-
Notifications
You must be signed in to change notification settings - Fork 765
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Improve Integration Test by Generating TLS/mTLS Certificates via MSBu…
…ild (#5818) Co-authored-by: Piotr Kiełkowicz <[email protected]> Co-authored-by: Alan West <[email protected]>
- Loading branch information
3 people
authored
Oct 17, 2024
1 parent
cddc091
commit 0343715
Showing
9 changed files
with
238 additions
and
39 deletions.
There are no files selected for viewing
6 changes: 6 additions & 0 deletions
6
test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/IntegrationTest/.gitignore
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,9 @@ | ||
| # Self-signed cert generated by integration test | ||
| otel-collector.crt | ||
| otel-collector.key | ||
| otel-client.crt | ||
| otel-client.key | ||
| otel-untrusted-collector.crt | ||
| otel-untrusted-collector.key | ||
| certs/* | ||
| certs |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
21 changes: 0 additions & 21 deletions
21
test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/IntegrationTest/create-cert.sh
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 2 additions & 2 deletions
4
test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/IntegrationTest/run-test.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| #!/bin/bash | ||
| set -e | ||
|
|
||
| # Trust the self-signed certificated used by the collector | ||
| cp /cfg/otel-collector.crt /usr/local/share/ca-certificates/ | ||
| # Trust the self-signed certificate used by the collector | ||
| cp /cfg/certs/otel-test-ca-cert.pem /usr/local/share/ca-certificates/otel-test-ca-cert.crt | ||
| update-ca-certificates --verbose | ||
|
|
||
| dotnet test OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests.dll --TestCaseFilter:CategoryName=CollectorIntegrationTests --logger "console;verbosity=detailed" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
90 changes: 90 additions & 0 deletions
90
test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/gen_test_cert.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| using namespace System.Security.Cryptography; | ||
| using namespace System.Security.Cryptography.X509Certificates; | ||
|
|
||
| param ( | ||
| [string] $OutDir | ||
| ) | ||
|
|
||
| function Write-Certificate { | ||
| param ( | ||
| [X509Certificate2] $Cert, | ||
| [string] $Name, | ||
| [string] $Dir | ||
| ) | ||
|
|
||
| # write cert content | ||
| $certPem = $Cert.ExportCertificatePem(); | ||
| $certPemPath = Join-Path $Dir -ChildPath "$Name-cert.pem"; | ||
| [System.IO.File]::WriteAllText($certPemPath, $certPem); | ||
|
|
||
| # write pkey | ||
| [AsymmetricAlgorithm] $pkey = [RSACertificateExtensions]::GetRSAPrivateKey($Cert); | ||
| [string] $pkeyPem = $null; | ||
|
|
||
| if ($null -ne $pkey) { | ||
| $pkeyPem = $pkey.ExportRSAPrivateKeyPem(); | ||
| } | ||
|
|
||
| if ($null -eq $pkey) { | ||
| $pkey = [ECDsaCertificateExtensions]::GetECDsaPrivateKey($Cert); | ||
| $pkeyPem = $pkey.ExportECPrivateKeyPem(); | ||
| } | ||
|
|
||
| if ($null -eq $pkeyPem) { | ||
| return; | ||
| } | ||
|
|
||
|
|
||
| $pKeyPath = Join-Path $Dir -ChildPath "$Name-key.pem"; | ||
| [System.IO.File]::WriteAllText($pKeyPath, $pkeyPem); | ||
| } | ||
|
|
||
| $ca = New-SelfSignedCertificate -CertStoreLocation 'Cert:\CurrentUser\My' ` | ||
| -DnsName "otel-test-ca" ` | ||
| -NotAfter (Get-Date).AddYears(20) ` | ||
| -FriendlyName "otel-test-ca" ` | ||
| -KeyAlgorithm ECDSA_nistP256 ` | ||
| -KeyExportPolicy Exportable ` | ||
| -KeyUsageProperty All -KeyUsage CertSign, CRLSign, DigitalSignature; | ||
|
|
||
|
|
||
| try { | ||
| Write-Certificate -Cert $ca -Name "otel-test-ca" -Dir $OutDir; | ||
| $serverCert = New-SelfSignedCertificate -CertStoreLocation 'Cert:\CurrentUser\My' ` | ||
| -DnsName "otel-collector" ` | ||
| -Signer $ca ` | ||
| -NotAfter (Get-Date).AddYears(20) ` | ||
| -FriendlyName "otel-test-server" ` | ||
| -KeyAlgorithm ECDSA_nistP256 ` | ||
| -KeyUsageProperty All ` | ||
| -KeyExportPolicy Exportable ` | ||
| -KeyUsage CertSign, CRLSign, DigitalSignature ` | ||
| -TextExtension @("2.5.29.19={text}CA=1&pathlength=1", "2.5.29.37={text}1.3.6.1.5.5.7.3.1"); | ||
|
|
||
| try { | ||
