Skip to content

Commit 9ac03cf

Browse files
MikalaiMazurenkaMikalaiMazurenka
committed
CSHARP-3161: Default OCSP to 'off' for drivers that hard-fail when an OCSP responder is unavailable
1 parent e0568c0 commit 9ac03cf

File tree

9 files changed

+136
-30
lines changed

9 files changed

+136
-30
lines changed

‎Docs/reference/content/reference/driver/ssl.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,21 +45,21 @@ var settings = new MongoClientSettings
4545
### Certificate Revocation Checking
4646

4747
#### Default behavior
48-
The .NET Driver now **enables** certificate revocation checking by
48+
The .NET Driver now **disables** certificate revocation checking by
4949
default, setting [`CheckCertificateRevocation`]({{< apiref
5050
"P_MongoDB_Driver_SslSettings_CheckCertificateRevocation">}}) in
5151
[`SslSettings`]({{< apiref "T_MongoDB_Driver_SslSettings" >}}) to
52-
`true` by default. This is in contrast to .NET's defaults for
52+
`false` by default. This correlates to .NET's defaults for
5353
`SslStream` (see .NET Framework documentation
5454
[here](https://docs.microsoft.com/en-us/dotnet/api/system.net.security.sslstream.authenticateasclient?view=netframework-4.7.2#System_Net_Security_SslStream_AuthenticateAsClient_System_String_)
5555
and .NET Standard documentation
5656
[here](https://docs.microsoft.com/en-us/dotnet/api/system.net.security.sslstream.authenticateasclient?view=netstandard-2.0#System_Net_Security_SslStream_AuthenticateAsClient_System_String_)).
57-
Any applications relying on the older default of `false` now must
57+
Applications relying on the intermediate default of `true` (introduced in beta driver releases 2.11.0-beta1 and 2.11.0-beta2) must
5858
explicitly set [`CheckCertificateRevocation`]({{< apiref
5959
"P_MongoDB_Driver_SslSettings_CheckCertificateRevocation">}}) to
60-
`false` in [`SslSettings`]({{< apiref "T_MongoDB_Driver_SslSettings"
61-
>}}) to disable certificate revocation checking. Alternatively,
62-
applications may also set `tlsDisableCertificateRevocationCheck=true`
60+
`true` in [`SslSettings`]({{< apiref "T_MongoDB_Driver_SslSettings"
61+
>}}) to enable certificate revocation checking. Alternatively,
62+
applications may also set `tlsDisableCertificateRevocationCheck=false`
6363
in their connection string. See
6464
[tlsDisableCertificateRevocationCheck](#tlsDisableCertificateRevocationCheck)
6565
for more information.

‎src/MongoDB.Driver.Core/Core/Configuration/SslStreamSettings.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public SslStreamSettings(
5050
Optional<SslProtocols> enabledProtocols = default(Optional<SslProtocols>),
5151
Optional<RemoteCertificateValidationCallback> serverCertificateValidationCallback = default(Optional<RemoteCertificateValidationCallback>))
5252
{
53-
_checkCertificateRevocation = checkCertificateRevocation.WithDefault(true);
53+
_checkCertificateRevocation = checkCertificateRevocation.WithDefault(false);
5454
_clientCertificates = Ensure.IsNotNull(clientCertificates.WithDefault(Enumerable.Empty<X509Certificate>()), "clientCertificates").ToList();
5555
_clientCertificateSelectionCallback = clientCertificateSelectionCallback.WithDefault(null);
5656
_enabledSslProtocols = enabledProtocols.WithDefault(SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls);

‎src/MongoDB.Driver/MongoUrlBuilder.cs

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ public class MongoUrlBuilder
6767
private IEnumerable<MongoServerAddress> _servers;
6868
private TimeSpan _serverSelectionTimeout;
6969
private TimeSpan _socketTimeout;
70-
private bool _tlsDisableCertificateRevocationCheck;
70+
private bool? _tlsDisableCertificateRevocationCheck;
7171
private string _username;
7272
private bool _useTls;
7373
private WriteConcern.WValue _w;
@@ -551,7 +551,7 @@ public TimeSpan SocketTimeout
551551
/// </summary>
552552
public bool TlsDisableCertificateRevocationCheck
553553
{
554-
get => _tlsDisableCertificateRevocationCheck;
554+
get => _tlsDisableCertificateRevocationCheck.GetValueOrDefault(true);
555555
set => _tlsDisableCertificateRevocationCheck = value;
556556
}
557557

