From 355cb3b0e41785c4cc496b0eef90a86fe975d615 Mon Sep 17 00:00:00 2001 From: Marcin Owsiany Date: Tue, 23 Jul 2024 11:21:57 +0200 Subject: [PATCH 1/5] tests: rewrite TLSChallengeTest in go, drop dead code --- .../nginx-lb-certs/ca-key.pem | 52 ---- .../tls-challenge-test/nginx-lb-certs/ca.pem | 29 -- .../nginx-lb-certs/generate-certs.sh | 21 -- .../nginx-lb-certs/leaf-cert.pem | 29 -- .../nginx-lb-certs/leaf-key.pem | 51 ---- .../tls-challenge-test/nginx-proxy.conf | 12 - .../orchestratormanager/Kubernetes.groovy | 90 ------ .../OrchestratorMain.groovy | 5 - .../main/groovy/util/ApplicationHealth.groovy | 5 - .../src/test/groovy/TLSChallengeTest.groovy | 206 ------------- .../nginx-loadbalancer.qa-tls-challenge.crt | 25 ++ .../nginx-loadbalancer.qa-tls-challenge.key | 28 ++ tests/bad-ca/root.crt | 46 +-- tests/bad-ca/self-signed.invalid.crt | 40 +-- tests/bad-ca/ssl-certs.sh | 67 ++-- tests/bad-ca/untrusted-root.invalid.crt | 42 +-- tests/common.go | 285 ++++++++++++++++++ tests/common_test.go | 62 ++++ tests/e2e/yaml/central-cr.envsubst.yaml | 2 +- tests/tls_challenge_test.go | 232 ++++++++++++++ 20 files changed, 735 insertions(+), 594 deletions(-) delete mode 100644 qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca-key.pem delete mode 100644 qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca.pem delete mode 100755 qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/generate-certs.sh delete mode 100644 qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-cert.pem delete mode 100644 qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-key.pem delete mode 100644 qa-tests-backend/artifacts/tls-challenge-test/nginx-proxy.conf delete mode 100644 qa-tests-backend/src/test/groovy/TLSChallengeTest.groovy create mode 100644 tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.crt create mode 100644 tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.key create mode 100644 tests/common_test.go create mode 100644 tests/tls_challenge_test.go diff --git a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca-key.pem b/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca-key.pem deleted file mode 100644 index d99f028d7b701..0000000000000 --- a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca-key.pem +++ /dev/null @@ -1,52 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDBLLJWeekuxnG6 -RoHE0QR2PJVRfv1ywWLFB+mrxKORI/fK8PFg5iQUI0AgJP2IL4yEdEbcNkBQHmZr -7GT8qyzWVdsCCYQD9IU21fuan5ScF2P8jqaPkuG+I/lz4INss7EUWyTo0QsNbmTr -EVaVe1oqAmcuBVHJw6eX/hjUKJ5zazFXWq0FjuAzp7W1o402vAUHqlnyiBcrNIi3 -WT+7fThLGpgdX1xlwMLDbGi4zU5r7yWJzd0PswtIZrtdvsjjuev/n7CNA9bj7Hcl -oCjmaRj0s2853ZSSrjgUkxh3E2tlcoMUH8KxBlgwu07gzmmimMUOMoCFsPePyuDm -QU8YIxWzAQoRoK9mFiPIAmr2smRhHBwIPM4TC+KEjvSDRKKweHb0w/FpkK+jvPdf -vDQbWxRM6O6Pkn6aoLa5l9CScdJOa0slXFK+KN/dDbuoN6DSwG6NMU66cughBjFQ -qZr2wvt9p5wBM+/tl6AE/04At+lwqlzphEq0TxbaU4E7lOT/DU7Lvecw9Bd55AXZ -DxUjlKQwu27EDHM3BBnKUdJcsZFVfEqYIloD401GDTTd0/J9XrcXhWvNSIGJ7xJd -kLe23ATL7xb/LLP6HHd+SP1fOkCDY3DU7WLSG0sYdw2ByK0t2X6epRjK4ei7JTDB -ODPzd4UXMdAzpgDrMD/QJ0F5PFywDQIDAQABAoICAHoXUtvfD2cV21ldKLWJWaWV -ItawSWXXHiLjnmeGz85zCjEE2bphmpnzsZrfZjJFwy0QBJ032KwKmrdJYIZldeA9 -wT7nXr3VNMD0u6H9jEKfcf1094a00eKIACih1M7GP3xbItfXD4I8rKH5glzV6qW0 -gRwQFqJL+8fPvEeTKJpQPI42bDagF8nuDKWxqhXW/eLbYyArrWEMQgCH8wT/3q1x -MIUX+WECVNaI1SM/93m2W2Zea4J5qf7nlzJn27Y6kxMsDb0CmTXTBXcNY+xErpYy -NnE/P6D5Zc5zLbpM1sr2diwo6rdSCDk8mVzyeMdggOM5PgvBTqZeFojQ7DmYKySv -tjlBZ8SGcaE2pw/SYPpNgZnvZn2O8l97l/8W1ZIOINblbr/K4ImWmOGRDSGmIr7d -vVtchTJ1SdGkg57x2ErICKEsr+NccOu/nok0RjC6bqjUZjRQvO1jtrAG9hWx4Bl0 -/U7SeNk6wdLRQR6mcxt4pMAvETdHCKult+6Oy0TWxoCkmUZs24B8qxzy9Lwot5r6 -NaiX78/hGypZpRe/kLLRoiTZyxg8UdIZuKMHaxkztKQP69uvphqGABHhgDbDwXkZ -Dw7pq9ElylwMKio6wtynOz4iCMk6YbbgobMCGtBY8QFRrQZUMqTGd5lCbUYVcseW -UkoFrn0qQckaUkTnucjhAoIBAQDiF3nBVofGylVvJ8ZtE+kX+P5Lf8soOwa9MhvB -1xyl5fZpB/7KE2cIr5DXw7alXL4btNSZYosjMZ4XrB5NKN8J750bRmaNAhyh2d2y -MQXXRZI2O1hvUtKMH1qt91VXjM3ByddHJ4AeP/I2RmHhrVSGyjEAFYhcA2V2Wdy7 -b46qlUoh9tmCWPdCsuogsV8mTFuwDox9YWWY3sjZ6TtpN5hU+gISeZAGXd1O5FEA -9XMRdoraKpuk5rQW6Sbwg7Gd4dK6sbbVFJF/I6pINtrT5h7a6ziOXsrEnwL9v62i -1VCgcCWF8kvF9772eZ+5eurQJerDsknOKaFs5cGuOxtSf/Y1AoIBAQDaun5cpJ9a -zQFfYD79ZmSOoPZrKB3qSt/7xvlAvzkxxUFWSOp1t/puN1SB98vcFsR5zPEPEkoT -8BKeATECJhjL5+Hvvn/RFyXxtI67mxgqiMzhaHus8CoWsC6GF7tzsNJqOdkWDT+p -NJP8pJxDJE89iSkjNZu9YXMOicFWIbPWtGR5UpxE1NT3Bj+wyo2xutnV3itfoEQV -x4o5YvgBbV8r+Ak4+ImfLg0u2xxlPEMmkdrHspIAWYzfDGtg5Xi8nitID5KKReeW -g3MNrDeL56Z4yYNYR5Efzw0cDMtOCSTpS7g9AYZs58Bt5uBdiWXjL9mGbN9kZkky -MS1IFfosci15AoIBAQC4pTl/p36d4FLjw9Uu8irUtDpiSI0PXx2C2HCI33h7GJMk -di4ktLHaCyA8xo7dACAWmpliZ3OAm54kcSISHAYDpFhnlRhdotLlb/u58oV1qVDe -z5rK2BYx781r9GoTZWAJGyGg7+aXTdwvbU21NIyqxGg+TFef5fowLPWzcklOkTwI -/wPmi2fsZhgF+TXfHk9nOoqMP0XtEk1wgiVOKeRTyhZ1Jih0uqXqL1bkdJC0O17t -DA0vIGcFqwZtOPCPI4WpiUfrP7AP6H3CGmKe2fprCd2XkF0DNWYI/Ej/ij0dulk6 -yoYNuOaRfwTuQy+QLNdNWccjAybdu8pw077dorndAoIBAQC3Ev2NAWU4FPsfH2nZ -owhrsSJP0oYngoAzNvmNTgDLPbVQSTulSFZeRgV/uy5wisXsxLLH0KEcSwbqJUkl -6Uk78lxT1HkbQ2rJAj2tnUT+5P3HdTJ/L42q69AlAFwvm0KjEsQ3BuPP9mgfQJBi -SlPgx5sdE1PFkXlCI98k/pSOEvM98P1HR3TxRdOtX/x1VFXcAlb/dR9Hs3poSgQW -/bp5DOR7QNu/1kXGgDMmMOhrsg0StM4raMjWMIj301nZVfIYIKChB52th1yXhxv/ -B+d4lgJPs6cunpj0b2kDaffxJSWSOmKPaPLRijslT0lufLBvKVVZrZt6XVrvSSXa -ab7RAoIBAGTWF5/cmZOMvKxak5BuNGt6sy3zbcot0bXQj3YrYpvlbjGBjUPq/10o -/A7lOdjAQZq62KnY/fZCIkSCOGNSdL18ewOgpfZLhViFnbJVR+n1IiakBNgaMA+A -oaI9xoKaMY5GIrzGZSa4OliD/cGHRz2I5QwUhULNxlUtUbPvE5HtCQ4JHaeJT+J6 -QNBcfg3oUL6qLA8kBCTBvNuVMSsm+N9wGSpN5jHW+VOjrjDFu9lcAJefDsKnObBe -fohMO1pJq5raSkVXjikwAU0+8xfElwfJSCkuTr1czhHr7VcHKw4rGVw37BgIQZ78 -MZxFCn137FPDj9x1uNHiKypit1s8cnU= ------END PRIVATE KEY----- diff --git a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca.pem b/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca.pem deleted file mode 100644 index 2b712e92d65cc..0000000000000 --- a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/ca.pem +++ /dev/null @@ -1,29 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIE8DCCAtigAwIBAgIJAO3bObwJI2n+MA0GCSqGSIb3DQEBCwUAMC0xKzApBgNV -BAMMIkxvYWRCYWxhbmNlciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjIwOTIy -MTczNTU3WhcNMjcwOTIxMTczNTU3WjAtMSswKQYDVQQDDCJMb2FkQmFsYW5jZXIg -Q2VydGlmaWNhdGUgQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC -CgKCAgEAwSyyVnnpLsZxukaBxNEEdjyVUX79csFixQfpq8SjkSP3yvDxYOYkFCNA -ICT9iC+MhHRG3DZAUB5ma+xk/Kss1lXbAgmEA/SFNtX7mp+UnBdj/I6mj5LhviP5 -c+CDbLOxFFsk6NELDW5k6xFWlXtaKgJnLgVRycOnl/4Y1Ciec2sxV1qtBY7gM6e1 -taONNrwFB6pZ8ogXKzSIt1k/u304SxqYHV9cZcDCw2xouM1Oa+8lic3dD7MLSGa7 -Xb7I47nr/5+wjQPW4+x3JaAo5mkY9LNvOd2Ukq44FJMYdxNrZXKDFB/CsQZYMLtO -4M5popjFDjKAhbD3j8rg5kFPGCMVswEKEaCvZhYjyAJq9rJkYRwcCDzOEwvihI70 -g0SisHh29MPxaZCvo7z3X7w0G1sUTOjuj5J+mqC2uZfQknHSTmtLJVxSvijf3Q27 -qDeg0sBujTFOunLoIQYxUKma9sL7faecATPv7ZegBP9OALfpcKpc6YRKtE8W2lOB -O5Tk/w1Oy73nMPQXeeQF2Q8VI5SkMLtuxAxzNwQZylHSXLGRVXxKmCJaA+NNRg00 -3dPyfV63F4VrzUiBie8SXZC3ttwEy+8W/yyz+hx3fkj9XzpAg2Nw1O1i0htLGHcN -gcitLdl+nqUYyuHouyUwwTgz83eFFzHQM6YA6zA/0CdBeTxcsA0CAwEAAaMTMBEw -DwYDVR0TBAgwBgEB/wIBADANBgkqhkiG9w0BAQsFAAOCAgEAQD+6HNyvC2mI9r64 -N/x3dULe1YnqN8tkcT60HNXLsp85DyKE92C60hdnh5qLdugayyFm3cjpoHHSdEEp -My6RoQyZquZvuVIVhR1e7STpGUxB2K2XQTPjtNNb5SexWTOcA00at/z8BlWAHqv2 -/SxPji8Yo32Fnq5oUUfjJIQ7vPTSie9f5MOnDbAfPjWWKLrvX47RJ1EtXDj3gi5u -uJke3L5fKFZJAhEtvsTEkq3dNub054/8S7IG3Sd4N5VxVt6OuSgDr56rBI84hzLe -v86QtjqyLjfR1YK876H7SJd5X5UJsgUJZK3985mAbEWgP+KnZmPNFnFC0AKYJ7TR -WxlLSQW5FKOJ8yMaElRaj+y6md6RtMowosx3L4JpUSGY83WuXaI5cPdQtuMnyqlb -F9lRLNP7Hehq4BaLqgONmyjGYsgE6JmaKRciJyRk92VyluTHNEdsAY4Jcfal36Z/ -bYwLSWtRKKJo8eWczSp2enbLbA6jUI65QtcvTTKM9Ruiubeay6MT3Jj4DX5akAwN -uEXF3cmvYtSFYuVJFHk7un9mCUued4g5mmYf7nDAqH8ncVhLP44Un4/2ytOla7d7 -x174TkfUESlTvkILsZqwlseF2A69w4sQCmRx0H8XJVHDMEY6EwFUidvG/RRe4a1B -n/h6TPs4x+aHHWsHXZVXkhQ7BRE= ------END CERTIFICATE----- diff --git a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/generate-certs.sh b/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/generate-certs.sh deleted file mode 100755 index 2b97fdf1c2384..0000000000000 --- a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/generate-certs.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/usr/bin/env bash -set -exo pipefail - -root_ca_exts=" - [req] - distinguished_name=dn - x509_extensions=ext - [ dn ] - [ ext ] - basicConstraints=CA:TRUE,pathlen:0 -" - -openssl req -config <(echo "${root_ca_exts}") -nodes -new -x509 -newkey 4096 -keyout ca-key.pem -out ca.pem -days 1825 -subj "/CN=LoadBalancer Certificate Authority" - -leaf_ca_exts="subjectAltName=DNS:nginx-loadbalancer.qa-tls-challenge" -openssl genrsa -out leaf-key.pem 4096 -openssl req -new -key leaf-key.pem -subj "/CN=nginx LoadBalancer" | \ - openssl x509 -sha256 -extfile <(echo "${leaf_ca_exts}") -req -CAcreateserial -CA ca.pem -CAkey ca-key.pem -out leaf-cert.pem -days 1825 - -rm ca.srl - diff --git a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-cert.pem b/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-cert.pem deleted file mode 100644 index 5714d7dc0f68c..0000000000000 --- a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-cert.pem +++ /dev/null @@ -1,29 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIE/zCCAuegAwIBAgIJAPMA43zkAPjjMA0GCSqGSIb3DQEBCwUAMC0xKzApBgNV -BAMMIkxvYWRCYWxhbmNlciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjIwOTIy -MTczNTU4WhcNMjcwOTIxMTczNTU4WjAdMRswGQYDVQQDDBJuZ2lueCBMb2FkQmFs -YW5jZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCZJrnH3McHOybt -zzhkqrScSoUSkIXG7vEV2P/k4QLD57ZYyFZQiGpa129/9U242XRKrPtnwLuzbuYI -h86nDoo0CD/u368FA2lO7jbp8a5ND2S0iJvlrK2/GxSs7fWknzHvGs1/i1G6PwZx -rV676szPWHmVJqwvP5+06WtyAjg5+NFfN1Sl88XGsPlFQgV+VRS2e7st/jZAoMc/ -OMGwOFDW6lCTS0X5ED/OphTs/OSlU1SjX3h+tWKGxggMLcWYxvMUAFNI1XqqeVo+ -MQ6OxXlRquAchohE0fFjKSvFYLRz0fi/lUeWJ2Dp9bi1gZrg2nCmPJaTVfUVbX00 -vjXNwzQDW6ATZaNWw90GbqSZDnMcb+6LTjeyBgBCDB8dPehSrVWEEhy0A+v4H+uT -DLFmJ3evBkousoCEmCWfzTvvZQSR1QgzkZmYV1K03K+rQ8kFa1BWNcmp7kAhuZ7V -SbucbYMQVza/HEt+3oPB+SJNd9GVR4u6rpcQoSIINaZ+olZw4BDEwQhysAVi3gFF -npCiHb9uioO0fsG9j/pbVfcxi/o25FByTyJpMFElsP7Fu/jVgDW0i2rHkCPKUbG0 -GjWinrg4ZN0Y2WCcYPNU+oi2DRM+5Q1LoRg/y/x9puIPvS06NC8bCYBTKntHUyHm -KgcT91aeCkNJNm5m/VwUySWeH/KiswIDAQABozIwMDAuBgNVHREEJzAlgiNuZ2lu -eC1sb2FkYmFsYW5jZXIucWEtdGxzLWNoYWxsZW5nZTANBgkqhkiG9w0BAQsFAAOC -AgEAKV9TMVOVGRMtUd/9uJ0+MFT85Q1CnGsU7xs1A9K/SpEiaFyZQngsREzfTtkA -8h51SzH+qabSESkPjBk1sXPsVKlkqcQmNq/k3mY2+/u5SUKQEoJll1jjwqgdK/7c -rCWffF6sqqlSzw/iR9+8AJtppb4lDrDV5lY0cz/8siKUMUUY3X0epnAtm/kKk5Xo -gMqFwl1fMxzAlG+586e0szNBYOUoGc3+Hvdwgq0eWcEsLHBTaGJzSDocBwKWD97F -Vbd6OR5J1vi13SaqrML8EJHHV0djzdSnJQN/fSlM635GxdgkBxR8ZFpTDLwlltK4 -HzYWCD7UfgY9ywUiBs7DFj4bdl/EmxyaJKgMsVOJc02xw9y3bkg1isKy+deMASTi -csKazE+TA1UZj4i2TkpcsRd0Qi9mqIb+8lr2fsFZiiQPGGUoXsY3a4ONyszAGvUd -t3Y1iWRIC3q67ehl7nhzEoxkAbKjsWnKe+dmm/9Wa8dX40ZXfZ1tiBB7vgwb2PQd -n5I8vP7mLilAkiD4PGnpJfHSavk1t4TsPgChEBqNR7KOBs0FaL5GQK4pto96Kknn -dYCludXmV2SuJ35OjDTgDssY8PqAyc6wPbOR69Mo91LLiVMZepkKl1pOTDImqFM+ -Vc9QK9pwtMB10mEwXYUg4JM6Em62kuHRTK63XYAGkDZtu2k= ------END CERTIFICATE----- diff --git a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-key.pem b/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-key.pem deleted file mode 100644 index 234ed344bb687..0000000000000 --- a/qa-tests-backend/artifacts/tls-challenge-test/nginx-lb-certs/leaf-key.pem +++ /dev/null @@ -1,51 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIJKQIBAAKCAgEAmSa5x9zHBzsm7c84ZKq0nEqFEpCFxu7xFdj/5OECw+e2WMhW -UIhqWtdvf/VNuNl0Sqz7Z8C7s27mCIfOpw6KNAg/7t+vBQNpTu426fGuTQ9ktIib -5aytvxsUrO31pJ8x7xrNf4tRuj8Gca1eu+rMz1h5lSasLz+ftOlrcgI4OfjRXzdU -pfPFxrD5RUIFflUUtnu7Lf42QKDHPzjBsDhQ1upQk0tF+RA/zqYU7PzkpVNUo194 -frVihsYIDC3FmMbzFABTSNV6qnlaPjEOjsV5UargHIaIRNHxYykrxWC0c9H4v5VH -lidg6fW4tYGa4NpwpjyWk1X1FW19NL41zcM0A1ugE2WjVsPdBm6kmQ5zHG/ui043 -sgYAQgwfHT3oUq1VhBIctAPr+B/rkwyxZid3rwZKLrKAhJgln80772UEkdUIM5GZ -mFdStNyvq0PJBWtQVjXJqe5AIbme1Um7nG2DEFc2vxxLft6DwfkiTXfRlUeLuq6X -EKEiCDWmfqJWcOAQxMEIcrAFYt4BRZ6Qoh2/boqDtH7BvY/6W1X3MYv6NuRQck8i -aTBRJbD+xbv41YA1tItqx5AjylGxtBo1op64OGTdGNlgnGDzVPqItg0TPuUNS6EY -P8v8fabiD70tOjQvGwmAUyp7R1Mh5ioHE/dWngpDSTZuZv1cFMklnh/yorMCAwEA -AQKCAgEAgxKSo4u/RuAINDVKRVWX178rXrUT2Sr8aD9c2mz86d9wv1FOFgR6SZ7h -zXiK+S4aiiK705Mu0aWS+DAK3AzkmR2KYg1MhBTkVuonU1dFXqxS+vODwTBlTw6F -Rm8t8aNRoBqnT4ZT/vsbr8S6NEgC214USGNdr95a+AFhtKRTrMHXpw76wkD8vk0O -OYkEnJeCb587lmRf2DYB8IjJs+CuxxCovzcH/t46Tcj0VdMmeJv17xCxVng0h7YK -gynVWCjFNxQEM2yJXEcZxepEVEqLxypgPemhzIyFc+FzlaxrJEjLBGRlbQvstK9Z -UvZGMDSjfpKSKCzD4X/gTXiRIbXz16zJ8kXRHtByOItG67/Mek9VjavZUYvDnJiu -0RSKTUDdoR4ygr6LJ4MwhNxRQwkR8jAk4K9wI8WWt4ooL0g0oVSjDo5g4K0kqNBD -GzbGgrjH1fkwZR6xp3KD+D+don+q7YZ/I8vZPaY7eTk5QT0M1SsoEG9XoYwUUQNg -IVAmUKtCnk0OX/Culp49PQuKb3T7RsB1Yzb459pFnwcr8AVI62g8FuBpL5aa7mH4 -Tes+ZZEL5jGesk63+FBk/Pl6IeHhf7LBhXi8m3SE+zRHuaFG75bJspWmVvU8+dCL -2gOi4HTwceI51M3+vKvfJMCAHF+eEvxrOnvqHbF5Omj4lsTqKbECggEBAMwADcrg -WdFrLgZyze9QnCWwQTq0ctWDQQZcVrkpMzevZCyQe7EC2ngGEsdKGgP4ra/q1McL -33c2Dzw++F4P0mARwZmOogV8hwU7IyfoXQkdkT8QPQkYsNFZgspL5bhn/+OIkiuW -69z9CZfTnKR1chlt/RqzJDPcV6QA5u4bEi5DMeiuO8YEeRtdNqceSKL0HBEdXcfy -mv+cqlJFd5Llq7GAyoEffwzl6iGWag4J0IzC77gND5tCqtNKu6YGcIF1HDFvcaAw -TYQJWPyJPcDqw3P/FCXV+93fxiC4yfPUawLRmyWe6JvvhyZmT2vyWONG8ckoe80n -6cxopIO0TexH/ssCggEBAMAwi9Qw3iG4Y6c0k9Ud07EpWVGYOf64RdEkpWm3PdMC -eLwMIZuTydCghb+1ihmyaQx5Pp2LxU/YGrFLbPkJJInXjdFJU6qEW3hUO8Az63LA -Akdd9mP3VFW1a2IxuiSURQUljzBQ7B6Lclb0IqjI828yGBQwYOfph4wrT4Zfbql2 -hL900IVoIEHhrsJlJAyuHy29Ie/Y2S9UV7jL2dWfFzaFAgXCB8GY3FtEmABqfqzs -1QDW5v44kozljA6gXOKXroJIVw1vqG4C/iLanVcfjibEiRndQLkzMyRxmmPwyWyv -rtM30OCVn+A4Q/tg46CzHPuM3bo9tsLSg1y/T8jARrkCggEADb4nL7ajdl8xD5Am -XWvhyQwxqMHFRqr783C/CuRCpgqzxejJ3Gfjzdgi5bgRPpk/Ii3AvdQH7uD+b8GS -O8v3ES/BChY4xgPYmLqeKK8XrWiHg2cVpYo7Ry8vh29Lf3vKGkr2Bee55f5J6ieA -UvfygtINDgJpevDqGotRA1NhiypNr24laracbgJ+jw2UOR4W0fRXgAPQ+01TkA1L -++JrCZ8yhTZY+cZ3WmHmrSFuIj1zpsOCfKQmG+vZ7lpas+3uw0nNrsvyPOXgT8rz -FQ77sdHKSq46tHzBvSyVtk5mEx+JwyQMaYzeXvDfgtcls9Hwset/Q5ffwTx/cLvx -z+wdtwKCAQEAms1/k6bZBWg0PJYJDXw861JW83YeIKHk+pT996z1S2WOQkmzOFFO -GZFyqfxcBF7EZpuyZ8wRXkK/HVeXqvBGUhEh1hWuIocB9mZCyooHeCJYs4tnzxWF -BJRgrnNHb/dNsNuT/mLwDZpcutVipXlXO5Wp93kQVTyxRaINKDruM+mW+2/oFczN -TsOttD8rTltiGcFh+IM+TPUuw1bPW1YNqIhyHJkxDitGMu2JUax15GvPFiIDZXnD -8WFj8tQQfSOYGLCUDeqGTDZ05TYZzfdI1MkxdXfVjldDNnOa3C0y0SyhMNigkoVy -hXRMrcpZDzO2gJfycPUMpNhTnv0qEpVtYQKCAQBoyUPk5y/OmGS7D2Y+O6QKuyOu -Hji2u98vjGLFUNru+ElDwZZgAwxEfOJAsBWjrD/hGlol9aC+ZklImu9YxVY8vQUp -tU/iPDaxkf/zEBCwabL3KS2pe58N+8DOdCRc+cOW9UEWym9WTb92K8d1aMKmEqFZ -kffmNi1mclfOh6VpAoz2e8S4R2JzWa4t5LZcHwlndPnB9xdx3o8adS2I4odd825T -wo1wxwQLk3E5c7NMGGlnVPsRNL6sHUPylmchx1uNjFDMQ8QkVqpZ2M/xle6hp3d2 -zyT8MySNOZFjeioHgg1JE1IU3bJr8wLaAI2DFTUMOozbfzuQiNY8QayU+z2+ ------END RSA PRIVATE KEY----- diff --git a/qa-tests-backend/artifacts/tls-challenge-test/nginx-proxy.conf b/qa-tests-backend/artifacts/tls-challenge-test/nginx-proxy.conf deleted file mode 100644 index 185e11e0f2e16..0000000000000 --- a/qa-tests-backend/artifacts/tls-challenge-test/nginx-proxy.conf +++ /dev/null @@ -1,12 +0,0 @@ -server { - listen 8443 ssl http2; - - ssl_certificate /run/secrets/tls/tls.crt; - ssl_certificate_key /run/secrets/tls/tls.key; - - location / { - client_max_body_size 50M; - grpc_pass grpcs://central.stackrox:443; - grpc_ssl_verify off; - } -} diff --git a/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy b/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy index c44c783751666..d8e26ae1979cd 100644 --- a/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy +++ b/qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy @@ -59,7 +59,6 @@ import io.fabric8.kubernetes.api.model.apps.DaemonSetBuilder import io.fabric8.kubernetes.api.model.apps.DaemonSetList import io.fabric8.kubernetes.api.model.apps.DaemonSetSpec import io.fabric8.kubernetes.api.model.apps.Deployment as K8sDeployment -import io.fabric8.kubernetes.api.model.apps.DeploymentBuilder