feat: support encrypted password file during SASL authentication for ZooKeeper C client

.github/workflows/lint_and_test_cpp.yaml

@@ -172,14 +172,15 @@ jobs:
           - dsn.zookeeper.tests
           # TODO(yingchun): Disable it because we find it's too flaky, we will re-enable it after
           # it has been optimized.
-#          - partition_split_test
+          # - partition_split_test
           - pegasus_geo_test
           - pegasus_rproxy_test
           - pegasus_unit_test
           - recovery_test
           - restore_test
           - security_test
           - throttle_test
+          - zookeeper_sasl_auth_test
     needs: build_Release
     runs-on: ubuntu-latest
     env:
@@ -257,7 +258,7 @@ jobs:
           - dsn.zookeeper.tests
           # TODO(yingchun): Disable it because we find it's too flaky, we will re-enable it after
           # it has been optimized.
-#          - partition_split_test
+          # - partition_split_test
           - pegasus_geo_test
           - pegasus_rproxy_test
           - pegasus_unit_test
@@ -266,7 +267,8 @@ jobs:
           - security_test
           # TODO(yingchun): Disable it because we find it's too flaky, we will re-enable it after
           # it has been optimized.
-#          - throttle_test
+          # - throttle_test
+          - zookeeper_sasl_auth_test
     needs: build_ASAN
     runs-on: ubuntu-latest
     env:
@@ -353,6 +355,7 @@ jobs:
 #          - restore_test
 #          - security_test
 #          - throttle_test
+#          - zookeeper_sasl_auth_test
 #    needs: build_UBSAN
 #    runs-on: ubuntu-latest
 #    env:

admin_tools/start_zk.sh

@@ -23,6 +23,7 @@ CWD=$(cd $(dirname $0) && pwd)
 # Options:
 #    INSTALL_DIR    <dir>
 #    PORT           <port>
+#    SASL_AUTH      YES|NO
 
 if [ -z "$INSTALL_DIR" ]
 then
@@ -36,6 +37,11 @@ then
     exit 1
 fi
 
+if [ -z "$SASL_AUTH" ]
+then
+    SASL_AUTH=NO
+fi
+
 if ! mkdir -p "$INSTALL_DIR";
 then
     echo "ERROR: mkdir $INSTALL_DIR failed"
@@ -54,7 +60,23 @@ fi
 
 ZOOKEEPER_PORT=$PORT
 
-cp $ZOOKEEPER_HOME/conf/zoo_sample.cfg $ZOOKEEPER_HOME/conf/zoo.cfg
+if [ "$SASL_AUTH" == "YES" ]; then
+    {
+        echo "Server {"
+        echo "    org.apache.zookeeper.server.auth.DigestLoginModule required"
+        echo "    user_myuser=\"mypassword\";"
+        echo "};"
+    } > $ZOOKEEPER_HOME/conf/jaas.conf
+
+    PROPERTIES=(
+        "-Dzookeeper.sessionRequireClientSASLAuth=true"
+        "-Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider"
+        "-Djava.security.auth.login.config=$ZOOKEEPER_HOME/conf/jaas.conf"
+    )
+    export JVMFLAGS="${JVMFLAGS} ${PROPERTIES[@]}"
+fi
+
+cp -a $ZOOKEEPER_HOME/conf/zoo_sample.cfg $ZOOKEEPER_HOME/conf/zoo.cfg
 sed -i "s@dataDir=/tmp/zookeeper@dataDir=$ZOOKEEPER_HOME/data@" $ZOOKEEPER_HOME/conf/zoo.cfg
 sed -i "s@clientPort=2181@clientPort=$ZOOKEEPER_PORT@" $ZOOKEEPER_HOME/conf/zoo.cfg
 echo "admin.enableServer=false" >> $ZOOKEEPER_HOME/conf/zoo.cfg

run.sh

@@ -440,6 +440,7 @@ function run_test()
       recovery_test
       restore_test
       throttle_test
+      zookeeper_sasl_auth_test
     )
     local onebox_opts=""
     local test_opts=""
@@ -536,7 +537,12 @@ function run_test()
         else
             # Restart ZK in what ever case.
             run_stop_zk
-            run_start_zk
+
+            if [ "${module}" == "zookeeper_sasl_auth_test" ]; then
+                run_start_zk --sasl_auth
+            else
+                run_start_zk
+            fi
         fi
 
