@@ -29,6 +29,7 @@ import (
2929 "go.mongodb.org/mongo-driver/v2/internal/httputil"
3030 "go.mongodb.org/mongo-driver/v2/internal/optionsutil"
3131 "go.mongodb.org/mongo-driver/v2/internal/ptrutil"
32+ "go.mongodb.org/mongo-driver/v2/internal/require"
3233 "go.mongodb.org/mongo-driver/v2/mongo/readconcern"
3334 "go.mongodb.org/mongo-driver/v2/mongo/readpref"
3435 "go.mongodb.org/mongo-driver/v2/mongo/writeconcern"
@@ -81,6 +82,7 @@ func TestClientOptions(t *testing.T) {
8182 {"TLSConfig" , (* ClientOptions ).SetTLSConfig , & tls.Config {}, "TLSConfig" , false },
8283 {"WriteConcern" , (* ClientOptions ).SetWriteConcern , writeconcern .Majority (), "WriteConcern" , false },
8384 {"ZlibLevel" , (* ClientOptions ).SetZlibLevel , 6 , "ZlibLevel" , true },
85+ {"DisableCertificateRevocationCheck" , (* ClientOptions ).SetDisableCertificateRevocationCheck , true , "DisableCertificateRevocationCheck" , true },
8486 {"DisableOCSPEndpointCheck" , (* ClientOptions ).SetDisableOCSPEndpointCheck , true , "DisableOCSPEndpointCheck" , true },
8587 {"LoadBalanced" , (* ClientOptions ).SetLoadBalanced , true , "LoadBalanced" , true },
8688 }
@@ -1086,6 +1088,23 @@ func TestApplyURI(t *testing.T) {
10861088 "along with tlsCertificateFile or tlsPrivateKeyFile" )),
10871089 },
10881090 },
1091+ {
1092+ name : "disable certificate revocation check" ,
1093+ uri : "mongodb://localhost/?tlsDisableCertificateRevocationCheck=true" ,
1094+ wantopts : & ClientOptions {
1095+ Hosts : []string {"localhost" },
1096+ DisableCertificateRevocationCheck : ptrutil.Ptr [bool ](true ),
1097+ err : nil ,
1098+ },
1099+ },
1100+ {
1101+ name : "disable certificate revocation check conflicts with tlsInsecure" ,
1102+ uri : "mongodb://localhost/?tlsInsecure=false&tlsDisableCertificateRevocationCheck=false" ,
1103+ wantopts : & ClientOptions {
1104+ err : errors .New ("error validating uri: " +
1105+ "sslInsecure/tlsInsecure cannot be used with tlsDisableCertificateRevocationCheck" ),
1106+ },
1107+ },
10891108 {
10901109 name : "disable OCSP endpoint check" ,
10911110 uri : "mongodb://localhost/?tlsDisableOCSPEndpointCheck=true" ,
@@ -1286,3 +1305,95 @@ func TestApplyURI(t *testing.T) {
12861305 })
12871306 }
12881307}
1308+
1309+ func TestValidateDisableCertificateRevocationCheck (t * testing.T ) {
1310+ const (
1311+ insecureURI = "mongodb://localhost/?tlsInsecure=%t"
1312+ endpointCheckURI = "mongodb://localhost/?tlsDisableOCSPEndpointCheck=%t"
1313+
1314+ insecureMsg = "sslInsecure/tlsInsecure cannot be used with tlsDisableCertificateRevocationCheck"
1315+ endpointMsg = "tlsDisableOCSPEndpointCheck cannot be used with tlsDisableCertificateRevocationCheck"
1316+ )
1317+
1318+ // Paths that connstring cannot cover, because the conflicting options are not both supplied
1319+ // through a URI. Validate inspects the final state, so both orderings are included.
