Skip to content

[cleanup][broker] Deduplicate test certificates to simplify management #21741

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
horizonzy wants to merge 1 commit into from
Closed

[cleanup][broker] Deduplicate test certificates to simplify management #21741

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 17 additions & 21 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/AdminApiTlsAuthTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,19 +65,15 @@
@Test(groups = "broker-admin")
public class AdminApiTlsAuthTest extends MockedPulsarServiceBaseTest {

private static String getTLSFile(String name) {
return String.format("./src/test/resources/authentication/tls-http/%s.pem", name);
}

@BeforeMethod
@Override
public void setup() throws Exception {
conf.setLoadBalancerEnabled(true);
conf.setBrokerServicePortTls(Optional.of(0));
conf.setWebServicePortTls(Optional.of(0));
conf.setTlsCertificateFilePath(getTLSFile("broker.cert"));
conf.setTlsKeyFilePath(getTLSFile("broker.key-pk8"));
conf.setTlsTrustCertsFilePath(getTLSFile("ca.cert"));
conf.setTlsCertificateFilePath(BROKER_CERT_FILE_PATH);
conf.setTlsKeyFilePath(BROKER_KEY_FILE_PATH);
conf.setTlsTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setAuthenticationEnabled(true);
conf.setAuthenticationProviders(
Set.of("org.apache.pulsar.broker.authentication.AuthenticationProviderTls"));
Expand All @@ -87,8 +83,8 @@ public void setup() throws Exception {

conf.setBrokerClientAuthenticationPlugin("org.apache.pulsar.client.impl.auth.AuthenticationTls");
conf.setBrokerClientAuthenticationParameters(
String.format("tlsCertFile:%s,tlsKeyFile:%s", getTLSFile("admin.cert"), getTLSFile("admin.key-pk8")));
conf.setBrokerClientTrustCertsFilePath(getTLSFile("ca.cert"));
String.format("tlsCertFile:%s,tlsKeyFile:%s", getTlsFileForClient("admin.cert"), getTlsFileForClient("admin.key-pk8")));
conf.setBrokerClientTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setBrokerClientTlsEnabled(true);
conf.setNumExecutorThreadPoolSize(5);

Expand All @@ -115,11 +111,11 @@ WebTarget buildWebClient(String user) throws Exception {
.register(JacksonConfigurator.class).register(JacksonFeature.class);

X509Certificate trustCertificates[] = SecurityUtility.loadCertificatesFromPemFile(
getTLSFile("ca.cert"));
CA_CERT_FILE_PATH);
SSLContext sslCtx = SecurityUtility.createSslContext(
false, trustCertificates,
SecurityUtility.loadCertificatesFromPemFile(getTLSFile(user + ".cert")),
SecurityUtility.loadPrivateKeyFromPemFile(getTLSFile(user + ".key-pk8")));
SecurityUtility.loadCertificatesFromPemFile(getTlsFileForClient(user + ".cert")),
SecurityUtility.loadPrivateKeyFromPemFile(getTlsFileForClient(user + ".key-pk8")));
clientBuilder.sslContext(sslCtx).hostnameVerifier(NoopHostnameVerifier.INSTANCE);
Client client = clientBuilder.build();

Expand All @@ -133,8 +129,8 @@ PulsarAdmin buildAdminClient(String user) throws Exception {
.serviceHttpUrl(brokerUrlTls.toString())
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(user + ".cert"), getTLSFile(user + ".key-pk8")))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(user + ".cert"), getTlsFileForClient(user + ".key-pk8")))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
}

PulsarClient buildClient(String user) throws Exception {
Expand All @@ -143,8 +139,8 @@ PulsarClient buildClient(String user) throws Exception {
.enableTlsHostnameVerification(false)
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(user + ".cert"), getTLSFile(user + ".key-pk8")))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(user + ".cert"), getTlsFileForClient(user + ".key-pk8")))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
}

@Test
Expand Down Expand Up @@ -471,20 +467,20 @@ public void testDeleteNamespace() throws Exception {
public void testCertRefreshForPulsarAdmin() throws Exception {
String adminUser = "admin";
String user2 = "user1";
File keyFile = new File(getTLSFile("temp" + ".key-pk8"));
File keyFile = File.createTempFile("temp", ".key-pk8");
Path keyFilePath = Paths.get(keyFile.getAbsolutePath());
int autoCertRefreshTimeSec = 1;
try {
Files.copy(Paths.get(getTLSFile(user2 + ".key-pk8")), keyFilePath, StandardCopyOption.REPLACE_EXISTING);
Files.copy(Paths.get(getTlsFileForClient(user2 + ".key-pk8")), keyFilePath, StandardCopyOption.REPLACE_EXISTING);
PulsarAdmin admin = PulsarAdmin.builder()
.allowTlsInsecureConnection(false)
.enableTlsHostnameVerification(false)
.serviceHttpUrl(brokerUrlTls.toString())
.autoCertRefreshTime(autoCertRefreshTimeSec, TimeUnit.SECONDS)
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(adminUser + ".cert"), keyFile))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(adminUser + ".cert"), keyFile))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
// try to call admin-api which should fail due to incorrect key-cert
try {
admin.tenants().createTenant("tenantX",
Expand All @@ -496,7 +492,7 @@ public void testCertRefreshForPulsarAdmin() throws Exception {
// replace correct key file
Files.delete(keyFile.toPath());
Thread.sleep(2 * autoCertRefreshTimeSec * 1000);
Files.copy(Paths.get(getTLSFile(adminUser + ".key-pk8")), keyFilePath);
Files.copy(Paths.get(getTlsFileForClient(adminUser + ".key-pk8")), keyFilePath);
MutableBoolean success = new MutableBoolean(false);
retryStrategically((test) -> {
try {
Expand Down
18 changes: 7 additions & 11 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/BrokerAdminClientTlsAuthTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,6 @@ public void beforeMethod(Method m) throws Exception {
methodName = m.getName();
}

