|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one or more |
| 3 | + * contributor license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright ownership. |
| 5 | + * The ASF licenses this file to you under the Apache License, Version 2.0 |
| 6 | + * (the "License"); you may not use this file except in compliance with |
| 7 | + * the License. You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, software |
| 12 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | + * See the License for the specific language governing permissions and |
| 15 | + * limitations under the License. |
| 16 | + */ |
| 17 | +package org.apache.flume.source; |
| 18 | + |
| 19 | +import static org.junit.Assert.assertFalse; |
| 20 | +import static org.junit.Assert.assertTrue; |
| 21 | +import static org.junit.Assume.assumeTrue; |
| 22 | + |
| 23 | +import java.io.IOException; |
| 24 | +import java.nio.file.Files; |
| 25 | +import java.nio.file.Path; |
| 26 | +import java.nio.file.Paths; |
| 27 | +import java.util.List; |
| 28 | +import java.util.stream.Collectors; |
| 29 | +import java.util.stream.Stream; |
| 30 | +import org.apache.flume.Context; |
| 31 | +import org.apache.flume.FlumeException; |
| 32 | +import org.apache.flume.sdk.test.TestKeyStores; |
| 33 | +import org.junit.Before; |
| 34 | +import org.junit.Rule; |
| 35 | +import org.junit.Test; |
| 36 | +import org.junit.rules.TemporaryFolder; |
| 37 | + |
| 38 | +public class TestSslContextAwareAbstractSource { |
| 39 | + |
| 40 | + private static final String KEYSTORE_PASSWORD = "password"; |
| 41 | + |
| 42 | + @Rule |
| 43 | + public final TemporaryFolder tempFolder = new TemporaryFolder(); |
| 44 | + |
| 45 | + private Path keystore; |
| 46 | + |
| 47 | + /** Minimal concrete source exposing the SSL configuration of the abstract class. */ |
| 48 | + private static final class TestSource extends SslContextAwareAbstractSource { |
| 49 | + void configure(Context context) { |
| 50 | + configureSsl(context); |
| 51 | + } |
| 52 | + } |
| 53 | + |
| 54 | + @Before |
| 55 | + public void writeKeystore() throws Exception { |
| 56 | + keystore = TestKeyStores.selfSigned("CN=localhost") |
| 57 | + .writeKeyStore(tempFolder.newFile("keystore.jks").toPath(), "JKS", KEYSTORE_PASSWORD); |
| 58 | + } |
| 59 | + |
| 60 | + private Context sslContext(String password) { |
| 61 | + Context context = new Context(); |
| 62 | + context.put("ssl", "true"); |
| 63 | + context.put("keystore", keystore.toString()); |
| 64 | + context.put("keystore-password", password); |
| 65 | + return context; |
| 66 | + } |
| 67 | + |
| 68 | + private TestSource configuredSource() { |
| 69 | + TestSource source = new TestSource(); |
| 70 | + source.configure(sslContext(KEYSTORE_PASSWORD)); |
| 71 | + return source; |
| 72 | + } |
| 73 | + |
| 74 | + @Test |
| 75 | + public void sslContextIsCreatedFromKeystore() { |
| 76 | + TestSource source = configuredSource(); |
| 77 | + assertTrue(source.isSslEnabled()); |
| 78 | + assertTrue(source.getSslContextSupplier().get().isPresent()); |
| 79 | + assertTrue(source.getSslEngineSupplier(false).get().isPresent()); |
| 80 | + } |
| 81 | + |
| 82 | + @Test |
| 83 | + public void noSslContextWhenSslIsDisabled() { |
| 84 | + TestSource source = new TestSource(); |
| 85 | + source.configure(new Context()); |
| 86 | + assertFalse(source.isSslEnabled()); |
| 87 | + assertFalse(source.getSslContextSupplier().get().isPresent()); |
| 88 | + } |
| 89 | + |
| 90 | + @Test(expected = FlumeException.class) |
| 91 | + public void wrongKeystorePasswordIsRejected() { |
| 92 | + new TestSource().configure(sslContext("wrong")); |
| 93 | + } |
| 94 | + |
| 95 | + @Test |
| 96 | + public void keystoreIsDeletableAfterUse() { |
| 97 | + // The source must not keep the keystore open: on Windows an open file cannot be deleted |
| 98 | + assertTrue(configuredSource().getSslContextSupplier().get().isPresent()); |
| 99 | + assertTrue("The keystore is still open", keystore.toFile().delete()); |
| 100 | + } |
| 101 | + |
| 102 | + @Test |
| 103 | + public void keystoreDescriptorIsReleased() throws IOException { |
| 104 | + // On Linux the open file descriptors of the process are listed under `/proc/self/fd` |
| 105 | + Path fdDir = Paths.get("/proc/self/fd"); |
| 106 | + assumeTrue("Not running on Linux", Files.isDirectory(fdDir)); |
| 107 | + assertTrue(configuredSource().getSslContextSupplier().get().isPresent()); |
| 108 | + String keystorePath = keystore.toRealPath().toString(); |
| 109 | + try (Stream<Path> fds = Files.list(fdDir)) { |
| 110 | + List<Path> open = |
| 111 | + fds.filter(fd -> keystorePath.equals(readLink(fd))).collect(Collectors.toList()); |
| 112 | + assertTrue("File descriptors still open on the keystore: " + open, open.isEmpty()); |
| 113 | + } |
| 114 | + } |
| 115 | + |
| 116 | + private static String readLink(Path fd) { |
| 117 | + try { |
| 118 | + return Files.readSymbolicLink(fd).toString(); |
| 119 | + } catch (IOException e) { |
| 120 | + // The descriptor was closed between the listing and the read |
| 121 | + return null; |
| 122 | + } |
| 123 | + } |
| 124 | +} |
0 commit comments