2016-02-02 22:47:02 +00:00
|
|
|
// +build !race
|
2017-09-22 00:51:12 +00:00
|
|
|
// The server tests have a go-metrics/exp manager race condition :(.
|
2016-02-03 13:41:31 +00:00
|
|
|
|
2015-12-11 20:58:10 +00:00
|
|
|
package command
|
|
|
|
|
2016-02-02 22:47:02 +00:00
|
|
|
import (
|
2016-03-14 18:05:47 +00:00
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
|
|
|
"fmt"
|
2016-02-02 22:47:02 +00:00
|
|
|
"io/ioutil"
|
2017-09-22 00:51:12 +00:00
|
|
|
"net"
|
2016-02-02 22:47:02 +00:00
|
|
|
"os"
|
|
|
|
"strings"
|
2016-03-14 18:05:47 +00:00
|
|
|
"sync"
|
2016-02-02 22:47:02 +00:00
|
|
|
"testing"
|
2016-03-14 18:05:47 +00:00
|
|
|
"time"
|
2016-02-02 22:47:02 +00:00
|
|
|
|
2017-08-03 17:24:27 +00:00
|
|
|
"github.com/hashicorp/vault/physical"
|
2016-02-02 22:47:02 +00:00
|
|
|
"github.com/mitchellh/cli"
|
2017-08-03 17:24:27 +00:00
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
physConsul "github.com/hashicorp/vault/physical/consul"
|
2017-08-03 17:24:27 +00:00
|
|
|
physFile "github.com/hashicorp/vault/physical/file"
|
2016-02-02 22:47:02 +00:00
|
|
|
)
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
func testRandomPort(tb testing.TB) int {
|
|
|
|
tb.Helper()
|
2015-12-11 20:58:10 +00:00
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
addr, err := net.ResolveTCPAddr("tcp", "127.0.0.1:0")
|
|
|
|
if err != nil {
|
|
|
|
tb.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
l, err := net.ListenTCP("tcp", addr)
|
|
|
|
if err != nil {
|
|
|
|
tb.Fatal(err)
|
|
|
|
}
|
|
|
|
defer l.Close()
|
|
|
|
|
|
|
|
return l.Addr().(*net.TCPAddr).Port
|
2015-12-11 20:58:10 +00:00
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
func testBaseHCL(tb testing.TB) string {
|
|
|
|
tb.Helper()
|
|
|
|
|
|
|
|
return strings.TrimSpace(fmt.Sprintf(`
|
|
|
|
disable_mlock = true
|
|
|
|
listener "tcp" {
|
|
|
|
address = "127.0.0.1:%d"
|
|
|
|
tls_disable = "true"
|
|
|
|
}
|
|
|
|
`, testRandomPort(tb)))
|
|
|
|
}
|
|
|
|
|
|
|
|
const (
|
|
|
|
consulHCL = `
|
2015-12-11 20:58:10 +00:00
|
|
|
backend "consul" {
|
2017-09-22 00:51:12 +00:00
|
|
|
prefix = "foo/"
|
|
|
|
advertise_addr = "http://127.0.0.1:8200"
|
|
|
|
disable_registration = "true"
|
2015-12-11 20:58:10 +00:00
|
|
|
}
|
|
|
|
`
|
2017-09-22 00:51:12 +00:00
|
|
|
haConsulHCL = `
|
2015-12-11 20:58:10 +00:00
|
|
|
ha_backend "consul" {
|
2017-09-22 00:51:12 +00:00
|
|
|
prefix = "bar/"
|
|
|
|
redirect_addr = "http://127.0.0.1:8200"
|
|
|
|
disable_registration = "true"
|
2015-12-11 20:58:10 +00:00
|
|
|
}
|
|
|
|
`
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
badHAConsulHCL = `
|
2015-12-11 20:58:10 +00:00
|
|
|
ha_backend "file" {
|
2017-09-22 00:51:12 +00:00
|
|
|
path = "/dev/null"
|
2015-12-11 20:58:10 +00:00
|
|
|
}
|
2016-03-14 18:05:47 +00:00
|
|
|
`
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
reloadHCL = `
|
2016-03-14 18:05:47 +00:00
|
|
|
backend "file" {
|
2017-09-22 00:51:12 +00:00
|
|
|
path = "/dev/null"
|
2016-03-14 18:05:47 +00:00
|
|
|
}
|
|
|
|
disable_mlock = true
|
|
|
|
listener "tcp" {
|
2017-09-22 00:51:12 +00:00
|
|
|
