mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-08 07:37:01 +02:00
44aa151b78
* redoing connection handling * a little more cleanup * empty implementation of rotation * updating rotate signature * signature update * updating interfaces again :( * changing back to interface * adding templated url support and rotation for postgres * adding correct username * return updates * updating statements to be a list * adding error sanitizing middleware * fixing log sanitizier * adding postgres rotate test * removing conf from rotate * adding rotate command * adding mysql rotate * finishing up the endpoint in the db backend for rotate * no more structs, just store raw config * fixing tests * adding db instance lock * adding support for statement list in cassandra * wip redoing interface to support BC * adding falllback for Initialize implementation * adding backwards compat for statements * fix tests * fix more tests * fixing up tests, switching to new fields in statements * fixing more tests * adding mssql and mysql * wrapping all the things in middleware, implementing templating for mongodb * wrapping all db servers with error santizer * fixing test * store the name with the db instance * adding rotate to cassandra * adding compatibility translation to both server and plugin * reordering a few things * store the name with the db instance * reordering * adding a few more tests * switch secret values from slice to map * addressing some feedback * reinstate execute plugin after resetting connection * set database connection to closed * switching secret values func to map[string]interface for potential future uses * addressing feedback
424 lines
11 KiB
Go
424 lines
11 KiB
Go
package dbplugin_test
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
plugin "github.com/hashicorp/go-plugin"
|
|
"github.com/hashicorp/vault/builtin/logical/database/dbplugin"
|
|
"github.com/hashicorp/vault/helper/pluginutil"
|
|
vaulthttp "github.com/hashicorp/vault/http"
|
|
"github.com/hashicorp/vault/logical"
|
|
"github.com/hashicorp/vault/plugins"
|
|
"github.com/hashicorp/vault/vault"
|
|
log "github.com/mgutz/logxi/v1"
|
|
)
|
|
|
|
type mockPlugin struct {
|
|
users map[string][]string
|
|
}
|
|
|
|
func (m *mockPlugin) Type() (string, error) { return "mock", nil }
|
|
func (m *mockPlugin) CreateUser(_ context.Context, statements dbplugin.Statements, usernameConf dbplugin.UsernameConfig, expiration time.Time) (username string, password string, err error) {
|
|
err = errors.New("err")
|
|
if usernameConf.DisplayName == "" || expiration.IsZero() {
|
|
return "", "", err
|
|
}
|
|
|
|
if _, ok := m.users[usernameConf.DisplayName]; ok {
|
|
return "", "", err
|
|
}
|
|
|
|
m.users[usernameConf.DisplayName] = []string{password}
|
|
|
|
return usernameConf.DisplayName, "test", nil
|
|
}
|
|
func (m *mockPlugin) RenewUser(_ context.Context, statements dbplugin.Statements, username string, expiration time.Time) error {
|
|
err := errors.New("err")
|
|
if username == "" || expiration.IsZero() {
|
|
return err
|
|
}
|
|
|
|
if _, ok := m.users[username]; !ok {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
func (m *mockPlugin) RevokeUser(_ context.Context, statements dbplugin.Statements, username string) error {
|
|
err := errors.New("err")
|
|
if username == "" {
|
|
return err
|
|
}
|
|
|
|
if _, ok := m.users[username]; !ok {
|
|
return err
|
|
}
|
|
|
|
delete(m.users, username)
|
|
return nil
|
|
}
|
|
func (m *mockPlugin) RotateRootCredentials(_ context.Context, statements []string) (map[string]interface{}, error) {
|
|
return nil, nil
|
|
}
|
|
func (m *mockPlugin) Init(_ context.Context, conf map[string]interface{}, _ bool) (map[string]interface{}, error) {
|
|
err := errors.New("err")
|
|
if len(conf) != 1 {
|
|
return nil, err
|
|
}
|
|
|
|
return conf, nil
|
|
}
|
|
func (m *mockPlugin) Initialize(_ context.Context, conf map[string]interface{}, _ bool) error {
|
|
err := errors.New("err")
|
|
if len(conf) != 1 {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
func (m *mockPlugin) Close() error {
|
|
m.users = nil
|
|
return nil
|
|
}
|
|
|
|
func getCluster(t *testing.T) (*vault.TestCluster, logical.SystemView) {
|
|
cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
|
|
HandlerFunc: vaulthttp.Handler,
|
|
})
|
|
cluster.Start()
|
|
cores := cluster.Cores
|
|
|
|
sys := vault.TestDynamicSystemView(cores[0].Core)
|
|
vault.TestAddTestPlugin(t, cores[0].Core, "test-plugin", "TestPlugin_GRPC_Main")
|
|
vault.TestAddTestPlugin(t, cores[0].Core, "test-plugin-netRPC", "TestPlugin_NetRPC_Main")
|
|
|
|
return cluster, sys
|
|
}
|
|
|
|
// This is not an actual test case, it's a helper function that will be executed
|
|
// by the go-plugin client via an exec call.
|
|
func TestPlugin_GRPC_Main(t *testing.T) {
|
|
if os.Getenv(pluginutil.PluginUnwrapTokenEnv) == "" {
|
|
return
|
|
}
|
|
|
|
plugin := &mockPlugin{
|
|
users: make(map[string][]string),
|
|
}
|
|
|
|
args := []string{"--tls-skip-verify=true"}
|
|
|
|
apiClientMeta := &pluginutil.APIClientMeta{}
|
|
flags := apiClientMeta.FlagSet()
|
|
flags.Parse(args)
|
|
|
|
plugins.Serve(plugin, apiClientMeta.GetTLSConfig())
|
|
}
|
|
|
|
// This is not an actual test case, it's a helper function that will be executed
|
|
// by the go-plugin client via an exec call.
