[jira] [Commented] (ARTEMIS-3185) Various TLS tests fail on newer JDKs/environments

["Robbie Gemmell (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/ARTEMIS-3185?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17386125#comment-17386125 ] 

Robbie Gemmell commented on ARTEMIS-3185:
-----------------------------------------

Its fairly typical for such things to live beside the test using them or in the src/test/resources of the module the tests exist, the latter in particular if they are general files that most tests would only need to use an identical set for. I would guess the folks that used these 'mqtt crl' files for other tests in the integration tests module did so because of the latter and especially given the files particularly generic naming. I didnt add most of the uses of them but certainly could have some of them, as its really the obvious usage to go for. Most of these tests just need a very simple server keystore and a trust store with the CA cert that signed it (actually I've come to realise none of the other stores use a CA cert, besides those 'mqtt crl' ones, I would also change that to make the tests better/more-representative and also simplify the number of stores needed).

I dont think that it really makes more sense for the instructions of basic keystores+truststore to be embedded across different tests deep within the source tree, and need to be copied out of their javadoc and edited in order to run, and then for the resulting stores files to be created all alongside each other but in an entirely different maven module from those instructions (files under tests/unit-tests, instructions inside tests within tests/integration-tests).

Its so much simpler to update the keystore/truststore resources if they sit next to instructions that can simply be executed as a script to regenerate them. Theres no confusion about which commands were run or from where and updating the files takes a instant to run/source the existing script (modifying the script first if needed), less time than even finding and copying ones embedded in different tests elsewhere. Looking for all changes to the files and the commands that created them? Simple check of the diff of that sole location.

> Various TLS tests fail on newer JDKs/environments
> -------------------------------------------------
>
>                 Key: ARTEMIS-3185
>                 URL: https://issues.apache.org/jira/browse/ARTEMIS-3185
>             Project: ActiveMQ Artemis
>          Issue Type: Test
>          Components: Tests
>    Affects Versions: 2.17.0
>            Reporter: Robbie Gemmell
>            Priority: Major
>
> Various broker integration tests fail after I updated to Fedora 33, seemingly on all JDK versions but certainly with 8u275 and above, with the failing tests all being TLS related. For example, AMQPConnectSaslTest, JMSSaslExternalTest, JMSSaslExternalLDAPTest failed, though there are others.
> Specifically, the related keystore for those tests looks to be keystore1.jks under tests/integration-tests/src/test/resources (though possibly other files in there and related tests could be affected or need updated also). The key contained uses SHA1withRSA for the signature, which keytool notes is disabled and so that is presumably the problem:
> {noformat}
> $ keytool -keystore keystore1.jks -storepass changeit -list -v
> ...snipped...
> Signature algorithm name: SHA1withRSA (disabled)
> ...snipped...
> <keystore1> uses the SHA1withRSA signature algorithm which is considered a security risk and is disabled.
> {noformat}
> I'm not clear how the file was generated and dont see the CA key used to sign it and which matches up to the truststore.jks file (it uses SHA256withRSA sig and so should be fine if the key were updated in isolation). If someone who knows the process used could update the key that would be great.
> A suggestion I would make is to create a script that creates the files, both so it can be seen later what was done, and more easily repeated and/or updated when needed. E.g for example we do this with the [Qpid JMS tests resources|https://github.com/apache/qpid-jms/blob/0.57.0/qpid-jms-client/src/test/resources/README.txt], which I adapted for creating the ['broker-connections' TLS example|https://github.com/apache/activemq-artemis/blob/master/examples/features/broker-connection/amqp-sending-overssl/store-generation.txt] resources when I was updating that.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)