raboof/pekko
1
0
Fork 0
Code Issues Pull requests Projects Releases 6 Packages Wiki Activity Actions 11

Test hostname verification (#27355)

Browse source
This commit is contained in:
Arnout Engelen 2019-07-16 15:32:50 +02:00 • committed by GitHub
parent 10c2b0714a
commit c3e8a968d9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 69 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

57
akka-remote/src/test/scala/akka/remote/artery/tcp/TlsTcpSpec.scala
View file

@ -25,6 +25,8 @@ import com.typesafe.config.Config
import com.typesafe.config.ConfigFactory
import javax.net.ssl.SSLEngine
import akka.testkit.EventFilter
class TlsTcpWithDefaultConfigSpec extends TlsTcpSpec(ConfigFactory.empty())
class TlsTcpWithSHA1PRNGSpec
@ -183,22 +185,65 @@ class TlsTcpWithHostnameVerificationSpec
akka.remote.artery.ssl.config-ssl-engine {
hostname-verification = on
}
akka.remote.use-unsafe-remote-features-without-cluster = on
akka.loggers = ["akka.testkit.TestEventListener"]
""").withFallback(TlsTcpSpec.config))
with ImplicitSender {
val systemB = newRemoteSystem(name = Some("systemB"))
val addressB = address(systemB)
val rootB = RootActorPath(addressB)
"Artery with TLS/TCP and hostname-verification=on" must {
"reject invalid" in {
"fail when the name in the server certificate does not match" in {
// this test only makes sense with tls-tcp transport
if (!arteryTcpTlsEnabled())
pending
val systemB = newRemoteSystem(
// The subjectAltName is 'localhost', so connecting to '127.0.0.1' should not
// work when using hostname verification:
extraConfig = Some("""akka.remote.artery.canonical.hostname = "127.0.0.1""""),
name = Some("systemB"))
val addressB = address(systemB)
val rootB = RootActorPath(addressB)
systemB.actorOf(TestActors.echoActorProps, "echo")
EventFilter
.warning(
pattern =
"outbound connection to \\[akka://systemB@127.0.0.1:.*" +
"Upstream failed, cause: SSLHandshakeException: General SSLEngine problem",
occurrences = 3)
.intercept {
system.actorSelection(rootB / "user" / "echo") ! Identify("echo")
}
expectNoMessage(2.seconds)
systemB.terminate()
}
"succeed when the name in the server certificate matches" in {
if (!arteryTcpTlsEnabled())
pending
val systemB = newRemoteSystem(
extraConfig = Some("""
// The subjectAltName is 'localhost', so this is how we want to be known:
akka.remote.artery.canonical.hostname = "localhost"
// Though we will still bind to 127.0.0.1 (make sure it's not ipv6)
akka.remote.artery.bind.hostname = "127.0.0.1"
"""),
name = Some("systemB"))
val addressB = address(systemB)
val rootB = RootActorPath(addressB)
systemB.actorOf(TestActors.echoActorProps, "echo")
system.actorSelection(rootB / "user" / "echo") ! Identify("echo")
expectNoMessage(2.seconds)
val id = expectMsgType[ActorIdentity]
id.ref.get ! "42"
expectMsg("42")
systemB.terminate()
}
}
}