2021-05-31 16:08:10 +00:00
|
|
|
// +build !race,!hsm
|
2018-08-24 16:09:03 +00:00
|
|
|
|
|
|
|
// NOTE: we can't use this with HSM. We can't set testing mode on and it's not
|
|
|
|
// safe to use env vars since that provides an attack vector in the real world.
|
|
|
|
//
|
2017-09-22 00:51:12 +00:00
|
|
|
// The server tests have a go-metrics/exp manager race condition :(.
|
2016-02-03 13:41:31 +00:00
|
|
|
|
2015-12-11 20:58:10 +00:00
|
|
|
package command
|
|
|
|
|
2016-02-02 22:47:02 +00:00
|
|
|
import (
|
2016-03-14 18:05:47 +00:00
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
|
|
|
"fmt"
|
2016-02-02 22:47:02 +00:00
|
|
|
"io/ioutil"
|
|
|
|
"os"
|
|
|
|
"strings"
|
2016-03-14 18:05:47 +00:00
|
|
|
"sync"
|
2016-02-02 22:47:02 +00:00
|
|
|
"testing"
|
2016-03-14 18:05:47 +00:00
|
|
|
"time"
|
2016-02-02 22:47:02 +00:00
|
|
|
|
2019-04-12 21:54:35 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/physical"
|
|
|
|
physInmem "github.com/hashicorp/vault/sdk/physical/inmem"
|
2016-02-02 22:47:02 +00:00
|
|
|
"github.com/mitchellh/cli"
|
|
|
|
)
|
|
|
|
|
2021-05-31 16:08:10 +00:00
|
|
|
func init() {
|
|
|
|
if signed := os.Getenv("VAULT_LICENSE_CI"); signed != "" {
|
2021-06-07 18:44:20 +00:00
|
|
|
os.Setenv(EnvVaultLicense, signed)
|
2021-05-31 16:08:10 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-05-10 17:41:42 +00:00
|
|
|
func testBaseHCL(tb testing.TB, listenerExtras string) string {
|
2017-09-22 00:51:12 +00:00
|
|
|
tb.Helper()
|
|
|
|
|
|
|
|
return strings.TrimSpace(fmt.Sprintf(`
|
|
|
|
disable_mlock = true
|
|
|
|
listener "tcp" {
|
2019-05-10 17:41:42 +00:00
|
|
|
address = "127.0.0.1:%d"
|
|
|
|
tls_disable = "true"
|
|
|
|
%s
|
2017-09-22 00:51:12 +00:00
|
|
|
}
|
2019-10-30 14:36:23 +00:00
|
|
|
`, 0, listenerExtras))
|
2017-09-22 00:51:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
const (
|
2019-05-10 17:41:42 +00:00
|
|
|
goodListenerTimeouts = `http_read_header_timeout = 12
|
|
|
|
http_read_timeout = "34s"
|
|
|
|
http_write_timeout = "56m"
|
|
|
|
http_idle_timeout = "78h"`
|
|
|
|
|
|
|
|
badListenerReadHeaderTimeout = `http_read_header_timeout = "12km"`
|
|
|
|
badListenerReadTimeout = `http_read_timeout = "34日"`
|
|
|
|
badListenerWriteTimeout = `http_write_timeout = "56lbs"`
|
|
|
|
badListenerIdleTimeout = `http_idle_timeout = "78gophers"`
|
|
|
|
|
2018-09-26 21:52:11 +00:00
|
|
|
inmemHCL = `
|
|
|
|
backend "inmem_ha" {
|
2017-09-22 00:51:12 +00:00
|
|
|
advertise_addr = "http://127.0.0.1:8200"
|
2015-12-11 20:58:10 +00:00
|
|
|
}
|
|
|
|
`
|
2018-09-26 21:52:11 +00:00
|
|
|
haInmemHCL = `
|
|
|
|
ha_backend "inmem_ha" {
|
2017-09-22 00:51:12 +00:00
|
|
|
redirect_addr = "http://127.0.0.1:8200"
|
2015-12-11 20:58:10 +00:00
|
|
|
}
|
|
|
|
`
|
|
|
|
|
2018-09-26 21:52:11 +00:00
|
|
|
badHAInmemHCL = `
|
|
|
|
ha_backend "inmem" {}
