Skip to content

Commit 36b05f6

Browse files
oleg-jukovecoleg-jukovec
committed
bugfix: build with -tags go_tarantool_ssl_disable
The patch fixes build with the build tag `go_tarantool_ssl_disable`: 1. It moves tests with OpenSslDialer to a test file that executes only with the tag. 2. It defines structure `sslOpts` in the common place to use it in the code with/without the flag. Finally, it adds tests to CI with the build tag. Closes #357
1 parent cabe16e commit 36b05f6

File tree

6 files changed

+349
-326
lines changed

6 files changed

+349
-326
lines changed

‎.github/workflows/testing.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,11 @@ jobs:
103103
make test
104104
make testrace
105105
106+
- name: Run regression tests with disabled SSL
107+
run: |
108+
make test TAGS="go_tarantool_ssl_disable"
109+
make testrace TAGS="go_tarantool_ssl_disable"
110+
106111
- name: Run fuzzing tests
107112
if: ${{ matrix.fuzzing }}
108113
run: make fuzzing TAGS="go_tarantool_decimal_fuzzing"
@@ -193,6 +198,12 @@ jobs:
193198
env:
194199
TEST_TNT_SSL: ${{matrix.ssl}}
195200

201+
- name: Run regression tests with disabled SSL
202+
run: |
203+
source tarantool-enterprise/env.sh
204+
make test TAGS="go_tarantool_ssl_disable"
205+
make testrace TAGS="go_tarantool_ssl_disable"
206+
196207
- name: Run fuzzing tests
197208
if: ${{ matrix.fuzzing }}
198209
run: make fuzzing TAGS="go_tarantool_decimal_fuzzing"
@@ -359,6 +370,12 @@ jobs:
359370
make test
360371
make testrace
361372
373+
- name: Run regression tests with disabled SSL
374+
run: |
375+
cd "${SRCDIR}"
376+
make test TAGS="go_tarantool_ssl_disable"
377+
make testrace TAGS="go_tarantool_ssl_disable"
378+
362379
- name: Run fuzzing tests
363380
if: ${{ matrix.fuzzing }}
364381
run: |

‎dial_test.go

Lines changed: 0 additions & 181 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ import (
1414
"github.com/stretchr/testify/assert"
1515
"github.com/stretchr/testify/require"
1616
"github.com/tarantool/go-iproto"
17-
"github.com/tarantool/go-openssl"
1817

1918
"github.com/tarantool/go-tarantool/v2"
2019
"github.com/tarantool/go-tarantool/v2/test_helpers"
@@ -605,186 +604,6 @@ func TestNetDialer_Dial_requirements(t *testing.T) {
605604
require.Contains(t, err.Error(), "invalid server protocol")
606605
}
607606

