You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by ho...@apache.org on 2016/05/11 23:38:13 UTC
[2/2] lucene-solr:branch_6x: SOLR-8970: Change SSLTestConfig to use a
keystore file that is included as a resource in the test-framework jar so
users subclassing SolrTestCaseJ4 don't need to preserve magic paths
SOLR-8970: Change SSLTestConfig to use a keystore file that is included as a resource in the test-framework jar so users subclassing SolrTestCaseJ4 don't need to preserve magic paths
(cherry picked from commit 76063648ae05a935459f2ea5ed53c4df1caa713d)
Project: http://git-wip-us.apache.org/repos/asf/lucene-solr/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/1d7094c9
Tree: http://git-wip-us.apache.org/repos/asf/lucene-solr/tree/1d7094c9
Diff: http://git-wip-us.apache.org/repos/asf/lucene-solr/diff/1d7094c9
Branch: refs/heads/branch_6x
Commit: 1d7094c931927ccf7ca87bce68aef51adcc49431
Parents: 84ffc4d
Author: Chris Hostetter <ho...@apache.org>
Authored: Wed May 11 16:28:07 2016 -0700
Committer: Chris Hostetter <ho...@apache.org>
Committed: Wed May 11 16:35:23 2016 -0700
----------------------------------------------------------------------
solr/CHANGES.txt | 3 +
solr/test-framework/build.xml | 6 ++
.../org/apache/solr/util/SSLTestConfig.java | 95 ++++++++++++++++---
.../resources/SSLTestConfig.testing.keystore | Bin 0 -> 2208 bytes
4 files changed, 91 insertions(+), 13 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/1d7094c9/solr/CHANGES.txt
----------------------------------------------------------------------
diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
index b5f9426..6cf1e47 100644
--- a/solr/CHANGES.txt
+++ b/solr/CHANGES.txt
@@ -172,6 +172,9 @@ Bug Fixes
* SOLR-9093: Fix NullPointerException in TopGroupsShardResponseProcessor. (Christine Poerschke)
+* SOLR-8970: Change SSLTestConfig to use a keystore file that is included as a resource in the
+ test-framework jar so users subclassing SolrTestCaseJ4 don't need to preserve magic paths (hossman)
+
Optimizations
----------------------
* SOLR-8722: Don't force a full ZkStateReader refresh on every Overseer operation.
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/1d7094c9/solr/test-framework/build.xml
----------------------------------------------------------------------
diff --git a/solr/test-framework/build.xml b/solr/test-framework/build.xml
index 021076d..1e0d7b5 100644
--- a/solr/test-framework/build.xml
+++ b/solr/test-framework/build.xml
@@ -38,9 +38,15 @@
</target>
<target name="compile-core" depends="resolve, compile-solr-core, compile-test-framework">
+ <!-- TODO: why does test-framework override compile-core to use this special classpath? -->
<compile srcdir="${src.dir}" destdir="${build.dir}/classes/java">
<classpath refid="test.base.classpath"/>
</compile>
+
+ <!-- Copy the resources folder (if existent) -->
+ <copy todir="${build.dir}/classes/java">
+ <fileset dir="${resources.dir}" erroronmissingdir="no"/>
+ </copy>
</target>
<!-- redefine the clover setup, because we dont want to run clover for the test-framework -->
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/1d7094c9/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
index c89ed66..7f6ab2e 100644
--- a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
+++ b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
@@ -27,6 +27,7 @@ import java.security.SecureRandomSpi;
import java.security.UnrecoverableKeyException;
import javax.net.ssl.SSLContext;
+import java.net.MalformedURLException;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeRegistry;
@@ -47,24 +48,92 @@ import org.eclipse.jetty.util.resource.Resource;
import org.eclipse.jetty.util.security.CertificateUtils;
import org.eclipse.jetty.util.ssl.SslContextFactory;
+/**
+ * An {@link SSLConfig} that supports reading key/trust store information directly from resource
+ * files provided with the Solr test-framework classes
+ */
public class SSLTestConfig extends SSLConfig {
+
+ /** @deprecated No longer used except by {@link #setSSLSystemProperties} */
public static File TEST_KEYSTORE = ExternalPaths.SERVER_HOME == null ? null
- : new File(ExternalPaths.SERVER_HOME, "../etc/test/solrtest.keystore");
+ : new File(ExternalPaths.SERVER_HOME, "../etc/test/solrtest.keystore");
+ /** @deprecated No longer used except by {@link #setSSLSystemProperties} */
private static String TEST_KEYSTORE_PATH = TEST_KEYSTORE != null
- && TEST_KEYSTORE.exists() ? TEST_KEYSTORE.getAbsolutePath() : null;
- private static String TEST_KEYSTORE_PASSWORD = "secret";
+ && TEST_KEYSTORE.exists() ? TEST_KEYSTORE.getAbsolutePath() : null;
+
+ private static final String TEST_KEYSTORE_RESOURCE = "SSLTestConfig.testing.keystore";
+ private static final String TEST_KEYSTORE_PASSWORD = "secret";
+
+ private final Resource keyStore;
+ private final Resource trustStore;
+ /** Creates an SSLTestConfig that does not use SSL or client authentication */
public SSLTestConfig() {
this(false, false);
}
-
+
+ /**
+ * Create an SSLTestConfig based on a few caller specified options. As needed,
+ * keystore/truststore information will be pulled from a hardocded resource file provided
+ * by the solr test-framework.
+ *
+ * @param useSSL - wether SSL should be required.