|
2016-03-14 18:05:47 +00:00
|
|
|
`
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
reloadHCL = `
|
2018-09-26 21:52:11 +00:00
|
|
|
backend "inmem" {}
|
2016-03-14 18:05:47 +00:00
|
|
|
disable_mlock = true
|
|
|
|
listener "tcp" {
|
2017-09-22 00:51:12 +00:00
|
|
|
address = "127.0.0.1:8203"
|
|
|
|
tls_cert_file = "TMPDIR/reload_cert.pem"
|
|
|
|
tls_key_file = "TMPDIR/reload_key.pem"
|
2016-03-14 18:05:47 +00:00
|
|
|
}
|
2015-12-11 20:58:10 +00:00
|
|
|
`
|
|
|
|
)
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
func testServerCommand(tb testing.TB) (*cli.MockUi, *ServerCommand) {
|
|
|
|
tb.Helper()
|
|
|
|
|
|
|
|
ui := cli.NewMockUi()
|
|
|
|
return ui, &ServerCommand{
|
|
|
|
BaseCommand: &BaseCommand{
|
|
|
|
UI: ui,
|
|
|
|
},
|
|
|
|
ShutdownCh: MakeShutdownCh(),
|
|
|
|
SighupCh: MakeSighupCh(),
|
2019-03-15 13:27:53 +00:00
|
|
|
SigUSR2Ch: MakeSigUSR2Ch(),
|
2017-09-22 00:51:12 +00:00
|
|
|
PhysicalBackends: map[string]physical.Factory{
|
2018-09-26 21:52:11 +00:00
|
|
|
"inmem": physInmem.NewInmem,
|
|
|
|
"inmem_ha": physInmem.NewInmemHA,
|
2017-09-22 00:51:12 +00:00
|
|
|
},
|
|
|
|
|
|
|
|
// These prevent us from random sleep guessing...
|
|
|
|
startedCh: make(chan struct{}, 5),
|
|
|
|
reloadedCh: make(chan struct{}, 5),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-14 18:05:47 +00:00
|
|
|
func TestServer_ReloadListener(t *testing.T) {
|
2017-09-22 00:51:12 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
2016-03-14 18:05:47 +00:00
|
|
|
wd, _ := os.Getwd()
|
|
|
|
wd += "/server/test-fixtures/reload/"
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
td, err := ioutil.TempDir("", "vault-test-")
|
2016-03-14 18:05:47 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
defer os.RemoveAll(td)
|
|
|
|
|
|
|
|
wg := &sync.WaitGroup{}
|
|
|
|
|
|
|
|
// Setup initial certs
|
|
|
|
inBytes, _ := ioutil.ReadFile(wd + "reload_foo.pem")
|
2021-04-08 16:43:39 +00:00
|
|
|
ioutil.WriteFile(td+"/reload_cert.pem", inBytes, 0o777)
|
2016-03-14 18:05:47 +00:00
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_foo.key")
|
2021-04-08 16:43:39 +00:00
|
|
|
ioutil.WriteFile(td+"/reload_key.pem", inBytes, 0o777)
|
2016-03-14 18:05:47 +00:00
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
relhcl := strings.Replace(reloadHCL, "TMPDIR", td, -1)
|
2021-04-08 16:43:39 +00:00
|
|
|
ioutil.WriteFile(td+"/reload.hcl", []byte(relhcl), 0o777)
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_ca.pem")
|
|
|
|
certPool := x509.NewCertPool()
|
|
|
|
ok := certPool.AppendCertsFromPEM(inBytes)
|
|
|
|
if !ok {
|
|
|
|
t.Fatal("not ok when appending CA cert")
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
ui, cmd := testServerCommand(t)
|
|
|
|
_ = ui
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
wg.Add(1)
|
|
|
|
args := []string{"-config", td + "/reload.hcl"}
