1 /*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19
20 #include <boost/test/unit_test.hpp>
21 #include <boost/test/unit_test_suite.hpp>
22 #include <boost/chrono/duration.hpp>
23 #include <boost/date_time/posix_time/posix_time_duration.hpp>
24 #include <boost/thread/thread.hpp>
25 #include <boost/filesystem.hpp>
26 #include <boost/format.hpp>
27 #include <memory>
28 #include <thrift/transport/TSSLSocket.h>
29 #include <thrift/transport/TSSLServerSocket.h>
30 #ifdef __linux__
31 #include <signal.h>
32 #endif
33
34 using apache::thrift::transport::TSSLServerSocket;
35 using apache::thrift::transport::TSSLSocket;
36 using apache::thrift::transport::TTransport;
37 using apache::thrift::transport::TTransportException;
38 using apache::thrift::transport::TSSLSocketFactory;
39
40 using std::static_pointer_cast;
41 using std::shared_ptr;
42
43 BOOST_AUTO_TEST_SUITE(TSSLSocketInterruptTest)
44
45 boost::filesystem::path keyDir;
certFile(const std::string & filename)46 boost::filesystem::path certFile(const std::string& filename)
47 {
48 return keyDir / filename;
49 }
50 boost::mutex gMutex;
51
52 struct GlobalFixtureSSL
53 {
GlobalFixtureSSLGlobalFixtureSSL54 GlobalFixtureSSL()
55 {
56 using namespace boost::unit_test::framework;
57 for (int i = 0; i < master_test_suite().argc; ++i)
58 {
59 BOOST_TEST_MESSAGE(boost::format("argv[%1%] = \"%2%\"") % i % master_test_suite().argv[i]);
60 }
61
62 #ifdef __linux__
63 // OpenSSL calls send() without MSG_NOSIGPIPE so writing to a socket that has
64 // disconnected can cause a SIGPIPE signal...
65 signal(SIGPIPE, SIG_IGN);
66 #endif
67
68 TSSLSocketFactory::setManualOpenSSLInitialization(true);
69 apache::thrift::transport::initializeOpenSSL();
70
71 keyDir = boost::filesystem::current_path().parent_path().parent_path().parent_path() / "test" / "keys";
72 if (!boost::filesystem::exists(certFile("server.crt")))
73 {
74 keyDir = boost::filesystem::path(master_test_suite().argv[master_test_suite().argc - 1]);
75 if (!boost::filesystem::exists(certFile("server.crt")))
76 {
77 throw std::invalid_argument("The last argument to this test must be the directory containing the test certificate(s).");
78 }
79 }
80 }
81
~GlobalFixtureSSLGlobalFixtureSSL82 virtual ~GlobalFixtureSSL()
83 {
84 apache::thrift::transport::cleanupOpenSSL();
85 #ifdef __linux__
86 signal(SIGPIPE, SIG_DFL);
87 #endif
88 }
89 };
90
91 #if (BOOST_VERSION >= 105900)
92 BOOST_GLOBAL_FIXTURE(GlobalFixtureSSL);
93 #else
BOOST_GLOBAL_FIXTURE(GlobalFixtureSSL)94 BOOST_GLOBAL_FIXTURE(GlobalFixtureSSL)
95 #endif
96
97 void readerWorker(shared_ptr<TTransport> tt, uint32_t expectedResult) {
98 uint8_t buf[4];
99 try {
100 tt->read(buf, 1);
101 BOOST_CHECK_EQUAL(expectedResult, tt->read(buf, 4));
102 } catch (const TTransportException& tx) {
103 BOOST_CHECK_EQUAL(TTransportException::TIMED_OUT, tx.getType());
104 }
105 }
106
readerWorkerMustThrow(shared_ptr<TTransport> tt)107 void readerWorkerMustThrow(shared_ptr<TTransport> tt) {
108 try {
109 uint8_t buf[400];
110 tt->read(buf, 1);
111 tt->read(buf, 400);
112 BOOST_ERROR("should not have gotten here");
113 } catch (const TTransportException& tx) {
114 BOOST_CHECK_EQUAL(TTransportException::INTERRUPTED, tx.getType());
115 }
116 }
117
createServerSocketFactory()118 shared_ptr<TSSLSocketFactory> createServerSocketFactory() {
119 shared_ptr<TSSLSocketFactory> pServerSocketFactory;
120
121 pServerSocketFactory.reset(new TSSLSocketFactory());
122 pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
123 pServerSocketFactory->loadCertificate(certFile("server.crt").string().c_str());
124 pServerSocketFactory->loadPrivateKey(certFile("server.key").string().c_str());
125 pServerSocketFactory->server(true);
126 return pServerSocketFactory;
127 }
128
