mirror of https://github.com/grpc/grpc.git
ZhenLian
4 years ago
parent
e6e6be4b0b
commit
d74e43da95
26 changed files with 1949 additions and 147 deletions
@ -0,0 +1,509 @@ |
|||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
|
||||||
|
#include "src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h" |
||||||
|
|
||||||
|
#include <gmock/gmock.h> |
||||||
|
|
||||||
|
#include <grpc/support/alloc.h> |
||||||
|
#include <grpc/support/log.h> |
||||||
|
#include <grpc/support/string_util.h> |
||||||
|
#include <gtest/gtest.h> |
||||||
|
|
||||||
|
#include <deque> |
||||||
|
#include <list> |
||||||
|
|
||||||
|
#include "src/core/lib/gpr/tmpfile.h" |
||||||
|
#include "src/core/lib/iomgr/load_file.h" |
||||||
|
#include "src/core/lib/slice/slice_internal.h" |
||||||
|
#include "test/core/security/tls_utils.h" |
||||||
|
#include "test/core/util/test_config.h" |
||||||
|
|
||||||
|
#define CA_CERT_PATH "src/core/tsi/test_creds/ca.pem" |
||||||
|
#define SERVER_CERT_PATH "src/core/tsi/test_creds/server1.pem" |
||||||
|
#define SERVER_KEY_PATH "src/core/tsi/test_creds/server1.key" |
||||||
|
#define CA_CERT_PATH_2 "src/core/tsi/test_creds/multi-domain.pem" |
||||||
|
#define SERVER_CERT_PATH_2 "src/core/tsi/test_creds/server0.pem" |
||||||
|
#define SERVER_KEY_PATH_2 "src/core/tsi/test_creds/server0.key" |
||||||
|
#define INVALID_PATH "invalid/path" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
namespace testing { |
||||||
|
|
||||||
|
constexpr const char* kCertName = "cert_name"; |
||||||
|
constexpr const char* kRootError = "Unable to get latest root certificates."; |
||||||
|
constexpr const char* kIdentityError = |
||||||
|
"Unable to get latest identity certificates."; |
||||||
|
|
||||||
|
class GrpcTlsCertificateProviderTest : public ::testing::Test { |
||||||
|
protected: |
||||||
|
// Forward declaration.
|
||||||
|
class TlsCertificatesTestWatcher; |
||||||
|
|
||||||
|
// CredentialInfo contains the parameters when calling OnCertificatesChanged
|
||||||
|
// of a watcher. When OnCertificatesChanged is invoked, we will push a
|
||||||
|
// CredentialInfo to the cert_update_queue of state_, and check in each test
|
||||||
|
// if the status updates are correct.
|
||||||
|
struct CredentialInfo { |
||||||
|
std::string root_certs; |
||||||
|
PemKeyCertPairList key_cert_pairs; |
||||||
|
CredentialInfo(std::string root, PemKeyCertPairList key_cert) |
||||||
|
: root_certs(std::move(root)), key_cert_pairs(std::move(key_cert)) {} |
||||||
|
bool operator==(const CredentialInfo& other) const { |
||||||
|
return root_certs == other.root_certs && |
||||||
|
key_cert_pairs == other.key_cert_pairs; |
||||||
|
} |
||||||
|
}; |
||||||
|
|
||||||
|
// ErrorInfo contains the parameters when calling OnError of a watcher. When
|
||||||
|
// OnError is invoked, we will push a ErrorInfo to the error_queue of state_,
|
||||||
|
// and check in each test if the status updates are correct.
|
||||||
|
struct ErrorInfo { |
||||||
|
std::string root_cert_str; |
||||||
|
std::string identity_cert_str; |
||||||
|
ErrorInfo(std::string root, std::string identity) |
||||||
|
: root_cert_str(std::move(root)), |
||||||
|
identity_cert_str(std::move(identity)) {} |
||||||
|
bool operator==(const ErrorInfo& other) const { |
||||||
|
return root_cert_str == other.root_cert_str && |
||||||
|
identity_cert_str == other.identity_cert_str; |
||||||
|
} |
||||||
|
}; |
||||||
|
|
||||||
|
struct WatcherState { |
||||||
|
TlsCertificatesTestWatcher* watcher = nullptr; |
||||||
|
std::deque<CredentialInfo> cert_update_queue; |
||||||
|
std::deque<ErrorInfo> error_queue; |
||||||
|
Mutex mu; |
||||||
|
|
||||||
|
std::deque<CredentialInfo> GetCredentialQueue() { |
||||||
|
// We move the data member value so the data member will be re-initiated
|
||||||
|
// with size 0, and ready for the next check.
