mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-06 14:47:01 +02:00
012cd5a42a
USGv6[0] requires implementing §4.1.1 of the NISTv6-r1 profile[1] for IPv6-Only capabilities. This section requires that whenever Vault displays IPv6 addresses (including CLI output, Web UI, logs, etc.) that _all_ IPv6 addresses must conform to RFC-5952 §4 text representation recommendations[2]. These recommendations do not prevent us from accepting RFC-4241[3] IPv6 addresses, however, whenever these same addresses are displayed they must conform to the strict RFC-5952 §4 guidelines. This PR implements handling of IPv6 address conformance in our `vault server` routine. We handle conformance normalization for all server, http_proxy, listener, seal, storage and telemetry configuration where an input could contain an IPv6 address, whether configured via an HCL file or via corresponding environment variables. The approach I've taken is to handle conformance normalization at parse time to ensure that all log output and subsequent usage inside of Vaults various subsystems always reference a conformant address, that way we don't need concern ourselves with conformance later. This approach ought to be backwards compatible to prior loose address configuration requirements, with the understanding that going forward all IPv6 representation will be strict regardless of what has been configured. In many cases I've updated our various parser functions to call the new `configutil.NormalizeAddr()` to apply conformance normalization. Others required no changes because they rely on standard library URL string output, which always displays IPv6 URLs in a conformant way. Not included in this changes is any other vault exec mode other than server. Client, operator commands, agent mode, proxy mode, etc. will be included in subsequent changes if necessary. [0]: https://www.nist.gov/publications/usgv6-profile [1]: https://www.nist.gov/publications/nist-ipv6-profile [2]: https://www.rfc-editor.org/rfc/rfc5952.html#section-4 [3]: https://www.rfc-editor.org/rfc/rfc4291 Signed-off-by: Ryan Cragun <me@ryan.ec>
97 lines
2.7 KiB
Go
97 lines
2.7 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package configutil
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestNormalizeAddr ensures that strings that match either an IP address or URL
|
|
// and contain an IPv6 address conform to RFC-5942 §4
|
|
// See: https://rfc-editor.org/rfc/rfc5952.html
|
|
func TestNormalizeAddr(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := map[string]struct {
|
|
addr string
|
|
expected string
|
|
isErrorExpected bool
|
|
}{
|
|
"hostname": {
|
|
addr: "https://vaultproject.io:8200",
|
|
expected: "https://vaultproject.io:8200",
|
|
},
|
|
"ipv4": {
|
|
addr: "10.10.1.10",
|
|
expected: "10.10.1.10",
|
|
},
|
|
"ipv4 IP:Port addr": {
|
|
addr: "10.10.1.10:8500",
|
|
expected: "10.10.1.10:8500",
|
|
},
|
|
"ipv4 URL": {
|
|
addr: "https://10.10.1.10:8200",
|
|
expected: "https://10.10.1.10:8200",
|
|
},
|
|
"ipv6 IP:Port addr no brackets": {
|
|
addr: "2001:0db8::0001:8500",
|
|
expected: "2001:db8::1:8500",
|
|
},
|
|
"ipv6 IP:Port addr with brackets": {
|
|
addr: "[2001:0db8::0001]:8500",
|
|
expected: "[2001:db8::1]:8500",
|
|
},
|
|
"ipv6 RFC-5952 4.1 conformance leading zeroes": {
|
|
addr: "2001:0db8::0001",
|
|
expected: "2001:db8::1",
|
|
},
|
|
"ipv6 URL RFC-5952 4.1 conformance leading zeroes": {
|
|
addr: "https://[2001:0db8::0001]:8200",
|
|
expected: "https://[2001:db8::1]:8200",
|
|
},
|
|
"ipv6 RFC-5952 4.2.2 conformance one 16-bit 0 field": {
|
|
addr: "2001:db8:0:1:1:1:1:1",
|
|
expected: "2001:db8:0:1:1:1:1:1",
|
|
},
|
|
"ipv6 URL RFC-5952 4.2.2 conformance one 16-bit 0 field": {
|
|
addr: "https://[2001:db8:0:1:1:1:1:1]:8200",
|
|
expected: "https://[2001:db8:0:1:1:1:1:1]:8200",
|
|
},
|
|
"ipv6 RFC-5952 4.2.3 conformance longest run of 0 bits shortened": {
|
|
addr: "2001:0:0:1:0:0:0:1",
|
|
expected: "2001:0:0:1::1",
|
|
},
|
|
"ipv6 URL RFC-5952 4.2.3 conformance longest run of 0 bits shortened": {
|
|
addr: "https://[2001:0:0:1:0:0:0:1]:8200",
|
|
expected: "https://[2001:0:0:1::1]:8200",
|
|
},
|
|
"ipv6 RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
|
|
addr: "2001:db8:0:0:1:0:0:1",
|
|
expected: "2001:db8::1:0:0:1",
|
|
},
|
|
"ipv6 URL RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
|
|
addr: "https://[2001:db8:0:0:1:0:0:1]:8200",
|
|
expected: "https://[2001:db8::1:0:0:1]:8200",
|
|
},
|
|
"ipv6 RFC-5952 4.3 conformance downcase hex letters": {
|
|
addr: "2001:DB8:AC3:FE4::1",
|
|
expected: "2001:db8:ac3:fe4::1",
|
|
},
|
|
"ipv6 URL RFC-5952 4.3 conformance downcase hex letters": {
|
|
addr: "https://[2001:DB8:AC3:FE4::1]:8200",
|
|
expected: "https://[2001:db8:ac3:fe4::1]:8200",
|
|
},
|
|
}
|
|
for name, tc := range tests {
|
|
name := name
|
|
tc := tc
|
|
t.Run(name, func(t *testing.T) {
|
|
t.Parallel()
|
|
require.Equal(t, tc.expected, NormalizeAddr(tc.addr))
|
|
})
|
|
}
|
|
}
|