Merge pull request #1231 from ChTimTsubasa/ssl_test

Fix SSL test

Author: pervazea

script/installation/create_certificates_test.sh

@@ -118,7 +118,7 @@ void PelotonServer::SSLInit() {
   }
   // TODO(Yuchen): change this.
   // load trusted CA certificates (peer authentication)
-  if (SSL_CTX_load_verify_locations(ssl_context, certificate_file_.c_str(),
+  if (SSL_CTX_load_verify_locations(ssl_context, root_cert_file_.c_str(),
                                     nullptr) != 1) {
     LOG_WARN("Exception when loading root_crt!");
     SetSSLLevel(SSLLevel::SSL_PREFER);

src/network/peloton_server.cpp

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDzCCAfegAwIBAgIJALnYXsYu6xTqMA0GCSqGSIb3DQEBCwUAMB4xHDAaBgNV
+BAMME3Jvb3QueW91cmRvbWFpbi5jb20wHhcNMTgwMzI3MjAwNTM5WhcNMjgwMzI0
+MjAwNTM5WjAeMRwwGgYDVQQDDBNyb290LnlvdXJkb21haW4uY29tMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+bP/zPanodNjwRT07JHxeXGhUQGdWbgM
+lXa30aYqM3JYsMyumXukNhAI0ErEwX+CkXBsK3/+nuATm18s8FipIWuUeh19Sokh
+qeLaZiSrZEHHjsiLreVsoKI9bAuohPay2XI3hkLEeQ1Mo4yxRjU1BpktY4lhzvvf
+cTE1G/zRtGMAGKeng/S0aadjJbmFxEQB14x68FQg6UsfpukIizmZmgJ5uRnmhDgL
+xiMfYrGjSl+sH9+Pmi5D6jcYIC1P1qcVDB7q1xd+cktrfNCXVo8zaYlDOuAqhPoD
+TpTf0eK9aPXoiFtP30Ys8S3CjQA3ChuxX96oyNOxG87VNGVFRiyvfQIDAQABo1Aw
+TjAdBgNVHQ4EFgQUcHPnzTFlIDQL7qO4hWpr4c3g0fEwHwYDVR0jBBgwFoAUcHPn
+zTFlIDQL7qO4hWpr4c3g0fEwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AQEA4ghpPKmNeSlFEwkfaqeum9DuvORlhrdBA/l64QlB3VwmeyA2O/bpTGuad3E6
+BsrR2DXH0k4lpoK/uzBGgUas5R0Tg2eiUD/uhHff/thU/yvoCD3o2K0cQXKCTYgq
+ct25OLMNxf2sHN8VD64AJnvF6yIv0ptBkF2Iqcn5486f5pJgs48MhJcSjFZYpjvo
+T54vh+U6DLT0dPIa5JJOhBQIe6LYuJDwZH84Fh3lGKip5OWT1RfuTHKViz5fL+lX
+eQqzL9kA9zm593Z6ltvVdSTxndBW1JYgL9opMB7wrvuEdGUECXzZJWioO9EP/yV2
+ekprwI05kJhh2fqrduTuIq30HQ==
+-----END CERTIFICATE-----

