Skip to content

Commit 48fcc98

Browse files
eramongodberamongodb
authored
CDRIVER-4183 re-enable CSE tests on RHEL (#882)
* Enable skipping of KMS TLS tests via MONGOC_TEST_SKIP_KMS_TLS_TESTS * Add condition for skipping KMS TLS tests on CA cert register failure * Add CA certificate registration routines for MacOS * Add routine to wait for mock KMS server startup completion * Re-enable CSE tests on RHEL variants
1 parent 33c8d31 commit 48fcc98

File tree

6 files changed

+84
-40
lines changed

6 files changed

+84
-40
lines changed

‎.evergreen/config.yml

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -775,11 +775,13 @@ functions:
775775
shell: bash
776776
script: |-
777777
set -o errexit
778+
echo "Starting mock KMS servers..."
778779
cd ./drivers-evergreen-tools/.evergreen/csfle
779780
. ./activate_venv.sh
780781
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/server.pem --port 7999 &
781782
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/expired.pem --port 8000 &
782783
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/wrong-host.pem --port 8001 &
784+
echo "Starting mock KMS servers... done."
783785
start load balancer:
784786
- command: shell.exec
785787
params:
@@ -26982,8 +26984,8 @@ buildvariants:
2698226984
- .debug-compile !.sspi .openssl
2698326985
- .debug-compile !.sspi .nossl
2698426986
- .authentication-tests .openssl
26985-
- .latest .openssl !.nosasl .server !.client-side-encryption
26986-
- .latest .nossl !.client-side-encryption
26987+
- .latest .openssl !.nosasl .server
26988+
- .latest .nossl
2698726989
- name: gcc48rhel
2698826990
display_name: GCC 4.8 (RHEL 7.0)
2698926991
expansions:
@@ -26999,14 +27001,14 @@ buildvariants:
2699927001
- .authentication-tests .openssl
2700027002
- .latest .openssl !.nosasl .server
2700127003
- .latest .nossl
27002-
- .5.0 .openssl !.nosasl .server !.client-side-encryption
27003-
- .4.4 .openssl !.nosasl .server !.client-side-encryption
27004-
- .4.2 .openssl !.nosasl .server !.client-side-encryption
27005-
- .4.0 .openssl !.nosasl .server !.client-side-encryption
27006-
- .3.6 .openssl !.nosasl .server !.client-side-encryption
27007-
- .3.4 .openssl !.nosasl .server !.client-side-encryption
27008-
- .3.2 .openssl !.nosasl .server !.client-side-encryption
27009-
- .3.0 .openssl !.nosasl !.auth !.client-side-encryption
27004+
- .5.0 .openssl !.nosasl .server
27005+
- .4.4 .openssl !.nosasl .server
27006+
- .4.2 .openssl !.nosasl .server
27007+
- .4.0 .openssl !.nosasl .server
27008+
- .3.6 .openssl !.nosasl .server
27009+
- .3.4 .openssl !.nosasl .server
27010+
- .3.2 .openssl !.nosasl .server
27011+
- .3.0 .openssl !.nosasl !.auth
2701027012
- name: gcc49
2701127013
display_name: GCC 4.9 (Debian 8.1)
2701227014
expansions:
@@ -27283,12 +27285,12 @@ buildvariants:
2728327285
- .debug-compile !.sspi .openssl
2728427286
- .debug-compile !.sspi .openssl-static
2728527287
- .debug-compile !.sspi .nossl
27286-
- .latest .openssl !.nosasl .server !.client-side-encryption
27287-
- .latest .openssl-static !.nosasl .server !.client-side-encryption
27288+
- .latest .openssl !.nosasl .server
27289+
- .latest .openssl-static !.nosasl .server
2728827290
- .latest .nossl
27289-
- .5.0 .openssl !.nosasl .server !.client-side-encryption
27290-
- .4.4 .openssl !.nosasl .server !.client-side-encryption
27291-
- .4.2 .openssl !.nosasl .server !.client-side-encryption
27291+
- .5.0 .openssl !.nosasl .server
27292+
- .4.4 .openssl !.nosasl .server
27293+
- .4.2 .openssl !.nosasl .server
2729227294
- test-dns-openssl
2729327295
batchtime: 1440
2729427296
- name: arm-ubuntu1804
@@ -27341,12 +27343,12 @@ buildvariants:
2734127343
- .debug-compile !.sspi .openssl
2734227344
- .debug-compile !.sspi .nossl
2734327345
- .authentication-tests .openssl
27344-
- .latest .openssl !.nosasl .server !.client-side-encryption
27346+
- .latest .openssl !.nosasl .server
2734527347
- .latest .nossl
27346-
- .5.0 .openssl !.nosasl .server !.client-side-encryption
27347-
- .4.4 .openssl !.nosasl .server !.client-side-encryption
27348-
- .4.2 .openssl !.nosasl .server !.client-side-encryption
27349-
- .4.0 .openssl !.nosasl .server !.client-side-encryption
27348+
- .5.0 .openssl !.nosasl .server
27349+
- .4.4 .openssl !.nosasl .server
27350+
- .4.2 .openssl !.nosasl .server
27351+
- .4.0 .openssl !.nosasl .server
2735027352
batchtime: 1440
2735127353
- name: valgrind-ubuntu
2735227354
display_name: Valgrind Tests (Ubuntu 18.04)