|
||||||
|
MutexLock lock(&mu); |
||||||
|
return std::move(cert_update_queue); |
||||||
|
} |
||||||
|
std::deque<ErrorInfo> GetErrorQueue() { |
||||||
|
// We move the data member value so the data member will be re-initiated
|
||||||
|
// with size 0, and ready for the next check.
|
||||||
|
MutexLock lock(&mu); |
||||||
|
return std::move(error_queue); |
||||||
|
} |
||||||
|
}; |
||||||
|
|
||||||
|
class TlsCertificatesTestWatcher : public grpc_tls_certificate_distributor:: |
||||||
|
TlsCertificatesWatcherInterface { |
||||||
|
public: |
||||||
|
// ctor sets state->watcher to this.
|
||||||
|
explicit TlsCertificatesTestWatcher(WatcherState* state) : state_(state) { |
||||||
|
state_->watcher = this; |
||||||
|
} |
||||||
|
|
||||||
|
// dtor sets state->watcher to nullptr.
|
||||||
|
~TlsCertificatesTestWatcher() override { state_->watcher = nullptr; } |
||||||
|
|
||||||
|
void OnCertificatesChanged( |
||||||
|
absl::optional<absl::string_view> root_certs, |
||||||
|
absl::optional<PemKeyCertPairList> key_cert_pairs) override { |
||||||
|
MutexLock lock(&state_->mu); |
||||||
|
std::string updated_root; |
||||||
|
if (root_certs.has_value()) { |
||||||
|
updated_root = std::string(*root_certs); |
||||||
|
} |
||||||
|
PemKeyCertPairList updated_identity; |
||||||
|
if (key_cert_pairs.has_value()) { |
||||||
|
updated_identity = std::move(*key_cert_pairs); |
||||||
|
} |
||||||
|
state_->cert_update_queue.emplace_back(std::move(updated_root), |
||||||
|
std::move(updated_identity)); |
||||||
|
} |
||||||
|
|
||||||
|
void OnError(grpc_error* root_cert_error, |
||||||
|
grpc_error* identity_cert_error) override { |
||||||
|
MutexLock lock(&state_->mu); |
||||||
|
GPR_ASSERT(root_cert_error != GRPC_ERROR_NONE || |
||||||
|
identity_cert_error != GRPC_ERROR_NONE); |
||||||
|
std::string root_error_str; |
||||||
|
std::string identity_error_str; |
||||||
|
if (root_cert_error != GRPC_ERROR_NONE) { |
||||||
|
grpc_slice root_error_slice; |
||||||
|
GPR_ASSERT(grpc_error_get_str( |
||||||
|
root_cert_error, GRPC_ERROR_STR_DESCRIPTION, &root_error_slice)); |
||||||
|
root_error_str = std::string(StringViewFromSlice(root_error_slice)); |
||||||
|
} |
||||||
|
if (identity_cert_error != GRPC_ERROR_NONE) { |
||||||
|
grpc_slice identity_error_slice; |
||||||
|
GPR_ASSERT(grpc_error_get_str(identity_cert_error, |
||||||
|
GRPC_ERROR_STR_DESCRIPTION, |
||||||
|
&identity_error_slice)); |
||||||
|
identity_error_str = |
||||||
|
std::string(StringViewFromSlice(identity_error_slice)); |
||||||
|
} |
||||||
|
state_->error_queue.emplace_back(std::move(root_error_str), |
||||||
|
std::move(identity_error_str)); |
||||||
|
GRPC_ERROR_UNREF(root_cert_error); |
||||||
|
GRPC_ERROR_UNREF(identity_cert_error); |
||||||
|
} |
||||||
|
|
||||||
|
private: |
||||||
|
WatcherState* state_; |
||||||
|
}; |
||||||
|
|
||||||
|
void SetUp() override { |
||||||
|
root_cert_ = GetFileContents(CA_CERT_PATH); |
||||||
|
cert_chain_ = GetFileContents(SERVER_CERT_PATH); |
||||||
|
private_key_ = GetFileContents(SERVER_KEY_PATH); |
||||||
|
root_cert_2_ = GetFileContents(CA_CERT_PATH_2); |
||||||
|
cert_chain_2_ = GetFileContents(SERVER_CERT_PATH_2); |
||||||
|
private_key_2_ = GetFileContents(SERVER_KEY_PATH_2); |
||||||
|
} |
||||||
|
|
||||||
|
WatcherState* MakeWatcher( |
||||||
|
RefCountedPtr<grpc_tls_certificate_distributor> distributor, |
||||||
|
absl::optional<std::string> root_cert_name, |
||||||
|
absl::optional<std::string> identity_cert_name) { |
||||||
|
MutexLock lock(&mu_); |
||||||
|
distributor_ = distributor; |
||||||
|
watchers_.emplace_back(); |
||||||
|
// TlsCertificatesTestWatcher ctor takes a pointer to the WatcherState.