private static String getTLSFile(String name) {
return String.format("./src/test/resources/authentication/tls-http/%s.pem", name);
}

@BeforeMethod
@Override
public void setup() throws Exception {
Expand All @@ -63,19 +59,19 @@ public void setup() throws Exception {

private void buildConf(ServiceConfiguration conf) {
conf.setLoadBalancerEnabled(true);
conf.setTlsCertificateFilePath(getTLSFile("broker.cert"));
conf.setTlsKeyFilePath(getTLSFile("broker.key-pk8"));
conf.setTlsTrustCertsFilePath(getTLSFile("ca.cert"));
conf.setTlsCertificateFilePath(BROKER_CERT_FILE_PATH);
conf.setTlsKeyFilePath(BROKER_KEY_FILE_PATH);
conf.setTlsTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setAuthenticationEnabled(true);
conf.setSuperUserRoles(Set.of("superproxy", "broker.pulsar.apache.org"));
conf.setAuthenticationProviders(
Set.of("org.apache.pulsar.broker.authentication.AuthenticationProviderTls"));
conf.setAuthorizationEnabled(true);
conf.setBrokerClientTlsEnabled(true);
String str = String.format("tlsCertFile:%s,tlsKeyFile:%s", getTLSFile("broker.cert"), getTLSFile("broker.key-pk8"));
String str = String.format("tlsCertFile:%s,tlsKeyFile:%s", BROKER_CERT_FILE_PATH, BROKER_KEY_FILE_PATH);
conf.setBrokerClientAuthenticationParameters(str);
conf.setBrokerClientAuthenticationPlugin("org.apache.pulsar.client.impl.auth.AuthenticationTls");
conf.setBrokerClientTrustCertsFilePath(getTLSFile("ca.cert"));
conf.setBrokerClientTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setTlsAllowInsecureConnection(true);
conf.setNumExecutorThreadPoolSize(5);
}
Expand All @@ -93,8 +89,8 @@ PulsarAdmin buildAdminClient(String user) throws Exception {
.serviceHttpUrl(brokerUrlTls.toString())
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTLSFile(user + ".cert"), getTLSFile(user + ".key-pk8")))
.tlsTrustCertsFilePath(getTLSFile("ca.cert")).build();
getTlsFileForClient(user + ".cert"), getTlsFileForClient(user + ".key-pk8")))
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).build();
}

/**
Expand Down
15 changes: 15 additions & 0 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/auth/MockedPulsarServiceBaseTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,21 @@
* Base class for all tests that need a Pulsar instance without a ZK and BK cluster.
*/
public abstract class MockedPulsarServiceBaseTest extends TestRetrySupport {
// All certificate-authority files are copied from the tests/certificate-authority directory and all share the same
// root CA.
protected static String getTlsFileForClient(String name) {
return ResourceUtils.getAbsolutePath(String.format("certificate-authority/client-keys/%s.pem", name));
}
public final static String CA_CERT_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/certs/ca.cert.pem");
public final static String BROKER_CERT_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/broker.cert.pem");
public final static String BROKER_KEY_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/broker.key-pk8.pem");
public final static String PROXY_CERT_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/proxy.cert.pem");
public final static String PROXY_KEY_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/server-keys/proxy.key-pk8.pem");
public final static String BROKER_KEYSTORE_FILE_PATH =
ResourceUtils.getAbsolutePath("certificate-authority/jks/broker.keystore.jks");
public final static String BROKER_TRUSTSTORE_FILE_PATH =
Expand Down
26 changes: 0 additions & 26 deletions pulsar-broker/src/test/resources/authentication/tls-http/admin.cert.pem
View file
Open in desktop

This file was deleted.

28 changes: 0 additions & 28 deletions pulsar-broker/src/test/resources/authentication/tls-http/admin.key-pk8.pem
View file
Open in desktop

This file was deleted.

27 changes: 0 additions & 27 deletions pulsar-broker/src/test/resources/authentication/tls-http/broker.cert.pem
View file
Open in desktop

This file was deleted.

28 changes: 0 additions & 28 deletions pulsar-broker/src/test/resources/authentication/tls-http/broker.key-pk8.pem
View file
Open in desktop

This file was deleted.

29 changes: 0 additions & 29 deletions pulsar-broker/src/test/resources/authentication/tls-http/ca.cert.pem
View file
Open in desktop

This file was deleted.

Loading