Merge remote-tracking branch 'origin/fix' into fix

pingcap · Mar 13, 2018 · 304b4d3 · 304b4d3
2 parents f11f8e0 + 24651f7
commit 304b4d3
Show file tree

Hide file tree

Showing 9 changed files with 46 additions and 8 deletions.
diff --git a/dbms/src/Server/Server.cpp b/dbms/src/Server/Server.cpp
@@ -387,7 +387,7 @@ int Server::main(const std::vector<std::string> & /*args*/)
                     http_socket.setSendTimeout(settings.http_send_timeout);
 
                     servers.emplace_back(new Poco::Net::HTTPServer(
-                        new HTTPHandlerFactory(*this, "HTTPHandler-factory"),
+                        new HTTPHandlerFactory(*this, "HTTPSHandler-factory"),
                         server_pool,
                         http_socket,
                         http_params));
@@ -425,7 +425,7 @@ int Server::main(const std::vector<std::string> & /*args*/)
                     tcp_socket.setReceiveTimeout(settings.receive_timeout);
                     tcp_socket.setSendTimeout(settings.send_timeout);
                     servers.emplace_back(new Poco::Net::TCPServer(
-                        new TCPHandlerFactory(*this),
+                        new TCPHandlerFactory(*this, /* secure= */ true ),
                                                                   server_pool,
                                                                   tcp_socket,
                                                                   new Poco::Net::TCPServerParams));

diff --git a/dbms/src/Server/TCPHandlerFactory.h b/dbms/src/Server/TCPHandlerFactory.h
@@ -17,9 +17,9 @@ class TCPHandlerFactory : public Poco::Net::TCPServerConnectionFactory
     Poco::Logger * log;
 
 public:
-    explicit TCPHandlerFactory(IServer & server_)
+    explicit TCPHandlerFactory(IServer & server_, bool secure_ = false)
         : server(server_)
-        , log(&Logger::get("TCPHandlerFactory"))
+        , log(&Logger::get(std::string("TCP") + (secure_ ? "S" : "") + "HandlerFactory"))
     {
     }
 

diff --git a/dbms/tests/clickhouse-test-server b/dbms/tests/clickhouse-test-server
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+set -x
 set -o errexit
 set -o pipefail
 
@@ -22,23 +23,27 @@ export CLICKHOUSE_CONFIG=${CLICKHOUSE_CONFIG:=${CONFIG_SERVER_DIR}server-test.xm
 [ ! -d "$QUERIES_DIR" ] && QUERIES_DIR=${QUERIES_DIR=/usr/share/clickhouse-test/queries}
 
 rm -rf $DATA_DIR
-mkdir -p $LOG_DIR
+mkdir -p $LOG_DIR $DATA_DIR
 
+openssl dhparam -out `${BIN_DIR}clickhouse-extract-from-config --config=$CLICKHOUSE_CONFIG  --key=openSSL.server.dhParamsFile` 256
+openssl req -subj "/CN=localhost" -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout `${BIN_DIR}clickhouse-extract-from-config --config=$CLICKHOUSE_CONFIG  --key=openSSL.server.privateKeyFile` -out `${BIN_DIR}clickhouse-extract-from-config --config=$CLICKHOUSE_CONFIG  --key=openSSL.server.certificateFile`
 
 # Start a local clickhouse server which will be used to run tests
 #PATH=$PATH:$BIN_DIR \
 ${BIN_DIR}clickhouse-server --config-file=${CLICKHOUSE_CONFIG} > $LOG_DIR/stdout 2>&1 &
 CH_PID=$!
 sleep 3
 
+tail -n50 $LOG_DIR/*
+
 # Define needed stuff to kill test clickhouse server after tests completion
 function finish {
   kill $CH_PID || true
   wait
   tail -n 50 $LOG_DIR/stdout
   rm -rf $DATA_DIR
 }
-trap finish EXIT
+trap finish EXIT SIGINT SIGQUIT SIGTERM
 
