2015-04-25 19:56:23 +00:00
|
|
|
package mysql
|
|
|
|
|
|
|
|
import (
|
2018-01-08 18:31:38 +00:00
|
|
|
"context"
|
2018-04-23 17:03:02 +00:00
|
|
|
"database/sql"
|
2015-04-25 19:56:23 +00:00
|
|
|
"fmt"
|
|
|
|
"log"
|
|
|
|
"os"
|
2016-06-11 15:48:40 +00:00
|
|
|
"reflect"
|
2015-04-25 19:56:23 +00:00
|
|
|
"testing"
|
|
|
|
|
2019-04-12 21:54:35 +00:00
|
|
|
logicaltest "github.com/hashicorp/vault/helper/testhelpers/logical"
|
2019-04-13 07:44:06 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2015-04-25 19:56:23 +00:00
|
|
|
"github.com/mitchellh/mapstructure"
|
2018-07-11 21:49:13 +00:00
|
|
|
"github.com/ory/dockertest"
|
2015-04-25 19:56:23 +00:00
|
|
|
)
|
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
func prepareTestContainer(t *testing.T) (func(), string) {
|
|
|
|
if os.Getenv("MYSQL_URL") != "" {
|
|
|
|
return func() {}, os.Getenv("MYSQL_URL")
|
2016-07-01 15:36:28 +00:00
|
|
|
}
|
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
pool, err := dockertest.NewPool("")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Failed to connect to docker: %s", err)
|
|
|
|
}
|
2016-07-01 15:36:28 +00:00
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
resource, err := pool.Run("mysql", "5.7", []string{"MYSQL_ROOT_PASSWORD=secret"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Could not start local MySQL docker container: %s", err)
|
|
|
|
}
|
2016-07-01 15:36:28 +00:00
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
cleanup := func() {
|
|
|
|
err := pool.Purge(resource)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Failed to cleanup local container: %s", err)
|
2016-07-01 15:36:28 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
retURL := fmt.Sprintf("root:secret@(localhost:%s)/mysql?parseTime=true", resource.GetPort("3306/tcp"))
|
2016-07-01 15:36:28 +00:00
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
// exponential backoff-retry
|
|
|
|
if err = pool.Retry(func() error {
|
|
|
|
var err error
|
|
|
|
var db *sql.DB
|
|
|
|
db, err = sql.Open("mysql", retURL)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2018-04-26 15:28:58 +00:00
|
|
|
defer db.Close()
|
2018-04-23 17:03:02 +00:00
|
|
|
return db.Ping()
|
|
|
|
}); err != nil {
|
|
|
|
cleanup()
|
|
|
|
t.Fatalf("Could not connect to MySQL docker container: %s", err)
|
2016-07-01 15:36:28 +00:00
|
|
|
}
|
2018-04-23 17:03:02 +00:00
|
|
|
|
|
|
|
return cleanup, retURL
|
2016-07-01 15:36:28 +00:00
|
|
|
}
|
|
|
|
|
2016-06-11 15:48:40 +00:00
|
|
|
func TestBackend_config_connection(t *testing.T) {
|
|
|
|
var resp *logical.Response
|
|
|
|
var err error
|
|
|
|
config := logical.TestBackendConfig()
|
|
|
|
config.StorageView = &logical.InmemStorage{}
|
2018-01-19 06:44:44 +00:00
|
|
|
b, err := Factory(context.Background(), config)
|
2016-06-11 15:48:40 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
configData := map[string]interface{}{
|
|
|
|
"connection_url": "sample_connection_url",
|
2016-07-20 13:26:26 +00:00
|
|
|
"max_open_connections": 9,
|
|
|
|
"max_idle_connections": 7,
|
2016-06-11 15:48:40 +00:00
|
|
|
"verify_connection": false,
|
|
|
|
}
|
|
|
|
|
|
|
|
configReq := &logical.Request{
|
|
|
|
Operation: logical.UpdateOperation,
|
|
|
|
Path: "config/connection",
|
|
|
|
Storage: config.StorageView,
|
|
|
|
Data: configData,
|
|
|
|
}
|
2018-01-08 18:31:38 +00:00
