[11/12] mesos git commit: Changed hostname used for SSL cert creation in tests.

[jo...@apache.org]

Changed hostname used for SSL cert creation in tests.

This changes the SSL helpers in libprocess to generate
certs using a hostname determined using the same address
that is advertised by libprocess. This assures that
validation of the certificates will succeed, even in environments
where the loopback interface does not resolve to a single hostname.

The test `SSLTest.BasicSameProcess` is also updated to accommodate
this change.

Review: https://reviews.apache.org/r/51065/


Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/ff5bef9e
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/ff5bef9e
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/ff5bef9e

Branch: refs/heads/master
Commit: ff5bef9ea42c981dd4a9420038444e82d0de5495
Parents: ba5317b
Author: Greg Mann <gr...@mesosphere.io>
Authored: Fri Dec 9 16:27:11 2016 -0800
Committer: Joseph Wu <jo...@apache.org>
Committed: Fri Dec 9 18:01:32 2016 -0800

----------------------------------------------------------------------
 .../libprocess/include/process/ssl/gtest.hpp    | 25 +++++++++++++-------
 3rdparty/libprocess/src/tests/ssl_tests.cpp     |  4 ++--
 2 files changed, 18 insertions(+), 11 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/mesos/blob/ff5bef9e/3rdparty/libprocess/include/process/ssl/gtest.hpp
----------------------------------------------------------------------
diff --git a/3rdparty/libprocess/include/process/ssl/gtest.hpp b/3rdparty/libprocess/include/process/ssl/gtest.hpp
index 2a19b3b..b368eda 100644
--- a/3rdparty/libprocess/include/process/ssl/gtest.hpp
+++ b/3rdparty/libprocess/include/process/ssl/gtest.hpp
@@ -176,12 +176,12 @@ protected:
       cleanup("Could not generate private key: " + private_key.error());
     }
 
-    // Figure out the hostname that 'INADDR_LOOPBACK' will bind to.
+    // Figure out the hostname that libprocess is advertising.
     // Set the hostname of the certificate to this hostname so that
     // hostname verification of the certificate will pass.
-    Try<std::string> hostname = net::getHostname(net::IP(INADDR_LOOPBACK));
+    Try<std::string> hostname = net::getHostname(process::address().ip);
     if (hostname.isError()) {
-      cleanup("Could not determine hostname of 'INADDR_LOOPBACK': " +
+      cleanup("Could not determine hostname of libprocess: " +
               hostname.error());
     }
 
@@ -193,7 +193,7 @@ protected:
         1,
         365,
         hostname.get(),
-        net::IP(INADDR_LOOPBACK));
+        net::IP(process::address().ip));
 
     if (certificate.isError()) {
       cleanup("Could not generate certificate: " + certificate.error());
@@ -302,10 +302,11 @@ protected:
 
     process::network::inet::Socket server = create.get();
 
-    // We need to explicitly bind to the loopback address so the
+    // We need to explicitly bind to the address advertised by libprocess so the
     // certificate we create in this test fixture can be verified.
     Try<process::network::inet::Address> bind =
-      server.bind(process::network::inet::Address::LOOPBACK_ANY());
+      server.bind(
+          process::network::inet::Address(net::IP(process::address().ip), 0));
 
     if (bind.isError()) {
       return Error(bind.error());
@@ -347,8 +348,8 @@ protected:
     const std::vector<std::string> argv = {
       "ssl-client",
       "--use_ssl=" + stringify(use_ssl_socket),
-      "--server=127.0.0.1",
-      "--port=" + stringify(address.get().port),
+      "--server=" + stringify(address->ip),
+      "--port=" + stringify(address->port),
       "--data=" + data};
 
     Result<std::string> path = os::realpath(BUILD_DIR);
@@ -356,6 +357,12 @@ protected:
       return Error("Could not establish build directory path");
     }
 
+    // Explicitly set `LIBPROCESS_IP` in the subprocess to the same IP that was
+    // used to generate the hostname for SSL certificates. This ensures that
+    // certificate verification can succeed.
+    std::map<std::string, std::string> full_environment(environment);
+    full_environment["LIBPROCESS_IP"] = stringify(process::address().ip);
+
     return process::subprocess(
         path::join(path.get(), "ssl-client"),
         argv,
@@ -363,7 +370,7 @@ protected:
         process::Subprocess::PIPE(),
         process::Subprocess::FD(STDERR_FILENO),
         nullptr,
-        environment);
+        full_environment);
   }
 
   static constexpr size_t BACKLOG = 5;

http://git-wip-us.apache.org/repos/asf/mesos/blob/ff5bef9e/3rdparty/libprocess/src/tests/ssl_tests.cpp
----------------------------------------------------------------------
diff --git a/3rdparty/libprocess/src/tests/ssl_tests.cpp b/3rdparty/libprocess/src/tests/ssl_tests.cpp
index 7fa46e4..a32d20e 100644
--- a/3rdparty/libprocess/src/tests/ssl_tests.cpp
+++ b/3rdparty/libprocess/src/tests/ssl_tests.cpp
@@ -141,9 +141,9 @@ TEST_P(SSLTest, BasicSameProcess)
   Try<Socket> client = Socket::create(SocketImpl::Kind::SSL);
   ASSERT_SOME(client);
 
-  // We need to explicitly bind to the loopback address so the
+  // We need to explicitly bind to the address advertised by libprocess so the
   // certificate we create in this test fixture can be verified.
-  ASSERT_SOME(server->bind(Address::LOOPBACK_ANY()));
+  ASSERT_SOME(server->bind(Address(net::IP(process::address().ip), 0)));
   ASSERT_SOME(server->listen(BACKLOG));
 
   Try<Address> address = server->address();