From f501d571714f7686f2541dea44560e9387e3b6d7 Mon Sep 17 00:00:00 2001 From: Ioannis Kakavas Date: Tue, 14 Aug 2018 13:20:35 +0300 Subject: [PATCH 1/2] Mute bwc tests for old versions in FIPS JVMs Elasticsearch versions earlier than 6.4.0 cannot properly run in a FIPS 140 JVM. This commit ensures that we do not try to run bwc tests that entail spinning up < 6.4.0 nodes when CI is run in a FIPS 140 JVM. It also reverts e497173 and e64bb48 as the workarounds inserted there are no longer required. Resolves #32727 --- x-pack/qa/full-cluster-restart/build.gradle | 15 ++++++++++++--- .../with-system-key/build.gradle | 8 -------- x-pack/qa/rolling-upgrade/build.gradle | 15 ++++++++++++--- .../rolling-upgrade/with-system-key/build.gradle | 7 ------- 4 files changed, 24 insertions(+), 21 deletions(-) diff --git a/x-pack/qa/full-cluster-restart/build.gradle b/x-pack/qa/full-cluster-restart/build.gradle index 3cf2970120675..be31b22411ce7 100644 --- a/x-pack/qa/full-cluster-restart/build.gradle +++ b/x-pack/qa/full-cluster-restart/build.gradle @@ -129,8 +129,12 @@ subprojects { .file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks') into outputDir } - - for (Version version : bwcVersions.indexCompatible) { + List indexCompatibleVersions = bwcVersions.indexCompatible + // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them + if (inFipsJvm){ + indexCompatibleVersions.removeAll { it.before("6.4.0")} + } + for (Version version : indexCompatibleVersions) { String baseName = "v${version}" Task oldClusterTest = tasks.create(name: "${baseName}#oldClusterTest", type: RestIntegTestTask) { @@ -240,7 +244,12 @@ subprojects { // basic integ tests includes testing bwc against the most recent version task integTest { if (project.bwc_tests_enabled) { - for (final def version : bwcVersions.snapshotsIndexCompatible) { + List snapshotsIndexCompatibleVersions = bwcVersions.snapshotsWireCompatible + // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them + if (inFipsJvm){ + snapshotsIndexCompatibleVersions.removeAll{ it.before("6.4.0")} + } + for (final def version : snapshotsIndexCompatibleVersions) { dependsOn "v${version}#bwcTest" } } diff --git a/x-pack/qa/full-cluster-restart/with-system-key/build.gradle b/x-pack/qa/full-cluster-restart/with-system-key/build.gradle index 928280b6584bd..e69de29bb2d1d 100644 --- a/x-pack/qa/full-cluster-restart/with-system-key/build.gradle +++ b/x-pack/qa/full-cluster-restart/with-system-key/build.gradle @@ -1,8 +0,0 @@ -import org.elasticsearch.gradle.test.RestIntegTestTask - -// Skip test on FIPS FIXME https://github.com/elastic/elasticsearch/issues/32737 -if (project.inFipsJvm) { - tasks.withType(RestIntegTestTask) { - enabled = false - } -} diff --git a/x-pack/qa/rolling-upgrade/build.gradle b/x-pack/qa/rolling-upgrade/build.gradle index b983caa866937..2457253c33801 100644 --- a/x-pack/qa/rolling-upgrade/build.gradle +++ b/x-pack/qa/rolling-upgrade/build.gradle @@ -111,8 +111,12 @@ subprojects { .file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks') into outputDir } - - for (Version version : bwcVersions.wireCompatible) { + List wireCompatibleVersions = bwcVersions.wireCompatible + // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them + if (inFipsJvm){ + wireCompatibleVersions.removeAll{ it.before("6.4.0")} + } + for (Version version : wireCompatibleVersions) { String baseName = "v${version}" Task oldClusterTest = tasks.create(name: "${baseName}#oldClusterTest", type: RestIntegTestTask) { @@ -276,7 +280,12 @@ subprojects { // basic integ tests includes testing bwc against the most recent version task integTest { if (project.bwc_tests_enabled) { - for (final def version : bwcVersions.snapshotsWireCompatible) { + List snapshotsWireCompatibleVersions = bwcVersions.snapshotsWireCompatible + // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them + if (inFipsJvm){ + snapshotsWireCompatibleVersions.removeAll{ it.before("6.4.0")} + } + for (final def version : snapshotsWireCompatibleVersions) { dependsOn "v${version}#bwcTest" } } diff --git a/x-pack/qa/rolling-upgrade/with-system-key/build.gradle b/x-pack/qa/rolling-upgrade/with-system-key/build.gradle index 5aaa1ed1eff9b..f5639100cc7ee 100644 --- a/x-pack/qa/rolling-upgrade/with-system-key/build.gradle +++ b/x-pack/qa/rolling-upgrade/with-system-key/build.gradle @@ -1,10 +1,3 @@ import org.elasticsearch.gradle.test.RestIntegTestTask -// Skip test on FIPS FIXME https://github.com/elastic/elasticsearch/issues/32737 -if (project.inFipsJvm) { - tasks.withType(RestIntegTestTask) { - enabled = false - } -} - group = "${group}.x-pack.qa.rolling-upgrade.with-system-key" From 5c6154eb0cfeaa4e5c9489b79913575a9941c066 Mon Sep 17 00:00:00 2001 From: Ioannis Kakavas Date: Tue, 14 Aug 2018 15:32:46 +0300 Subject: [PATCH 2/2] Address feedback --- .../gradle/VersionCollection.groovy | 19 ++++++++++++++----- x-pack/qa/full-cluster-restart/build.gradle | 14 ++------------ x-pack/qa/rolling-upgrade/build.gradle | 14 ++------------ 3 files changed, 18 insertions(+), 29 deletions(-) diff --git a/buildSrc/src/main/groovy/org/elasticsearch/gradle/VersionCollection.groovy b/buildSrc/src/main/groovy/org/elasticsearch/gradle/VersionCollection.groovy index 7d5b793254fe4..79a21c8450300 100644 --- a/buildSrc/src/main/groovy/org/elasticsearch/gradle/VersionCollection.groovy +++ b/buildSrc/src/main/groovy/org/elasticsearch/gradle/VersionCollection.groovy @@ -182,10 +182,15 @@ class VersionCollection { * * @return All earlier versions that should be tested for index BWC with the current version. */ - List getIndexCompatible() { + List getIndexCompatible(boolean inFipsJvm = false) { int actualMajor = (currentVersion.major == 5 ? 