‎.evergreen/run-tests.sh

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ if [ "$SSL" != "nossl" ]; then
3636
cygwin*)
3737
certutil.exe -addstore "Root" "src\libmongoc\tests\x509gen\ca.pem"
3838
;;
39+
darwin*)
40+
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain src/libmongoc/tests/x509gen/ca.pem
41+
;;
3942
*)
4043
if [ -f /etc/redhat-release ]; then
4144
echo "Copying CA certificate to /usr/share/pki/ca-trust-source/anchors..."
@@ -45,6 +48,7 @@ if [ "$SSL" != "nossl" ]; then
4548
sudo update-ca-trust extract --verbose
4649
else
4750
echo "Copying CA certificate to /usr/share/pki/ca-trust-source/anchors... failed."
51+
export MONGOC_TEST_SKIP_KMS_TLS_TESTS=on
4852
export MONGOC_TEST_SSL_CA_FILE="src/libmongoc/tests/x509gen/ca.pem"
4953
fi
5054
else
@@ -55,6 +59,7 @@ if [ "$SSL" != "nossl" ]; then
5559
sudo update-ca-certificates --verbose
5660
else
5761
echo "Copying CA certificate to /usr/local/share/ca-certificates... failed."
62+
export MONGOC_TEST_SKIP_KMS_TLS_TESTS=on
5863
export MONGOC_TEST_SSL_CA_FILE="src/libmongoc/tests/x509gen/ca.pem"
5964
fi
6065
fi
@@ -115,6 +120,27 @@ check_mongocryptd() {
115120

116121
export MONGOC_TEST_MONITORING_VERBOSE=on
117122

123+
# Ensure mock KMS servers are running before starting tests.
124+
if [ "$CLIENT_SIDE_ENCRYPTION" = "on" ]; then
125+
echo "Waiting for mock KMS servers to start..."
126+
wait_for_kms_server() {
127+
for i in $(seq 60); do
128+
# Exit code 7: "Failed to connect to host".
129+
if curl -s "localhost:$1"; test $? -ne 7; then
130+
return 0
131+
else
132+
sleep 1
133+
fi
134+
done
135+
echo "Could not detect mock KMS server on port $1"
136+
return 1
137+
}
138+
wait_for_kms_server 7999
139+
wait_for_kms_server 8000
140+
wait_for_kms_server 8001
141+
echo "Waiting for mock KMS servers to start... done."
142+
fi
143+
118144
if [ "$LOADBALANCED" != "noloadbalanced" ]; then
119145
if [ -z "$SINGLE_MONGOS_LB_URI" -o -z "$MULTI_MONGOS_LB_URI" ]; then
120146
echo "SINGLE_MONGOS_LB_URI and MULTI_MONGOS_LB_URI environment variables required."

‎CONTRIBUTING.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,10 @@ The set of mock KMS servers running in the background and their corresponding po
260260
| 8000 | ca.pem | expired.pem |
261261
| 8001 | ca.pem | wrong-host.pem |
262262

263+
KMS TLS tests for Client-Side Field Level Encryption can be skipped by defining:
264+
265+
* `MONGOC_TEST_SKIP_KMS_TLS_TESTS=on`
266+
263267
Specification tests may be filtered by their description:
264268

265269
* `MONGOC_JSON_SUBTEST=<string>`

‎build/evergreen_config_lib/functions.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -558,11 +558,13 @@
558558
)),
559559
('run kms servers', Function(
560560
shell_exec(r'''
561+
echo "Starting mock KMS servers..."
561562
cd ./drivers-evergreen-tools/.evergreen/csfle
562563
. ./activate_venv.sh
563564
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/server.pem --port 7999 &
564565
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/expired.pem --port 8000 &
565566
python -u kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/wrong-host.pem --port 8001 &
567+
echo "Starting mock KMS servers... done."
566568
''', test=False, background=True),
567569
)),
568570
('start load balancer', Function(