608-
func createSslListener(t *testing.T, opts tarantool.SslTestOpts) net.Listener {
609-
ctx, err := tarantool.SslCreateContext(opts)
610-
require.NoError(t, err)
611-
l, err := openssl.Listen("tcp", "127.0.0.1:0", ctx.(*openssl.Ctx))
612-
require.NoError(t, err)
613-
return l
614-
}
615-
616-
func TestOpenSslDialer_Dial_basic(t *testing.T) {
617-
l := createSslListener(t, tarantool.SslTestOpts{
618-
KeyFile: "testdata/localhost.key",
619-
CertFile: "testdata/localhost.crt",
620-
})
621-
622-
defer l.Close()
623-
addr := l.Addr().String()
624-
625-
dialer := tarantool.OpenSslDialer{
626-
Address: addr,
627-
User: testDialUser,
628-
Password: testDialPass,
629-
}
630-
631-
cases := []testDialOpts{
632-
{
633-
name: "all is ok",
634-
expectedProtocolInfo: idResponseTyped.Clone(),
635-
},
636-
{
637-
name: "id request unsupported",
638-
// Dialer sets auth.
639-
expectedProtocolInfo: tarantool.ProtocolInfo{Auth: tarantool.ChapSha1Auth},
640-
isIdUnsupported: true,
641-
},
642-
{
643-
name: "greeting response error",
644-
wantErr: true,
645-
expectedErr: "failed to read greeting",
646-
isErrGreeting: true,
647-
},
648-
{
649-
name: "id response error",
650-
wantErr: true,
651-
expectedErr: "failed to identify",
652-
isErrId: true,
653-
},
654-
{
655-
name: "auth response error",
656-
wantErr: true,
657-
expectedErr: "failed to authenticate",
658-
isErrAuth: true,
659-
},
660-
}
661-
for _, tc := range cases {
662-
t.Run(tc.name, func(t *testing.T) {
663-
testDialer(t, l, dialer, tc)
664-
})
665-
}
666-
}
667-
668-
func TestOpenSslDialer_Dial_requirements(t *testing.T) {
669-
l := createSslListener(t, tarantool.SslTestOpts{
670-
KeyFile: "testdata/localhost.key",
671-
CertFile: "testdata/localhost.crt",
672-
})
673-
674-
defer l.Close()
675-
addr := l.Addr().String()
676-
677-
dialer := tarantool.OpenSslDialer{
678-
Address: addr,
679-
User: testDialUser,
680-
Password: testDialPass,
681-
RequiredProtocolInfo: tarantool.ProtocolInfo{
682-
Features: []iproto.Feature{42},
683-
},
684-
}
685-
686-
testDialAccept(testDialOpts{}, l)
687-
ctx, cancel := test_helpers.GetConnectContext()
688-
defer cancel()
689-
conn, err := dialer.Dial(ctx, tarantool.DialOpts{})
690-
if err == nil {
691-
conn.Close()
692-
}
693-
require.Error(t, err)
694-
require.Contains(t, err.Error(), "invalid server protocol")
695-
}
696-
697-
func TestOpenSslDialer_Dial_papSha256Auth(t *testing.T) {
698-
l := createSslListener(t, tarantool.SslTestOpts{
699-
KeyFile: "testdata/localhost.key",
700-
CertFile: "testdata/localhost.crt",
701-
})
