Changeset cf4e708 in mod_gnutls for test

Timestamp:

Jan 23, 2016, 5:11:43 PM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

ddf6027

Parents:

bca7629

Message:

Run tests in separate network namespaces

Creating a network namespace for each test avoids port conflicts so
Apache instances can run in parallel, and also isolates the tests from
the host system.

Test namespaces are automatically used if the "unshare" command is
available, and can be disabled by passing "--disable-test-namespaces"
to ./configure.

Location:

test

Files:

• Makefile.am (modified) (1 diff)
• apache-conf/.gitignore (added)
• apache-conf/netns.conf.in (added)
• base_apache.conf (modified) (2 diffs)
• common.bash (modified) (1 diff)
• runtests (modified) (2 diffs)
• test-19_TLS_reverse_proxy.bash (modified) (1 diff)
• test-20_TLS_reverse_proxy_client_auth.bash (modified) (1 diff)
• test-21_TLS_reverse_proxy_wrong_cert.bash (modified) (1 diff)
• test-22_TLS_reverse_proxy_crl_revoke.bash (modified) (1 diff)
• test-23_TLS_reverse_proxy_mismatched_priorities.bash (modified) (1 diff)

test/Makefile.am

@@ -156 +156 @@
         export BACKEND_HOST="$(TEST_HOST)";
 
+if ENABLE_NETNS
+AM_TESTS_ENVIRONMENT += export UNSHARE="$(UNSHARE)"; \
+        export USE_TEST_NAMESPACE=1;
+endif
 # Without flock tests must not run in parallel. Otherwise set lock files.
 if DISABLE_FLOCK

test/base_apache.conf

@@ -5 +5 @@
 ErrorLog logs/${TEST_NAME}.error.log
 HostnameLookups Off
-PidFile apache2.pid
 KeepAlive Off
 LogLevel debug
@@ -15 +14 @@
 
 Include         listen.conf
+Include         apache-conf/*.conf
 
 DocumentRoot ${srcdir}/data

test/common.bash

@@ -16 +16 @@
     done
 }
+
+
+
+# Usage: netns_reexec ${@}
+#
+# If USE_TEST_NAMESPACE is set and MGS_NETNS_ACTIVE is not, exec the
+# running command inside a new namespace with active loopback
+# interface and MGS_NETNS_ACTIVE defined. This function can be used to
+# isolate each testcase inside its own network namespace. Since
+# MGS_NETNS_ACTIVE is used to track status, there's no harm in calling
+# it multiple times (e.g. in the test-* script and runtests).
+function netns_reexec
+{
+    if [ -n "${USE_TEST_NAMESPACE}" ] && [ -z "${MGS_NETNS_ACTIVE}" ]; then
+        exec "${UNSHARE}" --net -r /bin/bash -c \
+             "export MGS_NETNS_ACTIVE=1; ip link set up lo; exec ${0} ${@}"
+    fi
+    return 0
+}

test/runtests

@@ -7 +7 @@
 set -e
 . ${srcdir}/common.bash
+netns_reexec ${@}
 
 testid="${1##t-}"
@@ -153 +154 @@
 TEST_PID="apache2.pid"
 # configure locking for the Apache process
-if [ -n "${TEST_LOCK}" ]; then
+if [ -n "${USE_TEST_NAMESPACE}" ]; then
+    echo "Using namespaces to isolate tests, no need for locking."
+    flock_cmd=""
+elif [ -n "${TEST_LOCK}" ]; then
     flock_cmd="${FLOCK} -w ${TEST_LOCK_WAIT} $(realpath ${TEST_LOCK})"
 else

test/test-19_TLS_reverse_proxy.bash

@@ -3 +3 @@
 set -e
 : ${srcdir:="."}
+. ${srcdir}/common.bash
+netns_reexec ${@}
 
 testdir="${srcdir}/tests/19_TLS_reverse_proxy"

test/test-20_TLS_reverse_proxy_client_auth.bash

@@ -3 +3 @@
 set -e
 : ${srcdir:="."}
+. ${srcdir}/common.bash
+netns_reexec ${@}
 
 testdir="${srcdir}/tests/20_TLS_reverse_proxy_client_auth"

test/test-21_TLS_reverse_proxy_wrong_cert.bash

@@ -3 +3 @@
 set -e
 : ${srcdir:="."}
+. ${srcdir}/common.bash
+netns_reexec ${@}
 
 testdir="${srcdir}/tests/21_TLS_reverse_proxy_wrong_cert"

test/test-22_TLS_reverse_proxy_crl_revoke.bash

@@ -3 +3 @@
 set -e
 : ${srcdir:="."}
+. ${srcdir}/common.bash
+netns_reexec ${@}
 
 testdir="${srcdir}/tests/22_TLS_reverse_proxy_crl_revoke"

test/test-23_TLS_reverse_proxy_mismatched_priorities.bash

@@ -3 +3 @@
 set -e
 : ${srcdir:="."}
+. ${srcdir}/common.bash
+netns_reexec ${@}
 
 testdir="${srcdir}/tests/23_TLS_reverse_proxy_mismatched_priorities"