|
|
|
|
go func() {
|
2017-09-22 00:51:12 +00:00
|
|
|
if code := cmd.Run(args); code != 0 {
|
2018-04-05 16:54:15 +00:00
|
|
|
output := ui.ErrorWriter.String() + ui.OutputWriter.String()
|
|
|
|
t.Errorf("got a non-zero exit status: %s", output)
|
2016-03-14 18:05:47 +00:00
|
|
|
}
|
|
|
|
wg.Done()
|
|
|
|
}()
|
|
|
|
|
|
|
|
testCertificateName := func(cn string) error {
|
|
|
|
conn, err := tls.Dial("tcp", "127.0.0.1:8203", &tls.Config{
|
|
|
|
RootCAs: certPool,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
defer conn.Close()
|
|
|
|
if err = conn.Handshake(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
servName := conn.ConnectionState().PeerCertificates[0].Subject.CommonName
|
|
|
|
if servName != cn {
|
|
|
|
return fmt.Errorf("expected %s, got %s", cn, servName)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
select {
|
|
|
|
case <-cmd.startedCh:
|
|
|
|
case <-time.After(5 * time.Second):
|
|
|
|
t.Fatalf("timeout")
|
|
|
|
}
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
if err := testCertificateName("foo.example.com"); err != nil {
|
|
|
|
t.Fatalf("certificate name didn't check out: %s", err)
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
relhcl = strings.Replace(reloadHCL, "TMPDIR", td, -1)
|
2017-07-31 15:28:06 +00:00
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_bar.pem")
|
2021-04-08 16:43:39 +00:00
|
|
|
ioutil.WriteFile(td+"/reload_cert.pem", inBytes, 0o777)
|
2017-07-31 15:28:06 +00:00
|
|
|
inBytes, _ = ioutil.ReadFile(wd + "reload_bar.key")
|
2021-04-08 16:43:39 +00:00
|
|
|
ioutil.WriteFile(td+"/reload_key.pem", inBytes, 0o777)
|
|
|
|
ioutil.WriteFile(td+"/reload.hcl", []byte(relhcl), 0o777)
|
2016-03-14 18:05:47 +00:00
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
cmd.SighupCh <- struct{}{}
|
|
|
|
select {
|
|
|
|
case <-cmd.reloadedCh:
|
|
|
|
case <-time.After(5 * time.Second):
|
|
|
|
t.Fatalf("timeout")
|
|
|
|
}
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
if err := testCertificateName("bar.example.com"); err != nil {
|
|
|
|
t.Fatalf("certificate name didn't check out: %s", err)
|
|
|
|
}
|
|
|
|
|
2017-09-22 00:51:12 +00:00
|
|
|
cmd.ShutdownCh <- struct{}{}
|
2016-03-14 18:05:47 +00:00
|
|
|
|
|
|
|
wg.Wait()
|
|
|
|
}
|
2017-09-22 00:51:12 +00:00
|
|
|
|
|
|
|
func TestServer(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
cases := []struct {
|
|
|
|
name string
|
|
|
|
contents string
|
|
|
|
exp string
|
|
|
|
code int
|
2019-05-10 17:41:42 +00:00
|
|
|
flag string
|
2017-09-22 00:51:12 +00:00
|
|
|
}{
|
|
|
|
{
|
|
|
|
"common_ha",
|
2019-05-10 17:41:42 +00:00
|
|
|
testBaseHCL(t, "") + inmemHCL,
|
2017-09-22 00:51:12 +00:00
|
|
|
"(HA available)",
|
|
|
|
0,
|
2019-05-10 17:41:42 +00:00
|
|
|
"-test-verify-only",
|
2017-09-22 00:51:12 +00:00
|
|
|
},
|
|
|
|
{
|
|
|
|
