mirror of
https://github.com/optim-enterprises-bv/vault.git
synced 2025-10-30 02:02:43 +00:00
[VAULT-22481] Add audit filtering feature (#24558)
* VAULT-22481: Audit filter node (#24465) * Initial commit on adding filter nodes for audit * tests for audit filter * test: longer filter - more conditions * copywrite headers * Check interface for the right type * Add audit filtering feature (#24554) * Support filter nodes in backend factories and add some tests * More tests and cleanup * Attempt to move control of registration for nodes and pipelines to the audit broker (#24505) * invert control of the pipelines/nodes to the audit broker vs. within each backend * update noop audit test code to implement the pipeliner interface * noop mount path has trailing slash * attempting to make NoopAudit more friendly * NoopAudit uses known salt * Refactor audit.ProcessManual to support filter nodes * HasFiltering * rename the pipeliner * use exported AuditEvent in Filter * Add tests for registering and deregistering backends on the audit broker * Add missing licence header to one file, fix a typo in two tests --------- Co-authored-by: Peter Wilson <peter.wilson@hashicorp.com> * Add changelog file * update bexpr datum to use a strong type * go docs updates * test path * PR review comments * handle scenarios/outcomes from broker.send * don't need to re-check the complete sinks * add extra check to deregister to ensure that re-registering non-filtered device sets sink threshold * Ensure that the multierror is appended before attempting to return it --------- Co-authored-by: Peter Wilson <peter.wilson@hashicorp.com>
This commit is contained in:
Kuba Wieczorek
331
builtin/audit/socket/backend_test.go
Normal file
331
builtin/audit/socket/backend_test.go
Normal file
@@ -0,0 +1,331 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package socket
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/eventlogger"
|
||||
"github.com/hashicorp/vault/audit"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// TestBackend_formatterConfig ensures that all the configuration values are parsed correctly.
|
||||
func TestBackend_formatterConfig(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := map[string]struct {
|
||||
config map[string]string
|
||||
want audit.FormatterConfig
|
||||
wantErr bool
|
||||
expectedErrMsg string
|
||||
}{
|
||||
"happy-path-json": {
|
||||
config: map[string]string{
|
||||
"format": audit.JSONFormat.String(),
|
||||
"hmac_accessor": "true",
|
||||
"log_raw": "true",
|
||||
"elide_list_responses": "true",
|
||||
},
|
||||
want: audit.FormatterConfig{
|
||||
Raw: true,
|
||||
HMACAccessor: true,
|
||||
ElideListResponses: true,
|
||||
RequiredFormat: "json",
|
||||
}, wantErr: false,
|
||||
},
|
||||
"happy-path-jsonx": {
|
||||
config: map[string]string{
|
||||
"format": audit.JSONxFormat.String(),
|
||||
"hmac_accessor": "true",
|
||||
"log_raw": "true",
|
||||
"elide_list_responses": "true",
|
||||
},
|
||||
want: audit.FormatterConfig{
|
||||
Raw: true,
|
||||
HMACAccessor: true,
|
||||
ElideListResponses: true,
|
||||
RequiredFormat: "jsonx",
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
"invalid-format": {
|
||||
config: map[string]string{
|
||||
"format": " squiggly ",
|
||||
"hmac_accessor": "true",
|
||||
"log_raw": "true",
|
||||
"elide_list_responses": "true",
|
||||
},
|
||||
want: audit.FormatterConfig{},
|
||||
wantErr: true,
|
||||
expectedErrMsg: "audit.NewFormatterConfig: error applying options: audit.(format).validate: 'squiggly' is not a valid format: invalid parameter",
|
||||
},
|
||||
"invalid-hmac-accessor": {
|
||||
config: map[string]string{
|
||||
"format": audit.JSONFormat.String(),
|
||||
"hmac_accessor": "maybe",
|
||||
},
|
||||
want: audit.FormatterConfig{},
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.formatterConfig: unable to parse 'hmac_accessor': strconv.ParseBool: parsing \"maybe\": invalid syntax",
|
||||
},
|
||||
"invalid-log-raw": {
|
||||
config: map[string]string{
|
||||
"format": audit.JSONFormat.String(),
|
||||
"hmac_accessor": "true",
|
||||
"log_raw": "maybe",
|
||||
},
|
||||
want: audit.FormatterConfig{},
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.formatterConfig: unable to parse 'log_raw': strconv.ParseBool: parsing \"maybe\": invalid syntax",
|
||||
},
|
||||
"invalid-elide-bool": {
|
||||
config: map[string]string{
|
||||
"format": audit.JSONFormat.String(),
|
||||
"hmac_accessor": "true",
|
||||
"log_raw": "true",
|
||||
"elide_list_responses": "maybe",
|
||||
},
|
||||
want: audit.FormatterConfig{},
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.formatterConfig: unable to parse 'elide_list_responses': strconv.ParseBool: parsing \"maybe\": invalid syntax",
|
||||
},
|
||||
}
|
||||
for name, tc := range tests {
|
||||
name := name
|
||||
tc := tc
|
||||
t.Run(name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
got, err := formatterConfig(tc.config)
|
||||
if tc.wantErr {
|
||||
require.Error(t, err)
|
||||
require.EqualError(t, err, tc.expectedErrMsg)
|
||||
} else {
|
||||
require.NoError(t, err)
|
||||
}
|
||||
require.Equal(t, tc.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestBackend_configureFilterNode ensures that configureFilterNode handles various
|
||||
// filter values as expected. Empty (including whitespace) strings should return
|
||||
// no error but skip configuration of the node.
