-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(NODE-5985): throw Nodejs' certificate expired error when TLS fails to connect instead of CERT_HAS_EXPIRED
#4014
Merged
nbbeeken
merged 3 commits into
mongodb:main
from
baileympearson:NODE-5985-remove-dead-auth-error-code
Mar 5, 2024
Merged
fix(NODE-5985): throw Nodejs' certificate expired error when TLS fails to connect instead of CERT_HAS_EXPIRED
#4014
nbbeeken
merged 3 commits into
mongodb:main
from
baileympearson:NODE-5985-remove-dead-auth-error-code
Mar 5, 2024
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nbbeeken
added
the
Primary Review
In Review with primary reviewer, not yet ready for team's eyes
label
Mar 5, 2024
nbbeeken
requested changes
Mar 5, 2024
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Change LGTM, can you make the title and release notes reflect the bug being fixed, which I think is mainly the error message, but also that there is a cause being set to a string (while not broken, highly unexpected)
baileympearson
changed the title
fix(NODE-5985): remove
fix(NODE-5985): throw Nodejs' certificate expired error when TLS fails to connect instead of Mar 5, 2024
rejectUnauthorized
special handling in connect()CERT_HAS_EXPIRED
nbbeeken
approved these changes
Mar 5, 2024
aditi-khare-mongoDB
added a commit
that referenced
this pull request
Mar 8, 2024
synced new test files added support for error response added api docs made MongoServerError.errorResponse required + casted resulting type errors test(NODE-5992): fix env var restoration in tests (#4017) refactor(NODE-5903): add newline to stdio logging (#4018) fix(NODE-5985): throw Nodejs' certificate expired error when TLS fails to connect instead of `CERT_HAS_EXPIRED` (#4014) test(NODE-5962): gossip cluster time in utr (#4019) chore(NODE-5997): update saslprep to ^1.1.5 (#4023) feat(NODE-5968): container and Kubernetes awareness in client metadata (#4005) fix(NODE-5993): memory leak in the `Connection` class (#4022) added TODO(NODE-XXXX)
This was referenced Jun 29, 2024
This was referenced Jul 6, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
What is changing?
When enabled,
rejectUnauthorized
configures Node's TLS API to reject / error when its unable to verify the certificates of the server. This is enabled by default. When the option is enabled and Node is unabled to verify the certificates of the server, an error event is emitted. In our connect logic, this means theconnect
promise rejects.Prior to #3973, the code removed in this PR was in the connect handler (called on successful TLS connection). This was dead code because we will never receive an error that is triggered by
rejectUnauthorized
and successfully connect. When #3973 refactoredconnect()
to be async, we moved this logic into thecatch
block instead of thetry
block, so that it did run when an error occurred during TLS connection.The code throws
socket.authorizationError
instead of the caught error, which is a string value (https://nodejs.org/api/tls.html#tlssocketauthorizationerror). As a result, instead of throwing the error Nodejs gave us, we throw the authorization error property from the socket.Is there new documentation needed for these changes?
No.
What is the motivation for this change?
Release Highlight
Driver
6.3.0
included an internal refactor to the driver's TLS connection logic that introduced logic that intercepted TLS connection errors. In certain situations, the driver would erroneously throw the TLS socket'sauthorizationError
property instead of the error thrown from Nodejs' TLS API.This was observable in two ways:
certificate has expired
, the driver threw an error with the messageCERT_HAS_EXPIRED
cause
property set to a string instead of an error.The driver now correctly propagates TLS errors.
Double check the following
npm run check:lint
scripttype(NODE-xxxx)[!]: description
feat(NODE-1234)!: rewriting everything in coffeescript