Skip to content

Commit 8b2b420

Browse files
michaelklishinmichaelklishin
committed
New integration tests that target TLS connectivity
Since the build system around TLS is now more complex and varies between target platforms, we need a suite like this on CI. These tests are skipped by defautl because 1. The node must be pre-configured to use TLS 2. TLS-related code changes very rarely, so it's acceptable that these only run on CI
1 parent 82caa54 commit 8b2b420

File tree

6 files changed

+507
-4
lines changed

6 files changed

+507
-4
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 101 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,4 +76,104 @@ jobs:
7676
run: RUST_HTTP_API_CLIENT_RABBITMQCTL=DOCKER:${{job.services.rabbitmq.id}} bin/ci/before_build.sh
7777

7878
- name: Run tests
79-
run: RUST_BACKTRACE=1 NEXTEST_RETRIES=2 cargo nextest run --workspace --no-fail-fast --all-features
79+
run: RUST_BACKTRACE=1 NEXTEST_RETRIES=2 cargo nextest run --workspace --no-fail-fast --all-features
80+
81+
tls-tests:
82+
name: TLS Tests
83+
strategy:
84+
matrix:
85+
rabbitmq-series:
86+
- "4.1"
87+
rust-version:
88+
- stable
89+
runner:
90+
- "ubuntu-22.04"
91+
- "ubuntu-24.04"
92+
- "ubuntu-24.04-arm"
93+
runs-on: ${{ matrix.runner }}
94+
95+
steps:
96+
- uses: actions/checkout@v6
97+
98+
- name: Setup Rust
99+
uses: dtolnay/rust-toolchain@stable
100+
with:
101+
toolchain: ${{ matrix.rust-version }}
102+
103+
- uses: taiki-e/install-action@nextest
104+
105+
- name: Clone tls-gen
106+
run: git clone --depth 1 https://github.com/rabbitmq/tls-gen.git target/tls-gen
107+
108+
- name: Generate TLS certificates
109+
run: |
110+
cd target/tls-gen/basic
111+
make CN=localhost
112+
make alias-leaf-artifacts
113+
114+
- name: Create certs directory
115+
run: mkdir -p tests/tls/certs
116+
117+
- name: Copy certificates
118+
run: |
119+
cp target/tls-gen/basic/result/ca_certificate.pem tests/tls/certs/
120+
cp target/tls-gen/basic/result/server_certificate.pem tests/tls/certs/
121+
cp target/tls-gen/basic/result/server_key.pem tests/tls/certs/
122+
cp target/tls-gen/basic/result/client_certificate.pem tests/tls/certs/
123+
cp target/tls-gen/basic/result/client_key.pem tests/tls/certs/
124+
125+
- name: Create RabbitMQ TLS configuration
126+
run: |
127+
cat > tests/tls/certs/rabbitmq.conf << 'EOF'
128+
management.ssl.port = 15671
129+
management.ssl.cacertfile = /etc/rabbitmq/certs/ca_certificate.pem
130+
management.ssl.certfile = /etc/rabbitmq/certs/server_certificate.pem
131+
management.ssl.keyfile = /etc/rabbitmq/certs/server_key.pem
132+
management.tcp.port = 15672
133+
EOF
134+
135+
- name: Start RabbitMQ with TLS
136+
run: |
137+
docker run -d --name rabbitmq-tls \
138+
-p 15671:15671 \
139+
-p 15672:15672 \
140+
-p 5672:5672 \
141+
-v ${{ github.workspace }}/tests/tls/certs:/etc/rabbitmq/certs:ro \
142+
-v ${{ github.workspace }}/tests/tls/certs/rabbitmq.conf:/etc/rabbitmq/conf.d/20-tls.conf:ro \
143+
rabbitmq:${{ matrix.rabbitmq-series }}-management
144+
145+
- name: Wait for RabbitMQ to start
146+
run: |
147+
echo "Waiting for RabbitMQ to start..."
148+
for i in $(seq 1 30); do
149+
if docker exec rabbitmq-tls rabbitmqctl status > /dev/null 2>&1; then
150+
echo "RabbitMQ is ready"
151+
break
152+
fi
153+
echo "Waiting... ($i/30)"
154+
sleep 2
155+
done
156+
157+
- name: Verify TLS listener
158+
run: |
159+
docker exec rabbitmq-tls rabbitmq-diagnostics listeners
160+
echo "Checking if TLS port 15671 is listening..."
161+
docker exec rabbitmq-tls rabbitmq-diagnostics listeners | grep -E "15671|ssl" || echo "Note: TLS listener output"
162+
163+
- name: Configure broker
164+
run: |
165+
docker exec rabbitmq-tls rabbitmq-plugins enable rabbitmq_management
166+
sleep 3
167+
docker exec rabbitmq-tls rabbitmqctl add_vhost / || true
168+
docker exec rabbitmq-tls rabbitmqctl add_user guest guest || true
169+
docker exec rabbitmq-tls rabbitmqctl set_permissions -p / guest ".*" ".*" ".*"
170+
171+
- name: Run TLS tests
172+
run: |
173+
TLS_CERTS_DIR=${{ github.workspace }}/tests/tls/certs \
174+
RUST_BACKTRACE=1 \
175+
cargo nextest run -E 'binary(tls_tests)' --run-ignored=only --no-fail-fast
176+
177+
- name: Stop RabbitMQ container
178+
if: always()
179+
run: docker stop rabbitmq-tls && docker rm rabbitmq-tls || true