import io.fabric8.kubernetes.api.model.apps.DeploymentList import io.fabric8.kubernetes.api.model.apps.DeploymentSpec import io.fabric8.kubernetes.api.model.apps.StatefulSet as K8sStatefulSet @@ -308,40 +307,6 @@ class Kubernetes implements OrchestratorMain { client.pods().inNamespace(ns).withLabels(labels).delete() } - void deleteAllPodsAndWait(String ns, Map labels) { - log.debug "Will delete all pods in ${ns} with labels ${labels} and wait for deletion" - - List beforePods = evaluateWithRetry(2, 3) { - client.pods().inNamespace(ns).withLabels(labels).list().getItems() - } - beforePods.each { pod -> - evaluateWithRetry(2, 3) { - client.pods().inNamespace(ns).withName(pod.metadata.name).delete() - } - } - - Timer t = new Timer(30, 5) - Boolean allDeleted = false - while (!allDeleted && t.IsValid()) { - allDeleted = true - beforePods.each { deleted -> - Pod pod = evaluateWithRetry(2, 3) { - client.pods().inNamespace(ns).withName(deleted.metadata.name).get() - } - if (pod == null) { - log.debug "${deleted.metadata.name} is deleted" - } - else { - log.debug "${deleted.metadata.name} is not deleted" - allDeleted = false - } - } - } - if (!allDeleted) { - throw new OrchestratorManagerException("Gave up trying to delete all pods") - } - } - Boolean deletePodAndWait(String ns, String name, int retries, int intervalSeconds) { deletePod(ns, name, null) log.debug "Deleting pod ${name}" @@ -358,15 +323,6 @@ class Kubernetes implements OrchestratorMain { throw new OrchestratorManagerException("Could not delete pod ${ns}/${name}") } - Boolean restartPodByLabelWithExecKill(String ns, Map labels) { - Pod pod = getPodsByLabel(ns, labels).get(0) - int prevRestartCount = pod.status.containerStatuses.get(0).restartCount - def cmds = ["sh", "-c", "kill -15 1"] as String[] - execInContainerByPodName(pod.metadata.name, pod.metadata.namespace, cmds) - log.debug "Killed pod ${pod.metadata.name}" - return waitForPodRestart(pod.metadata.namespace, pod.metadata.name, prevRestartCount, 25, 5) - } - def restartPodByLabels(String ns, Map labels, int retries, int intervalSecond) { Pod pod = getPodsByLabel(ns, labels).get(0) @@ -554,52 +510,6 @@ class Kubernetes implements OrchestratorMain { .portForward(port) } - EnvVar getDeploymentEnv(String ns, String name, String key) { - def deployment = client.apps().deployments().inNamespace(ns).withName(name).get() - if (deployment == null) { - throw new OrchestratorManagerException("Did not find deployment ${ns}/${name}") - } - - List envVars = client.apps().deployments().inNamespace(ns).withName(name).get().spec.template - .spec.containers.get(0).env - int index = envVars.findIndexOf { EnvVar it -> it.name == key } - if (index < 0) { - throw new OrchestratorManagerException("Did not find env variable ${key} in ${ns}/${name}") - } - return envVars.get(index) - } - - def updateDeploymentEnv(String ns, String name, String key, String value) { - log.debug "Update env var in ${ns}/${name}: ${key} = ${value}" - List envVars = client.apps().deployments().inNamespace(ns).withName(name).get().spec.template - .spec.containers.get(0).env - - int index = envVars.findIndexOf { EnvVar it -> it.name == key } - if (index > -1) { - log.debug "Env var ${key} found on index: ${index}" - envVars.get(index).value = value - } - else { - log.debug "Env var ${key} not found. Adding it now" - envVars.add(new EnvVarBuilder().withName(key).withValue(value).build()) - } - - withRetry(2, 3) { - client.apps().deployments().inNamespace(ns).withName(name) - .edit { d -> new DeploymentBuilder(d) - .editSpec() - .editTemplate() - .editSpec() - .editContainer(0) - .withEnv(envVars) - .endContainer() - .endSpec() - .endTemplate() - .endSpec() - .build() } - } - } - def scaleDeployment(String ns, String name, Integer replicas) { Exception mostRecentException Timer t = new Timer(30, 5) diff --git a/qa-tests-backend/src/main/groovy/orchestratormanager/OrchestratorMain.groovy b/qa-tests-backend/src/main/groovy/orchestratormanager/OrchestratorMain.groovy index 1bee6b458dc61..017b22a6fd60e 100644 --- a/qa-tests-backend/src/main/groovy/orchestratormanager/OrchestratorMain.groovy +++ b/qa-tests-backend/src/main/groovy/orchestratormanager/OrchestratorMain.groovy @@ -1,6 +1,5 @@ package orchestratormanager -import io.fabric8.kubernetes.api.model.EnvVar import io.fabric8.kubernetes.api.model.ObjectMeta import io.fabric8.kubernetes.api.model.Pod import io.fabric8.kubernetes.api.model.admissionregistration.v1.ValidatingWebhookConfiguration @@ -26,8 +25,6 @@ interface OrchestratorMain { Boolean deletePod(String ns, String podName, Long gracePeriodSecs) Boolean deletePodAndWait(String ns, String podName, int retries, int intervalSeconds) def deleteAllPods(String ns, Map labels) - void deleteAllPodsAndWait(String ns, Map labels) - Boolean restartPodByLabelWithExecKill(String ns, Map labels) def restartPodByLabels(String ns, Map labels, int retries, int intervalSecond) def waitForAllPodsToBeRemoved(String ns, Maplabels, int iterations, int intervalSeconds) def waitForPodsReady(String ns, Map labels, int minReady, int iterations, int intervalSeconds) @@ -56,8 +53,6 @@ interface OrchestratorMain { def getDeploymentCount(String ns) Set getDeploymentSecrets(Deployment