‎build/evergreen_config_lib/variants.py

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -226,8 +226,8 @@ def days(n):
226226
'.debug-compile !.sspi .openssl',
227227
'.debug-compile !.sspi .nossl',
228228
'.authentication-tests .openssl',
229-
'.latest .openssl !.nosasl .server !.client-side-encryption',
230-
'.latest .nossl !.client-side-encryption'],
229+
'.latest .openssl !.nosasl .server',
230+
'.latest .nossl'],
231231
{'CC': 'gcc'}),
232232
Variant('gcc48rhel',
233233
'GCC 4.8 (RHEL 7.0)',
@@ -241,14 +241,14 @@ def days(n):
241241
'.authentication-tests .openssl',
242242
'.latest .openssl !.nosasl .server',
243243
'.latest .nossl',
244-
'.5.0 .openssl !.nosasl .server !.client-side-encryption',
245-
'.4.4 .openssl !.nosasl .server !.client-side-encryption',
246-
'.4.2 .openssl !.nosasl .server !.client-side-encryption',
247-
'.4.0 .openssl !.nosasl .server !.client-side-encryption',
248-
'.3.6 .openssl !.nosasl .server !.client-side-encryption',
249-
'.3.4 .openssl !.nosasl .server !.client-side-encryption',
250-
'.3.2 .openssl !.nosasl .server !.client-side-encryption',
251-
'.3.0 .openssl !.nosasl !.auth !.client-side-encryption'],
244+
'.5.0 .openssl !.nosasl .server',
245+
'.4.4 .openssl !.nosasl .server',
246+
'.4.2 .openssl !.nosasl .server',
247+
'.4.0 .openssl !.nosasl .server',
248+
'.3.6 .openssl !.nosasl .server',
249+
'.3.4 .openssl !.nosasl .server',
250+
'.3.2 .openssl !.nosasl .server',
251+
'.3.0 .openssl !.nosasl !.auth'],
252252
{'CC': 'gcc'}),
253253
Variant('gcc49',
254254
'GCC 4.9 (Debian 8.1)',
@@ -499,12 +499,12 @@ def days(n):
499499
'.debug-compile !.sspi .openssl',
500500
'.debug-compile !.sspi .openssl-static',
501501
'.debug-compile !.sspi .nossl',
502-
'.latest .openssl !.nosasl .server !.client-side-encryption',
503-
'.latest .openssl-static !.nosasl .server !.client-side-encryption',
502+
'.latest .openssl !.nosasl .server',
503+
'.latest .openssl-static !.nosasl .server',
504504
'.latest .nossl',
505-
'.5.0 .openssl !.nosasl .server !.client-side-encryption',
506-
'.4.4 .openssl !.nosasl .server !.client-side-encryption',
507-
'.4.2 .openssl !.nosasl .server !.client-side-encryption',
505+
'.5.0 .openssl !.nosasl .server',
506+
'.4.4 .openssl !.nosasl .server',
507+
'.4.2 .openssl !.nosasl .server',
508508
'test-dns-openssl'],
509509
{'CC': 'gcc'},
510510
batchtime=days(1)),
@@ -552,12 +552,12 @@ def days(n):
552552
'.debug-compile !.sspi .openssl',
553553
'.debug-compile !.sspi .nossl',
554554
'.authentication-tests .openssl',
555-
'.latest .openssl !.nosasl .server !.client-side-encryption',
555+
'.latest .openssl !.nosasl .server',
556556
'.latest .nossl',
557-
'.5.0 .openssl !.nosasl .server !.client-side-encryption',
558-
'.4.4 .openssl !.nosasl .server !.client-side-encryption',
559-
'.4.2 .openssl !.nosasl .server !.client-side-encryption',
560-
'.4.0 .openssl !.nosasl .server !.client-side-encryption'],
557+
'.5.0 .openssl !.nosasl .server',
558+
'.4.4 .openssl !.nosasl .server',
559+
'.4.2 .openssl !.nosasl .server',
560+
'.4.0 .openssl !.nosasl .server'],
561561
{'CC': 'gcc'},
562562
batchtime=days(1)),
563563
# Note, do not use Ubuntu 16.04 for valgrind, as the system valgrind

‎src/libmongoc/tests/test-mongoc-client-side-encryption.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2416,6 +2416,13 @@ test_kms_tls_cert_wrong_host (void *unused)
24162416
mongoc_client_destroy (client);
24172417
}
24182418

2419+
/* Required CA certificates may not be registered on system. See BUILD-14068. */
2420+
int
2421+
test_framework_skip_kms_tls_tests (void)
2422+
{
2423+
return test_framework_getenv_bool ("MONGOC_TEST_SKIP_KMS_TLS_TESTS") ? 0 : 1;
2424+
}
2425+
24192426
void
24202427
test_client_side_encryption_install (TestSuite *suite)
24212428
{
@@ -2499,20 +2506,23 @@ test_client_side_encryption_install (TestSuite *suite)
24992506
NULL,
25002507
NULL,
25012508
test_framework_skip_if_no_client_side_encryption,
2509+
test_framework_skip_kms_tls_tests,
25022510
test_framework_skip_if_max_wire_version_less_than_8);
25032511
TestSuite_AddFull (suite,
25042512
"/client_side_encryption/kms_tls/expired",
25052513
test_kms_tls_cert_expired,
25062514
NULL,
25072515
NULL,
25082516
test_framework_skip_if_no_client_side_encryption,
2517+
test_framework_skip_kms_tls_tests,
25092518
test_framework_skip_if_max_wire_version_less_than_8);
25102519
TestSuite_AddFull (suite,
25112520
"/client_side_encryption/kms_tls/wrong_host",
25122521
test_kms_tls_cert_wrong_host,
25132522
NULL,
25142523
NULL,
25152524
test_framework_skip_if_no_client_side_encryption,
2525+
test_framework_skip_kms_tls_tests,
25162526
test_framework_skip_if_max_wire_version_less_than_8);
25172527

25182528
/* Other, C driver specific, tests. */

0 commit comments

Comments
 (0)