test/network/ssl/root.crt

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQD5s//M9qeh02PB
+FPTskfF5caFRAZ1ZuAyVdrfRpiozcliwzK6Ze6Q2EAjQSsTBf4KRcGwrf/6e4BOb
+XyzwWKkha5R6HX1KiSGp4tpmJKtkQceOyIut5Wygoj1sC6iE9rLZcjeGQsR5DUyj
+jLFGNTUGmS1jiWHO+99xMTUb/NG0YwAYp6eD9LRpp2MluYXERAHXjHrwVCDpSx+m
+6QiLOZmaAnm5GeaEOAvGIx9isaNKX6wf34+aLkPqNxggLU/WpxUMHurXF35yS2t8
+0JdWjzNpiUM64CqE+gNOlN/R4r1o9eiIW0/fRizxLcKNADcKG7Ff3qjI07EbztU0
+ZUVGLK99AgMBAAECggEBAKukQEyqq9YAEczyU92eAGfjZOji/D9k1TmUTozM9KtC
+iZaWS9py9BC5euV6z77WoHDK34ATTnn1O2UMyj44I6I2aex7AtnOY5Z8unWF9U5I
+LR2H2wPg9YeBnkj7xo4Hai8wZNxkXtt6+dheaKkC//0WI+4MzG/UEOak1YX0hk3A
+eAOldQdPAKs4tMiTaj47bXRkXTNvKertmk7mrQewI2GHs8T3jJuHInIXv4tbyMCo
+Y9PGqufFw+PmcYy10h0RRgwqQOdcuopSArtIP9OoG7jiM/yFSFG83z7bQ3a8aDoo
+lrJsk3IcW+XVDOoTwDpgNdJtQ3671VYc30N5r+pJHMECgYEA/em3T7zJoJI4maFK
+vuFq5e2sBJdKz+iMBx5ZSOOP9J0O3iWykbE0r7H4GPBFM8P2wnqlZeQM7iFmFTAR
+PJT+u8rucfR1Y3HrVgFtWEG17YyRs9yn+sEW+Rwnc0RociuFL0xJlJNvkbhWVKSg
+1SopWdJ/x7nTIWfLcjgSyJtihq0CgYEA+8FswZAUej+LHBdOgvUF8oQhCvaDabX1
+i89SlgzAVFXc11NaI3bBhSKPreMcE3CmYqhYHNIReI2YWjZEJRtB5QMzYxU77OW+
+OSaP5oRfQenpo132VKbHbAgrALe8KYy7avYHRrS/bTJehRqQaTL2dflKUc8gc8dY
+N0RCgryGdhECgYBoAL9RLeb4mmwMoYBYR0TeAUggaUf/eSVCFTBFJtDkRSC95XsL
+KiaGgMM6k9AEsBP2/P2aipqxP4Ts0M9+nRjqGukoTBV5MkRO6i67o869CoLzxUIY
+99ZNGzcdg7u0aBcZlInfDbT5XyQdb4FhTu+5Fvu392l/mWA/3K/085Cb0QKBgQDS
+RKYiMMV5qTL1vl2bsSxLdqHmdyghFZHFON7AZlwI1EIEMiDZ9+j/2nLoiAQ+FFtT
+kUkuoSFob9LsneBioZZywS6dNfH8FZLARv3vSWYKNmUmRmdkInvzNgs8qTjl9x3d
+4ykGnBY6DNS3FQ3CX4dL12+ETpvLN5btafynFvCzEQKBgQCxTA32yitkjHs6qlZL
+Nhhs5bisM5upzbgHs3CuI83OnbdW9X9Wx1jVTEf4wFAvOUmwdVPvdrghZ0Dsd2mI
+/WKkWDYHnLqDw0CSmSz6w1N+9BwOI2LzPiWcqMo795DZCwkuKnDyuv79UmuH3ta5
+X/DANwRv0KqMTYddWJD56/59KA==
+-----END PRIVATE KEY-----

