Simplify SSL test to not use openssl.
I think the intent here is to just test that our SSL layers work, not invoke a long chain of keytool + openssl commands. This simplifies the build and will work on windows. Original commit: elastic/x-pack-elasticsearch@af07d0d4f7
This commit is contained in:
parent
d8e4c06522
commit
9df905ff19
|
@ -7,76 +7,8 @@ dependencies {
|
||||||
}
|
}
|
||||||
|
|
||||||
// location of keystore and files to generate it
|
// location of keystore and files to generate it
|
||||||
File ca = new File(project.buildDir, 'ca')
|
|
||||||
File caConfig = new File(ca, 'conf/caconfig.cnf')
|
|
||||||
File cert = new File(project.buildDir, 'cert/test-node.csr')
|
|
||||||
File signedCert = new File(project.buildDir, 'cert/test-node-signed.csr')
|
|
||||||
File keystore = new File(project.buildDir, 'keystore/test-node.jks')
|
File keystore = new File(project.buildDir, 'keystore/test-node.jks')
|
||||||
|
|
||||||
String caConfigData = """
|
|
||||||
[ ca ]
|
|
||||||
default_ca = CA_default
|
|
||||||
[ CA_default ]
|
|
||||||
copy_extensions = copy
|
|
||||||
serial = ${ca}/serial
|
|
||||||
database = ${ca}/index.txt
|
|
||||||
new_certs_dir = ${ca}/certs
|
|
||||||
certificate = ${ca}/certs/cacert.pem
|
|
||||||
private_key = ${ca}/private/cakey.pem
|
|
||||||
default_days = 712
|
|
||||||
default_md = sha256
|
|
||||||
preserve = no
|
|
||||||
email_in_dn = no
|
|
||||||
x509_extensions = v3_ca
|
|
||||||
name_opt = ca_default
|
|
||||||
cert_opt = ca_default
|
|
||||||
policy = policy_anything
|
|
||||||
[ policy_anything ]
|
|
||||||
countryName = optional
|
|
||||||
stateOrProvinceName = optional
|
|
||||||
localityName = optional
|
|
||||||
organizationName = optional
|
|
||||||
organizationalUnitName = optional
|
|
||||||
commonName = supplied
|
|
||||||
emailAddress = optional
|
|
||||||
[ req ]
|
|
||||||
default_bits = 2048 # Size of keys
|
|
||||||
default_keyfile = key.pem # name of generated keys
|
|
||||||
default_md = sha256 # message digest algorithm
|
|
||||||
string_mask = nombstr # permitted characters
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
req_extensions = v3_req
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
# Variable name Prompt string
|
|
||||||
#------------------------- ----------------------------------
|
|
||||||
0.organizationName = Organization Name (company)
|
|
||||||
organizationalUnitName = Organizational Unit Name (department, division)
|
|
||||||
emailAddress = Email Address
|
|
||||||
emailAddress_max = 40
|
|
||||||
localityName = Locality Name (city, district)
|
|
||||||
stateOrProvinceName = State or Province Name (full name)
|
|
||||||
countryName = Country Name (2 letter code)
|
|
||||||
countryName_min = 2
|
|
||||||
countryName_max = 2
|
|
||||||
commonName = Common Name (hostname, IP, or your name)
