refactor (kms): adopt the go-kms-wrapping/extras/kms package (#2027)
* feature (db): add Db.UnderlyingDB() This is needed to allow for integration with bits that need a *dbw.DB * feature (kms): add new go-kms-wrapping/extras/kms dependency * refactor (kms): schema changes required to adopt extras/kms pkg * refactor (kms/iam): rename to DeprecateCreateKeysTx(...) * refactor (kms): remove deprecated test * refactor (kms): refactor Kms type This refactor includes renaming the existing type to DeprecatedKms and then refactoring the Kms type to become a wrapper of go-kms-wrapping/extras/kms * refactor (kms): delete all the unneeded bits All this stuff is not needed now that we're using go-kms-wrapping/extras/kms * refactor (db): fixup tests after kms refactor * refactor (kms/tests): use testing.TB for test helpers Our test helper packages were not possible to use with benchmarks. This refactor switches to testing.TB to allow both tests and benchmarks to use the helpers. * tests (session benchmarks): refactor to use new Kms type * refactor (schema): rm test which relies on deprecated Kms code * refactor (kms): post rebase on main changes required * chore (kms refactor): re-add unit test from main * refactor (kms): uses migrations that don't include KMS schema changes
This commit is contained in:
97 files changed
+2580
-15154
No files matched your search
+13
-251
@@ -2,276 +2,38 @@ package kms
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/internal/db"
|
||||
wrapping "github.com/hashicorp/go-kms-wrapping/v2"
|
||||
aead "github.com/hashicorp/go-kms-wrapping/v2/aead"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestRootKey(t testing.TB, conn *db.DB, scopeId string) *RootKey {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := AllocRootKey(); return &i }(), "scope_id = ?", scopeId)
|
||||
rw := db.New(conn)
|
||||
k, err := NewRootKey(scopeId)
|
||||
require.NoError(err)
|
||||
id, err := newRootKeyId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestRootKeyVersion(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, rootId string) (kv *RootKeyVersion, kvWrapper wrapping.Wrapper) {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
rootKeyVersionWrapper := db.TestWrapper(t)
|
||||
key, err := rootKeyVersionWrapper.(*aead.Wrapper).KeyBytes(context.Background())
|
||||
require.NoError(err)
|
||||
k, err := NewRootKeyVersion(rootId, key)
|
||||
require.NoError(err)
|
||||
id, err := newRootKeyVersionId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = k.Encrypt(context.Background(), wrapper)
|
||||
require.NoError(err)
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
_, err = rootKeyVersionWrapper.(*aead.Wrapper).SetConfig(context.Background(), wrapping.WithKeyId(k.GetPrivateId()))
|
||||
require.NoError(err)
|
||||
return k, rootKeyVersionWrapper
|
||||
}
|
||||
|
||||
// TestKms creates a kms for testing.
|
||||
func TestKms(t testing.TB, conn *db.DB, rootWrapper wrapping.Wrapper) *Kms {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
kmsRepo, err := NewRepository(rw, rw)
|
||||
require.NoError(err)
|
||||
kms, err := NewKms(kmsRepo)
|
||||
kms, err := New(context.Background(), rw, rw)
|
||||
require.NoError(err)
|
||||
err = kms.AddExternalWrappers(context.Background(), WithRootWrapper(rootWrapper))
|
||||
require.NoError(err)
|
||||
_, err = kms.underlying.GetExternalRootWrapper()
|
||||
require.NoError(err)
|
||||
return kms
|
||||
}
|
||||
|
||||
func TestDatabaseKey(t testing.TB, conn *db.DB, rootKeyId string) *DatabaseKey {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := AllocDatabaseKey(); return &i }(), "root_key_id = ?", rootKeyId)
|
||||
k, err := NewDatabaseKey(rootKeyId)
|
||||
require.NoError(err)
|
||||
id, err := newDatabaseKeyId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
k.RootKeyId = rootKeyId
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
// TestKmsDeleteKeyPurpose allows you to delete a KeyPurpose for testing.
