Skip to content

Commit ddade52

Browse files
jdduncanjdduncan
committed
WL#15166 patch #3 Testing NdbProcess and ndb_sign_keys
Add a unit test, an NdbApi test, and an MTR test. The unit test is testNdbProcess-t The NdbApi test is testMgmd -n SshKeySigning The MTR test is sign_keys in suite ndb_tls Create the ndb_tls test suite. Create the ndb-tls subdirectory in std_data. Create a CA key and certificate in std_data/ndb-tls/. Change-Id: Icec0fa4a9031be11facbd346d09debe8bc8bfe68
1 parent c6e2f62 commit ddade52

File tree

15 files changed

+507
-5
lines changed

15 files changed

+507
-5
lines changed

‎mysql-test/collections/default.push

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ perl mysql-test-run.pl --timer --testcase-timeout=30 --suite-timeout=300 --debug
1818
# Run all Ndb tests separately.
1919
# For builds without Ndb support no tests will be attempted.
2020
#
21-
perl mysql-test-run.pl --timer --testcase-timeout=30 --suite-timeout=300 --debug-server --force --comment=ndb --vardir=var-ndb --skip-combinations --no-skip --with-ndb-only
21+
perl mysql-test-run.pl --timer --testcase-timeout=30 --suite-timeout=300 --debug-server --force --comment=ndb --vardir=var-ndb --no-skip --with-ndb-only
2222

2323
#
2424
# Group Replication

‎mysql-test/include/excludenoskip.list

+1
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ federated_bug_25714.test
107107

108108
# 4.4
109109
check_openssl_version.inc
110+
check_openssl.inc
110111
have_tlsv13.inc
111112
not_have_tlsv13.inc
112113
not_min_protocol_tlsv12.inc

‎mysql-test/lsan.supp

+3
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,6 @@ leak:sasl_client_add_plugin
4646

4747
# The GSS API plugin for SASL has leaks.
4848
leak:gss_acquire_cred_from
49+
50+
# ndb_sign_keys leaks in some error-exit situations
51+
leak:ndb_sign_keys

‎mysql-test/mysql-test-run.pl

+2-1
Original file line numberDiff line numberDiff line change
@@ -3182,6 +3182,7 @@ sub environment_setup {
31823182
ndb_select_all
31833183
ndb_select_count
31843184
ndb_show_tables
3185+
ndb_sign_keys
31853186
ndb_waiter
31863187
ndbxfrm
31873188
ndb_secretsfile_reader
@@ -3754,7 +3755,7 @@ ($)
37543755
# Add MySQL Cluster test suites
37553756
$DEFAULT_SUITES .= "," if $DEFAULT_SUITES;
37563757
$DEFAULT_SUITES .= "ndb,ndb_binlog,rpl_ndb,ndb_rpl,ndbcluster,ndb_ddl,".
3757-
"gcol_ndb,json_ndb,ndb_opt";
3758+
"gcol_ndb,json_ndb,ndb_opt,ndb_tls";
37583759
# Increase the suite timeout when running with default ndb suites
37593760
$opt_suite_timeout *= 2;
37603761
return;

‎mysql-test/std_data/ndb-tls/CA-cert.pem

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIC6DCCAdCgAwIBAgILAOJzsRsTdsy+5KIwDQYJKoZIhvcNAQELBQAwKDEmMCQG
3+
A1UEAwwdTXlTUUwgTkRCIENsdXN0ZXIgQ2VydGlmaWNhdGUwHhcNMjIwNjA2MDEy
4+
NzAxWhcNMjYwNjA2MDEyNzAxWjAoMSYwJAYDVQQDDB1NeVNRTCBOREIgQ2x1c3Rl
5+
ciBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJtZ
6+
p2cfo6Q9TG7krVpfcdKWoAM9yjaWVt7TD6O+N2Zk1fxjgFigQEa20uMwfmaZ4L7n
7+
djWWpK6oa+TaCdfsNAaAdkE2HXA/mcFsd+fPFXOEELgkPoin83HnFRLWnPnj6wRU
8+
3O4r7TsDVqgPjEh4O3vmyOUYR7jw3B6rajDVQFtXT54ZrrsoH+QzWX8mX8Q0WSQd
9+
hKKFekQqnRyLucjJcMfb7B1fLwZGi5dC9/UzDIT4NM0a2mMBL4/9xjg94LYHfTmN
10+
MbmSaLbYQjuGrCwf3nelQIAq5UZ04/7mQ8mNMyEnXDI37FfMhIX1HzYew5nD4nxE
11+
sh/8RrFKpqHSayNj1d0CAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
12+
9w0BAQsFAAOCAQEAJop7adeLAgULgwp4SwXr64DQ7aw2HsSHnI/iCOz6tV96hoDq
13+
COi02L4M5T8PS/T5/JjawZ82D/Xs2m61c3VTNblxP/WIWPMfTRH3cDd7YDjRPRZE
14+
xPZvbAJawMnkV/GtMxXPEScJzoIqjugaZ9B2KXCn20EGlXJ82qDBQZT/9HrYNKki
15+
Cc080C8ybLw2Sm7Ty8SzetS+fMmdfAzqdIHB+IlATOzkhsIvC1A3MG0TP17vtcUW
16+
JcL0sjI//5kX14Sz63lZl1ecVMl4e8oHrdOtrDfM7m2D4x4dfsn0VehP6ZmqygJ/
17+
Pzp7VdwefvR0almfGq4hSGgXI1sR8DspPbgItw==
18+
-----END CERTIFICATE-----

