 or higher)

‎lib/replset.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ var EventEmitter = require('events').EventEmitter
4242
// Allowed parameters
4343
var legalOptionNames = ['ha', 'haInterval', 'replicaSet', 'rs_name', 'secondaryAcceptableLatencyMS'
4444
, 'connectWithNoPrimary', 'poolSize', 'ssl', 'checkServerIdentity', 'sslValidate'
45-
, 'sslCA', 'sslCert', 'sslKey', 'sslPass', 'socketOptions', 'bufferMaxEntries'
45+
, 'sslCA', 'sslCert', 'sslCRL', 'sslKey', 'sslPass', 'socketOptions', 'bufferMaxEntries'
4646
, 'store', 'auto_reconnect', 'autoReconnect', 'emitError'
4747
, 'keepAlive', 'noDelay', 'connectTimeoutMS', 'socketTimeoutMS', 'strategy', 'debug'
4848
, 'loggerLevel', 'logger', 'reconnectTries', 'appname', 'domainsEnabled'
@@ -72,6 +72,7 @@ var release = os.release();
7272
* @param {boolean|function} [options.checkServerIdentity=true] Ensure we check server identify during SSL, set to false to disable checking. Only works for Node 0.12.x or higher. You can pass in a boolean or your own checkServerIdentity override function.
7373
* @param {object} [options.sslValidate=true] Validate mongod server certificate against ca (needs to have a mongod server with ssl support, 2.4 or higher)
7474
* @param {array} [options.sslCA=null] Array of valid certificates either as Buffers or Strings (needs to have a mongod server with ssl support, 2.4 or higher)
75+
* @param {array} [options.sslCRL=null] Array of revocation certificates either as Buffers or Strings (needs to have a mongod server with ssl support, 2.4 or higher)
7576
* @param {(Buffer|string)} [options.sslCert=null] String or buffer containing the certificate we wish to present (needs to have a mongod server with ssl support, 2.4 or higher)
7677
* @param {(Buffer|string)} [options.sslKey=null] String or buffer containing the certificate private key we wish to present (needs to have a mongod server with ssl support, 2.4 or higher)
7778
* @param {(Buffer|string)} [options.sslPass=null] String or buffer containing the certificate password (needs to have a mongod server with ssl support, 2.4 or higher)

‎lib/server.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ var release = os.release();
4646
// Allowed parameters
4747
var legalOptionNames = ['ha', 'haInterval', 'acceptableLatencyMS'
4848
, 'poolSize', 'ssl', 'checkServerIdentity', 'sslValidate'
49-
, 'sslCA', 'sslCert', 'sslKey', 'sslPass', 'socketOptions', 'bufferMaxEntries'
49+
, 'sslCA', 'sslCRL', 'sslCert', 'sslKey', 'sslPass', 'socketOptions', 'bufferMaxEntries'
5050
, 'store', 'auto_reconnect', 'autoReconnect', 'emitError'
5151
, 'keepAlive', 'noDelay', 'connectTimeoutMS', 'socketTimeoutMS'
5252
, 'loggerLevel', 'logger', 'reconnectTries', 'reconnectInterval', 'monitoring'
@@ -65,6 +65,7 @@ var release = os.release();
6565
* @param {object} [options.sslValidate=true] Validate mongod server certificate against ca (needs to have a mongod server with ssl support, 2.4 or higher)
6666
* @param {boolean|function} [options.checkServerIdentity=true] Ensure we check server identify during SSL, set to false to disable checking. Only works for Node 0.12.x or higher. You can pass in a boolean or your own checkServerIdentity override function.
6767
* @param {array} [options.sslCA=null] Array of valid certificates either as Buffers or Strings (needs to have a mongod server with ssl support, 2.4 or higher)
68+
* @param {array} [options.sslCRL=null] Array of revocation certificates either as Buffers or Strings (needs to have a mongod server with ssl support, 2.4 or higher)
6869
* @param {(Buffer|string)} [options.sslCert=null] String or buffer containing the certificate we wish to present (needs to have a mongod server with ssl support, 2.4 or higher)
6970
* @param {(Buffer|string)} [options.sslKey=null] String or buffer containing the certificate private key we wish to present (needs to have a mongod server with ssl support, 2.4 or higher)
7071
* @param {(Buffer|string)} [options.sslPass=null] String or buffer containing the certificate password (needs to have a mongod server with ssl support, 2.4 or higher)

‎lib/utils.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,8 @@ var mergeOptions = function(target, source) {
262262
var translateOptions = function(target, source) {
263263
var translations = {
264264
// SSL translation options
265-
'sslCA': 'ca', 'sslValidate': 'rejectUnauthorized', 'sslKey': 'key', 'sslCert': 'cert', 'sslPass': 'passphrase',
265+
'sslCA': 'ca', 'sslCRL': 'crl', 'sslValidate': 'rejectUnauthorized', 'sslKey': 'key',
266+
'sslCert': 'cert', 'sslPass': 'passphrase',
266267
// SocketTimeout translation options
267268
'socketTimeoutMS': 'socketTimeout', 'connectTimeoutMS': 'connectionTimeout',
268269
// Replicaset options

‎test/functional/ssl_mongoclient_tests.js

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,60 @@ exports.shouldCorrectlyCommunicateUsingSSLSocket = {
5454
}
5555
}
5656

57+
/**
58+
* @ignore
59+
*/
60+
exports['should fail due to CRL list passed in'] = {
61+
metadata: { requires: { topology: 'ssl' } },
62+
63+
// The actual test we wish to run
64+
test: function(configuration, test) {
65+
var ServerManager = require('mongodb-topology-manager').Server
66+
, MongoClient = configuration.require.MongoClient;
67+
68+
// All inserted docs
69+
var docs = [];
70+
var errs = [];
71+
var insertDocs = [];
72+
73+
// Start server
74+
var serverManager = new ServerManager('mongod', {
75+
journal: null
76+
, port: 27019
77+
, sslOnNormalPorts: null
78+
, sslPEMKeyFile: __dirname + "/ssl/server.pem"
79+
, dbpath: path.join(path.resolve('db'), f("data-%d", 27019))
80+
}, {
81+
ssl:true
82+
});
83+
84+
// Read the ca
85+
var crl = [fs.readFileSync(__dirname + "/ssl/crl_expired.pem")];
86+
var ca = [fs.readFileSync(__dirname + "/ssl/ca.pem")];
87+
88+
serverManager.purge().then(function() {
89+
// Start the server
90+
serverManager.start().then(function() {
91+
setTimeout(function() {
92+
// Connect
93+
MongoClient.connect("mongodb://server:27019/test?ssl=true", {
94+
sslValidate: true,
95+
sslCA: ca,
96+
sslCRL: crl,
97+
}, function(err, db) {
98+
test.ok(err);
99+
test.ok(err.message.indexOf('CRL has expired') != -1);
100+
101+
serverManager.stop().then(function() {
102+
test.done();
103+
});
104+
});
105+
}, 10000);
106+
});
107+
});
108+
}
109+
}
110+
57111
/**
58112
* @ignore
59113
*/

0 commit comments

Comments
 (0)