| #! /bin/bash |
| |
| # |
| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| # |
| |
| #=============================================================================== |
| # These tests create federated links between two brokers using SASL security. |
| # The SASL mechanism used is EXTERNAL, which is satisfied by SSL |
| # transport-layer security. |
| #=============================================================================== |
| |
| source ./test_env.sh |
| |
| script_name=`basename $0` |
| |
| if [ $# -lt 1 ] || [ $# -gt 2 ] |
| then |
| echo |
| # These are the four different ways of creating links ( or routes+links ) |
| # that the qpid-route command provides. |
| echo "Usage: ${script_name} dynamic|link|queue|route [cluster]" |
| echo |
| exit 1 |
| fi |
| |
| # Has the user told us to do clustering ? ----------- |
| clustering_flag= |
| if [ $# -eq "2" ] && [ "$2" == "cluster" ]; then |
| clustering_flag=true |
| fi |
| |
| qpid_route_method=$1 |
| |
| # Debugging print. -------------------------- |
| debug= |
| function print { |
| if [ "$debug" ]; then |
| echo "${script_name}: $1" |
| fi |
| } |
| |
| print "=========== start sasl_fed_ex $* ============" |
| |
| |
| |
| # This minimum value corresponds to sasl version 2.1.22 |
| minimum_sasl_version=131350 |
| |
| sasl_version=`$QPID_TEST_EXEC_DIR/sasl_version` |
| |
| # This test is necessary because this sasl version is the first one that permits |
| # redirection of the sasl config file path. |
| if [ "$sasl_version" -lt "$minimum_sasl_version" ]; then |
| echo "sasl_fed: must have sasl version 2.1.22 or greater. ( Integer value: $minimum_sasl_version ) Version is: $sasl_version" |
| exit 0 |
| fi |
| |
| # In a distribution, the python tools will be absent. |
| if [ ! -f $QPID_CONFIG_EXEC ] || [ ! -f $QPID_ROUTE_EXEC ] ; then |
| echo "python tools absent - skipping sasl_fed_ex." |
| exit 0 |
| fi |
| |
| CERT_DIR=`pwd`/test_cert_db |
| CERT_PW_FILE=`pwd`/cert.password |
| TEST_HOSTNAME=127.0.0.1 |
| |
| create_certs() { |
| #create certificate and key databases with single, simple, self-signed certificate in it |
| mkdir ${CERT_DIR} |
| certutil -N -d ${CERT_DIR} -f ${CERT_PW_FILE} |
| certutil -S -d ${CERT_DIR} -n ${TEST_HOSTNAME} -s "CN=${TEST_HOSTNAME}" -t "CT,," -x -f ${CERT_PW_FILE} -z /usr/bin/certutil 2> /dev/null |
| } |
| |
| delete_certs() { |
| if [[ -e ${CERT_DIR} ]] ; then |
| print "removing cert dir ${CERT_DIR}" |
| rm -rf ${CERT_DIR} |
| fi |
| } |
| |
| |
| CERTUTIL=$(type -p certutil) |
| if [[ !(-x $CERTUTIL) ]] ; then |
| echo "No certutil, skipping ssl test"; |
| exit 0; |
| fi |
| |
| delete_certs |
| create_certs 2> /dev/null |
| if [ ! $? ]; then |
| error "Could not create test certificate" |
| exit 1 |
| fi |
| |
| sasl_config_dir=$builddir/sasl_config |
| |
| tmp_root=${builddir}/sasl_fed_ex_temp |
| print "results dir is ${tmp_root}" |
| rm -rf ${tmp_root} |
| mkdir -p $tmp_root |
| |
| SRC_SSL_PORT=6667 |
| DST_SSL_PORT=6666 |
| |
| SRC_SSL_PORT_2=6668 |
| DST_SSL_PORT_2=6669 |
| |
| SRC_TCP_PORT=5801 |
| DST_TCP_PORT=5807 |
| |
| SRC_TCP_PORT_2=5802 |
| DST_TCP_PORT_2=5803 |
| |
| CLUSTER_NAME_SUFFIX=`hostname | tr '.' ' ' | awk '{print $1}'` |
| CLUSTER_1_NAME=sasl_fed_ex_cluster_1_${CLUSTER_NAME_SUFFIX} |
| CLUSTER_2_NAME=sasl_fed_ex_cluster_2_${CLUSTER_NAME_SUFFIX} |
| |
| print "CLUSTER_1_NAME == ${CLUSTER_1_NAME}" |
| print "CLUSTER_2_NAME == ${CLUSTER_2_NAME}" |
| |