1320+ conflicts := []struct {
1321+ name string
1322+ opts * ClientOptions
1323+ wantErr string
1324+ }{
1325+ {
1326+ name : "setters, both true" ,
1327+ opts : Client ().SetDisableOCSPEndpointCheck (true ).SetDisableCertificateRevocationCheck (true ),
1328+ wantErr : endpointMsg ,
1329+ },
1330+ {
1331+ // Presence is what conflicts, not the values.
1332+ name : "setters, both false" ,
1333+ opts : Client ().SetDisableOCSPEndpointCheck (false ).SetDisableCertificateRevocationCheck (false ),
1334+ wantErr : endpointMsg ,
1335+ },
1336+ {
1337+ name : "setters, reversed order" ,
1338+ opts : Client ().SetDisableCertificateRevocationCheck (true ).SetDisableOCSPEndpointCheck (false ),
1339+ wantErr : endpointMsg ,
1340+ },
1341+ {
1342+ name : "InsecureSkipVerify via TLSConfig" ,
1343+ opts : Client ().
1344+ SetTLSConfig (& tls.Config {InsecureSkipVerify : true }).
1345+ SetDisableCertificateRevocationCheck (true ),
1346+ wantErr : insecureMsg ,
1347+ },
1348+ {
1349+ name : "URI tlsInsecure=true then setter" ,
1350+ opts : Client ().ApplyURI (fmt .Sprintf (insecureURI , true )).SetDisableCertificateRevocationCheck (true ),
1351+ wantErr : insecureMsg ,
1352+ },
1353+ {
1354+ // tlsInsecure=false leaves InsecureSkipVerify false, so this is only detectable
1355+ // through the connection string.
1356+ name : "URI tlsInsecure=false then setter" ,
1357+ opts : Client ().ApplyURI (fmt .Sprintf (insecureURI , false )).SetDisableCertificateRevocationCheck (true ),
1358+ wantErr : insecureMsg ,
1359+ },
1360+ {
1361+ name : "setter then URI tlsInsecure=true" ,
1362+ opts : Client ().SetDisableCertificateRevocationCheck (true ).ApplyURI (fmt .Sprintf (insecureURI , true )),
1363+ wantErr : insecureMsg ,
1364+ },
1365+ {
1366+ name : "URI tlsDisableOCSPEndpointCheck then setter" ,
1367+ opts : Client ().ApplyURI (fmt .Sprintf (endpointCheckURI , true )).SetDisableCertificateRevocationCheck (true ),
1368+ wantErr : endpointMsg ,
1369+ },
1370+ }
1371+
1372+ for _ , tc := range conflicts {
1373+ t .Run (tc .name , func (t * testing.T ) {
1374+ err := tc .opts .Validate ()
1375+ require .EqualError (t , err , tc .wantErr )
1376+ })
1377+ }
1378+
1379+ allowed := []struct {
1380+ name string
1381+ opts * ClientOptions
1382+ }{
1383+ {"option alone" , Client ().SetDisableCertificateRevocationCheck (true )},
1384+ {"option alone, set to false" , Client ().SetDisableCertificateRevocationCheck (false )},
1385+ {
1386+ "option with a TLSConfig that does not skip verification" ,
1387+ Client ().SetTLSConfig (& tls.Config {}).SetDisableCertificateRevocationCheck (true ),
1388+ },
1389+ {"option via URI alone" , Client ().ApplyURI ("mongodb://localhost/?tlsDisableCertificateRevocationCheck=true" )},
1390+ {"tlsInsecure alone" , Client ().ApplyURI (fmt .Sprintf (insecureURI , true ))},
1391+ {"tlsDisableOCSPEndpointCheck alone" , Client ().ApplyURI (fmt .Sprintf (endpointCheckURI , true ))},
1392+ }
1393+
1394+ for _ , tc := range allowed {
1395+ t .Run (tc .name , func (t * testing.T ) {
1396+ require .NoError (t , tc .opts .Validate (), "expected no error" )
1397+ })
1398+ }
1399+ }
0 commit comments