|
|
@@ -0,0 +1,191 @@
|
|
|
+%%--------------------------------------------------------------------
|
|
|
+%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
|
+%%
|
|
|
+%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
+%% you may not use this file except in compliance with the License.
|
|
|
+%% You may obtain a copy of the License at
|
|
|
+%%
|
|
|
+%% http://www.apache.org/licenses/LICENSE-2.0
|
|
|
+%%
|
|
|
+%% Unless required by applicable law or agreed to in writing, software
|
|
|
+%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
+%% See the License for the specific language governing permissions and
|
|
|
+%% limitations under the License.
|
|
|
+%%--------------------------------------------------------------------
|
|
|
+
|
|
|
+-module(emqx_authn_mongo_tls_SUITE).
|
|
|
+
|
|
|
+-compile(nowarn_export_all).
|
|
|
+-compile(export_all).
|
|
|
+
|
|
|
+-include("emqx_authn.hrl").
|
|
|
+-include_lib("eunit/include/eunit.hrl").
|
|
|
+-include_lib("common_test/include/ct.hrl").
|
|
|
+-include_lib("snabbkaffe/include/snabbkaffe.hrl").
|
|
|
+
|
|
|
+
|
|
|
+-define(MONGO_HOST, "mongo-tls").
|
|
|
+-define(MONGO_PORT, 27017).
|
|
|
+
|
|
|
+-define(PATH, [authentication]).
|
|
|
+
|
|
|
+all() ->
|
|
|
+ emqx_common_test_helpers:all(?MODULE).
|
|
|
+
|
|
|
+init_per_testcase(_TestCase, Config) ->
|
|
|
+ {ok, _} = emqx_cluster_rpc:start_link(node(), emqx_cluster_rpc, 1000),
|
|
|
+ emqx_authentication:initialize_authentication(?GLOBAL, []),
|
|
|
+ emqx_authn_test_lib:delete_authenticators(
|
|
|
+ [authentication],
|
|
|
+ ?GLOBAL),
|
|
|
+ Config.
|
|
|
+
|
|
|
+init_per_suite(Config) ->
|
|
|
+ _ = application:load(emqx_conf),
|
|
|
+ case emqx_authn_test_lib:is_tcp_server_available(?MONGO_HOST, ?MONGO_PORT) of
|
|
|
+ true ->
|
|
|
+ ok = emqx_common_test_helpers:start_apps([emqx_authn]),
|
|
|
+ ok = start_apps([emqx_resource, emqx_connector]),
|
|
|
+ Config;
|
|
|
+ false ->
|
|
|
+ {skip, no_mongo}
|
|
|
+ end.
|
|
|
+
|
|
|
+end_per_suite(_Config) ->
|
|
|
+ emqx_authn_test_lib:delete_authenticators(
|
|
|
+ [authentication],
|
|
|
+ ?GLOBAL),
|
|
|
+ ok = stop_apps([emqx_resource, emqx_connector]),
|
|
|
+ ok = emqx_common_test_helpers:stop_apps([emqx_authn]).
|
|
|
+
|
|
|
+%%------------------------------------------------------------------------------
|
|
|
+%% Tests
|
|
|
+%%------------------------------------------------------------------------------
|
|
|
+
|
|
|
+%% emqx_connector_mongo connects asyncronously,
|
|
|
+%% so we check failure/success indirectly (through snabbkaffe).
|
|
|
+
|
|
|
+%% openssl s_client -tls1_2 -cipher ECDHE-RSA-AES256-GCM-SHA384 \
|
|
|
+%% -connect mongo-tls:27017 \
|
|
|
+%% -cert mongo-tls-client.crt -key mongo-tls-client.key -CAfile mongo-tls-ca.crt
|
|
|
+
|
|
|
+t_create(_Config) ->
|
|
|
+ ?check_trace(
|
|
|
+ create_mongo_auth_with_ssl_opts(
|
|
|
+ #{<<"server_name_indication">> => <<"mongo-tls">>,
|
|
|
+ <<"verify">> => <<"verify_peer">>,
|
|
|
+ <<"versions">> => [<<"tlsv1.2">>],
|
|
|
+ <<"ciphers">> => [<<"ECDHE-RSA-AES256-GCM-SHA384">>]}),
|
|
|
+ fun({ok, _}, Trace) ->
|
|
|
+ ?assertEqual(
|
|
|
+ [ok],
|
|
|
+ ?projection(
|
|
|
+ status,
|
|
|
+ ?of_kind(emqx_connector_mongo_health_check, Trace)))
|
|
|
+ end).
|
|
|
+
|
|
|
+
|
|
|
+t_create_invalid_server_name(_Config) ->
|
|
|
+ ?check_trace(
|
|
|
+ create_mongo_auth_with_ssl_opts(
|
|
|
+ #{<<"server_name_indication">> => <<"mongo-tls-unknown-host">>,
|
|
|
+ <<"verify">> => <<"verify_peer">>}),
|
|
|
+ fun({ok, _}, Trace) ->
|
|
|
+ ?assertEqual(
|
|
|
+ [failed],
|
|
|
+ ?projection(
|
|
|
+ status,
|
|
|
+ ?of_kind(emqx_connector_mongo_health_check, Trace)))
|
|
|
+ end).