|
|
|
resp, err = b.HandleRequest(context.Background(), configReq)
|
2016-06-11 15:48:40 +00:00
|
|
|
if err != nil || (resp != nil && resp.IsError()) {
|
|
|
|
t.Fatalf("err:%s resp:%#v\n", err, resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
configReq.Operation = logical.ReadOperation
|
2018-01-08 18:31:38 +00:00
|
|
|
resp, err = b.HandleRequest(context.Background(), configReq)
|
2016-06-11 15:48:40 +00:00
|
|
|
if err != nil || (resp != nil && resp.IsError()) {
|
|
|
|
t.Fatalf("err:%s resp:%#v\n", err, resp)
|
|
|
|
}
|
|
|
|
|
2016-07-19 15:55:49 +00:00
|
|
|
delete(configData, "verify_connection")
|
2018-03-30 14:17:39 +00:00
|
|
|
delete(configData, "connection_url")
|
2016-06-11 15:48:40 +00:00
|
|
|
if !reflect.DeepEqual(configData, resp.Data) {
|
|
|
|
t.Fatalf("bad: expected:%#v\nactual:%#v\n", configData, resp.Data)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-04-25 19:56:23 +00:00
|
|
|
func TestBackend_basic(t *testing.T) {
|
2016-07-01 15:36:28 +00:00
|
|
|
config := logical.TestBackendConfig()
|
|
|
|
config.StorageView = &logical.InmemStorage{}
|
2018-01-19 06:44:44 +00:00
|
|
|
b, err := Factory(context.Background(), config)
|
2016-07-01 15:36:28 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2015-04-25 19:56:23 +00:00
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
cleanup, connURL := prepareTestContainer(t)
|
|
|
|
defer cleanup()
|
|
|
|
|
2016-07-01 15:36:28 +00:00
|
|
|
connData := map[string]interface{}{
|
|
|
|
"connection_url": connURL,
|
2016-02-19 19:59:15 +00:00
|
|
|
}
|
2016-07-01 15:36:28 +00:00
|
|
|
|
2016-10-03 18:53:05 +00:00
|
|
|
// for wildcard based mysql user
|
2015-04-25 19:56:23 +00:00
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
2018-11-07 01:21:24 +00:00
|
|
|
LogicalBackend: b,
|
2015-04-25 19:56:23 +00:00
|
|
|
Steps: []logicaltest.TestStep{
|
2016-07-01 15:36:28 +00:00
|
|
|
testAccStepConfig(t, connData, false),
|
2016-10-03 02:28:54 +00:00
|
|
|
testAccStepRole(t, true),
|
|
|
|
testAccStepReadCreds(t, "web"),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestBackend_basicHostRevoke(t *testing.T) {
|
|
|
|
config := logical.TestBackendConfig()
|
|
|
|
config.StorageView = &logical.InmemStorage{}
|
2018-01-19 06:44:44 +00:00
|
|
|
b, err := Factory(context.Background(), config)
|
2016-10-03 02:28:54 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
cleanup, connURL := prepareTestContainer(t)
|
|
|
|
defer cleanup()
|
|
|
|
|
2016-10-03 02:28:54 +00:00
|
|
|
connData := map[string]interface{}{
|
|
|
|
"connection_url": connURL,
|
|
|
|
}
|
|
|
|
|
2016-10-03 18:53:05 +00:00
|
|
|
// for host based mysql user
|
2016-10-03 02:28:54 +00:00
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
2018-11-07 01:21:24 +00:00
|
|
|
LogicalBackend: b,
|
2016-10-03 02:28:54 +00:00
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepConfig(t, connData, false),
|
|
|
|
testAccStepRole(t, false),
|
2015-04-25 19:56:23 +00:00
|
|
|
testAccStepReadCreds(t, "web"),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
2016-02-19 02:03:47 +00:00
|
|
|
|
2016-07-01 15:36:28 +00:00
|
|
|
func TestBackend_roleCrud(t *testing.T) {
|
|
|
|
config := logical.TestBackendConfig()
|
|
|
|
config.StorageView = &logical.InmemStorage{}
|
2018-01-19 06:44:44 +00:00
|
|
|
b, err := Factory(context.Background(), config)