| SSL_LIB=${moduledir}/ssl.so |
| CLUSTER_LIB=${moduledir}/cluster.so |
| |
| export QPID_SSL_CERT_NAME=${TEST_HOSTNAME} |
| |
| export QPID_NO_MODULE_DIR=1 |
| export QPID_LOAD_MODULE=$SSLCONNECTOR_LIB |
| export QPID_SSL_CERT_DB=${CERT_DIR} |
| export QPID_SSL_CERT_PASSWORD_FILE=${CERT_PW_FILE} |
| export QPID_SSL_CERT_NAME=${TEST_HOSTNAME} |
| |
| |
| |
| ####################################### |
| # Understanding this Plumbing |
| ####################################### |
| # 1. when you establish the route with qpid-route, |
| # here is the best termiology to use: |
| # |
| # qpid-route route add DST SRC |
| # |
| # 2. DST will connect to SRC through the ssl port of SRC. |
| # |
| # 3. sender client connects to the tcp port of SRC. |
| # |
| # 4. sender specifies mechanism ANONYMOUS. |
| # |
| # 5. DST pulls messages off the temp queue on SRC to itself. |
| # |
| |
| COMMON_BROKER_OPTIONS=" \ |
| --ssl-sasl-no-dict \ |
| --sasl-config=$sasl_config_dir \ |
| --ssl-require-client-authentication \ |
| --auth yes \ |
| --ssl-cert-db $CERT_DIR \ |
| --ssl-cert-password-file $CERT_PW_FILE \ |
| --ssl-cert-name $TEST_HOSTNAME \ |
| --no-data-dir \ |
| --no-module-dir \ |
| --load-module ${SSL_LIB} \ |
| --mgmt-enable=yes \ |
| --log-enable info+ \ |
| --log-source yes \ |
| --daemon " |
| |
| |
| function start_brokers { |
| if [ $1 ]; then |
| # clustered ---------------------------------------- |
| print "Starting SRC cluster" |
| |
| print " src broker 1" |
| $QPIDD_EXEC \ |
| --port=${SRC_TCP_PORT} \ |
| --ssl-port ${SRC_SSL_PORT} \ |
| ${COMMON_BROKER_OPTIONS} \ |
| --load-module ${CLUSTER_LIB} \ |
| --cluster-name ${CLUSTER_1_NAME} \ |
| --log-to-file $tmp_root/qpidd_src.log 2> /dev/null |
| |
| broker_ports[0]=${SRC_TCP_PORT} |
| |
| print " src broker 2" |
| $QPIDD_EXEC \ |
| --port=${SRC_TCP_PORT_2} \ |
| --ssl-port ${SRC_SSL_PORT_2} \ |
| ${COMMON_BROKER_OPTIONS} \ |
| --load-module ${CLUSTER_LIB} \ |
| --cluster-name ${CLUSTER_1_NAME} \ |
| --log-to-file $tmp_root/qpidd_src_2.log 2> /dev/null |
| |
| broker_ports[1]=${SRC_TCP_PORT_2} |
| |
| |
| print "Starting DST cluster" |
| |
| print " dst broker 1" |
| $QPIDD_EXEC \ |
| --port=${DST_TCP_PORT} \ |
| --ssl-port ${DST_SSL_PORT} \ |
| ${COMMON_BROKER_OPTIONS} \ |
| --load-module ${CLUSTER_LIB} \ |
| --cluster-name ${CLUSTER_2_NAME} \ |
| --log-to-file $tmp_root/qpidd_dst.log 2> /dev/null |
| |
| broker_ports[2]=${DST_TCP_PORT} |
| |
| print " dst broker 2" |
| $QPIDD_EXEC \ |
| --port=${DST_TCP_PORT_2} \ |
| --ssl-port ${DST_SSL_PORT_2} \ |
| ${COMMON_BROKER_OPTIONS} \ |
| --load-module ${CLUSTER_LIB} \ |
| --cluster-name ${CLUSTER_2_NAME} \ |
| --log-to-file $tmp_root/qpidd_dst_2.log 2> /dev/null |
| |
| broker_ports[3]=${DST_TCP_PORT_2} |
| |
| else |
| # vanilla brokers -------------------------------- |
| print "Starting SRC broker" |
| $QPIDD_EXEC \ |
| --port=${SRC_TCP_PORT} \ |
| --ssl-port ${SRC_SSL_PORT} \ |
| ${COMMON_BROKER_OPTIONS} \ |
| --log-to-file $tmp_root/qpidd_src.log 2> /dev/null |
| |
| broker_ports[0]=${SRC_TCP_PORT} |
| |
| print "Starting DST broker" |
| $QPIDD_EXEC \ |
| --port=${DST_TCP_PORT} \ |
| --ssl-port ${DST_SSL_PORT} \ |
| ${COMMON_BROKER_OPTIONS} \ |
| --log-to-file $tmp_root/qpidd_dst.log 2> /dev/null |
| |
| broker_ports[1]=${DST_TCP_PORT} |
| fi |
| } |
| |
| |
| function halt_brokers { |
| n_brokers=${#broker_ports[@]} |
| print "Halting ${n_brokers} brokers." |
| for i in $(seq 0 $((${n_brokers} - 1))) |
| do |