address = "127.0.0.1:8203"
|
|
|
|
tls_cert_file = "TMPDIR/reload_cert.pem"
|
|
|
|
tls_key_file = "TMPDIR/reload_key.pem"
|
2016-03-14 18:05:47 +00:00
|
|
|
}
|
2015-12-11 20:58:10 +00:00
|
|
|
`
|
|
|
|
)
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
func testServerCommand(tb testing.TB) (*cli.MockUi, *ServerCommand) {
|
|
|
|
tb.Helper()
|
|
|
|
|
|
|
|
ui := cli.NewMockUi()
|
|
|
|
return ui, &ServerCommand{
|
|
|
|
BaseCommand: &BaseCommand{
|
|
|
|
UI: ui,
|
|
|
|
},
|
|
|
|
ShutdownCh: MakeShutdownCh(),
|
|
|
|
SighupCh: MakeSighupCh(),
|
|
|
|
PhysicalBackends: map[string]physical.Factory{
|
|
|
|
"file": physFile.NewFileBackend,
|
|
|
|
"consul": physConsul.NewConsulBackend,
|
|
|
|
},
|
|
|
|
|
|
|
|
// These prevent us from random sleep guessing...
|
|
|
|
startedCh: make(chan struct{}, 5),
|
|
|
|
reloadedCh: make(chan struct{}, 5),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-14 18:05:47 +00:00
|
|
|
func TestServer_ReloadListener(t *testing.T) {
|
2017-09-22 00:51:12 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
2016-03-14 18:05:47 +00:00
|
|
|
wd, _ := os.Getwd()
|
|
|
|
wd += "/server/test-fixtures/reload/"
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
td, err := ioutil.TempDir("", "vault-test-")
|
2016-03-14 18:05:47 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
defer os.RemoveAll(td)
|
|
|
|
|
|
|
|
wg := &sync.WaitGroup{}
|
|
|
|
|
|
|
|
// Setup initial certs
|
|
|
|
inBytes, _ := ioutil.ReadFile(wd + "reload_foo.pem")
|
2017-07-31 15:28:06 +00:00
|
|
|
ioutil.WriteFile(td+"/reload_cert.pem", inBytes, 0777)
|
2016-03-14 18:05:47 +00:00
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_foo.key")
|
2017-07-31 15:28:06 +00:00
|
|
|
ioutil.WriteFile(td+"/reload_key.pem", inBytes, 0777)
|
2016-03-14 18:05:47 +00:00
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
relhcl := strings.Replace(reloadHCL, "TMPDIR", td, -1)
|
2016-03-14 18:05:47 +00:00
|
|
|
ioutil.WriteFile(td+"/reload.hcl", []byte(relhcl), 0777)
|
|
|
|
|
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_ca.pem")
|
|
|
|
certPool := x509.NewCertPool()
|
|
|
|
ok := certPool.AppendCertsFromPEM(inBytes)
|
|
|
|
if !ok {
|
|
|
|
t.Fatal("not ok when appending CA cert")
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
ui, cmd := testServerCommand(t)
|
|
|
|
_ = ui
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
finished := false
|
|
|
|
finishedMutex := sync.Mutex{}
|
|
|
|
|
|
|
|
wg.Add(1)
|
|
|
|
args := []string{"-config", td + "/reload.hcl"}
|
|
|
|
go func() {
|
2017-09-22 00:51:12 +00:00
|
|
|
if code := cmd.Run(args); code != 0 {
|
2016-03-14 18:05:47 +00:00
|
|
|
t.Error("got a non-zero exit status")
|
|
|
|
}
|
|
|
|
finishedMutex.Lock()
|
|
|
|
finished = true
|
|
|
|
finishedMutex.Unlock()
|
|
|
|
wg.Done()
|
|
|
|
}()
|
|
|
|
|
|
|
|
testCertificateName := func(cn string) error {
|
|
|
|
conn, err := tls.Dial("tcp", "127.0.0.1:8203", &tls.Config{
|
|
|
|
RootCAs: certPool,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
defer conn.Close()
|
|
|
|
if err = conn.Handshake(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