deployment) def createPortForward(int port, Deployment deployment) - def updateDeploymentEnv(String ns, String name, String key, String value) - EnvVar getDeploymentEnv(String ns, String name, String key) def scaleDeployment(String ns, String name, Integer replicas) List getDeployments(String ns) boolean deploymentReady(String ns, String name) diff --git a/qa-tests-backend/src/main/groovy/util/ApplicationHealth.groovy b/qa-tests-backend/src/main/groovy/util/ApplicationHealth.groovy index 74243dd46189b..6a720cd218c74 100644 --- a/qa-tests-backend/src/main/groovy/util/ApplicationHealth.groovy +++ b/qa-tests-backend/src/main/groovy/util/ApplicationHealth.groovy @@ -23,11 +23,6 @@ class ApplicationHealth { this.waitTimeForHealthiness = waitTimeForHealthiness } - void waitForSensorHealthiness() { - Deployment sensor = new Deployment().setNamespace(Constants.STACKROX_NAMESPACE).setName("sensor") - waitForHealthiness(sensor) - } - void waitForCollectorHealthiness() { Deployment collector = new DaemonSet().setNamespace(Constants.STACKROX_NAMESPACE).setName("collector") waitForHealthiness(collector) diff --git a/qa-tests-backend/src/test/groovy/TLSChallengeTest.groovy b/qa-tests-backend/src/test/groovy/TLSChallengeTest.groovy deleted file mode 100644 index a77f238e2a72e..0000000000000 --- a/qa-tests-backend/src/test/groovy/TLSChallengeTest.groovy +++ /dev/null @@ -1,206 +0,0 @@ -import static io.stackrox.proto.storage.ClusterOuterClass.ClusterHealthStatus.HealthStatusLabel -import static util.Helpers.withRetry - -import java.nio.file.Files -import java.nio.file.Paths - -import io.fabric8.kubernetes.api.model.EnvVar -import orchestratormanager.OrchestratorManagerException - -import io.stackrox.proto.storage.ClusterOuterClass - -import objects.ConfigMap -import objects.Deployment -import objects.Secret -import util.ApplicationHealth -import util.Timer - -import spock.lang.Shared -import spock.lang.Tag -import spock.lang.IgnoreIf -import util.Env - -// skip if executed in a test environment with just secured-cluster deployed in the test cluster -// i.e. central is deployed elsewhere -@IgnoreIf({ Env.ONLY_SECURED_CLUSTER == "true" }) -@Tag("PZ") -class TLSChallengeTest extends BaseSpecification { - @Shared - private EnvVar originalCentralEndpoint = new EnvVar() - private final static String PROXY_NAMESPACE = "qa-tls-challenge" - private final static String CENTRAL_PROXY_ENDPOINT = "nginx-loadbalancer.${PROXY_NAMESPACE}:443" - private final static String ASSETS_DIR = Paths.get( - System.getProperty("user.dir"), "artifacts", "tls-challenge-test") - - private final static LEAF_KEY_CONTENT = Files.readAllBytes( - Paths.get(ASSETS_DIR, "nginx-lb-certs", "leaf-key.pem")) - private final static LEAF_CERT_CONTENT = Files.readAllBytes( - Paths.get(ASSETS_DIR, "nginx-lb-certs", "leaf-cert.pem")) - private final static CA_CERT_CONTENT = Files.readAllBytes( - Paths.get(ASSETS_DIR, "nginx-lb-certs", "ca.pem")) - - def setupSpec() { - originalCentralEndpoint = orchestrator.getDeploymentEnv("stackrox", "sensor", "ROX_CENTRAL_ENDPOINT") - orchestrator.ensureNamespaceExists(PROXY_NAMESPACE) - addStackroxImagePullSecret(PROXY_NAMESPACE) - - ByteArrayOutputStream out = new ByteArrayOutputStream() - out.write(LEAF_CERT_CONTENT) - out.write(CA_CERT_CONTENT) - def certChain = out.toByteArray() - - deployNGINXProxy(certChain, LEAF_KEY_CONTENT) - } - - def cleanupSpec() { - orchestrator.deleteNamespace(PROXY_NAMESPACE) - orchestrator.waitForNamespaceDeletion(PROXY_NAMESPACE) - - orchestrator.deleteSecret("additional-ca", "stackrox") - orchestrator.restartPodByLabelWithExecKill("stackrox", [app: "central"]) - orchestrator.waitForPodsReady("stackrox", [app: "central"], 1, 50, 3) - - // Ensure Central API is reachable. - withRetry(30, 2) { Services.getMetadataClient().getMetadata() } - - // Restart sensor to reset the gRPC connection to central. - // Scale to 0 and back to 1 so that the check for sensor healthiness is based on the restarted sensor pod. - orchestrator.scaleDeployment("stackrox", "sensor", 0) - orchestrator.waitForAllPodsToBeRemoved("stackrox", ["app": "sensor"], 30, 5) - orchestrator.updateDeploymentEnv("stackrox", "sensor", - originalCentralEndpoint.name, originalCentralEndpoint.value) - orchestrator.scaleDeployment("stackrox", "sensor", 1) - ApplicationHealth ah = new ApplicationHealth(orchestrator, 600) - ah.waitForSensorHealthiness() - - orchestrator.deleteAllPodsAndWait("stackrox", [app: "collector"]) - ah.waitForCollectorHealthiness() - - withRetry(30, 1) { Services.getMetadataClient().getMetadata() } - waitUntilCentralSensorConnectionIs(HealthStatusLabel.HEALTHY) - } - - @Tag("SensorBounceNext") - def "Verify sensor can communicate with central behind an untrusted load balancer"() { - when: - "Deploying Sensor without root CA certs can't connect to load balancer" - - log.info("Setting sensor ROX_CENTRAL_ENDPOINT to ${CENTRAL_PROXY_ENDPOINT}") - orchestrator.updateDeploymentEnv("stackrox", "sensor", "ROX_CENTRAL_ENDPOINT", CENTRAL_PROXY_ENDPOINT) - log.info("Waiting for sensor to be restarted") - orchestrator.waitForPodsReady("stackrox", [app: "sensor"], 1, 10, 5) - - then: - "Sensor connection to Central becomes unhealthy because