335 lines
11 KiB
Erlang
335 lines
11 KiB
Erlang
%%--------------------------------------------------------------------
|
|
%% Copyright (c) 2020-2024 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
%%
|
|
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
%% you may not use this file except in compliance with the License.
|
|
%% You may obtain a copy of the License at
|
|
%%
|
|
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
%%
|
|
%% Unless required by applicable law or agreed to in writing, software
|
|
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
%% See the License for the specific language governing permissions and
|
|
%% limitations under the License.
|
|
%%--------------------------------------------------------------------
|
|
|
|
-module(emqx_dashboard_https_SUITE).
|
|
|
|
-compile(nowarn_export_all).
|
|
-compile(export_all).
|
|
|
|
-include_lib("eunit/include/eunit.hrl").
|
|
-include_lib("snabbkaffe/include/snabbkaffe.hrl").
|
|
|
|
-define(NAME, 'https:dashboard').
|
|
-define(HOST_HTTPS, "https://127.0.0.1:18084").
|
|
-define(HOST_HTTP, "http://127.0.0.1:18083").
|
|
-define(BASE_PATH, "/api/v5").
|
|
-define(OVERVIEWS, [
|
|
"alarms",
|
|
"banned",
|
|
"stats",
|
|
"metrics",
|
|
"listeners",
|
|
"clients",
|
|
"subscriptions"
|
|
]).
|
|
|
|
all() ->
|
|
emqx_common_test_helpers:all(?MODULE).
|
|
|
|
init_per_suite(Config) -> Config.
|
|
end_per_suite(_Config) -> emqx_mgmt_api_test_util:end_suite([emqx_management]).
|
|
|
|
init_per_testcase(_TestCase, Config) -> Config.
|
|
end_per_testcase(_TestCase, _Config) -> emqx_mgmt_api_test_util:end_suite([emqx_management]).
|
|
|
|
t_update_conf(_Config) ->
|
|
Conf = #{
|
|
dashboard => #{
|
|
listeners => #{
|
|
https => #{bind => 18084, ssl_options => #{depth => 5}},
|
|
http => #{bind => 18083}
|
|
}
|
|
}
|
|
},
|
|
emqx_common_test_helpers:load_config(emqx_dashboard_schema, Conf),
|
|
emqx_mgmt_api_test_util:init_suite([emqx_management], fun(X) -> X end),
|
|
Headers = emqx_dashboard_SUITE:auth_header_(),
|
|
{ok, Client1} = emqx_dashboard_SUITE:request_dashboard(
|
|
get, https_api_path(["clients"]), Headers
|
|
),
|
|
{ok, Client2} = emqx_dashboard_SUITE:request_dashboard(
|
|
get, http_api_path(["clients"]), Headers
|
|
),
|
|
Raw = emqx:get_raw_config([<<"dashboard">>]),
|
|
?assertEqual(
|
|
5,
|
|
emqx_utils_maps:deep_get(
|
|
[<<"listeners">>, <<"https">>, <<"ssl_options">>, <<"depth">>], Raw
|
|
)
|
|
),
|
|
?assertEqual(Client1, Client2),
|
|
?check_trace(
|
|
begin
|
|
Raw1 = emqx_utils_maps:deep_put(
|
|
[<<"listeners">>, <<"https">>, <<"bind">>], Raw, 0
|
|
),
|
|
?assertMatch({ok, _}, emqx:update_config([<<"dashboard">>], Raw1)),
|
|
?assertEqual(Raw1, emqx:get_raw_config([<<"dashboard">>])),
|
|
{ok, _} = ?block_until(#{?snk_kind := regenerate_minirest_dispatch}, 10000),
|
|
ok
|
|
end,
|
|
fun(ok, Trace) ->
|
|
%% Don't start new listener, so is empty
|
|
?assertMatch([#{listeners := []}], ?of_kind(regenerate_minirest_dispatch, Trace))
|
|
end
|
|
),
|
|
{ok, Client3} = emqx_dashboard_SUITE:request_dashboard(
|
|
get, http_api_path(["clients"]), Headers
|
|
),
|
|
?assertEqual(Client1, Client3),
|
|
?assertMatch(
|
|
{error,
|
|
{failed_connect, [
|
|
_,
|
|
{inet, [inet], econnrefused}
|
|
]}},
|
|
emqx_dashboard_SUITE:request_dashboard(get, https_api_path(["clients"]), Headers)
|
|
),
|
|
%% reset
|
|
?check_trace(
|
|
begin
|
|
?assertMatch({ok, _}, emqx:update_config([<<"dashboard">>], Raw)),
|
|
?assertEqual(Raw, emqx:get_raw_config([<<"dashboard">>])),
|
|
{ok, _} = ?block_until(#{?snk_kind := regenerate_minirest_dispatch}, 10000),
|
|
ok
|
|
end,
|
|
fun(ok, Trace) ->
|
|
%% start new listener('https:dashboard')
|
|
?assertMatch(
|
|
[#{listeners := ['https:dashboard']}], ?of_kind(regenerate_minirest_dispatch, Trace)
|
|
)
|
|
end
|
|
),
|
|
{ok, Client1} = emqx_dashboard_SUITE:request_dashboard(
|
|
get, https_api_path(["clients"]), Headers
|
|
),
|
|
{ok, Client2} = emqx_dashboard_SUITE:request_dashboard(
|
|
get, http_api_path(["clients"]), Headers
|
|
),
|
|
emqx_mgmt_api_test_util:end_suite([emqx_management]).
