From b4a21d1957bb44cb4a289a8ed8dfc7b45cd8464d Mon Sep 17 00:00:00 2001 From: Robert Gemmell Date: Thu, 26 Nov 2009 16:47:36 +0000 Subject: QPID-2184: add additional testing against static firewall configurations git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@884634 13f79535-47bb-0310-9956-ffa450edef68 --- .../systests/etc/config-systests-firewall-2.xml | 137 +++++++++++++++++++++ .../systests/etc/config-systests-firewall-3.xml | 137 +++++++++++++++++++++ .../security/firewall/FirewallConfigTest.java | 82 ++++++++++++ 3 files changed, 356 insertions(+) create mode 100644 qpid/java/systests/etc/config-systests-firewall-2.xml create mode 100644 qpid/java/systests/etc/config-systests-firewall-3.xml (limited to 'qpid/java') diff --git a/qpid/java/systests/etc/config-systests-firewall-2.xml b/qpid/java/systests/etc/config-systests-firewall-2.xml new file mode 100644 index 0000000000..1c560d751d --- /dev/null +++ b/qpid/java/systests/etc/config-systests-firewall-2.xml @@ -0,0 +1,137 @@ + + + + ${QPID_HOME} + ${QPID_WORK} + ${prefix}/etc + + + + false + false + /path/to/keystore.ks + keystorepass + + false + + false + 262144 + 262144 + + nio + 5672 + 8672 + 32768 + 32768 + + + false + 8999 + + false + + ${prefix}/../test-profiles/test_resources/ssl/keystore.jks + password + + + + + false + false + 65535 + false + false + en_US + + + + + + + passwordfile + org.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase + + + passwordFile + ${conf}/passwd + + + + + + + org.apache.qpid.server.security.access.plugins.AllowAll + + + false + + + ${conf}/jmxremote.access + passwordfile + + + + + + + + + test + + + test + + + org.apache.qpid.server.store.MemoryMessageStore + + + + + + + + + + test2 + + + org.apache.qpid.server.store.MemoryMessageStore + + + + + + + 0 + 2.0 + + + true + + + ON + + + + diff --git a/qpid/java/systests/etc/config-systests-firewall-3.xml b/qpid/java/systests/etc/config-systests-firewall-3.xml new file mode 100644 index 0000000000..05c4df6069 --- /dev/null +++ b/qpid/java/systests/etc/config-systests-firewall-3.xml @@ -0,0 +1,137 @@ + + + + ${QPID_HOME} + ${QPID_WORK} + ${prefix}/etc + + + + false + false + /path/to/keystore.ks + keystorepass + + false + + false + 262144 + 262144 + + nio + 5672 + 8672 + 32768 + 32768 + + + false + 8999 + + false + + ${prefix}/../test-profiles/test_resources/ssl/keystore.jks + password + + + + + false + false + 65535 + false + false + en_US + + + + + + + passwordfile + org.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase + + + passwordFile + ${conf}/passwd + + + + + + + org.apache.qpid.server.security.access.plugins.AllowAll + + + false + + + ${conf}/jmxremote.access + passwordfile + + + + + + + + + test + + + test + + + org.apache.qpid.server.store.MemoryMessageStore + + + + + + + test2 + + + org.apache.qpid.server.store.MemoryMessageStore + + + + + + + + + + 0 + 2.0 + + + true + + + ON + + + + diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java index 94bacea2f4..b0415b67c0 100644 --- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java +++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java @@ -7,6 +7,7 @@ import java.io.IOException; import javax.jms.Connection; import javax.jms.JMSException; +import org.apache.qpid.client.AMQConnectionURL; import org.apache.qpid.test.utils.QpidTestCase; public class FirewallConfigTest extends QpidTestCase @@ -50,6 +51,87 @@ public class FirewallConfigTest extends QpidTestCase out.write(""); out.close(); } + + public void testVhostAllowBrokerDeny() throws Exception + { + if (_broker.equals(VM)) + { + //No point running this test with an InVM broker as the + //firewall plugin only functions for TCP connections. + return; + } + + _configFile = new File(System.getProperty("QPID_HOME"), "etc/config-systests-firewall-2.xml"); + + super.setUp(); + + Connection conn = null; + try + { + //Try to get a connection to the 'test2' vhost + //This is expected to fail as it is denied at the broker level + conn = getConnection(new AMQConnectionURL( + "amqp://username:password@clientid/test2?brokerlist='" + getBroker() + "'")); + fail("We expected the connection to fail"); + } + catch (JMSException e) + { + //ignore + } + + conn = null; + try + { + //Try to get a connection to the 'test' vhost + //This is expected to succeed as it is allowed at the vhost level + conn = getConnection(); + } + catch (JMSException e) + { + e.getLinkedException().printStackTrace(); + fail("The connection was expected to succeed: " + e.getMessage()); + } + } + + public void testVhostDenyBrokerAllow() throws Exception + { + if (_broker.equals(VM)) + { + //No point running this test with an InVM broker as the + //firewall plugin only functions for TCP connections. + return; + } + + _configFile = new File(System.getProperty("QPID_HOME"), "etc/config-systests-firewall-3.xml"); + + super.setUp(); + + Connection conn = null; + try + { + //Try to get a connection to the 'test2' vhost + //This is expected to fail as it is denied at the vhost level + conn = getConnection(new AMQConnectionURL( + "amqp://username:password@clientid/test2?brokerlist='" + getBroker() + "'")); + } + catch (JMSException e) + { + //ignore + } + + conn = null; + try + { + //Try to get a connection to the 'test' vhost + //This is expected to succeed as it is allowed at the broker level + conn = getConnection(); + } + catch (JMSException e) + { + e.getLinkedException().printStackTrace(); + fail("The connection was expected to succeed: " + e.getMessage()); + } + } public void testDenyOnRestart() throws Exception { -- cgit v1.2.1