scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-31 02:28:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
672cdc0fdb35daa04ad9c59ff2146d94e8f7dc4f
vault/command/pki_health_check_test.go
Alexander Scheel 1ad92c5dcc Various health check improvements + tests (#18096) 
* Rename common.go->healthcheck.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Push handling of no resources to the health checks

This allows us to better run on empty mounts.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Exit when no issuers are found

This makes health checks less useful.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add additional test criteria, refactor tests

This will allow us to setup more tests.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add more OK statuses when checks are good

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add test cases for all bad results

The test for too-many-certs was elided for now due to being too hard to
setup in CI.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add test for missing mount

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add expected failure test on empty mount

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add test for only having an issuer in the mount

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* More consistently perform permission checks

Also return them to the caller when they're relevant.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add test without token

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Run health check tests in parallel

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Update command/healthcheck/healthcheck.go

Co-authored-by: Steven Clark <steven.clark@hashicorp.com>

* Update command/healthcheck/healthcheck.go

Co-authored-by: Steven Clark <steven.clark@hashicorp.com>

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
2022-11-23 14:42:19 +00:00

632 lines
13 KiB
Go
Raw Blame History

package command
import (
"bytes"
"encoding/json"
"fmt"
"strings"
"testing"
"time"
"github.com/hashicorp/vault/api"
"github.com/hashicorp/vault/command/healthcheck"
"github.com/mitchellh/cli"
"github.com/stretchr/testify/require"
)
func TestPKIHC_AllGood(t *testing.T) {
t.Parallel()
client, closer := testVaultServer(t)
defer closer()
if err := client.Sys().Mount("pki", &api.MountInput{
Type: "pki",
Config: api.MountConfigInput{
AuditNonHMACRequestKeys: healthcheck.VisibleReqParams,
AuditNonHMACResponseKeys: healthcheck.VisibleRespParams,
PassthroughRequestHeaders: []string{"If-Modified-Since"},
AllowedResponseHeaders: []string{"Last-Modified"},
MaxLeaseTTL: "36500d",
},
}); err != nil {
t.Fatalf("pki mount error: %#v", err)
}
if resp, err := client.Logical().Write("pki/root/generate/internal", map[string]interface{}{
"key_type": "ec",
"common_name": "Root X1",
"ttl": "3650d",
}); err != nil || resp == nil {
t.Fatalf("failed to prime CA: %v", err)
}
if _, err := client.Logical().Read("pki/crl/rotate"); err != nil {
t.Fatalf("failed to rotate CRLs: %v", err)
}
if _, err := client.Logical().Write("pki/roles/testing", map[string]interface{}{
"allow_any_name": true,
"no_store": true,
}); err != nil {
t.Fatalf("failed to write role: %v", err)
}
if _, err := client.Logical().Write("pki/config/auto-tidy", map[string]interface{}{
"enabled": true,
"tidy_cert_store": true,
}); err != nil {
t.Fatalf("failed to write auto-tidy config: %v", err)
}
if _, err := client.Logical().Write("pki/tidy", map[string]interface{}{
"tidy_cert_store": true,
}); err != nil {
t.Fatalf("failed to run tidy: %v", err)
}
_, _, results := execPKIHC(t, client, true)
validateExpectedPKIHC(t, expectedAllGood, results)
}
func TestPKIHC_AllBad(t *testing.T) {
t.Parallel()
client, closer := testVaultServer(t)
defer closer()
if err := client.Sys().Mount("pki", &api.MountInput{
Type: "pki",
}); err != nil {
t.Fatalf("pki mount error: %#v", err)
}
if resp, err := client.Logical().Write("pki/root/generate/internal", map[string]interface{}{
"key_type": "ec",
"common_name": "Root X1",
"ttl": "35d",
}); err != nil || resp == nil {
t.Fatalf("failed to prime CA: %v", err)
}
if _, err := client.Logical().Write("pki/config/crl", map[string]interface{}{
"expiry": "5s",
}); err != nil {
t.Fatalf("failed to issue leaf cert: %v", err)
}
if _, err := client.Logical().Read("pki/crl/rotate"); err != nil {