|
|
|
|
t_default_ssl_cert(_Config) ->
|
|
Conf = #{dashboard => #{listeners => #{https => #{bind => 18084}}}},
|
|
validate_https(Conf, 512, default_ssl_cert(), verify_none),
|
|
ok.
|
|
|
|
t_compatibility_ssl_cert(_Config) ->
|
|
MaxConnection = 1000,
|
|
Conf = #{
|
|
dashboard => #{
|
|
listeners => #{
|
|
https => #{
|
|
bind => 18084,
|
|
cacertfile => naive_env_interpolation(<<"${EMQX_ETC_DIR}/certs/cacert.pem">>),
|
|
certfile => naive_env_interpolation(<<"${EMQX_ETC_DIR}/certs/cert.pem">>),
|
|
keyfile => naive_env_interpolation(<<"${EMQX_ETC_DIR}/certs/key.pem">>),
|
|
max_connections => MaxConnection
|
|
}
|
|
}
|
|
}
|
|
},
|
|
validate_https(Conf, MaxConnection, default_ssl_cert(), verify_none),
|
|
ok.
|
|
|
|
t_normal_ssl_cert(_Config) ->
|
|
MaxConnection = 1024,
|
|
Conf = #{
|
|
dashboard => #{
|
|
listeners => #{
|
|
https => #{
|
|
bind => 18084,
|
|
ssl_options => #{
|
|
cacertfile => naive_env_interpolation(
|
|
<<"${EMQX_ETC_DIR}/certs/cacert.pem">>
|
|
),
|
|
certfile => naive_env_interpolation(<<"${EMQX_ETC_DIR}/certs/cert.pem">>),
|
|
keyfile => naive_env_interpolation(<<"${EMQX_ETC_DIR}/certs/key.pem">>),
|
|
depth => 5
|
|
},
|
|
max_connections => MaxConnection
|
|
}
|
|
}
|
|
}
|
|
},
|
|
validate_https(Conf, MaxConnection, default_ssl_cert(), verify_none),
|
|
ok.
|
|
|
|
t_verify_cacertfile(_Config) ->
|
|
MaxConnection = 1024,
|
|
DefaultSSLCert = default_ssl_cert(),
|
|
SSLCert = DefaultSSLCert#{cacertfile => <<"">>},
|
|
%% default #{verify => verify_none}
|
|
Conf = #{
|
|
dashboard => #{
|
|
listeners => #{
|
|
https => #{
|
|
bind => 18084,
|
|
cacertfile => <<"">>,
|
|
max_connections => MaxConnection
|
|
}
|
|
}
|
|
}
|
|
},
|
|
validate_https(Conf, MaxConnection, SSLCert, verify_none),
|
|
%% verify_peer but cacertfile is empty
|
|
VerifyPeerConf1 = emqx_utils_maps:deep_put(
|
|
[dashboard, listeners, https, verify],
|
|
Conf,
|
|
verify_peer
|
|
),
|
|
emqx_common_test_helpers:load_config(emqx_dashboard_schema, VerifyPeerConf1),
|
|
?assertMatch({error, [?NAME]}, emqx_dashboard:start_listeners()),
|
|
%% verify_peer and cacertfile is ok.
|
|
VerifyPeerConf2 = emqx_utils_maps:deep_put(
|
|
[dashboard, listeners, https, cacertfile],
|
|
VerifyPeerConf1,
|
|
naive_env_interpolation(<<"${EMQX_ETC_DIR}/certs/cacert.pem">>)
|
|
),
|
|
%% we always test client with verify_none and no client cert is sent
|
|
%% since the server is configured with verify_peer
|
|
%% hence the expected observation on the client side is an error
|
|
ErrorReason =
|
|
try
|
|
validate_https(VerifyPeerConf2, MaxConnection, DefaultSSLCert, verify_peer)
|
|
catch
|
|
error:{https_client_error, Reason} ->
|
|
Reason
|
|
end,
|
|
%% There seems to be a race-condition causing the return value to vary a bit
|
|
case ErrorReason of
|
|
socket_closed_remotely ->
|
|
ok;
|
|
{ssl_error, _SslSock, {tls_alert, {certificate_required, _}}} ->
|
|
ok;
|
|
Other ->
|
|
throw({unexpected, Other})
|
|
end.