|
||||
func TestBackend_configureFilterNode(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := map[string]struct {
|
||||
filter string
|
||||
shouldSkipNode bool
|
||||
wantErr bool
|
||||
expectedErrorMsg string
|
||||
}{
|
||||
"happy": {
|
||||
filter: "foo == bar",
|
||||
},
|
||||
"empty": {
|
||||
filter: "",
|
||||
shouldSkipNode: true,
|
||||
},
|
||||
"spacey": {
|
||||
filter: " ",
|
||||
shouldSkipNode: true,
|
||||
},
|
||||
"bad": {
|
||||
filter: "___qwerty",
|
||||
wantErr: true,
|
||||
expectedErrorMsg: "socket.(Backend).configureFilterNode: error creating filter node: audit.NewEntryFilter: cannot create new audit filter",
|
||||
},
|
||||
}
|
||||
for name, tc := range tests {
|
||||
name := name
|
||||
tc := tc
|
||||
t.Run(name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
b := &Backend{
|
||||
nodeIDList: []eventlogger.NodeID{},
|
||||
nodeMap: map[eventlogger.NodeID]eventlogger.Node{},
|
||||
}
|
||||
|
||||
err := b.configureFilterNode(tc.filter)
|
||||
|
||||
switch {
|
||||
case tc.wantErr:
|
||||
require.Error(t, err)
|
||||
require.ErrorContains(t, err, tc.expectedErrorMsg)
|
||||
require.Len(t, b.nodeIDList, 0)
|
||||
require.Len(t, b.nodeMap, 0)
|
||||
case tc.shouldSkipNode:
|
||||
require.NoError(t, err)
|
||||
require.Len(t, b.nodeIDList, 0)
|
||||
require.Len(t, b.nodeMap, 0)
|
||||
default:
|
||||
require.NoError(t, err)
|
||||
require.Len(t, b.nodeIDList, 1)
|
||||
require.Len(t, b.nodeMap, 1)
|
||||
id := b.nodeIDList[0]
|
||||
node := b.nodeMap[id]
|
||||
require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestBackend_configureFormatterNode ensures that configureFormatterNode
|
||||
// populates the nodeIDList and nodeMap on Backend when given valid formatConfig.
|
||||
func TestBackend_configureFormatterNode(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
b := &Backend{
|
||||
nodeIDList: []eventlogger.NodeID{},
|
||||
nodeMap: map[eventlogger.NodeID]eventlogger.Node{},
|
||||
}
|
||||
|
||||
formatConfig, err := audit.NewFormatterConfig()
|
||||
require.NoError(t, err)
|
||||
|
||||
err = b.configureFormatterNode(formatConfig)
|
||||
|
||||
require.NoError(t, err)
|
||||
require.Len(t, b.nodeIDList, 1)
|
||||
require.Len(t, b.nodeMap, 1)
|
||||
id := b.nodeIDList[0]
|
||||
node := b.nodeMap[id]
|
||||
require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
|
||||
}
|
||||
|
||||
// TestBackend_configureSinkNode ensures that we can correctly configure the sink
|
||||
// node on the Backend, and any incorrect parameters result in the relevant errors.
