Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PR 522 followup #526

Merged
merged 3 commits into from
Mar 28, 2022
Merged

PR 522 followup #526

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c1c58ef
Multi-certificate test cases
absurdfarce Mar 25, 2022
028b7c5
Fixes to the multi-cert test case
absurdfarce Mar 28, 2022
7e4d6a3
Formatting fix (to make clang-format happy)
absurdfarce Mar 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions src/ssl/ssl_openssl_impl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -560,10 +560,8 @@ CassError OpenSslContext::add_trusted_cert(const char* cert, size_t cert_length)
int num_certs = 0;

// Iterate over the bio, reading out as many certificates as possible.
for (X509* cert = PEM_read_bio_X509(bio, NULL, pem_password_callback, NULL);
cert != NULL;
cert = PEM_read_bio_X509(bio, NULL, pem_password_callback, NULL))
{
for (X509* cert = PEM_read_bio_X509(bio, NULL, pem_password_callback, NULL); cert != NULL;
cert = PEM_read_bio_X509(bio, NULL, pem_password_callback, NULL)) {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Formatting change which was leading to Jenkins build failures on PR 522. The format check was only failing on Ubuntu Bionic instances so it's worth validating that we're okay on the other platforms as well... last thing we need is to introduce a failure somewhere else via this change.

X509_STORE_add_cert(trusted_store_, cert);
X509_free(cert);
num_certs++;
Expand Down
46 changes: 46 additions & 0 deletions tests/src/integration/ssl_certificates.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,22 @@ namespace test {
* ssh-keygen -p \
* -N invalid \
* -f ssl/invalid/driver-private-invalid.pem
*
* # Building dummy PEM. Some tests below require multiple PEM-encoded
* # certs in order to verify that we consider all input certs (and
* # not just the first one)
* keytool -genkeypair -noprompt -keyalg RSA -validity 36500 \
* -alias dummy \
* -keystore ssl/keystore.jks \
* -storepass cassandra \
* -keypass cassandra \
* -dname "CN=1.2.3.4, OU=SomeOU, O=SomeO, L=Somewhere, ST=SomeState, C=US"
*
* keytool -exportcert -rfc -noprompt \
* -alias dummy \
* -keystore ssl/keystore.jks \
* -storepass cassandra \
* -file ssl/dummy.pem
*/

static const unsigned char cassandra_crt[953] = {
Expand Down Expand Up @@ -557,6 +573,36 @@ class SslCertificates {
"cAHazCFHOKxSQ/G7n+8xDx3r6jHxyE956u5jf5FRqUbaVIBMdg==\12"
"-----END CERTIFICATE-----\12";
}
static const char* dummy_pem() {
return "-----BEGIN CERTIFICATE-----\12"
"MIIDcTCCAlmgAwIBAgIEKDL8hDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJV\12"
"UzESMBAGA1UECBMJU29tZVN0YXRlMRIwEAYDVQQHEwlTb21ld2hlcmUxDjAMBgNV\12"
"BAoTBVNvbWVPMQ8wDQYDVQQLEwZTb21lT1UxEDAOBgNVBAMTBzEuMi4zLjQwIBcN\12"
"MjIwMzI1MjAzNzM3WhgPMjEyMjAzMDEyMDM3MzdaMGgxCzAJBgNVBAYTAlVTMRIw\12"
"EAYDVQQIEwlTb21lU3RhdGUxEjAQBgNVBAcTCVNvbWV3aGVyZTEOMAwGA1UEChMF\12"
"U29tZU8xDzANBgNVBAsTBlNvbWVPVTEQMA4GA1UEAxMHMS4yLjMuNDCCASIwDQYJ\12"
"KoZIhvcNAQEBBQADggEPADCCAQoCggEBAIEmKUqWeRb9WGFLjE4OVOC99643Xz2s\12"
"BahaHpoEvUW7r0gO6BxQ6b6KkiZbs5OfqX4MYheEUePQq3v2OJ1nAUTSiXDwCOUq\12"
"3ZhS9CS4NlNaIqF4MIoPxaQYqG3jhUB/fNkg9o4DgrH0DmnGd6Mgw2/hUvNGq8IW\12"
"JdlMgZGnX2cIhGQ0Cu/HV372IoYNotGEncyJEg/0ZiJDUyTWV91WoRY767GqIxn/\12"
"lROrsiTzF/xzqcBdOCaMWP3et3X+jrk/i2957mw7bYYRuD415/pHlQqQQItkrmip\12"
"uHJXHF8Ah0blqvFeUsBNMmzIAZblbLBbnc27tbqzUkRRjtR59suExukCAwEAAaMh\12"
"MB8wHQYDVR0OBBYEFCECHg0GKw4U7/NSdq7QmEXgLydVMA0GCSqGSIb3DQEBCwUA\12"
"A4IBAQAz5CAdtEcTa830ClNmR/FRLi0OkjmBd2neylflvQcpoMP/26vkdcf+5JqH\12"
"+WRemkv5X7BgkdAyiQcQXal33i7ykPFjYzH0myMfknIFvmuxexgBth0cPFOsZw3x\12"
"ouQSEkvVuR4q8hW77o9um0e61cTI5Qi6oToA1VXTzkwu8tcY4JcFkgskf4xRX9Qf\12"
"VhuoLllozdhjShd8abWvYdZZEX3EdNVjMHWojPgEvgQzjKOOMz+EbT8YsF9+Nu1p\12"
"INYMLWZ/2KDTcKOHEF2E0YbCbxiSEi32tjD40u39XcidA7vh0w9bHEujeqdQa9fs\12"
"LDeLr91cBnfxzH8fxEj4iMkyV7gj\12"
"-----END CERTIFICATE-----\12";
}
static const char* multi_cert_pem() {
std::string combo = dummy_pem();
combo.append("\n");
combo.append(cassandra_pem());
return combo.c_str();
}

static const char* driver_private_pem_password() { return "driver"; }

static void write_ccm_server_files() {
Expand Down
16 changes: 16 additions & 0 deletions tests/src/integration/tests/test_ssl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,22 @@ CASSANDRA_INTEGRATION_TEST_F(SslTests, VerifyPeerIdentity) {
write_and_read();
}

/**
* Ensures SSL connection verifying peer/server certificate while performing write and read
* operations.
*/
CASSANDRA_INTEGRATION_TEST_F(SslTests, VerifyPeerMultipleCerts) {
CHECK_FAILURE;

Ssl ssl;
ssl.with_verify_flags(CASS_SSL_VERIFY_PEER_CERT);
ssl.add_trusted_cert(SslCertificates::multi_cert_pem());

Cluster cluster = default_cluster().with_ssl(ssl);
connect(cluster);
write_and_read();
}
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Simple integration test for the functionality added in PR 522.


/**
* Ensures that when one node (in this case the whole cluster) is terminated and restarted the
* driver will reconnect without throwing errors. Each stage (connect and reconnect) write and read
Expand Down