@@ -783,8 +783,7 @@ public void Parse(string url)
783783
});
784784
_serverSelectionTimeout = connectionString.ServerSelectionTimeout.GetValueOrDefault(MongoDefaults.ServerSelectionTimeout);
785785
_socketTimeout = connectionString.SocketTimeout.GetValueOrDefault(MongoDefaults.SocketTimeout);
786-
_tlsDisableCertificateRevocationCheck =
787-
connectionString.TlsDisableCertificateRevocationCheck.GetValueOrDefault(false);
786+
_tlsDisableCertificateRevocationCheck = connectionString.TlsDisableCertificateRevocationCheck;
788787
_username = connectionString.Username;
789788
_useTls = connectionString.Tls.GetValueOrDefault(false);
790789
_w = connectionString.W;
@@ -907,9 +906,9 @@ public override string ToString()
907906
query.AppendFormat("tlsInsecure=true;");
908907
}
909908

910-
if (_tlsDisableCertificateRevocationCheck)
909+
if (_tlsDisableCertificateRevocationCheck != null)
911910
{
912-
query.AppendFormat("tlsDisableCertificateRevocationCheck=true;");
911+
query.AppendFormat("tlsDisableCertificateRevocationCheck={0};", JsonConvert.ToString(_tlsDisableCertificateRevocationCheck.Value));
913912
}
914913

915914
if (_compressors?.Any() ?? false)

‎src/MongoDB.Driver/SslSettings.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ public class SslSettings : IEquatable<SslSettings>
3434
private static readonly IEqualityComparer<X509CertificateCollection> __certificateCollectionEqualityComparer = new X509CertificateCollectionEqualityComparer();
3535

3636
// private fields
37-
private bool _checkCertificateRevocation = true;
37+
private bool _checkCertificateRevocation = false;
3838
private X509CertificateCollection _clientCertificateCollection;
3939
private LocalCertificateSelectionCallback _clientCertificateSelectionCallback;
4040
private SslProtocols _enabledSslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls;

‎tests/MongoDB.Driver.Core.Tests/Core/Configuration/SslStreamSettingsTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public void constructor_should_initialize_instance()
3131
{
3232
var subject = new SslStreamSettings();
3333

34-
subject.CheckCertificateRevocation.Should().BeTrue();
34+
subject.CheckCertificateRevocation.Should().BeFalse();
3535
subject.ClientCertificates.Should().BeEmpty();
3636
subject.ClientCertificateSelectionCallback.Should().BeNull();
3737
subject.EnabledSslProtocols.Should().Be(SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls);

‎tests/MongoDB.Driver.Legacy.Tests/MongoServerSettingsTests.cs

Lines changed: 62 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,36 @@ public void TestClone()
113113
settings.SdamLogFilename = "unimatrix-zero";
114114

115115
var clone = settings.Clone();
116+
116117
Assert.Equal(settings, clone);
117118
}
118119

120+
[Fact]
121+
public void TestCloneTlsDisableCertificateRevocationCheck()
122+
{
123+
var connectionString = "mongodb://somehost/?tlsDisableCertificateRevocationCheck=true";
124+
var builder = new MongoUrlBuilder(connectionString);
125+
var url = builder.ToMongoUrl();
126+
var settings = MongoServerSettings.FromUrl(url);
127+
128+
var clone = settings.Clone();
129+
130+
clone.Should().Be(settings);
131+
}
132+
133+
[Fact]
134+
public void TestCloneTlsInsecure()
135+
{
136+
var connectionString = "mongodb://somehost/?tlsInsecure=true";
137+
var builder = new MongoUrlBuilder(connectionString);
138+
var url = builder.ToMongoUrl();
139+
var settings = MongoServerSettings.FromUrl(url);
140+
141+
var clone = settings.Clone();
142+
143+
clone.Should().Be(settings);
144+
}
145+
119146
[Fact]
120147
public void TestConnectionMode()
121148
{
@@ -414,6 +441,7 @@ public void TestFromClientSettings()
414441
clientSettings.SdamLogFilename = "section-31";
415442

