├── .dockerignore ├── .github └── workflows │ └── push.yml ├── .gitignore ├── Dockerfile ├── LICENSE ├── README.md ├── docker-compose.yml ├── dockerRemote ├── resources ├── create-certs.sh ├── entrypoint.sh └── nginx-cert.conf └── test ├── .dockerignore ├── .mvn └── wrapper │ ├── MavenWrapperDownloader.java │ ├── maven-wrapper.jar │ └── maven-wrapper.properties ├── Dockerfile ├── README.md ├── docker-compose.yml ├── mvnw ├── mvnw.cmd ├── pom.xml └── src └── test ├── java └── de │ └── kekru │ └── dockerremoteapitls │ └── test │ ├── BasicConnectionTest.java │ ├── CertGenerationTest.java │ ├── WrongCertTest.java │ └── utils │ ├── AbstractIntegrationTest.java │ ├── CertUtils.java │ └── ShellExecutor.java └── resources ├── simplelogger.properties ├── some-client-cert.pem └── some-client-key.pem /.dockerignore: -------------------------------------------------------------------------------- 1 | cert-data 2 | certs 3 | test 4 | certs-integr-test 5 | target 6 | -------------------------------------------------------------------------------- /.github/workflows/push.yml: -------------------------------------------------------------------------------- 1 | name: run-tests 2 | on: push 3 | jobs: 4 | test: 5 | runs-on: ubuntu-latest 6 | steps: 7 | - name: Checkout repository 8 | uses: actions/checkout@v3 9 | - name: Set up Docker Buildx 10 | uses: docker/setup-buildx-action@v2 11 | - name: Build 12 | env: 13 | COMPOSE_DOCKER_CLI_BUILD: 1 14 | DOCKER_BUILDKIT: 1 15 | COMPOSE_PROJECT_NAME: test 16 | run: cd test && mkdir -p target/integr-test && echo "" > target/integr-test/remote-api.env && docker compose build 17 | - name: Test 18 | env: 19 | COMPOSE_DOCKER_CLI_BUILD: 1 20 | DOCKER_BUILDKIT: 1 21 | COMPOSE_PROJECT_NAME: test 22 | run: cd test && docker compose run test 23 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | cert-data 2 | certs 3 | certs-integr-test 4 | temp 5 | tmp 6 | .vscode 7 | .idea 8 | .classpath 9 | .project 10 | test/target 11 | test/.settings 12 | *.iml 13 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | # Original Dockerfile: https://github.com/nginxinc/docker-nginx/blob/b0e153a1b644ca8b2bd378b14913fff316e07cf2/stable/alpine/Dockerfile 2 | FROM nginx:1.26.2-alpine 3 | LABEL MAINTAINER="Kevin Krummenauer " 4 | RUN apk add --no-cache openssl 5 | 6 | COPY resources/create-certs.sh /script/create-certs.sh 7 | COPY resources/nginx-cert.conf /etc/nginx/nginx.conf 8 | COPY resources/entrypoint.sh /docker-entrypoint.d/30_entrypoint.sh 9 | 10 | RUN chmod +x /script/create-certs.sh /docker-entrypoint.d/30_entrypoint.sh 11 | 12 | ENV CREATE_CERTS_WITH_PW="" \ 13 | CERTS_DIR=/data/certs \ 14 | CERT_HOSTNAME="abc.127.0.0.1.nip.io" \ 15 | CERT_EXPIRATION_DAYS="365" \ 16 | CA_EXPIRATION_DAYS="900" 17 | 18 | HEALTHCHECK --start-period=1s \ 19 | --interval=5s \ 20 | --timeout=5s \ 21 | --retries=12 \ 22 | CMD nc -vz 127.0.0.1 443 || exit 1 23 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2016 Kevin Krummenauer 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Docker Remote API with TLS client authentication via container 2 | 3 | This images makes you publish your Docker Remote API by a container. 4 | A client must authenticate with a client-TLS certificate. 5 | This is an alternative way, instead of [configuring TLS on Docker directly](https://gist.github.com/kekru/974e40bb1cd4b947a53cca5ba4b0bbe5). 6 | 7 | [![dockeri.co](https://dockerico.blankenship.io/image/kekru/docker-remote-api-tls)](https://hub.docker.com/r/kekru/docker-remote-api-tls) 8 | 9 | ## Remote Api with external CA, certificates and key 10 | 11 | First you need a CA and certs and keys for your Docker server and the client. 12 | 13 | Create them as shown here [Protect the Docker daemon socket](https://docs.docker.com/engine/security/https/). 14 | Or create the files with this script [create-certs.sh](https://github.com/kekru/linux-utils/blob/master/cert-generate/create-certs.sh). Read [Create certificate files](https://gist.github.com/kekru/974e40bb1cd4b947a53cca5ba4b0bbe5#create-certificate-files) for information on how to use the script. 15 | 16 | Copy the following files in a directory. The directory will me mounted in the container. 17 | 18 | ```bash 19 | ca-cert.pem 20 | server-cert.pem 21 | server-key.pem 22 | ``` 23 | 24 | The files `cert.pem` and `key.pem` are certificate and key for the client. The client will also need the `ca-cert.pem`. 25 | 26 | Create a docker-compose.yml file: 27 | 28 | ```yml 29 | version: "3.4" 30 | services: 31 | remote-api: 32 | image: kekru/docker-remote-api-tls:v0.5.0 33 | ports: 34 | - 2376:443 35 | volumes: 36 | - :/data/certs:ro 37 | - /var/run/docker.sock:/var/run/docker.sock:ro 38 | ``` 39 | 40 | Now run the container with `docker-compose up -d` or `docker stack deploy --compose-file=docker-compose.yml remoteapi`. 41 | Your Docker Remote API is available on port 2376 via https. The client needs to authenticate via `cert.pem` and `key.pem`. 42 | 43 | ## Remote Api with auto generating CA, certificates and keys 44 | 45 | The docker-remote-api image can generate CA, certificates and keys for you automatically. 46 | Create a docker-compose.yml file, specifying a password and the hostname, on which the remote api will be accessible later on. The hostname will be written to the server's certificate. 47 | 48 | ```yml 49 | version: "3.4" 50 | services: 51 | remote-api: 52 | image: kekru/docker-remote-api-tls:v0.5.0 53 | ports: 54 | - 2376:443 55 | environment: 56 | - CREATE_CERTS_WITH_PW=supersecret 57 | - CERT_HOSTNAME=remote-api.example.com 58 | volumes: 59 | - :/data/certs 60 | - /var/run/docker.sock:/var/run/docker.sock:ro 61 | ``` 62 | 63 | Now run the container with `docker-compose up -d` or `docker stack deploy --compose-file=docker-compose.yml remoteapi`. 64 | Certificates will be created in ``. 65 | You will find the client-certs in `/client/`. The files are `ca.pem`, `cert.pem` and `key.pem`. 66 | 67 | ## Environment variables 68 | 69 | #### `CREATE_CERTS_WITH_PW` 70 | Passphrase to encrypt the certificate. 71 | 72 | #### `CERTS_PASSWORD_FILE` 73 | Certificate passphrase will be read from this docker secret. Absolute path of the secret file has to be provided i.e. `CERTS_PASSWORD_FILE=/run/secrets/`. 74 | 75 | If both passphrase and secret file are set, the secret file takes precedence. 76 | 77 | #### `CERT_EXPIRATION_DAYS` 78 | Certificate expiration for server and client certs in days. If not set, the default value 365 is applied. 79 | 80 | #### `CA_EXPIRATION_DAYS` 81 | Certificate expiration for CA in days. If not set, the default value 900 is applied. 82 | 83 | #### `CERT_HOSTNAME` 84 | Domain name of the docker server. 85 | If you don't have a DNS name, you can use [nip.io](https://nip.io) to get a name for any IP. 86 | 87 | ## Setup client 88 | 89 | See [Run commands on remote Docker host](https://gist.github.com/kekru/4e6d49b4290a4eebc7b597c07eaf61f2) for instructions how to setup a client to communicate with the remote api. 90 | 91 | You can also reuse [dockerRemote](./dockerRemote) and set url and path in it to your correct values. 92 | Then just run `./dockerRemote ps` to call `ps` against your remote api. 93 | 94 | ## Quick test 95 | 96 | To test this repo quickly, clone this repo, then run 97 | 98 | ```bash 99 | # Start remote-api locally 100 | docker-compose up -d 101 | # Run ps over remote api (use GitBash when you are on Windows) 102 | ./dockerRemote ps 103 | ``` 104 | 105 | ## Changelog 106 | 107 | #### v0.2.0 108 | 109 | First stable release 110 | Thanks [@smiller171](https://github.com/smiller171) for contributing! 111 | 112 | #### v0.3.0 113 | 114 | + update nginx version 115 | + add configuration for cert expiration 116 | + add configuration to use swarm secret as password for cert generation 117 | + add automatic tests 118 | 119 | Thanks [@benkorichard](https://github.com/benkorichard) for contributing! 