createClientSocketFactory()129 shared_ptr<TSSLSocketFactory> createClientSocketFactory() {
130 shared_ptr<TSSLSocketFactory> pClientSocketFactory;
131
132 pClientSocketFactory.reset(new TSSLSocketFactory());
133 pClientSocketFactory->authenticate(true);
134 pClientSocketFactory->loadCertificate(certFile("client.crt").string().c_str());
135 pClientSocketFactory->loadPrivateKey(certFile("client.key").string().c_str());
136 pClientSocketFactory->loadTrustedCertificates(certFile("CA.pem").string().c_str());
137 return pClientSocketFactory;
138 }
139
BOOST_AUTO_TEST_CASE(test_ssl_interruptable_child_read_while_handshaking)140 BOOST_AUTO_TEST_CASE(test_ssl_interruptable_child_read_while_handshaking) {
141 shared_ptr<TSSLSocketFactory> pServerSocketFactory = createServerSocketFactory();
142 TSSLServerSocket sock1("localhost", 0, pServerSocketFactory);
143 sock1.listen();
144 int port = sock1.getPort();
145 shared_ptr<TSSLSocketFactory> pClientSocketFactory = createClientSocketFactory();
146 shared_ptr<TSSLSocket> clientSock = pClientSocketFactory->createSocket("localhost", port);
147 clientSock->open();
148 shared_ptr<TTransport> accepted = sock1.accept();
149 boost::thread readThread(std::bind(readerWorkerMustThrow, accepted));
150 boost::this_thread::sleep(boost::posix_time::milliseconds(50));
151 // readThread is practically guaranteed to be blocking now
152 sock1.interruptChildren();
153 BOOST_CHECK_MESSAGE(readThread.try_join_for(boost::chrono::milliseconds(20)),
154 "server socket interruptChildren did not interrupt child read");
155 clientSock->close();
156 accepted->close();
157 sock1.close();
158 }
159
BOOST_AUTO_TEST_CASE(test_ssl_interruptable_child_read)160 BOOST_AUTO_TEST_CASE(test_ssl_interruptable_child_read) {
161 shared_ptr<TSSLSocketFactory> pServerSocketFactory = createServerSocketFactory();
162 TSSLServerSocket sock1("localhost", 0, pServerSocketFactory);
163 sock1.listen();
164 int port = sock1.getPort();
165 shared_ptr<TSSLSocketFactory> pClientSocketFactory = createClientSocketFactory();
166 shared_ptr<TSSLSocket> clientSock = pClientSocketFactory->createSocket("localhost", port);
167 clientSock->open();
168 shared_ptr<TTransport> accepted = sock1.accept();
169 boost::thread readThread(std::bind(readerWorkerMustThrow, accepted));
170 clientSock->write((const uint8_t*)"0", 1);
171 boost::this_thread::sleep(boost::posix_time::milliseconds(50));
172 // readThread is practically guaranteed to be blocking now
173 sock1.interruptChildren();
174 BOOST_CHECK_MESSAGE(readThread.try_join_for(boost::chrono::milliseconds(20)),
175 "server socket interruptChildren did not interrupt child read");
176 accepted->close();
177 clientSock->close();
178 sock1.close();
179 }
180
BOOST_AUTO_TEST_CASE(test_ssl_non_interruptable_child_read)181 BOOST_AUTO_TEST_CASE(test_ssl_non_interruptable_child_read) {
182 shared_ptr<TSSLSocketFactory> pServerSocketFactory = createServerSocketFactory();
183 TSSLServerSocket sock1("localhost", 0, pServerSocketFactory);
184 sock1.setInterruptableChildren(false); // returns to pre-THRIFT-2441 behavior
185 sock1.listen();
186 int port = sock1.getPort();
187 shared_ptr<TSSLSocketFactory> pClientSocketFactory = createClientSocketFactory();
188 shared_ptr<TSSLSocket> clientSock = pClientSocketFactory->createSocket("localhost", port);
189 clientSock->open();
190 shared_ptr<TTransport> accepted = sock1.accept();
191 static_pointer_cast<TSSLSocket>(accepted)->setRecvTimeout(1000);
192 boost::thread readThread(std::bind(readerWorker, accepted, 0));
193 clientSock->write((const uint8_t*)"0", 1);
194 boost::this_thread::sleep(boost::posix_time::milliseconds(50));
195 // readThread is practically guaranteed to be blocking here
196 sock1.interruptChildren();
197 BOOST_CHECK_MESSAGE(!readThread.try_join_for(boost::chrono::milliseconds(200)),