416443
var settings = MongoServerSettings.FromClientSettings(clientSettings);
444+
417445
Assert.Equal(url.AllowInsecureTls, settings.AllowInsecureTls);
418446
Assert.Equal(url.ApplicationName, settings.ApplicationName);
419447
Assert.Equal(url.ConnectionMode, settings.ConnectionMode);
@@ -450,7 +478,7 @@ public void TestFromClientSettings()
450478
Assert.True(url.Servers.SequenceEqual(settings.Servers));
451479
Assert.Equal(url.ServerSelectionTimeout, settings.ServerSelectionTimeout);
452480
Assert.Equal(url.SocketTimeout, settings.SocketTimeout);
453-
settings.SslSettings.Should().BeNull();
481+
Assert.Equal(url.TlsDisableCertificateRevocationCheck, !settings.SslSettings.CheckCertificateRevocation);
454482
#pragma warning disable 618
455483
Assert.Equal(url.UseSsl, settings.UseSsl);
456484
#pragma warning restore 618
@@ -472,11 +500,23 @@ public void TestFromClientSettingsTlsDisableCertificateRevocationCheck()
472500
var builder = new MongoUrlBuilder(connectionString);
473501
var url = builder.ToMongoUrl();
474502
var clientSettings = MongoClientSettings.FromUrl(url);
475-
clientSettings.SdamLogFilename = "section-31";
476503

477504
var settings = MongoServerSettings.FromClientSettings(clientSettings);
478-
settings.SslSettings.Should().Be(
479-
new SslSettings { CheckCertificateRevocation = !url.TlsDisableCertificateRevocationCheck });
505+
506+
settings.SslSettings.Should().Be(new SslSettings { CheckCertificateRevocation = !url.TlsDisableCertificateRevocationCheck });
507+
}
508+
509+
[Fact]
510+
public void TestFromClientSettingsTlsInsecure()
511+
{
512+
var connectionString = "mongodb://lcars/?tlsInsecure=true";
513+
var builder = new MongoUrlBuilder(connectionString);
514+
var url = builder.ToMongoUrl();
515+
var clientSettings = MongoClientSettings.FromUrl(url);
516+
517+
var settings = MongoServerSettings.FromClientSettings(clientSettings);
518+
519+
settings.AllowInsecureTls.Should().BeTrue();
480520
}
481521

482522
[Fact]
@@ -502,6 +542,7 @@ public void TestFromUrl()
502542
var url = builder.ToMongoUrl();
503543

504544
var settings = MongoServerSettings.FromUrl(url);
545+
505546
Assert.Equal(url.AllowInsecureTls, settings.AllowInsecureTls);
506547
Assert.Equal(url.ApplicationName, settings.ApplicationName);
507548
Assert.Equal(url.ConnectionMode, settings.ConnectionMode);
@@ -535,12 +576,14 @@ public void TestFromUrl()
535576
Assert.True(url.Servers.SequenceEqual(settings.Servers));
536577
Assert.Equal(url.ServerSelectionTimeout, settings.ServerSelectionTimeout);
537578
Assert.Equal(url.SocketTimeout, settings.SocketTimeout);
538-
settings.SslSettings.Should().BeNull();
579+
Assert.Equal(url.TlsDisableCertificateRevocationCheck, !settings.SslSettings.CheckCertificateRevocation);
539580
#pragma warning disable 618
540581
Assert.Equal(url.UseSsl, settings.UseSsl);
541-
Assert.Equal(url.VerifySslCertificate, settings.VerifySslCertificate);
542582
#pragma warning restore 618
543583
Assert.Equal(url.UseTls, settings.UseTls);
584+
#pragma warning disable 618
585+
Assert.Equal(url.VerifySslCertificate, settings.VerifySslCertificate);
586+
#pragma warning restore 618
544587
#pragma warning disable 618
545588
Assert.Equal(url.ComputedWaitQueueSize, settings.WaitQueueSize);
546589
#pragma warning restore 618
@@ -556,9 +599,22 @@ public void TestFromUrlTlsDisableCertificateRevocationCheck()
556599
var url = builder.ToMongoUrl();
557600

558601
var settings = MongoServerSettings.FromUrl(url);
602+
559603
settings.SslSettings.Should().Be(new SslSettings { CheckCertificateRevocation = !url.TlsDisableCertificateRevocationCheck });
560604
}
561605

606+
[Fact]
607+
public void TestFromUrlTlsInsecure()
608+
{
609+
var connectionString = "mongodb://unimatrix-zero/?tlsInsecure=true";
610+
var builder = new MongoUrlBuilder(connectionString);
611+
var url = builder.ToMongoUrl();
612+
613+
var settings = MongoServerSettings.FromUrl(url);
614+
615+
settings.AllowInsecureTls.Should().Be(url.AllowInsecureTls);
616+
}
617+
562618
[Fact]
563619
public void TestFrozenCopy()
564620
{