|
|
||||||
commonName_max = 64
|
|
||||||
# Default values for the above, for consistency and less typing.
|
|
||||||
# Variable name Value
|
|
||||||
#------------------------ ------------------------------
|
|
||||||
0.organizationName_default = Elasticsearch Test Org
|
|
||||||
localityName_default = Amsterdam
|
|
||||||
stateOrProvinceName_default = Amsterdam
|
|
||||||
countryName_default = NL
|
|
||||||
emailAddress_default = cacerttest@YOUR.COMPANY.TLD
|
|
||||||
[ v3_ca ]
|
|
||||||
basicConstraints = CA:TRUE
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
authorityKeyIdentifier = keyid:always,issuer:always
|
|
||||||
[ v3_req ]
|
|
||||||
basicConstraints = CA:FALSE
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
"""
|
|
||||||
|
|
||||||
// generate the keystore
|
// generate the keystore
|
||||||
task createKey(type: LoggedExec) {
|
task createKey(type: LoggedExec) {
|
||||||
doFirst {
|
doFirst {
|
||||||
|
@ -95,58 +27,9 @@ task createKey(type: LoggedExec) {
|
||||||
'-storepass', 'keypass'
|
'-storepass', 'keypass'
|
||||||
}
|
}
|
||||||
|
|
||||||
task createCertificate(type: LoggedExec, dependsOn: createKey) {
|
|
||||||
doFirst {
|
|
||||||
project.delete(cert.parentFile)
|
|
||||||
cert.parentFile.mkdirs()
|
|
||||||
}
|
|
||||||
executable = 'keytool'
|
|
||||||
standardInput = new ByteArrayInputStream('keypass\n'.getBytes('UTF-8'))
|
|
||||||
args '-certreq',
|
|
||||||
'-alias', 'test-node',
|
|
||||||
'-keystore', keystore,
|
|
||||||
'-file', cert,
|
|
||||||
'-keyalg', 'RSA',
|
|
||||||
'-ext', 'san=dns:localhost,ip:127.0.0.1'
|
|
||||||
}
|
|
||||||
|
|
||||||
task createCertificateAuthority(type: LoggedExec) {
|
|
||||||
doFirst {
|
|
||||||
project.delete(ca)
|
|
||||||
ca.mkdirs()
|
|
||||||
for (String dir : ['private', 'certs', 'conf']) {
|
|
||||||
new File(ca, dir).mkdirs()
|
|
||||||
}
|
|
||||||
caConfig.setText(caConfigData, 'UTF-8')
|
|
||||||
new File(ca, 'serial').setText('01', 'UTF-8')
|
|
||||||
new File(ca, 'index.txt').setText('', 'UTF-8')
|
|
||||||
}
|
|
||||||
executable = 'openssl'
|
|
||||||
args 'req', '-new', '-x509', '-extensions', 'v3_ca',
|
|
||||||
'-keyout', new File(ca, 'private/cakey.pem'),
|
|
||||||
'-out', new File(ca, 'certs/cacert.pem'),
|
|
||||||
'-days', '1460',
|
|
||||||
'-config', caConfig,
|
|
||||||
'-subj', '/OU=XPlugins QA',
|
|
||||||
'-passout', 'pass:capass'
|
|
||||||
}
|
|
||||||
|
|
||||||
task signCertificate(type: LoggedExec, dependsOn: [createCertificate, createCertificateAuthority]) {
|
|
||||||
executable = 'openssl'
|
|
||||||
standardInput = new ByteArrayInputStream('y\ny\n'.getBytes('UTF-8'))
|
|
||||||
args 'ca', '-in', cert, '-notext', '-out', signedCert, '-config', caConfig,
|
|
||||||
'-extensions', 'v3_req', '-passin', 'pass:capass'
|
|
||||||
}
|
|
||||||
|
|
||||||
task importCertificate(type: LoggedExec, dependsOn: signCertificate) {
|
|
||||||
executable = 'keytool'
|
|
||||||
standardInput = new ByteArrayInputStream('keypass\nyes\n'.getBytes('UTF-8'))
|
|
||||||
args '-importcert', '-keystore', keystore, '-file', signedCert, '-trustcacerts'
|
|
||||||
}
|
|
||||||
|
|
||||||
// add keystore to test classpath: it expects it there
|
// add keystore to test classpath: it expects it there
|
||||||
sourceSets.test.resources.srcDir(keystore.parentFile)
|
sourceSets.test.resources.srcDir(keystore.parentFile)
|
||||||
processTestResources.dependsOn(importCertificate)
|
processTestResources.dependsOn(createKey)
|
||||||
|
|
||||||
// add ES plugins, this loop must be outside of a configuration closure, otherwise it may get executed multiple times
|
// add ES plugins, this loop must be outside of a configuration closure, otherwise it may get executed multiple times
|
||||||
for (Project subproj : project.rootProject.subprojects) {
|
for (Project subproj : project.rootProject.subprojects) {
|
||||||
|
@ -157,14 +40,6 @@ for (Project subproj : project.rootProject.subprojects) {
|
||||||
}
|
}
|
||||||
|
|
||||||
integTest {
|
integTest {
|
||||||
// in some environments, openssl might not be available
|
|
||||||
try {
|
|
||||||
int ret = Runtime.getRuntime().exec("openssl version").waitFor();
|
|
||||||
enabled = (ret == 0);
|
|
||||||
} catch (IOException unavailable) {
|
|
||||||
enabled = false;
|
|
||||||
}
|
|
||||||
|
|
||||||
cluster {
|
cluster {
|
||||||
// TODO: use some variable here for port number
|
// TODO: use some variable here for port number
|
||||||
systemProperty 'es.marvel.agent.exporter.es.hosts', 'https://marvel_export:changeme@localhost:9400'
|
systemProperty 'es.marvel.agent.exporter.es.hosts', 'https://marvel_export:changeme@localhost:9400'
|
||||||
|
|
Loading…
Reference in New Issue