@@ -35,7 +35,7 @@ implementations of TLS:
35
35
available exclusively on _ MacOS_ .
36
36
37
37
We manage TLS through an interface called
38
- [ ` SSLManagerInterface ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L181 ) . There are
38
+ [ ` SSLManagerInterface ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L204 ) . There are
39
39
three different implementations of this interface for each implementation of TLS respectively:
40
40
41
41
1 . [ ` SSLManagerOpenSSL ` ] ( ssl_manager_openssl.cpp )
@@ -44,10 +44,10 @@ three different implementations of this interface for each implementation of TLS
44
44
45
45
Every SSLManager has a set of key methods that describe the general idea of establishing a connection over TLS:
46
46
47
- - [ ` connect ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L193 ) : initiates a TLS connection
48
- - [ ` accept ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L201 ) : waits for a peer to
47
+ - [ ` connect ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L241 ) : initiates a TLS connection
48
+ - [ ` accept ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L249 ) : waits for a peer to
49
49
initiate a TLS connection
50
- - [ ` parseAndValidatePeerCertificate ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L268 ) :
50
+ - [ ` parseAndValidatePeerCertificate ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L381 ) :
51
51
parses a certificate acquired from a peer during connection negotiation and validates it.
52
52
53
53
The SSLManagers are wrappers around these TLS implementations such that they conform to our practices and standards, and
@@ -91,10 +91,10 @@ into certificates along with the public key and certificate metadata. Internal a
91
91
stored in the database, is more commonly used for acquiring access rights, and X.509 authorization is not a typical
92
92
use case of certificates in general. We do not provide any utility for generating these unique certificates, but the
93
93
logic for parsing them is in
94
- [ ` parsePeerRoles ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L294 ) .
94
+ [ ` parsePeerRoles ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L458 ) .
95
95
96
96
X.509 certificates _ are_ commonly used for _ authentication_ .
97
- [ ` SSLManager::parseAndValidatePeerCertificate ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L268 )
97
+ [ ` SSLManager::parseAndValidatePeerCertificate ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager.h#L381 )
98
98
extracts information required for authentication, such as the client name, during connection negotiation. We use
99
99
TLS for authentication, as being able to successfully perform a cryptographic handshake after key exchange should be as
100
100
sufficient proof of authenticity as providing a username and password. This idea is the same as using one's RSA public
@@ -104,7 +104,7 @@ with TLS (using the
104
104
mechanism), it receives a certificate from the client during the initial TLS handshake, extracts the subject name, which
105
105
MongoDB will consider a username, and performs the cryptographic handshake. If the handshake succeeds, then the server
106
106
will note that the client proved ownership of the presented certificate. The authentication logic happens in the
107
- [ ` authX509 ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/client/authenticate.cpp#L127 ) function, although
107
+ [ ` authX509 ` ] ( https://github.com/mongodb/mongo/blob/master/src/mongo/client/authenticate.cpp#L135-L147 ) function, although
108
108
there are many callers of this function that use it in different ways. Later, when that client tries to authenticate,
109
109
the server will know that the previous TLS handshake has proved their authenticity, and will grant themm the appropriate
110
110
access rights.
0 commit comments