Add new TLS tests to DMM's system tests - #2208
ryanwixon-emerson wants to merge 28 commits into
Conversation
1345654 to
568fce9
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2208 +/- ##
==========================================
+ Coverage 88.09% 88.13% +0.04%
==========================================
Files 88 88
Lines 22756 22828 +72
==========================================
+ Hits 20047 20120 +73
+ Misses 2709 2708 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Flaky system tests seem to be timing out. It's a different one each time and are part of test suites that this PR does not touch, but everything related to my changes is consistently passing. I'm publishing this PR now to avoid delaying feedback longer. |
You don't need to commit an empty change to rerun a failed PR Check. |
This contribution adheres to CONTRIBUTING.md.
I've updated CHANGELOG.md if applicable.I've added tests applicable for this pull request
What does this Pull Request accomplish?
This PR upgrades the
TestGrpcsystem tests to use mTLS encryption options and adds new tests for testing additional encryption options. These changes are only for DMM at the moment, but once this PR is merged, they will be expanded to cover every driver supported bynimi-python.The gRPC tests in full include:
TestGrpcSecuredTLS- Runs the full suite of tests with mTLS encryption, configured viani-tls-config.TestGrpcUnsecuredTLS- Runs a small set of basic usability tests withni-tls-config's "Disabled" option.TestGrpcNoTLS- Runs a small set of basic usability tests with no dependency onni-tls-configat all (this is effectively what is running today)test_unsecured_server- A standalone test ensuring that a TLS-enabled client will notconnect to an unsecured server.test_unsercured_client- A standalone test ensuring that a TLS-enabled server will not allow an unsecured client to connect.In order to assist with the setup, a version of the
nitlsconfigtestis being used. This provides us with utilities to configure theni-tls-config.yml configuration files, and to provision certificates. This PR also includes two functions which wrap the Python scripts it provides and gives the tests an easy-to-use interface to interact with them.Also included is a patching function which resolves an issue with the 32-bit tests. Since they now rely on
nitlsconfig.exe(installed in System32), the 32-bit test processes do not have a way to invoke it without disabling WOW64 redirection. The patcher provides functionality to do just that, but exclusively fornitlsconfig.exeas to minimize the blast radius.List issues fixed by this Pull Request below, if any.
N/A - This PR does not address any issues
What testing has been done?
N/A - These are tests themselves. However, I did verify using Wireshark that the tests really are using TLS encryption with the expected configurations.