2656c020ae
* Move seal barrier type field from Access to autoSeal struct. Remove method Access.SetType(), which was only being used by a single test, and which can use the name option of NewTestSeal() to specify the type. * Change method signatures of Access to match those of Wrapper. * Turn seal.Access struct into an interface. * Tweak Access implementation. Change `access` struct to have a field of type wrapping.Wrapper, rather than extending it. * Add method Seal.GetShamirWrapper(). Add method Seal.GetShamirWrapper() for use by code that need to perform Shamir-specific operations.
79 lines
2.2 KiB
Go
79 lines
2.2 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package sealhelper
|
|
|
|
import (
|
|
"path"
|
|
"strconv"
|
|
|
|
"github.com/hashicorp/go-hclog"
|
|
"github.com/hashicorp/vault/api"
|
|
"github.com/hashicorp/vault/builtin/logical/transit"
|
|
"github.com/hashicorp/vault/helper/testhelpers/teststorage"
|
|
"github.com/hashicorp/vault/http"
|
|
"github.com/hashicorp/vault/internalshared/configutil"
|
|
"github.com/hashicorp/vault/sdk/helper/logging"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
"github.com/hashicorp/vault/vault"
|
|
"github.com/hashicorp/vault/vault/seal"
|
|
"github.com/mitchellh/go-testing-interface"
|
|
)
|
|
|
|
type TransitSealServer struct {
|
|
*vault.TestCluster
|
|
}
|
|
|
|
func NewTransitSealServer(t testing.T, idx int) *TransitSealServer {
|
|
conf := &vault.CoreConfig{
|
|
LogicalBackends: map[string]logical.Factory{
|
|
"transit": transit.Factory,
|
|
},
|
|
}
|
|
opts := &vault.TestClusterOptions{
|
|
NumCores: 1,
|
|
HandlerFunc: http.Handler,
|
|
Logger: logging.NewVaultLogger(hclog.Trace).Named(t.Name()).Named("transit-seal" + strconv.Itoa(idx)),
|
|
}
|
|
teststorage.InmemBackendSetup(conf, opts)
|
|
cluster := vault.NewTestCluster(t, conf, opts)
|
|
cluster.Start()
|
|
|
|
if err := cluster.Cores[0].Client.Sys().Mount("transit", &api.MountInput{
|
|
Type: "transit",
|
|
}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
return &TransitSealServer{cluster}
|
|
}
|
|
|
|
func (tss *TransitSealServer) MakeKey(t testing.T, key string) {
|
|
client := tss.Cores[0].Client
|
|
if _, err := client.Logical().Write(path.Join("transit", "keys", key), nil); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := client.Logical().Write(path.Join("transit", "keys", key, "config"), map[string]interface{}{
|
|
"deletion_allowed": true,
|
|
}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func (tss *TransitSealServer) MakeSeal(t testing.T, key string) (vault.Seal, error) {
|
|
client := tss.Cores[0].Client
|
|
wrapperConfig := map[string]string{
|
|
"address": client.Address(),
|
|
"token": client.Token(),
|
|
"mount_path": "transit",
|
|
"key_name": key,
|
|
"tls_ca_cert": tss.CACertPEMFile,
|
|
}
|
|
transitSeal, _, err := configutil.GetTransitKMSFunc(&configutil.KMS{Config: wrapperConfig})
|
|
if err != nil {
|
|
t.Fatalf("error setting wrapper config: %v", err)
|
|
}
|
|
|
|
return vault.NewAutoSeal(seal.NewAccess(transitSeal))
|
|
}
|