120 | 121 | #### v0.4.0 122 | 123 | + update nginx version to 1.20.2 124 | 125 | #### v0.5.0 126 | 127 | + update nginx version to 1.26.2 128 | -------------------------------------------------------------------------------- /docker-compose.yml: -------------------------------------------------------------------------------- 1 | x-sharedConfig: &sharedConfig 2 | logging: 3 | driver: "json-file" 4 | options: 5 | max-size: "500k" 6 | max-file: "10" 7 | 8 | x-sharedDeployConfig: &sharedDeployConfig 9 | resources: 10 | limits: 11 | cpus: '0.5' 12 | memory: 150M 13 | reservations: 14 | cpus: '0.1' 15 | memory: 10M 16 | 17 | services: 18 | remote-api: 19 | <<: *sharedConfig 20 | pull_policy: build 21 | build: . 22 | ports: 23 | - 8443:443 24 | environment: 25 | - CREATE_CERTS_WITH_PW=supersecret 26 | - CERT_HOSTNAME=abc.127.0.0.1.nip.io 27 | volumes: 28 | - ./certs:/data/certs 29 | - /var/run/docker.sock:/var/run/docker.sock:ro 30 | deploy: 31 | <<: *sharedDeployConfig 32 | placement: 33 | constraints: 34 | - node.role == manager 35 | -------------------------------------------------------------------------------- /dockerRemote: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | export DOCKER_HOST=abc.127.0.0.1.nip.io:8443 4 | export DOCKER_TLS_VERIFY=1 5 | export DOCKER_CERT_PATH=$(pwd)/certs/client 6 | 7 | exec docker "$@" 8 | -------------------------------------------------------------------------------- /resources/create-certs.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | #see https://docs.docker.com/engine/security/https/ 3 | set -e 4 | 5 | if [ "$DEBUG" = "true" ]; then 6 | set -x 7 | fi 8 | 9 | EXPIRATIONDAYS=700 10 | CASUBJSTRING="/C=GB/ST=London/L=London/O=ExampleCompany/OU=IT/CN=example.com/emailAddress=test@example.com" 11 | 12 | while [[ $# -gt 1 ]] 13 | do 14 | key="$1" 15 | 16 | case $key in 17 | -m|--mode) 18 | MODE="$2" 19 | shift 20 | ;; 21 | -h|--hostname) 22 | NAME="$2" 23 | shift 24 | ;; 25 | -hip|--hostip) 26 | SERVERIP="$2" 27 | shift 28 | ;; 29 | -pw|--password) 30 | PASSWORD="$2" 31 | shift 32 | ;; 33 | -t|--targetdir) 34 | TARGETDIR="$2" 35 | shift 36 | ;; 37 | -e|--expirationdays) 38 | EXPIRATIONDAYS="$2" 39 | shift 40 | ;; 41 | --ca-subj) 42 | CASUBJSTRING="$2" 43 | shift 44 | ;; 45 | *) 46 | # unknown option 47 | ;; 48 | esac 49 | shift 50 | done 51 | 52 | echo "Mode $MODE" 53 | echo "Host/Clientname $NAME" 54 | echo "Host IP $SERVERIP" 55 | echo "Targetdir $TARGETDIR" 56 | echo "Expiration $EXPIRATIONDAYS" 57 | 58 | programname=$0 59 | 60 | function usage { 61 | echo "usage: $programname -m ca -h example.de [-hip 1.2.3.4] -pw my-secret -t /target/dir [-e 365]" 62 | echo " -m|--mode 'ca' to create CA, 'server' to create server cert, 'client' to create client cert" 63 | echo " -h|--hostname|-n|--name DNS hostname for the server or name of client" 64 | echo " -hip|--hostip host's IP - default: none" 65 | echo " -pw|--password Password for CA Key generation" 66 | echo " -t|--targetdir Targetdir for certfiles and keys" 67 | echo " -e|--expirationdays certificate expiration in day - default: 700 days" 68 | echo " --ca-subj subj string for ca cert - default: Example String..." 69 | exit 1 70 | } 71 | 72 | function createCA { 73 | openssl genrsa -aes256 -passout pass:$PASSWORD -out $TARGETDIR/ca-key.pem 4096 74 | openssl req -passin pass:$PASSWORD -new -x509 -days $EXPIRATIONDAYS -key $TARGETDIR/ca-key.pem -sha256 -out $TARGETDIR/ca.pem -subj $CASUBJSTRING 75 | 76 | chmod 0400 $TARGETDIR/ca-key.pem 77 | chmod 0444 $TARGETDIR/ca.pem 78 | } 79 | 80 | function checkCAFilesExist { 81 | if [[ ! -f "$TARGETDIR/ca.pem" || ! -f "$TARGETDIR/ca-key.pem" ]]; then 82 | echo "$TARGETDIR/ca.pem or $TARGETDIR/ca-key.pem not found. Create CA first with '-m ca'" 83 | exit 1 84 | fi 85 | } 86 | 87 | function createServerCert { 88 | checkCAFilesExist 89 | 90 | if [[ -z $SERVERIP ]]; then 91 | IPSTRING="" 92 | else 93 | IPSTRING=",IP:$SERVERIP" 94 | fi 95 | 96 | openssl genrsa -out $TARGETDIR/server-key.pem 4096 97 | openssl req -subj "/CN=$NAME" -new -key $TARGETDIR/server-key.pem -out $TARGETDIR/server.csr 98 | echo "subjectAltName = DNS:$NAME$IPSTRING" > $TARGETDIR/extfile.cnf 99 | openssl x509 -passin pass:$PASSWORD -req -days $EXPIRATIONDAYS -in $TARGETDIR/server.csr -CA $TARGETDIR/ca.pem -CAkey $TARGETDIR/ca-key.pem -CAcreateserial -out $TARGETDIR/server-cert.pem -extfile $TARGETDIR/extfile.cnf 100 | 101 | rm $TARGETDIR/server.csr $TARGETDIR/extfile.cnf $TARGETDIR/ca.srl 102 | chmod 0400 $TARGETDIR/server-key.pem 103 | chmod 0444 $TARGETDIR/server-cert.pem 104 | } 105 | 106 | function createClientCert { 107 | checkCAFilesExist 108 | 109 | openssl genrsa -out $TARGETDIR/client-key.pem 4096 110 | openssl req -subj "/CN=$NAME" -new -key $TARGETDIR/client-key.pem -out $TARGETDIR/client.csr 111 | echo "extendedKeyUsage = clientAuth" > $TARGETDIR/extfile.cnf 112 | openssl x509 -passin pass:$PASSWORD -req -days $EXPIRATIONDAYS -in $TARGETDIR/client.csr -CA $TARGETDIR/ca.pem -CAkey $TARGETDIR/ca-key.pem -CAcreateserial -out $TARGETDIR/client-cert.pem -extfile $TARGETDIR/extfile.cnf 113 | 114 | rm $TARGETDIR/client.csr $TARGETDIR/extfile.cnf $TARGETDIR/ca.srl 115 | chmod 0400 $TARGETDIR/client-key.pem 116 | chmod 0444 $TARGETDIR/client-cert.pem 117 | 118 | mv $TARGETDIR/client-key.pem $TARGETDIR/client-$NAME-key.pem 119 | mv $TARGETDIR/client-cert.pem $TARGETDIR/client-$NAME-cert.pem 120 | } 121 | 122 | 123 | if [[ -z $MODE || -z $PASSWORD || -z $TARGETDIR ]]; then 124 | usage 125 | fi 126 | 127 | mkdir -p $TARGETDIR 128 | 129 | if [[ $MODE = "ca" ]]; then 130 | createCA 131 | elif [[ $MODE = "server" ]]; then 132 | createServerCert 133 | elif [[ $MODE = "client" ]]; then 134 | createClientCert 135 | else 136 | usage 137 | fi -------------------------------------------------------------------------------- /resources/entrypoint.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | set -e 3 | 4 | if [ "$DEBUG" = "true" ]; then 5 | set -x 6 | fi 7 | 8 | if [ -n "$CERTS_PASSWORD_FILE" ]; then 9 | echo "Using cert password from $CERTS_PASSWORD_FILE" 10 | CREATE_CERTS_WITH_PW="$(cat $CERTS_PASSWORD_FILE)" 11 | fi 12 | 13 | if [ -n "$CREATE_CERTS_WITH_PW" ]; then 14 | if [ -z "$(ls -A $CERTS_DIR)" ]; then 15 | 16 | echo "Create CA cert" 17 | /script/create-certs.sh -m ca -pw $CREATE_CERTS_WITH_PW -t $CERTS_DIR -e $CA_EXPIRATION_DAYS 18 | echo "Create server cert" 19 | /script/create-certs.sh -m server -h $CERT_HOSTNAME -pw $CREATE_CERTS_WITH_PW -t $CERTS_DIR -e $CERT_EXPIRATION_DAYS 20 | echo "Create client cert" 21 | /script/create-certs.sh -m client -h testClient -pw $CREATE_CERTS_WITH_PW -t $CERTS_DIR -e $CERT_EXPIRATION_DAYS 22 | 23 | mkdir $CERTS_DIR/client 24 | mv $CERTS_DIR/ca.pem $CERTS_DIR/ca-cert.pem 25 | cp $CERTS_DIR/ca-cert.pem $CERTS_DIR/client/ca.pem 26 | mv $CERTS_DIR/client-testClient-cert.pem $CERTS_DIR/client/cert.pem 27 | mv $CERTS_DIR/client-testClient-key.pem $CERTS_DIR/client/key.pem 28 | chmod 444 $CERTS_DIR/client/key.pem 29 | 30 | else 31 | 32 | echo "$CERTS_DIR is not empty. Not creating certs." 33 | fi 34 | 35 | else 36 | echo "CREATE_CERTS_WITH_PW is not set. Not creating certs." 37 | fi 38 | -------------------------------------------------------------------------------- /resources/nginx-cert.conf: -------------------------------------------------------------------------------- 1 | user root; 2 | worker_processes 1; 3 | 4 | error_log /var/log/nginx/error.log warn; 5 | pid /var/run/nginx.pid; 6 | 7 | 8 | events { 9 | worker_connections 1024; 10 | } 11 | 12 | 13 | stream { 14 | server { 15 | listen 443 ssl; 16 | 17 | ssl_certificate /data/certs/server-cert.pem; 18 | ssl_certificate_key /data/certs/server-key.pem; 19 | ssl_client_certificate /data/certs/ca-cert.pem; 20 | ssl_verify_client on; 21 | 22 | proxy_pass unix:/var/run/docker.sock; 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /test/.dockerignore: -------------------------------------------------------------------------------- 1 | cert-data 2 | certs 3 | test 4 | certs-integr-test 5 | target 6 | -------------------------------------------------------------------------------- /test/.mvn/wrapper/MavenWrapperDownloader.