| Write-Certificate -Cert $serverCert -Name "otel-test-server" -Dir $OutDir; | ||
|
|
||
| $clientCert = New-SelfSignedCertificate -CertStoreLocation 'Cert:\CurrentUser\My' ` | ||
| -DnsName "otel-test-client" ` | ||
| -Signer $ca ` | ||
| -NotAfter (Get-Date).AddYears(20) ` | ||
| -FriendlyName "otel-test-client" ` | ||
| -KeyAlgorithm ECDSA_nistP256 ` | ||
| -KeyUsageProperty All ` | ||
| -KeyExportPolicy Exportable ` | ||
| -KeyUsage CertSign, CRLSign, DigitalSignature ` | ||
| -TextExtension @("2.5.29.19={text}CA=1&pathlength=1", "2.5.29.37={text}1.3.6.1.5.5.7.3.2"); | ||
| try { | ||
| Write-Certificate -Cert $clientCert -Name "otel-test-client" -Dir $OutDir; | ||
| } | ||
| finally { | ||
| Get-Item -Path "Cert:\CurrentUser\My\$($clientCert.Thumbprint)" | Remove-Item; | ||
| } | ||
| } | ||
| finally { | ||
| Get-Item -Path "Cert:\CurrentUser\My\$($serverCert.Thumbprint)" | Remove-Item; | ||
| } | ||
| } | ||
| finally { | ||
| Get-Item -Path "Cert:\CurrentUser\My\$($ca.Thumbprint)" | Remove-Item; | ||
| } |
69 changes: 69 additions & 0 deletions
69
test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/gen_test_cert.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Set output directory, default is the current directory | ||
| OUT_DIR=${1:-"."} | ||
|
|
||
| # Create output directory if it doesn't exist | ||
| mkdir -p "$OUT_DIR" | ||
|
|
||
| # Generate CA certificate (Certificate Authority) | ||
| openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \ | ||
| -subj "/CN=otel-test-ca" \ | ||
| -keyout "$OUT_DIR/otel-test-ca-key.pem" -out "$OUT_DIR/otel-test-ca-cert.pem" | ||
|
|
||
| # Create the extension configuration file for the server certificate | ||
| cat > "$OUT_DIR/server_cert_ext.cnf" <<EOF | ||
| [ v3_req ] | ||
| basicConstraints = CA:FALSE | ||
| nsCertType = server | ||
| nsComment = "OpenSSL Generated Server Certificate" | ||
| subjectKeyIdentifier = hash | ||
| authorityKeyIdentifier = keyid,issuer:always | ||
| keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment | ||
| extendedKeyUsage = serverAuth | ||
| subjectAltName = @alt_names | ||
| [ alt_names ] | ||
| DNS.1 = otel-collector | ||
| EOF | ||
|
|
||
| # Generate server certificate private key and CSR (Certificate Signing Request) | ||
| openssl req -new -newkey rsa:2048 -sha256 -nodes \ | ||
| -keyout "$OUT_DIR/otel-test-server-key.pem" -out "$OUT_DIR/otel-test-server-csr.pem" \ | ||
| -subj "/CN=otel-collector" | ||
|
|
||
| # Sign the server certificate using the CA certificate | ||
| openssl x509 -req -in "$OUT_DIR/otel-test-server-csr.pem" \ | ||
| -extfile "$OUT_DIR/server_cert_ext.cnf" -extensions v3_req \ | ||
| -CA "$OUT_DIR/otel-test-ca-cert.pem" -CAkey "$OUT_DIR/otel-test-ca-key.pem" -CAcreateserial \ | ||
| -out "$OUT_DIR/otel-test-server-cert.pem" \ | ||
| -days 3650 -sha256 | ||
|
|
||
| # Create the extension configuration file for the client certificate | ||
| cat > "$OUT_DIR/client_cert_ext.cnf" <<EOF | ||
| [ v3_client ] | ||
| basicConstraints = CA:FALSE | ||
| nsCertType = client, email | ||
| nsComment = "OpenSSL Generated Client Certificate" | ||
| subjectKeyIdentifier = hash | ||
| authorityKeyIdentifier = keyid,issuer | ||
| keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment | ||
| extendedKeyUsage = clientAuth, emailProtection | ||
| EOF | ||
|
|
||
| # Generate client certificate private key and CSR | ||
| openssl req -new -newkey rsa:2048 -sha256 -nodes \ | ||
| -keyout "$OUT_DIR/otel-test-client-key.pem" -out "$OUT_DIR/otel-test-client-csr.pem" \ | ||
| -subj "/CN=otel-test-client" | ||
|
|
||
| # Sign the client certificate using the CA certificate | ||
| openssl x509 -req -in "$OUT_DIR/otel-test-client-csr.pem" \ | ||
| -extfile "$OUT_DIR/client_cert_ext.cnf" -extensions v3_client \ | ||
| -CA "$OUT_DIR/otel-test-ca-cert.pem" -CAkey "$OUT_DIR/otel-test-ca-key.pem" -CAcreateserial \ | ||
| -out "$OUT_DIR/otel-test-client-cert.pem" \ | ||
| -days 3650 -sha256 | ||
|
|
||
| # Generate an untrusted self-signed certificate (not signed by the CA) | ||
| openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \ | ||
| -subj "/CN=otel-untrusted-collector" \ | ||
| -keyout "$OUT_DIR/otel-untrusted-collector-key.pem" -out "$OUT_DIR/otel-untrusted-collector-cert.pem" |