Skip to content

Commit 0443a02

Browse files
author
Brandon Black
committed
RUBY-565 testy goodness for ssl cert validation
Adding a few tests to cover the new SSL features. Sadly, there's too much certificate, /etc/hosts and MongoDB server mucking around for these tests to actually be run in bulk or automated in CI. These tests must be run manually, and in some cases (spefifically for negative test cases) a single test at a time. I've grouped the tests by their configuration and server options required to make them successful and provided notes for each test on how to set it up locall on your own machine.
1 parent ae98043 commit 0443a02

File tree

4 files changed

+234
-21
lines changed

4 files changed

+234
-21
lines changed

‎tasks/testing.rake‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -78,25 +78,25 @@ namespace :test do
7878
end
7979
end
8080

81+
Rake::TestTask.new(:functional) do |t|
82+
t.test_files = FileList['test/functional/*_test.rb'] - [
83+
'test/functional/grid_io_test.rb',
84+
'test/functional/grid_test.rb',
85+
'test/functional/ssl_test.rb'
86+
]
87+
t.libs << 'test'
88+
end
89+
8190
Rake::TestTask.new(:replica_set) do |t|
8291
disabled = [
8392
'test/replica_set/complex_connect_test.rb',
8493
'test/replica_set/count_test.rb',
85-
'test/replica_set/read_preference_test.rb'
94+
'test/replica_set/read_preference_test.rb',
95+
'test/replica_set/ssl_test.rb'
8696
]
8797

8898
t.test_files = FileList['test/replica_set/*_test.rb'] - disabled
8999
t.libs << 'test'
90-
#t.verbose = true
91-
#t.options = '-v'
92-
end
93-
94-
Rake::TestTask.new(:functional) do |t|
95-
t.test_files = FileList['test/functional/*_test.rb'] - [
96-
"test/functional/grid_io_test.rb",
97-
"test/functional/grid_test.rb"
98-
]
99-
t.libs << 'test'
100100
end
101101

102102
desc "Runs test cleanup"

‎test/fixtures/certificates/crl_expired.pem‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎test/functional/ssl_test.rb‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
require 'test_helper'
2+
3+
class SSLCertValidationTest < Test::Unit::TestCase
4+
include Mongo
5+
6+
CERT_PATH = "#{Dir.pwd}/test/fixtures/certificates/"
7+
CLIENT_CERT = "#{CERT_PATH}client.pem"
8+
CA_CERT = "#{CERT_PATH}ca.pem"
9+
10+
# This test doesn't connect, no server config required
11+
def test_ssl_configuration
12+
# raises when ssl=false and ssl opts specified
13+
assert_raise MongoArgumentError do
14+
MongoClient.new('server', 27017, :connect => false,
15+
:ssl => false,
16+
:ssl_cert => CLIENT_CERT)
17+
end
18+
19+
# raises when ssl=nil and ssl opts specified
20+
assert_raise MongoArgumentError do
21+
MongoClient.new('server', 27017, :connect => false,
22+
:ssl_key => CLIENT_CERT)
23+
end
24+
25+
# raises when verify=true and no ca_cert
26+
assert_raise MongoArgumentError do
27+
MongoClient.new('server', 27017, :connect => false,
28+
:ssl => true,
29+
:ssl_key => CLIENT_CERT,
30+
:ssl_cert => CLIENT_CERT,
31+
:ssl_verify => true)
32+
end
33+
end
34+
35+
# Requires MongoDB built with SSL and the follow options:
36+
#
37+
# mongod --dbpath /path/to/data/directory --sslOnNormalPorts \
38+
# --sslPEMKeyFile /path/to/server.pem \
39+
# --sslCAFile /path/to/ca.pem \
40+
# --sslCRLFile /path/to/crl.pem \
41+
# --sslWeakCertificateValidation
42+
#
43+
# Make sure you have 'server' as an alias for localhost in /etc/hosts
44+
#
45+
def test_ssl_basic
46+
client = MongoClient.new('server', 27017, :connect => false,
47+
:ssl => true)
48+
assert client.connect
49+
end
50+
51+
# Requires MongoDB built with SSL and the follow options:
52+
#
53+
# mongod --dbpath /path/to/data/directory --sslOnNormalPorts \
54+
# --sslPEMKeyFile /path/to/server.pem \
55+
# --sslCAFile /path/to/ca.pem \
56+
# --sslCRLFile /path/to/crl.pem
57+
#
58+
# Make sure you have 'server' as an alias for localhost in /etc/hosts
59+
#
60+
def test_ssl_with_cert
61+
client = MongoClient.new('server', 27017, :connect => false,
62+
:ssl => true,
63+
:ssl_cert => CLIENT_CERT,
64+
:ssl_key => CLIENT_CERT)
65+
assert client.connect
66+
end
67+
68+
def test_ssl_with_peer_cert_validation
69+
client = MongoClient.new('server', 27017, :connect => false,
70+
:ssl => true,
71+
:ssl_key => CLIENT_CERT,
72+
:ssl_cert => CLIENT_CERT,
73+
:ssl_verify => true,
74+
:ssl_ca_cert => CA_CERT)
75+
assert client.connect
76+
end
77+
78+
def test_ssl_peer_cert_validation_hostname_fail
79+
client = MongoClient.new('localhost', 27017, :connect => false,
80+
:ssl => true,
81+
:ssl_key => CLIENT_CERT,
82+
:ssl_cert => CLIENT_CERT,
83+
:ssl_verify => true,
84+
:ssl_ca_cert => CA_CERT)
85+
assert_raise ConnectionFailure do
86+
client.connect
87+
end
88+
end
89+
90+
# Requires mongod built with SSL and the follow options:
91+
#
92+
# mongod --dbpath /path/to/data/directory --sslOnNormalPorts \
93+
# --sslPEMKeyFile /path/to/server.pem \
94+
# --sslCAFile /path/to/ca.pem \
95+
# --sslCRLFile /path/to/crl_client_revoked.pem
96+
#
97+
# Make sure you have 'server' as an alias for localhost in /etc/hosts
98+
#
99+
def test_ssl_with_invalid_cert
100+
assert_raise ConnectionFailure do
101+
MongoClient.new('server', 27017, :ssl => true,
102+
:ssl_key => CLIENT_CERT,
103+
:ssl_cert => CLIENT_CERT,
104+
:ssl_verify => true,
105+
:ssl_ca_cert => CA_CERT)
106+
end
107+
end
108+
109+
end

