Skip to content

Commit bdf0094

Browse files
committed
WL#15154 patch #7 MTR tests
Add MTR test cases for Transporter TLS Off and Required. In these tests, transporter connections to mgmd (which are "upgraded" from MGM connections) still use cleartext, even in the "Required" scenario. This will be fixed later, in WL#15524, by starting TLS on the MGM connection before the upgrade. Change-Id: Id710f47a19ab930914ccf9013d5045d46e51d32d
1 parent bc05ac9 commit bdf0094

16 files changed

+270
-0
lines changed
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICGDCCAQCgAwIBAgIKe6gT+9hCjqPJBjANBgkqhkiG9w0BAQsFADAoMSYwJAYD
3+
VQQDDB1NeVNRTCBOREIgQ2x1c3RlciBDZXJ0aWZpY2F0ZTAeFw0yMzAzMTYwNTAx
4+
MThaFw0yNDA0MTkwNTAxMThaMBwxGjAYBgNVBAMMEU5EQiBOb2RlIE1hciAyMDIz
5+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOyNOrCPzL3D9s+4jgVwBI7haMMto
6+
JhCqIi4fFOi/zvt41jfiAl1+U+lUs1scjotlXQCGhjleIM3qL40RYqcv4aMbMBkw
7+
FwYDVR0RAQH/BA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4IBAQB54m3T
8+
Jh/X0dx0FBwSbvC02sXWYF84rxI8332lttGIcN88IVjO0vMGJJhMm98r97RlE95M
9+
MY09MYm/yKemXVe+szNANLDfZ/SLkDaUZyJrI6lhznMljj8xnDJN0fRhAnm4iwcT
10+
vHG0osyTiDm/4CXLr5V3UVDDoDfpktCVSsrstaKOPLMzXhGgat/Y3/hvC0QvvnuC
11+
/bGcF+5ZJTJTx1lbXE5ef/51oU4u/hi0c6UhuO63+oNM3v+Fdg9wmOz3ITdHfuXp
12+
MiEjMzY2L5vuB1DrOwlpK9K+PijkbDCjHcntZuDQrviyN/l8VpCuGoUTU53/o4K7
13+
BV1g75aefCy1+y8s
14+
-----END CERTIFICATE-----
15+
-----BEGIN CERTIFICATE-----
16+
MIIC6DCCAdCgAwIBAgILAOJzsRsTdsy+5KIwDQYJKoZIhvcNAQELBQAwKDEmMCQG
17+
A1UEAwwdTXlTUUwgTkRCIENsdXN0ZXIgQ2VydGlmaWNhdGUwHhcNMjIwNjA2MDEy
18+
NzAxWhcNMjYwNjA2MDEyNzAxWjAoMSYwJAYDVQQDDB1NeVNRTCBOREIgQ2x1c3Rl
19+
ciBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJtZ
20+
p2cfo6Q9TG7krVpfcdKWoAM9yjaWVt7TD6O+N2Zk1fxjgFigQEa20uMwfmaZ4L7n
21+
djWWpK6oa+TaCdfsNAaAdkE2HXA/mcFsd+fPFXOEELgkPoin83HnFRLWnPnj6wRU
22+
3O4r7TsDVqgPjEh4O3vmyOUYR7jw3B6rajDVQFtXT54ZrrsoH+QzWX8mX8Q0WSQd
23+
hKKFekQqnRyLucjJcMfb7B1fLwZGi5dC9/UzDIT4NM0a2mMBL4/9xjg94LYHfTmN
24+
MbmSaLbYQjuGrCwf3nelQIAq5UZ04/7mQ8mNMyEnXDI37FfMhIX1HzYew5nD4nxE
25+
sh/8RrFKpqHSayNj1d0CAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
26+
9w0BAQsFAAOCAQEAJop7adeLAgULgwp4SwXr64DQ7aw2HsSHnI/iCOz6tV96hoDq
27+
COi02L4M5T8PS/T5/JjawZ82D/Xs2m61c3VTNblxP/WIWPMfTRH3cDd7YDjRPRZE
28+
xPZvbAJawMnkV/GtMxXPEScJzoIqjugaZ9B2KXCn20EGlXJ82qDBQZT/9HrYNKki
29+
Cc080C8ybLw2Sm7Ty8SzetS+fMmdfAzqdIHB+IlATOzkhsIvC1A3MG0TP17vtcUW
30+
