mirror of
https://github.com/hashicorp/vault.git
synced 2025-11-19 01:31:39 +01:00
b1f0d4e495
* Build a better nonce service Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add internal nonce service for testing Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add benchmarks for nonce service Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add statistics around how long tidy took Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Replace ACME nonces with shared nonce service Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add an initialize method to nonce services Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Use the new initialize helper on nonce service in PKI Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add additional tests for nonces Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Format sdk/helper/nonce Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Use default 90s nonce expiry in PKI Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Remove parallel test case as covered by benchmark Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add additional commentary to encrypted nonce implementation Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add nonce to test_packages Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> --------- Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
93 lines
2.0 KiB
Go
93 lines
2.0 KiB
Go
package nonce
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestNonceService(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
s := NewNonceService()
|
|
err := s.Initialize()
|
|
require.NoError(t, err)
|
|
|
|
// Double redemption should fail.
|
|
nonce, _, err := s.Get()
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, nonce)
|
|
|
|
require.True(t, s.Redeem(nonce))
|
|
require.False(t, s.Redeem(nonce))
|
|
|
|
// Redeeming in opposite order should work.
|
|
var nonces []string
|
|
numNonces := 100
|
|
for i := 0; i < numNonces; i++ {
|
|
nonce, _, err = s.Get()
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, nonce)
|
|
|
|
nonces = append(nonces, nonce)
|
|
}
|
|
|
|
for i := len(nonces) - 1; i >= 0; i-- {
|
|
nonce = nonces[i]
|
|
require.True(t, s.Redeem(nonce))
|
|
}
|
|
|
|
for i := 0; i < len(nonces); i++ {
|
|
nonce = nonces[i]
|
|
require.False(t, s.Redeem(nonce))
|
|
}
|
|
|
|
status := s.Tidy()
|
|
require.NotNil(t, status)
|
|
require.Equal(t, uint64(1+numNonces), status.Issued)
|
|
require.Equal(t, uint64(0), status.Outstanding)
|
|
}
|
|
|
|
func TestNonceExpiry(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
s := NewNonceServiceWithValidity(2 * time.Second)
|
|
err := s.Initialize()
|
|
require.NoError(t, err)
|
|
|
|
// Issue and redeem should succeed.
|
|
nonce, _, err := s.Get()
|
|
original := nonce
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, nonce)
|
|
require.True(t, s.Redeem(nonce))
|
|
|
|
// Issue and wait should fail to redeem.
|
|
nonce, _, err = s.Get()
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, nonce)
|
|
time.Sleep(3 * time.Second)
|
|
require.False(t, s.Redeem(nonce))
|
|
|
|
// Issue and wait+tidy should fail to redeem.
|
|
nonce, _, err = s.Get()
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, nonce)
|
|
time.Sleep(3 * time.Second)
|
|
s.Tidy()
|
|
require.False(t, s.Redeem(nonce))
|
|
require.False(t, s.Redeem(nonce))
|
|
|
|
nonce, _, err = s.Get()
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, nonce)
|
|
s.Tidy()
|
|
time.Sleep(3 * time.Second)
|
|
require.False(t, s.Redeem(nonce))
|
|
require.False(t, s.Redeem(nonce))
|
|
|
|
// Original nonce should fail on second use.
|
|
require.False(t, s.Redeem(original))
|
|
}
|