|
||||
func TestKmsDeleteKeyPurpose(t testing.TB, conn *db.DB, purpose KeyPurpose) {
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := dataKey{}; return &i }(), fmt.Sprintf("purpose='%s'", purpose.String()))
|
||||
}
|
||||
|
||||
func TestDatabaseKeyVersion(t testing.TB, conn *db.DB, rootKeyVersionWrapper wrapping.Wrapper, databaseKeyId string, key []byte) *DatabaseKeyVersion {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
rootKeyId, err := rootKeyVersionWrapper.KeyId(context.Background())
|
||||
require.NoError(err)
|
||||
rootKeyVersionId := rootKeyId
|
||||
require.NotEmpty(rootKeyVersionId)
|
||||
k, err := NewDatabaseKeyVersion(databaseKeyId, key, rootKeyVersionId)
|
||||
require.NoError(err)
|
||||
id, err := newDatabaseKeyVersionId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = k.Encrypt(context.Background(), rootKeyVersionWrapper)
|
||||
require.NoError(err)
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
// TestKmsDeleteAllKeys allows you to delete all the keys for testing.
|
||||
func TestKmsDeleteAllKeys(t testing.TB, conn *db.DB) {
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := rootKey{}; return &i }(), "1=1")
|
||||
}
|
||||
|
||||
func TestOplogKey(t testing.TB, conn *db.DB, rootKeyId string) *OplogKey {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := AllocOplogKey(); return &i }(), "root_key_id = ?", rootKeyId)
|
||||
k, err := NewOplogKey(rootKeyId)
|
||||
require.NoError(err)
|
||||
id, err := newOplogKeyId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
k.RootKeyId = rootKeyId
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
type dataKey struct{}
|
||||
|
||||
func TestOplogKeyVersion(t testing.TB, conn *db.DB, rootKeyVersionWrapper wrapping.Wrapper, oplogKeyId string, key []byte) *OplogKeyVersion {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
rootKeyId, err := rootKeyVersionWrapper.KeyId(context.Background())
|
||||
require.NoError(err)
|
||||
rootKeyVersionId := rootKeyId
|
||||
require.NotEmpty(rootKeyVersionId)
|
||||
k, err := NewOplogKeyVersion(oplogKeyId, key, rootKeyVersionId)
|
||||
require.NoError(err)
|
||||
id, err := newOplogKeyVersionId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = k.Encrypt(context.Background(), rootKeyVersionWrapper)
|
||||
require.NoError(err)
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestTokenKey(t testing.TB, conn *db.DB, rootKeyId string) *TokenKey {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := AllocTokenKey(); return &i }(), "root_key_id = ?", rootKeyId)
|
||||
rw := db.New(conn)
|
||||
k, err := NewTokenKey(rootKeyId)
|
||||
require.NoError(err)
|
||||
id, err := newTokenKeyId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
k.RootKeyId = rootKeyId
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestTokenKeyVersion(t testing.TB, conn *db.DB, rootKeyVersionWrapper wrapping.Wrapper, tokenKeyId string, key []byte) *TokenKeyVersion {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
rootKeyId, err := rootKeyVersionWrapper.KeyId(context.Background())
|
||||
require.NoError(err)
|
||||
rootKeyVersionId := rootKeyId
|
||||
require.NotEmpty(rootKeyVersionId)
|
||||
k, err := NewTokenKeyVersion(tokenKeyId, key, rootKeyVersionId)
|
||||
require.NoError(err)
|
||||
id, err := newTokenKeyVersionId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = k.Encrypt(context.Background(), rootKeyVersionWrapper)
|
||||
require.NoError(err)
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestSessionKey(t testing.TB, conn *db.DB, rootKeyId string) *SessionKey {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := AllocSessionKey(); return &i }(), "root_key_id = ?", rootKeyId)