|
||||||
|
// It sets WatcherState::watcher to point to itself.
|
||||||
|
// The TlsCertificatesTestWatcher dtor will set WatcherState::watcher back
|
||||||
|
// to nullptr to indicate that it's been destroyed.
|
||||||
|
auto watcher = |
||||||
|
absl::make_unique<TlsCertificatesTestWatcher>(&watchers_.back()); |
||||||
|
distributor_->WatchTlsCertificates(std::move(watcher), |
||||||
|
std::move(root_cert_name), |
||||||
|
std::move(identity_cert_name)); |
||||||
|
return &watchers_.back(); |
||||||
|
} |
||||||
|
|
||||||
|
void CancelWatch(WatcherState* state) { |
||||||
|
MutexLock lock(&mu_); |
||||||
|
distributor_->CancelTlsCertificatesWatch(state->watcher); |
||||||
|
EXPECT_EQ(state->watcher, nullptr); |
||||||
|
} |
||||||
|
|
||||||
|
std::string root_cert_; |
||||||
|
std::string private_key_; |
||||||
|
std::string cert_chain_; |
||||||
|
std::string root_cert_2_; |
||||||
|
std::string private_key_2_; |
||||||
|
std::string cert_chain_2_; |
||||||
|
RefCountedPtr<grpc_tls_certificate_distributor> distributor_; |
||||||
|
// Use a std::list<> here to avoid the address invalidation caused by internal
|
||||||
|
// reallocation of std::vector<>.
|
||||||
|
std::list<WatcherState> watchers_; |
||||||
|
// This is to make watchers_ thread-safe.
|
||||||
|
Mutex mu_; |
||||||
|
}; |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, StaticDataCertificateProviderCreation) { |
||||||
|
StaticDataCertificateProvider provider( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), cert_chain_.c_str())); |
||||||
|
// Watcher watching both root and identity certs.
|
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
// Watcher watching only root certs.
|
||||||
|
WatcherState* watcher_state_2 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, absl::nullopt); |
||||||
|
EXPECT_THAT(watcher_state_2->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo(root_cert_, {}))); |
||||||
|
CancelWatch(watcher_state_2); |
||||||
|
// Watcher watching only identity certs.
|
||||||
|
WatcherState* watcher_state_3 = |
||||||
|
MakeWatcher(provider.distributor(), absl::nullopt, kCertName); |
||||||
|
EXPECT_THAT( |
||||||
|
watcher_state_3->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
"", MakeCertKeyPairs(private_key_.c_str(), cert_chain_.c_str())))); |
||||||
|
CancelWatch(watcher_state_3); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderWithGoodPaths) { |
||||||
|
FileWatcherCertificateProvider provider(SERVER_KEY_PATH, SERVER_CERT_PATH, |
||||||
|
CA_CERT_PATH, 1); |
||||||
|
// Watcher watching both root and identity certs.
|
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
// Watcher watching only root certs.
|
||||||
|
WatcherState* watcher_state_2 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, absl::nullopt); |
||||||
|
EXPECT_THAT(watcher_state_2->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo(root_cert_, {}))); |
||||||
|
CancelWatch(watcher_state_2); |
||||||
|
// Watcher watching only identity certs.
