From 746958d1875f5a334abef4f44c150fa017dd9d19 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Wed, 11 Apr 2018 10:35:50 +0200 Subject: [PATCH] Upgrade to Vault 0.10.0. Closes gh-240. --- .travis.yml | 1 + .../VaultSysTemplateIntegrationTests.java | 4 +- .../VaultTransitTemplateIntegrationTests.java | 47 ------------------ .../vault/util/PrepareVault.java | 41 ++++++++++++---- .../springframework/vault/util/VaultRule.java | 48 ++++++++++--------- src/test/bash/install_vault.sh | 2 +- 6 files changed, 60 insertions(+), 83 deletions(-) diff --git a/.travis.yml b/.travis.yml index d4187ede..164b3798 100644 --- a/.travis.yml +++ b/.travis.yml @@ -16,6 +16,7 @@ env: - VAULT_VER=0.8.3 - VAULT_VER=0.9.0 - VAULT_VER=0.9.5 + - VAULT_VER=0.10.0 - PROFILE=springNext before_install: diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultSysTemplateIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultSysTemplateIntegrationTests.java index 56f49ab8..ab5923b6 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultSysTemplateIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultSysTemplateIntegrationTests.java @@ -57,7 +57,7 @@ public class VaultSysTemplateIntegrationTests extends IntegrationTestSupport { private VaultSysOperations adminOperations; @Before - public void before() throws Exception { + public void before() { vaultVersion = prepare().getVersion(); @@ -72,8 +72,6 @@ public class VaultSysTemplateIntegrationTests extends IntegrationTestSupport { assertThat(mounts).containsKey("secret/"); VaultMount secret = mounts.get("secret/"); - assertThat(Arrays.asList("generic secret storage", "key/value secret storage")) - .contains(secret.getDescription()); assertThat(Arrays.asList("kv", "generic")).contains(secret.getType()); } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java index c4cbe675..f4435da9 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java @@ -684,17 +684,6 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport assertThat(signature.getSignature()).isNotEmpty(); } - @Test(expected = VaultException.class) - public void signWithInvalidAlgorithmShouldFail() { - - String keyName = createEcdsaP256Key(); - - VaultSignRequest request = VaultSignRequest.builder() - .plaintext(Plaintext.of("hello-world")).algorithm("blah-512").build(); - - transitOperations.sign(keyName, request); - } - @Test public void shouldVerifyValidSignature() { @@ -746,42 +735,6 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport assertThat(valid).isEqualTo(SignatureValidation.valid()); } - @Test - public void shouldFailToVerifyValidSignatureWithInvalidExistingCustomAlgorithm() { - - assumeTrue(vaultVersion.isGreaterThanOrEqualTo(SIGN_VERIFY_INTRODUCED_IN_VERSION)); - - String keyName = createEcdsaP256Key(); - - Plaintext plaintext = Plaintext.of("hello-world"); - Signature signature = transitOperations.sign(keyName, plaintext); - - VaultSignatureVerificationRequest verificationRequest = VaultSignatureVerificationRequest - .builder().algorithm("sha2-512").plaintext(plaintext) - .signature(signature).build(); - - SignatureValidation valid = transitOperations - .verify(keyName, verificationRequest); - assertThat(valid).isEqualTo(SignatureValidation.invalid()); - } - - @Test(expected = VaultException.class) - public void shouldFailToVerifyValidSignatureWithInvalidCustomAlgorithm() { - - assumeTrue(vaultVersion.isGreaterThanOrEqualTo(SIGN_VERIFY_INTRODUCED_IN_VERSION)); - - String keyName = createEcdsaP256Key(); - - Plaintext plaintext = Plaintext.of("hello-world"); - Signature signature = transitOperations.sign(keyName, plaintext); - - VaultSignatureVerificationRequest verificationRequest = VaultSignatureVerificationRequest - .builder().algorithm("blah-512").plaintext(plaintext) - .signature(signature).build(); - - transitOperations.verify(keyName, verificationRequest); - } - @Test public void shouldCreateNewExportableKey() { diff --git a/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java b/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java index 587449ca..7d814f2c 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java @@ -15,6 +15,8 @@ */ package org.springframework.vault.util; +import java.util.Collections; + import org.springframework.util.Assert; import org.springframework.util.StringUtils; import org.springframework.vault.core.VaultOperations; @@ -46,6 +48,13 @@ public class PrepareVault { private final VaultSysOperations adminOperations; private WebClient webClient; + /** + * Create a new {@link PrepareVault} object. + * + * @param webClient must not be {@literal null}. + * @param restTemplate must not be {@literal null}. + * @param vaultOperations must not be {@literal null}. + */ public PrepareVault(WebClient webClient, RestTemplate restTemplate, VaultOperations vaultOperations) { @@ -84,9 +93,9 @@ public class PrepareVault { /** * Create a token for the given {@code tokenId} and {@code policy}. * - * @param tokenId - * @param policy - * @return + * @param tokenId must not be {@literal null}. + * @param policy must not be {@literal