diff --git a/src/test/java/io/github/protocol/pulsar/TlsClientTest.java b/src/test/java/io/github/protocol/pulsar/TlsClientTest.java index fd38568..cdda0ef 100644 --- a/src/test/java/io/github/protocol/pulsar/TlsClientTest.java +++ b/src/test/java/io/github/protocol/pulsar/TlsClientTest.java @@ -101,6 +101,36 @@ public void testTlsCustomCiphers() throws PulsarAdminException { pulsarAdmin.brokers().healthcheck(TopicVersion.V1); } + @Test + public void testTlsByVerifyAndNoHostnameVerification() throws PulsarAdminException { + PulsarAdmin pulsarAdmin = PulsarAdmin.builder() + .port(server.getWebPort()) + .useSsl(true) + .keyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath()) + .keyStorePassword(CLIENT_CERT_PASSWORD) + .trustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath()) + .trustStorePassword(CLIENT_CERT_PASSWORD) + .disableSslVerify(false) + .disableHostnameVerification(false) + .build(); + pulsarAdmin.brokers().healthcheck(TopicVersion.V1); + } + + @Test + public void testTlsByVerifyAndHostnameVerification() throws PulsarAdminException { + PulsarAdmin pulsarAdmin = PulsarAdmin.builder() + .port(server.getWebPort()) + .useSsl(true) + .keyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath()) + .keyStorePassword(CLIENT_CERT_PASSWORD) + .trustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath()) + .trustStorePassword(CLIENT_CERT_PASSWORD) + .disableSslVerify(false) + .disableHostnameVerification(true) + .build(); + pulsarAdmin.brokers().healthcheck(TopicVersion.V1); + } + @AfterAll public static void teardown() throws Exception { server.close(); diff --git a/src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java b/src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java new file mode 100644 index 0000000..780e0ab --- /dev/null +++ b/src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java @@ -0,0 +1,66 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package io.github.protocol.pulsar; + +import io.github.embedded.pulsar.core.EmbeddedPulsarConfig; +import io.github.embedded.pulsar.core.EmbeddedPulsarServer; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.BeforeAll; + +import java.io.File; + +public class TlsClientWrongHostTest { + + private static EmbeddedPulsarServer server; + + private static final String CLIENT_KEYSTORE_FILE = + TlsClientTest.class.getClassLoader().getResource("pulsar_client_key_wrong_host.jks").getFile(); + private static final String CLIENT_TRUSTSTORE_FILE = + TlsClientTest.class.getClassLoader().getResource("pulsar_client_trust_wrong_host.jks").getFile(); + + private static final String SERVER_KEYSTORE_FILE = + TlsClientTest.class.getClassLoader().getResource("pulsar_server_key_wrong_host.jks").getFile(); + private static final String SERVER_TRUSTSTORE_FILE = + TlsClientTest.class.getClassLoader().getResource("pulsar_server_trust_wrong_host.jks").getFile(); + + private static final String CLIENT_CERT_PASSWORD = "pulsar_client_pwd"; + + private static final String SERVER_CERT_PASSWORD = "pulsar_server_pwd"; + + @BeforeAll + public static void setup() throws Exception { + EmbeddedPulsarConfig config = new EmbeddedPulsarConfig(); + config.enableTls(true); + config.serverKeyStorePath(new File(SERVER_KEYSTORE_FILE).getAbsolutePath()); + config.serverKeyStorePassword(SERVER_CERT_PASSWORD); + config.serverTrustStorePath(new File(SERVER_TRUSTSTORE_FILE).getAbsolutePath()); + config.serverTrustStorePassword(SERVER_CERT_PASSWORD); + config.clientKeyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath()); + config.clientKeyStorePassword(CLIENT_CERT_PASSWORD); + config.clientTrustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath()); + config.clientTrustStorePassword(CLIENT_CERT_PASSWORD); + server = new EmbeddedPulsarServer(config); + server.start(); + } + + @AfterAll + public static void teardown() throws Exception { + server.close(); + } +} diff --git a/src/test/resources/gen_jks_wrong_host.sh b/src/test/resources/gen_jks_wrong_host.sh new file mode 100644 index 0000000..549ab3c --- /dev/null +++ b/src/test/resources/gen_jks_wrong_host.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +client_pass=pulsar_client_pwd +server_pass=pulsar_server_pwd +server_dname="C=CN,ST=GD,L=SZ,O=sh,OU=sh,CN=nonlocalhost" +client_dname="C=CN,ST=GD,L=SZ,O=sh,OU=sh,CN=nonlocalhost" +echo "generate client keystore" +keytool -genkeypair -keypass $client_pass -storepass $client_pass -dname $client_dname -keyalg RSA -keysize 2048 -validity 3650 -keystore pulsar_client_key_wrong_host.jks +echo "generate server keystore" +keytool -genkeypair -keypass $server_pass -storepass $server_pass -dname $server_dname -keyalg RSA -keysize 2048 -validity 3650 -keystore pulsar_server_key_wrong_host.jks +echo "export server certificate" +keytool -exportcert -keystore pulsar_server_key_wrong_host.jks -file server.cer -storepass $server_pass +echo "export client certificate" +keytool -exportcert -keystore pulsar_client_key_wrong_host.jks -file client.cer -storepass $client_pass +echo "add server cert to client trust keystore" +keytool -importcert -keystore pulsar_client_trust_wrong_host.jks -file server.cer -storepass $client_pass -noprompt +echo "add client cert to server trust keystore" +keytool -importcert -keystore pulsar_server_trust_wrong_host.jks -file client.cer -storepass $server_pass -noprompt +rm -f server.cer +rm -f client.cer diff --git a/src/test/resources/pulsar_client_key_wrong_host.jks b/src/test/resources/pulsar_client_key_wrong_host.jks new file mode 100644 index 0000000..cd19b61 Binary files /dev/null and b/src/test/resources/pulsar_client_key_wrong_host.jks differ diff --git a/src/test/resources/pulsar_client_trust_wrong_host.jks b/src/test/resources/pulsar_client_trust_wrong_host.jks new file mode 100644 index 0000000..67fc79e Binary files /dev/null and b/src/test/resources/pulsar_client_trust_wrong_host.jks differ diff --git a/src/test/resources/pulsar_server_key_wrong_host.jks b/src/test/resources/pulsar_server_key_wrong_host.jks new file mode 100644 index 0000000..d4bae0a Binary files /dev/null and b/src/test/resources/pulsar_server_key_wrong_host.jks differ diff --git a/src/test/resources/pulsar_server_trust_wrong_host.jks b/src/test/resources/pulsar_server_trust_wrong_host.jks new file mode 100644 index 0000000..668dbd6 Binary files /dev/null and b/src/test/resources/pulsar_server_trust_wrong_host.jks differ