|
|
|
|
t_bad_certfile(_Config) ->
|
|
Conf = #{
|
|
dashboard => #{
|
|
listeners => #{
|
|
https => #{
|
|
bind => 18084,
|
|
certfile => <<"${EMQX_ETC_DIR}/certs/not_found_cert.pem">>
|
|
}
|
|
}
|
|
}
|
|
},
|
|
emqx_common_test_helpers:load_config(emqx_dashboard_schema, Conf),
|
|
?assertMatch({error, [?NAME]}, emqx_dashboard:start_listeners()),
|
|
ok.
|
|
|
|
validate_https(Conf, MaxConnection, SSLCert, Verify) ->
|
|
emqx_common_test_helpers:load_config(emqx_dashboard_schema, Conf),
|
|
emqx_mgmt_api_test_util:init_suite([emqx_management], fun(X) -> X end),
|
|
try
|
|
assert_ranch_options(MaxConnection, SSLCert, Verify),
|
|
assert_https_request()
|
|
after
|
|
emqx_mgmt_api_test_util:end_suite([emqx_management])
|
|
end.
|
|
|
|
assert_ranch_options(MaxConnections0, SSLCert, Verify) ->
|
|
Middlewares = [emqx_dashboard_middleware, cowboy_router, cowboy_handler],
|
|
[
|
|
?NAME,
|
|
ranch_ssl,
|
|
#{
|
|
max_connections := MaxConnections,
|
|
num_acceptors := _,
|
|
socket_opts := SocketOpts
|
|
},
|
|
cowboy_tls,
|
|
#{
|
|
env := #{
|
|
dispatch := {persistent_term, ?NAME},
|
|
options := #{
|
|
name := ?NAME,
|
|
protocol := https,
|
|
protocol_options := #{proxy_header := false},
|
|
security := [#{basicAuth := []}, #{bearerAuth := []}],
|
|
swagger_global_spec := _
|
|
}
|
|
},
|
|
middlewares := Middlewares,
|
|
proxy_header := false
|
|
}
|
|
] = ranch_server:get_listener_start_args(?NAME),
|
|
?assertEqual(MaxConnections0, MaxConnections),
|
|
?assert(lists:member(inet, SocketOpts), SocketOpts),
|
|
#{
|
|
backlog := 1024,
|
|
ciphers := Ciphers,
|
|
port := 18084,
|
|
send_timeout := 10000,
|
|
verify := Verify,
|
|
versions := Versions
|
|
} = SocketMaps = maps:from_list(SocketOpts -- [inet]),
|
|
%% without tlsv1.1 tlsv1
|
|
?assertMatch(['tlsv1.3', 'tlsv1.2'], Versions),
|
|
?assert(Ciphers =/= []),
|
|
maps:foreach(
|
|
fun(K, ConfVal) ->
|
|
case maps:find(K, SocketMaps) of
|
|
{ok, File} -> ?assertEqual(naive_env_interpolation(ConfVal), File);
|
|
error -> ?assertEqual(<<"">>, ConfVal)
|
|
end
|
|
end,
|
|
SSLCert
|
|
),
|
|
?assertMatch(
|
|
#{
|
|
env := #{dispatch := {persistent_term, ?NAME}},
|
|
middlewares := Middlewares,
|
|
proxy_header := false
|
|
},
|
|
ranch:get_protocol_options(?NAME)
|
|
),
|
|
ok.
|
|
|
|
assert_https_request() ->
|
|
Headers = emqx_dashboard_SUITE:auth_header_(),
|
|
lists:foreach(
|
|
fun(Path) ->
|
|
ApiPath = https_api_path([Path]),
|
|
case emqx_dashboard_SUITE:request_dashboard(get, ApiPath, Headers) of
|
|
{ok, _} -> ok;
|
|
{error, Reason} -> error({https_client_error, Reason})
|
|
end
|
|
end,
|
|
?OVERVIEWS
|
|
).
|
|
|
|
https_api_path(Parts) ->
|
|
?HOST_HTTPS ++ filename:join([?BASE_PATH | Parts]).
|
|
|
|
http_api_path(Parts) ->
|
|
?HOST_HTTP ++ filename:join([?BASE_PATH | Parts]).
|
|
|
|
naive_env_interpolation(Str0) ->
|
|
Str1 = emqx_schema:naive_env_interpolation(Str0),
|
|
%% assert all envs are replaced
|
|
?assertNot(lists:member($$, Str1)),
|
|
Str1.
|
|
|
|
default_ssl_cert() ->
|
|
#{
|
|
cacertfile => <<"${EMQX_ETC_DIR}/certs/cacert.pem">>,
|
|
certfile => <<"${EMQX_ETC_DIR}/certs/cert.pem">>,
|
|
keyfile => <<"${EMQX_ETC_DIR}/certs/key.pem">>
|
|
}.
|