2018-06-13 08:40:03 +00:00
|
|
|
package ca
|
|
|
|
|
|
|
|
import (
|
2018-06-14 21:20:10 +00:00
|
|
|
"fmt"
|
2018-06-13 08:40:03 +00:00
|
|
|
"io/ioutil"
|
2018-06-14 17:56:17 +00:00
|
|
|
"net"
|
2018-06-13 08:40:03 +00:00
|
|
|
"testing"
|
2018-06-14 21:20:10 +00:00
|
|
|
"time"
|
2018-06-13 08:40:03 +00:00
|
|
|
|
|
|
|
"github.com/hashicorp/consul/agent/connect"
|
2018-06-14 17:56:17 +00:00
|
|
|
vaultapi "github.com/hashicorp/vault/api"
|
2018-06-13 08:40:03 +00:00
|
|
|
"github.com/hashicorp/vault/builtin/logical/pki"
|
|
|
|
vaulthttp "github.com/hashicorp/vault/http"
|
|
|
|
"github.com/hashicorp/vault/vault"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
)
|
|
|
|
|
2018-06-14 17:56:17 +00:00
|
|
|
func testVaultCluster(t *testing.T) (*VaultProvider, *vault.Core, net.Listener) {
|
2018-07-16 09:46:10 +00:00
|
|
|
return testVaultClusterWithConfig(t, nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
func testVaultClusterWithConfig(t *testing.T, rawConf map[string]interface{}) (*VaultProvider, *vault.Core, net.Listener) {
|
2018-06-14 17:56:17 +00:00
|
|
|
if err := vault.AddTestLogicalBackend("pki", pki.Factory); err != nil {
|
|
|
|
t.Fatal(err)
|
2018-06-13 08:40:03 +00:00
|
|
|
}
|
2018-06-14 17:56:17 +00:00
|
|
|
core, _, token := vault.TestCoreUnsealedRaw(t)
|
2018-06-13 08:40:03 +00:00
|
|
|
|
2018-06-14 17:56:17 +00:00
|
|
|
ln, addr := vaulthttp.TestServer(t, core)
|
2018-06-13 08:40:03 +00:00
|
|
|
|
2018-07-16 09:46:10 +00:00
|
|
|
conf := map[string]interface{}{
|
2018-06-14 17:56:17 +00:00
|
|
|
"Address": addr,
|
|
|
|
"Token": token,
|
2018-06-13 08:40:03 +00:00
|
|
|
"RootPKIPath": "pki-root/",
|
|
|
|
"IntermediatePKIPath": "pki-intermediate/",
|
2018-07-16 09:46:10 +00:00
|
|
|
}
|
|
|
|
for k, v := range rawConf {
|
|
|
|
conf[k] = v
|
|
|
|
}
|
|
|
|
|
|
|
|
provider, err := NewVaultProvider(conf, "asdf")
|
2018-06-13 08:40:03 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
2018-06-14 17:56:17 +00:00
|
|
|
return provider, core, ln
|
2018-06-13 08:40:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestVaultCAProvider_Bootstrap(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-14 17:56:17 +00:00
|
|
|
provider, core, listener := testVaultCluster(t)
|
|
|
|
defer core.Shutdown()
|
|
|
|
defer listener.Close()
|
|
|
|
client, err := vaultapi.NewClient(&vaultapi.Config{
|
|
|
|
Address: "http://" + listener.Addr().String(),
|
|
|
|
})
|
|
|
|
require.NoError(err)
|
|
|
|
client.SetToken(provider.config.Token)
|
2018-06-13 08:40:03 +00:00
|
|
|
|
|
|
|
cases := []struct {
|
|
|
|
certFunc func() (string, error)
|
|
|
|
backendPath string
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
certFunc: provider.ActiveRoot,
|
|
|
|
backendPath: "pki-root/",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
certFunc: provider.ActiveIntermediate,
|
|
|
|
backendPath: "pki-intermediate/",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
// Verify the root and intermediate certs match the ones in the vault backends
|
|
|
|
for _, tc := range cases {
|
|
|
|
cert, err := tc.certFunc()
|
|
|
|
require.NoError(err)
|
2018-06-14 17:56:17 +00:00
|
|
|
req := client.NewRequest("GET", "/v1/"+tc.backendPath+"ca/pem")
|
2018-06-13 08:40:03 +00:00
|
|
|
resp, err := client.RawRequest(req)
|
|
|
|
require.NoError(err)
|
|
|
|
bytes, err := ioutil.ReadAll(resp.Body)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(cert, string(bytes))
