|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one or more |
| 3 | + * contributor license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright ownership. |
| 5 | + * The ASF licenses this file to You under the Apache License, Version 2.0 |
| 6 | + * (the "License"); you may not use this file except in compliance with |
| 7 | + * the License. You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, software |
| 12 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | + * See the License for the specific language governing permissions and |
| 15 | + * limitations under the License. |
| 16 | + */ |
| 17 | +package org.apache.camel.quarkus.component.http.http.it; |
| 18 | + |
| 19 | +import java.io.File; |
| 20 | +import java.nio.file.Files; |
| 21 | +import java.nio.file.Path; |
| 22 | +import java.util.LinkedHashMap; |
| 23 | +import java.util.Map; |
| 24 | + |
| 25 | +import io.quarkus.test.common.QuarkusTestResourceLifecycleManager; |
| 26 | +import org.apache.camel.quarkus.test.support.pqc.certificate.PqcCertificatesUtil; |
| 27 | +import org.eclipse.microprofile.config.ConfigProvider; |
| 28 | +import org.testcontainers.containers.BindMode; |
| 29 | +import org.testcontainers.containers.GenericContainer; |
| 30 | +import org.testcontainers.containers.wait.strategy.Wait; |
| 31 | +import org.testcontainers.utility.DockerImageName; |
| 32 | + |
| 33 | +/** |
| 34 | + * Test resource that starts a nginx container with PQC hybrid certificates. |
| 35 | + * |
| 36 | + * Certificates are generated via @PQCCertificates annotation on the test class. |
| 37 | + */ |
| 38 | +public class PqcNginxTestResource implements QuarkusTestResourceLifecycleManager { |
| 39 | + public static final String TRUSTSTORE_PASSWORD = "changeit"; |
| 40 | + public static final String CERT_NAME = "nginx-hybrid-pqc"; |
| 41 | + // Use standard nginx (not OQS) to test BCTLS integration |
| 42 | + // OQS-OpenSSL is incompatible with BouncyCastle JSSE at the protocol level |
| 43 | + private static final String NGINX_IMAGE = ConfigProvider.getConfig().getValue("nginx.container.image", |
| 44 | + String.class); |
| 45 | + |
| 46 | + private GenericContainer<?> container; |
| 47 | + |
| 48 | + @Override |
| 49 | + public Map<String, String> start() { |
| 50 | + try { |
| 51 | + Path certFile = PqcCertificatesUtil.getCertificatePem(CERT_NAME); |
| 52 | + Path keyFile = PqcCertificatesUtil.getPrimaryKeyPem(CERT_NAME); |
| 53 | + Path truststoreFile = PqcCertificatesUtil.getTruststore(CERT_NAME); |
| 54 | + |
| 55 | + if (!certFile.toFile().exists() || !keyFile.toFile().exists()) { |
| 56 | + throw new IllegalStateException( |
| 57 | + "PQC certificate files not found at expected locations: cert=" + certFile + ", key=" + keyFile); |
| 58 | + } |
| 59 | + |
| 60 | + // Write nginx configuration |
| 61 | + // Certificate contains both RSA (primary) and Dilithium2/ML-DSA (alternative) keys |
| 62 | + // Use filenames from the certificate files |
| 63 | + String certFileName = certFile.getFileName().toString(); |
| 64 | + String keyFileName = keyFile.getFileName().toString(); |
| 65 | + |
| 66 | + String nginxConfig = String.format(""" |
| 67 | + server { |
| 68 | + listen 4433 ssl; |
| 69 | + server_name localhost; |
| 70 | + ssl_certificate /certs/%s; |
| 71 | + ssl_certificate_key /certs/%s; |
| 72 | + ssl_protocols TLSv1.3; |
| 73 | + location /test { |
| 74 | + return 200 "Hybrid RSA+Dilithium(ML-DSA) certificate validated"; |
| 75 | + add_header Content-Type text/plain; |
| 76 | + } |
| 77 | + } |
| 78 | + """, certFileName, keyFileName); |
| 79 | + |
| 80 | + // Get certificate directory from actual certificate path |
| 81 | + Path certDirPath = certFile.getParent(); |
| 82 | + File nginxConfigFile = certDirPath.resolve("default.conf").toFile(); |
| 83 | + Files.writeString(nginxConfigFile.toPath(), nginxConfig); |
| 84 | + |
| 85 | + // Start standard nginx container |
| 86 | + container = new GenericContainer<>(DockerImageName.parse(NGINX_IMAGE)) |
| 87 | + .withExposedPorts(4433) |
| 88 | + .withFileSystemBind(certDirPath.toAbsolutePath().toString(), "/certs", BindMode.READ_ONLY) |
| 89 | + .withFileSystemBind(nginxConfigFile.getAbsolutePath(), "/etc/nginx/conf.d/default.conf", |
| 90 | + BindMode.READ_ONLY) |
| 91 | + .withLogConsumer(frame -> System.out.print(frame.getUtf8String())) |
| 92 | + .waitingFor(Wait.forListeningPort()); |
| 93 | + |
| 94 | + container.start(); |
| 95 | + |
| 96 | + // Return configuration properties using paths from certificate files |
| 97 | + Map<String, String> result = new LinkedHashMap<>(); |
| 98 | + result.put("pqc.nginx.host", container.getHost()); |
| 99 | + result.put("pqc.nginx.port", String.valueOf(container.getMappedPort(4433))); |
| 100 | + result.put("pqc.nginx.truststore.path", "file://" + truststoreFile.toAbsolutePath()); |
| 101 | + result.put("pqc.nginx.truststore.password", TRUSTSTORE_PASSWORD); |
| 102 | + |
| 103 | + return result; |
| 104 | + } catch (Exception e) { |
| 105 | + throw new RuntimeException("Failed to start PQC nginx test resource", e); |
| 106 | + } |
| 107 | + } |
| 108 | + |
| 109 | + @Override |
| 110 | + public void stop() { |
| 111 | + if (container != null) { |
| 112 | + container.stop(); |
| 113 | + } |
| 114 | + } |
| 115 | +} |
0 commit comments