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@
44
profile.json
55
.tool-versions
66
*.proptest-regressions
7+
tests/tls/certs/*.pem
8+
tests/tls/certs/*.conf

‎Cargo.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bin/ci/before_build_tls.sh‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
#!/bin/sh
2+
3+
# TLS test setup script for CI
4+
# Generates certificates using tls-gen and configures RabbitMQ with TLS-enabled management API
5+
6+
set -e
7+
8+
CTL=${RUST_HTTP_API_CLIENT_RABBITMQCTL:="sudo rabbitmqctl"}
9+
PLUGINS=${RUST_HTTP_API_CLIENT_RABBITMQ_PLUGINS:="sudo rabbitmq-plugins"}
10+
11+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
12+
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
13+
CERTS_DIR="${REPO_ROOT}/tests/tls/certs"
14+
15+
# Docker container ID (passed via environment or extracted from CTL)
16+
CONTAINER_ID=""
17+
18+
case $CTL in
19+
DOCKER*)
20+
CONTAINER_ID="${CTL##*:}"
21+
PLUGINS="docker exec ${CONTAINER_ID} rabbitmq-plugins"
22+
CTL="docker exec ${CONTAINER_ID} rabbitmqctl"
23+
;;
24+
esac
25+
26+
echo "Will use rabbitmqctl at ${CTL}"
27+
echo "Will use rabbitmq-plugins at ${PLUGINS}"
28+
29+
# Create certs directory
30+
mkdir -p "${CERTS_DIR}"
31+
32+
# Check if tls-gen is available
33+
TLSGEN_DIR="${TLSGEN_DIR:-}"
34+
if [ -z "$TLSGEN_DIR" ]; then
35+
echo "TLSGEN_DIR not set, cloning tls-gen..."
36+
TLSGEN_DIR="${REPO_ROOT}/target/tls-gen"
37+
if [ ! -d "$TLSGEN_DIR" ]; then
38+
git clone --depth 1 https://github.com/rabbitmq/tls-gen.git "$TLSGEN_DIR"
39+
fi
40+
fi
41+
42+
echo "Using tls-gen at ${TLSGEN_DIR}"
43+
44+
# Generate certificates using basic profile
45+
cd "${TLSGEN_DIR}/basic"
46+
make CN=localhost
47+
make alias-leaf-artifacts
48+
49+
# Copy certificates to the test directory
50+
cp result/ca_certificate.pem "${CERTS_DIR}/"
51+
cp result/server_certificate.pem "${CERTS_DIR}/"
52+
cp result/server_key.pem "${CERTS_DIR}/"
53+
cp result/client_certificate.pem "${CERTS_DIR}/"
54+
cp result/client_key.pem "${CERTS_DIR}/"
55+
56+
echo "Certificates generated and copied to ${CERTS_DIR}"
57+
58+
# Create RabbitMQ configuration for TLS
59+
RABBITMQ_CONF="${CERTS_DIR}/rabbitmq.conf"
60+
cat > "${RABBITMQ_CONF}" << 'EOF'
61+
# Enable TLS on management plugin
62+
management.ssl.port = 15671
63+
management.ssl.cacertfile = /etc/rabbitmq/certs/ca_certificate.pem
64+
management.ssl.certfile = /etc/rabbitmq/certs/server_certificate.pem
65+
management.ssl.keyfile = /etc/rabbitmq/certs/server_key.pem
66+
67+
# Keep HTTP enabled for other tests
68+
management.tcp.port = 15672
69+
EOF
70+
71+
echo "RabbitMQ TLS configuration written to ${RABBITMQ_CONF}"
72+
73+
# If using Docker, copy certificates and configuration to container
74+
if [ -n "$CONTAINER_ID" ]; then
75+