t.Fatalf("failed to rotate CRLs: %v", err)
}
time.Sleep(5 * time.Second)
if _, err := client.Logical().Write("pki/roles/testing", map[string]interface{}{
"allow_localhost": true,
"allowed_domains": "*.example.com",
"allow_glob_domains": true,
"allow_wildcard_certificates": true,
"no_store": false,
"key_type": "ec",
"ttl": "30d",
}); err != nil {
t.Fatalf("failed to write role: %v", err)
}
if _, err := client.Logical().Write("pki/issue/testing", map[string]interface{}{
"common_name": "something.example.com",
}); err != nil {
t.Fatalf("failed to issue leaf cert: %v", err)
}
if _, err := client.Logical().Write("pki/config/auto-tidy", map[string]interface{}{
"enabled": false,
"tidy_cert_store": false,
}); err != nil {
t.Fatalf("failed to write auto-tidy config: %v", err)
}
_, _, results := execPKIHC(t, client, true)
validateExpectedPKIHC(t, expectedAllBad, results)
}
func TestPKIHC_OnlyIssuer(t *testing.T) {
t.Parallel()
client, closer := testVaultServer(t)
defer closer()
if err := client.Sys().Mount("pki", &api.MountInput{
Type: "pki",
}); err != nil {
t.Fatalf("pki mount error: %#v", err)
}
if resp, err := client.Logical().Write("pki/root/generate/internal", map[string]interface{}{
"key_type": "ec",
"common_name": "Root X1",
"ttl": "35d",
}); err != nil || resp == nil {
t.Fatalf("failed to prime CA: %v", err)
}
_, _, results := execPKIHC(t, client, true)
validateExpectedPKIHC(t, expectedEmptyWithIssuer, results)
}
func TestPKIHC_NoMount(t *testing.T) {
t.Parallel()
client, closer := testVaultServer(t)
defer closer()
code, message, _ := execPKIHC(t, client, false)
if code != 1 {
t.Fatalf("Expected return code 1 from invocation on non-existent mount, got %v\nOutput: %v", code, message)
}
if !strings.Contains(message, "route entry not found") {
t.Fatalf("Expected failure to talk about missing route entry, got exit code %v\nOutput: %v", code, message)
}
}
func TestPKIHC_ExpectedEmptyMount(t *testing.T) {
t.Parallel()
client, closer := testVaultServer(t)
defer closer()
if err := client.Sys().Mount("pki", &api.MountInput{
Type: "pki",
}); err != nil {
t.Fatalf("pki mount error: %#v", err)
}
code, message, _ := execPKIHC(t, client, false)
if code != 1 {
t.Fatalf("Expected return code 1 from invocation on empty mount, got %v\nOutput: %v", code, message)
}
if !strings.Contains(message, "lacks any configured issuers,") {
t.Fatalf("Expected failure to talk about no issuers, got exit code %v\nOutput: %v", code, message)
}
}
func TestPKIHC_NoPerm(t *testing.T) {
t.Parallel()
client, closer := testVaultServer(t)
defer closer()
if err := client.Sys().Mount("pki", &api.MountInput{
Type: "pki",
}); err != nil {
t.Fatalf("pki mount error: %#v", err)
}
if resp, err := client.Logical().Write("pki/root/generate/internal", map[string]interface{}{
"key_type": "ec",
"common_name": "Root X1",
"ttl": "35d",
}); err != nil || resp == nil {
t.Fatalf("failed to prime CA: %v", err)
}
if _, err := client.Logical().Write("pki/config/crl", map[string]interface{}{
"expiry": "5s",
}); err != nil {
t.Fatalf("failed to issue leaf cert: %v", err)
}
if _, err := client.Logical().Read("pki/crl/rotate"); err != nil {
t.Fatalf("failed to rotate CRLs: %v", err)
}
time.Sleep(5 * time.Second)
if _, err := client.Logical().Write("pki/roles/testing", map[string]interface{}{
"allow_localhost": true,
"allowed_domains": "*.example.com",
"allow_glob_domains": true,
"allow_wildcard_certificates": true,
"no_store": false,
"key_type": "ec",
"ttl": "30d",
}); err != nil {
t.Fatalf("failed to write role: %v", err)
}
if _, err := client.Logical().Write("pki/issue/testing", map[string]interface{}{
"common_name": "something.example.com",
}); err != nil {
t.Fatalf("failed to issue leaf cert: %v", err)
}
if _, err := client.Logical().Write("pki/config/auto-tidy", map[string]interface{}{
"enabled": false,
"tidy_cert_store": false,
}); err != nil {
t.Fatalf("failed to write auto-tidy config: %v", err)
}
// Remove client token.
client.ClearToken()
_, _, results := execPKIHC(t, client, true)
validateExpectedPKIHC(t, expectedNoPerm, results)
}
func testPKIHealthCheckCommand(tb testing.TB) (*cli.MockUi, *PKIHealthCheckCommand) {
tb.Helper()
ui := cli.NewMockUi()
return ui, &PKIHealthCheckCommand{
BaseCommand: &BaseCommand{
UI: ui,
},
}
}
func execPKIHC(t *testing.T, client *api.Client, ok bool) (int, string, map[string][]map[string]interface{}) {