|
||||||
|
WatcherState* watcher_state_3 = |
||||||
|
MakeWatcher(provider.distributor(), absl::nullopt, kCertName); |
||||||
|
EXPECT_THAT( |
||||||
|
watcher_state_3->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
"", MakeCertKeyPairs(private_key_.c_str(), cert_chain_.c_str())))); |
||||||
|
CancelWatch(watcher_state_3); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderWithBadPaths) { |
||||||
|
FileWatcherCertificateProvider provider(INVALID_PATH, INVALID_PATH, |
||||||
|
INVALID_PATH, 1); |
||||||
|
// Watcher watching both root and identity certs.
|
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
EXPECT_THAT(watcher_state_1->GetErrorQueue(), |
||||||
|
::testing::ElementsAre(ErrorInfo(kRootError, kIdentityError))); |
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), ::testing::ElementsAre()); |
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
// Watcher watching only root certs.
|
||||||
|
WatcherState* watcher_state_2 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, absl::nullopt); |
||||||
|
EXPECT_THAT(watcher_state_2->GetErrorQueue(), |
||||||
|
::testing::ElementsAre(ErrorInfo(kRootError, ""))); |
||||||
|
EXPECT_THAT(watcher_state_2->GetCredentialQueue(), ::testing::ElementsAre()); |
||||||
|
CancelWatch(watcher_state_2); |
||||||
|
// Watcher watching only identity certs.
|
||||||
|
WatcherState* watcher_state_3 = |
||||||
|
MakeWatcher(provider.distributor(), absl::nullopt, kCertName); |
||||||
|
EXPECT_THAT(watcher_state_3->GetErrorQueue(), |
||||||
|
::testing::ElementsAre(ErrorInfo("", kIdentityError))); |
||||||
|
EXPECT_THAT(watcher_state_3->GetCredentialQueue(), ::testing::ElementsAre()); |
||||||
|
CancelWatch(watcher_state_3); |
||||||
|
} |
||||||
|
|
||||||
|
// The following tests write credential data to temporary files to test the
|
||||||
|
// transition behavior of the provider.
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderOnBothCertsRefreshed) { |
||||||
|
// Create temporary files and copy cert data into them.
|
||||||
|
TmpFile tmp_root_cert(root_cert_); |
||||||
|
TmpFile tmp_identity_key(private_key_); |
||||||
|
TmpFile tmp_identity_cert(cert_chain_); |
||||||
|
// Create FileWatcherCertificateProvider.
|
||||||
|
FileWatcherCertificateProvider provider(tmp_identity_key.name(), |
||||||
|
tmp_identity_cert.name(), |
||||||
|
tmp_root_cert.name(), 1); |
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
// Expect to see the credential data.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
// Copy new data to files.
|
||||||
|
// TODO(ZhenLian): right now it is not completely atomic. Use the real atomic
|
||||||
|
// update when the directory renaming is added in gpr.
|
||||||
|
tmp_root_cert.RewriteFile(root_cert_2_); |
||||||
|
tmp_identity_key.RewriteFile(private_key_2_); |
||||||
|
tmp_identity_cert.RewriteFile(cert_chain_2_); |
||||||
|
// Wait 2 seconds for the provider's refresh thread to read the updated files.
|
||||||
|
gpr_sleep_until(gpr_time_add(gpr_now(GPR_CLOCK_MONOTONIC), |
||||||
|
gpr_time_from_seconds(2, GPR_TIMESPAN))); |
||||||
|
// Expect to see the new credential data.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_2_, MakeCertKeyPairs(private_key_2_.c_str(), |
||||||
|
cert_chain_2_.c_str())))); |
||||||
|
// Clean up.
|
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderOnRootCertsRefreshed) { |
||||||
|
// Create temporary files and copy cert data into them.
|
||||||
|
TmpFile tmp_root_cert(root_cert_); |
||||||
|
TmpFile tmp_identity_key(private_key_); |
||||||
|
TmpFile tmp_identity_cert(cert_chain_); |
||||||
|
// Create FileWatcherCertificateProvider.
|
||||||
|
FileWatcherCertificateProvider provider(tmp_identity_key.name(), |
||||||
|
tmp_identity_cert.name(), |
||||||
|
tmp_root_cert.name(), 1); |
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
// Expect to see the credential data.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
// Copy new data to files.