"separate_ha",
|
2019-05-10 17:41:42 +00:00
|
|
|
testBaseHCL(t, "") + inmemHCL + haInmemHCL,
|
2017-09-22 00:51:12 +00:00
|
|
|
"HA Storage:",
|
|
|
|
0,
|
2019-05-10 17:41:42 +00:00
|
|
|
"-test-verify-only",
|
2017-09-22 00:51:12 +00:00
|
|
|
},
|
|
|
|
{
|
|
|
|
"bad_separate_ha",
|
2019-05-10 17:41:42 +00:00
|
|
|
testBaseHCL(t, "") + inmemHCL + badHAInmemHCL,
|
2017-09-22 00:51:12 +00:00
|
|
|
"Specified HA storage does not support HA",
|
|
|
|
1,
|
2019-05-10 17:41:42 +00:00
|
|
|
"-test-verify-only",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"good_listener_timeout_config",
|
|
|
|
testBaseHCL(t, goodListenerTimeouts) + inmemHCL,
|
|
|
|
"",
|
|
|
|
0,
|
|
|
|
"-test-server-config",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"bad_listener_read_header_timeout_config",
|
|
|
|
testBaseHCL(t, badListenerReadHeaderTimeout) + inmemHCL,
|
2020-10-30 20:44:06 +00:00
|
|
|
"unknown unit \"km\" in duration \"12km\"",
|
2019-05-10 17:41:42 +00:00
|
|
|
1,
|
|
|
|
"-test-server-config",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"bad_listener_read_timeout_config",
|
|
|
|
testBaseHCL(t, badListenerReadTimeout) + inmemHCL,
|
2020-05-14 13:19:27 +00:00
|
|
|
"parsing \"34日\": invalid syntax",
|
2019-05-10 17:41:42 +00:00
|
|
|
1,
|
|
|
|
"-test-server-config",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"bad_listener_write_timeout_config",
|
|
|
|
testBaseHCL(t, badListenerWriteTimeout) + inmemHCL,
|
2020-10-30 20:44:06 +00:00
|
|
|
"unknown unit \"lbs\" in duration \"56lbs\"",
|
2019-05-10 17:41:42 +00:00
|
|
|
1,
|
|
|
|
"-test-server-config",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"bad_listener_idle_timeout_config",
|
|
|
|
testBaseHCL(t, badListenerIdleTimeout) + inmemHCL,
|
2020-10-30 20:44:06 +00:00
|
|
|
"unknown unit \"gophers\" in duration \"78gophers\"",
|
2019-05-10 17:41:42 +00:00
|
|
|
1,
|
|
|
|
"-test-server-config",
|
2017-09-22 00:51:12 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tc := range cases {
|
|
|
|
tc := tc
|
|
|
|
|
|
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
ui, cmd := testServerCommand(t)
|
|
|
|
f, err := ioutil.TempFile("", "")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("error creating temp dir: %v", err)
|
|
|
|
}
|
|
|
|
f.WriteString(tc.contents)
|
|
|
|
f.Close()
|
|
|
|
defer os.Remove(f.Name())
|
|
|
|
|
|
|
|
code := cmd.Run([]string{
|
|
|
|
"-config", f.Name(),
|
2019-05-10 17:41:42 +00:00
|
|
|
tc.flag,
|
2017-09-22 00:51:12 +00:00
|
|
|
})
|
|
|
|
output := ui.ErrorWriter.String() + ui.OutputWriter.String()
|
|
|
|
if code != tc.code {
|
|
|
|
t.Errorf("expected %d to be %d: %s", code, tc.code, output)
|
|
|
|
}
|
|
|
|
|
|
|
|
if !strings.Contains(output, tc.exp) {
|
|
|
|
t.Fatalf("expected %q to contain %q", output, tc.exp)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|