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2007-present the original author or authors. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, software 11 | * distributed under the License is distributed on an "AS IS" BASIS, 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | * See the License for the specific language governing permissions and 14 | * limitations under the License. 15 | */ 16 | import java.net.*; 17 | import java.io.*; 18 | import java.nio.channels.*; 19 | import java.util.Properties; 20 | 21 | public class MavenWrapperDownloader { 22 | 23 | private static final String WRAPPER_VERSION = "0.5.6"; 24 | /** 25 | * Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided. 26 | */ 27 | private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/" 28 | + WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar"; 29 | 30 | /** 31 | * Path to the maven-wrapper.properties file, which might contain a downloadUrl property to 32 | * use instead of the default one. 33 | */ 34 | private static final String MAVEN_WRAPPER_PROPERTIES_PATH = 35 | ".mvn/wrapper/maven-wrapper.properties"; 36 | 37 | /** 38 | * Path where the maven-wrapper.jar will be saved to. 39 | */ 40 | private static final String MAVEN_WRAPPER_JAR_PATH = 41 | ".mvn/wrapper/maven-wrapper.jar"; 42 | 43 | /** 44 | * Name of the property which should be used to override the default download url for the wrapper. 45 | */ 46 | private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl"; 47 | 48 | public static void main(String args[]) { 49 | System.out.println("- Downloader started"); 50 | File baseDirectory = new File(args[0]); 51 | System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath()); 52 | 53 | // If the maven-wrapper.properties exists, read it and check if it contains a custom 54 | // wrapperUrl parameter. 55 | File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH); 56 | String url = DEFAULT_DOWNLOAD_URL; 57 | if(mavenWrapperPropertyFile.exists()) { 58 | FileInputStream mavenWrapperPropertyFileInputStream = null; 59 | try { 60 | mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile); 61 | Properties mavenWrapperProperties = new Properties(); 62 | mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream); 63 | url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url); 64 | } catch (IOException e) { 65 | System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'"); 66 | } finally { 67 | try { 68 | if(mavenWrapperPropertyFileInputStream != null) { 69 | mavenWrapperPropertyFileInputStream.close(); 70 | } 71 | } catch (IOException e) { 72 | // Ignore ... 73 | } 74 | } 75 | } 76 | System.out.println("- Downloading from: " + url); 77 | 78 | File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH); 79 | if(!outputFile.getParentFile().exists()) { 80 | if(!outputFile.getParentFile().mkdirs()) { 81 | System.out.println( 82 | "- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'"); 83 | } 84 | } 85 | System.out.println("- Downloading to: " + outputFile.getAbsolutePath()); 86 | try { 87 | downloadFileFromURL(url, outputFile); 88 | System.out.println("Done"); 89 | System.exit(0); 90 | } catch (Throwable e) { 91 | System.out.println("- Error downloading"); 92 | e.printStackTrace(); 93 | System.exit(1); 94 | } 95 | } 96 | 97 | private static void downloadFileFromURL(String urlString, File destination) throws Exception { 98 | if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) { 99 | String username = System.getenv("MVNW_USERNAME"); 100 | char[] password = System.getenv("MVNW_PASSWORD").toCharArray(); 101 | Authenticator.setDefault(new Authenticator() { 102 | @Override 103 | protected PasswordAuthentication getPasswordAuthentication() { 104 | return new PasswordAuthentication(username, password); 105 | } 106 | }); 107 | } 108 | URL website = new URL(urlString); 109 | ReadableByteChannel rbc; 110 | rbc = Channels.newChannel(website.openStream()); 111 | FileOutputStream fos = new FileOutputStream(destination); 112 | fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE); 113 | fos.close(); 114 | rbc.close(); 115 | } 116 | 117 | } 118 | -------------------------------------------------------------------------------- /test/.mvn/wrapper/maven-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kekru/docker-remote-api-tls/7b28ee71a413c85ad068395c8f414f4199cb2575/test/.mvn/wrapper/maven-wrapper.jar -------------------------------------------------------------------------------- /test/.mvn/wrapper/maven-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip 2 | wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar 3 | -------------------------------------------------------------------------------- /test/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM docker:27.3.1-cli as docker 2 | FROM maven:3.6.3-openjdk-8-slim 3 | 4 | COPY --from=docker --chmod=555 /usr/local/bin/docker /usr/local/bin/docker 5 | COPY --from=docker --chmod=555 /usr/local/libexec/docker/cli-plugins/ /root/.docker/cli-plugins 6 | 7 | WORKDIR /build 8 | COPY pom.xml . 9 | RUN mvn dependency:go-offline 10 | COPY . . 11 | 12 | CMD mvn test 13 | -------------------------------------------------------------------------------- /test/README.md: -------------------------------------------------------------------------------- 1 | # Tests 2 | 3 | Test are written in JUnit and Maven 4 | 5 | Run with Maven: 6 | 7 | ```bash 8 | ./mvnw test 9 | ``` 10 | 11 | Run with Docker-Compose 12 | 13 | ```bash 14 | docker-compose build && docker-compose run test 15 | ``` 16 | -------------------------------------------------------------------------------- /test/docker-compose.yml: -------------------------------------------------------------------------------- 1 | services: 2 | remote-api: 3 | build: .. 4 | image: kekru/docker-remote-api-tls:temp-for-unittests 5 | ports: 6 | - 30129:443 7 | env_file: 8 | - ./target/integr-test/remote-api.env 9 | volumes: 10 | - "/var/run/docker.sock:/var/run/docker.sock:ro" 11 | 12 | test: 13 | pull_policy: build 14 | build: . 15 | volumes: 16 | - "/var/run/docker.sock:/var/run/docker.sock:ro" 17 | network_mode: "host" 18 | -------------------------------------------------------------------------------- /test/mvnw: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # ---------------------------------------------------------------------------- 3 | # Licensed to the Apache Software Foundation (ASF) under one 4 | # or more contributor license agreements. See the NOTICE file 5 | # distributed with this work for additional information 6 | # regarding copyright ownership. The ASF licenses this file 7 | # to you under the Apache License, Version 2.0 (the 8 | # "License"); you may not use this file except in compliance 9 | # with the License. You may obtain a copy of the License at 10 | # 11 | # http://www.apache.org/licenses/LICENSE-2.0 12 | # 13 | # Unless required by applicable law or agreed to in writing, 14 | # software distributed under the License is distributed on an 15 | # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 16 | # KIND, either express or implied. See the License for the 17 | # specific language governing permissions and limitations 18 | # under the License. 19 | # ---------------------------------------------------------------------------- 20 | 21 | # ---------------------------------------------------------------------------- 22 | # Maven Start Up Batch script 23 | # 24 | # Required ENV vars: 25 | # ------------------ 26 | # JAVA_HOME - location of a JDK home dir 27 | # 28 | # Optional ENV vars 29 | # ----------------- 30 | # M2_HOME - location of maven2's installed home dir 31 | # MAVEN_OPTS - parameters passed to the Java VM when running Maven 32 | # e.g. to debug Maven itself, use 33 | # set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 34 | # MAVEN_SKIP_RC - flag to disable loading of mavenrc files 35 | # ---------------------------------------------------------------------------- 36 | 37 | if [ -z "$MAVEN_SKIP_RC" ] ; then 38 | 39 | if [ -f /etc/mavenrc ] ; then 40 | . /etc/mavenrc 41 | fi 42 | 43 | if [ -f "$HOME/.mavenrc" ] ; then 44 | . "$HOME/.mavenrc" 45 | fi 46 | 47 | fi 48 | 49 | # OS specific support. $var _must_ be set to either true or false. 