Run API tests using https

diff --git a/regression-tests.api/.gitignore b/regression-tests.api/.gitignore
index fcd61ea7b4ed74e67fac47fd1dadf784ddb698af..e80d95307ffe87f6fdeba3a2f0432d662dc86a69 100644 (file)
--- a/regression-tests.api/.gitignore
+++ b/regression-tests.api/.gitignore
@@ -16,3 +16,12 @@
 /acl-notify.list.yml
 /acl.list.yml
 /recursor.yml
+/rec-api.d
+/ca.key
+/ca.pem
+/ca.srl
+/server.chain
+/server.csr
+/server.key
+/server.pem
+/server.p12

diff --git a/regression-tests.api/Makefile b/regression-tests.api/Makefile
new file mode 100644 (file)
index 0000000..84286d7
--- /dev/null
+++ b/regression-tests.api/Makefile
@@ -0,0 +1,15 @@
+clean-certs:
+       rm -f ca.key ca.pem ca.srl server.csr server.key server.pem server.chain server.ocsp
+clean-configs:
+       rm -rf configs/*
+certs:
+       # Generate a new CA
+       openssl req -new -x509 -days 1 -extensions v3_ca -keyout ca.key -out ca.pem -nodes -config configCA.conf
+       # Generate a new server certificate request
+       openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -config configServer.conf
+       # Sign the server cert
+       openssl x509 -req -days 1 -CA ca.pem -CAkey ca.key -CAcreateserial -in server.csr -out server.pem -extfile configServer.conf -extensions v3_req
+       # Generate a chain
+       cat server.pem ca.pem > server.chain
+       # Generate a password-protected PKCS12 file
+       openssl pkcs12 -export -passout pass:passw0rd -clcerts -in server.pem -CAfile ca.pem -inkey server.key -out server.p12

diff --git a/regression-tests.api/configCA.conf b/regression-tests.api/configCA.conf
new file mode 100644 (file)
index 0000000..353616e
--- /dev/null
+++ b/regression-tests.api/configCA.conf
@@ -0,0 +1,19 @@
+[req]
+default_bits = 2048
+encrypt_key = no
+prompt = no
+distinguished_name = distinguished_name
+
+[v3_ca]
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+basicConstraints = critical, CA:true
+keyUsage = critical, cRLSign, keyCertSign
+
+[distinguished_name]
+CN = PowerDNS Recursor TLS regression tests CA
+OU = PowerDNS.com BV
+countryName = NL
+
+[CA_default]
+copy_extensions = copy

diff --git a/regression-tests.api/configServer.conf b/regression-tests.api/configServer.conf
new file mode 100644 (file)
index 0000000..587caf6
--- /dev/null
+++ b/regression-tests.api/configServer.conf
@@ -0,0 +1,21 @@
+[req]
+default_bits = 2048
+encrypt_key = no
+prompt = no
+distinguished_name = server_distinguished_name
+req_extensions = v3_req
+
+[server_distinguished_name]
+CN = tls.tests.powerdns.com
+OU = PowerDNS.com BV
+countryName = NL
+
+[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = tls.tests.powerdns.com
+DNS.2 = powerdns.com
+IP.3 = 127.0.0.1

diff --git a/regression-tests.api/runtests b/regression-tests.api/runtests
index 46bddcbbf20d1b11abf217531c324c680462291c..6e7838a1c3dd46b57d66b156153039a117f01d0f 100755 (executable)
--- a/regression-tests.api/runtests
+++ b/regression-tests.api/runtests
@@ -8,6 +8,9 @@ python -V
 pip install -U pip wheel | cat
 pip install -r requirements.txt | cat
 
+make clean-certs
+make certs
+
 if [ -z "${SDIG}" ]; then
   export SDIG=$(type -P sdig)
 fi

diff --git a/regression-tests.api/runtests.py b/regression-tests.api/runtests.py
index 0a3e8f1d578edf679f17b3ecdc754e858a010f90..99932570d3eb726d792a431c292bcfd646dc5abb 100755 (executable)
--- a/regression-tests.api/runtests.py
+++ b/regression-tests.api/runtests.py
@@ -110,7 +110,15 @@ incoming:
   allow_from_file: acl.list.yml
   allow_notify_from_file: acl-notify.list.yml
 webservice:
+  webserver: true
   api_dir: %(api_dir)s
+  listen:
+    - addresses: [ 127.0.0.1:"""+str(WEBPORT)+""" ]
+      tls:
+        certificate: server.chain
+        key: server.key
+  api_key: """+APIKEY+"""
+  password: """+WEBPASSWORD+"""
 recursor:
   include_dir: %(conf_dir)s
   devonly_regression_test_mode: true
@@ -160,6 +168,10 @@ common_args = [
     "--webserver-password="+WEBPASSWORD,
     "--api-key="+APIKEY
 ]
+rec_args = [
+    "--daemon=no", "--socket-dir=.", "--config-dir=.",
+    "--local-address=127.0.0.1", "--local-port="+str(DNSPORT),
+]
 