+ * @param clientAuth - whether client authentication should be required.
+ */
public SSLTestConfig(boolean useSSL, boolean clientAuth) {
- this(useSSL, clientAuth, TEST_KEYSTORE_PATH, TEST_KEYSTORE_PASSWORD, TEST_KEYSTORE_PATH, TEST_KEYSTORE_PASSWORD);
+ super(useSSL, clientAuth, null, TEST_KEYSTORE_PASSWORD, null, TEST_KEYSTORE_PASSWORD);
+ trustStore = keyStore = Resource.newClassPathResource(TEST_KEYSTORE_RESOURCE);
+ if (null == keyStore || ! keyStore.exists() ) {
+ throw new IllegalStateException("Unable to locate keystore resource file in classpath: "
+ + TEST_KEYSTORE_RESOURCE);
+ }
}
-
+
+ /**
+ * Create an SSLTestConfig using explicit paths for files
+ * @deprecated - use {@link SSLConfig} directly
+ */
+ @Deprecated
public SSLTestConfig(boolean useSSL, boolean clientAuth, String keyStore, String keyStorePassword, String trustStore, String trustStorePassword) {
super(useSSL, clientAuth, keyStore, keyStorePassword, trustStore, trustStorePassword);
+ this.keyStore = tryNewResource(keyStore, "KeyStore");
+ this.trustStore = tryNewResource(trustStore, "TrustStore");
+ }
+
+ /**
+ * Helper utility for building resources from arbitrary user input paths/urls
+ * if input is null, returns null; otherwise attempts to build Resource and verifies that Resource exists.
+ */
+ private static final Resource tryNewResource(String userInput, String type) {
+ if (null == userInput) {
+ return null;
+ }
+ Resource result;
+ try {
+ result = Resource.newResource(userInput);
+ } catch (MalformedURLException e) {
+ throw new IllegalArgumentException("Can't build " + type + " Resource: " + e.getMessage(), e);
+ }
+ if (! result.exists()) {
+ throw new IllegalArgumentException(type + " Resource does not exist " + result.getName());
+ }
+ return result;
+ }
+
+ /** NOTE: This method is meaningless unless you explicitly provide paths when constructing this instance
+ * @see #SSLTestConfig(boolean,boolean,String,String,String,String)
+ */
+ @Override
+ public String getKeyStore() {
+ return super.getKeyStore();
+ }
+ /** NOTE: This method is meaningless unless you explicitly provide paths when constructing this instance
+ * @see #SSLTestConfig(boolean,boolean,String,String,String,String)
+ */
+ @Override
+ public String getTrustStore() {
+ return super.getTrustStore();
}
/**
@@ -100,10 +169,10 @@ public class SSLTestConfig extends SSLConfig {
// NOTE: KeyStore & TrustStore are swapped because they are from configured from server perspective...
// we are a client - our keystore contains the keys the server trusts, and vice versa
- builder.loadTrustMaterial(buildKeyStore(getKeyStore(), getKeyStorePassword()), new TrustSelfSignedStrategy()).build();
+ builder.loadTrustMaterial(buildKeyStore(keyStore, getKeyStorePassword()), new TrustSelfSignedStrategy()).build();
if (isClientAuthMode()) {
- builder.loadKeyMaterial(buildKeyStore(getTrustStore(), getTrustStorePassword()), getTrustStorePassword().toCharArray());
+ builder.loadKeyMaterial(buildKeyStore(trustStore, getTrustStorePassword()), getTrustStorePassword().toCharArray());
}
@@ -127,10 +196,10 @@ public class SSLTestConfig extends SSLConfig {
SSLContextBuilder builder = SSLContexts.custom();
builder.setSecureRandom(NotSecurePsuedoRandom.INSTANCE);
- builder.loadKeyMaterial(buildKeyStore(getKeyStore(), getKeyStorePassword()), getKeyStorePassword().toCharArray());
+ builder.loadKeyMaterial(buildKeyStore(keyStore, getKeyStorePassword()), getKeyStorePassword().toCharArray());
if (isClientAuthMode()) {
- builder.loadTrustMaterial(buildKeyStore(getTrustStore(), getTrustStorePassword()), new TrustSelfSignedStrategy()).build();
+ builder.loadTrustMaterial(buildKeyStore(trustStore, getTrustStorePassword()), new TrustSelfSignedStrategy()).build();
}
@@ -161,11 +230,11 @@ public class SSLTestConfig extends SSLConfig {
/**
* Constructs a KeyStore using the specified filename and password
*/
- protected static KeyStore buildKeyStore(String keyStoreLocation, String password) {
+ protected static KeyStore buildKeyStore(Resource resource, String password) {
try {
- return CertificateUtils.getKeyStore(Resource.newResource(keyStoreLocation), "JKS", null, password);
+ return CertificateUtils.getKeyStore(resource, "JKS", null, password);
} catch (Exception ex) {
- throw new IllegalStateException("Unable to build KeyStore from file: " + keyStoreLocation, ex);
+ throw new IllegalStateException("Unable to build KeyStore from resource: " + resource.getName(), ex);
}
}
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/1d7094c9/solr/test-framework/src/resources/SSLTestConfig.testing.keystore
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/resources/SSLTestConfig.testing.keystore b/solr/test-framework/src/resources/SSLTestConfig.testing.keystore
new file mode 100644
index 0000000..bcc6ec0
Binary files /dev/null and b/solr/test-framework/src/resources/SSLTestConfig.testing.keystore differ