yuanbiao
/
emqx
1
0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

chore(ssl conf): update the ssl configuration format for mongo, pgsql, and redis plug-ins

This commit is contained in:
zhanghongtong 2020-12-28 10:55:39 +08:00 committed by Rory Z
parent 6989c7a83d
commit 41afcde964
9 changed files with 58 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.ci/compatibility_tests/.env Normal file
View File

@ -0,0 +1,5 @@
MYSQL_TAG=5.7
REDIS_TAG=6
MONGO_TAG=4.1
PGSQL_TAG=11
LDAP_TAG=2.4.50

21
.github/workflows/run_cts_tests.yaml vendored
View File

@ -2,6 +2,8 @@ name: Compatibility Test Suite
on: on:
push: push:
tags:
- v*
release: release:
types: types:
- published - published
@ -77,10 +79,15 @@ jobs:
if: matrix.connect_type == 'tls' if: matrix.connect_type == 'tls'
run: | run: |
docker-compose -f .ci/compatibility_tests/docker-compose-mongo-tls.yaml up -d docker-compose -f .ci/compatibility_tests/docker-compose-mongo-tls.yaml up -d
echo 'auth.mongo.ssl = true' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl = on' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
echo 'auth.mongo.ssl_opts.cacertfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/ca.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl.cacertfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/ca.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
echo 'auth.mongo.ssl_opts.certfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-cert.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl.certfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-cert.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
echo 'auth.mongo.ssl_opts.keyfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-key.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl.keyfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-key.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
# echo 'auth.mongo.ssl = true' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
# echo 'auth.mongo.ssl_opts.cacertfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/ca.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
# echo 'auth.mongo.ssl_opts.certfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-cert.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
# echo 'auth.mongo.ssl_opts.keyfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-key.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
- name: setup - name: setup
env: env:
MONGO_TAG: ${{ matrix.mongo_tag }} MONGO_TAG: ${{ matrix.mongo_tag }}
@ -247,9 +254,9 @@ jobs:
docker-compose -f .ci/compatibility_tests/docker-compose-redis-${{ matrix.node_type }}-tls.yaml up -d docker-compose -f .ci/compatibility_tests/docker-compose-redis-${{ matrix.node_type }}-tls.yaml up -d
echo '\n' >> apps/emqx_auth_mongo/etc/emqx_auth_redis.conf echo '\n' >> apps/emqx_auth_mongo/etc/emqx_auth_redis.conf
echo 'auth.redis.ssl = on' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl = on' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
echo 'auth.redis.cafile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/ca.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl.cafile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/ca.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
echo 'auth.redis.certfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl.certfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
echo 'auth.redis.keyfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.key' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl.keyfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.key' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
- name: setup - name: setup
env: env:
REDIS_TAG: ${{ matrix.redis_tag }} REDIS_TAG: ${{ matrix.redis_tag }}

16
.github/workflows/run_test_cases.yaml vendored
View File

@ -20,7 +20,7 @@ jobs:
matrix: matrix:
mysql_tag: [5.7] mysql_tag: [5.7]
redis_tag: [6] redis_tag: [6]
mongo_tag: [3, 4] mongo_tag: [4]
pgsql_tag: [13] pgsql_tag: [13]
ldap_tag: [2.4.50] ldap_tag: [2.4.50]
@ -49,15 +49,15 @@ jobs:
sed -i "/auth.redis.server/c auth.redis.server = redis_server:6379" apps/emqx_auth_redis/etc/emqx_auth_redis.conf sed -i "/auth.redis.server/c auth.redis.server = redis_server:6379" apps/emqx_auth_redis/etc/emqx_auth_redis.conf
echo 'auth.redis.ssl = on' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl = on' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
echo 'auth.redis.cafile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/ca.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl.cafile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/ca.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
echo 'auth.redis.certfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl.certfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.crt' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
echo 'auth.redis.keyfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.key' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf echo 'auth.redis.ssl.keyfile = /emqx/apps/emqx_auth_redis/test/emqx_auth_redis_SUITE_data/certs/redis.key' >> apps/emqx_auth_redis/etc/emqx_auth_redis.conf
sed -i "/auth.mongo.server/c auth.mongo.server = mongo_server:27017" apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf sed -i "/auth.mongo.server/c auth.mongo.server = mongo_server:27017" apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
echo 'auth.mongo.ssl = true' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl = on' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
echo 'auth.mongo.ssl_opts.cacertfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/ca.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl.cacertfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/ca.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
echo 'auth.mongo.ssl_opts.certfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-cert.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl.certfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-cert.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
echo 'auth.mongo.ssl_opts.keyfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-key.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf echo 'auth.mongo.ssl.keyfile = /emqx/apps/emqx_auth_mongo/test/emqx_auth_mongo_SUITE_data/client-key.pem' >> apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
sed -i "/auth.pgsql.server/c auth.pgsql.server = pgsql_server:5432" apps/emqx_auth_pgsql/etc/emqx_auth_pgsql.conf sed -i "/auth.pgsql.server/c auth.pgsql.server = pgsql_server:5432" apps/emqx_auth_pgsql/etc/emqx_auth_pgsql.conf
sed -i "/auth.ldap.servers/c auth.ldap.servers = ldap_server" apps/emqx_auth_ldap/etc/emqx_auth_ldap.conf sed -i "/auth.ldap.servers/c auth.ldap.servers = ldap_server" apps/emqx_auth_ldap/etc/emqx_auth_ldap.conf