 # Take sdig if it exists (recursor in travis), otherwise build it from Authoritative source.
 sdig = os.environ.get("SDIG", "")
@@ -237,7 +249,7 @@ else:
     with open(conf_dir+'/example.com.yml', 'w') as conf_file:
         conf_file.write(REC_EXAMPLE_COM_CONF_TPL)
 
-    servercmd = [pdns_recursor] + common_args
+    servercmd = [pdns_recursor] + rec_args
 
 
 # Now run pdns and the tests.
@@ -269,7 +281,10 @@ available = False
 time.sleep(1)
 for try_number in range(0, 10):
     try:
-        res = requests.get('http://127.0.0.1:%s/' % WEBPORT)
+        if daemon == 'authoritative':
+            res = requests.get('http://127.0.0.1:%s/' % WEBPORT)
+        else:
+            res = requests.get('https://127.0.0.1:%s/' % WEBPORT, verify=False)
         available = True
         break
     except HTTPError as http_err:

diff --git a/regression-tests.api/test_Basics.py b/regression-tests.api/test_Basics.py
index 46b32a641b46ac8b265e99e0e11240d283201973..6acf9a803283801bc9d8daa3700420c8f90ef7f7 100644 (file)
--- a/regression-tests.api/test_Basics.py
+++ b/regression-tests.api/test_Basics.py
@@ -7,11 +7,11 @@ from test_helper import ApiTestCase, is_auth
 class TestBasics(ApiTestCase):
 
     def test_unauth(self):
-        r = requests.get(self.url("/api/v1/servers/localhost"))
+        r = requests.get(self.url("/api/v1/servers/localhost"), verify=False)
         self.assertEqual(r.status_code, requests.codes.unauthorized)
 
     def test_index_html(self):
-        r = requests.get(self.url("/"), auth=('admin', self.server_web_password))
+        r = requests.get(self.url("/"), auth=('admin', self.server_web_password), verify=False)
         self.assertEqual(r.status_code, requests.codes.ok)
 
     def test_split_request(self):

diff --git a/regression-tests.api/test_Servers.py b/regression-tests.api/test_Servers.py
index 47122ebb159387b1976471d9601166646b74d7c7..c0e1206514743b078de5e434f34306c88acf82a4 100644 (file)
--- a/regression-tests.api/test_Servers.py
+++ b/regression-tests.api/test_Servers.py
@@ -101,7 +101,7 @@ class Servers(ApiTestCase):
 
     @unittest.skipIf(is_auth(), "Not applicable")
     def test_read_statistics_using_password(self):
-        r = requests.get(self.url("/api/v1/servers/localhost/statistics"), auth=('admin', self.server_web_password))
+        r = requests.get(self.url("/api/v1/servers/localhost/statistics"), auth=('admin', self.server_web_password), verify=False)
         self.assertEqual(r.status_code, requests.codes.ok)
         self.assert_success_json(r)
 

diff --git a/regression-tests.api/test_helper.py b/regression-tests.api/test_helper.py
index 54d70126287ef208d58e0a867639c64e22cb7268..fe8272560fcb8b43f816d3217c4cddb394b1f62f 100644 (file)
--- a/regression-tests.api/test_helper.py
+++ b/regression-tests.api/test_helper.py
@@ -38,6 +38,9 @@ class ApiTestCase(unittest.TestCase):
         self.server_web_password = os.environ.get('WEBPASSWORD', 'MISSING')
         self.session = requests.Session()
         self.session.headers = {'X-API-Key': os.environ.get('APIKEY', 'changeme-key'), 'Origin': 'http://%s:%s' % (self.server_address, self.server_port)}
+        if is_recursor():
+            self.server_url = 'https://%s:%s/' % (self.server_address, self.server_port)
+            self.session.verify = False
 
     def url(self, relative_url):
         return urljoin(self.server_url, relative_url)

diff --git a/regression-tests.recursor-dnssec/.gitignore b/regression-tests.recursor-dnssec/.gitignore
index 118c63c0c44830ac1479d372d4533881cefde6b5..1bc206a05c3f0780f4dd80180fab6f003b03ecc3 100644 (file)
--- a/regression-tests.recursor-dnssec/.gitignore
+++ b/regression-tests.recursor-dnssec/.gitignore
@@ -12,4 +12,3 @@
 /server.key
 /server.pem
 /server.p12
-