2023-03-15 16:00:52 +00:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
|
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
|
2020-05-14 13:19:27 +00:00
|
|
|
package server
|
2019-02-28 21:13:56 +00:00
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"fmt"
|
2020-09-15 14:01:26 +00:00
|
|
|
"net/url"
|
2019-02-28 21:13:56 +00:00
|
|
|
"path"
|
|
|
|
"reflect"
|
|
|
|
"testing"
|
|
|
|
"time"
|
|
|
|
|
2019-04-22 16:26:10 +00:00
|
|
|
"github.com/hashicorp/go-uuid"
|
2019-02-28 21:13:56 +00:00
|
|
|
"github.com/hashicorp/vault/api"
|
2020-10-13 23:38:21 +00:00
|
|
|
"github.com/hashicorp/vault/internalshared/configutil"
|
2023-04-24 18:25:50 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/docker"
|
2019-02-28 21:13:56 +00:00
|
|
|
)
|
|
|
|
|
2020-01-11 01:39:52 +00:00
|
|
|
func TestTransitWrapper_Lifecycle(t *testing.T) {
|
2020-09-15 14:01:26 +00:00
|
|
|
cleanup, config := prepareTestContainer(t)
|
2019-02-28 21:13:56 +00:00
|
|
|
defer cleanup()
|
|
|
|
|
2020-01-11 01:39:52 +00:00
|
|
|
wrapperConfig := map[string]string{
|
2020-09-15 14:01:26 +00:00
|
|
|
"address": config.URL().String(),
|
|
|
|
"token": config.token,
|
|
|
|
"mount_path": config.mountPath,
|
|
|
|
"key_name": config.keyName,
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
2020-01-16 18:10:30 +00:00
|
|
|
|
2022-08-23 19:37:16 +00:00
|
|
|
kms, _, err := configutil.GetTransitKMSFunc(&configutil.KMS{Config: wrapperConfig})
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
2020-01-11 01:39:52 +00:00
|
|
|
t.Fatalf("error setting wrapper config: %v", err)
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Test Encrypt and Decrypt calls
|
|
|
|
input := []byte("foo")
|
2020-05-14 13:19:27 +00:00
|
|
|
swi, err := kms.Encrypt(context.Background(), input, nil)
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err.Error())
|
|
|
|
}
|
|
|
|
|
2020-05-14 13:19:27 +00:00
|
|
|
pt, err := kms.Decrypt(context.Background(), swi, nil)
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err.Error())
|
|
|
|
}
|
|
|
|
|
|
|
|
if !reflect.DeepEqual(input, pt) {
|
|
|
|
t.Fatalf("expected %s, got %s", input, pt)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestTransitSeal_TokenRenewal(t *testing.T) {
|
2020-09-15 14:01:26 +00:00
|
|
|
cleanup, config := prepareTestContainer(t)
|
2019-02-28 21:13:56 +00:00
|
|
|
defer cleanup()
|
|
|
|
|
2020-09-15 14:01:26 +00:00
|
|
|
remoteClient, err := api.NewClient(config.apiConfig())
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
2020-09-15 14:01:26 +00:00
|
|
|
remoteClient.SetToken(config.token)
|
2019-02-28 21:13:56 +00:00
|
|
|
|
|
|
|
req := &api.TokenCreateRequest{
|
|
|
|
Period: "5s",
|
|
|
|
}
|
2022-04-07 19:12:58 +00:00
|
|
|
rsp, err := remoteClient.Auth().Token().Create(req)
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
|
2020-01-11 01:39:52 +00:00
|
|
|
wrapperConfig := map[string]string{
|
2020-09-15 14:01:26 +00:00
|
|
|
"address": config.URL().String(),
|
2019-03-07 19:23:30 +00:00
|
|
|
"token": rsp.Auth.ClientToken,
|
2020-09-15 14:01:26 +00:00
|
|
|
"mount_path": config.mountPath,
|
|
|
|
"key_name": config.keyName,
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
2022-08-23 19:37:16 +00:00
|
|
|
kms, _, err := configutil.GetTransitKMSFunc(&configutil.KMS{Config: wrapperConfig})
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
2020-01-11 01:39:52 +00:00
|
|
|
t.Fatalf("error setting wrapper config: %v", err)
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
time.Sleep(7 * time.Second)
|
|
|
|
|
|
|
|
// Test Encrypt and Decrypt calls
|
|
|
|
input := []byte("foo")
|
2020-05-14 13:19:27 +00:00
|
|
|
swi, err := kms.Encrypt(context.Background(), input, nil)