‎mysql-test/std_data/ndb-tls/CA-key.pem

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
-----BEGIN ENCRYPTED PRIVATE KEY-----
2+
MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI1W6H2p92tVsCAggA
3+
MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECLQUM5chjeEsBIIEyLcXK1k+5V3V
4+
F8OsAcxZNAGtkA3XvPvu4wZP4F0BT14x12Z2vL3DFib6krhv4yOJSSzW5P3qlc2v
5+
MzCZOtkkWBA2AQ5L1RF8o2x5AzpK9uyPKCuroiD76iuhNcAjNjeOyJVQmdV8zXdq
6+
QAixLX7nZQV8iorry8DY9nyBwBUxsaAuDYEAwCtLVz/YSCLqqjSXKqQuDmF/lMes
7+
Z4FE8B8O9y+TIqpjlh/7TIYQ8S925DyaS+elU3W2swBR1Vlr6Kc2k+KQw6gNStRj
8+
x1kouFpxknhYUeQwnEKafG7iPoQqtdYNbkmrkEJ6e/2KytTmT0Wlo9HCn4SEKG1q
9+
4VIsMTFXjtX7IzstCYX9+jRFljASP4Ajvbg/Cld27J45/Me5mhsPr4tcXYZseV89
10+
6xqaA14sw7LvLR9MGqOGu9PhezvJ+Lz19kFQGd0q/aYwBr7UXvMJvJVxXlnZIfty
11+
XT3qoqIEaibYNFN666tldVP2K2eJVwV4e8Jc2D9yykodGS5ArmJ0bpsMhQ/oiAPd
12+
eSOCZEPH2iPLtgrdI2e8mH7Ukb1P7cv4m0NPDhlUSym3UeHHFwLN+FB9mlP5eJCy
13+
8Zp/ZUsgLrX8eYKAogu2abMSvPV7z9ZmE0pCnInfxEqA5TR4LKZlLQmxiTipksGc
14+
JniOJ5fqIc8ho2ZZZHR6HI8xyXyxFuCo1Fq10GtHurmrXJo2ENOOXX7R8Z0YdrtH
15+
jg2WSHWEKEdE7AxTU8XeyB17ljnUrtF9K+zZIjkapF9AkCpzgcCAwktqDYd/BaoU
16+
I5lufnb+fkE/LUqHNF4OCZa7C4yD2++0hQQblVbklWz4f/Tkt1HTai5pfFs1RtA8
17+
BrB/IERKkBE3OITIA0whWUvrU/QlItRuP5jEZcw3WA0A8QyITjUa88CgOyC7LUD6
18+
lXNt1A39AfxDwVkNSxy+pOCZm08WTGmaULhJy1fi+UeAUQRxZ3feVAVAckosAEIm
19+
ljosSunZEoZUW05YKyV9LZa7pfPP+5cm1FKoTSNpX2G2eS0v+pxcqQOOeR7HkeRM
20+
W9QewYVpkKQou68aHRG8RuXkcTTeadOwQQCTixWLuX4apJ/AnNLUURefh+qLl4Ko
21+
uFrH1yeae83oopp8bIsFEVxubHCpsrUEftfNpnkZ+puMHeHHNanxz86J8gsi8/jg
22+
2x4nLbbOMaV1dNyLGjeZacmWI1IzZcLWgiiSbflGnn7uLgq2QIevxyJgNKXjUkW5
23+
VUFOIgfj7IAyZWwqFuBH4VrPFEohHKvkF5tI6zbt7WxZorTbSyTjdrBrlTT5sPuA
24+
DKjNtvstWIU43ONsRpMoRy4imaH+vFdA+lY9vOZWmo0g0wjYFRHWcS4eWUxgtcbx
25+
UVhx0MteVhMM9l5gK8Pe+3V1zGZioRVMa0GBCWsdLp+66Td72gclzOoeaAE+xlqJ
26+
vfnaplm/HB6bGNNbUrc+tv6HifWIC+bn/FuIv3ghlF15hr/PFYtupgmR0bFcQfxd
27+
llfxb/1tG12quQNAnmCSBeUGxf6dv3SXCMfbQAH/T6SCb04KhPjSdO0O1Xj+xSTz
28+
onhJOYc+5iFHwrhpTXctz2WCN2rgalWkbAJnRgc3g8QjjCU87SHJDZ86HOCvRLuk
29+
gZTWPbtzlpMXJ+q1MKKyTA==
30+
-----END ENCRYPTED PRIVATE KEY-----