|
||||
rw := db.New(conn)
|
||||
k, err := NewSessionKey(rootKeyId)
|
||||
require.NoError(err)
|
||||
id, err := newSessionKeyId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
k.RootKeyId = rootKeyId
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestSessionKeyVersion(t testing.TB, conn *db.DB, rootKeyVersionWrapper wrapping.Wrapper, sessionKeyId string, key []byte) *SessionKeyVersion {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
rootKeyId, err := rootKeyVersionWrapper.KeyId(context.Background())
|
||||
require.NoError(err)
|
||||
rootKeyVersionId := rootKeyId
|
||||
require.NotEmpty(rootKeyVersionId)
|
||||
k, err := NewSessionKeyVersion(sessionKeyId, key, rootKeyVersionId)
|
||||
require.NoError(err)
|
||||
id, err := newSessionKeyVersionId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = k.Encrypt(context.Background(), rootKeyVersionWrapper)
|
||||
require.NoError(err)
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestOidcKey(t testing.TB, conn *db.DB, rootKeyId string) *OidcKey {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := AllocOidcKey(); return &i }(), "root_key_id = ?", rootKeyId)
|
||||
rw := db.New(conn)
|
||||
k, err := NewOidcKey(rootKeyId)
|
||||
require.NoError(err)
|
||||
id, err := newOidcKeyId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
k.RootKeyId = rootKeyId
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestOidcKeyVersion(t testing.TB, conn *db.DB, rootKeyVersionWrapper wrapping.Wrapper, oidcKeyId string, key []byte) *OidcKeyVersion {
|
||||
t.Helper()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
rootKeyId, err := rootKeyVersionWrapper.KeyId(context.Background())
|
||||
require.NoError(err)
|
||||
rootKeyVersionId := rootKeyId
|
||||
require.NotEmpty(rootKeyVersionId)
|
||||
k, err := NewOidcKeyVersion(oidcKeyId, key, rootKeyVersionId)
|
||||
require.NoError(err)
|
||||
id, err := newOidcKeyVersionId()
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = k.Encrypt(context.Background(), rootKeyVersionWrapper)
|
||||
require.NoError(err)
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestAuditKey(t testing.TB, conn *db.DB, rootKeyId string) *AuditKey {
|
||||
t.Helper()
|
||||
ctx := context.Background()
|
||||
require := require.New(t)
|
||||
db.TestDeleteWhere(t, conn, func() interface{} { i := AllocAuditKey(); return &i }(), "root_key_id = ?", rootKeyId)
|
||||
rw := db.New(conn)
|
||||
k, err := NewAuditKey(ctx, rootKeyId)
|
||||
require.NoError(err)
|
||||
id, err := newAuditKeyId(ctx)
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
k.RootKeyId = rootKeyId
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
|
||||
func TestAuditKeyVersion(t testing.TB, conn *db.DB, rootKeyVersionWrapper wrapping.Wrapper, auditKeyId string, key []byte) *AuditKeyVersion {
|
||||
t.Helper()
|
||||
ctx := context.Background()
|
||||
require := require.New(t)
|
||||
rw := db.New(conn)
|
||||
rootKeyVersionId, err := rootKeyVersionWrapper.KeyId(ctx)
|
||||
require.NoError(err)
|
||||
require.NotEmpty(rootKeyVersionId)
|
||||
k, err := NewAuditKeyVersion(ctx, auditKeyId, key, rootKeyVersionId)
|
||||
require.NoError(err)
|
||||
id, err := newAuditKeyVersionId(ctx)
|
||||
require.NoError(err)
|
||||
k.PrivateId = id
|
||||
err = k.Encrypt(context.Background(), rootKeyVersionWrapper)
|
||||
require.NoError(err)
|
||||
err = rw.Create(context.Background(), k)
|
||||
require.NoError(err)
|
||||
return k
|
||||
}
|
||||
func (*dataKey) TableName() string { return "kms_data_key" }
|
||||
Reference in new issue
Block a user