JcL0sjI//5kX14Sz63lZl1ecVMl4e8oHrdOtrDfM7m2D4x4dfsn0VehP6ZmqygJ/
31+
Pzp7VdwefvR0almfGq4hSGgXI1sR8DspPbgItw==
32+
-----END CERTIFICATE-----
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgQ3qE2Dcmyz4pGEtB
3+
/GC2+lE0er1DhWbIYV82wFoUosuhRANCAAQ7I06sI/MvcP2z7iOBXAEjuFowy2gm
4+
EKoiLh8U6L/O+3jWN+ICXX5T6VSzWxyOi2VdAIaGOV4gzeovjRFipy/h
5+
-----END PRIVATE KEY-----
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICADCB6aADAgECAgsAtxUy1a7/x+HiSjANBgkqhkiG9w0BAQsFADAoMSYwJAYD
3+
VQQDDB1NeVNRTCBOREIgQ2x1c3RlciBDZXJ0aWZpY2F0ZTAeFw0yMzAzMTYwNTAx
4+
MThaFw0yNDA0MTkwNTAxMThaMCExHzAdBgNVBAMMFk5EQiBEYXRhIE5vZGUgTWFy
5+
IDIwMjMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATbVN3EfgsY8mAgD9WCkRiI
6+
OOzFtdS91cvi5QBsnMIvoeLa7pylcncNA7hVHJoAny8IkhY1KbIlIkoBxi21lxFT
7+
MA0GCSqGSIb3DQEBCwUAA4IBAQARaCq4DFBZGaZk5uKYKUBEqmkaTy6zOGSu+754
8+
2D8a2kpmk41BJh+gxUkOMGK4cIUHB+QZA8TgekDZR0OXQMrueDkAoj9IvmoQSw6X
9+
7HOGK0HOhdHGYcMKcQ15npYWcwKTxFbbllwtNDG1EdLOa0zGxeIdN5mEWm2spAhu
10+
kGRE/Zxii2tB1EChPBZyS09gNSqEOTj7N30phqX9omEIVZixxGGMGq1j059YZDET
11+
y6Z33YfYCsB0GybD6hFYArLRUkGgSOE3TJ2mE021tcklirWG9hi626BxPDlbwLbj
12+
NahfVZgv7QBPn2N+ZFVq8rhzh+W7LF6rJadmSgF9oG+sMxr4
13+
-----END CERTIFICATE-----
14+
-----BEGIN CERTIFICATE-----
15+
MIIC6DCCAdCgAwIBAgILAOJzsRsTdsy+5KIwDQYJKoZIhvcNAQELBQAwKDEmMCQG
16+
A1UEAwwdTXlTUUwgTkRCIENsdXN0ZXIgQ2VydGlmaWNhdGUwHhcNMjIwNjA2MDEy
17+
NzAxWhcNMjYwNjA2MDEyNzAxWjAoMSYwJAYDVQQDDB1NeVNRTCBOREIgQ2x1c3Rl
18+
ciBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJtZ
19+
p2cfo6Q9TG7krVpfcdKWoAM9yjaWVt7TD6O+N2Zk1fxjgFigQEa20uMwfmaZ4L7n
20+
djWWpK6oa+TaCdfsNAaAdkE2HXA/mcFsd+fPFXOEELgkPoin83HnFRLWnPnj6wRU
21+
3O4r7TsDVqgPjEh4O3vmyOUYR7jw3B6rajDVQFtXT54ZrrsoH+QzWX8mX8Q0WSQd
22+
hKKFekQqnRyLucjJcMfb7B1fLwZGi5dC9/UzDIT4NM0a2mMBL4/9xjg94LYHfTmN
23+
MbmSaLbYQjuGrCwf3nelQIAq5UZ04/7mQ8mNMyEnXDI37FfMhIX1HzYew5nD4nxE
24+
sh/8RrFKpqHSayNj1d0CAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
25+
9w0BAQsFAAOCAQEAJop7adeLAgULgwp4SwXr64DQ7aw2HsSHnI/iCOz6tV96hoDq
26+
COi02L4M5T8PS/T5/JjawZ82D/Xs2m61c3VTNblxP/WIWPMfTRH3cDd7YDjRPRZE
27+
xPZvbAJawMnkV/GtMxXPEScJzoIqjugaZ9B2KXCn20EGlXJ82qDBQZT/9HrYNKki
28+
Cc080C8ybLw2Sm7Ty8SzetS+fMmdfAzqdIHB+IlATOzkhsIvC1A3MG0TP17vtcUW
29+
JcL0sjI//5kX14Sz63lZl1ecVMl4e8oHrdOtrDfM7m2D4x4dfsn0VehP6ZmqygJ/
30+
Pzp7VdwefvR0almfGq4hSGgXI1sR8DspPbgItw==
31+
-----END CERTIFICATE-----
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgcLBjUXRm1C3yc0+U
3+