stdout := bytes.NewBuffer(nil)
stderr := bytes.NewBuffer(nil)
runOpts := &RunOptions{
Stdout: stdout,
Stderr: stderr,
Client: client,
}
code := RunCustom([]string{"pki", "health-check", "-format=json", "pki"}, runOpts)
combined := stdout.String() + stderr.String()
var results map[string][]map[string]interface{}
if err := json.Unmarshal([]byte(combined), &results); err != nil {
if ok {
t.Fatalf("failed to decode json (ret %v): %v\njson:\n%v", code, err, combined)
}
}
t.Log(combined)
return code, combined, results
}
func validateExpectedPKIHC(t *testing.T, expected, results map[string][]map[string]interface{}) {
for test, subtest := range expected {
actual, ok := results[test]
require.True(t, ok, fmt.Sprintf("expected top-level test %v to be present", test))
if subtest == nil {
continue
}
require.NotNil(t, actual, fmt.Sprintf("expected top-level test %v to be non-empty; wanted wireframe format %v", test, subtest))
require.Equal(t, len(subtest), len(actual), fmt.Sprintf("top-level test %v has different number of results %v in wireframe, %v in test output\nwireframe: %v\noutput: %v\n", test, len(subtest), len(actual), subtest, actual))
for index, subset := range subtest {
for key, value := range subset {
a_value, present := actual[index][key]
require.True(t, present)
if value != nil {
require.Equal(t, value, a_value, fmt.Sprintf("in test: %v / result %v - when validating key %v\nWanted: %v\nGot: %v", test, index, key, subset, actual[index]))
}
}
}
}
for name := range results {
if _, present := expected[name]; !present {
t.Fatalf("got unexpected health check: %v\n%v", name, results[name])
}
}
}
var expectedAllGood = map[string][]map[string]interface{}{
"ca_validity_period": {
{
"status": "ok",
},
},
"crl_validity_period": {
{
"status": "ok",
},
{
"status": "ok",
},
},
"allow_if_modified_since": {
{
"status": "ok",
},
},
"audit_visibility": {
{
"status": "ok",
},
},
"enable_auto_tidy": {
{
"status": "ok",
},
},
"role_allows_glob_wildcards": {
{
"status": "ok",
},
},
"role_allows_localhost": {
{
"status": "ok",
},
},
"role_no_store_false": {
{
"status": "ok",
},
},
"root_issued_leaves": {
{
"status": "ok",
},
},
"tidy_last_run": {
{
"status": "ok",
},
},
"too_many_certs": {
{
"status": "ok",
},
},
}
var expectedAllBad = map[string][]map[string]interface{}{
"ca_validity_period": {
{
"status": "critical",
},
},
"crl_validity_period": {
{
"status": "critical",
},
{
"status": "critical",
},
},
"allow_if_modified_since": {
{
"status": "informational",
},
},
"audit_visibility": {
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
{
"status": "informational",
},
},
"enable_auto_tidy": {
{
"status": "informational",
},
},
"role_allows_glob_wildcards": {
{
"status": "warning",
},
},
"role_allows_localhost": {
{
"status": "warning",
},
},
"role_no_store_false": {
{
"status": "warning",
},
},
"root_issued_leaves": {
{
"status": "warning",
},
},
"tidy_last_run": {
{
"status": "critical",
},
},
"too_many_certs": {
{
"status": "ok",
},
},
}
var expectedEmptyWithIssuer = map[string][]map[string]interface{}{
"ca_validity_period": {
{
"status": "critical",
},
},
"crl_validity_period": {
{
"status": "ok",
},
{
"status": "ok",
},
},
"allow_if_modified_since": nil,
"audit_visibility": nil,
"enable_auto_tidy": {
{
"status": "informational",
},
},
"role_allows_glob_wildcards": nil,
"role_allows_localhost": nil,
"role_no_store_false": nil,
"root_issued_leaves": {
{
"status": "ok",
},
},
"tidy_last_run": {
{
"status": "critical",
},
},
"too_many_certs": {
{
"status": "ok",
},
},
}
var expectedNoPerm = map[string][]map[string]interface{}{
"ca_validity_period": {
{
"status": "critical",
},
},
"crl_validity_period": {
{
"status": "insufficient_permissions",
},
{
"status": "critical",
},
{
"status": "critical",
},
},
"allow_if_modified_since": nil,
"audit_visibility": nil,
"enable_auto_tidy": {
{
"status": "insufficient_permissions",
},
},
"role_allows_glob_wildcards": {
{
"status": "insufficient_permissions",
},
},
"role_allows_localhost": {
{
"status": "insufficient_permissions",
},
},
"role_no_store_false": {
{
"status": "insufficient_permissions",
},
},
"root_issued_leaves": {
{
"status": "ok",
},
},
"tidy_last_run": {
{
"status": "insufficient_permissions",
},
},
"too_many_certs": {
{
"status": "ok",
},
},
}
Reference in New Issue View Git Blame Copy Permalink