702-
703-
defer l.Close()
704-
addr := l.Addr().String()
705-
706-
dialer := tarantool.OpenSslDialer{
707-
Address: addr,
708-
User: testDialUser,
709-
Password: testDialPass,
710-
Auth: tarantool.PapSha256Auth,
711-
}
712-
713-
protocol := idResponseTyped.Clone()
714-
protocol.Auth = tarantool.PapSha256Auth
715-
716-
testDialer(t, l, dialer, testDialOpts{
717-
expectedProtocolInfo: protocol,
718-
isPapSha256Auth: true,
719-
})
720-
}
721-
722-
func TestOpenSslDialer_Dial_opts(t *testing.T) {
723-
for _, test := range sslTests {
724-
t.Run(test.name, func(t *testing.T) {
725-
l := createSslListener(t, test.serverOpts)
726-
defer l.Close()
727-
addr := l.Addr().String()
728-
729-
dialer := tarantool.OpenSslDialer{
730-
Address: addr,
731-
User: testDialUser,
732-
Password: testDialPass,
733-
SslKeyFile: test.clientOpts.KeyFile,
734-
SslCertFile: test.clientOpts.CertFile,
735-
SslCaFile: test.clientOpts.CaFile,
736-
SslCiphers: test.clientOpts.Ciphers,
737-
SslPassword: test.clientOpts.Password,
738-
SslPasswordFile: test.clientOpts.PasswordFile,
739-
}
740-
testDialer(t, l, dialer, testDialOpts{
741-
wantErr: !test.ok,
742-
expectedProtocolInfo: idResponseTyped.Clone(),
743-
})
744-
})
745-
}
746-
}
747-
748-
func TestOpenSslDialer_Dial_ctx_cancel(t *testing.T) {
749-
serverOpts := tarantool.SslTestOpts{
750-
KeyFile: "testdata/localhost.key",
751-
CertFile: "testdata/localhost.crt",
752-
CaFile: "testdata/ca.crt",
753-
Ciphers: "ECDHE-RSA-AES256-GCM-SHA384",
754-
}
755-
clientOpts := tarantool.SslTestOpts{
756-
KeyFile: "testdata/localhost.key",
757-
CertFile: "testdata/localhost.crt",
758-
CaFile: "testdata/ca.crt",
759-
Ciphers: "ECDHE-RSA-AES256-GCM-SHA384",
760-
}
761-
762-
l := createSslListener(t, serverOpts)
763-
defer l.Close()
764-
addr := l.Addr().String()
765-
testDialAccept(testDialOpts{}, l)
766-
767-
dialer := tarantool.OpenSslDialer{
768-
Address: addr,
769-
User: testDialUser,
770-
Password: testDialPass,
771-
SslKeyFile: clientOpts.KeyFile,
772-
SslCertFile: clientOpts.CertFile,
773-
SslCaFile: clientOpts.CaFile,
774-
SslCiphers: clientOpts.Ciphers,
775-
SslPassword: clientOpts.Password,
776-
SslPasswordFile: clientOpts.PasswordFile,
777-
}
778-
779-
ctx, cancel := context.WithCancel(context.Background())
780-
cancel()
781-
conn, err := dialer.Dial(ctx, tarantool.DialOpts{})
782-
if err == nil {
783-
conn.Close()
784-
}
785-
require.Error(t, err)
786-
}
787-
788607
func TestFdDialer_Dial(t *testing.T) {
789608
l, err := net.Listen("tcp", "127.0.0.1:0")
790609
require.NoError(t, err)