|
||||
func TestBackend_configureSinkNode(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := map[string]struct {
|
||||
name string
|
||||
address string
|
||||
format string
|
||||
wantErr bool
|
||||
expectedErrMsg string
|
||||
expectedName string
|
||||
}{
|
||||
"name-empty": {
|
||||
name: "",
|
||||
address: "wss://foo",
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.(Backend).configureSinkNode: name is required: invalid parameter",
|
||||
},
|
||||
"name-whitespace": {
|
||||
name: " ",
|
||||
address: "wss://foo",
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.(Backend).configureSinkNode: name is required: invalid parameter",
|
||||
},
|
||||
"address-empty": {
|
||||
name: "foo",
|
||||
address: "",
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.(Backend).configureSinkNode: address is required: invalid parameter",
|
||||
},
|
||||
"address-whitespace": {
|
||||
name: "foo",
|
||||
address: " ",
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.(Backend).configureSinkNode: address is required: invalid parameter",
|
||||
},
|
||||
"format-empty": {
|
||||
name: "foo",
|
||||
address: "wss://foo",
|
||||
format: "",
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.(Backend).configureSinkNode: format is required: invalid parameter",
|
||||
},
|
||||
"format-whitespace": {
|
||||
name: "foo",
|
||||
address: "wss://foo",
|
||||
format: " ",
|
||||
wantErr: true,
|
||||
expectedErrMsg: "socket.(Backend).configureSinkNode: format is required: invalid parameter",
|
||||
},
|
||||
"happy": {
|
||||
name: "foo",
|
||||
address: "wss://foo",
|
||||
format: "json",
|
||||
wantErr: false,
|
||||
expectedName: "foo",
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range tests {
|
||||
name := name
|
||||
tc := tc
|
||||
t.Run(name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
b := &Backend{
|
||||
nodeIDList: []eventlogger.NodeID{},
|
||||
nodeMap: map[eventlogger.NodeID]eventlogger.Node{},
|
||||
}
|
||||
|
||||
err := b.configureSinkNode(tc.name, tc.address, tc.format)
|
||||
|
||||
if tc.wantErr {
|
||||
require.Error(t, err)
|
||||
require.EqualError(t, err, tc.expectedErrMsg)
|
||||
require.Len(t, b.nodeIDList, 0)
|
||||
require.Len(t, b.nodeMap, 0)
|
||||
} else {
|
||||
require.NoError(t, err)
|
||||
require.Len(t, b.nodeIDList, 1)
|
||||
require.Len(t, b.nodeMap, 1)
|
||||
id := b.nodeIDList[0]
|
||||
node := b.nodeMap[id]
|
||||
require.Equal(t, eventlogger.NodeTypeSink, node.Type())
|
||||
sw, ok := node.(*audit.SinkWrapper)
|
||||
require.True(t, ok)
|
||||
require.Equal(t, tc.expectedName, sw.Name)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestBackend_configureFilterFormatterSink ensures that configuring all three
|
||||
// types of nodes on a Backend works as expected, i.e. we have all three nodes
|
||||
// at the end and nothing gets overwritten. The order of calls influences the
|
||||
// slice of IDs on the Backend.
|
||||
func TestBackend_configureFilterFormatterSink(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
b := &Backend{
|
||||
nodeIDList: []eventlogger.NodeID{},
|
||||
nodeMap: map[eventlogger.NodeID]eventlogger.Node{},
|
||||
}
|
||||
|
||||
formatConfig, err := audit.NewFormatterConfig()
|
||||
require.NoError(t, err)
|
||||
|
||||
err = b.configureFilterNode("foo == bar")
|
||||
require.NoError(t, err)
|
||||
|
||||
err = b.configureFormatterNode(formatConfig)
|
||||
require.NoError(t, err)
|
||||
|
||||
err = b.configureSinkNode("foo", "https://hashicorp.com", "json")
|
||||
require.NoError(t, err)
|
||||
|
||||
require.Len(t, b.nodeIDList, 3)
|
||||
require.Len(t, b.nodeMap, 3)
|
||||
|
||||
id := b.nodeIDList[0]
|
||||
node := b.nodeMap[id]
|
||||
require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
|
||||
|
||||
id = b.nodeIDList[1]
|
||||
node = b.nodeMap[id]
|
||||
require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
|
||||
|
||||
id = b.nodeIDList[2]
|
||||
node = b.nodeMap[id]
|
||||
require.Equal(t, eventlogger.NodeTypeSink, node.Type())
|
||||
}
|
||||
Reference in New Issue
Block a user