50 | cygwin=false; 51 | darwin=false; 52 | mingw=false 53 | case "`uname`" in 54 | CYGWIN*) cygwin=true ;; 55 | MINGW*) mingw=true;; 56 | Darwin*) darwin=true 57 | # Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home 58 | # See https://developer.apple.com/library/mac/qa/qa1170/_index.html 59 | if [ -z "$JAVA_HOME" ]; then 60 | if [ -x "/usr/libexec/java_home" ]; then 61 | export JAVA_HOME="`/usr/libexec/java_home`" 62 | else 63 | export JAVA_HOME="/Library/Java/Home" 64 | fi 65 | fi 66 | ;; 67 | esac 68 | 69 | if [ -z "$JAVA_HOME" ] ; then 70 | if [ -r /etc/gentoo-release ] ; then 71 | JAVA_HOME=`java-config --jre-home` 72 | fi 73 | fi 74 | 75 | if [ -z "$M2_HOME" ] ; then 76 | ## resolve links - $0 may be a link to maven's home 77 | PRG="$0" 78 | 79 | # need this for relative symlinks 80 | while [ -h "$PRG" ] ; do 81 | ls=`ls -ld "$PRG"` 82 | link=`expr "$ls" : '.*-> \(.*\)$'` 83 | if expr "$link" : '/.*' > /dev/null; then 84 | PRG="$link" 85 | else 86 | PRG="`dirname "$PRG"`/$link" 87 | fi 88 | done 89 | 90 | saveddir=`pwd` 91 | 92 | M2_HOME=`dirname "$PRG"`/.. 93 | 94 | # make it fully qualified 95 | M2_HOME=`cd "$M2_HOME" && pwd` 96 | 97 | cd "$saveddir" 98 | # echo Using m2 at $M2_HOME 99 | fi 100 | 101 | # For Cygwin, ensure paths are in UNIX format before anything is touched 102 | if $cygwin ; then 103 | [ -n "$M2_HOME" ] && 104 | M2_HOME=`cygpath --unix "$M2_HOME"` 105 | [ -n "$JAVA_HOME" ] && 106 | JAVA_HOME=`cygpath --unix "$JAVA_HOME"` 107 | [ -n "$CLASSPATH" ] && 108 | CLASSPATH=`cygpath --path --unix "$CLASSPATH"` 109 | fi 110 | 111 | # For Mingw, ensure paths are in UNIX format before anything is touched 112 | if $mingw ; then 113 | [ -n "$M2_HOME" ] && 114 | M2_HOME="`(cd "$M2_HOME"; pwd)`" 115 | [ -n "$JAVA_HOME" ] && 116 | JAVA_HOME="`(cd "$JAVA_HOME"; pwd)`" 117 | fi 118 | 119 | if [ -z "$JAVA_HOME" ]; then 120 | javaExecutable="`which javac`" 121 | if [ -n "$javaExecutable" ] && ! [ "`expr \"$javaExecutable\" : '\([^ ]*\)'`" = "no" ]; then 122 | # readlink(1) is not available as standard on Solaris 10. 123 | readLink=`which readlink` 124 | if [ ! `expr "$readLink" : '\([^ ]*\)'` = "no" ]; then 125 | if $darwin ; then 126 | javaHome="`dirname \"$javaExecutable\"`" 127 | javaExecutable="`cd \"$javaHome\" && pwd -P`/javac" 128 | else 129 | javaExecutable="`readlink -f \"$javaExecutable\"`" 130 | fi 131 | javaHome="`dirname \"$javaExecutable\"`" 132 | javaHome=`expr "$javaHome" : '\(.*\)/bin'` 133 | JAVA_HOME="$javaHome" 134 | export JAVA_HOME 135 | fi 136 | fi 137 | fi 138 | 139 | if [ -z "$JAVACMD" ] ; then 140 | if [ -n "$JAVA_HOME" ] ; then 141 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 142 | # IBM's JDK on AIX uses strange locations for the executables 143 | JAVACMD="$JAVA_HOME/jre/sh/java" 144 | else 145 | JAVACMD="$JAVA_HOME/bin/java" 146 | fi 147 | else 148 | JAVACMD="`which java`" 149 | fi 150 | fi 151 | 152 | if [ ! -x "$JAVACMD" ] ; then 153 | echo "Error: JAVA_HOME is not defined correctly." >&2 154 | echo " We cannot execute $JAVACMD" >&2 155 | exit 1 156 | fi 157 | 158 | if [ -z "$JAVA_HOME" ] ; then 159 | echo "Warning: JAVA_HOME environment variable is not set." 160 | fi 161 | 162 | CLASSWORLDS_LAUNCHER=org.codehaus.plexus.classworlds.launcher.Launcher 163 | 164 | # traverses directory structure from process work directory to filesystem root 165 | # first directory with .mvn subdirectory is considered project base directory 166 | find_maven_basedir() { 167 | 168 | if [ -z "$1" ] 169 | then 170 | echo "Path not specified to find_maven_basedir" 171 | return 1 172 | fi 173 | 174 | basedir="$1" 175 | wdir="$1" 176 | while [ "$wdir" != '/' ] ; do 177 | if [ -d "$wdir"/.mvn ] ; then 178 | basedir=$wdir 179 | break 180 | fi 181 | # workaround for JBEAP-8937 (on Solaris 10/Sparc) 182 | if [ -d "${wdir}" ]; then 183 | wdir=`cd "$wdir/.."; pwd` 184 | fi 185 | # end of workaround 186 | done 187 | echo "${basedir}" 188 | } 189 | 190 | # concatenates all lines of a file 191 | concat_lines() { 192 | if [ -f "$1" ]; then 193 | echo "$(tr -s '\n' ' ' < "$1")" 194 | fi 195 | } 196 | 197 | BASE_DIR=`find_maven_basedir "$(pwd)"` 198 | if [ -z "$BASE_DIR" ]; then 199 | exit 1; 200 | fi 201 | 202 | ########################################################################################## 203 | # Extension to allow automatically downloading the maven-wrapper.jar from Maven-central 204 | # This allows using the maven wrapper in projects that prohibit checking in binary data. 205 | ########################################################################################## 206 | if [ -r "$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" ]; then 207 | if [ "$MVNW_VERBOSE" = true ]; then 208 | echo "Found .mvn/wrapper/maven-wrapper.jar" 209 | fi 210 | else 211 | if [ "$MVNW_VERBOSE" = true ]; then 212 | echo "Couldn't find .mvn/wrapper/maven-wrapper.jar, downloading it ..." 213 | fi 214 | if [ -n "$MVNW_REPOURL" ]; then 215 | jarUrl="$MVNW_REPOURL/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 216 | else 217 | jarUrl="https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 218 | fi 219 | while IFS="=" read key value; do 220 | case "$key" in (wrapperUrl) jarUrl="$value"; break ;; 221 | esac 222 | done < "$BASE_DIR/.mvn/wrapper/maven-wrapper.properties" 223 | if [ "$MVNW_VERBOSE" = true ]; then 224 | echo "Downloading from: $jarUrl" 225 | fi 226 | wrapperJarPath="$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" 227 | if $cygwin; then 228 | wrapperJarPath=`cygpath --path --windows "$wrapperJarPath"` 229 | fi 230 | 231 | if command -v wget > /dev/null; then 232 | if [ "$MVNW_VERBOSE" = true ]; then 233 | echo "Found wget ... using wget" 234 | fi 235 | if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then 236 | wget "$jarUrl" -O "$wrapperJarPath" 237 | else 238 | wget --http-user=$MVNW_USERNAME --http-password=$MVNW_PASSWORD "$jarUrl" -O "$wrapperJarPath" 239 | fi 240 | elif command -v curl > /dev/null; then 241 | if [ "$MVNW_VERBOSE" = true ]; then 242 | echo "Found curl ... using curl" 243 | fi 244 | if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then 245 | curl -o "$wrapperJarPath" "$jarUrl" -f 246 | else 247 | curl --user $MVNW_USERNAME:$MVNW_PASSWORD -o "$wrapperJarPath" "$jarUrl" -f 248 | fi 249 | 250 | else 251 | if [ "$MVNW_VERBOSE" = true ]; then 252 | echo "Falling back to using Java to download" 253 | fi 254 | javaClass="$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.java" 255 | # For Cygwin, switch paths to Windows format before running javac 256 | if $cygwin; then 257 | javaClass=`cygpath --path --windows "$javaClass"` 258 | fi 259 | if [ -e "$javaClass" ]; then 260 | if [ ! -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then 261 | if [ "$MVNW_VERBOSE" = true ]; then 262 | echo " - Compiling MavenWrapperDownloader.java ..." 263 | fi 264 | # Compiling the Java class 265 | ("$JAVA_HOME/bin/javac" "$javaClass") 266 | fi 267 | if [ -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then 268 | # Running the downloader 269 | if [ "$MVNW_VERBOSE" = true ]; then 270 | echo " - Running MavenWrapperDownloader.java ..." 271 | fi 272 | ("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$MAVEN_PROJECTBASEDIR") 273 | fi 274 | fi 275 | fi 276 | fi 277 | ########################################################################################## 278 | # End of extension 279 | ########################################################################################## 280 | 281 | export MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"} 282 | if [ "$MVNW_VERBOSE" = true ]; then 283 | echo $MAVEN_PROJECTBASEDIR 284 | fi 285 | MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS" 286 | 287 | # For Cygwin, switch paths to Windows format before running java 288 | if $cygwin; then 289 | [ -n "$M2_HOME" ] && 290 | M2_HOME=`cygpath --path --windows "$M2_HOME"` 291 | [ -n "$JAVA_HOME" ] && 292 | JAVA_HOME=`cygpath --path --windows "$JAVA_HOME"` 293 | [ -n "$CLASSPATH" ] && 294 | CLASSPATH=`cygpath --path --windows "$CLASSPATH"` 295 | [ -n "$MAVEN_PROJECTBASEDIR" ] && 296 | MAVEN_PROJECTBASEDIR=`cygpath --path --windows "$MAVEN_PROJECTBASEDIR"` 297 | fi 298 | 299 | # Provide a "standardized" way to retrieve the CLI args that will 300 | # work with both Windows and non-Windows executions. 