mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-06 14:47:01 +02:00
012cd5a42a
USGv6[0] requires implementing §4.1.1 of the NISTv6-r1 profile[1] for IPv6-Only capabilities. This section requires that whenever Vault displays IPv6 addresses (including CLI output, Web UI, logs, etc.) that _all_ IPv6 addresses must conform to RFC-5952 §4 text representation recommendations[2]. These recommendations do not prevent us from accepting RFC-4241[3] IPv6 addresses, however, whenever these same addresses are displayed they must conform to the strict RFC-5952 §4 guidelines. This PR implements handling of IPv6 address conformance in our `vault server` routine. We handle conformance normalization for all server, http_proxy, listener, seal, storage and telemetry configuration where an input could contain an IPv6 address, whether configured via an HCL file or via corresponding environment variables. The approach I've taken is to handle conformance normalization at parse time to ensure that all log output and subsequent usage inside of Vaults various subsystems always reference a conformant address, that way we don't need concern ourselves with conformance later. This approach ought to be backwards compatible to prior loose address configuration requirements, with the understanding that going forward all IPv6 representation will be strict regardless of what has been configured. In many cases I've updated our various parser functions to call the new `configutil.NormalizeAddr()` to apply conformance normalization. Others required no changes because they rely on standard library URL string output, which always displays IPv6 URLs in a conformant way. Not included in this changes is any other vault exec mode other than server. Client, operator commands, agent mode, proxy mode, etc. will be included in subsequent changes if necessary. [0]: https://www.nist.gov/publications/usgv6-profile [1]: https://www.nist.gov/publications/nist-ipv6-profile [2]: https://www.rfc-editor.org/rfc/rfc5952.html#section-4 [3]: https://www.rfc-editor.org/rfc/rfc4291 Signed-off-by: Ryan Cragun <me@ryan.ec>
102 lines
2.6 KiB
Go
102 lines
2.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package configutil
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestParsePrefixFilters(t *testing.T) {
|
|
t.Parallel()
|
|
cases := []struct {
|
|
inputFilters []string
|
|
expectedErrStr string
|
|
expectedAllowedPrefixes []string
|
|
expectedBlockedPrefixes []string
|
|
}{
|
|
{
|
|
[]string{""},
|
|
"Cannot have empty filter rule in prefix_filter",
|
|
[]string(nil),
|
|
[]string(nil),
|
|
},
|
|
{
|
|
[]string{"vault.abc"},
|
|
"Filter rule must begin with either '+' or '-': \"vault.abc\"",
|
|
[]string(nil),
|
|
[]string(nil),
|
|
},
|
|
{
|
|
[]string{"+vault.abc", "-vault.bcd"},
|
|
"",
|
|
[]string{"vault.abc"},
|
|
[]string{"vault.bcd"},
|
|
},
|
|
}
|
|
t.Run("validate metric filter configs", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
for _, tc := range cases {
|
|
|
|
allowedPrefixes, blockedPrefixes, err := parsePrefixFilter(tc.inputFilters)
|
|
|
|
if err != nil {
|
|
assert.EqualError(t, err, tc.expectedErrStr)
|
|
} else {
|
|
assert.Equal(t, "", tc.expectedErrStr)
|
|
assert.Equal(t, tc.expectedAllowedPrefixes, allowedPrefixes)
|
|
|
|
assert.Equal(t, tc.expectedBlockedPrefixes, blockedPrefixes)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
// TestNormalizeTelemetryAddresses ensures that any telemetry configuration that
|
|
// can be a URL, IP Address, or host:port address is conformant with RFC-5942 §4
|
|
// See: https://rfc-editor.org/rfc/rfc5952.html
|
|
func TestNormalizeTelemetryAddresses(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := map[string]struct {
|
|
given *Telemetry
|
|
expected *Telemetry
|
|
}{
|
|
"ipv6-conformance": {
|
|
given: &Telemetry{
|
|
// RFC-5952 4.1 leading zeroes
|
|
CirconusAPIURL: "https://[2001:0db8::0001]:443",
|
|
// RFC-5952 4.2.3 longest run of 0 bits shortened
|
|
CirconusCheckSubmissionURL: "https://[2001:0:0:1:0:0:0:1]:443",
|
|
// RFC-5952 4.2.3 equal runs of 0 bits shortened
|
|
DogStatsDAddr: "https://[2001:db8:0:0:1:0:0:1]:443",
|
|
// RFC-5952 4.3 downcase hex letters
|
|
StatsdAddr: "https://[2001:DB8:AC3:FE4::1]:443",
|
|
StatsiteAddr: "https://[2001:DB8:AC3:FE4::1]:443",
|
|
},
|
|
expected: &Telemetry{
|
|
CirconusAPIURL: "https://[2001:db8::1]:443",
|
|
CirconusCheckSubmissionURL: "https://[2001:0:0:1::1]:443",
|
|
DogStatsDAddr: "https://[2001:db8::1:0:0:1]:443",
|
|
StatsdAddr: "https://[2001:db8:ac3:fe4::1]:443",
|
|
StatsiteAddr: "https://[2001:db8:ac3:fe4::1]:443",
|
|
},
|
|
},
|
|
}
|
|
|
|
for name, tc := range tests {
|
|
name := name
|
|
tc := tc
|
|
t.Run(name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
normalizeTelemetryAddresses(tc.given)
|
|
require.EqualValues(t, tc.expected, tc.given)
|
|
})
|
|
}
|
|
}
|