‎tests/MongoDB.Driver.Tests/MongoClientSettingsTests.cs

Lines changed: 57 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public void TestClone()
8585
"maxIdleTime=124;maxLifeTime=125;maxPoolSize=126;minPoolSize=127;readConcernLevel=majority;" +
8686
"readPreference=secondary;readPreferenceTags=a:1,b:2;readPreferenceTags=c:3,d:4;socketTimeout=129;" +
8787
"serverSelectionTimeout=20s;ssl=true;sslVerifyCertificate=false;waitqueuesize=130;waitQueueTimeout=131;" +
88-
"w=1;fsync=true;journal=true;w=2;wtimeout=131;gssapiServiceName=other;tlsInsecure=true";
88+
"w=1;fsync=true;journal=true;w=2;wtimeout=131;gssapiServiceName=other";
8989
#pragma warning disable 618
9090
if (BsonDefaults.GuidRepresentationMode == GuidRepresentationMode.V2)
9191
{
@@ -95,7 +95,6 @@ public void TestClone()
9595
var builder = new MongoUrlBuilder(connectionString);
9696
var url = builder.ToMongoUrl();
9797
var settings = MongoClientSettings.FromUrl(url);
98-
9998
// a few settings can only be made in code
10099
#pragma warning disable 618
101100
settings.Credential = MongoCredential.CreateMongoCRCredential("database", "username", "password").WithMechanismProperty("SERVICE_NAME", "other");
@@ -104,9 +103,36 @@ public void TestClone()
104103
settings.SdamLogFilename = "stdout";
105104

106105
var clone = settings.Clone();
106+
107107
Assert.Equal(settings, clone);
108108
}
109109

110+
[Fact]
111+
public void TestCloneTlsDisableCertificateRevocationCheck()
112+
{
113+
var connectionString = "mongodb://somehost/?tlsDisableCertificateRevocationCheck=true";
114+
var builder = new MongoUrlBuilder(connectionString);
115+
var url = builder.ToMongoUrl();
116+
var settings = MongoClientSettings.FromUrl(url);
117+
118+
var clone = settings.Clone();
119+
120+
clone.Should().Be(settings);
121+
}
122+
123+
[Fact]
124+
public void TestCloneTlsInsecure()
125+
{
126+
var connectionString = "mongodb://somehost/?tlsInsecure=true";
127+
var builder = new MongoUrlBuilder(connectionString);
128+
var url = builder.ToMongoUrl();
129+
var settings = MongoClientSettings.FromUrl(url);
130+
131+
var clone = settings.Clone();
132+
133+
clone.Should().Be(settings);
134+
}
135+
110136
[Fact]
111137
public void TestCompressors()
112138
{
@@ -398,12 +424,14 @@ public void TestFreezeInvalid()
398424
public void TestFromUrl()
399425
{
400426
// set everything to non default values to test that all settings are converted
427+
// with the exception of tlsDisableCertificateRevocationCheck because setting that with tlsInsecure is
428+
// not allowed in a connection string
401429
var connectionString =
402430
"mongodb://user1:password1@somehost/?appname=app1;authSource=db;authMechanismProperties=CANONICALIZE_HOST_NAME:true;" +
403431
"compressors=zlib,snappy;zlibCompressionLevel=9;connect=direct;connectTimeout=123;ipv6=true;heartbeatInterval=1m;heartbeatTimeout=2m;localThreshold=128;" +
404432
"maxIdleTime=124;maxLifeTime=125;maxPoolSize=126;minPoolSize=127;readConcernLevel=majority;" +
405433
"readPreference=secondary;readPreferenceTags=a:1,b:2;readPreferenceTags=c:3,d:4;retryReads=false;retryWrites=true;socketTimeout=129;" +
406-
"serverSelectionTimeout=20s;tls=true;tlsInsecure=true;waitqueuesize=130;waitQueueTimeout=131;" +
434+
"serverSelectionTimeout=20s;tls=true;sslVerifyCertificate=false;waitqueuesize=130;waitQueueTimeout=131;" +
407435
"w=1;fsync=true;journal=true;w=2;wtimeout=131;gssapiServiceName=other";
408436
#pragma warning disable 618
409437
if (BsonDefaults.GuidRepresentationMode == GuidRepresentationMode.V2)
@@ -415,6 +443,7 @@ public void TestFromUrl()
415443
var url = builder.ToMongoUrl();
416444

