Skip to content

Commit

Permalink
[cleanup] Deduplicate test certificates to simplify management (#20289)
Browse files Browse the repository at this point in the history
  • Loading branch information
@michaeljmarshall
michaeljmarshall authored May 10, 2023
1 parent fb9c4d0 commit 96367e1
Show file tree
Hide file tree
Showing 29 changed files with 64 additions and 712 deletions.
38 changes: 17 additions & 21 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/AdminApiTlsAuthTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,19 +65,15 @@
@Test(groups = "broker-admin")
public class AdminApiTlsAuthTest extends MockedPulsarServiceBaseTest {

private static String getTLSFile(String name) {
return String.format("./src/test/resources/authentication/tls-http/%s.pem", name);
}

@BeforeMethod
@Override
public void setup() throws Exception {
conf.setLoadBalancerEnabled(true);
conf.setBrokerServicePortTls(Optional.of(0));
conf.setWebServicePortTls(Optional.of(0));
conf.setTlsCertificateFilePath(getTLSFile("broker.cert"));
conf.setTlsKeyFilePath(getTLSFile("broker.key-pk8"));
conf.setTlsTrustCertsFilePath(getTLSFile("ca.cert"));
conf.setTlsCertificateFilePath(BROKER_CERT_FILE_PATH);
conf.setTlsKeyFilePath(BROKER_KEY_FILE_PATH);
conf.setTlsTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setAuthenticationEnabled(true);
conf.setAuthenticationProviders(
Set.of("org.apache.pulsar.broker.authentication.AuthenticationProviderTls"));
Expand All @@ -87,8 +83,8 @@ public void setup() throws Exception {

conf.setBrokerClientAuthenticationPlugin("org.apache.pulsar.client.impl.auth.AuthenticationTls");
conf.setBrokerClientAuthenticationParameters(
String.format("tlsCertFile:%s,tlsKeyFile:%s", getTLSFile("admin.cert"), getTLSFile("admin.key-pk8")));
conf.setBrokerClientTrustCertsFilePath(getTLSFile("ca.cert"));
String.format("tlsCertFile:%s,tlsKeyFile:%s", getTlsFileForClient("admin.cert"), getTlsFileForClient("admin.key-pk8")));
conf.setBrokerClientTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setBrokerClientTlsEnabled(true);
conf.setNumExecutorThreadPoolSize(5);

Expand All @@ -115,11 +111,11 @@ WebTarget buildWebClient(String user) throws Exception {
.register(JacksonConfigurator.class).register(JacksonFeature.class);

X509Certificate trustCertificates[] = SecurityUtility.loadCertificatesFromPemFile(
getTLSFile("ca.cert"));
CA_CERT_FILE_PATH);
SSLContext sslCtx = SecurityUtility.createSslContext(
false, trustCertificates,
SecurityUtility.loadCertificatesFromPemFile(getTLSFile(user + ".cert")),
SecurityUtility.loadPrivateKeyFromPemFile(getTLSFile(user + ".key-pk8")));
SecurityUtility.loadCertificatesFromPemFile(getTlsFileForClient(user + ".cert")),
SecurityUtility.loadPrivateKeyFromPemFile(getTlsFileForClient(user + ".key-pk8")));
clientBuilder.sslContext(sslCtx).hostnameVerifier(NoopHostnameVerifier.INSTANCE);
Client client = clientBuilder.build();

Expand All @@ -133,8 +129,8 @@ PulsarAdmin buildAdminClient(String user) throws Exception {
.serviceHttpUrl(brokerUrlTls.toString())
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(user + ".cert"), getTLSFile(user + ".key-pk8")))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(user + ".cert"), getTlsFileForClient(user + ".key-pk8")))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
}

PulsarClient buildClient(String user) throws Exception {
Expand All @@ -143,8 +139,8 @@ PulsarClient buildClient(String user) throws Exception {
.enableTlsHostnameVerification(false)
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(user + ".cert"), getTLSFile(user + ".key-pk8")))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(user + ".cert"), getTlsFileForClient(user + ".key-pk8")))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
}

@Test
Expand Down Expand Up @@ -471,20 +467,20 @@ public void testDeleteNamespace() throws Exception {
public void testCertRefreshForPulsarAdmin() throws Exception {
String adminUser = "admin";
String user2 = "user1";
File keyFile = new File(getTLSFile("temp" + ".key-pk8"));
File keyFile = File.createTempFile("temp", ".key-pk8");
Path keyFilePath = Paths.get(keyFile.getAbsolutePath());
int autoCertRefreshTimeSec = 1;
try {
Files.copy(Paths.get(getTLSFile(user2 + ".key-pk8")), keyFilePath, StandardCopyOption.REPLACE_EXISTING);
Files.copy(Paths.get(getTlsFileForClient(user2 + ".key-pk8")), keyFilePath, StandardCopyOption.REPLACE_EXISTING);
PulsarAdmin admin = PulsarAdmin.builder()
.allowTlsInsecureConnection(false)
.enableTlsHostnameVerification(false)
.serviceHttpUrl(brokerUrlTls.toString())
.autoCertRefreshTime(autoCertRefreshTimeSec, TimeUnit.SECONDS)
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(adminUser + ".cert"), keyFile))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(adminUser + ".cert"), keyFile))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
// try to call admin-api which should fail due to incorrect key-cert
try {
admin.tenants().createTenant("tenantX",
Expand All @@ -496,7 +492,7 @@ public void testCertRefreshForPulsarAdmin() throws Exception {
// replace correct key file
Files.delete(keyFile.toPath());
Thread.sleep(2 * autoCertRefreshTimeSec * 1000);
Files.copy(Paths.get(getTLSFile(adminUser + ".key-pk8")), keyFilePath);
Files.copy(Paths.get(getTlsFileForClient(adminUser + ".key-pk8")), keyFilePath);
MutableBoolean success = new MutableBoolean(false);
retryStrategically((test) -> {
try {
Expand Down
18 changes: 7 additions & 11 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/BrokerAdminClientTlsAuthTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,6 @@ public void beforeMethod(Method m) throws Exception {
methodName = m.getName();
}