s3k0GbR2l+2rnYqUFkzRG7OUSkuhRANCAATbVN3EfgsY8mAgD9WCkRiIOOzFtdS9
4+
1cvi5QBsnMIvoeLa7pylcncNA7hVHJoAny8IkhY1KbIlIkoBxi21lxFT
5+
-----END PRIVATE KEY-----
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICIzCCAQugAwIBAgIKIHADuL5fx/uoPjANBgkqhkiG9w0BAQsFADAoMSYwJAYD
3+
VQQDDB1NeVNRTCBOREIgQ2x1c3RlciBDZXJ0aWZpY2F0ZTAeFw0yMzAzMTYwNTAx
4+
MThaFw0yNDA0MTkwNTAxMThaMCcxJTAjBgNVBAMMHE5EQiBNYW5hZ2VtZW50IE5v
5+
ZGUgTWFyIDIwMjMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATmsuHpwU+xx8o7
6+
AV9Pn2TZ3HNvr9p311Ix4lJjc68d2jZHEQnh/U9ymVB4aDCxbFpTG5c4xPEz6Jdo
7+
nHrsonskoxswGTAXBgNVHREBAf8EDTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQEL
8+
BQADggEBAGrk2sWxAvrp7XfcawerV2oAQhvRXplhxWzY3wS0VinbJSGCnqCeHHvC
9+
fJ4oYwhcqobkA1hMD0uQepdH2nLs5TTHEncwF2s++n565sqw/Vj77Ew1ayqo/6ml
10+
/Np5ccnzCks7eas+mIKi+Z/0YAtUSbZHkjCyhkGDnHpXAD4ZhM3rlXcLBbWhfmLT
11+
v/bua1W/MkyLBfI0zR7VSi+t/DzsF1Ga8tHzi/ZrMYmRayqVw8xB1cVeoPqPK++i
12+
J7pTnOokfBrqVv26D5ne6fNVLp4iWhTTmp+BinMFNOmCGcrvMzUfOFoeaOoh6pG/
13+
18qS23O6VP2GdGwxomZggluykKc+TFA=
14+
-----END CERTIFICATE-----
15+
-----BEGIN CERTIFICATE-----
16+
MIIC6DCCAdCgAwIBAgILAOJzsRsTdsy+5KIwDQYJKoZIhvcNAQELBQAwKDEmMCQG
17+
A1UEAwwdTXlTUUwgTkRCIENsdXN0ZXIgQ2VydGlmaWNhdGUwHhcNMjIwNjA2MDEy
18+
NzAxWhcNMjYwNjA2MDEyNzAxWjAoMSYwJAYDVQQDDB1NeVNRTCBOREIgQ2x1c3Rl
19+
ciBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJtZ
20+
p2cfo6Q9TG7krVpfcdKWoAM9yjaWVt7TD6O+N2Zk1fxjgFigQEa20uMwfmaZ4L7n
21+
djWWpK6oa+TaCdfsNAaAdkE2HXA/mcFsd+fPFXOEELgkPoin83HnFRLWnPnj6wRU
22+
3O4r7TsDVqgPjEh4O3vmyOUYR7jw3B6rajDVQFtXT54ZrrsoH+QzWX8mX8Q0WSQd
23+
hKKFekQqnRyLucjJcMfb7B1fLwZGi5dC9/UzDIT4NM0a2mMBL4/9xjg94LYHfTmN
24+
MbmSaLbYQjuGrCwf3nelQIAq5UZ04/7mQ8mNMyEnXDI37FfMhIX1HzYew5nD4nxE
25+
sh/8RrFKpqHSayNj1d0CAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
26+
9w0BAQsFAAOCAQEAJop7adeLAgULgwp4SwXr64DQ7aw2HsSHnI/iCOz6tV96hoDq
27+
COi02L4M5T8PS/T5/JjawZ82D/Xs2m61c3VTNblxP/WIWPMfTRH3cDd7YDjRPRZE
28+
xPZvbAJawMnkV/GtMxXPEScJzoIqjugaZ9B2KXCn20EGlXJ82qDBQZT/9HrYNKki
29+
Cc080C8ybLw2Sm7Ty8SzetS+fMmdfAzqdIHB+IlATOzkhsIvC1A3MG0TP17vtcUW
30+
JcL0sjI//5kX14Sz63lZl1ecVMl4e8oHrdOtrDfM7m2D4x4dfsn0VehP6ZmqygJ/
31+
Pzp7VdwefvR0almfGq4hSGgXI1sR8DspPbgItw==
32+
-----END CERTIFICATE-----
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgA/Q1pd10WI3oLjR5
3+
flzbpFS2Rg+8NIgEZTXb94McjpihRANCAATmsuHpwU+xx8o7AV9Pn2TZ3HNvr9p3
4+
11Ix4lJjc68d2jZHEQnh/U9ymVB4aDCxbFpTG5c4xPEz6JdonHrsonsk
5+
-----END PRIVATE KEY-----