|
||||||
|
// TODO(ZhenLian): right now it is not completely atomic. Use the real atomic
|
||||||
|
// update when the directory renaming is added in gpr.
|
||||||
|
tmp_root_cert.RewriteFile(root_cert_2_); |
||||||
|
// Wait 2 seconds for the provider's refresh thread to read the updated files.
|
||||||
|
gpr_sleep_until(gpr_time_add(gpr_now(GPR_CLOCK_MONOTONIC), |
||||||
|
gpr_time_from_seconds(2, GPR_TIMESPAN))); |
||||||
|
// Expect to see the new credential data.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_2_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
// Clean up.
|
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderOnIdentityCertsRefreshed) { |
||||||
|
// Create temporary files and copy cert data into them.
|
||||||
|
TmpFile tmp_root_cert(root_cert_); |
||||||
|
TmpFile tmp_identity_key(private_key_); |
||||||
|
TmpFile tmp_identity_cert(cert_chain_); |
||||||
|
// Create FileWatcherCertificateProvider.
|
||||||
|
FileWatcherCertificateProvider provider(tmp_identity_key.name(), |
||||||
|
tmp_identity_cert.name(), |
||||||
|
tmp_root_cert.name(), 1); |
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
// Expect to see the credential data.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
// Copy new data to files.
|
||||||
|
// TODO(ZhenLian): right now it is not completely atomic. Use the real atomic
|
||||||
|
// update when the directory renaming is added in gpr.
|
||||||
|
tmp_identity_key.RewriteFile(private_key_2_); |
||||||
|
tmp_identity_cert.RewriteFile(cert_chain_2_); |
||||||
|
// Wait 2 seconds for the provider's refresh thread to read the updated files.
|
||||||
|
gpr_sleep_until(gpr_time_add(gpr_now(GPR_CLOCK_MONOTONIC), |
||||||
|
gpr_time_from_seconds(2, GPR_TIMESPAN))); |
||||||
|
// Expect to see the new credential data.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_2_.c_str(), |
||||||
|
cert_chain_2_.c_str())))); |
||||||
|
// Clean up.
|
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderWithGoodAtFirstThenDeletedBothCerts) { |
||||||
|
// Create temporary files and copy cert data into it.
|
||||||
|
auto tmp_root_cert = absl::make_unique<TmpFile>(root_cert_); |
||||||
|
auto tmp_identity_key = absl::make_unique<TmpFile>(private_key_); |
||||||
|
auto tmp_identity_cert = absl::make_unique<TmpFile>(cert_chain_); |
||||||
|
// Create FileWatcherCertificateProvider.
|
||||||
|
FileWatcherCertificateProvider provider(tmp_identity_key->name(), |
||||||
|
tmp_identity_cert->name(), |
||||||
|
tmp_root_cert->name(), 1); |
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
// The initial data is all good, so we expect to have successful credential
|
||||||
|
// updates.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
// Delete TmpFile objects, which will remove the corresponding files.
|
||||||
|
tmp_root_cert.reset(); |
||||||
|
tmp_identity_key.reset(); |
||||||
|
tmp_identity_cert.reset(); |
||||||
|
// Wait 2 seconds for the provider's refresh thread to read the deleted files.
|
||||||
|
gpr_sleep_until(gpr_time_add(gpr_now(GPR_CLOCK_MONOTONIC), |
||||||
|
gpr_time_from_seconds(2, GPR_TIMESPAN))); |
||||||
|
// Expect to see errors sent to watchers, and no credential updates.
|
||||||
|
// We have no ideas on how many errors we will receive, so we only check once.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetErrorQueue(), |
||||||
|
::testing::Contains(ErrorInfo(kRootError, kIdentityError))); |
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), ::testing::ElementsAre()); |
||||||
|
// Clean up.
|
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderWithGoodAtFirstThenDeletedRootCerts) { |
||||||
|
// Create temporary files and copy cert data into it.
|
||||||
|
auto tmp_root_cert = absl::make_unique<TmpFile>(root_cert_); |
||||||
|
TmpFile tmp_identity_key(private_key_); |
||||||
|
TmpFile tmp_identity_cert(cert_chain_); |
||||||
|
// Create FileWatcherCertificateProvider.