198 "server socket interruptChildren interrupted child read");
199
200 // wait for receive timeout to kick in
201 readThread.join();
202 accepted->close();
203 clientSock->close();
204 sock1.close();
205 }
206
BOOST_AUTO_TEST_CASE(test_ssl_cannot_change_after_listen)207 BOOST_AUTO_TEST_CASE(test_ssl_cannot_change_after_listen) {
208 shared_ptr<TSSLSocketFactory> pServerSocketFactory = createServerSocketFactory();
209 TSSLServerSocket sock1("localhost", 0, pServerSocketFactory);
210 sock1.listen();
211 BOOST_CHECK_THROW(sock1.setInterruptableChildren(false), std::logic_error);
212 sock1.close();
213 }
214
peekerWorker(shared_ptr<TTransport> tt,bool expectedResult)215 void peekerWorker(shared_ptr<TTransport> tt, bool expectedResult) {
216 uint8_t buf[400];
217 try {
218 tt->read(buf, 1);
219 BOOST_CHECK_EQUAL(expectedResult, tt->peek());
220 } catch (const TTransportException& tx) {
221 BOOST_CHECK_EQUAL(TTransportException::TIMED_OUT, tx.getType());
222 }
223 }
224
peekerWorkerInterrupt(shared_ptr<TTransport> tt)225 void peekerWorkerInterrupt(shared_ptr<TTransport> tt) {
226 uint8_t buf[400];
227 try {
228 tt->read(buf, 1);
229 tt->peek();
230 } catch (const TTransportException& tx) {
231 BOOST_CHECK_EQUAL(TTransportException::INTERRUPTED, tx.getType());
232 }
233 }
234
BOOST_AUTO_TEST_CASE(test_ssl_interruptable_child_peek)235 BOOST_AUTO_TEST_CASE(test_ssl_interruptable_child_peek) {
236 shared_ptr<TSSLSocketFactory> pServerSocketFactory = createServerSocketFactory();
237 TSSLServerSocket sock1("localhost", 0, pServerSocketFactory);
238 sock1.listen();
239 int port = sock1.getPort();
240 shared_ptr<TSSLSocketFactory> pClientSocketFactory = createClientSocketFactory();
241 shared_ptr<TSSLSocket> clientSock = pClientSocketFactory->createSocket("localhost", port);
242 clientSock->open();
243 shared_ptr<TTransport> accepted = sock1.accept();
244 boost::thread peekThread(std::bind(peekerWorkerInterrupt, accepted));
245 clientSock->write((const uint8_t*)"0", 1);
246 boost::this_thread::sleep(boost::posix_time::milliseconds(50));
247 // peekThread is practically guaranteed to be blocking now
248 sock1.interruptChildren();
249 BOOST_CHECK_MESSAGE(peekThread.try_join_for(boost::chrono::milliseconds(200)),
250 "server socket interruptChildren did not interrupt child peek");
251 accepted->close();
252 clientSock->close();
253 sock1.close();
254 }
255
BOOST_AUTO_TEST_CASE(test_ssl_non_interruptable_child_peek)256 BOOST_AUTO_TEST_CASE(test_ssl_non_interruptable_child_peek) {
257 shared_ptr<TSSLSocketFactory> pServerSocketFactory = createServerSocketFactory();
258 TSSLServerSocket sock1("localhost", 0, pServerSocketFactory);
259 sock1.setInterruptableChildren(false); // returns to pre-THRIFT-2441 behavior
260 sock1.listen();
261 int port = sock1.getPort();
262 shared_ptr<TSSLSocketFactory> pClientSocketFactory = createClientSocketFactory();
263 shared_ptr<TSSLSocket> clientSock = pClientSocketFactory->createSocket("localhost", port);
264 clientSock->open();
265 shared_ptr<TTransport> accepted = sock1.accept();
266 static_pointer_cast<TSSLSocket>(accepted)->setRecvTimeout(1000);
267 boost::thread peekThread(std::bind(peekerWorker, accepted, false));
268 clientSock->write((const uint8_t*)"0", 1);
269 boost::this_thread::sleep(boost::posix_time::milliseconds(50));
270 // peekThread is practically guaranteed to be blocking now
271 sock1.interruptChildren();
272 BOOST_CHECK_MESSAGE(!peekThread.try_join_for(boost::chrono::milliseconds(200)),
273 "server socket interruptChildren interrupted child peek");
274
275 // wait for the receive timeout to kick in
276 peekThread.join();
277 accepted->close();
278 clientSock->close();
279 sock1.close();
280 }
281
282 BOOST_AUTO_TEST_SUITE_END()
283