2 : currentVersion.major - 1) + Version fromVersion = Version.fromString("${actualMajor}.0.0") + // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them + if (inFipsJvm && fromVersion.before("6.4.0")){ + fromVersion = Version.fromString("6.4.0") + } return versionSet - .tailSet(Version.fromString("${actualMajor}.0.0")) + .tailSet(fromVersion) .headSet(currentVersion) .asList() } @@ -217,9 +222,13 @@ class VersionCollection { * * @return All earlier versions that should be tested for wire BWC with the current version. */ - List getWireCompatible() { + List getWireCompatible(boolean inFipsJvm = false) { // Get the last minor of the previous major Version lowerBound = getHighestPreviousMinor(currentVersion.major) + // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them + if (inFipsJvm && Version.fromString("${lowerBound.major}.${lowerBound.minor}.0").before("6.4.0")){ + lowerBound = Version.fromString("6.4.0") + } return versionSet .tailSet(Version.fromString("${lowerBound.major}.${lowerBound.minor}.0")) .headSet(currentVersion) @@ -229,9 +238,9 @@ class VersionCollection { /** * Ensures the types of snapshot are not null and are also in the wire compat list */ - List getSnapshotsWireCompatible() { + List getSnapshotsWireCompatible(boolean inFipsJvm = false) { List compatSnapshots = [] - List allCompatVersions = getWireCompatible() + List allCompatVersions = getWireCompatible(inFipsJvm) if (allCompatVersions.contains(nextMinorSnapshot)) { compatSnapshots.add(nextMinorSnapshot) } diff --git a/x-pack/qa/full-cluster-restart/build.gradle b/x-pack/qa/full-cluster-restart/build.gradle index be31b22411ce7..4a1c242a3deed 100644 --- a/x-pack/qa/full-cluster-restart/build.gradle +++ b/x-pack/qa/full-cluster-restart/build.gradle @@ -129,12 +129,7 @@ subprojects { .file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks') into outputDir } - List indexCompatibleVersions = bwcVersions.indexCompatible - // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them - if (inFipsJvm){ - indexCompatibleVersions.removeAll { it.before("6.4.0")} - } - for (Version version : indexCompatibleVersions) { + for (Version version : bwcVersions.getIndexCompatible(inFipsJvm)) { String baseName = "v${version}" Task oldClusterTest = tasks.create(name: "${baseName}#oldClusterTest", type: RestIntegTestTask) { @@ -244,12 +239,7 @@ subprojects { // basic integ tests includes testing bwc against the most recent version task integTest { if (project.bwc_tests_enabled) { - List snapshotsIndexCompatibleVersions = bwcVersions.snapshotsWireCompatible - // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them - if (inFipsJvm){ - snapshotsIndexCompatibleVersions.removeAll{ it.before("6.4.0")} - } - for (final def version : snapshotsIndexCompatibleVersions) { + for (final def version : bwcVersions.getSnapshotsWireCompatible(inFipsJvm)) { dependsOn "v${version}#bwcTest" } } diff --git a/x-pack/qa/rolling-upgrade/build.gradle b/x-pack/qa/rolling-upgrade/build.gradle index 2457253c33801..623e5b56261ef 100644 --- a/x-pack/qa/rolling-upgrade/build.gradle +++ b/x-pack/qa/rolling-upgrade/build.gradle @@ -111,12 +111,7 @@ subprojects { .file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks') into outputDir } - List wireCompatibleVersions = bwcVersions.wireCompatible - // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them - if (inFipsJvm){ - wireCompatibleVersions.removeAll{ it.before("6.4.0")} - } - for (Version version : wireCompatibleVersions) { + for (Version version : bwcVersions.getWireCompatible(inFipsJvm)) { String baseName = "v${version}" Task oldClusterTest = tasks.create(name: "${baseName}#oldClusterTest", type: RestIntegTestTask) { @@ -280,12 +275,7 @@ subprojects { // basic integ tests includes testing bwc against the most recent version task integTest { if (project.bwc_tests_enabled) { - List snapshotsWireCompatibleVersions = bwcVersions.snapshotsWireCompatible - // Versions before 6.4.0 cannot be run in a FIPS 140 JVM, so exclude them - if (inFipsJvm){ - snapshotsWireCompatibleVersions.removeAll{ it.before("6.4.0")} - } - for (final def version : snapshotsWireCompatibleVersions) { + for (final def version : bwcVersions.getSnapshotsWireCompatible(inFipsJvm)) { dependsOn "v${version}#bwcTest" } }