Mirroristas/etcd
2
0
Fork 0
mirror of https://github.com/etcd-io/etcd.git synced 2024-09-27 06:25:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

e2e: test client-side cipher suites with curl

Browse Source 
Signed-off-by: Gyuho Lee <gyuhox@gmail.com>
This commit is contained in:
Gyuho Lee 2018-06-05 18:29:09 -07:00
parent 13715724b8
commit a0ebf8cb1c
3 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
e2e/cluster_test.go
View File

@ -112,6 +112,8 @@ type etcdProcessClusterConfig struct {
isClientAutoTLS bool
isClientCRL bool
cipherSuites []string
forceNewCluster bool
initialToken string
quotaBackendBytes int64
@ -296,6 +298,10 @@ func (cfg *etcdProcessClusterConfig) tlsArgs() (args []string) {
args = append(args, "--client-crl-file", crlPath, "--client-cert-auth")
}
if len(cfg.cipherSuites) > 0 {
args = append(args, "--cipher-suites", strings.Join(cfg.cipherSuites, ","))
}
return args
}

6
e2e/v2_curl_test.go
View File

@ -127,6 +127,8 @@ type cURLReq struct {
header string
metricsURLScheme string
ciphers string
}
// cURLPrefixArgs builds the beginning of a curl command for a given key
@ -165,6 +167,10 @@ func cURLPrefixArgs(clus *etcdProcessCluster, method string, req cURLReq) []stri
cmdArgs = append(cmdArgs, "-H", req.header)
}
if req.ciphers != "" {
cmdArgs = append(cmdArgs, "--ciphers", req.ciphers)
}
switch method {
case "POST", "PUT":
dt := req.value

44
e2e/v3_curl_test.go
View File

@ -17,6 +17,7 @@ package e2e
import (
"encoding/base64"
"encoding/json"
"fmt"
"path"
"strconv"
"testing"
@ -24,6 +25,7 @@ import (
epb "github.com/coreos/etcd/etcdserver/api/v3election/v3electionpb"
pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
"github.com/coreos/etcd/pkg/testutil"
"github.com/coreos/etcd/version"
"github.com/grpc-ecosystem/grpc-gateway/runtime"
)
@ -390,3 +392,45 @@ type campaignResponse struct {
Lease string `json:"lease,omitempty"`
} `json:"leader,omitempty"`
}
func TestV3CurlCipherSuitesValid(t *testing.T) { testV3CurlCipherSuites(t, true) }
func TestV3CurlCipherSuitesMismatch(t *testing.T) { testV3CurlCipherSuites(t, false) }
func testV3CurlCipherSuites(t *testing.T, valid bool) {
cc := configClientTLS
cc.clusterSize = 1
cc.cipherSuites = []string{
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
}
testFunc := cipherSuiteTestValid
if !valid {
testFunc = cipherSuiteTestMismatch
}
testCtl(t, testFunc, withCfg(cc))
}
func cipherSuiteTestValid(cx ctlCtx) {
if err := cURLGet(cx.epc, cURLReq{
endpoint: "/metrics",
expected: fmt.Sprintf(`etcd_server_version{server_version="%s"} 1`, version.Version),
metricsURLScheme: cx.cfg.metricsURLScheme,
ciphers: "ECDHE-RSA-AES128-GCM-SHA256", // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
}); err != nil {
cx.t.Fatalf("failed get with curl (%v)", err)
}
}
func cipherSuiteTestMismatch(cx ctlCtx) {
if err := cURLGet(cx.epc, cURLReq{
endpoint: "/metrics",
expected: "alert handshake failure",
metricsURLScheme: cx.cfg.metricsURLScheme,
ciphers: "ECDHE-RSA-DES-CBC3-SHA", // TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
}); err != nil {
cx.t.Fatalf("failed get with curl (%v)", err)
}
}