‎mysql-test/suite/ndb_tls/include/check_openssl.inc

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Detect whether compile-time OpenSSL library provides sufficient support
2+
# for NDB to use TLS
3+
4+
let $ver = query_get_value(show status like "Tls_library_version", Value, 1);
5+
let $match = `select "$ver" like "OpenSSL 1.0%"`;
6+
if($match)
7+
{
8+
skip OpenSSL too old;
9+
}
10+

‎mysql-test/suite/ndb_tls/my.cnf

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
!include include/default_mysqld.cnf
2+
3+
#
4+
# Define small two node cluster with only one mysqld
5+
#
6+
[cluster_config.1]
7+
ndbd=,
8+
ndb_mgmd=
9+
mysqld=
10+
ndbapi=,,
11+
12+
[cluster_config]
13+
DataMemory= 30M
14+
NoOfFragmentLogFiles= 4
15+
SharedGlobalMemory= 20M
16+
LongMessageBuffer= 4M
17+
RedoBuffer= 4M
18+
BackupLogBufferSize= 2M
19+
HeartbeatIntervalDbDb= 30000
20+
HeartbeatIntervalDbApi= 30000
21+
22+
[mysqld]
23+
ndbcluster
24+
ndb-wait-connected=30
25+
ndb-wait-setup=120
26+
ndb-extra-logging=99
27+
28+
[cluster_config.mysqld.1.1]
29+
NodeId=51
30+
Dedicated=1
31+
32+
[mysqld.1.1]
33+
ndb-nodeid=51
34+
35+
[ENV]
36+
NDB_CONNECTSTRING= @mysql_cluster.1.ndb_connectstring
37+
MTR_NDBMTD= 1
38+
39+
[ndb_mgmd.1.1]
40+
ndb-tls-search-path=$MYSQLTEST_VARDIR/mysql_cluster.1
41+
42+
[ndb_sign_keys]
43+
ndb-tls-search-path=$MYSQLTEST_VARDIR/mysql_cluster.1
44+
passphrase=Stockholm

‎mysql-test/suite/ndb_tls/sign_keys.result

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
SELECT 1;
2+
1
3+
1
4+
ndb-api-cert
5+
ndb-api-private-key
6+
ndb-data-node-cert
7+
ndb-data-node-private-key
8+
ndb-mgm-server-cert
9+
ndb-mgm-server-private-key

