mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-09 08:07:01 +02:00
60 lines
1.6 KiB
Go
60 lines
1.6 KiB
Go
package api_test
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/vault/api"
|
|
vaulthttp "github.com/hashicorp/vault/http"
|
|
"github.com/hashicorp/vault/vault"
|
|
)
|
|
|
|
func TestSysRekey_Verification(t *testing.T) {
|
|
cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
|
|
HandlerFunc: vaulthttp.Handler,
|
|
})
|
|
cluster.Start()
|
|
defer cluster.Cleanup()
|
|
|
|
vault.TestWaitActive(t, cluster.Cores[0].Core)
|
|
client := cluster.Cores[0].Client
|
|
client.SetMaxRetries(0)
|
|
|
|
// This first block verifies that if we are using recovery keys to force a
|
|
// rekey of a stored-shares barrier that verification is not allowed since
|
|
// the keys aren't returned
|
|
vault.DefaultSealPretendsToAllowRecoveryKeys = true
|
|
vault.DefaultSealPretendsToAllowStoredShares = true
|
|
vault.DefaultSealPretendRecoveryConfig = &vault.SealConfig{}
|
|
status, err := client.Sys().RekeyInit(&api.RekeyInitRequest{
|
|
StoredShares: 1,
|
|
RequireVerification: true,
|
|
})
|
|
if err == nil {
|
|
t.Fatal("expected error")
|
|
}
|
|
if !strings.Contains(err.Error(), "requiring verification not supported") {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
|
|
// Now we set things back and start a normal rekey with the verification process
|
|
vault.DefaultSealPretendsToAllowRecoveryKeys = false
|
|
vault.DefaultSealPretendsToAllowStoredShares = false
|
|
vault.DefaultSealPretendRecoveryConfig = nil
|
|
status, err = client.Sys().RekeyInit(&api.RekeyInitRequest{
|
|
SecretShares: 5,
|
|
SecretThreshold: 3,
|
|
RequireVerification: true,
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if status == nil {
|
|
t.Fatal("nil status")
|
|
}
|
|
/*
|
|
cluster.EnsureCoresSealed(t)
|
|
cluster.UnsealCores(t)
|
|
*/
|
|
}
|