|
|
|
+
|
|
|
+
|
|
|
+%% docker-compose-mongo-single-tls.yaml:
|
|
|
+%% --tlsDisabledProtocols TLS1_0,TLS1_1
|
|
|
+
|
|
|
+t_create_invalid_version(_Config) ->
|
|
|
+ ?check_trace(
|
|
|
+ create_mongo_auth_with_ssl_opts(
|
|
|
+ #{<<"server_name_indication">> => <<"mongo-tls">>,
|
|
|
+ <<"verify">> => <<"verify_peer">>,
|
|
|
+ <<"versions">> => [<<"tlsv1.1">>]}),
|
|
|
+ fun({ok, _}, Trace) ->
|
|
|
+ ?assertEqual(
|
|
|
+ [failed],
|
|
|
+ ?projection(
|
|
|
+ status,
|
|
|
+ ?of_kind(emqx_connector_mongo_health_check, Trace)))
|
|
|
+ end).
|
|
|
+
|
|
|
+
|
|
|
+%% docker-compose-mongo-single-tls.yaml:
|
|
|
+%% --setParameter opensslCipherConfig='HIGH:!EXPORT:!aNULL:!DHE:!kDHE@STRENGTH'
|
|
|
+
|
|
|
+t_invalid_ciphers(_Config) ->
|
|
|
+ ?check_trace(
|
|
|
+ create_mongo_auth_with_ssl_opts(
|
|
|
+ #{<<"server_name_indication">> => <<"mongo-tls">>,
|
|
|
+ <<"verify">> => <<"verify_peer">>,
|
|
|
+ <<"versions">> => [<<"tlsv1.2">>],
|
|
|
+ <<"ciphers">> => [<<"DHE-RSA-AES256-GCM-SHA384">>]}),
|
|
|
+ fun({ok, _}, Trace) ->
|
|
|
+ ?assertEqual(
|
|
|
+ [failed],
|
|
|
+ ?projection(
|
|
|
+ status,
|
|
|
+ ?of_kind(emqx_connector_mongo_health_check, Trace)))
|
|
|
+ end).
|
|
|
+
|
|
|
+%%------------------------------------------------------------------------------
|
|
|
+%% Helpers
|
|
|
+%%------------------------------------------------------------------------------
|
|
|
+
|
|
|
+create_mongo_auth_with_ssl_opts(SpecificSSLOpts) ->
|
|
|
+ AuthConfig = raw_mongo_auth_config(SpecificSSLOpts),
|
|
|
+ emqx:update_config(?PATH, {create_authenticator, ?GLOBAL, AuthConfig}).
|
|
|
+
|
|
|
+raw_mongo_auth_config(SpecificSSLOpts) ->
|
|
|
+ SSLOpts = maps:merge(
|
|
|
+ client_ssl_opts(),
|
|
|
+ #{enable => <<"true">>}),
|
|
|
+ #{
|
|
|
+ mechanism => <<"password-based">>,
|
|
|
+ password_hash_algorithm => #{name => <<"plain">>,
|
|
|
+ salt_position => <<"suffix">>},
|
|
|
+ enable => <<"true">>,
|
|
|
+
|
|
|
+ backend => <<"mongodb">>,
|
|
|
+ pool_size => 2,
|
|
|
+ mongo_type => <<"single">>,
|
|
|
+ database => <<"mqtt">>,
|
|
|
+ collection => <<"users">>,
|
|
|
+ server => mongo_server(),
|
|
|
+
|
|
|
+ selector => #{<<"username">> => <<"${username}">>},
|
|
|
+ password_hash_field => <<"password_hash">>,
|
|
|
+ salt_field => <<"salt">>,
|
|
|
+ is_superuser_field => <<"is_superuser">>,
|
|
|
+ topology => #{
|
|
|
+ server_selection_timeout_ms => <<"10000ms">>
|
|
|
+ },
|
|
|
+
|
|
|
+ ssl => maps:merge(SSLOpts, SpecificSSLOpts)
|
|
|
+ }.
|
|
|
+
|
|
|
+mongo_server() ->
|
|
|
+ iolist_to_binary(
|
|
|
+ io_lib:format(
|
|
|
+ "~s:~b",
|
|
|
+ [?MONGO_HOST, ?MONGO_PORT])).
|
|
|
+
|
|
|
+start_apps(Apps) ->
|
|
|
+ lists:foreach(fun application:ensure_all_started/1, Apps).
|
|
|
+
|
|
|
+stop_apps(Apps) ->
|
|
|
+ lists:foreach(fun application:stop/1, Apps).
|
|
|
+
|
|
|
+client_ssl_opts() ->
|
|
|
+ Dir = code:lib_dir(emqx_authn, test),
|
|
|
+ #{keyfile => filename:join([Dir, <<"data/certs">>, "mongo-tls-client.key"]),
|
|
|
+ certfile => filename:join([Dir, <<"data/certs">>, "mongo-tls-client.crt"]),
|
|
|
+ cacertfile => filename:join([Dir, <<"data/certs">>, "mongo-tls-ca.crt"])}.
|
Ilya Averyanov