private static String getTLSFile(String name) {
return String.format("./src/test/resources/authentication/tls-http/%s.pem", name);
}

@BeforeMethod
@Override
public void setup() throws Exception {
Expand All @@ -63,19 +59,19 @@ public void setup() throws Exception {

private void buildConf(ServiceConfiguration conf) {
conf.setLoadBalancerEnabled(true);
conf.setTlsCertificateFilePath(getTLSFile("broker.cert"));
conf.setTlsKeyFilePath(getTLSFile("broker.key-pk8"));
conf.setTlsTrustCertsFilePath(getTLSFile("ca.cert"));
conf.setTlsCertificateFilePath(BROKER_CERT_FILE_PATH);
conf.setTlsKeyFilePath(BROKER_KEY_FILE_PATH);
conf.setTlsTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setAuthenticationEnabled(true);
conf.setSuperUserRoles(Set.of("superproxy", "broker.pulsar.apache.org"));
conf.setAuthenticationProviders(
Set.of("org.apache.pulsar.broker.authentication.AuthenticationProviderTls"));
conf.setAuthorizationEnabled(true);
conf.setBrokerClientTlsEnabled(true);
String str = String.format("tlsCertFile:%s,tlsKeyFile:%s", getTLSFile("broker.cert"), getTLSFile("broker.key-pk8"));
String str = String.format("tlsCertFile:%s,tlsKeyFile:%s", BROKER_CERT_FILE_PATH, BROKER_KEY_FILE_PATH);
conf.setBrokerClientAuthenticationParameters(str);
conf.setBrokerClientAuthenticationPlugin("org.apache.pulsar.client.impl.auth.AuthenticationTls");
conf.setBrokerClientTrustCertsFilePath(getTLSFile("ca.cert"));
conf.setBrokerClientTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setTlsAllowInsecureConnection(true);
conf.setNumExecutorThreadPoolSize(5);
}
Expand All @@ -93,8 +89,8 @@ PulsarAdmin buildAdminClient(String user) throws Exception {
.serviceHttpUrl(brokerUrlTls.toString())
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(user + ".cert"), getTLSFile(user + ".key-pk8")))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(user + ".cert"), getTlsFileForClient(user + ".key-pk8")))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
}

/**
Expand Down
15 changes: 15 additions & 0 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/auth/MockedPulsarServiceBaseTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,21 @@
* Base class for all tests that need a Pulsar instance without a ZK and BK cluster.
*/
public abstract class MockedPulsarServiceBaseTest extends TestRetrySupport {
// All certificate-authority files are copied from the tests/certificate-authority directory and all share the same
// root CA.
protected static String getTlsFileForClient(String name) {
return ResourceUtils.getAbsolutePath(String.format("certificate-authority/client-keys/%s.pem", name));
}
public final static String CA_CERT_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/certs/ca.cert.pem");
public final static String BROKER_CERT_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/broker.cert.pem");
public final static String BROKER_KEY_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/broker.key-pk8.pem");
public final static String PROXY_CERT_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/proxy.cert.pem");
public final static String PROXY_KEY_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/proxy.key-pk8.pem");
public final static String BROKER_KEYSTORE_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/jks/broker.keystore.jks");
public final static String BROKER_TRUSTSTORE_FILE_PATH =
Expand Down
26 changes: 0 additions & 26 deletions pulsar-broker/src/test/resources/authentication/tls-http/admin.cert.pem
View file

This file was deleted.

28 changes: 0 additions & 28 deletions pulsar-broker/src/test/resources/authentication/tls-http/admin.key-pk8.pem
View file

This file was deleted.

27 changes: 0 additions & 27 deletions pulsar-broker/src/test/resources/authentication/tls-http/broker.cert.pem
View file

This file was deleted.

28 changes: 0 additions & 28 deletions pulsar-broker/src/test/resources/authentication/tls-http/broker.key-pk8.pem
View file

This file was deleted.

29 changes: 0 additions & 29 deletions pulsar-broker/src/test/resources/authentication/tls-http/ca.cert.pem
View file

This file was deleted.

Loading

0 comments on commit 96367e1

Please sign in to comment.