Added unit tests for SSL.

server/core/config.c

@@ -453,41 +453,69 @@ hashtable_memory_fns(monitorhash,strdup,NULL,free,NULL);
 				if(ssl)
 				{
 				    if(ssl_cert == NULL)
+				    {
+					error_count++;
 					skygw_log_write(LE,"Error: Server certificate missing for service '%s'."
 						"Please provide the path to the server certificate by adding the ssl_cert=<path> parameter",
 						 obj->object);
+				    }
 				    if(ssl_ca_cert == NULL)
+				    {
+					error_count++;
 					skygw_log_write(LE,"Error: CA Certificate missing for service '%s'."						
 						"Please provide the path to the certificate authority certificate by adding the ssl_ca_cert=<path> parameter",
 						 obj->object);
+				    }
 				    if(ssl_key == NULL)
+				    {
+					error_count++;
 					skygw_log_write(LE,"Error: Server private key missing for service '%s'. "
 						"Please provide the path to the server certificate key by adding the ssl_key=<path> parameter"
 						,obj->object);
+				    }
 
-				    if(ssl_ca_cert != NULL && ssl_cert != NULL && ssl_key != NULL)
+				    if(access(ssl_ca_cert,F_OK) != 0)
 				    {
+					skygw_log_write(LE,"Error: Certificate authority file for service '%s' not found: %s",
+						 obj->object,
+						 ssl_ca_cert);
+					error_count++;
+				    }
+				    if(access(ssl_cert,F_OK) != 0)
+				    {
+					skygw_log_write(LE,"Error: Server certificate file for service '%s' not found: %s",
+						 obj->object,
+						 ssl_cert);
+					error_count++;
+				    }
+				    if(access(ssl_key,F_OK) != 0)
+				    {
+					skygw_log_write(LE,"Error: Server private key file for service '%s' not found: %s",
+						 obj->object,
+						 ssl_key);
+					error_count++;
+				    }
 
+				    if(error_count == 0)
+				    {
 					if(serviceSetSSL(obj->element,ssl) != 0)
 					{
 					    skygw_log_write(LE,"Error: Unknown parameter for service '%s': %s",obj->object,ssl);
+					    error_count++;
 					}
 					else
 					{
 					    serviceSetCertificates(obj->element,ssl_cert,ssl_key,ssl_ca_cert);
 					    if(ssl_version)
 					    {
-						serviceSetSSLVersion(obj->element,ssl_version);
+						if(serviceSetSSLVersion(obj->element,ssl_version) != 0)
+						{
+						    skygw_log_write(LE,"Error: Unknown parameter value for 'ssl_version' for service '%s': %s",obj->object,ssl_version);
+						    error_count++;
+						}
 					    }
 					}
 				    }
-				    else
-				    {
-					/** If SSL was configured wrong, the
-					 * service needs to fail.*/
-					skygw_log_write_flush(LE,"Error: Missing SSL certificate paths found in the configuration. "
-						"This service will not use SSL.");
-				    }
 
 				}
 

server/core/service.c

@@ -864,12 +864,20 @@ serviceOptimizeWildcard(SERVICE *service, int action)
 void
 serviceSetCertificates(SERVICE *service, char* cert,char* key, char* ca_cert)
 {
+    if(service->ssl_cert)
+	free(service->ssl_cert);
     service->ssl_cert = strdup(cert);
+
+    if(service->ssl_key)
+	free(service->ssl_key);
     service->ssl_key = strdup(key);
+
+    if(service->ssl_ca_cert)
+	free(service->ssl_ca_cert);
     service->ssl_ca_cert = strdup(ca_cert);
 }
 