mysql-test/suite/ndb_tls/my.cnf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ ndbcluster
2424
ndb-wait-connected=30
2525
ndb-wait-setup=120
2626
ndb-extra-logging=99
27+
ndb-tls-search-path=$MYSQLTEST_VARDIR/mysql_cluster.1
2728

2829
[cluster_config.mysqld.1.1]
2930
NodeId=51

mysql-test/suite/ndb_tls/no_path.cnf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
!include suite/ndb_tls/my.cnf
2+
3+
[ndb_mgmd.1.1]
4+
ndb-tls-search-path=
5+
6+
[ndbd.1.1]
7+
ndb-tls-search-path=
8+
9+
[ndbd.2.1]
10+
ndb-tls-search-path=
11+
12+
[mysqld]
13+
ndb-tls-search-path=
14+
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
SHOW VARIABLES LIKE 'ndb_tls_search_path';
2+
Variable_name Value
3+
ndb_tls_search_path
4+
SELECT * FROM ndbinfo.certificates;
5+
Node_id Name Expires Serial

mysql-test/suite/ndb_tls/no_path.test

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
--source include/have_ndb.inc
2+
--source suite/ndb_tls/include/check_openssl.inc
3+
4+
# Test with TLS search path set to an empty string
5+
6+
# The MySQL server is up
7+
SHOW VARIABLES LIKE 'ndb_tls_search_path';
8+
9+
# The certificates table is empty.
10+
SELECT * FROM ndbinfo.certificates;
11+
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
!include suite/ndb_tls/my.cnf
2+
3+
[ndbd.1.1]
4+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
5+
6+
[ndbd.2.1]
7+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
8+
9+
[ndb_mgmd.1.1]
10+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
11+
12+
[mysqld.1.1]
13+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
14+
15+
16+
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
SELECT * FROM ndbinfo.certificates order by Node_id;
2+
Node_id Name Expires Serial
3+
1 NDB Data Node Mar 2023 19-Apr-2024 B7:15:32:D5:AE:FF:C7:E1:E2
4+
2 NDB Data Node Mar 2023 19-Apr-2024 B7:15:32:D5:AE:FF:C7:E1:E2
5+
SELECT node_id, remote_node_id, encrypted from ndbinfo.transporters
6+
WHERE status = 'CONNECTED' ORDER BY node_id, remote_node_id;
7+
node_id remote_node_id encrypted
8+
1 2 0
9+
1 3 0
10+
1 51 0
11+
2 1 0
12+
2 3 0
13+
2 51 0
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--source include/have_ndb.inc
2+
--source suite/ndb_tls/include/check_openssl.inc
3+
4+
# Data node certs exist and are visible in ndbinfo
5+
6+
# Expect 2 node certificates.
7+
# ndbinfo is aware of DB certs that belong to each data node, but it
8+
# is not aware of any API or MGM certs because no data node has a TLS
9+
# connection to an MGM or API node.
10+
#
11+
SELECT * FROM ndbinfo.certificates order by Node_id;
12+
13+
# Expect all connections unencrypted
14+
SELECT node_id, remote_node_id, encrypted from ndbinfo.transporters
15+
WHERE status = 'CONNECTED' ORDER BY node_id, remote_node_id;
Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
!include suite/ndb_tls/my.cnf
2+
3+
[cluster_config.ndbd.1.1]
4+
RequireTls=true
5+
6+
[cluster_config.ndbd.2.1]
7+
RequireTls=true
8+
9+
[ndbd.1.1]
10+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
11+
12+
[ndbd.2.1]
13+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
14+
15+
[ndb_mgmd.1.1]
16+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
17+
18+
[mysqld.1.1]
19+
ndb-tls-search-path=$MYSQLTEST_VARDIR/std_data/ndb-tls/active
20+
ndb-cluster-connection-pool=2
21+
ndb-cluster-connection-pool-nodeids=51,52
22+
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
SELECT * FROM ndbinfo.certificates order by Node_id;
2+
Node_id Name Expires Serial
3+
1 NDB Data Node Mar 2023 19-Apr-2024 B7:15:32:D5:AE:FF:C7:E1:E2
4+
2 NDB Data Node Mar 2023 19-Apr-2024 B7:15:32:D5:AE:FF:C7:E1:E2
5+
51 NDB Node Mar 2023 19-Apr-2024 7B:A8:13:FB:D8:42:8E:A3:C9
6+
52 NDB Node Mar 2023 19-Apr-2024 7B:A8:13:FB:D8:42:8E:A3:C9
7+
SELECT node_id, remote_node_id, encrypted from ndbinfo.transporters
8+
WHERE status = 'CONNECTED' ORDER BY node_id, remote_node_id;
9+
node_id remote_node_id encrypted
10+
1 2 1
11+
1 3 0
12+
1 51 1
13+
1 52 1
14+
2 1 1
15+
2 3 0
16+
2 51 1
17+
2 52 1
18+
Use test;
19+
CREATE TABLE t (i int primary key not null, j int) engine = ndb;
20+
INSERT INTO t VALUES(1, 1);
21+
SELECT * FROM t;
22+
i j
23+
1 1
24+
DROP TABLE t;
Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
--source include/have_ndb.inc
2+
--source suite/ndb_tls/include/check_openssl.inc
3+
4+
# Test with RequireTls=true.
5+
6+
# This test uses two NDB cluster connections from the mysql server
7+
8+
# At startup, all nodes have active certificates in std_data/
9+
#
10+
# To refresh these:
11+
#
12+
# mtr --start ndb_tls.tls_required (TO START MGMD)
13+
# Then, in the source tree:
14+
#
15+
# cd mysql-test/std_data/ndb-tls
16+
# ndb_sign_keys -C CA-cert.pem -K CA-key.pem -c localhost:13000 \
17+
# --CA-search-path=. --ndb-tls-search-path=active \
18+
# --schedule=400,0,400,0,400,0
19+
#
20+
# Then enter the CA passphrase, which is "Stockholm".
21+
#
22+
# Commit the three new cert files, and discard the retired files.
23+
24+
25+
# Expect 3 keys and 3 certificates for 7 nodes
26+
#
27+
SELECT * FROM ndbinfo.certificates order by Node_id;
28+
29+
## Expect 6 encrypted links, plus two unencrypted links to node 3
30+
#
31+
SELECT node_id, remote_node_id, encrypted from ndbinfo.transporters
32+
WHERE status = 'CONNECTED' ORDER BY node_id, remote_node_id;
33+
34+
# Manage some data
35+
Use test;
36+
CREATE TABLE t (i int primary key not null, j int) engine = ndb;
37+
INSERT INTO t VALUES(1, 1);
38+
SELECT * FROM t;
39+
DROP TABLE t;

0 commit comments

Comments
 (0)