scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-02 11:38:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

VAULT-25710: Audit - enforce header formatter requirement in EntryFormatter (#26239)

Browse Source 
* Check Enterprise unseal order for audit funcs, enforce header formatter in audit entry formatter node
* ApplyConfig return empty headers (but never nil) when nil/empty supplied
* Add NoopHeaderFormatter and remove builtin audit testHeaderFormatters
This commit is contained in:
Peter Wilson
2024-04-03 10:53:34 +01:00
committed by GitHub
parent 39499e6fba
commit e0a905e8f8
19 changed files with 319 additions and 243 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
builtin/audit/file/backend_test.go
View File

@@ -13,6 +13,7 @@ import (
"github.com/hashicorp/eventlogger"
"github.com/hashicorp/go-hclog"
"github.com/hashicorp/vault/audit"
"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
"github.com/hashicorp/vault/internal/observability/event"
"github.com/hashicorp/vault/sdk/helper/salt"
"github.com/hashicorp/vault/sdk/logical"
@@ -40,7 +41,7 @@ func TestAuditFile_fileModeNew(t *testing.T) {
SaltView: &logical.InmemStorage{},
Logger: hclog.NewNullLogger(),
}
_, err = Factory(context.Background(), backendConfig, nil)
_, err = Factory(context.Background(), backendConfig, &corehelpers.NoopHeaderFormatter{})
require.NoError(t, err)
info, err := os.Stat(file)
@@ -73,7 +74,7 @@ func TestAuditFile_fileModeExisting(t *testing.T) {
Logger: hclog.NewNullLogger(),
}
_, err = Factory(context.Background(), backendConfig, nil)
_, err = Factory(context.Background(), backendConfig, &corehelpers.NoopHeaderFormatter{})
require.NoError(t, err)
info, err := os.Stat(f.Name())
@@ -107,7 +108,7 @@ func TestAuditFile_fileMode0000(t *testing.T) {
Logger: hclog.NewNullLogger(),
}
_, err = Factory(context.Background(), backendConfig, nil)
_, err = Factory(context.Background(), backendConfig, &corehelpers.NoopHeaderFormatter{})
require.NoError(t, err)
info, err := os.Stat(f.Name())
@@ -136,7 +137,7 @@ func TestAuditFile_EventLogger_fileModeNew(t *testing.T) {
Logger: hclog.NewNullLogger(),
}
_, err = Factory(context.Background(), backendConfig, nil)
_, err = Factory(context.Background(), backendConfig, &corehelpers.NoopHeaderFormatter{})
require.NoError(t, err)
info, err := os.Stat(file)
@@ -144,8 +145,8 @@ func TestAuditFile_EventLogger_fileModeNew(t *testing.T) {
require.Equalf(t, os.FileMode(mode), info.Mode(), "File mode does not match.")
}
// TestBackend_formatterConfig ensures that all the configuration values are parsed correctly.
func TestBackend_formatterConfig(t *testing.T) {
// TestBackend_newFormatterConfig ensures that all the configuration values are parsed correctly.
func TestBackend_newFormatterConfig(t *testing.T) {
t.Parallel()
tests := map[string]struct {
@@ -201,7 +202,7 @@ func TestBackend_formatterConfig(t *testing.T) {
},
want: audit.FormatterConfig{},
wantErr: true,
expectedMessage: "file.formatterConfig: unable to parse 'hmac_accessor': strconv.ParseBool: parsing \"maybe\": invalid syntax",
expectedMessage: "file.newFormatterConfig: unable to parse 'hmac_accessor': strconv.ParseBool: parsing \"maybe\": invalid syntax",
},
"invalid-log-raw": {
config: map[string]string{
@@ -211,7 +212,7 @@ func TestBackend_formatterConfig(t *testing.T) {
},
want: audit.FormatterConfig{},
wantErr: true,
expectedMessage: "file.formatterConfig: unable to parse 'log_raw': strconv.ParseBool: parsing \"maybe\": invalid syntax",
expectedMessage: "file.newFormatterConfig: unable to parse 'log_raw': strconv.ParseBool: parsing \"maybe\": invalid syntax",
},
"invalid-elide-bool": {
config: map[string]string{
@@ -222,7 +223,18 @@ func TestBackend_formatterConfig(t *testing.T) {
},
want: audit.FormatterConfig{},
wantErr: true,
expectedMessage: "file.formatterConfig: unable to parse 'elide_list_responses': strconv.ParseBool: parsing \"maybe\": invalid syntax",
expectedMessage: "file.newFormatterConfig: unable to parse 'elide_list_responses': strconv.ParseBool: parsing \"maybe\": invalid syntax",
},
"prefix": {
config: map[string]string{
"format": audit.JSONFormat.String(),
"prefix": "foo",
},
want: audit.FormatterConfig{
RequiredFormat: audit.JSONFormat,
Prefix: "foo",
HMACAccessor: true,
},
},
}
for name, tc := range tests {
@@ -231,14 +243,19 @@ func TestBackend_formatterConfig(t *testing.T) {
t.Run(name, func(t *testing.T) {
t.Parallel()
got, err := formatterConfig(tc.config)
got, err := newFormatterConfig(&corehelpers.NoopHeaderFormatter{}, tc.config)
if tc.wantErr {
require.Error(t, err)
require.EqualError(t, err, tc.expectedMessage)
} else {
require.NoError(t, err)
}
require.Equal(t, tc.want, got)
require.Equal(t, tc.want.RequiredFormat, got.RequiredFormat)
require.Equal(t, tc.want.Raw, got.Raw)
require.Equal(t, tc.want.ElideListResponses, got.ElideListResponses)
require.Equal(t, tc.want.HMACAccessor, got.HMACAccessor)
require.Equal(t, tc.want.OmitTime, got.OmitTime)
require.Equal(t, tc.want.Prefix, got.Prefix)
})
}
}
@@ -253,7 +270,7 @@ func TestBackend_configureFormatterNode(t *testing.T) {
nodeMap: map[eventlogger.NodeID]eventlogger.Node{},
}
formatConfig, err := audit.NewFormatterConfig()
formatConfig, err := audit.NewFormatterConfig(&corehelpers.NoopHeaderFormatter{})
require.NoError(t, err)
err = b.configureFormatterNode("juan", formatConfig, hclog.NewNullLogger())
@@ -476,7 +493,7 @@ func TestBackend_Factory_Conf(t *testing.T) {
t.Run(name, func(t *testing.T) {
t.Parallel()
be, err := Factory(ctx, tc.backendConfig, nil)
be, err := Factory(ctx, tc.backendConfig, &corehelpers.NoopHeaderFormatter{})
switch {
case tc.isErrorExpected:
@@ -535,7 +552,7 @@ func TestBackend_IsFallback(t *testing.T) {
t.Run(name, func(t *testing.T) {
t.Parallel()
be, err := Factory(ctx, tc.backendConfig, nil)
be, err := Factory(ctx, tc.backendConfig, &corehelpers.NoopHeaderFormatter{})
require.NoError(t, err)
require.NotNil(t, be)
require.Equal(t, tc.isFallbackExpected, be.IsFallback())