|
||||||
|
FileWatcherCertificateProvider provider(tmp_identity_key.name(), |
||||||
|
tmp_identity_cert.name(), |
||||||
|
tmp_root_cert->name(), 1); |
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
// The initial data is all good, so we expect to have successful credential
|
||||||
|
// updates.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
// Delete root TmpFile object, which will remove the corresponding file.
|
||||||
|
tmp_root_cert.reset(); |
||||||
|
// Wait 2 seconds for the provider's refresh thread to read the deleted files.
|
||||||
|
gpr_sleep_until(gpr_time_add(gpr_now(GPR_CLOCK_MONOTONIC), |
||||||
|
gpr_time_from_seconds(2, GPR_TIMESPAN))); |
||||||
|
// Expect to see errors sent to watchers, and no credential updates.
|
||||||
|
// We have no ideas on how many errors we will receive, so we only check once.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetErrorQueue(), |
||||||
|
::testing::Contains(ErrorInfo(kRootError, ""))); |
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), ::testing::ElementsAre()); |
||||||
|
// Clean up.
|
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(GrpcTlsCertificateProviderTest, |
||||||
|
FileWatcherCertificateProviderWithGoodAtFirstThenDeletedIdentityCerts) { |
||||||
|
// Create temporary files and copy cert data into it.
|
||||||
|
TmpFile tmp_root_cert(root_cert_); |
||||||
|
auto tmp_identity_key = absl::make_unique<TmpFile>(private_key_); |
||||||
|
auto tmp_identity_cert = absl::make_unique<TmpFile>(cert_chain_); |
||||||
|
// Create FileWatcherCertificateProvider.
|
||||||
|
FileWatcherCertificateProvider provider(tmp_identity_key->name(), |
||||||
|
tmp_identity_cert->name(), |
||||||
|
tmp_root_cert.name(), 1); |
||||||
|
WatcherState* watcher_state_1 = |
||||||
|
MakeWatcher(provider.distributor(), kCertName, kCertName); |
||||||
|
// The initial data is all good, so we expect to have successful credential
|
||||||
|
// updates.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), |
||||||
|
::testing::ElementsAre(CredentialInfo( |
||||||
|
root_cert_, MakeCertKeyPairs(private_key_.c_str(), |
||||||
|
cert_chain_.c_str())))); |
||||||
|
// Delete identity TmpFile objects, which will remove the corresponding files.
|
||||||
|
tmp_identity_key.reset(); |
||||||
|
tmp_identity_cert.reset(); |
||||||
|
// Wait 2 seconds for the provider's refresh thread to read the deleted files.
|
||||||
|
gpr_sleep_until(gpr_time_add(gpr_now(GPR_CLOCK_MONOTONIC), |
||||||
|
gpr_time_from_seconds(2, GPR_TIMESPAN))); |
||||||
|
// Expect to see errors sent to watchers, and no credential updates.
|
||||||
|
// We have no ideas on how many errors we will receive, so we only check once.
|
||||||
|
EXPECT_THAT(watcher_state_1->GetErrorQueue(), |
||||||
|
::testing::Contains(ErrorInfo("", kIdentityError))); |
||||||
|
EXPECT_THAT(watcher_state_1->GetCredentialQueue(), ::testing::ElementsAre()); |
||||||
|
// Clean up.
|
||||||
|
CancelWatch(watcher_state_1); |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace testing
|
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
int main(int argc, char** argv) { |
||||||
|
grpc::testing::TestEnvironment env(argc, argv); |
||||||
|
::testing::InitGoogleTest(&argc, argv); |
||||||
|
grpc_init(); |
||||||
|
int ret = RUN_ALL_TESTS(); |
||||||
|
grpc_shutdown(); |
||||||
|
return ret; |
||||||
|
} |
||||||
@ -0,0 +1,83 @@ |
|||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
|
||||||
|
#include "test/core/security/tls_utils.h" |
||||||
|
|
||||||
|
#include "src/core/lib/gpr/tmpfile.h" |
||||||
|
#include "src/core/lib/iomgr/load_file.h" |
||||||
|
#include "src/core/lib/slice/slice_internal.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
namespace testing { |
||||||
|
|
||||||
|
TmpFile::TmpFile(absl::string_view credential_data) { |
||||||
|
name_ = CreateTmpFileAndWriteData(credential_data); |
||||||
|
GPR_ASSERT(!name_.empty()); |
||||||
|
} |
||||||
|
|
||||||
|
TmpFile::~TmpFile() { GPR_ASSERT(remove(name_.c_str()) == 0); } |
||||||
|
|
||||||
|
void TmpFile::RewriteFile(absl::string_view credential_data) { |
||||||
|
// Create a new file containing new data.