301 | MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $@" 302 | export MAVEN_CMD_LINE_ARGS 303 | 304 | WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain 305 | 306 | exec "$JAVACMD" \ 307 | $MAVEN_OPTS \ 308 | -classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \ 309 | "-Dmaven.home=${M2_HOME}" "-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \ 310 | ${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@" 311 | -------------------------------------------------------------------------------- /test/mvnw.cmd: -------------------------------------------------------------------------------- 1 | @REM ---------------------------------------------------------------------------- 2 | @REM Licensed to the Apache Software Foundation (ASF) under one 3 | @REM or more contributor license agreements. See the NOTICE file 4 | @REM distributed with this work for additional information 5 | @REM regarding copyright ownership. The ASF licenses this file 6 | @REM to you under the Apache License, Version 2.0 (the 7 | @REM "License"); you may not use this file except in compliance 8 | @REM with the License. You may obtain a copy of the License at 9 | @REM 10 | @REM http://www.apache.org/licenses/LICENSE-2.0 11 | @REM 12 | @REM Unless required by applicable law or agreed to in writing, 13 | @REM software distributed under the License is distributed on an 14 | @REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 15 | @REM KIND, either express or implied. See the License for the 16 | @REM specific language governing permissions and limitations 17 | @REM under the License. 18 | @REM ---------------------------------------------------------------------------- 19 | 20 | @REM ---------------------------------------------------------------------------- 21 | @REM Maven Start Up Batch script 22 | @REM 23 | @REM Required ENV vars: 24 | @REM JAVA_HOME - location of a JDK home dir 25 | @REM 26 | @REM Optional ENV vars 27 | @REM M2_HOME - location of maven2's installed home dir 28 | @REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands 29 | @REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending 30 | @REM MAVEN_OPTS - parameters passed to the Java VM when running Maven 31 | @REM e.g. to debug Maven itself, use 32 | @REM set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 33 | @REM MAVEN_SKIP_RC - flag to disable loading of mavenrc files 34 | @REM ---------------------------------------------------------------------------- 35 | 36 | @REM Begin all REM lines with '@' in case MAVEN_BATCH_ECHO is 'on' 37 | @echo off 38 | @REM set title of command window 39 | title %0 40 | @REM enable echoing by setting MAVEN_BATCH_ECHO to 'on' 41 | @if "%MAVEN_BATCH_ECHO%" == "on" echo %MAVEN_BATCH_ECHO% 42 | 43 | @REM set %HOME% to equivalent of $HOME 44 | if "%HOME%" == "" (set "HOME=%HOMEDRIVE%%HOMEPATH%") 45 | 46 | @REM Execute a user defined script before this one 47 | if not "%MAVEN_SKIP_RC%" == "" goto skipRcPre 48 | @REM check for pre script, once with legacy .bat ending and once with .cmd ending 49 | if exist "%HOME%\mavenrc_pre.bat" call "%HOME%\mavenrc_pre.bat" 50 | if exist "%HOME%\mavenrc_pre.cmd" call "%HOME%\mavenrc_pre.cmd" 51 | :skipRcPre 52 | 53 | @setlocal 54 | 55 | set ERROR_CODE=0 56 | 57 | @REM To isolate internal variables from possible post scripts, we use another setlocal 58 | @setlocal 59 | 60 | @REM ==== START VALIDATION ==== 61 | if not "%JAVA_HOME%" == "" goto OkJHome 62 | 63 | echo. 64 | echo Error: JAVA_HOME not found in your environment. >&2 65 | echo Please set the JAVA_HOME variable in your environment to match the >&2 66 | echo location of your Java installation. >&2 67 | echo. 68 | goto error 69 | 70 | :OkJHome 71 | if exist "%JAVA_HOME%\bin\java.exe" goto init 72 | 73 | echo. 74 | echo Error: JAVA_HOME is set to an invalid directory. >&2 75 | echo JAVA_HOME = "%JAVA_HOME%" >&2 76 | echo Please set the JAVA_HOME variable in your environment to match the >&2 77 | echo location of your Java installation. >&2 78 | echo. 79 | goto error 80 | 81 | @REM ==== END VALIDATION ==== 82 | 83 | :init 84 | 85 | @REM Find the project base dir, i.e. the directory that contains the folder ".mvn". 86 | @REM Fallback to current working directory if not found. 87 | 88 | set MAVEN_PROJECTBASEDIR=%MAVEN_BASEDIR% 89 | IF NOT "%MAVEN_PROJECTBASEDIR%"=="" goto endDetectBaseDir 90 | 91 | set EXEC_DIR=%CD% 92 | set WDIR=%EXEC_DIR% 93 | :findBaseDir 94 | IF EXIST "%WDIR%"\.mvn goto baseDirFound 95 | cd .. 96 | IF "%WDIR%"=="%CD%" goto baseDirNotFound 97 | set WDIR=%CD% 98 | goto findBaseDir 99 | 100 | :baseDirFound 101 | set MAVEN_PROJECTBASEDIR=%WDIR% 102 | cd "%EXEC_DIR%" 103 | goto endDetectBaseDir 104 | 105 | :baseDirNotFound 106 | set MAVEN_PROJECTBASEDIR=%EXEC_DIR% 107 | cd "%EXEC_DIR%" 108 | 109 | :endDetectBaseDir 110 | 111 | IF NOT EXIST "%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config" goto endReadAdditionalConfig 112 | 113 | @setlocal EnableExtensions EnableDelayedExpansion 114 | for /F "usebackq delims=" %%a in ("%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config") do set JVM_CONFIG_MAVEN_PROPS=!JVM_CONFIG_MAVEN_PROPS! %%a 115 | @endlocal & set JVM_CONFIG_MAVEN_PROPS=%JVM_CONFIG_MAVEN_PROPS% 116 | 117 | :endReadAdditionalConfig 118 | 119 | SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe" 120 | set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar" 121 | set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain 122 | 123 | set DOWNLOAD_URL="https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 124 | 125 | FOR /F "tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO ( 126 | IF "%%A"=="wrapperUrl" SET DOWNLOAD_URL=%%B 127 | ) 128 | 129 | @REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central 130 | @REM This allows using the maven wrapper in projects that prohibit checking in binary data. 131 | if exist %WRAPPER_JAR% ( 132 | if "%MVNW_VERBOSE%" == "true" ( 133 | echo Found %WRAPPER_JAR% 134 | ) 135 | ) else ( 136 | if not "%MVNW_REPOURL%" == "" ( 137 | SET DOWNLOAD_URL="%MVNW_REPOURL%/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 138 | ) 139 | if "%MVNW_VERBOSE%" == "true" ( 140 | echo Couldn't find %WRAPPER_JAR%, downloading it ... 141 | echo Downloading from: %DOWNLOAD_URL% 142 | ) 143 | 144 | powershell -Command "&{"^ 145 | "$webclient = new-object System.Net.WebClient;"^ 146 | "if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^ 147 | "$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^ 148 | "}"^ 149 | "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%DOWNLOAD_URL%', '%WRAPPER_JAR%')"^ 150 | "}" 151 | if "%MVNW_VERBOSE%" == "true" ( 152 | echo Finished downloading %WRAPPER_JAR% 153 | ) 154 | ) 155 | @REM End of extension 156 | 157 | @REM Provide a "standardized" way to retrieve the CLI args that will 158 | @REM work with both Windows and non-Windows executions. 