         # Run server test.
@@ -602,6 +608,7 @@ function usage_start_zk()
     echo "                     zookeeper install directory,"
     echo "                     if not set, then default is './.zk_install'"
     echo "   -p|--port <port>  listen port of zookeeper, default is 22181"
+    echo "   -s|--sasl_auth    start zookeeper with SASL Auth, default no"
 }
 
 function run_start_zk()
@@ -615,6 +622,7 @@ function run_start_zk()
 
     INSTALL_DIR=`pwd`/.zk_install
     PORT=22181
+    SASL_AUTH=NO
     while [[ $# > 0 ]]; do
         key="$1"
         case $key in
@@ -630,6 +638,9 @@ function run_start_zk()
                 PORT=$2
                 shift
                 ;;
+            -s|--sasl_auth)
+                SASL_AUTH=YES
+                ;;
             *)
                 echo "ERROR: unknown option \"$key\""
                 echo
@@ -657,7 +668,7 @@ function run_start_zk()
         fi
     fi
 
-    INSTALL_DIR="$INSTALL_DIR" PORT="$PORT" $ROOT/admin_tools/start_zk.sh
+    INSTALL_DIR="$INSTALL_DIR" PORT="$PORT" SASL_AUTH="$SASL_AUTH" $ROOT/admin_tools/start_zk.sh
 }
 
 #####################

src/zookeeper/test/CMakeLists.txt

@@ -54,3 +54,5 @@ set(MY_BINPLACES
     )
 
 dsn_add_test()
+
+add_subdirectory(sasl_auth)

src/zookeeper/test/config-test.ini

@@ -65,7 +65,6 @@ pause_on_start = false
 logging_start_level = LOG_LEVEL_DEBUG
 logging_factory_name = dsn::tools::simple_logger
 
-
 [tools.simple_logger]
 fast_flush = true
 short_header = false

src/zookeeper/test/sasl_auth/CMakeLists.txt

@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+set(MY_PROJ_NAME zookeeper_sasl_auth_test)
+project(${MY_PROJ_NAME} C CXX)
+
+include_directories("${CMAKE_CURRENT_SOURCE_DIR}/../")
+
+# Source files under CURRENT project directory will be automatically included.
+# You can manually set MY_PROJ_SRC to include source files under other directories.
+set(MY_PROJ_SRC
+        "${CMAKE_CURRENT_SOURCE_DIR}/../zookeeper_session_test_base.cpp")
+
+# Search mode for source files under CURRENT project directory?
+# "GLOB_RECURSE" for recursive search
+# "GLOB" for non-recursive search
+set(MY_SRC_SEARCH_MODE "GLOB")
+
+set(MY_PROJ_LIBS
+        dsn.replication.zookeeper_provider
+        dsn_runtime
+        zookeeper
+        hashtable
+        gtest
+        sasl2
+        rocksdb
+        lz4
+        zstd
+        snappy)
+
+set(MY_BOOST_LIBS Boost::system Boost::filesystem)
+
+set(MY_BINPLACES
+        "${CMAKE_CURRENT_SOURCE_DIR}/config-test.ini"
+        "${CMAKE_CURRENT_SOURCE_DIR}/run.sh")
+
+dsn_add_test()