|
2016-07-01 15:36:28 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
2016-02-18 22:02:59 +00:00
|
|
|
}
|
2016-07-01 15:36:28 +00:00
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
cleanup, connURL := prepareTestContainer(t)
|
|
|
|
defer cleanup()
|
|
|
|
|
2016-07-01 15:36:28 +00:00
|
|
|
connData := map[string]interface{}{
|
|
|
|
"connection_url": connURL,
|
2016-02-18 22:02:59 +00:00
|
|
|
}
|
2015-04-25 19:56:23 +00:00
|
|
|
|
2016-02-18 22:02:59 +00:00
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
2018-11-07 01:21:24 +00:00
|
|
|
LogicalBackend: b,
|
2016-02-18 22:02:59 +00:00
|
|
|
Steps: []logicaltest.TestStep{
|
2016-07-01 15:36:28 +00:00
|
|
|
testAccStepConfig(t, connData, false),
|
2016-10-03 19:58:09 +00:00
|
|
|
// test SQL with wildcard based user
|
|
|
|
testAccStepRole(t, true),
|
2016-10-03 18:53:05 +00:00
|
|
|
testAccStepReadRole(t, "web", testRoleWildCard),
|
2015-04-25 19:56:23 +00:00
|
|
|
testAccStepDeleteRole(t, "web"),
|
2016-10-03 19:58:09 +00:00
|
|
|
// test SQL with host based user
|
|
|
|
testAccStepRole(t, false),
|
|
|
|
testAccStepReadRole(t, "web", testRoleHost),
|
|
|
|
testAccStepDeleteRole(t, "web"),
|
2015-04-25 19:56:23 +00:00
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2015-08-13 19:32:40 +00:00
|
|
|
func TestBackend_leaseWriteRead(t *testing.T) {
|
2016-07-01 15:36:28 +00:00
|
|
|
config := logical.TestBackendConfig()
|
|
|
|
config.StorageView = &logical.InmemStorage{}
|
2018-01-19 06:44:44 +00:00
|
|
|
b, err := Factory(context.Background(), config)
|
2016-07-01 15:36:28 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
2018-04-23 17:03:02 +00:00
|
|
|
cleanup, connURL := prepareTestContainer(t)
|
|
|
|
defer cleanup()
|
|
|
|
|
2016-07-01 15:36:28 +00:00
|
|
|
connData := map[string]interface{}{
|
|
|
|
"connection_url": connURL,
|
2016-02-18 22:02:59 +00:00
|
|
|
}
|
2015-08-13 19:32:40 +00:00
|
|
|
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
2018-11-07 01:21:24 +00:00
|
|
|
LogicalBackend: b,
|
2015-08-13 19:32:40 +00:00
|
|
|
Steps: []logicaltest.TestStep{
|
2016-07-01 15:36:28 +00:00
|
|
|
testAccStepConfig(t, connData, false),
|
2015-08-13 19:32:40 +00:00
|
|
|
testAccStepWriteLease(t),
|
|
|
|
testAccStepReadLease(t),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2016-02-18 22:02:59 +00:00
|
|
|
func testAccStepConfig(t *testing.T, d map[string]interface{}, expectError bool) logicaltest.TestStep {
|
2015-04-25 19:56:23 +00:00
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-04-25 19:56:23 +00:00
|
|
|
Path: "config/connection",
|
2016-02-18 22:02:59 +00:00
|
|
|
Data: d,
|
|
|
|
ErrorOk: true,
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
if expectError {
|
|
|
|
if resp.Data == nil {
|
|
|
|
return fmt.Errorf("data is nil")
|
|
|
|
}
|
|
|
|
var e struct {
|
|
|
|
Error string `mapstructure:"error"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &e); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if len(e.Error) == 0 {
|
2016-10-03 02:28:54 +00:00
|
|
|
return fmt.Errorf("expected error, but write succeeded")
|
2016-02-18 22:02:59 +00:00
|
|
|
}
|
|
|
|
return nil
|
2016-07-01 15:36:28 +00:00
|
|
|
} else if resp != nil && resp.IsError() {
|
|
|
|
return fmt.Errorf("got an error response: %v", resp.Error())
|
2016-02-18 22:02:59 +00:00
|
|
|
}
|
|
|
|
return nil