‎ssl.go

Lines changed: 0 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,5 @@
1-
//go:build !go_tarantool_ssl_disable
2-
// +build !go_tarantool_ssl_disable
3-
41
package tarantool
52

6-
import (
7-
"bufio"
8-
"context"
9-
"errors"
10-
"io/ioutil"
11-
"net"
12-
"os"
13-
"strings"
14-
15-
"github.com/tarantool/go-openssl"
16-
)
17-
183
type sslOpts struct {
194
// KeyFile is a path to a private SSL key file.
205
KeyFile string
@@ -43,131 +28,3 @@ type sslOpts struct {
4328
// file as a password.
4429
PasswordFile string
4530
}
46-
47-
func sslDialContext(ctx context.Context, network, address string,
48-
opts sslOpts) (connection net.Conn, err error) {
49-
var sslCtx interface{}
50-
if sslCtx, err = sslCreateContext(opts); err != nil {
51-
return
52-
}
53-
54-
return openssl.DialContext(ctx, network, address, sslCtx.(*openssl.Ctx), 0)
55-
}
56-
57-
// interface{} is a hack. It helps to avoid dependency of go-openssl in build
58-
// of tests with the tag 'go_tarantool_ssl_disable'.
59-
func sslCreateContext(opts sslOpts) (ctx interface{}, err error) {
60-
var sslCtx *openssl.Ctx
61-
62-
// Require TLSv1.2, because other protocol versions don't seem to
63-
// support the GOST cipher.
64-
if sslCtx, err = openssl.NewCtxWithVersion(openssl.TLSv1_2); err != nil {
65-
return
66-
}
67-
ctx = sslCtx
68-
sslCtx.SetMaxProtoVersion(openssl.TLS1_2_VERSION)
69-
sslCtx.SetMinProtoVersion(openssl.TLS1_2_VERSION)
70-
71-
if opts.CertFile != "" {
72-
if err = sslLoadCert(sslCtx, opts.CertFile); err != nil {
73-
return
74-
}
75-
}
76-
77-
if opts.KeyFile != "" {
78-
if err = sslLoadKey(sslCtx, opts.KeyFile, opts.Password, opts.PasswordFile); err != nil {
79-
return
80-
}
81-
}
82-
83-
if opts.CaFile != "" {
84-
if err = sslCtx.LoadVerifyLocations(opts.CaFile, ""); err != nil {
85-
return
86-
}
87-
verifyFlags := openssl.VerifyPeer | openssl.VerifyFailIfNoPeerCert
88-
sslCtx.SetVerify(verifyFlags, nil)
89-
}
90-
91-
if opts.Ciphers != "" {
92-
sslCtx.SetCipherList(opts.Ciphers)
93-
}
94-
95-
return
96-
}
97-
98-
func sslLoadCert(ctx *openssl.Ctx, certFile string) (err error) {
99-
var certBytes []byte
100-
if certBytes, err = ioutil.ReadFile(certFile); err != nil {
101-
return
102-
}
103-
104-
certs := openssl.SplitPEM(certBytes)
105-
if len(certs) == 0 {
106-
err = errors.New("No PEM certificate found in " + certFile)
107-
return
108-
}
109-
first, certs := certs[0], certs[1:]
110-
111-
var cert *openssl.Certificate
112-
if cert, err = openssl.LoadCertificateFromPEM(first); err != nil {
113-
return
114-
}
115-
if err = ctx.UseCertificate(cert); err != nil {
116-
return
117-
}
118-
119-
for _, pem := range certs {
120-
if cert, err = openssl.LoadCertificateFromPEM(pem); err != nil {
121-
break
122-
}
123-
if err = ctx.AddChainCertificate(cert); err != nil {
124-
break
125-
}
126-
}
127-
return
128-
}
129-
130-
func sslLoadKey(ctx *openssl.Ctx, keyFile string, password string,
131-
passwordFile string) error {
132-
var keyBytes []byte
133-
var err, firstDecryptErr error
134-
135-
if keyBytes, err = ioutil.ReadFile(keyFile); err != nil {
136-
return err
137-
}
138-
139-
// If the key is encrypted and password is not provided,
140-
// openssl.LoadPrivateKeyFromPEM(keyBytes) asks to enter PEM pass phrase
141-
// interactively. On the other hand,
142-
// openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password) works fine
143-
// for non-encrypted key with any password, including empty string. If
144-
// the key is encrypted, we fast fail with password error instead of
145-
// requesting the pass phrase interactively.
146-
passwords := []string{password}
147-
if passwordFile != "" {
148-
file, err := os.Open(passwordFile)
149-
if err == nil {
150-
defer file.Close()
151-
152-
scanner := bufio.NewScanner(file)
153-
// Tarantool itself tries each password file line.
154-
for scanner.Scan() {
155-
password = strings.TrimSpace(scanner.Text())
156-
passwords = append(passwords, password)
157-
}
158-
} else {
159-
firstDecryptErr = err
160-
}
161-
}
162-
163-
for _, password := range passwords {
164-
key, err := openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)
165-
if err == nil {
166-
return ctx.UsePrivateKey(key)
167-
} else if firstDecryptErr == nil {
168-
firstDecryptErr = err
169-
}
170-
}
171-
172-
return firstDecryptErr
173-
}

‎ssl_disable.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,10 @@ import (
1010
)
1111

1212
func sslDialContext(ctx context.Context, network, address string,
13-
opts SslOpts) (connection net.Conn, err error) {
13+
opts sslOpts) (connection net.Conn, err error) {
1414
return nil, errors.New("SSL support is disabled.")
1515
}
1616

17-
func sslCreateContext(opts SslOpts) (ctx interface{}, err error) {
17+
func sslCreateContext(opts sslOpts) (ctx interface{}, err error) {
1818
return nil, errors.New("SSL support is disabled.")
1919
}

0 commit comments

Comments
 (0)