servName := conn.ConnectionState().PeerCertificates[0].Subject.CommonName
|
|
|
|
if servName != cn {
|
|
|
|
return fmt.Errorf("expected %s, got %s", cn, servName)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
select {
|
|
|
|
case <-cmd.startedCh:
|
|
|
|
case <-time.After(5 * time.Second):
|
|
|
|
t.Fatalf("timeout")
|
|
|
|
}
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
if err := testCertificateName("foo.example.com"); err != nil {
|
|
|
|
t.Fatalf("certificate name didn't check out: %s", err)
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
relhcl = strings.Replace(reloadHCL, "TMPDIR", td, -1)
|
2017-07-31 15:28:06 +00:00
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_bar.pem")
|
|
|
|
ioutil.WriteFile(td+"/reload_cert.pem", inBytes, 0777)
|
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_bar.key")
|
|
|
|
ioutil.WriteFile(td+"/reload_key.pem", inBytes, 0777)
|
2016-03-14 18:05:47 +00:00
|
|
|
ioutil.WriteFile(td+"/reload.hcl", []byte(relhcl), 0777)
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
cmd.SighupCh <- struct{}{}
|
|
|
|
select {
|
|
|
|
case <-cmd.reloadedCh:
|
|
|
|
case <-time.After(5 * time.Second):
|
|
|
|
t.Fatalf("timeout")
|
|
|
|
}
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
if err := testCertificateName("bar.example.com"); err != nil {
|
|
|
|
t.Fatalf("certificate name didn't check out: %s", err)
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
cmd.ShutdownCh <- struct{}{}
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
wg.Wait()
|
|
|
|
}
|
2017-09-22 00:51:12 +00:00
|
|
|
|
|
|
|
func TestServer(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
cases := []struct {
|
|
|
|
name string
|
|
|
|
contents string
|
|
|
|
exp string
|
|
|
|
code int
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
"common_ha",
|
|
|
|
testBaseHCL(t) + consulHCL,
|
|
|
|
"(HA available)",
|
|
|
|
0,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"separate_ha",
|
|
|
|
testBaseHCL(t) + consulHCL + haConsulHCL,
|
|
|
|
"HA Storage:",
|
|
|
|
0,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"bad_separate_ha",
|
|
|
|
testBaseHCL(t) + consulHCL + badHAConsulHCL,
|
|
|
|
"Specified HA storage does not support HA",
|
|
|
|
1,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tc := range cases {
|
|
|
|
tc := tc
|
|
|
|
|
|
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
ui, cmd := testServerCommand(t)
|
|
|
|
f, err := ioutil.TempFile("", "")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("error creating temp dir: %v", err)
|
|
|
|
}
|
|
|
|
f.WriteString(tc.contents)
|
|
|
|
f.Close()
|
|
|
|
defer os.Remove(f.Name())
|
|
|
|
|
|
|
|
code := cmd.Run([]string{
|
|
|
|
"-config", f.Name(),
|
|
|
|
"-test-verify-only",
|
|
|
|
})
|
|
|
|
output := ui.ErrorWriter.String() + ui.OutputWriter.String()
|
|
|
|
if code != tc.code {
|
|
|
|
t.Errorf("expected %d to be %d: %s", code, tc.code, output)
|
|
|
|
}
|
|
|
|
|
|
|
|
if !strings.Contains(output, tc.exp) {
|
|
|
|
t.Fatalf("expected %q to contain %q", output, tc.exp)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|