10
apps/emqx_auth_mongo/etc/emqx_auth_mongo.conf
View File

@ -52,23 +52,23 @@ auth.mongo.database = mqtt
## Whether to enable SSL connection. ## Whether to enable SSL connection.
## ##
## Value: true | false ## Value: on | off
## auth.mongo.ssl = false ## auth.mongo.ssl = off
## SSL keyfile. ## SSL keyfile.
## ##
## Value: File ## Value: File
## auth.mongo.ssl_opts.keyfile = ## auth.mongo.ssl.keyfile =
## SSL certfile. ## SSL certfile.
## ##
## Value: File ## Value: File
## auth.mongo.ssl_opts.certfile = ## auth.mongo.ssl.certfile =
## SSL cacertfile. ## SSL cacertfile.
## ##
## Value: File ## Value: File
## auth.mongo.ssl_opts.cacertfile = ## auth.mongo.ssl.cacertfile =
## MongoDB write mode. ## MongoDB write mode.
## ##

12
apps/emqx_auth_mongo/priv/emqx_auth_mongo.schema
View File

@ -42,19 +42,19 @@
]}. ]}.
{mapping, "auth.mongo.ssl", "emqx_auth_mongo.server", [ {mapping, "auth.mongo.ssl", "emqx_auth_mongo.server", [
{default, false}, {default, off},
{datatype, {enum, [true, false]}} {datatype, flag}
]}. ]}.
{mapping, "auth.mongo.ssl_opts.keyfile", "emqx_auth_mongo.server", [ {mapping, "auth.mongo.ssl.keyfile", "emqx_auth_mongo.server", [
{datatype, string} {datatype, string}
]}. ]}.
{mapping, "auth.mongo.ssl_opts.certfile", "emqx_auth_mongo.server", [ {mapping, "auth.mongo.ssl.certfile", "emqx_auth_mongo.server", [
{datatype, string} {datatype, string}
]}. ]}.
{mapping, "auth.mongo.ssl_opts.cacertfile", "emqx_auth_mongo.server", [ {mapping, "auth.mongo.ssl.cacertfile", "emqx_auth_mongo.server", [
{datatype, string} {datatype, string}
]}. ]}.
@ -107,7 +107,7 @@
{certfile, cuttlefish:conf_get(Prefix ++ ".certfile", Conf, undefined)}, {certfile, cuttlefish:conf_get(Prefix ++ ".certfile", Conf, undefined)},
{cacertfile, cuttlefish:conf_get(Prefix ++ ".cacertfile", Conf, undefined)}]) {cacertfile, cuttlefish:conf_get(Prefix ++ ".cacertfile", Conf, undefined)}])
end, end,
[{ssl, true}, {ssl_opts, SslOpts("auth.mongo.ssl_opts")}]; [{ssl, true}, {ssl_opts, SslOpts("auth.mongo.ssl")}];
false -> false ->
[] []
end, end,

10
apps/emqx_auth_pgsql/etc/emqx_auth_pgsql.conf
View File

@ -36,23 +36,23 @@ auth.pgsql.encoding = utf8
## Whether to enable SSL connection. ## Whether to enable SSL connection.
## ##
## Value: true | false ## Value: on | off
auth.pgsql.ssl = false auth.pgsql.ssl = off
## SSL keyfile. ## SSL keyfile.
## ##
## Value: File ## Value: File
## auth.pgsql.ssl_opts.keyfile = ## auth.pgsql.ssl.keyfile =
## SSL certfile. ## SSL certfile.
## ##
## Value: File ## Value: File
## auth.pgsql.ssl_opts.certfile = ## auth.pgsql.ssl.certfile =
## SSL cacertfile. ## SSL cacertfile.
## ##
## Value: File ## Value: File
## auth.pgsql.ssl_opts.cacertfile = ## auth.pgsql.ssl.cacertfile =
## Authentication query. ## Authentication query.
## ##

