Database gRPC plugins (#3666)

* Start work on context aware backends * Start work on moving the database plugins to gRPC in order to pass context * Add context to builtin database plugins * use byte slice instead of string * Context all the things * Move proto messages to the dbplugin package * Add a grpc mechanism for running backend plugins * Serve the GRPC plugin * Add backwards compatibility to the database plugins * Remove backend plugin changes * Remove backend plugin changes * Cleanup the transport implementations * If grpc connection is in an unexpected state restart the plugin * Fix tests * Fix tests * Remove context from the request object, replace it with context.TODO * Add a test to verify netRPC plugins still work * Remove unused mapstructure call * Code review fixes * Code review fixes * Code review fixes
2025-11-01 02:57:59 +00:00 · 2017-12-14 14:03:11 -08:00
parent 2ce0984e00
commit a401cc7cb5
35 changed files with 1425 additions and 390 deletions
--- a/builtin/logical/database/dbplugin/plugin_test.go
+++ b/builtin/logical/database/dbplugin/plugin_test.go
@@ -1,11 +1,13 @@
 package dbplugin_test

 import (
+	"context"
 	"errors"
 	"os"
 	"testing"
 	"time"

+	plugin "github.com/hashicorp/go-plugin"
 	"github.com/hashicorp/vault/builtin/logical/database/dbplugin"
 	"github.com/hashicorp/vault/helper/pluginutil"
 	vaulthttp "github.com/hashicorp/vault/http"
@@ -20,7 +22,7 @@ type mockPlugin struct {
 }

 func (m *mockPlugin) Type() (string, error) { return "mock", nil }
-func (m *mockPlugin) CreateUser(statements dbplugin.Statements, usernameConf dbplugin.UsernameConfig, expiration time.Time) (username string, password string, err error) {
+func (m *mockPlugin) CreateUser(_ context.Context, statements dbplugin.Statements, usernameConf dbplugin.UsernameConfig, expiration time.Time) (username string, password string, err error) {
 	err = errors.New("err")
 	if usernameConf.DisplayName == "" || expiration.IsZero() {
 		return "", "", err
@@ -34,7 +36,7 @@ func (m *mockPlugin) CreateUser(statements dbplugin.Statements, usernameConf dbp

 	return usernameConf.DisplayName, "test", nil
 }
-func (m *mockPlugin) RenewUser(statements dbplugin.Statements, username string, expiration time.Time) error {
+func (m *mockPlugin) RenewUser(_ context.Context, statements dbplugin.Statements, username string, expiration time.Time) error {
 	err := errors.New("err")
 	if username == "" || expiration.IsZero() {
 		return err
@@ -46,7 +48,7 @@ func (m *mockPlugin) RenewUser(statements dbplugin.Statements, username string,

 	return nil
 }
-func (m *mockPlugin) RevokeUser(statements dbplugin.Statements, username string) error {
+func (m *mockPlugin) RevokeUser(_ context.Context, statements dbplugin.Statements, username string) error {
 	err := errors.New("err")
 	if username == "" {
 		return err
@@ -59,7 +61,7 @@ func (m *mockPlugin) RevokeUser(statements dbplugin.Statements, username string)
 	delete(m.users, username)
 	return nil
 }
-func (m *mockPlugin) Initialize(conf map[string]interface{}, _ bool) error {
+func (m *mockPlugin) Initialize(_ context.Context, conf map[string]interface{}, _ bool) error {
 	err := errors.New("err")
 	if len(conf) != 1 {
 		return err
@@ -80,14 +82,15 @@ func getCluster(t *testing.T) (*vault.TestCluster, logical.SystemView) {
 	cores := cluster.Cores

 	sys := vault.TestDynamicSystemView(cores[0].Core)
-	vault.TestAddTestPlugin(t, cores[0].Core, "test-plugin", "TestPlugin_Main")
+	vault.TestAddTestPlugin(t, cores[0].Core, "test-plugin", "TestPlugin_GRPC_Main")
+	vault.TestAddTestPlugin(t, cores[0].Core, "test-plugin-netRPC", "TestPlugin_NetRPC_Main")

 	return cluster, sys
 }

 // This is not an actual test case, it's a helper function that will be executed
 // by the go-plugin client via an exec call.
-func TestPlugin_Main(t *testing.T) {
+func TestPlugin_GRPC_Main(t *testing.T) {
 	if os.Getenv(pluginutil.PluginUnwrapTokenEnv) == "" {
 		return
 	}
@@ -105,6 +108,30 @@ func TestPlugin_Main(t *testing.T) {
 	plugins.Serve(plugin, apiClientMeta.GetTLSConfig())
 }

+// This is not an actual test case, it's a helper function that will be executed
+// by the go-plugin client via an exec call.
+func TestPlugin_NetRPC_Main(t *testing.T) {
+	if os.Getenv(pluginutil.PluginUnwrapTokenEnv) == "" {
+		return
+	}
+
+	p := &mockPlugin{
+		users: make(map[string][]string),
+	}
+
+	args := []string{"--tls-skip-verify=true"}
+
+	apiClientMeta := &pluginutil.APIClientMeta{}
+	flags := apiClientMeta.FlagSet()
+	flags.Parse(args)
+
+	tlsProvider := pluginutil.VaultPluginTLSProvider(apiClientMeta.GetTLSConfig())
+	serveConf := dbplugin.ServeConfig(p, tlsProvider)
+	serveConf.GRPCServer = nil
+
+	plugin.Serve(serveConf)
+}
+
 func TestPlugin_Initialize(t *testing.T) {
 	cluster, sys := getCluster(t)
 	defer cluster.Cleanup()
@@ -118,7 +145,7 @@ func TestPlugin_Initialize(t *testing.T) {
 		"test": 1,
 	}