|
|
func TestPlugin_NetRPC_Main(t *testing.T) {
|
|
if os.Getenv(pluginutil.PluginUnwrapTokenEnv) == "" {
|
|
return
|
|
}
|
|
|
|
p := &mockPlugin{
|
|
users: make(map[string][]string),
|
|
}
|
|
|
|
args := []string{"--tls-skip-verify=true"}
|
|
|
|
apiClientMeta := &pluginutil.APIClientMeta{}
|
|
flags := apiClientMeta.FlagSet()
|
|
flags.Parse(args)
|
|
|
|
tlsProvider := pluginutil.VaultPluginTLSProvider(apiClientMeta.GetTLSConfig())
|
|
serveConf := dbplugin.ServeConfig(p, tlsProvider)
|
|
serveConf.GRPCServer = nil
|
|
|
|
plugin.Serve(serveConf)
|
|
}
|
|
|
|
func TestPlugin_Init(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
dbRaw, err := dbplugin.PluginFactory(context.Background(), "test-plugin", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
|
|
_, err = dbRaw.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
err = dbRaw.Close()
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
}
|
|
|
|
func TestPlugin_CreateUser(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
db, err := dbplugin.PluginFactory(context.Background(), "test-plugin", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
defer db.Close()
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
|
|
_, err = db.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
usernameConf := dbplugin.UsernameConfig{
|
|
DisplayName: "test",
|
|
RoleName: "test",
|
|
}
|
|
|
|
us, pw, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
if us != "test" || pw != "test" {
|
|
t.Fatal("expected username and password to be 'test'")
|
|
}
|
|
|
|
// try and save the same user again to verify it saved the first time, this
|
|
// should return an error
|
|
_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err == nil {
|
|
t.Fatal("expected an error, user wasn't created correctly")
|
|
}
|
|
}
|
|
|
|
func TestPlugin_RenewUser(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
db, err := dbplugin.PluginFactory(context.Background(), "test-plugin", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
defer db.Close()
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
_, err = db.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
usernameConf := dbplugin.UsernameConfig{
|
|
DisplayName: "test",
|
|
RoleName: "test",
|
|
}
|
|
|
|
us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
err = db.RenewUser(context.Background(), dbplugin.Statements{}, us, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
}
|
|
|
|
func TestPlugin_RevokeUser(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
db, err := dbplugin.PluginFactory(context.Background(), "test-plugin", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
defer db.Close()
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
_, err = db.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
usernameConf := dbplugin.UsernameConfig{
|
|
DisplayName: "test",
|
|
RoleName: "test",
|
|
}
|
|
|
|
us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
// Test default revoke statements
|
|
err = db.RevokeUser(context.Background(), dbplugin.Statements{}, us)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
// Try adding the same username back so we can verify it was removed
|
|
_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
}
|
|
|
|
// Test the code is still compatible with an old netRPC plugin
|
|
func TestPlugin_NetRPC_Init(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
dbRaw, err := dbplugin.PluginFactory(context.Background(), "test-plugin-netRPC", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
|
|
_, err = dbRaw.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
err = dbRaw.Close()
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
}
|
|
|
|
func TestPlugin_NetRPC_CreateUser(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
db, err := dbplugin.PluginFactory(context.Background(), "test-plugin-netRPC", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
defer db.Close()
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
|
|
_, err = db.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
usernameConf := dbplugin.UsernameConfig{
|
|
DisplayName: "test",
|
|
RoleName: "test",
|
|
}
|
|
|
|
us, pw, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
if us != "test" || pw != "test" {
|
|
t.Fatal("expected username and password to be 'test'")
|
|
}
|
|
|
|
// try and save the same user again to verify it saved the first time, this
|
|
// should return an error
|
|
_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err == nil {
|
|
t.Fatal("expected an error, user wasn't created correctly")
|
|
}
|
|
}
|
|
|
|
func TestPlugin_NetRPC_RenewUser(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
db, err := dbplugin.PluginFactory(context.Background(), "test-plugin-netRPC", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
defer db.Close()
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
_, err = db.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
usernameConf := dbplugin.UsernameConfig{
|
|
DisplayName: "test",
|
|
RoleName: "test",
|
|
}
|
|
|
|
us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
err = db.RenewUser(context.Background(), dbplugin.Statements{}, us, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
}
|
|
|
|
func TestPlugin_NetRPC_RevokeUser(t *testing.T) {
|
|
cluster, sys := getCluster(t)
|
|
defer cluster.Cleanup()
|
|
|
|
db, err := dbplugin.PluginFactory(context.Background(), "test-plugin-netRPC", sys, &log.NullLogger{})
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
defer db.Close()
|
|
|
|
connectionDetails := map[string]interface{}{
|
|
"test": 1,
|
|
}
|
|
_, err = db.Init(context.Background(), connectionDetails, true)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
usernameConf := dbplugin.UsernameConfig{
|
|
DisplayName: "test",
|
|
RoleName: "test",
|
|
}
|
|
|
|
us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
// Test default revoke statements
|
|
err = db.RevokeUser(context.Background(), dbplugin.Statements{}, us)
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
|
|
// Try adding the same username back so we can verify it was removed
|
|
_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
|
|
if err != nil {
|
|
t.Fatalf("err: %s", err)
|
|
}
|
|
}
|