159 | set MAVEN_CMD_LINE_ARGS=%* 160 | 161 | %MAVEN_JAVA_EXE% %JVM_CONFIG_MAVEN_PROPS% %MAVEN_OPTS% %MAVEN_DEBUG_OPTS% -classpath %WRAPPER_JAR% "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" %WRAPPER_LAUNCHER% %MAVEN_CONFIG% %* 162 | if ERRORLEVEL 1 goto error 163 | goto end 164 | 165 | :error 166 | set ERROR_CODE=1 167 | 168 | :end 169 | @endlocal & set ERROR_CODE=%ERROR_CODE% 170 | 171 | if not "%MAVEN_SKIP_RC%" == "" goto skipRcPost 172 | @REM check for post script, once with legacy .bat ending and once with .cmd ending 173 | if exist "%HOME%\mavenrc_post.bat" call "%HOME%\mavenrc_post.bat" 174 | if exist "%HOME%\mavenrc_post.cmd" call "%HOME%\mavenrc_post.cmd" 175 | :skipRcPost 176 | 177 | @REM pause the script if MAVEN_BATCH_PAUSE is set to 'on' 178 | if "%MAVEN_BATCH_PAUSE%" == "on" pause 179 | 180 | if "%MAVEN_TERMINATE_CMD%" == "on" exit %ERROR_CODE% 181 | 182 | exit /B %ERROR_CODE% 183 | -------------------------------------------------------------------------------- /test/pom.xml: -------------------------------------------------------------------------------- 1 | 5 | 4.0.0 6 | de.kekru.docker-remote-api-tls 7 | docker-remote-api-tls-test 8 | jar 9 | 0.0.1-SNAPSHOT 10 | https://github.com/kekru/docker-remote-api-tls 11 | 12 | 13 | UTF-8 14 | 1.8 15 | 1.8 16 | 17 | 18 | 19 | 20 | junit 21 | junit 22 | 4.13.1 23 | test 24 | 25 | 26 | org.assertj 27 | assertj-core 28 | 3.17.2 29 | test 30 | 31 | 32 | commons-io 33 | commons-io 34 | 2.14.0 35 | test 36 | 37 | 38 | org.apache.commons 39 | commons-lang3 40 | 3.11 41 | test 42 | 43 | 44 | org.slf4j 45 | slf4j-simple 46 | 1.7.9 47 | test 48 | 49 | 50 | 51 | -------------------------------------------------------------------------------- /test/src/test/java/de/kekru/dockerremoteapitls/test/BasicConnectionTest.java: -------------------------------------------------------------------------------- 1 | package de.kekru.dockerremoteapitls.test; 2 | 3 | import static org.assertj.core.api.Assertions.assertThat; 4 | import static org.junit.Assert.assertThrows; 5 | 6 | import de.kekru.dockerremoteapitls.test.utils.AbstractIntegrationTest; 7 | import de.kekru.dockerremoteapitls.test.utils.CertUtils; 8 | import java.io.File; 9 | import java.time.LocalDate; 10 | import org.junit.BeforeClass; 11 | import org.junit.Test; 12 | 13 | public class BasicConnectionTest extends AbstractIntegrationTest { 14 | 15 | @BeforeClass 16 | public static void init() { 17 | startRemoteApiContainer( 18 | "CERT_HOSTNAME=abc.127.0.0.1.nip.io", 19 | "CREATE_CERTS_WITH_PW=supersecret" 20 | ); 21 | } 22 | 23 | @Test 24 | public void canConnectOverRemoteApi() { 25 | // When 26 | String output = runOverRemoteApi("docker ps"); 27 | 28 | // Then 29 | assertThat(output).contains("kekru/docker-remote-api-tls:temp-for-unittests"); 30 | } 31 | 32 | @Test 33 | public void failsOnWrongHost() { 34 | // When 35 | RuntimeException exception = assertThrows(RuntimeException.class, () -> 36 | runOverRemoteApi("docker ps", 37 | "DOCKER_HOST=tcp://wrong-host-" + REMOTE_API_HOST + ":" + REMOTE_API_PORT) 38 | ); 39 | 40 | // Then 41 | assertThat(exception) 42 | .hasMessageContaining("error during connect:"); 43 | assertThat(exception) 44 | .hasMessageContaining("x509: certificate is valid for abc.127.0.0.1.nip.io, " 45 | + "not wrong-host-abc.127.0.0.1.nip.io"); 46 | } 47 | 48 | @Test 49 | public void failsOnNoTls() { 50 | // When 51 | RuntimeException exception = assertThrows(RuntimeException.class, () -> 52 | runOverRemoteApi("docker ps", 53 | "DOCKER_TLS_VERIFY=", 54 | "DOCKER_CERT_PATH=" 55 | ) 56 | ); 57 | 58 | // Then 59 | assertThat(exception) 60 | .hasMessageContaining("error during connect: Get \"http://abc.127.0.0.1.nip.io:30129/v1.47/containers/json\""); 61 | } 62 | 63 | @Test 64 | public void caCertHasCorrectDefaultValues() { 65 | 66 | CertUtils caCert = new CertUtils(new File(certsDir + "/ca-cert.pem")); 67 | 68 | assertThat(caCert.getCert().getSubjectDN().getName()) 69 | .isEqualTo("EMAILADDRESS=test@example.com, CN=example.com, OU=IT, O=ExampleCompany, L=London, ST=London, C=GB"); 70 | 71 | assertThat(caCert.getExpiresAt()) 72 | .isEqualTo(LocalDate.now().plusDays(900)); 73 | } 74 | 75 | @Test 76 | public void serverCertHasCorrectDefaultValues() { 77 | 78 | CertUtils caCert = new CertUtils(new File(certsDir + "/server-cert.pem")); 79 | 80 | assertThat(caCert.getCert().getSubjectDN().getName()) 81 | .isEqualTo("CN=abc.127.0.0.1.nip.io"); 82 | 83 | assertThat(caCert.getExpiresAt()) 84 | .isEqualTo(LocalDate.now().plusDays(365)); 85 | } 86 | 87 | @Test 88 | public void clientCertHasCorrectDefaultValues() { 89 | 90 | CertUtils caCert = new CertUtils(new File(certsDirClient + "/cert.pem")); 91 | 92 | assertThat(caCert.getCert().getSubjectDN().getName()) 93 | .isEqualTo("CN=testClient"); 94 | 95 | assertThat(caCert.getExpiresAt()) 96 | .isEqualTo(LocalDate.now().plusDays(365)); 97 | } 98 | 99 | } 100 | -------------------------------------------------------------------------------- /test/src/test/java/de/kekru/dockerremoteapitls/test/CertGenerationTest.java: -------------------------------------------------------------------------------- 1 | package de.kekru.dockerremoteapitls.test; 2 | 3 | import static org.assertj.core.api.Assertions.assertThat; 4 | 5 | import de.kekru.dockerremoteapitls.test.utils.AbstractIntegrationTest; 6 | import de.kekru.dockerremoteapitls.test.utils.CertUtils; 7 | import java.io.File; 8 | import java.io.IOException; 9 | import java.time.LocalDate; 10 | import org.apache.commons.io.FileUtils; 11 | import org.junit.BeforeClass; 12 | import org.junit.Test; 13 | 14 | public class CertGenerationTest extends AbstractIntegrationTest { 15 | 16 | @BeforeClass 17 | public static void init() { 18 | startRemoteApiContainer( 19 | "CERT_HOSTNAME=something-else.127.0.0.1.nip.io", 20 | "CREATE_CERTS_WITH_PW=supersecret123", 21 | "CERT_EXPIRATION_DAYS=17", 22 | "CA_EXPIRATION_DAYS=1273" 23 | ); 24 | } 25 | 26 | @Test 27 | public void caCertHasCorrectDefaultValues() { 28 | 29 | CertUtils caCert = new CertUtils(new File(certsDir + "/ca-cert.pem")); 30 | 31 | assertThat(caCert.getCert().getSubjectDN().getName()) 32 | .isEqualTo("EMAILADDRESS=test@example.com, CN=example.com, OU=IT, O=ExampleCompany, L=London, ST=London, C=GB"); 33 | 34 | assertThat(caCert.getExpiresAt()) 35 | .isEqualTo(LocalDate.now().plusDays(1273)); 36 | } 37 | 38 | @Test 39 | public void serverCertHasCorrectDefaultValues() { 40 | 41 | CertUtils caCert = new CertUtils(new File(certsDir + "/server-cert.pem")); 42 | 43 | assertThat(caCert.getCert().getSubjectDN().getName()) 44 | .isEqualTo("CN=something-else.127.0.0.1.nip.io"); 45 | 46 | assertThat(caCert.getExpiresAt()) 47 | .isEqualTo(LocalDate.now().plusDays(17)); 48 | } 49 | 50 | @Test 51 | public void clientCertHasCorrectDefaultValues() { 52 | 53 | CertUtils caCert = new CertUtils(new File(certsDirClient + "/cert.pem")); 54 | 55 | assertThat(caCert.getCert().getSubjectDN().getName()) 56 | .isEqualTo("CN=testClient"); 57 | 58 | assertThat(caCert.getExpiresAt()) 59 | .isEqualTo(LocalDate.now().plusDays(17)); 60 | } 61 | 62 | @Test 63 | public void caCertInClientDirIsSameAsInServerDir() throws IOException { 64 | 65 | String ca = FileUtils.readFileToString(new File(certsDir + "/ca-cert.pem"), "UTF-8"); 66 | String caInClientDir = FileUtils.readFileToString(new File(certsDirClient + "/ca.pem"), "UTF-8"); 67 | 68 | assertThat(ca).isEqualTo(caInClientDir); 69 | } 70 | 71 | } 72 | -------------------------------------------------------------------------------- /test/src/test/java/de/kekru/dockerremoteapitls/test/WrongCertTest.java: -------------------------------------------------------------------------------- 1 | package de.kekru.dockerremoteapitls.test; 2 | 3 | import static org.assertj.core.api.Assertions.assertThat; 4 | import static org.junit.Assert.assertThrows; 5 | 6 | import de.kekru.dockerremoteapitls.test.utils.AbstractIntegrationTest; 7 | import java.io.File; 8 | import java.io.FileOutputStream; 9 | import java.io.IOException; 10 | import java.io.InputStream; 11 | import java.io.OutputStream; 12 | import java.util.Objects; 13 | import org.apache.commons.io.IOUtils; 14 | import org.junit.BeforeClass; 15 | import org.junit.Test; 16 | 17 | public class WrongCertTest extends AbstractIntegrationTest { 18 | 19 | @BeforeClass 20 | public static void init() { 21 | startRemoteApiContainer( 22 | "CERT_HOSTNAME=abc.127.0.0.1.nip.io", 23 | "CREATE_CERTS_WITH_PW=supersecret" 24 | ); 25 | } 26 | 27 | @Test 28 | public void failsOnModifiedClientCert() throws Exception { 29 | // Given 30 | copyResourceToFile("/some-client-cert.pem", 31 | new File(certsDirClient + "/cert.pem")); 32 | copyResourceToFile("/some-client-key.pem", 33 | new File(certsDirClient + "/key.pem")); 34 | 35 | // When 36 | RuntimeException exception = assertThrows(RuntimeException.class, () -> 37 | runOverRemoteApi("docker ps") 38 | ); 39 | 40 | // Then 41 | assertThat(exception) 42 | .hasMessageContaining("failed to retrieve context tls info: tls: private key does not match public key"); 43 | } 44 | 45 | private void copyResourceToFile(String resourceFile, File clientCert) throws IOException { 46 | try (InputStream in = getClass().getResourceAsStream(resourceFile); 47 | OutputStream out = new FileOutputStream(clientCert)) { 48 | 49 | Objects.requireNonNull(in, "no resourcefile found for " + resourceFile); 50 | IOUtils.copy(in, out); 51 | } 52 | } 53 | 54 | } 55 | -------------------------------------------------------------------------------- /test/src/test/java/de/kekru/dockerremoteapitls/test/utils/AbstractIntegrationTest.java: -------------------------------------------------------------------------------- 1 | package de.kekru.dockerremoteapitls.test.utils; 2 | 3 | import static org.assertj.core.api.Assertions.assertThat; 4 | 5 | import java.io.File; 6 | import java.io.FileWriter; 7 | import java.io.IOException; 8 | import java.io.PrintWriter; 9 | import java.util.Arrays; 10 | import java.util.Collections; 11 | import java.util.HashMap; 12 | import java.util.List; 13 | import java.util.Map; 14 | import org.apache.commons.io.FileUtils; 15 | import org.apache.commons.lang3.StringUtils; 16 | import org.junit.BeforeClass; 17 | import org.junit.ClassRule; 18 | import org.junit.rules.TemporaryFolder; 19 | import org.slf4j.Logger; 20 | import org.slf4j.LoggerFactory; 21 | 22 | public class AbstractIntegrationTest { 23 | 24 | protected static final Logger LOG = LoggerFactory.getLogger(AbstractIntegrationTest.class); 25 | protected static final String REMOTE_API_HOST = "abc.127.0.0.1.nip.io"; 26 | protected static final int REMOTE_API_PORT = 30129; 27 | 28 | @ClassRule 29 | public static TemporaryFolder folder = new TemporaryFolder(); 30 | protected static final ShellExecutor shellExecutor = new ShellExecutor(); 31 | protected static final File certsDir = new File("target/integr-test/certs"); 32 | protected static final File certsDirClient = new File(certsDir + "/client"); 33 | protected static final File remoteApiEnvFile = new File("target/integr-test/remote-api.env"); 34 | 35 | 36 | @BeforeClass 37 | public static void initTests() throws IOException { 38 | if (certsDir.exists()) { 39 | FileUtils.cleanDirectory(certsDir); 40 | } 41 | certsDir.mkdirs(); 42 | writeEnvFile(Collections.emptyList()); 43 | 44 | runDockerCompose("stop remote-api"); 45 | } 46 | 47 | protected static void startRemoteApiContainer(String... envEntries) { 48 | writeEnvFile(Arrays.asList(envEntries)); 49 | runDockerCompose("up -d --force-recreate remote-api"); 50 | waitForHealthy(); 51 | copyGeneratedClientCertsToLocal(); 52 | } 53 | 54 | private static void writeEnvFile(List envEntries) { 55 | if (remoteApiEnvFile.exists()) { 56 | remoteApiEnvFile.delete(); 57 | } 58 | 59 | try (PrintWriter printWriter = new PrintWriter(new FileWriter(remoteApiEnvFile))) { 60 | envEntries.forEach(printWriter::println); 61 | } catch (IOException e) { 62 | throw new RuntimeException(e); 63 | } 64 | } 65 | 66 | protected static String runDockerCompose(String composeCommand) { 67 | 68 | Map env = new HashMap<>(); 69 | env.put("COMPOSE_DOCKER_CLI_BUILD", "1"); 70 | env.put("DOCKER_BUILDKIT", "1"); 71 | env.put("COMPOSE_PROJECT_NAME", "test"); 72 | //shellExecutor.execute("docker-compose build --progress=plain remote-api", env); 73 | return shellExecutor.execute("docker compose " + composeCommand, env); 74 | } 75 | 76 | protected static void waitForHealthy() { 77 | final int timeoutSeconds = 30; 78 | final long endTime = System.currentTimeMillis() + (timeoutSeconds * 1000); 79 | 80 | try { 81 | while (System.currentTimeMillis() < endTime) { 82 | 83 | LOG.info("Waiting for remote-api to become healthy"); 84 | Thread.sleep(1000); 85 | 86 | String output = runDockerCompose("ps remote-api"); 87 | 88 | if (output.contains("(healthy)")) { 89 | return; 90 | } 91 | } 92 | 93 | throw new RuntimeException("remote-api not healthy after" + timeoutSeconds + " seconds"); 94 | 95 | } catch (final InterruptedException e) { 96 | Thread.currentThread().interrupt(); 97 | throw new RuntimeException("Sleep interrupted", e); 98 | } 99 | } 100 | 101 | protected static void copyGeneratedClientCertsToLocal() { 102 | String remoteApiContainerId = runDockerCompose("ps -q remote-api"); 103 | shellExecutor.execute("docker cp " + remoteApiContainerId + ":/data/certs/. " 104 | + withForwardSlashes(certsDir)); 105 | 106 | assertThat(new File(certsDir + "/ca-cert.pem")).exists(); 107 | assertThat(new File(certsDir + "/ca-key.pem")).exists(); 108 | assertThat(new File(certsDir + "/server-cert.pem")).exists(); 109 | assertThat(new File(certsDir + "/server-key.pem")).exists(); 110 | assertThat(new File(certsDirClient + "/ca.pem")).exists(); 111 | assertThat(new File(certsDirClient + "/cert.pem")).exists(); 112 | assertThat(new File(certsDirClient + "/key.pem")).exists(); 113 | } 114 | 115 | protected static String runOverRemoteApi(String command, String... moreEnvs) { 116 | Map env = new HashMap<>(); 117 | env.put("DOCKER_HOST", "tcp://" + REMOTE_API_HOST + ":" + REMOTE_API_PORT); 118 | env.put("DOCKER_TLS_VERIFY", "1"); 119 | env.put("DOCKER_CERT_PATH", withForwardSlashes(certsDirClient)); 120 | 121 | for (String entry : moreEnvs) { 122 | String key = StringUtils.substringBefore(entry, "="); 123 | String value = StringUtils.substringAfter(entry, "="); 124 | env.put(key, value); 125 | 126 | if (StringUtils.isBlank(value)) { 127 | env.remove(key); 128 | } 129 | } 130 | 131 | return shellExecutor.execute(command, env); 132 | } 133 | 134 | private static String withForwardSlashes(File file) { 135 | return file.getAbsolutePath().replace("\\", "/"); 136 | } 137 | } 138 | -------------------------------------------------------------------------------- /test/src/test/java/de/kekru/dockerremoteapitls/test/utils/CertUtils.java: -------------------------------------------------------------------------------- 1 | package de.kekru.dockerremoteapitls.test.utils; 2 | 3 | import java.io.File; 4 | import java.io.FileInputStream; 5 | import java.io.InputStream; 6 | import java.time.LocalDate; 7 | import java.time.ZoneId; 8 | import java.util.Date; 9 | import javax.security.cert.X509Certificate; 10 | 11 | public class CertUtils { 12 | 13 | private final X509Certificate cert; 14 | 15 | public CertUtils(File file) { 16 | cert = getCert(file); 17 | } 18 | 19 | private X509Certificate getCert(File file) { 20 | try (InputStream in = new FileInputStream(file)) { 21 | return X509Certificate.getInstance(in); 22 | } catch (Exception e) { 23 | throw new RuntimeException(e); 24 | } 25 | } 26 | 27 | public LocalDate getExpiresAt() { 28 | return toLocalDate(cert.getNotAfter()); 29 | } 30 | 31 | public LocalDate toLocalDate(Date dateToConvert) { 32 | return dateToConvert.toInstant() 33 | .atZone(ZoneId.systemDefault()) 34 | .toLocalDate(); 35 | } 36 | 37 | public X509Certificate getCert() { 38 | return cert; 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /test/src/test/java/de/kekru/dockerremoteapitls/test/utils/ShellExecutor.java: -------------------------------------------------------------------------------- 1 | package de.kekru.dockerremoteapitls.test.utils; 2 | 3 | import java.io.BufferedReader; 4 | import java.io.IOException; 5 | import java.io.InputStreamReader; 6 | import java.util.Arrays; 7 | import java.util.Collections; 8 | import java.util.List; 9 | import java.util.Map; 10 | import java.util.stream.Collectors; 11 | import org.slf4j.Logger; 12 | import org.slf4j.LoggerFactory; 13 | 14 | public class ShellExecutor { 15 | 16 | private static final Logger LOG = LoggerFactory.getLogger(ShellExecutor.class); 17 | 18 | public String execute(String command) { 19 | return execute(command, Collections.emptyMap()); 20 | } 21 | 22 | public String execute(String command, Map additionalEnvVars) { 23 | return execute(Arrays.asList(command.split(" ")), additionalEnvVars); 