-	err = dbRaw.Initialize(connectionDetails, true)
+	err = dbRaw.Initialize(context.Background(), connectionDetails, true)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -143,7 +170,7 @@ func TestPlugin_CreateUser(t *testing.T) {
 		"test": 1,
 	}

-	err = db.Initialize(connectionDetails, true)
+	err = db.Initialize(context.Background(), connectionDetails, true)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -153,7 +180,7 @@ func TestPlugin_CreateUser(t *testing.T) {
 		RoleName:    "test",
 	}

-	us, pw, err := db.CreateUser(dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	us, pw, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -163,7 +190,7 @@ func TestPlugin_CreateUser(t *testing.T) {

 	// try and save the same user again to verify it saved the first time, this
 	// should return an error
-	_, _, err = db.CreateUser(dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
 	if err == nil {
 		t.Fatal("expected an error, user wasn't created correctly")
 	}
@@ -182,7 +209,7 @@ func TestPlugin_RenewUser(t *testing.T) {
 	connectionDetails := map[string]interface{}{
 		"test": 1,
 	}
-	err = db.Initialize(connectionDetails, true)
+	err = db.Initialize(context.Background(), connectionDetails, true)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -192,12 +219,12 @@ func TestPlugin_RenewUser(t *testing.T) {
 		RoleName:    "test",
 	}

-	us, _, err := db.CreateUser(dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}

-	err = db.RenewUser(dbplugin.Statements{}, us, time.Now().Add(time.Minute))
+	err = db.RenewUser(context.Background(), dbplugin.Statements{}, us, time.Now().Add(time.Minute))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -216,7 +243,7 @@ func TestPlugin_RevokeUser(t *testing.T) {
 	connectionDetails := map[string]interface{}{
 		"test": 1,
 	}
-	err = db.Initialize(connectionDetails, true)
+	err = db.Initialize(context.Background(), connectionDetails, true)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -226,19 +253,159 @@ func TestPlugin_RevokeUser(t *testing.T) {
 		RoleName:    "test",
 	}

-	us, _, err := db.CreateUser(dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}

 	// Test default revoke statememts
-	err = db.RevokeUser(dbplugin.Statements{}, us)
+	err = db.RevokeUser(context.Background(), dbplugin.Statements{}, us)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}

 	// Try adding the same username back so we can verify it was removed
-	_, _, err = db.CreateUser(dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+// Test the code is still compatible with an old netRPC plugin
+func TestPlugin_NetRPC_Initialize(t *testing.T) {
+	cluster, sys := getCluster(t)
+	defer cluster.Cleanup()
+
+	dbRaw, err := dbplugin.PluginFactory("test-plugin-netRPC", sys, &log.NullLogger{})
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	connectionDetails := map[string]interface{}{
+		"test": 1,
+	}
+
+	err = dbRaw.Initialize(context.Background(), connectionDetails, true)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	err = dbRaw.Close()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestPlugin_NetRPC_CreateUser(t *testing.T) {
+	cluster, sys := getCluster(t)
+	defer cluster.Cleanup()
+
+	db, err := dbplugin.PluginFactory("test-plugin-netRPC", sys, &log.NullLogger{})
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	defer db.Close()
+
+	connectionDetails := map[string]interface{}{
+		"test": 1,
+	}
+
+	err = db.Initialize(context.Background(), connectionDetails, true)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	usernameConf := dbplugin.UsernameConfig{
+		DisplayName: "test",
+		RoleName:    "test",
+	}
+
+	us, pw, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if us != "test" || pw != "test" {
+		t.Fatal("expected username and password to be 'test'")
+	}
+
+	// try and save the same user again to verify it saved the first time, this
+	// should return an error
+	_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	if err == nil {
+		t.Fatal("expected an error, user wasn't created correctly")
+	}
+}
+
+func TestPlugin_NetRPC_RenewUser(t *testing.T) {
+	cluster, sys := getCluster(t)
+	defer cluster.Cleanup()
+
+	db, err := dbplugin.PluginFactory("test-plugin-netRPC", sys, &log.NullLogger{})
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	defer db.Close()
+
+	connectionDetails := map[string]interface{}{
+		"test": 1,
+	}
+	err = db.Initialize(context.Background(), connectionDetails, true)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	usernameConf := dbplugin.UsernameConfig{
+		DisplayName: "test",
+		RoleName:    "test",
+	}
+
+	us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	err = db.RenewUser(context.Background(), dbplugin.Statements{}, us, time.Now().Add(time.Minute))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestPlugin_NetRPC_RevokeUser(t *testing.T) {
+	cluster, sys := getCluster(t)
+	defer cluster.Cleanup()
+
+	db, err := dbplugin.PluginFactory("test-plugin-netRPC", sys, &log.NullLogger{})
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	defer db.Close()
+
+	connectionDetails := map[string]interface{}{
+		"test": 1,
+	}
+	err = db.Initialize(context.Background(), connectionDetails, true)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	usernameConf := dbplugin.UsernameConfig{
+		DisplayName: "test",
+		RoleName:    "test",
+	}
+
+	us, _, err := db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Test default revoke statememts
+	err = db.RevokeUser(context.Background(), dbplugin.Statements{}, us)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Try adding the same username back so we can verify it was removed
+	_, _, err = db.CreateUser(context.Background(), dbplugin.Statements{}, usernameConf, time.Now().Add(time.Minute))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}