-void
+int
 serviceSetSSLVersion(SERVICE *service, char* version)
 {
     if(strcasecmp(version,"SSLV2") == 0)
@@ -884,6 +892,8 @@ serviceSetSSLVersion(SERVICE *service, char* version)
 	service->ssl_method_type = SERVICE_TLS12;
     else if(strcasecmp(version,"MAX") == 0)
 	service->ssl_method_type = SERVICE_SSL_TLS_MAX;
+    else return -1;
+    return 0;
 }
 /** Enable or disable the service SSL capability*/
 int

server/include/service.h

@@ -210,6 +210,7 @@ extern	int	serviceGetUser(SERVICE *, char **, char **);
 extern	void	serviceSetFilters(SERVICE *, char *);
 extern  int     serviceSetSSL(SERVICE *service, char* action);
 extern  int     serviceInitSSL(SERVICE* service);
+extern  int     serviceSetSSLVersion(SERVICE *service, char* version);
 extern  void    serviceSetCertificates(SERVICE *service, char* cert,char* key, char* ca_cert);
 extern	int	serviceEnableRootUser(SERVICE *, int );
 extern	int	serviceSetTimeout(SERVICE *, int );

server/modules/protocol/CMakeLists.txt

@@ -17,6 +17,7 @@ install(TARGETS HTTPD DESTINATION ${MAXSCALE_LIBDIR})
 if(BUILD_TESTS)
   add_library(testprotocol SHARED testprotocol.c)
   install(TARGETS testprotocol DESTINATION ${MAXSCALE_LIBDIR})
+  add_subdirectory(test)
 endif()
 
 add_library(maxscaled SHARED maxscaled.c)

server/modules/protocol/test/CMakeLists.txt

@@ -0,0 +1,10 @@
+configure_file(test_ssl.sh ${CMAKE_CURRENT_BINARY_DIR}/test_ssl.sh @ONLY)
+configure_file(no_ca.cnf ${CMAKE_CURRENT_BINARY_DIR}/no_ca.cnf @ONLY)
+configure_file(no_server_cert.cnf ${CMAKE_CURRENT_BINARY_DIR}/no_server_cert.cnf @ONLY)
+configure_file(no_server_key.cnf ${CMAKE_CURRENT_BINARY_DIR}/no_server_key.cnf @ONLY)
+configure_file(bad_ca.cnf ${CMAKE_CURRENT_BINARY_DIR}/bad_ca.cnf @ONLY)
+configure_file(bad_cert.cnf ${CMAKE_CURRENT_BINARY_DIR}/bad_cert.cnf @ONLY)
+configure_file(bad_key.cnf ${CMAKE_CURRENT_BINARY_DIR}/bad_key.cnf @ONLY)
+configure_file(bad_ssl.cnf ${CMAKE_CURRENT_BINARY_DIR}/bad_ssl.cnf @ONLY)
+configure_file(ok.cnf ${CMAKE_CURRENT_BINARY_DIR}/ok.cnf @ONLY)
+add_test(NAME SSLTest COMMAND ${CMAKE_CURRENT_BINARY_DIR}/test_ssl.sh)

server/modules/protocol/test/bad_ca.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=enabled
+ssl_ca_cert=This is not a value
+ssl_cert=@CMAKE_CURRENT_BINARY_DIR@/server-cert
+ssl_key=@CMAKE_CURRENT_BINARY_DIR@/server-key
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/bad_cert.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=enabled
+ssl_ca_cert=@CMAKE_CURRENT_BINARY_DIR@/ca
+ssl_cert=This is not a value
+ssl_key=@CMAKE_CURRENT_BINARY_DIR@/server-key
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/bad_key.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=enabled
+ssl_ca_cert=@CMAKE_CURRENT_BINARY_DIR@/ca
+ssl_cert=@CMAKE_CURRENT_BINARY_DIR@/server-cert
+ssl_key=This is not a value
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/bad_ssl.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=testing
+ssl_ca_cert=@CMAKE_CURRENT_BINARY_DIR@/ca
+ssl_cert=@CMAKE_CURRENT_BINARY_DIR@/server-cert
+ssl_key=@CMAKE_CURRENT_BINARY_DIR@/server-key
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/no_ca.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=enabled
+#ssl_ca_cert=@CMAKE_CURRENT_BINARY_DIR@/ca
+ssl_cert=@CMAKE_CURRENT_BINARY_DIR@/server-cert
+ssl_key=@CMAKE_CURRENT_BINARY_DIR@/server-key
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/no_server_cert.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=enabled
+ssl_ca_cert=@CMAKE_CURRENT_BINARY_DIR@/ca
+#ssl_cert=@CMAKE_CURRENT_BINARY_DIR@/server-cert
+ssl_key=@CMAKE_CURRENT_BINARY_DIR@/server-key
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/no_server_key.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=enabled
+ssl_ca_cert=@CMAKE_CURRENT_BINARY_DIR@/ca
+ssl_cert=@CMAKE_CURRENT_BINARY_DIR@/server-cert
+#ssl_key=@CMAKE_CURRENT_BINARY_DIR@/server-key
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/ok.cnf