‎test/replica_set/ssl_test.rb‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
require 'test_helper'
2+
3+
# Note: For testing with MongoReplicaSetClient you *MUST* use the
4+
# hostname 'server' for all members of the replica set.
5+
6+
class ReplicaSetSSLCertValidationTest < Test::Unit::TestCase
7+
include Mongo
8+
9+
CERT_PATH = "#{Dir.pwd}/test/fixtures/certificates/"
10+
CLIENT_CERT = "#{CERT_PATH}client.pem"
11+
CA_CERT = "#{CERT_PATH}ca.pem"
12+
SEEDS = ['server:3000','server:3001','server:3002']
13+
BAD_SEEDS = ['localhost:3000','localhost:3001','localhost:3002']
14+
15+
# This test doesn't connect, no server config required
16+
def test_ssl_configuration
17+
# raises when ssl=false and ssl opts specified
18+
assert_raise MongoArgumentError do
19+
MongoReplicaSetClient.new(SEEDS, :connect => false,
20+
:ssl => false,
21+
:ssl_cert => CLIENT_CERT)
22+
end
23+
24+
# raises when ssl=nil and ssl opts specified
25+
assert_raise MongoArgumentError do
26+
MongoReplicaSetClient.new(SEEDS, :connect => false,
27+
:ssl_key => CLIENT_CERT)
28+
end
29+
30+
# raises when verify=true and no ca_cert
31+
assert_raise MongoArgumentError do
32+
MongoReplicaSetClient.new(SEEDS, :connect => false,
33+
:ssl => true,
34+
:ssl_key => CLIENT_CERT,
35+
:ssl_cert => CLIENT_CERT,
36+
:ssl_verify => true)
37+
end
38+
end
39+
40+
# Requires MongoDB built with SSL and the follow options:
41+
#
42+
# mongod --dbpath /path/to/data/directory --sslOnNormalPorts \
43+
# --sslPEMKeyFile /path/to/server.pem \
44+
# --sslCAFile /path/to/ca.pem \
45+
# --sslCRLFile /path/to/crl.pem \
46+
# --sslWeakCertificateValidation
47+
#
48+
# Make sure you have 'server' as an alias for localhost in /etc/hosts
49+
#
50+
def test_ssl_basic
51+
client = MongoReplicaSetClient.new(SEEDS, :connect => false,
52+
:ssl => true)
53+
assert client.connect
54+
end
55+
56+
# Requires MongoDB built with SSL and the follow options:
57+
#
58+
# mongod --dbpath /path/to/data/directory --sslOnNormalPorts \
59+
# --sslPEMKeyFile /path/to/server.pem \
60+
# --sslCAFile /path/to/ca.pem \
61+
# --sslCRLFile /path/to/crl.pem
62+
#
63+
# Make sure you have 'server' as an alias for localhost in /etc/hosts
64+
#
65+
def test_ssl_with_cert
66+
client = MongoReplicaSetClient.new(SEEDS, :connect => false,
67+
:ssl => true,
68+
:ssl_cert => CLIENT_CERT,
69+
:ssl_key => CLIENT_CERT)
70+
assert client.connect
71+
end
72+
73+
def test_ssl_with_peer_cert_validation
74+
client = MongoReplicaSetClient.new(SEEDS, :connect => false,
75+
:ssl => true,
76+
:ssl_key => CLIENT_CERT,
77+
:ssl_cert => CLIENT_CERT,
78+
:ssl_verify => true,
79+
:ssl_ca_cert => CA_CERT)
80+
assert client.connect
81+
end
82+
83+
def test_ssl_peer_cert_validation_hostname_fail
84+
client = MongoReplicaSetClient.new(BAD_SEEDS, :connect => false,
85+
:ssl => true,
86+
:ssl_key => CLIENT_CERT,
87+
:ssl_cert => CLIENT_CERT,
88+
:ssl_verify => true,
89+
:ssl_ca_cert => CA_CERT)
90+
assert_raise ConnectionFailure do
91+
client.connect
92+
end
93+
end
94+
95+
# Requires mongod built with SSL and the follow options:
96+
#
97+
# mongod --dbpath /path/to/data/directory --sslOnNormalPorts \
98+
# --sslPEMKeyFile /path/to/server.pem \
99+
# --sslCAFile /path/to/ca.pem \
100+
# --sslCRLFile /path/to/crl_client_revoked.pem
101+
#
102+
# Make sure you have 'server' as an alias for localhost in /etc/hosts
103+
#
104+
def test_ssl_with_invalid_cert
105+
assert_raise ConnectionFailure do
106+
MongoReplicaSetClient.new(SEEDS, :ssl => true,
107+
:ssl_key => CLIENT_CERT,
108+
:ssl_cert => CLIENT_CERT,
109+
:ssl_verify => true,
110+
:ssl_ca_cert => CA_CERT)
111+
end
112+
end
113+
114+
end

0 commit comments

Comments
 (0)