‎mysql-test/suite/ndb_tls/sign_keys.test

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
--source include/have_ndb.inc
2+
--source suite/ndb_tls/include/check_openssl.inc
3+
4+
## TEMPORARILY SKIP THIS TEST ON WINDOWS
5+
##
6+
## Remote Key Signing (at line 106) will time out very slowly and create
7+
## crash dumps. Use the testNdbProcess-t unit test to isolate this issue,
8+
## then re-enable this test on Windows.
9+
##
10+
--source include/not_windows.inc
11+
12+
# The MySQL server is up
13+
SELECT 1;
14+
15+
# On startup, none of the files exist
16+
--error 1
17+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-cert
18+
--error 1
19+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-private-key
20+
--error 1
21+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-private-key
22+
23+
# Create a CA
24+
--exec $NDB_SIGN_KEYS --create-CA
25+
26+
# Now the CA files exist
27+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-cert
28+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-private-key
29+
30+
# Create all the keys and certs for this cluster
31+
--exec $NDB_SIGN_KEYS --create-key
32+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-cert
33+
--list_files $MYSQLTEST_VARDIR/mysql_cluster.1 ndb-*
34+
35+
# Remove them; remove_file will fail if a file does not exist.
36+
# On Windows, private key files must be writable to be removed.
37+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-private-key
38+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-private-key
39+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-private-key
40+
41+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-private-key
42+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-cert
43+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-private-key
44+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-cert
45+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-private-key
46+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-cert
47+
48+
# Create a pending key and a 90-day certificate for the management node.
49+
--exec $NDB_SIGN_KEYS --create-key --pending -n 3 --schedule=70,5,80,5,90,0
50+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-pending-key
51+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-pending-cert
52+
53+
# Promote the files from pending to active
54+
--exec $NDB_SIGN_KEYS --promote -n 3
55+
56+
# Now the files have been renamed from pending to active
57+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-private-key
58+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-cert
59+
60+
# The old pending files do not exist
61+
--error 1
62+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-pending-key
63+
--error 1
64+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-pending-cert
65+
66+
# Create an active key and certificate for a data node, with bound node id
67+
--exec $NDB_SIGN_KEYS --create-key -n 2
68+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-private-key
69+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-cert
70+
71+
# Create a pending client key and cert in no-config mode
72+
--exec $NDB_SIGN_KEYS --no-config --create-key --pending -t api --bind-host=0
73+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-pending-key
74+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-pending-cert
75+
76+
# Then promote the pending files to active
77+
--exec $NDB_SIGN_KEYS --no-config -t api --promote
78+
79+
# Remove them
80+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-private-key
81+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-private-key
82+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-cert
83+
84+
# Try to create a CSR for node 10.
85+
# There is not a node 10 configured, so this fails.
86+
--error 110
87+
--exec $NDB_SIGN_KEYS -n 10 --create-key --skip-sign
88+
89+
# Try to create a CSR for node 10 in no-config mode.
90+
# This fails because -n and no-config mode are incompatible
91+
--error 101
92+
--exec $NDB_SIGN_KEYS -l -n 10 -t api --create-key --skip-sign
93+
94+
# Try to create a CSR for an API node in no-config mode.
95+
# This fails because it wants to bind a hostname, but none is available.
96+
--error 34
97+
--exec $NDB_SIGN_KEYS -l -t api --create-key --skip-sign
98+
99+
# Create the CSR for an API node in no-config mode.
100+
--exec $NDB_SIGN_KEYS -l -t api --create-key --skip-sign --bind-host=0
101+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-cert-request
102+
103+
# Test remote key signing with a tool
104+
# (using ndb_sign_keys itself as the tool)
105+
# Because the CSR already exists, the binding options are not necessary.
106+
--let $cmd = `SELECT substring_index("$NDB_SIGN_KEYS", " ", 1)`
107+
--exec $NDB_SIGN_KEYS -l -t api -X $cmd >> $MYSQLTEST_VARDIR/tmp/rsk.out
108+
--remove_file $MYSQLTEST_VARDIR/tmp/rsk.out
109+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-cert
110+
--error 1
111+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-cert-request
112+
113+
# Refresh the certificate for node 2, but keep the existing key
114+
--exec $NDB_SIGN_KEYS -n 2 --schedule=70,5,80,5,90,0
115+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-retired-cert
116+
--error 1
117+
--file_exists $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-retired-key
118+
119+
# Check all the certs in the path, in no-config mode.
120+
--error 1
121+
--exec $NDB_SIGN_KEYS --no-config --check --replace-by=-91
122+
123+
# Check all the certs in the path, using config
124+
--error 1
125+
--exec $NDB_SIGN_KEYS --check --replace-by=-91
126+
127+
# Check the key cert node 3, using config (check passes)
128+
--exec $NDB_SIGN_KEYS --check --replace-by=-50 -n 3
129+
130+
# Check the cert for node 3, using config (check fails)
131+
--error 1
132+
--exec $NDB_SIGN_KEYS --check --replace-by=-91 -n 3
133+
134+
# Replace the key and the certificate both
135+
--exec $NDB_SIGN_KEYS --create-key -n 3
136+
137+
# Rotate the CA
138+
--exec $NDB_SIGN_KEYS --rotate-CA
139+
140+
# On Windows, private key files must be made writable to be removed.
141+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-private-key
142+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-private-key.retired
143+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-private-key
144+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-private-key
145+
--chmod 0600 $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-private-key
146+
147+
# Delete everything so the test can be repeated
148+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-private-key
149+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-cert
150+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-private-key.retired
151+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/NDB-Cluster-cert.retired
152+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-private-key
153+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-cert
154+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-data-node-retired-cert
155+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-cert
156+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-private-key
157+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-mgm-server-retired-cert
158+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-private-key
159+
--remove_file $MYSQLTEST_VARDIR/mysql_cluster.1/ndb-api-cert

‎storage/ndb/src/common/util/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ FOREACH(tests
113113
testSecureSocket
114114
testConfigValues
115115
testTlsKeyManager
116+
testNdbProcess
116117
)
117118
NDB_ADD_TEST("${tests}-t" "${tests}.cpp" LIBS ndbmgmapi ndbgeneral ndbportlib)
118119
ENDFOREACH(tests)

0 commit comments

Comments
 (0)