|
||||||
|
std::string new_name = CreateTmpFileAndWriteData(credential_data); |
||||||
|
GPR_ASSERT(!new_name.empty()); |
||||||
|
// Remove the old file.
|
||||||
|
GPR_ASSERT(remove(name_.c_str()) == 0); |
||||||
|
// Rename the new file to the original name.
|
||||||
|
GPR_ASSERT(rename(new_name.c_str(), name_.c_str()) == 0); |
||||||
|
} |
||||||
|
|
||||||
|
std::string TmpFile::CreateTmpFileAndWriteData( |
||||||
|
absl::string_view credential_data) { |
||||||
|
char* name = nullptr; |
||||||
|
FILE* file_descriptor = gpr_tmpfile("GrpcTlsCertificateProviderTest", &name); |
||||||
|
GPR_ASSERT(fwrite(credential_data.data(), 1, credential_data.size(), |
||||||
|
file_descriptor) == credential_data.size()); |
||||||
|
GPR_ASSERT(fclose(file_descriptor) == 0); |
||||||
|
GPR_ASSERT(file_descriptor != nullptr); |
||||||
|
GPR_ASSERT(name != nullptr); |
||||||
|
std::string name_to_return = name; |
||||||
|
gpr_free(name); |
||||||
|
return name_to_return; |
||||||
|
} |
||||||
|
|
||||||
|
PemKeyCertPairList MakeCertKeyPairs(const char* private_key, |
||||||
|
const char* certs) { |
||||||
|
if (strcmp(private_key, "") == 0 && strcmp(certs, "") == 0) { |
||||||
|
return {}; |
||||||
|
} |
||||||
|
grpc_ssl_pem_key_cert_pair* ssl_pair = |
||||||
|
static_cast<grpc_ssl_pem_key_cert_pair*>( |
||||||
|
gpr_malloc(sizeof(grpc_ssl_pem_key_cert_pair))); |
||||||
|
ssl_pair->private_key = gpr_strdup(private_key); |
||||||
|
ssl_pair->cert_chain = gpr_strdup(certs); |
||||||
|
PemKeyCertPairList pem_key_cert_pairs; |
||||||
|
pem_key_cert_pairs.emplace_back(ssl_pair); |
||||||
|
return pem_key_cert_pairs; |
||||||
|
} |
||||||
|
|
||||||
|
std::string GetFileContents(const char* path) { |
||||||
|
grpc_slice slice = grpc_empty_slice(); |
||||||
|
GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file", grpc_load_file(path, 0, &slice))); |
||||||
|
std::string credential = std::string(StringViewFromSlice(slice)); |
||||||
|
grpc_slice_unref(slice); |
||||||
|
return credential; |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace testing
|
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
@ -0,0 +1,47 @@ |
|||||||
|
//
|
||||||
|
// Copyright 2020 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
//
|
||||||
|
|
||||||
|
#include "src/core/lib/security/security_connector/ssl_utils.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
namespace testing { |
||||||
|
|
||||||
|
class TmpFile { |
||||||
|
public: |
||||||
|
// Create a temporary file with |credential_data| written in.
|
||||||
|
explicit TmpFile(absl::string_view credential_data); |
||||||
|
|
||||||
|
~TmpFile(); |
||||||
|
|
||||||
|
const std::string& name() { return name_; } |
||||||
|
|
||||||
|
// Rewrite |credential_data| to the temporary file, in an atomic way.
|
||||||
|
void RewriteFile(absl::string_view credential_data); |
||||||
|
|
||||||
|
private: |
||||||
|
std::string CreateTmpFileAndWriteData(absl::string_view credential_data); |
||||||
|
|
||||||
|
std::string name_; |
||||||
|
}; |
||||||
|
|
||||||
|
PemKeyCertPairList MakeCertKeyPairs(const char* private_key, const char* certs); |
||||||
|
|
||||||
|
std::string GetFileContents(const char* path); |
||||||
|
|
||||||
|
} // namespace testing
|
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
Loading…
Reference in new issue