test/network/ssl/root.key

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICujCCAaICCQCGyfkOWMMn2jANBgkqhkiG9w0BAQsFADAeMRwwGgYDVQQDDBNy
+b290LnlvdXJkb21haW4uY29tMB4XDTE4MDMyNzIwMDU0OFoXDTE5MDMyNzIwMDU0
+OFowIDEeMBwGA1UEAwwVZGJob3N0LnlvdXJkb21haW4uY29tMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA75NjtSRgvXgreFG5Ud0UjMMPkkBUcPcHDTuR
+SqMkTld+TNw22mCadSVvYtbECwmbbBRvQ4PGaIvyeVH2+s5kUqrB6GHdy3pslhoG
+I5QTgMZHlJDDlL/dDKzMRnjAcf33wUnxB0ZgHZiQ1w6DCe8q59BoFc1lqb0jq64x
+TtBdmU/KdQT2Bk/3K3hHWhfLDIZnHPxptBBVm2sq7B+lpcAHbw7OGjv7AUyonzWC
+U1rvQpzbIs3vqEzNRu1KR6muuf5vNFY5DXchKitZiIwvj6El3Irkk9Of6NrOlSeI
+diSh2DS3i3z/mHCvbJc2d7Pbp0Hy0Jb27Ym9TtGJ68675lYTMQIDAQABMA0GCSqG
+SIb3DQEBCwUAA4IBAQBc5SNlFnyQLhJSF8iEVw3qevIEjhcgjSUazfNVMNKD+edN
+Q5v2w1yEp8sdFJVR9KYfpqj+h9BABG7toY1+COGjdbNM/0dVrwBle14s9ALmj5nR
+tAR13jyRsdbGR7C8P7n1KessHi/RBokLZjMkfiPlimWQjMeRsLsQVjf2XGk+ywOO
+57O0GktuEnN17MYa/D393+AL6fMFcmmuE4e7Hf6mN77ztWcWo/BAyc1tQXsQm4CQ
+KDk43LAUEA+ml12PuRjDVDeTDPrIte6YDM9Dxbr0vXj+NPZ4rVvPM5b+wxnZr7kQ
+2G7oYEHfI5QRpIw5fvVwRoNo0NhLHK6SlAKnzn3i
+-----END CERTIFICATE-----

test/network/ssl/root_test.crt

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDvk2O1JGC9eCt4
+UblR3RSMww+SQFRw9wcNO5FKoyROV35M3DbaYJp1JW9i1sQLCZtsFG9Dg8Zoi/J5
+Ufb6zmRSqsHoYd3LemyWGgYjlBOAxkeUkMOUv90MrMxGeMBx/ffBSfEHRmAdmJDX
+DoMJ7yrn0GgVzWWpvSOrrjFO0F2ZT8p1BPYGT/creEdaF8sMhmcc/Gm0EFWbayrs
+H6WlwAdvDs4aO/sBTKifNYJTWu9CnNsize+oTM1G7UpHqa65/m80VjkNdyEqK1mI
+jC+PoSXciuST05/o2s6VJ4h2JKHYNLeLfP+YcK9slzZ3s9unQfLQlvbtib1O0Ynr
+zrvmVhMxAgMBAAECggEAD/iicAQB0v+83iOMmDGF2jByzEwvlOxS8wXilLg1hmd8
+ywDvQzWndmHNgChTH20/iEAAft69DmEuA/p73ZJ+y6gIj0Ze896weH05pYuMlUwi
+n3vbHgKAaQToBVatdav5pVAZmmONqstt9HhKMhJYqOWS2sk7mso6I4rUTK3FX5/6
+GK+Xr0E6doGLiGx1wLD+JazKRpiBbq8yrZbldaHvvufeBW+C9oJUpbbAgjc/0uNX
+zOp5DG9Rt7N7kaZgKy13mZ3P9BEKM52bj11nk88FNvoNR+zxOGyJh6YFI0IeRVZ9
+6gR7n0pNjJ0G/WKkOgzrXY9z78aT8t9sVOOsp9ZqAQKBgQD6XU4LS4Bfyhb3FfFi
+CSZl+fADlUlRR4qHfZp3dnYh8SLUC5YwMk5KfjkSX1frnVL+kFZBO5I2ZcqxhHTM
+YhSGYoxu4HdpzKNCi1P+iceHiwDSoF0HGQOxqze4NYDN63ODqFjDgsEPIM4SlssZ
+0o1zzEGZpu4OhreMaOA4M8EPkQKBgQD09+p1X6SKclBCnZDdyI+Xvp7ybombqp6F
+vJfehgtLkq/c6v2pLI1UV0eo6LeZwdB4xTHHrzZVE5LKJmkaRNVMEuvbwuJnOmLQ
+NVrxBmanhJ5FKgB2KTYY+iKgqEdkoHp21MM5HBPGGDBKO96knDYVSLlbNivmeo8b
+51zQ9DQ5oQKBgGMtHOJaiULowgok9ha4uy5AQPSaaY26AkVD2zGhipBNfldzM45q
+DxtxPthpTmG2U48lzBVRLM1Bq3aAmufvnmPRnAG8B3Gwr6eHm8FEAPdPeAb3oYJT
+RWRXB95/y0NHFt47jNX98M42V4uDknbrMj+B1SaxurGkagdD8DYzQjIRAoGAdpda
+gu4FaxzCLC25hxTkJxMaQcUvixPDYH0XjJuZ9kESMEH3ASJXXSBPyb63u5Dvirf0
+THZPOEqcgo6rzRLLq+NxGVe0YUMLuT5LQ2nU4n46XMNjq9Bxpw/ZGau9vEJQZxzD
+Ue98xybIofdv5oLVT+KAEV8dS5vDkj+kWGgQrGECgYAw6AoXsWTHo0chADBt+hEm
+CEguCXSwxx2tix5WF2gwbunjfnkXe2nmG3M+teG0xRK3mqoPqevyaA6gL0kDwBIu
+CD1pNTVrcqg8jAnLP0hfX5VNgL2lLIfhLFbUdal7VklfdW70Pbv3J6D3uCVXaW4A
+BGtLxLiDzo9PJi09hKhrng==
+-----END PRIVATE KEY-----