 # Do tests
 if [ -n "$*" ]; then

diff --git a/dbms/tests/client-test.xml b/dbms/tests/client-test.xml
@@ -1,4 +1,5 @@
 <!-- Config for connecting to test server -->
 <yandex>
     <tcp_port>59000</tcp_port>
+    <tcp_ssl_port>59440</tcp_ssl_port>
 </yandex>
diff --git a/dbms/tests/queries/0_stateless/00505_tcp_ssl.reference b/dbms/tests/queries/0_stateless/00505_tcp_ssl.reference
@@ -1,2 +1,3 @@
 1
 2
+3
diff --git a/dbms/tests/queries/0_stateless/00505_tcp_ssl.sh b/dbms/tests/queries/0_stateless/00505_tcp_ssl.sh
@@ -13,4 +13,6 @@ else
     # Auto port detect
     ${CLICKHOUSE_CLIENT} --ssl -q "SELECT 1";
     ${CLICKHOUSE_CLIENT} --ssl --port=${CLICKHOUSE_PORT_TCP_SSL} -q "SELECT 2";
+
+    ${CLICKHOUSE_CURL} -sS --insecure ${CLICKHOUSE_URL_HTTPS}?query=SELECT%203
 fi
diff --git a/dbms/tests/queries/shell_config.sh b/dbms/tests/queries/shell_config.sh
@@ -18,6 +18,7 @@ export CLICKHOUSE_PORT_HTTPS=${CLICKHOUSE_PORT_HTTPS:=`${CLICKHOUSE_EXTRACT_CONF
 export CLICKHOUSE_PORT_HTTPS=${CLICKHOUSE_PORT_HTTPS:="8443"}
 export CLICKHOUSE_PORT_HTTP_PROTO=${CLICKHOUSE_PORT_HTTP_PROTO:="http"}
 export CLICKHOUSE_URL=${CLICKHOUSE_URL:="${CLICKHOUSE_PORT_HTTP_PROTO}://${CLICKHOUSE_HOST}:${CLICKHOUSE_PORT_HTTP}/"}
+export CLICKHOUSE_URL_HTTPS=${CLICKHOUSE_URL_HTTPS:="https://${CLICKHOUSE_HOST}:${CLICKHOUSE_PORT_HTTPS}/"}
 export CLICKHOUSE_CURL=${CLICKHOUSE_CURL:="curl --max-time 10"}
 export CLICKHOUSE_TMP=${CLICKHOUSE_TMP:="."}
 mkdir -p ${CLICKHOUSE_TMP}
diff --git a/dbms/tests/server-test.xml b/dbms/tests/server-test.xml
@@ -13,8 +13,36 @@
     <listen_try>1</listen_try>
     <http_port>58123</http_port>
     <tcp_port>59000</tcp_port>
-    <listen_host>0.0.0.0</listen_host>
+    <https_port>58443</https_port>
+    <tcp_ssl_port>59440</tcp_ssl_port>
     <interserver_http_port>59009</interserver_http_port>
+    <openSSL>
+        <server> <!-- Used for https server AND secure tcp port -->
+            <!-- openssl req -subj "/CN=localhost" -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/clickhouse-server/server.key -out /etc/clickhouse-server/server.crt -->
+            <certificateFile>/tmp/clickhouse/server.crt</certificateFile>
+            <privateKeyFile>/tmp/clickhouse/server.key</privateKeyFile>
+            <!-- openssl dhparam -out /etc/clickhouse-server/dhparam.pem 4096 -->
+            <dhParamsFile>/tmp/clickhouse/dhparam.pem</dhParamsFile>
+            <verificationMode>none</verificationMode>
+            <loadDefaultCAFile>true</loadDefaultCAFile>
+            <cacheSessions>true</cacheSessions>
+            <disableProtocols>sslv2,sslv3</disableProtocols>
+            <preferServerCiphers>true</preferServerCiphers>
+        </server>
+
+        <client> <!-- Used for connecting to https dictionary source -->
+            <loadDefaultCAFile>true</loadDefaultCAFile>
+            <cacheSessions>true</cacheSessions>
+            <disableProtocols>sslv2,sslv3</disableProtocols>
+            <preferServerCiphers>true</preferServerCiphers>
+            <!-- Use for self-signed: <verificationMode>none</verificationMode> -->
+            <invalidCertificateHandler>
+                <!-- Use for self-signed: <name>AcceptCertificateHandler</name> -->
+                <name>RejectCertificateHandler</name>
+            </invalidCertificateHandler>
+        </client>
+    </openSSL>
+
     <keep_alive_timeout>3</keep_alive_timeout>
     <path>/tmp/clickhouse/data/</path>
     <tmp_path>/tmp/clickhouse/tmp/</tmp_path>

diff --git a/debian/control b/debian/control
@@ -51,5 +51,5 @@ Description: debugging symbols for clickhouse-server-base
 Package: clickhouse-test
 Priority: extra
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, clickhouse-client, bash, expect, python, python-lxml, python-termcolor, curl, perl, sudo
+Depends: ${shlibs:Depends}, ${misc:Depends}, clickhouse-client, bash, expect, python, python-lxml, python-termcolor, curl, perl, sudo, openssl
 Description: Clickhouse tests