24 | } 25 | 26 | public String execute(List commandParts, Map additionalEnvVars) { 27 | String commandJoined = commandParts.stream().collect(Collectors.joining(" ")); 28 | 29 | if (LOG.isDebugEnabled()) { 30 | LOG.debug("Running command: " + commandJoined + ", env: " + additionalEnvVars); 31 | } 32 | 33 | ProcessBuilder processBuilder = new ProcessBuilder(); 34 | processBuilder.command(commandParts); 35 | 36 | for (Map.Entry entry : additionalEnvVars.entrySet()) { 37 | processBuilder.environment().put(entry.getKey(), entry.getValue()); 38 | } 39 | processBuilder.redirectErrorStream(true); 40 | 41 | Process process = null; 42 | 43 | try { 44 | process = processBuilder.start(); 45 | 46 | try (BufferedReader reader = new BufferedReader( 47 | new InputStreamReader(process.getInputStream()))) { 48 | 49 | String commandOutput = reader 50 | .lines() 51 | .peek(s -> { 52 | if (LOG.isDebugEnabled()) { 53 | LOG.debug(s); 54 | } 55 | }) 56 | .collect(Collectors.joining("\n")); 57 | 58 | int exitCode = process.waitFor(); 59 | if (LOG.isDebugEnabled()) { 60 | LOG.debug("Exit code from script: " + exitCode); 61 | } 62 | 63 | if (exitCode != 0) { 64 | throw new RuntimeException("Command exited with code " + exitCode + ": " + 65 | commandJoined + 66 | "\nOutput was:\n " + commandOutput); 67 | } 68 | 69 | return commandOutput; 70 | 71 | } catch (IOException e) { 72 | throw new RuntimeException("Shell Command failed: " + commandJoined, e); 73 | 74 | } catch (InterruptedException e) { 75 | Thread.currentThread().interrupt(); 76 | throw new RuntimeException("Command was interrupted", e); 77 | } 78 | } catch (IOException e) { 79 | throw new RuntimeException("Could not start process " + commandJoined, e); 80 | } finally { 81 | if (process != null && process.isAlive()) { 82 | process.destroyForcibly(); 83 | } 84 | } 85 | } 86 | } 87 | -------------------------------------------------------------------------------- /test/src/test/resources/simplelogger.properties: -------------------------------------------------------------------------------- 1 | org.slf4j.simpleLogger.defaultLogLevel=debug 2 | -------------------------------------------------------------------------------- /test/src/test/resources/some-client-cert.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIFRzCCAy+gAwIBAgIUV3bmnPUjIQRdKlEcLXSdY20bJFUwDQYJKoZIhvcNAQEL 3 | BQAwgYwxCzAJBgNVBAYTAkdCMQ8wDQYDVQQIDAZMb25kb24xDzANBgNVBAcMBkxv 4 | bmRvbjEXMBUGA1UECgwORXhhbXBsZUNvbXBhbnkxCzAJBgNVBAsMAklUMRQwEgYD 5 | VQQDDAtleGFtcGxlLmNvbTEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFtcGxlLmNv 6 | bTAeFw0yMDEwMTAxOTEwMTNaFw0yMTEwMTAxOTEwMTNaMBUxEzARBgNVBAMMCnRl 7 | c3RDbGllbnQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDZHT0jSuQV 8 | gxXIcI6Tv8l9V9jqgCGOktMvpD8CG9WB+QgtotU04YMWEk1xVeHHu8nSkKSqBgGG 9 | 5L3LHUFEi5yFEKrBtPx076rBXfAP87od1HLH3+MWpqzm8PQ30cCHE42PcppSXy9E 10 | 5yNeY93xIIY4ryLXibPH2msilExkR051MLRIFw7IIskWq6kKeJUPEDn647VXwhhD 11 | NGfmec6YcpLyeqT96urUEjC5lXKN3yC6w3sXgjJcpxpEJnBGYedvnu/n6XgjKXn3 12 | MU3wBCXJusnsL2EUmBacizkNaCI5YVHYAxH7HMeaM+vEhAkD2V7vZ6Sz0/51a61a 13 | 0P4cj/ytEfG//JUcsc8tTeqyvvCdYBqONXGpB3XG04tzY7DtS8wi+i7RvVtyhl7D 14 | FtW9R5+WH0uTcsBQGWZ2KK3RviSWeobFPZfnHlf1c5eNbjH44M9yf6OCr0EKnXbA 15 | ioNKnNdkUBPhWf9DoPCGXdoCyYc2U4xtXc9JE7JtN6Gerpfkc+ixsLGeFpGyOFRt 16 | EPmRzFy9hsomJyXb/05hJ2QCBLkEaAYwSX7sLHkYQSOxMYiDFVa+iyR2kap4INja 17 | w1s4cRvuBOJYP0oyuIYQyYgI5XqY7tjG+B9azjVfVQwxb9222OvOKTtq6j6j8ZFM 18 | g0qf0h4mMpnNB5oNw4ylStAxBPVBUdE9SQIDAQABoxcwFTATBgNVHSUEDDAKBggr 19 | BgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAgEAFAsbdScIwlvu0AQwi2/dbTFfQEYY 20 | rA8U2eev9kYbKrXXA5gabXevwcLTQfYwhlDCugAPPNYRvZqS3ZzYxtTd1u7s6lSD 21 | 2oPynTmQUiPeEjewL9cRwmz1SsKUZARZY6T4OEfwm0LeirqJxFYQ3AHXKRokfCHj 22 | elzMr2suZauDeg1+i3w67cNjZTSfiImGrzV9Pkx96qiatTmlmPUH2u92ahhxC/sj 23 | p+DUCTQhcoWGpUg0hA+JisSoVlSPAibXSU5uLPgL5Ft92oiGAGwDy4ke/Ojd0QVJ 24 | yp/KhWL54jmjTRf+zUZNyQ7rAPtErhL6m3i/LAFfYqa6cAM0kcbLohNIF5mm88tJ 25 | M9necXGlHHM5Py83zHA6/FUC1BeBx1ac0Y2taizUFlNZ1HkxoiPoguFl0aMzhD82 26 | FZwx8U5XUkQJxvAlbDNkth8YEiOtA1OVTf9yYws1JjzzuGxCd+Rvy+aAKM/7ZmPC 27 | A2aAbvrm4Gk2KYxEHS+Ywz/Js7FER5b95Yav/6GFEBH8onDxQrpj8wmhmK7SHPz+ 28 | OFCzbh7Ij8xKxm8SMMpa44nyOZeA1yVV+VHYe4DMnqvSJQ8i0z4Xbk+8ceUNByTY 29 | RBlsVGlvZi9fRAMJQH33P1RXktDJVkguPPcuqooDh9r4Cvzw89KyPnbuaKjilaZ/ 30 | hnvKQDVgJxCVlkA= 31 | -----END CERTIFICATE----- 32 | -------------------------------------------------------------------------------- /test/src/test/resources/some-client-key.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIJKQIBAAKCAgEApvXTnfOmWmwZ9lhvK2VEbKhuvSyDbHY4SRal5ZgrIETYl8AF 3 | QymR3exmKXYATRwUAbfcJh0LV9okHBI1vGpa89ikq8d/74BWhuyXB9d2ewl9qB1q 4 | GmW6R7RvnMpvpTNqw3XnTN40eLyX38wnp7CjvmpO1TeSUsah91gr55L+iJ10tkXM 5 | Cgbr/hMDr/VJcX6b7l0GWlKYobLMVgxvR3NTLKdiJX3I6Oqa3LL5FjDxdFsd35wO 6 | 6KKPXeYECuS3w77CE/dW3HyLJsrD1GO3YEqBgbgs13z4nejkOetnllhdpC2/livq 7 | fuNWbktCu3QjVAf6VyxHLYe9skl964vx/Yn+MvGrEFWDBzd71cc+F0ESIc6U4qMI 8 | teVqIVT9/mtyZ7HStOkibCT9e6pliTEhqV8pZw8Cr7GgFspueb+Bw4t7rt0Q4Ceb 9 | nn/JZ0cn+tkhclbKz8iQenUDSjQN5RLPdG8S70rZ6KLH/COC7/YGUyvKb4jbhV0B 10 | q7zi2mkJjZi8CuegTBQRjU0YK+wq+5LRKRaGj+d7wpBW7662k3KbDoJj6uk9JpZF 11 | youdYh8F++rzjZCgeCkP5A9p9B1x0z/NGynv0G3a6/TO//feiKhs+N5oqt0XixJR 12 | raBFRc83aRm8McJS53QnhAGN+c4MB9oQZM+PrpqXv36kxObZH+imc9AvPmMCAwEA 13 | AQKCAgEAhYDD+eU9+8e86tLD8ftDv27fPb0+SZguYaMOfIw0z9S9LHqKuq2eycmh 14 | 1z1X+FCfXtBZ5NAMpe70OM4G0eZpW9q7sfAQSL5icfj0u3x6bN+l7qu2j+0QCw4o 15 | wULOC1cV471/emOjqXeEKZvhiaEhDb2L08pf4niaQmHqmX1csnjVPnqJMOtgAQXL 16 | SQPl+i63GN6hmc+55HJIGfZPdN6uf2JIhJoT8MrHkfo6WphAOj4xoP/0m+iAoyCt 17 | 0tgYaRk7ryNz/VJJIne4JzilBQYOkF9o29Y+JmZ3OCkX54w5NHKwY7AyDcxS7FaZ 18 | wbKYHTVT5CivsaR89vb1DUgV9BpHe8Flw7SY4ra8RuhKgfogbzYeUHo1GUWKu9Hy 19 | n0ndVKHY47z08yhUqaUsQ0HgSd1NX3M/J7QD2mInNs+0OzlXDBYONNmWnd/C4PxE 20 | wqc8bRqeCFDuWq0sPdpMdg+4/PKhONRatul/DxKho+EjTMz930xz+hiB+8BiYzrY 21 | JUpTuADtdm2wsUQf+PjwxcBE+PTabFoTjVI43YScDTjDvVejwanSpPQMQ8gnQosm 22 | i4l/ESUCzLxU1sJfRn+ly9CyzEkyeocX/K6ynez+LOddMGNuKV3eGtoLJv35iFSu 23 | k+JhMlheUpTlIwclqykzcaNSsk87crjUNdHfLRa0RiYuW2l13WECggEBAN54nH6M 24 | UvLpdlObE0QuDA8hkaUe8PSYmqjtImX8lO7QTRTIhDXKpStX5yOqdtHFnrKN88DD 25 | VJBJTr8nasvoAdI/7LOpzB/U87hMCSElaA4cPXlBzdBD2oqfTojYTtuek3AWbUKA 26 | M7MayRkQPxPtYK5XHHSyhTJJuxOKfYM9bOa1eajOKZoNFTv2xNUMr7YiWHc6mIRR 27 | Z6r4QlnkFoVLWKOXSMicqXq1jUNBpgQSQBJmo+a/VNocPRcsR+Y7BRLA8sD4/CWx 28 | 9W3XtRcUq2YSD4+as2z1FalAB9NLn3V3oBRnGgow8WGSxEbCK6sM7/LeAy+F8YwS 29 | OXbcxBJaYQDoDBUCggEBAMAffipDDV/V75RhNi8tKOyU38+OL4Br6KoUkOzCDt9Q 30 | 7ltVZD6mrw37jlNnO/GJ3QgvRdeZQQ3+0ycROzwJ6JOlp5QDXywIOQTWDFo21fqL 31 | MFu915iKT3JbBrhR8rvGh3sTdvp7/gzJMnnlG51o42xZ+ZU4/YisNyDWd3/tPnyK 32 | 9Z2VlPT8ho2b1+z7yYrRIR7tb6k71epVRxZ7fyc9TRdL3m9fMFM7D5Dc54R2ITbE 33 | PtZOgxjSuQrcu1RDLU4ADFmRtF+PaJvn3XKd9zcehYPQFNOVr5V4xheigg9nMPdA 34 | 2QZY3J+WSmw7U+AMeenlEjMrXruAoZFQsPuJ80+xJpcCggEAewQ4jOVtLLMZ4gs7 35 | MRVBR9CpJ6QfWzFTPBu8TKbJd/Co3tgt+0yt3nTB8//bqg1bvqIt6iZYiVxv9dWH 36 | AW+uKiN88K/wlp17kypAVhrIGh1VhMp1UzdiDgsfMx5hJKHgJzfPfNlFPUGPd5N7 37 | PbqiHmU+7+yTKIaKsrh+xOZfZIdu2X/+kxeu6TSADMryEoWVY4B8O5aD+49BqVEt 38 | ftF2FyedcIjoUlk33rvbYB7zXPlyojKkaeL5iOnMbCuwl3koArrrOrDX5MBFe5jL 39 | WiqcfizuEE7JhohIi3cimqLmWsHULVR49Rph/Dp8SR5jRGmtW0b2lRyyt95FcVyW 40 | jRjDLQKCAQEAq/vFKjnqAA94L4CyS5sGlnpSu+9RcImotpBAh+DUBW7iYNpZKYh3 41 | DnJRHzI7w+Yg+lGvGOg1Bz1FciSHvSA1le5lzCcUjEs0F7MxTZTnCiiNeqLAG+o8 42 | Ymc/5cJeI1/+Kdvr1yEl8/Yr/Fhu1wNtCrKkrMNemnlnxDqYsOkE1eJjKtUbig+A 43 | t8V5jsh6y4yYNKJiIcHRpbr/Lw4QbmT+3Mrq7RHuJaOqNIi7q6U/6FHW2mtgCdmh 44 | Eis0eqLELJ34cDnxmNW81EvEvfTQuAPXi367FglaK9j4o3GzMeyzNbNUU806epXE 45 | O40EcX1ZqVqJZ0r8u6bTe00bkaEVMRKpMwKCAQBtlhQa89d+Lew+RhKtKxb8tvAm 46 | VKbtxYwP0wbvXjywTj+hSr/sr0UFJDykIk58YA48NAoW6jZ0631a3ZwMLdD+IuTi 47 | CPYsCqE5J+YgYIj3ex6A2i13MgkZ7HBsu9QAGxNRuoLRk66bv3a0BPlWYmrQeOuA 48 | pDcyl/mVb2tsb+EKCRfpnZsWo2T92SLdFjvjx+8xdGzfM7oB693x+GgwQWvy83BA 49 | XgcvgKOJBEN/oETte5QGeew3BRe6jlU9DNV8i0XW+Vto/Dzxt+VAS1PUX0ASlV59 50 | pEIuhQ2k6PIOAeBxNSph7mGbLPp0m80RucHctCQsuPXzyA6oiJxB+zbs97dQ 51 | -----END RSA PRIVATE KEY----- 52 | --------------------------------------------------------------------------------