echo "Copying certificates to Docker container ${CONTAINER_ID}..."
76+
77+
docker exec "${CONTAINER_ID}" mkdir -p /etc/rabbitmq/certs
78+
docker cp "${CERTS_DIR}/ca_certificate.pem" "${CONTAINER_ID}:/etc/rabbitmq/certs/"
79+
docker cp "${CERTS_DIR}/server_certificate.pem" "${CONTAINER_ID}:/etc/rabbitmq/certs/"
80+
docker cp "${CERTS_DIR}/server_key.pem" "${CONTAINER_ID}:/etc/rabbitmq/certs/"
81+
docker cp "${RABBITMQ_CONF}" "${CONTAINER_ID}:/etc/rabbitmq/conf.d/20-tls.conf"
82+
83+
# Set proper permissions
84+
docker exec "${CONTAINER_ID}" chmod 644 /etc/rabbitmq/certs/*.pem
85+
docker exec "${CONTAINER_ID}" chmod 600 /etc/rabbitmq/certs/server_key.pem
86+
87+
echo "Restarting RabbitMQ to apply TLS configuration..."
88+
docker exec "${CONTAINER_ID}" rabbitmqctl stop_app
89+
docker exec "${CONTAINER_ID}" rabbitmqctl start_app
90+
91+
sleep 5
92+
93+
# Verify TLS listener is active
94+
echo "Verifying TLS listener..."
95+
docker exec "${CONTAINER_ID}" rabbitmq-diagnostics listeners | grep -E "15671|ssl" || echo "Warning: TLS listener may not be active"
96+
fi
97+
98+
# Enable management plugin (should already be enabled in the management image)
99+
$PLUGINS enable rabbitmq_management
100+
101+
sleep 3
102+
103+
# Configure vhosts and users (same as before_build.sh)
104+
$CTL add_vhost /
105+
$CTL add_user guest guest || true
106+
$CTL set_permissions -p / guest ".*" ".*" ".*"
107+
108+
# Clean up test vhosts
109+
cd "${REPO_ROOT}"
110+
cargo -q run '--' vhosts delete_multiple --name-pattern "^rabbitmqadmin" --dry-run --table-style modern || true
111+
cargo -q run '--' --non-interactive vhosts delete_multiple --name-pattern "^rabbitmqadmin" || true
112+
113+
$CTL add_vhost "rust/rabbitmqadmin"
114+
$CTL set_permissions -p "rust/rabbitmqadmin" guest ".*" ".*" ".*"
115+
116+
# Set cluster name
117+
$CTL set_cluster_name rabbitmq@localhost
118+
119+
$CTL enable_feature_flag all
120+
121+
# Enable additional plugins
122+
$PLUGINS enable rabbitmq_shovel
123+
$PLUGINS enable rabbitmq_shovel_management
124+
$PLUGINS enable rabbitmq_federation
125+
$PLUGINS enable rabbitmq_federation_management
126+
$PLUGINS enable rabbitmq_stream
127+
$PLUGINS enable rabbitmq_stream_management
128+
129+
# Export certificate paths for tests
130+
echo ""
131+
echo "=== TLS Test Environment ==="
132+
echo "CA Certificate: ${CERTS_DIR}/ca_certificate.pem"
133+
echo "Client Certificate: ${CERTS_DIR}/client_certificate.pem"
134+
echo "Client Key: ${CERTS_DIR}/client_key.pem"
135+
echo "TLS Endpoint: https://localhost:15671/api"
136+
echo ""
137+
echo "To run TLS tests:"
138+
echo " TLS_CERTS_DIR=${CERTS_DIR} cargo nextest run -E 'binary(tls_tests)' --run-ignored=only"
139+
echo ""
140+
141+
true

‎tests/tls/.gitkeep‎

Whitespace-only changes.

0 commit comments

Comments
 (0)