test/network/ssl/server.crt

@@ -32,27 +32,29 @@ namespace test {
 
 class SSLTests : public PelotonTest {};
 
-std::string client_crt = std::string(StringUtil::Format(
-    "%s%s", SOURCE_FOLDER, "/test/network/ssl/client_test.crt"));
-std::string client_key = std::string(StringUtil::Format(
-    "%s%s", SOURCE_FOLDER, "/test/network/ssl/client_test.key"));
-std::string server_crt = std::string(StringUtil::Format(
-    "%s%s", SOURCE_FOLDER, "/test/network/ssl/server_test.crt"));
-std::string server_key = std::string(StringUtil::Format(
-    "%s%s", SOURCE_FOLDER, "/test/network/ssl/server_test.key"));
-std::string root_crt = std::string(StringUtil::Format(
-    "%s%s", SOURCE_FOLDER, "/test/network/ssl/root_test.crt"));
+// The following keys and certificates are generated using
+// https://www.postgresql.org/docs/9.5/static/libpq-ssl.html
+std::string client_crt = std::string(
+    StringUtil::Format("%s%s", SOURCE_FOLDER, "/test/network/ssl/root.crt"));
+std::string client_key = std::string(
+    StringUtil::Format("%s%s", SOURCE_FOLDER, "/test/network/ssl/root.key"));
+std::string server_crt = std::string(
+    StringUtil::Format("%s%s", SOURCE_FOLDER, "/test/network/ssl/server.crt"));
+std::string server_key = std::string(
+    StringUtil::Format("%s%s", SOURCE_FOLDER, "/test/network/ssl/server.key"));
+std::string root_crt = std::string(
+    StringUtil::Format("%s%s", SOURCE_FOLDER, "/test/network/ssl/root.crt"));
 
 /**
  * Basic SSL connection test:  Tested with valid certificats and key files
  */
-void *BasicTest(int port) {
+void *TestRoutine(int port) {
   try {
     // forcing the factory to generate psql protocol handler
     pqxx::connection C(StringUtil::Format(
         "host=127.0.0.1 port=%d user=default_database application_name=psql "
-        "sslmode=require sslkey=%s ",
-        port, client_key.c_str()));
+        "sslmode=require sslkey=%s sslcert=%s sslrootcert=%s",
+        port, client_key.c_str(), client_crt.c_str(), root_crt.c_str()));
 
     pqxx::work txn1(C);
 
@@ -115,6 +117,7 @@ void *BasicTest(int port) {
  * Callback method to close server after client finishes
  */
 TEST_F(SSLTests, BasicTest) {
+  EXPECT_EQ(0, chmod(client_key.c_str(), S_IRUSR));
   peloton::PelotonInit::Initialize();
   LOG_INFO("Server initialized");
   peloton::network::PelotonServer peloton_server;
@@ -134,7 +137,7 @@ TEST_F(SSLTests, BasicTest) {
   std::thread serverThread([&] { peloton_server.ServerLoop(); });
 
   // server & client running correctly
-  BasicTest(port);
+  TestRoutine(port);
 
   peloton_server.Close();
   serverThread.join();