Support SSL parameters (#127)

[ajdavis]

No description provided.

[ajdavis]

mlaunch init --help now includes:

SSL Options:
  --sslCAFile SSLCAFILE
                        Certificate Authority file for SSL
  --sslCRLFile SSLCRLFILE
                        Certificate Revocation List file for SSL
  --sslAllowInvalidHostnames
                        allow client and server certificates to provide non-
                        matching hostnames
  --sslAllowInvalidCertificates
                        allow client or server connections with invalid
                        certificates

Server SSL Options:
  --sslOnNormalPorts    use ssl on configured ports
  --sslMode {disabled,allowSSL,preferSSL,requireSSL}
                        set the SSL operation mode
  --sslPEMKeyFile SSLPEMKEYFILE
                        PEM file for ssl
  --sslPEMKeyPassword SSLPEMKEYPASSWORD
                        PEM file password
  --sslClusterFile SSLCLUSTERFILE
                        key file for internal SSL authentication
  --sslClusterPassword SSLCLUSTERPASSWORD
                        internal authentication key file password
  --sslDisabledProtocols SSLDISABLEDPROTOCOLS
                        comma separated list of TLS protocols to disable
                        [TLS1_0,TLS1_1,TLS1_2]
  --sslWeakCertificateValidation
                        allow client to connect without presenting a
                        certificate
  --sslAllowConnectionsWithoutCertificates
                        allow client to connect without presenting a
                        certificate
  --sslFIPSMode         activate FIPS 140-2 mode

Client SSL Options:
  --sslClientCertificate SSLCLIENTCERTIFICATE
                        client certificate file for ssl
  --sslClientPEMKeyFile SSLCLIENTPEMKEYFILE
                        client PEM file for ssl
  --sslClientPEMKeyPassword SSLCLIENTPEMKEYPASSWORD
                        client PEM file password

[ajdavis]

Since the imports are changing, I'm taking the opportunity to fix their style.

[ajdavis]

All the MongoConnection calls need SSL options so I'm refactoring.

[kevinadi]

Thanks for the PR Jessie. We've been looking forward to adding SSL support to mlaunch 👍

I found a peculiar issue, though. It seems that mlaunch cannot register nodes are up and running if I use requireSSL, and thus mlaunch stop won't stop anything. This doesn't seem to happen if I use preferSSL or allowSSL This is what I see:

$ mlaunch init --replicaset --sslMode preferSSL --sslCAFile ca.crt --sslPEMKeyFile server.pem --sslClientCertificate client.pem
launching: mongod on port 27017
launching: mongod on port 27018
launching: mongod on port 27019
replica set 'replset' initialized.

$ mlaunch list

PROCESS    PORT     STATUS     PID

mongod     27017    running    66871
mongod     27018    running    66874
mongod     27019    running    66877

However, using requireSSL:

$ mlaunch init --replicaset --sslMode requireSSL --sslCAFile ca.crt --sslPEMKeyFile server.pem --sslClientCertificate client.pem
launching: mongod on port 27017
launching: mongod on port 27018
launching: mongod on port 27019
replica set 'replset' initialized.

$ mlaunch list

PROCESS    PORT     STATUS    PID

mongod     27017    down      -
mongod     27018    down      -
mongod     27019    down      -

Could you confirm that you're seeing the same behaviour? Sorry I can't dig deeper into the cause at the moment, but I'll be happy to help you with this.

Kevin

[ajdavis]

Thanks for testing this! I added a commit that fixes the issue with "list". mlaunch hadn't been using the loaded SSL client parameters to connect to the servers and check them.

[kevinadi]

lgtm