null}. + * @return the created {@link VaultToken}. */ public VaultToken createToken(String tokenId, String policy) { @@ -104,7 +113,7 @@ public class PrepareVault { /** * Check whether Vault is available (vault created and unsealed). * - * @return + * @return {@literal true} if Vault is available (vault created and unsealed). */ public boolean isAvailable() { return adminOperations.isInitialized() && !adminOperations.health().isSealed(); @@ -113,7 +122,7 @@ public class PrepareVault { /** * Mount an auth backend. * - * @param authBackend + * @param authBackend must not be {@literal null} or empty. */ public void mountAuth(String authBackend) { @@ -125,8 +134,8 @@ public class PrepareVault { /** * Check whether a auth-backend is enabled. * - * @param authBackend - * @return + * @param authBackend must not be {@literal null} or empty. + * @return {@literal true} if a auth-backend is enabled. */ public boolean hasAuth(String authBackend) { @@ -138,7 +147,7 @@ public class PrepareVault { /** * Mount an secret backend. * - * @param secretBackend + * @param secretBackend must not be {@literal null} or empty. */ public void mountSecret(String secretBackend) { @@ -150,8 +159,8 @@ public class PrepareVault { /** * Check whether a auth-backend is enabled. * - * @param secretBackend - * @return + * @param secretBackend must not be {@literal null} or empty. + * @return {@literal true} if a auth-backend is enabled. */ public boolean hasSecret(String secretBackend) { @@ -182,6 +191,18 @@ public class PrepareVault { return Version.parse("0.0.0"); } + /** + * Disable Vault versioning Key-Value backend (kv version 2). + */ + public void disableGenericVersioning() { + + vaultOperations.opsForSys().unmount("secret"); + + VaultMount kv = VaultMount.builder().type("kv") + .config(Collections.singletonMap("versioned", false)).build(); + vaultOperations.opsForSys().mount("secret", kv); + } + public VaultOperations getVaultOperations() { return vaultOperations; } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/util/VaultRule.java b/spring-vault-core/src/test/java/org/springframework/vault/util/VaultRule.java index 92067974..ff1fe516 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/util/VaultRule.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/util/VaultRule.java @@ -15,7 +15,6 @@ */ package org.springframework.vault.util; -import java.io.IOException; import java.net.InetAddress; import java.net.InetSocketAddress; import java.net.Socket; @@ -32,12 +31,17 @@ import org.springframework.web.client.RestTemplate; import org.springframework.web.reactive.function.client.WebClient; /** - * Vault rule to ensure a running and prepared Vault. + * Vault rule to ensure a running and prepared Vault. Prepared means unsealed, having a + * non-versioning key-value backend mounted at {@code secret/} and a {@link VaultToken} + * with {@code root} privileges. * * @author Mark Paluch + * @see Settings#token() */ public class VaultRule extends ExternalResource { + public static final Version VERSIONING_INTRODUCED_WITH = Version.parse("0.10.0"); + private final VaultEndpoint vaultEndpoint; private final PrepareVault prepareVault; @@ -83,15 +87,27 @@ public class VaultRule extends ExternalResource { @Override public void before() { - Socket socket = null; - try { + assertRunningVault(); - socket = new Socket(); + if (!this.prepareVault.isAvailable()) { + this.token = prepareVault.initializeVault(); + this.prepareVault.createToken(Settings.token().getToken(), "root"); + + if (this.prepareVault.getVersion().isGreaterThanOrEqualTo( + VERSIONING_INTRODUCED_WITH)) { + this.prepareVault.disableGenericVersioning(); + } + + this.token = Settings.token(); + } + } + + private void assertRunningVault() { + + try (Socket socket = new Socket()) { socket.connect(new InetSocketAddress(InetAddress.getByName("localhost"), vaultEndpoint.getPort())); - socket.close(); - } catch (Exception ex) { throw new IllegalStateException( @@ -99,23 +115,11 @@ public class VaultRule extends ExternalResource { "Vault is not running on localhost:%d which is required to run a test using @Rule %s", vaultEndpoint.getPort(), getClass().getSimpleName())); } - finally { - if (socket != null) { - try { - socket.close(); - } - catch (IOException e) { - } - } - } - - if (!this.prepareVault.isAvailable()) { - this.token = prepareVault.initializeVault(); - this.prepareVault.createToken(Settings.token().getToken(), "root"); - this.token = Settings.token(); - } } + /** + * @return the {@link PrepareVault} object. + */ public PrepareVault prepare() { return prepareVault; } diff --git a/src/test/bash/install_vault.sh b/src/test/bash/install_vault.sh index c8e32bed..58280b6a 100755 --- a/src/test/bash/install_vault.sh +++ b/src/test/bash/install_vault.sh @@ -6,7 +6,7 @@ ########################################################################### -VAULT_VER="${VAULT_VER:-0.9.5}" +VAULT_VER="${VAULT_VER:-0.10.0}" UNAME=$(uname -s | tr '[:upper:]' '[:lower:]') VAULT_ZIP="vault_${VAULT_VER}_${UNAME}_amd64.zip" IGNORE_CERTS="${IGNORE_CERTS:-no}"