@@ -0,0 +1,28 @@
+[maxscale]
+threads=1
+logdir=@CMAKE_CURRENT_BINARY_DIR@
+datadir=@CMAKE_CURRENT_BINARY_DIR@
+piddir=@CMAKE_CURRENT_BINARY_DIR@
+cachedir=@CMAKE_CURRENT_BINARY_DIR@
+
+[Testservice]
+type=service
+router=readconnroute
+servers=server1
+user=user
+passwd=pwd
+ssl=enabled
+ssl_ca_cert=@CMAKE_CURRENT_BINARY_DIR@/ca
+ssl_cert=@CMAKE_CURRENT_BINARY_DIR@/server-cert
+ssl_key=@CMAKE_CURRENT_BINARY_DIR@/server-key
+
+[Testlistener]
+type=listener
+service=Testservice
+protocol=MySQLBackend
+port=12345
+
+[server1]
+type=server
+address=127.0.0.1
+port=4321

server/modules/protocol/test/test_ssl.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+
+function create_certs()
+{
+    echo "CA cert" > @CMAKE_CURRENT_BINARY_DIR@/ca.pem
+    echo "Server Certificate" > @CMAKE_CURRENT_BINARY_DIR@/server-cert.pem
+    echo "Server Key" > @CMAKE_CURRENT_BINARY_DIR@/server-key.pem
+}
+
+function start_maxscale ()
+{
+    local result=$(@CMAKE_INSTALL_PREFIX@/@MAXSCALE_BINDIR@/maxscale -d -f $1 &> $1.log;echo $?)
+    if [[ $result == "0" ]]
+    then
+        echo "Error: $1 exited with status $result!"
+        exit 1
+    fi
+}
+
+# No CA defined
+printf "Testing No CA defined"
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/no_ca.cnf
+echo " OK"
+
+# No cert defined
+printf "Testing No cert defined"
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/no_cert.cnf
+echo " OK"
+
+# No key defined
+printf "Testing No key defined"
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/no_key.cnf
+echo " OK"
+
+# Bad SSL value
+printf "Testing Bad SSL defined"
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/bad_ssl.cnf
+echo " OK"
+
+# Bad CA defined
+printf "Testing Bad CA defined"
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/bad_ca.cnf
+echo " OK"
+
+# Bad cert defined
+printf "Testing Bad cert defined"
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/bad_cert.cnf
+echo " OK"
+
+# Bad key defined
+printf "Testing Bad key defined"
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/bad_key.cnf
+echo " OK"
+
+# No CA file
+printf "Testing No CA file"
+create_certs
+rm @CMAKE_CURRENT_BINARY_DIR@/ca.pem
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/ok.cnf
+echo " OK"
+
+# No cert file
+printf "Testing No cert file"
+create_certs
+rm @CMAKE_CURRENT_BINARY_DIR@/server-cert.pem
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/ok.cnf
+echo " OK"
+
+# No key file
+printf "Testing No key file"
+create_certs
+rm @CMAKE_CURRENT_BINARY_DIR@/server-key.pem
+start_maxscale @CMAKE_CURRENT_BINARY_DIR@/ok.cnf
+echo " OK"
+
+exit 0