| halt_port=${broker_ports[$i]} |
| print "Halting broker $i on port ${halt_port}" |
| $QPIDD_EXEC --port ${halt_port} --quit |
| done |
| |
| } |
| |
| |
| start_brokers $clustering_flag |
| |
| |
| # I am not randomizing these names, because this test creates its own brokers. |
| QUEUE_NAME=sasl_fed_queue |
| ROUTING_KEY=sasl_fed_queue |
| EXCHANGE_NAME=sasl_fedex |
| |
| |
| print "add exchanges" |
| $QPID_CONFIG_EXEC -a localhost:${SRC_TCP_PORT} add exchange direct $EXCHANGE_NAME |
| $QPID_CONFIG_EXEC -a localhost:${DST_TCP_PORT} add exchange direct $EXCHANGE_NAME |
| |
| |
| print "add queues" |
| $QPID_CONFIG_EXEC -a localhost:${SRC_TCP_PORT} add queue $QUEUE_NAME |
| $QPID_CONFIG_EXEC -a localhost:${DST_TCP_PORT} add queue $QUEUE_NAME |
| |
| |
| print "create bindings" |
| $QPID_CONFIG_EXEC -a localhost:${SRC_TCP_PORT} bind $EXCHANGE_NAME $QUEUE_NAME $ROUTING_KEY |
| $QPID_CONFIG_EXEC -a localhost:${DST_TCP_PORT} bind $EXCHANGE_NAME $QUEUE_NAME $ROUTING_KEY |
| |
| |
| # |
| # NOTE: The SRC broker *must* be referred to as $TEST_HOSTNAME, and not as "localhost". |
| # It must be referred to by the exact string given as the Common Name (CN) in the cert, |
| # which was created in the function create_certs, above. |
| |
| |
| |
| #---------------------------------------------------------------- |
| # Use qpid-route to create the link, or the link+route, depending |
| # on which of its several methods was requested. |
| #---------------------------------------------------------------- |
| if [ ${qpid_route_method} == "dynamic" ]; then |
| print "dynamic add" |
| $QPID_ROUTE_EXEC -t ssl dynamic add localhost:${DST_TCP_PORT} $TEST_HOSTNAME:${SRC_SSL_PORT} $EXCHANGE_NAME "" "" EXTERNAL |
| elif [ ${qpid_route_method} == "link" ]; then |
| print "link add" |
| $QPID_ROUTE_EXEC -t ssl link add localhost:${DST_TCP_PORT} $TEST_HOSTNAME:${SRC_SSL_PORT} EXTERNAL |
| elif [ ${qpid_route_method} == "queue" ]; then |
| print "queue add" |
| $QPID_ROUTE_EXEC -t ssl queue add localhost:${DST_TCP_PORT} $TEST_HOSTNAME:${SRC_SSL_PORT} $EXCHANGE_NAME $ROUTING_KEY EXTERNAL |
| elif [ ${qpid_route_method} == "route" ]; then |
| print "route add" |
| $QPID_ROUTE_EXEC -t ssl route add localhost:${DST_TCP_PORT} $TEST_HOSTNAME:${SRC_SSL_PORT} $EXCHANGE_NAME $ROUTING_KEY "" "" EXTERNAL |
| else |
| echo "unknown method: |${qpid_route_method}|" |
| echo " choices are: dynamic|link|queue|route " |
| halt_brokers |
| exit 1 |
| fi |
| |
| |
| # I don't know how to avoid this sleep yet. It has to come after route-creation |
| # to avoid false negatives. |
| sleep 5 |
| |
| # This should work the same whether or not we are running a clustered test. |
| # In the case of clustered tests, the status is not printed by qpid_route. |
| # So in either case, I will look only at the transport field, which should be "ssl". |
| print "check the link" |
| link_status=$($QPID_ROUTE_EXEC link list localhost:${DST_TCP_PORT} | tail -1 | awk '{print $3}') |
| |
| halt_brokers |
| |
| sleep 1 |
| |
| if [ ! ${link_status} ]; then |
| print "link_status is empty" |
| print "result: fail" |
| exit 2 |
| fi |
| |
| if [ ${link_status} == "ssl" ]; then |
| print "result: good" |
| # Only remove the tmp_root on success, to permit debugging. |
| print "Removing temporary directory $tmp_root" |
| rm -rf $tmp_root |
| exit 0 |
| fi |
| |
| print "link_status has a bad value: ${link_status}" |
| print "result: fail" |
| exit 3 |
| |
| |
| |