417445
var settings = MongoClientSettings.FromUrl(url);
446+
418447
Assert.Equal(url.AllowInsecureTls, settings.AllowInsecureTls);
419448
Assert.Equal(url.ApplicationName, settings.ApplicationName);
420449
Assert.Equal(url.Compressors, settings.Compressors);
@@ -453,21 +482,44 @@ public void TestFromUrl()
453482
Assert.Equal(url.ServerSelectionTimeout, settings.ServerSelectionTimeout);
454483
Assert.Equal(url.SocketTimeout, settings.SocketTimeout);
455484
#pragma warning disable 618
456-
settings.SslSettings.Should().BeNull();
485+
Assert.Equal(url.TlsDisableCertificateRevocationCheck, !settings.SslSettings.CheckCertificateRevocation);
457486
Assert.Equal(url.UseSsl, settings.UseSsl);
458487
#pragma warning restore 618
459488
Assert.Equal(url.UseTls, settings.UseTls);
460489
#pragma warning disable 618
461490
Assert.Equal(url.VerifySslCertificate, settings.VerifySslCertificate);
462491
#pragma warning restore 618
463-
464492
#pragma warning disable 618
465493
Assert.Equal(url.ComputedWaitQueueSize, settings.WaitQueueSize);
466494
#pragma warning restore 618
467495
Assert.Equal(url.WaitQueueTimeout, settings.WaitQueueTimeout);
468496
Assert.Equal(url.GetWriteConcern(true), settings.WriteConcern);
469497
}
470498

499+
[Fact]
500+
public void TestFromUrlTlsDisableCertificateRevocationCheck()
501+
{
502+
var connectionString = "mongodb://the-next-generation/?tlsDisableCertificateRevocationCheck=true";
503+
var builder = new MongoUrlBuilder(connectionString);
504+
var url = builder.ToMongoUrl();
505+
506+
var settings = MongoClientSettings.FromUrl(url);
507+
508+
settings.SslSettings.Should().Be(new SslSettings { CheckCertificateRevocation = !url.TlsDisableCertificateRevocationCheck });
509+
}
510+
511+
[Fact]
512+
public void TestFromUrlTlsInsecure()
513+
{
514+
var connectionString = "mongodb://the-next-generation/?tlsInsecure=true";
515+
var builder = new MongoUrlBuilder(connectionString);
516+
var url = builder.ToMongoUrl();
517+
518+
var settings = MongoClientSettings.FromUrl(url);
519+
520+
settings.AllowInsecureTls.Should().Be(url.AllowInsecureTls);
521+
}
522+
471523
[Fact]
472524
public void TestFromUrlWithMongoDBX509()
473525
{

‎tests/MongoDB.Driver.Tests/MongoUrlTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ public void TestAll()
245245
Assert.Equal(new MongoServerAddress("host", 27017), url.Server);
246246
Assert.Equal(TimeSpan.FromSeconds(10), url.ServerSelectionTimeout);
247247
Assert.Equal(TimeSpan.FromSeconds(7), url.SocketTimeout);
248-
url.TlsDisableCertificateRevocationCheck.Should().Be(false);
248+
Assert.Equal(true, url.TlsDisableCertificateRevocationCheck);
249249
Assert.Equal("username", url.Username);
250250
#pragma warning disable 618
251251
Assert.Equal(true, url.UseSsl);

‎tests/MongoDB.Driver.Tests/SslSettingsTests.cs

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020
using System.Reflection;
2121
using System.Security.Authentication;
2222
using System.Security.Cryptography.X509Certificates;
23-
using MongoDB.Driver;
2423
using Xunit;
2524
using FluentAssertions;
2625

@@ -51,7 +50,7 @@ private bool ServerCertificateValidationCallback(
5150
public void TestCheckCertificateRevocation()
5251
{
5352
var settings = new SslSettings();
54-
settings.CheckCertificateRevocation.Should().BeTrue();
53+
settings.CheckCertificateRevocation.Should().BeFalse();
5554

5655
var checkCertificateRevocation = !settings.CheckCertificateRevocation;
5756
settings.CheckCertificateRevocation = checkCertificateRevocation;
@@ -116,7 +115,7 @@ public void TestClone()
116115
public void TestDefaults()
117116
{
118117
var settings = new SslSettings();
119-
settings.CheckCertificateRevocation.Should().BeTrue();
118+
settings.CheckCertificateRevocation.Should().BeFalse();
120119
Assert.Equal(null, settings.ClientCertificates);
121120
Assert.Equal(null, settings.ClientCertificateSelectionCallback);
122121
Assert.Equal(SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls, settings.EnabledSslProtocols);

0 commit comments

Comments
 (0)