jstests/ocsp/ocsp_ignore_irrelevant.js
/**
 * Tests OCSP status verification in the client-side ignores the statuses
 * of irrelevant certificates. No stapling is performed server-side.
 */
Tests OCSP status verification in the client-side ignores the statuses
of irrelevant certificates. No stapling is performed server-side.
Tests OCSP status verification in the client - side ignores the statuses of irrelevant certificates . No stapling is performed server - side .
function testClient(serverCert, caCert, responderCertPair, issuerDigest) {
    jsTestLog("Running client test with params: " + JSON.stringify(arguments));
    clearOCSPCache();
    let mock_ocsp =
        new MockOCSPServer("", 1, responderCertPair, 0, INCLUDE_EXTRA_STATUS, issuerDigest);
    let ocsp_options = {
        sslMode: "requireSSL",
        sslPEMKeyFile: serverCert,
        sslCAFile: caCert,
        sslAllowInvalidHostnames: "",
        setParameter: {
            "failpoint.disableStapling": "{'mode':'alwaysOn'}",
            "ocspEnabled": "true",
        },
        waitForConnect: false,
    };
    const conn = MongoRunner.runMongod(ocsp_options);
    waitForServer(conn);
    jsTestLog(
        "Testing client can connect if OCSP response has extraneous statuses and the matching CertID is Good");
    mock_ocsp.start();
    assertClientConnectSucceeds(conn);
    mock_ocsp.stop();
    jsTestLog(
        "Testing client can't connect if OCSP response has extraneous statuses and the matching CertID is Revoked");
    mock_ocsp = new MockOCSPServer(
        FAULT_REVOKED, 1, responderCertPair, 0, INCLUDE_EXTRA_STATUS, issuerDigest);
    mock_ocsp.start();
    assertClientConnectFails(conn);
    MongoRunner.stopMongod(conn);
    sleep(1000);
    mock_ocsp.stop();
}
function testClient ( serverCert , caCert , responderCertPair , issuerDigest ) { jsTestLog ( "Running client test with params: " + JSON . stringify ( arguments ) ) ; clearOCSPCache ( ) ; let mock_ocsp = new MockOCSPServer ( "" , 1 , responderCertPair , 0 , INCLUDE_EXTRA_STATUS , issuerDigest ) ; let ocsp_options = { sslMode : "requireSSL" , sslPEMKeyFile : serverCert , sslCAFile : caCert , sslAllowInvalidHostnames : "" , setParameter : { "failpoint.disableStapling" : "{'mode':'alwaysOn'}" , "ocspEnabled" : "true" , } , waitForConnect : false , } ; const conn = MongoRunner . runMongod ( ocsp_options ) ; waitForServer ( conn ) ; jsTestLog ( "Testing client can connect if OCSP response has extraneous statuses and the matching CertID is Good" ) ; mock_ocsp . start ( ) ; assertClientConnectSucceeds ( conn ) ; mock_ocsp . stop ( ) ; jsTestLog ( "Testing client can't connect if OCSP response has extraneous statuses and the matching CertID is Revoked" ) ; mock_ocsp = new MockOCSPServer ( FAULT_REVOKED , 1 , responderCertPair , 0 , INCLUDE_EXTRA_STATUS , issuerDigest ) ; mock_ocsp . start ( ) ; assertClientConnectFails ( conn ) ; MongoRunner . stopMongod ( conn ) ; sleep ( 1000 ) ; mock_ocsp . stop ( ) ; }
Tests OCSP status verification in the client-side ignores the statuses
 of irrelevant certificates.
Tests OCSP status verification in the client - side ignores the statuses of irrelevant certificates .
// The mongoRunner spawns a new Mongo Object to validate the collections which races // with the shutdown logic of the mock_ocsp responder on some platforms. We need this // sleep to make sure that the threads don't interfere with each other.