src/zookeeper/test/sasl_auth/config-test.ini

@@ -0,0 +1,80 @@
+; Licensed to the Apache Software Foundation (ASF) under one
+; or more contributor license agreements.  See the NOTICE file
+; distributed with this work for additional information
+; regarding copyright ownership.  The ASF licenses this file
+; to you under the Apache License, Version 2.0 (the
+; "License"); you may not use this file except in compliance
+; with the License.  You may obtain a copy of the License at
+;
+;   http://www.apache.org/licenses/LICENSE-2.0
+;
+; Unless required by applicable law or agreed to in writing,
+; software distributed under the License is distributed on an
+; "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+; KIND, either express or implied.  See the License for the
+; specific language governing permissions and limitations
+; under the License.
+
+[apps..default]
+run = true
+count = 1
+;network.client.RPC_CHANNEL_TCP = dsn::tools::sim_network_provider, 65536
+;network.client.RPC_CHANNEL_UDP = dsn::tools::sim_network_provider, 65536
+;network.server.0.RPC_CHANNEL_TCP = dsn::tools::sim_network_provider, 65536
+
+[apps.client]
+type = test
+arguments =
+run = true
+ports =
+count = 1
+delay_seconds = 1
+pools = THREAD_POOL_DEFAULT
+
+[core]
+;tool = simulator
+tool = nativerun
+
+;toollets = tracer, profiler
+;fault_injector
+pause_on_start = false
+
+logging_start_level = LOG_LEVEL_DEBUG
+logging_factory_name = dsn::tools::simple_logger
+
+[tools.simple_logger]
+fast_flush = true
+short_header = false
+stderr_start_level = LOG_LEVEL_WARNING
+
+[tools.simulator]
+random_seed = 0
+
+[network]
+; how many network threads for network library (used by asio)
+io_service_worker_count = 2
+
+[task..default]
+is_trace = true
+is_profile = true
+allow_inline = false
+rpc_call_channel = RPC_CHANNEL_TCP
+rpc_message_header_format = dsn
+rpc_timeout_milliseconds = 5000
+
+[task.LPC_RPC_TIMEOUT]
+is_trace = false
+is_profile = false
+
+; specification for each thread pool
+[threadpool..default]
+worker_count = 2
+
+[threadpool.THREAD_POOL_DEFAULT]
+partitioned = false
+worker_priority = THREAD_xPRIORITY_NORMAL
+
+[zookeeper]
+hosts_list = localhost:22181
+timeout_ms = 30000
+zoo_log_level = ZOO_LOG_LEVEL_DEBUG

src/zookeeper/test/sasl_auth/main.cpp

@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include <gtest/gtest.h>
+#include <atomic>
+#include <string>
+#include <vector>
+
+#include "runtime/app_model.h"
+#include "runtime/service_app.h"
+#include "utils/error_code.h"
+#include "utils/synchronize.h"
+
+dsn::utils::notify_event g_on_completed;
+std::atomic_int g_test_result{0};
+
+// Mock a service_app which is required by ZookeeperSessionConnector.
+class test_client : public dsn::service_app
+{
+public:
+    explicit test_client(const dsn::service_app_info *info) : dsn::service_app(info) {}
+
+    dsn::error_code start(const std::vector<std::string> &args) override
+    {
+        g_test_result = RUN_ALL_TESTS();
+
+        // All tests have been finished.
+        g_on_completed.notify();
+
+        return ::dsn::ERR_OK;
+    }
+
+    dsn::error_code stop(bool cleanup = false) override { return dsn::ERR_OK; } // NOLINT
+};
+
+GTEST_API_ int main(int argc, char **argv)
+{
+    testing::InitGoogleTest(&argc, argv);
+
+    // Register all services.
+    dsn::service_app::register_factory<test_client>("test");
+
+    dsn_run_config("config-test.ini", false);
+
+    // Wait until all tests are finished.
+    g_on_completed.wait();
+
+#ifndef ENABLE_GCOV
+    dsn_exit(g_test_result);
+#endif
+
+    return g_test_result;
+}