root CAs are missing" - log.info("Waiting until Sensor connection is marked as UNHEALTHY or DEGRADED in Centrals clusters health") - assert waitUntilCentralSensorConnectionIs(HealthStatusLabel.UNHEALTHY, HealthStatusLabel.DEGRADED) - - when: - "Central receives additional CA configurations after restart" - - log.info("Creating additional-ca secret") - Secret additionalCASecret = new Secret( - name: "additional-ca", - namespace: "stackrox", - type: "Opaque", - data: [ "ca.crt": Base64.getEncoder().encodeToString(CA_CERT_CONTENT) ] - ) - orchestrator.createSecret(additionalCASecret) - - log.info("Restarting central to pick up the optional additional-ca secret") - // restart with "kill 1" to prevent deletion of PVs on local machines - assert orchestrator.restartPodByLabelWithExecKill("stackrox", [app: "central"]) - log.info("Waiting for central pod being ready again") - orchestrator.waitForPodsReady("stackrox", [app: "central"], 1, 50, 3) - - log.info("Restarting central proxy") - orchestrator.restartPodByLabels(PROXY_NAMESPACE, [app: "nginx"], 30, 5) - - then: - "Sensor receives root CAs from central after restart and is connected to central" - - // delete sensor to force reconnect - log.info("Restarting Sensor, should connect to ${CENTRAL_PROXY_ENDPOINT}") - orchestrator.restartPodByLabels("stackrox", [app: "sensor"], 30, 5) - - log.info("Waiting until Sensor is ready again") - assert Services.waitForDeployment(new Deployment(name: "sensor", namespace: "stackrox")) - - // Check connection details Sensor <> Central - assert checkSensorLogs() - assert waitUntilCentralSensorConnectionIs(HealthStatusLabel.HEALTHY) - } - - boolean checkSensorLogs() { - def logs = "" - Timer t = new Timer(40, 5) - while (t.IsValid()) { - def pod = orchestrator.getPods("stackrox", "sensor").get(0) - logs = orchestrator.getPodLog("stackrox", pod.metadata.name) - - // Check if sensor logs contain expected connection information - if (logs.contains("Connecting to Central server ${CENTRAL_PROXY_ENDPOINT}") - && logs.contains("Communication with central started")) { - log.info("Found successful connection logs in sensor pod") - return true - } - } - - log.error("Sensor did not establish connection to central via ${CENTRAL_PROXY_ENDPOINT}") - log.info logs - return false - } - - boolean waitUntilCentralSensorConnectionIs(HealthStatusLabel... healthStatusLabels) { - Timer t = new Timer(60, 5) - while (t.IsValid()) { - List list = Services.getClusterClient().getClusters().getClustersList() - if (list.empty) { - throw new OrchestratorManagerException("Central does not know about any secured clusters.") - } - if (list.size() > 1) { - throw new OrchestratorManagerException("Central knows about more than one secured cluster.") - } - - log.info("Receiving cluster status from central, checking sensor connection") - HealthStatusLabel healthStatusLabel = list.get(0).getHealthStatus().getSensorHealthStatus() - log.info("Status is: ${healthStatusLabel}") - if (healthStatusLabels.find { it == healthStatusLabel }) { - return true - } - } - return false - } - - def deployNGINXProxy(byte[] certChain, byte[] leafKeyContent) { - def nginxConfig = new String(Files.readAllBytes(Paths.get(ASSETS_DIR, "nginx-proxy.conf"))) - ConfigMap nginxConfigMap = new ConfigMap( - name: "nginx-proxy-conf", - data: ["nginx-proxy-grpc-tls.conf": nginxConfig], - namespace: PROXY_NAMESPACE - ) - orchestrator.createConfigMap(nginxConfigMap) - - Secret tlsConfSecret = new Secret() - tlsConfSecret.name = "nginx-tls-conf" - tlsConfSecret.type = "tls" - tlsConfSecret.namespace = PROXY_NAMESPACE - tlsConfSecret.data = [ - "tls.crt": Base64.getEncoder().encodeToString(certChain), - "tls.key": Base64.getEncoder().encodeToString(leafKeyContent), - ] - orchestrator.createSecret(tlsConfSecret) - - Deployment loadBalancerDeployment = new Deployment() - loadBalancerDeployment.setNamespace(PROXY_NAMESPACE) - .setName("nginx-loadbalancer") - .setExposeAsService(true) - .setImage("quay.io/rhacs-eng/qa-multi-arch:nginx-1-17-1") - .addVolumeFromConfigMap(nginxConfigMap, "/etc/nginx/conf.d/") - .addVolumeFromSecret(tlsConfSecret, "/run/secrets/tls/") - .setTargetPort(8443) - .setPorts([443: "TCP"]) - loadBalancerDeployment.setLabels([app: "nginx"]) - orchestrator.createDeployment(loadBalancerDeployment) - } -} diff --git a/tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.crt b/tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.crt new file mode 100644 index 0000000000000..b300dad8ca094 --- /dev/null +++ b/tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.crt @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIENzCCAp+gAwIBAgIUXGVn9On48RWFyZUofTNpWAdR83EwDQYJKoZIhvcNAQEL +BQAwFjEUMBIGA1UEAwwLQ3VzdG9tIFJvb3QwIBcNMjQwNzIyMDYwNjU2WhgPMjA3 +NTAzMTcwNjA2NTZaMF8xLjAsBgNVBAMMJSoubmdpbngtbG9hZGJhbGFuY2VyLnFh +LXRscy1jaGFsbGVuZ2UxFzAVBgNVBAoMDlN0YWNrcm94IFRlc3RzMRQwEgYDVQQL +DAtTdGFja3JveCBRQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMFH +ViGa3rCHjberepa+4f5ILQP63ZtHqiud6OgQ/PMuylK5AVRH2OoZZRRFbYGDyhFL +myG8m9pYngr51URpHRDc2Ne5xtOvx484ckALnRh39NVUEgJ0kEkkw2twg4fVq2yW ++dP75iDd1kSdaBgMHx5vnvKGt6U+Ovr/QZlmS2FlBC8VUlfUPeTVizlJk1CvHhE6 +myQ2IO6PJjkyFGOkrmDUmTIwYcJiJRgmgDwzfCUoQcuudKp4YlnMS6E94bIFqUdT +qLp0ie0q7VjKXl8goucr8UJi2GlqZy+ca9X+MKsd/a+GgrYDya3IKmcwuua3KGV/ +1yGuGCehVlxB3MlOSIcCAwEAAaOBsTCBrjBbBgNVHREEVDBSgiNuZ2lueC1sb2Fk +YmFsYW5jZXIucWEtdGxzLWNoYWxsZW5nZYIlKi5uZ2lueC1sb2FkYmFsYW5jZXIu +cWEtdGxzLWNoYWxsZW5nZYcEfwAAATAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww +CgYIKwYBBQUHAwEwCQYDVR0TBAIwADAfBgNVHSMEGDAWgBQ2wsm8n+xYss+9Gcqf +garhMSyn4jANBgkqhkiG9w0BAQsFAAOCAYEAqGTwBZ9I3y0GlivK4aQnjHmSrLzf +TAZxzRaHkB5JDGJc6Ca58ZufB7mlKcUAgzWSRdd7CRKxt9U7/P/hsw/H7Isb8Dmp +vSLuhd8wymwkDjLtwsHM898rxht9q0CmYjqmW0qWOPNGUPkGfqs7+NjPXfoTJsqw +NhJQXHC3QqQ/CA57T4HokxvJkA7oAuqCIQwP8j8eA/O0MkQoOaAXSm+HfCoPTRiV +eHY6RzhC2jA9IPo9ykpRSg8RVLZJIYqhGq7o908x8fLvGqmzCN1w0CyTWtDAOkd0 +uslHXwnAd0HwPVsBRBO/o+61tfMZ5YDJx9EApde3H7tYpfsvayURMz7sbt/uVcdr +3Fk6gS4b3UI3FC8kF9apkuo5mg/w9CWbqS+vOsLyBcg5vwE/4C3IJHrMQJKelFCi +n+4Bo6ZZqXTq/NzheXwxOFKkYHv3NawSB5OzViDEf7K9bLqnKhptNxQxez26NGGe +MwdxmVjQOisC34GBXADpy6AeyEkZ7i9Vn3Bj +-----END CERTIFICATE----- diff --git a/tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.key b/tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.key new file mode 100644 index 0000000000000..60acfe38ae68c --- /dev/null +++ b/tests/bad-ca/nginx-loadbalancer.qa-tls-challenge.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDBR1Yhmt6wh423 +q3qWvuH+SC0D+t2bR6ornejoEPzzLspSuQFUR9jqGWUURW2Bg8oRS5shvJvaWJ4K ++dVEaR0Q3NjXucbTr8ePOHJAC50Yd/TVVBICdJBJJMNrcIOH1atslvnT++Yg3dZE +nWgYDB8eb57yhrelPjr6/0GZZkthZQQvFVJX1D3k1Ys5SZNQrx4ROpskNiDujyY5 +MhRjpK5g1JkyMGHCYiUYJoA8M3wlKEHLrnSqeGJZzEuhPeGyBalHU6i6dIntKu1Y +yl5fIKLnK/FCYthpamcvnGvV/jCrHf2vhoK2A8mtyCpnMLrmtyhlf9chrhgnoVZc +QdzJTkiHAgMBAAECggEAVyH60XGJHRovKHM088qgBUuyh43L49n9/GXW/u/RqSwZ +6Ashb0ZoorjKGcZm5LFuIjfsetwVguzaauZQX+PnR5fYZgCJgxtGoul2kCrsKoDB +rn6VE+hKt77MHp59nXoVKwIxJID2MTDxDMPNjrHAQa9ef8V9+w+/9TGn+CjmqMPg +MpsD3nfn9YawGaU6Xxnis3ggrwX5ZrGgk5DZa738hWZLTzX+EhAI9u0uO4105/06 +3pvQeXbaqrbt1g/NyL3L6tu6SzXXFAC3AnLsa+Xjle5qdWQtOA0iR4O0l6g6mqa2 +83ZAl04/C1hxJZ4BuS+5dVKFaHuvUPWLd+3X5/wL8QKBgQD+Mcu5dbAKjvAV/4/S +hlJec4LtIbb6daFMUzb0lCssFL81+Jde6ts27zmGUhYF0Garj1QYqE+azvNXn8Rd +IdsgDMSd9W/DoyV54mlx+MPCO4hekloColLnZplB2JDcgeQEildeqx1S/xhx5iBF +Bn+90IAXsQNXZj7mlq9WGIY9DwKBgQDCpsbb/w7AZw46kie51qfFBRJ1fzhUYY9e +T7aT2jB9JaGIpMcsqFITOl3XhIyyQKuNunZjn1FSGG7XAULcpyYRaCxOUg25Ble9 +cwRrcaZ4yBx+rrHTuODoi4k9zZctXrhIX8puEcFmxM2k/Zn1WZagry8ezeYd6/+7 +lY7sS32tCQKBgEq51MwGfuP7tTSiVmNrPVeq2XhgiuwCHJLVe7hWvoJM7xEsrUMo +A52Yoe6MvxCifSw+DFjbUduOrxa5Tv6Z71LyrfJJrrtygJfeKWVp3hKBcctrdq6D +jZ+dF7y1r5BDVwbGrHyWDR7TAxqorh/ckzz3yFAup27QDfm3nn/O4dedAoGAJc/2 +E2hxuiiK2A/qTayIPLqmglKrY6DsE9sSUZhyEO2Nepjf5Cnyf6+36RTjrADqEocl +VmbtijAa4ANrtKd3uqvs524DIm08AB5mvmR+fToKZwWSn9lrP2FT0MCuXG7pB44s +KcOjOU6D0Eg/byzvGNnPIoHG8QsWS59a+0YS7NkCgYEAkXmpZrnMsA37otdPYeBi +utCB1zresb7Ac16mStWBz1yxFM4gNYndFz0/ouyGDkkTURqFuRbtwalaS/tm981v +TqiRlxrlJ87SsM/HYMq+6LJedd1Z5GtgvnluWln4O/8vZ0Oy2ZV/tIylL1XU4JRp +p5loTDUld/qNEmbTFUAQ4QI= +-----END PRIVATE KEY----- diff --git a/tests/bad-ca/root.crt b/tests/bad-ca/root.crt index 374d4478c1e5d..0b1d1c76fd33d 100644 --- a/tests/bad-ca/root.crt +++ b/tests/bad-ca/root.crt @@ -1,25 +1,25 @@ -----BEGIN CERTIFICATE----- -MIIEIjCCAoqgAwIBAgIUJWP+1FiRwEMQxeih4vKaGzkp3hAwDQYJKoZIhvcNAQEL -BQAwFjEUMBIGA1UEAwwLQ3VzdG9tIFJvb3QwIBcNMjQwNzA5MDg0NjA3WhgPMjA3 -NTAzMDQwODQ2MDdaMBYxFDASBgNVBAMMC0N1c3RvbSBSb290MIIBojANBgkqhkiG -9w0BAQEFAAOCAY8AMIIBigKCAYEA4d4SzHTGdHnGg2XOMMT/ykhm8Cf83M52MloV -PM/J9eZRsVezq6Ieb65swvOM4qOnGs5+gt1TbSiHk86MHhvIMFPvGQmJCnH46eIf -Qi7t+/qD5xJafiZoRRpAsMGoacwEsqtyUDq46+C0+a+grFrPazvEFxDezYLfGq0t -rb3IEBIG8atFe6t9Q4GsO2JjUeNodLxb7DGbcznz1z+4n6vNA2vAh9vxLQyvmfhh -ybHipYvLAbb/4sq7eMMVi6iCBA9QWg9TX/XtqTRCzt/V6AlaILwtTRSKiZdZx3/M -G4q3OwhlvRlmWOUCV3XN+rLp5Ht5jyuk/4siUKd9aawv21eVb41z9REAtNO7HTF+ -PnApCtb05AIUzBAm7WnwYPuka7WQpDAd/BH/4K2SDxyarJFeOvP9GtwTvQpv7J4s -24PQhEkXfneJcWAtqyfdJbwMYfD2djdKMVWz4fHjbAu6W+1qNG/XcS1eHpdeby7H -aMSd0efde85MifZDUkW4SngONSCjAgMBAAGjZjBkMB8GA1UdIwQYMBaAFKcj2vdI -RZx2xpekXDdkJzRih9dfMA4GA1UdDwEB/wQEAwICBDASBgNVHRMBAf8ECDAGAQH/ -AgEAMB0GA1UdDgQWBBSnI9r3SEWcdsaXpFw3ZCc0YofXXzANBgkqhkiG9w0BAQsF -AAOCAYEAIYa4lPKtWF2LxN5gpFcBqfr7HznkPP1+3UKWWL+s7M2m2wqNls3rR51b -NFtlP4MjGGBkC6kyBONDfp1p2QuEpG71lJM52gxW3W2w038S1JrFGhSeAynEK3Ym -S0Tj8t4/PB7ob0MmMbAbZj/fkVprS2n6Td+GZ6KsoXvqZfl30kcPwLAhI8w1RvSW -SawZEvcDQaWdOLROr9JjKBA1jQ1dveFLsC9dHaYGvJDtUDpn5Tu5LtCUlI+8pUhQ -iZnkIK0LmMtjyhLIMJGfGm6QACP8U8860bRcSO7ib6ooBv0hlQnjiqqsHCKdKxZZ -sqyajs+kw6VqtV7s5cytvJM73JLzbEIvagzY648y9oY8yh7hmoQj+JWbsSKXCOzo -s/pniV2ZaaVCydVlTsPI904dRiN3xCDQORR+Sn9c9QQtCte5kShGpczAUznoAvO2 -9X5QoO+121MV7PE+Usj+g71JHF7LiJREwW1gL1YaYMwE/mdkNvrYrM5ZFj4401gX -JowEWG8u +MIIEIjCCAoqgAwIBAgIUexFAF9aU9qh6nDbDNdNZfTOmPuowDQYJKoZIhvcNAQEL +BQAwFjEUMBIGA1UEAwwLQ3VzdG9tIFJvb3QwIBcNMjQwNzIyMDYwNjU2WhgPMjA3 +NTAzMTcwNjA2NTZaMBYxFDASBgNVBAMMC0N1c3RvbSBSb290MIIBojANBgkqhkiG +9w0BAQEFAAOCAY8AMIIBigKCAYEAvzciE8qHy4ahuCXFe0smEJqwU6j2W6TWskdR +fUGVR8uEcyUScyowxlI/V47R0WBpOeJOeBWekpKZkK+Yp60AbsVXHQRcVdWEsfC9 +in0sxPbDVFaIJ7r2dI0F/gbxnNxwE2Hdx05WCWbk90VXZuzBuvXfQB6nd8FCR9Py +tc0PZI3URTJwdxco/QevH15S9ByGuEblM61CinMgiDK4hL88zK0jd0yYscyc9apc +TTtyxKSeKfSzDebdvxf/7vO241yW2jcKMM7GABFs1NvroTwYz9mmVBaJqgkFJWoh +MMUinA5X1+EM5H3iXyMg/XHejBxiKeq/XETw68aykUScThSnKOZFJBtC0o4+vYrE +9zpX3CnefNmnUh7x7TsMYiHZoApIKvFK68GLyEuonu3n6Sfiyw+lUl2HD6eJ3wu3 +BJbEnPcPzoCS5/FO6AnccRNJmBbmufujAcb3EBvuU5Ms8wPneuCblmiQkvQm2obK +NAcuMvJ20RD3W1hpaHzQ/o1GkawPAgMBAAGjZjBkMB8GA1UdIwQYMBaAFDbCybyf +7Fiyz70Zyp+BquExLKfiMA4GA1UdDwEB/wQEAwICBDASBgNVHRMBAf8ECDAGAQH/ +AgEAMB0GA1UdDgQWBBQ2wsm8n+xYss+9GcqfgarhMSyn4jANBgkqhkiG9w0BAQsF +AAOCAYEAo1hnl0hQ+76bfoA2nUcrVKy49Ill9/0kCv5TVmk00i9ap+r/SmA/aqW2 +OYqoKzzGpwEN84cwaXiMqxU7XIGeNTMwBFQXFwCCiK16rHi6zNUhZip/DJ2M95K+ +ieDrMA1P/i18r+0FyNG605zSk5fC08vPj6iSyuX53bMD4rDFvcu2G+9E/FQ65HQC +2b3vIMwQAyuBF5CNIykxOplffTG2ERaSiXW4jDLcesDo2yamiFx2LrqYTmYCKFJ7 +htT71UdlgB/kJ8r7jwyAHKgm4r4hhHw5K+wyZJ8SBAdWv7tgEzK/q5Le5gjyMh90 +k1QW6Y1fRVRBRK99PHIJWbZbzBBS2xUCb9fiYTuYW1iftom2/wsp++4WsM8dbF67 +khGHhZxJnLy3SQivLW9OcClGXJoJxX1Dezhpt3s03ImpB45cc1qcGSM0cCNnxQNH +28iyrZgsE/mpnyCw0OATSuQBMJ67k7g1k7BqDA3iFaAhywniZOjU3vrisuHJ+J4k +yttbu5D3 -----END CERTIFICATE----- diff --git a/tests/bad-ca/self-signed.invalid.crt b/tests/bad-ca/self-signed.invalid.crt index e6fb49165154e..09ef786c93400 100644 --- a/tests/bad-ca/self-signed.invalid.crt +++ b/tests/bad-ca/self-signed.invalid.crt @@ -1,24 +1,24 @@ -----BEGIN CERTIFICATE----- -MIIEBzCCAm+gAwIBAgIUEhj8ayXGpCpWoI8uS0Hf8ePH7ncwDQYJKoZIhvcNAQEL -BQAwFjEUMBIGA1UEAwwLQ3VzdG9tIFJvb3QwIBcNMjQwNzA5MDg0NjA2WhgPMjA3 -NTAzMDQwODQ2MDZaME8xHjAcBgNVBAMMFSouc2VsZi1zaWduZWQuaW52YWxpZDEX -MBUGA1UECgwOU3RhY2tyb3gsIEluYy4xFDASBgNVBAsMC1N0YWNrcm94IFFBMIIB -IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsOkmw6DEe0zjNoVSpXlCpdi+ -zZN4S1yUsEOwkQaycNqx4z+DpsBEHNBYAl3RL2ms6B3jJNDp4gI0HACfH3KQQi7q -eBFGHiF9ZkRALCsqtyO/dqzQkyjvMR9marutrCMz7GakOSL65b9r2LT5ioKTkalq -Ok3aWDXhUMkO3zUDn7lPYKl+FVMK0z6t34t3sYu2CsK+1qqaNlavOwG1w2Ln/vOg -ufGZlrMOFoKvxFyM9V3xMQnOM9RrwewBb873B2ddQeo5n+Jb9jAyGMQ0+x4F91Bb -fFJgLc2ibBONu/+IHgwB5vqFXyvHUcoxoaeABx27EkhvSZvaBt2rkC8oQRGImwID +MIIEBzCCAm+gAwIBAgIUcN2APjWipFiHODJfdDUcD+IDLY8wDQYJKoZIhvcNAQEL +BQAwFjEUMBIGA1UEAwwLQ3VzdG9tIFJvb3QwIBcNMjQwNzIyMDYwNjU2WhgPMjA3 +NTAzMTcwNjA2NTZaME8xHjAcBgNVBAMMFSouc2VsZi1zaWduZWQuaW52YWxpZDEX +MBUGA1UECgwOU3RhY2tyb3ggVGVzdHMxFDASBgNVBAsMC1N0YWNrcm94IFFBMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3VEl+brif4L4Fp2D8tkRYDp5 +TY70tmfiV9L6nEDXDaoxxo1XELQC1K/vwdGdurImR7IJ4TE09Kr4LY/GdQM3v3WA +4guV0ihgcbvguEkZXhss9x2xC9lFgtGXFdg4g62V/SKCBQBLgZDk4qwCs3dZsvU8 +iDRsR/3vYo4Q3voaUm9G9IggvFnuziPr+JxlOUtA/b+icYa54XsPhFPrrztky22m +YgfLrh/AWKnm2z469I4zL4Rw+h3DTpJCY5PMSyKP27blCzjRAqAO+caMGpiLk58W +nfubdfYVG+MQP0shZ2GWc2+LUsnBOIDEu3b00G9EVdnm2vJxemjaJjijNJTbjQID AQABo4GRMIGOMDsGA1UdEQQ0MDKCE3NlbGYtc2lnbmVkLmludmFsaWSCFSouc2Vs Zi1zaWduZWQuaW52YWxpZIcEfwAAATAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww -CgYIKwYBBQUHAwEwCQYDVR0TBAIwADAfBgNVHSMEGDAWgBSr/reW0zsiocTRJh99 -AulrF7gvSjANBgkqhkiG9w0BAQsFAAOCAYEAPF8svXBGXcQfay6UoDT959+h8wg6 -gt7uIAuosfpv7s6KPakMiUj+FS4lUIAaWwpfuI/AC6gIy7n1leI0BxA456nTfNNC -e5LwHoSqF/lnyIEqO2tpcVHsrzgNbSR314tV8nTsDXn1vi5KC7cFQ7gYhXczD9od -j+FIDNMnpNkdZiZFXloGpxRUEq+rbL5lYkiUwJwgZ1iRJ9s0DpyyGPnkSWYMK5P1 -iFoAnt8GeKfleqMMIqHIXZGLuY7IMV8pUP9EFGE8Qk52dJr+s4FfWvMe+jp7sf/q -ki2d+lIgDpxdYKnQzX6vNn2Eh2ZUXiU2tKLg41nFagmh9h3jvSS2EP+ziRV7sAd8 -qlS5026bffnQ4Zna/31Xabrg+kpySbPluOU2er2MMKyXojmMXn+XEFkefiHYtbyT -DUptozSvhJ+CYAPdWq9bGD5atSsmzaaDfMwVQu9nGEDhUzAXYoYWrb0X9yC/TX6v -ns8AgzMtECeutc6h3CfzGdpJkws/rHaCvF68 +CgYIKwYBBQUHAwEwCQYDVR0TBAIwADAfBgNVHSMEGDAWgBRN22pXvhW9JiyqRk4T +jtbFswOA2TANBgkqhkiG9w0BAQsFAAOCAYEAzpBWDqOXJdgWmNAb4avFIlR4jIck +NEwB730PA2tME8DbDtGWe+bQoBkAawkkxZKEvTwz3b45/WHLiS7ar8pft0MdCicL +68K5kHIVvD7QGGQ4GMoac04TNSkF9L4Q3nd4NWs164bRQXGewyeshgCzJ7hQvUfr +MpCDosmqSGTnneIgcC8NKw/ZUgf70DOIPbwWL0ZVXbuvQBXfEMeyGP9ZPgqMn29I +uoPXmGOuNiznFNh0MrDkS+3WDk9VFHB84a6g9cpaop8NzbSJLIIgcdPIBYdO3nrz +eyeVJbOWCt6TqumIJHrVPd/uq6OJR1SIS0YQqhkj00m6JfCz+fqEAGceaNYpTQkq +4BBw0CNiRNR20DsuqfDG2QdtfPATj4nd/PhYBFttkLP+VQeWbE1aUOLf9um4MnF9 +hRO1e+LHmbxvqV63Q04iImW//wVBTy2eW2UMnCnLEp6lH/Uf5FCYZFrBY7mwHhn+ +woFTESHbRJ+dYie3OmcpQJs3T4VZauqA4phC -----END CERTIFICATE----- diff --git a/tests/bad-ca/ssl-certs.sh b/tests/bad-ca/ssl-certs.sh index 5f4bb82136ff1..4e8e9086fd0aa 100755 --- a/tests/bad-ca/ssl-certs.sh +++ b/tests/bad-ca/ssl-certs.sh @@ -4,11 +4,11 @@ # See https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309 function generate() { - name="Stackrox, Inc." - base=$1 - root=$2 + name="Stackrox Tests" + root=$1 + shift - echo "create root key and certificate" + echo "creating $root root key and certificate" openssl genrsa -out "${root}.key" 3072 openssl req -x509 -nodes -sha256 -new -key "${root}.key" -out "${root}.crt" -days 18500 \ -subj "/CN=Custom Root" \ @@ -16,37 +16,46 @@ function generate() { -addext "basicConstraints = critical, CA:TRUE, pathlen:0" \ -addext "subjectKeyIdentifier = hash" - echo "create our key and certificate signing request" - openssl genrsa -out "${base}.key" 2048 - openssl req -sha256 -new -key "${base}.key" -out "${base}.csr" \ - -subj "/CN=*.${base}/O=${name}/OU=Stackrox QA" \ - -reqexts SAN -config <(echo -e "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[SAN]\nsubjectAltName=DNS:${base},DNS:*.${base},IP:127.0.0.1\n") - - echo "create our final certificate and sign it" - openssl x509 -req -sha256 -in "${base}.csr" -out "${base}.crt" -days 18500 \ - -CAkey "${root}.key" -CA "${root}.crt" -CAcreateserial -extfile <( - cat <