|
|
|
|
|
2018-06-14 17:56:17 +00:00
|
|
|
// Should be a valid CA cert
|
2018-06-13 08:40:03 +00:00
|
|
|
parsed, err := connect.ParseCert(cert)
|
|
|
|
require.NoError(err)
|
2018-06-14 17:56:17 +00:00
|
|
|
require.True(parsed.IsCA)
|
2018-06-14 21:20:10 +00:00
|
|
|
require.Len(parsed.URIs, 1)
|
|
|
|
require.Equal(parsed.URIs[0].String(), fmt.Sprintf("spiffe://%s.consul", provider.clusterId))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestVaultCAProvider_SignLeaf(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-07-16 09:46:10 +00:00
|
|
|
provider, core, listener := testVaultClusterWithConfig(t, map[string]interface{}{
|
|
|
|
"LeafCertTTL": "1h",
|
|
|
|
})
|
2018-06-14 21:20:10 +00:00
|
|
|
defer core.Shutdown()
|
|
|
|
defer listener.Close()
|
|
|
|
client, err := vaultapi.NewClient(&vaultapi.Config{
|
|
|
|
Address: "http://" + listener.Addr().String(),
|
|
|
|
})
|
|
|
|
require.NoError(err)
|
|
|
|
client.SetToken(provider.config.Token)
|
|
|
|
|
|
|
|
spiffeService := &connect.SpiffeIDService{
|
|
|
|
Host: "node1",
|
|
|
|
Namespace: "default",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Service: "foo",
|
|
|
|
}
|
|
|
|
|
|
|
|
// Generate a leaf cert for the service.
|
|
|
|
var firstSerial uint64
|
|
|
|
{
|
|
|
|
raw, _ := connect.TestCSR(t, spiffeService)
|
|
|
|
|
|
|
|
csr, err := connect.ParseCSR(raw)
|
|
|
|
require.NoError(err)
|
|
|
|
|
|
|
|
cert, err := provider.Sign(csr)
|
|
|
|
require.NoError(err)
|
|
|
|
|
|
|
|
parsed, err := connect.ParseCert(cert)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(parsed.URIs[0], spiffeService.URI())
|
|
|
|
firstSerial = parsed.SerialNumber.Uint64()
|
|
|
|
|
|
|
|
// Ensure the cert is valid now and expires within the correct limit.
|
2018-07-16 09:46:10 +00:00
|
|
|
now := time.Now()
|
|
|
|
require.True(parsed.NotAfter.Sub(now) < time.Hour)
|
|
|
|
require.True(parsed.NotBefore.Before(now))
|
2018-06-14 21:20:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Generate a new cert for another service and make sure
|
|
|
|
// the serial number is unique.
|
|
|
|
spiffeService.Service = "bar"
|
|
|
|
{
|
|
|
|
raw, _ := connect.TestCSR(t, spiffeService)
|
|
|
|
|
|
|
|
csr, err := connect.ParseCSR(raw)
|
|
|
|
require.NoError(err)
|
|
|
|
|
|
|
|
cert, err := provider.Sign(csr)
|
|
|
|
require.NoError(err)
|
|
|
|
|
|
|
|
parsed, err := connect.ParseCert(cert)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(parsed.URIs[0], spiffeService.URI())
|
|
|
|
require.NotEqual(firstSerial, parsed.SerialNumber.Uint64())
|
|
|
|
|
|
|
|
// Ensure the cert is valid now and expires within the correct limit.
|
2018-07-26 00:51:45 +00:00
|
|
|
require.True(parsed.NotAfter.Sub(time.Now()) < time.Hour)
|
2018-06-14 21:20:10 +00:00
|
|
|
require.True(parsed.NotBefore.Before(time.Now()))
|
2018-06-13 08:40:03 +00:00
|
|
|
}
|
|
|
|
}
|
2018-06-15 23:25:53 +00:00
|
|
|
|
|
|
|
func TestVaultCAProvider_CrossSignCA(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
provider1, core1, listener1 := testVaultCluster(t)
|
|
|
|
defer core1.Shutdown()
|
|
|
|
defer listener1.Close()
|
|
|
|
|
|
|
|
provider2, core2, listener2 := testVaultCluster(t)
|
|
|
|
defer core2.Shutdown()
|
|
|
|
defer listener2.Close()
|
|
|
|
|
2018-06-19 23:46:18 +00:00
|
|
|
testCrossSignProviders(t, provider1, provider2)
|
2018-06-15 23:25:53 +00:00
|
|
|
}
|