Mirroristas/etcd
2
0
Fork 0
mirror of https://github.com/etcd-io/etcd.git synced 2024-09-27 06:25:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(e2e): add a case where client tls is missing for https metrics url

Browse Source 
Signed-off-by: Gyuho Lee <gyuhox@gmail.com>
This commit is contained in:
Gyuho Lee 2024-06-17 21:09:24 +08:00
parent a657f069a1
commit 22f20a827b
No known key found for this signature in database
GPG Key ID: A79582C05F6BEF63
3 changed files with 59 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/embed/etcd.go
View File

@ -822,7 +822,7 @@ func (e *Etcd) pickGRPCGatewayServeContext(splitHTTP bool) *serveCtx {
panic("Expect at least one context able to serve grpc")
}
var errMissingClientTLSInfoForMetricsURL = errors.New("client TLS key/cert (--cert-file, --key-file) must be provided for metrics url")
var ErrMissingClientTLSInfoForMetricsURL = errors.New("client TLS key/cert (--cert-file, --key-file) must be provided for metrics url")
func (e *Etcd) createMetricsListener(murl url.URL) (net.Listener, error) {
tlsInfo := &e.cfg.ClientTLSInfo
@ -831,7 +831,7 @@ func (e *Etcd) createMetricsListener(murl url.URL) (net.Listener, error) {
tlsInfo = nil
case "https", "unixs":
if e.cfg.ClientTLSInfo.Empty() {
return nil, errMissingClientTLSInfoForMetricsURL
return nil, ErrMissingClientTLSInfoForMetricsURL
}
}
return transport.NewListenerWithOpts(murl.Host, murl.Scheme,

4
server/embed/etcd_test.go
View File

@ -18,7 +18,7 @@ func TestEmptyClientTLSInfo_createMetricsListener(t *testing.T) {
Scheme: "https",
Host: "localhost:8080",
}
if _, err := e.createMetricsListener(murl); err != errMissingClientTLSInfoForMetricsURL {
t.Fatalf("expected error %v, got %v", errMissingClientTLSInfoForMetricsURL, err)
if _, err := e.createMetricsListener(murl); err != ErrMissingClientTLSInfoForMetricsURL {
t.Fatalf("expected error %v, got %v", ErrMissingClientTLSInfoForMetricsURL, err)
}
}

55
tests/e2e/etcd_config_test.go
View File

@ -28,6 +28,7 @@ import (
"golang.org/x/sync/errgroup"
"go.etcd.io/etcd/pkg/v3/expect"
"go.etcd.io/etcd/server/v3/embed"
"go.etcd.io/etcd/tests/v3/framework/config"
"go.etcd.io/etcd/tests/v3/framework/e2e"
)
@ -120,6 +121,60 @@ func TestEtcdUnixPeers(t *testing.T) {
}
}
// TestEtcdListenMetricsURLsWithMissingClientTLSInfo checks that the HTTPs listen metrics URL
// but without the client TLS info will fail its verification.
func TestEtcdListenMetricsURLsWithMissingClientTLSInfo(t *testing.T) {
e2e.SkipInShortMode(t)
tempDir := t.TempDir()
defer os.RemoveAll(tempDir)
caFile, certFiles, keyFiles, err := generateCertsForIPs(tempDir, []net.IP{net.ParseIP("127.0.0.1")})
require.NoError(t, err)
// non HTTP but metrics URL is HTTPS, invalid when the client TLS info is not provided
clientURL := fmt.Sprintf("http://localhost:%d", e2e.EtcdProcessBasePort)
peerURL := fmt.Sprintf("https://localhost:%d", e2e.EtcdProcessBasePort+1)
listenMetricsURL := fmt.Sprintf("https://localhost:%d", e2e.EtcdProcessBasePort+2)
commonArgs := []string{
e2e.BinPath.Etcd,
"--name", "e0",
"--data-dir", tempDir,
"--listen-client-urls", clientURL,
"--advertise-client-urls", clientURL,
"--initial-advertise-peer-urls", peerURL,
"--listen-peer-urls", peerURL,
"--initial-cluster", "e0=" + peerURL,
"--listen-metrics-urls", listenMetricsURL,
"--peer-cert-file", certFiles[0],
"--peer-key-file", keyFiles[0],
"--peer-trusted-ca-file", caFile,
"--peer-client-cert-auth",
}
proc, err := e2e.SpawnCmd(commonArgs, nil)
if err != nil {
t.Fatal(err)
}
defer func() {
if err := proc.Stop(); err != nil {
t.Error(err)
}
proc.Wait() // ensure the port has been released
_ = proc.Close()
}()
if err := e2e.WaitReadyExpectProc(context.TODO(), proc, []string{embed.ErrMissingClientTLSInfoForMetricsURL.Error()}); err != nil {
t.Fatal(err)
}
}
// TestEtcdPeerCNAuth checks that the inter peer auth based on CN of cert is working correctly.
func TestEtcdPeerCNAuth(t *testing.T) {
e2e.SkipInShortMode(t)