|
2015-04-25 19:56:23 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-10-03 02:28:54 +00:00
|
|
|
func testAccStepRole(t *testing.T, wildCard bool) logicaltest.TestStep {
|
|
|
|
|
2016-10-03 19:58:09 +00:00
|
|
|
pathData := make(map[string]interface{})
|
2016-10-03 02:28:54 +00:00
|
|
|
if wildCard == true {
|
2016-10-03 19:58:09 +00:00
|
|
|
pathData = map[string]interface{}{
|
|
|
|
"sql": testRoleWildCard,
|
2016-10-03 18:53:05 +00:00
|
|
|
}
|
|
|
|
} else {
|
2016-10-03 19:58:09 +00:00
|
|
|
pathData = map[string]interface{}{
|
2016-10-05 17:52:59 +00:00
|
|
|
"sql": testRoleHost,
|
|
|
|
"revocation_sql": testRevocationSQL,
|
2016-10-03 02:28:54 +00:00
|
|
|
}
|
|
|
|
}
|
2016-10-03 18:53:05 +00:00
|
|
|
|
2015-04-25 19:56:23 +00:00
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-04-25 19:56:23 +00:00
|
|
|
Path: "roles/web",
|
2016-10-03 18:53:05 +00:00
|
|
|
Data: pathData,
|
2015-04-25 19:56:23 +00:00
|
|
|
}
|
2016-10-03 02:28:54 +00:00
|
|
|
|
2015-04-25 19:56:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepDeleteRole(t *testing.T, n string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.DeleteOperation,
|
|
|
|
Path: "roles/" + n,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepReadCreds(t *testing.T, name string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
|
|
|
Path: "creds/" + name,
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
var d struct {
|
|
|
|
Username string `mapstructure:"username"`
|
|
|
|
Password string `mapstructure:"password"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
log.Printf("[WARN] Generated credentials: %v", d)
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepReadRole(t *testing.T, name string, sql string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
|
|
|
Path: "roles/" + name,
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
if resp == nil {
|
|
|
|
if sql == "" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
var d struct {
|
|
|
|
SQL string `mapstructure:"sql"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.SQL != sql {
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-08-13 19:32:40 +00:00
|
|
|
func testAccStepWriteLease(t *testing.T) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-08-13 19:32:40 +00:00
|
|
|
Path: "config/lease",
|
|
|
|
Data: map[string]interface{}{
|
|
|
|
"lease": "1h5m",
|
|
|
|
"lease_max": "24h",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepReadLease(t *testing.T) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
|
|
|
Path: "config/lease",
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
if resp.Data["lease"] != "1h5m0s" || resp.Data["lease_max"] != "24h0m0s" {
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-10-03 02:28:54 +00:00
|
|
|
const testRoleWildCard = `
|
2015-04-25 19:56:23 +00:00
|
|
|
CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
|
|
|
|
GRANT SELECT ON *.* TO '{{name}}'@'%';
|
|
|
|
`
|
2016-10-03 02:28:54 +00:00
|
|
|
const testRoleHost = `
|
|
|
|
CREATE USER '{{name}}'@'10.1.1.2' IDENTIFIED BY '{{password}}';
|
|
|
|
GRANT SELECT ON *.* TO '{{name}}'@'10.1.1.2';
|
|
|
|
`
|
2016-10-05 17:52:59 +00:00
|
|
|
const testRevocationSQL = `
|
2016-10-03 02:28:54 +00:00
|
|
|
REVOKE ALL PRIVILEGES, GRANT OPTION FROM '{{name}}'@'10.1.1.2';
|
|
|
|
DROP USER '{{name}}'@'10.1.1.2';
|
|
|
|
`
|