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err.Error())
|
|
|
|
}
|
|
|
|
|
2020-05-14 13:19:27 +00:00
|
|
|
pt, err := kms.Decrypt(context.Background(), swi, nil)
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err.Error())
|
|
|
|
}
|
|
|
|
|
|
|
|
if !reflect.DeepEqual(input, pt) {
|
|
|
|
t.Fatalf("expected %s, got %s", input, pt)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-09-15 14:01:26 +00:00
|
|
|
type DockerVaultConfig struct {
|
|
|
|
docker.ServiceURL
|
|
|
|
token string
|
|
|
|
mountPath string
|
|
|
|
keyName string
|
|
|
|
tlsConfig *api.TLSConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *DockerVaultConfig) apiConfig() *api.Config {
|
|
|
|
vaultConfig := api.DefaultConfig()
|
|
|
|
vaultConfig.Address = c.URL().String()
|
|
|
|
if err := vaultConfig.ConfigureTLS(c.tlsConfig); err != nil {
|
|
|
|
panic("unable to configure TLS")
|
|
|
|
}
|
|
|
|
|
|
|
|
return vaultConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ docker.ServiceConfig = &DockerVaultConfig{}
|
|
|
|
|
|
|
|
func prepareTestContainer(t *testing.T) (func(), *DockerVaultConfig) {
|
|
|
|
rootToken, err := uuid.GenerateUUID()
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
testMountPath, err := uuid.GenerateUUID()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
testKeyName, err := uuid.GenerateUUID()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
|
2020-09-15 14:01:26 +00:00
|
|
|
runner, err := docker.NewServiceRunner(docker.RunOptions{
|
2022-11-02 17:33:17 +00:00
|
|
|
ContainerName: "vault",
|
|
|
|
ImageRepo: "docker.mirror.hashicorp.services/hashicorp/vault",
|
|
|
|
ImageTag: "latest",
|
2021-04-08 16:43:39 +00:00
|
|
|
Cmd: []string{
|
|
|
|
"server", "-log-level=trace", "-dev", fmt.Sprintf("-dev-root-token-id=%s", rootToken),
|
|
|
|
"-dev-listen-address=0.0.0.0:8200",
|
|
|
|
},
|
2020-09-15 14:01:26 +00:00
|
|
|
Ports: []string{"8200/tcp"},
|
|
|
|
})
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
2020-09-15 14:01:26 +00:00
|
|
|
t.Fatalf("could not start docker vault: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
svc, err := runner.StartService(context.Background(), func(ctx context.Context, host string, port int) (docker.ServiceConfig, error) {
|
|
|
|
c := &DockerVaultConfig{
|
|
|
|
ServiceURL: *docker.NewServiceURL(url.URL{Scheme: "http", Host: fmt.Sprintf("%s:%d", host, port)}),
|
|
|
|
tlsConfig: &api.TLSConfig{
|
|
|
|
Insecure: true,
|
|
|
|
},
|
|
|
|
token: rootToken,
|
|
|
|
mountPath: testMountPath,
|
|
|
|
keyName: testKeyName,
|
2020-01-11 01:39:52 +00:00
|
|
|
}
|
2020-09-15 14:01:26 +00:00
|
|
|
vault, err := api.NewClient(c.apiConfig())
|
2019-02-28 21:13:56 +00:00
|
|
|
if err != nil {
|
2020-09-15 14:01:26 +00:00
|
|
|
return nil, err
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
2020-09-15 14:01:26 +00:00
|
|
|
vault.SetToken(rootToken)
|
2019-02-28 21:13:56 +00:00
|
|
|
|
|
|
|
// Set up transit
|
|
|
|
if err := vault.Sys().Mount(testMountPath, &api.MountInput{
|
|
|
|
Type: "transit",
|
|
|
|
}); err != nil {
|
2020-09-15 14:01:26 +00:00
|
|
|
return nil, err
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Create default aesgcm key
|
|
|
|
if _, err := vault.Logical().Write(path.Join(testMountPath, "keys", testKeyName), map[string]interface{}{}); err != nil {
|
2020-09-15 14:01:26 +00:00
|
|
|
return nil, err
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
|
|
|
|
2020-09-15 14:01:26 +00:00
|
|
|
return c, nil
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("could not start docker vault: %s", err)
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|
2020-09-15 14:01:26 +00:00
|
|
|
return svc.Cleanup, svc.Config.(*DockerVaultConfig)
|
2019-02-28 21:13:56 +00:00
|
|
|
}
|