12
apps/emqx_auth_pgsql/priv/emqx_auth_pgsql.schema
View File

@ -31,19 +31,19 @@
]}. ]}.
{mapping, "auth.pgsql.ssl", "emqx_auth_pgsql.server", [ {mapping, "auth.pgsql.ssl", "emqx_auth_pgsql.server", [
{default, false}, {default, off},
{datatype, {enum, [true, false]}} {datatype, flag}
]}. ]}.
{mapping, "auth.pgsql.ssl_opts.keyfile", "emqx_auth_pgsql.server", [ {mapping, "auth.pgsql.ssl.keyfile", "emqx_auth_pgsql.server", [
{datatype, string} {datatype, string}
]}. ]}.
{mapping, "auth.pgsql.ssl_opts.certfile", "emqx_auth_pgsql.server", [ {mapping, "auth.pgsql.ssl.certfile", "emqx_auth_pgsql.server", [
{datatype, string} {datatype, string}
]}. ]}.
{mapping, "auth.pgsql.ssl_opts.cacertfile", "emqx_auth_pgsql.server", [ {mapping, "auth.pgsql.ssl.cacertfile", "emqx_auth_pgsql.server", [
{datatype, string} {datatype, string}
]}. ]}.
@ -85,7 +85,7 @@
{database, DB}, {database, DB},
{encoding, Encoding}, {encoding, Encoding},
{ssl, Ssl}, {ssl, Ssl},
{ssl_opts, SslOpts("auth.pgsql.ssl_opts")}] {ssl_opts, SslOpts("auth.pgsql.ssl")}]
end}. end}.
{mapping, "auth.pgsql.auth_query", "emqx_auth_pgsql.auth_query", [ {mapping, "auth.pgsql.auth_query", "emqx_auth_pgsql.auth_query", [

6
apps/emqx_auth_redis/etc/emqx_auth_redis.conf
View File

@ -103,15 +103,15 @@ auth.redis.acl_cmd = HGETALL mqtt_acl:%u
## CA certificate. ## CA certificate.
## ##
## Value: File ## Value: File
#auth.redis.cafile = path/to/your/cafile #auth.redis.ssl.cafile = path/to/your/cafile
## Client ssl certificate. ## Client ssl certificate.
## ##
## Value: File ## Value: File
#auth.redis.certfile = path/to/your/certfile #auth.redis.ssl.certfile = path/to/your/certfile
## Client ssl keyfile. ## Client ssl keyfile.
## ##
## Value: File ## Value: File
#auth.redis.keyfile = path/to/your/keyfile #auth.redis.ssl.keyfile = path/to/your/keyfile

12
apps/emqx_auth_redis/priv/emqx_auth_redis.schema
View File

@ -38,17 +38,17 @@
{datatype, flag} {datatype, flag}
]}. ]}.
{mapping, "auth.redis.cafile", "emqx_auth_redis.options", [ {mapping, "auth.redis.ssl.cafile", "emqx_auth_redis.options", [
{default, ""}, {default, ""},
{datatype, string} {datatype, string}
]}. ]}.
{mapping, "auth.redis.certfile", "emqx_auth_redis.options", [ {mapping, "auth.redis.ssl.certfile", "emqx_auth_redis.options", [
{default, ""}, {default, ""},
{datatype, string} {datatype, string}
]}. ]}.
{mapping, "auth.redis.keyfile", "emqx_auth_redis.options", [ {mapping, "auth.redis.ssl.keyfile", "emqx_auth_redis.options", [
{default, ""}, {default, ""},
{datatype, string} {datatype, string}
]}. ]}.
@ -57,9 +57,9 @@
Ssl = cuttlefish:conf_get("auth.redis.ssl", Conf, false), Ssl = cuttlefish:conf_get("auth.redis.ssl", Conf, false),
case Ssl of case Ssl of
true -> true ->
CA = cuttlefish:conf_get("auth.redis.cafile", Conf), CA = cuttlefish:conf_get("auth.redis.ssl.cafile", Conf),
Cert = cuttlefish:conf_get("auth.redis.certfile", Conf), Cert = cuttlefish:conf_get("auth.redis.ssl.certfile", Conf),
Key = cuttlefish:conf_get("auth.redis.keyfile", Conf), Key = cuttlefish:conf_get("auth.redis.ssl.keyfile", Conf),
[{options, [{ssl_options, [{cacertfile, CA}, [{options, [{ssl_options, [{cacertfile, CA},
{certfile, Cert}, {certfile, Cert},
{keyfile, Key}]}]}]; {keyfile, Key}]}]}];