CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(vault): add context and remove deprecated errors (#2396)

Browse Source 
* refact(vault): add context and remove deprecated errors
This commit is contained in:
Irena Rindos authored and GitHub committed 2022-08-25 14:37:22 -04:00
1 parent aef9073fa6
commit b4b95e0f0e
16 files changed
+169 -141
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/credential/vault/credential_store.go
+4 -3
View File
@@ -1,6 +1,7 @@
package vault
import (
"context"
"strings"
"github.com/hashicorp/boundary/internal/credential/vault/store"
@@ -168,7 +169,7 @@ func (cs *CredentialStore) ClientCertificate() *ClientCertificate {
return cs.clientCert
}
func (cs *CredentialStore) client() (*client, error) {
func (cs *CredentialStore) client(ctx context.Context) (*client, error) {
const op = "vault.(CredentialStore).client"
clientConfig := &clientConfig{
Addr: cs.VaultAddress,
@@ -183,9 +184,9 @@ func (cs *CredentialStore) client() (*client, error) {
clientConfig.ClientKey = cs.clientCert.GetCertificateKey()
}
c, err := newClient(clientConfig)
c, err := newClient(ctx, clientConfig)
if err != nil {
return nil, errors.WrapDeprecated(err, op)
return nil, errors.Wrap(ctx, err, op)
}
return c, nil
}
internal/credential/vault/jobs.go
+8 -8
View File
@@ -181,13 +181,13 @@ func (r *TokenRenewalJob) renewToken(ctx context.Context, s *privateStore) error
return nil
}
vc, err := s.client()
vc, err := s.client(ctx)
if err != nil {
return errors.Wrap(ctx, err, op)
}
var respErr *vault.ResponseError
renewedToken, err := vc.renewToken()
renewedToken, err := vc.renewToken(ctx)
if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusForbidden {
// Vault returned a 403 when attempting a renew self, the token is either expired
// or malformed. Set status to "expired" so credentials created with token can be
@@ -411,13 +411,13 @@ func (r *TokenRevocationJob) revokeToken(ctx context.Context, s *privateStore) e
return nil
}
vc, err := s.client()
vc, err := s.client(ctx)
if err != nil {
return errors.Wrap(ctx, err, op)
}
var respErr *vault.ResponseError
err = vc.revokeToken()
err = vc.revokeToken(ctx)
if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusForbidden {
// Vault returned a 403 when attempting a revoke self, the token is already expired.
// Clobber error and set status to "revoked" below.
@@ -561,7 +561,7 @@ func (r *CredentialRenewalJob) renewCred(ctx context.Context, c *privateCredenti
return errors.Wrap(ctx, err, op)
}
vc, err := c.client()
vc, err := c.client(ctx)
if err != nil {
return errors.Wrap(ctx, err, op)
}
@@ -570,7 +570,7 @@ func (r *CredentialRenewalJob) renewCred(ctx context.Context, c *privateCredenti
var respErr *vault.ResponseError
// Subtract last renewal time from previous expiration time to get lease duration
leaseDuration := c.ExpirationTime.AsTime().Sub(c.LastRenewalTime.AsTime())
renewedCred, err := vc.renewLease(c.ExternalId, leaseDuration)
renewedCred, err := vc.renewLease(ctx, c.ExternalId, leaseDuration)
if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusBadRequest {
// Vault returned a 400 when attempting a renew lease, the lease is either expired
// or the leaseId is malformed. Set status to "expired".
@@ -720,14 +720,14 @@ func (r *CredentialRevocationJob) revokeCred(ctx context.Context, c *privateCred
return errors.Wrap(ctx, err, op)
}
vc, err := c.client()
vc, err := c.client(ctx)
if err != nil {
return errors.Wrap(ctx, err, op)
}
cred := c.toCredential()
var respErr *vault.ResponseError
err = vc.revokeLease(c.ExternalId)
err = vc.revokeLease(ctx, c.ExternalId)
if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusBadRequest {
// Vault returned a 400 when attempting a revoke lease, the lease is already expired.
// Clobber error and set status to "revoked" below.
internal/credential/vault/jobs_test.go
+3 -2
View File
@@ -97,6 +97,7 @@ func testVaultCred(t *testing.T,
expiration time.Duration,
) (*vault.Secret, *Credential) {
t.Helper()
ctx := context.Background()
assert, require := assert.New(t), require.New(t)
rw := db.New(conn)
@@ -105,9 +106,9 @@ func testVaultCred(t *testing.T,
var err error
switch Method(cl.HttpMethod) {
case MethodGet:
secret, err = client.get(cl.VaultPath)
secret, err = client.get(ctx, cl.VaultPath)
case MethodPost:
secret, err = client.post(cl.VaultPath, cl.HttpRequestBody)
secret, err = client.post(ctx, cl.VaultPath, cl.HttpRequestBody)
}
require.NoError(err)
require.NotNil(secret)
internal/credential/vault/private_credential.go
+2 -2
View File
@@ -79,7 +79,7 @@ func (pc *privateCredential) decrypt(ctx context.Context, cipher wrapping.Wrappe
return nil
}
func (pc *privateCredential) client() (*client, error) {
func (pc *privateCredential) client(ctx context.Context) (*client, error) {
const op = "vault.(privateCredential).client"
clientConfig := &clientConfig{
Addr: pc.VaultAddress,
@@ -95,7 +95,7 @@ func (pc *privateCredential) client() (*client, error) {
clientConfig.ClientKey = pc.ClientKey
}
client, err := newClient(clientConfig)
client, err := newClient(ctx, clientConfig)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to create vault client"))
}
internal/credential/vault/private_library.go
+5 -5
View File
@@ -257,7 +257,7 @@ func (pl *privateLibrary) decrypt(ctx context.Context, cipher wrapping.Wrapper)
return nil
}
func (pl *privateLibrary) client() (*client, error) {
func (pl *privateLibrary) client(ctx context.Context) (*client, error) {
const op = "vault.(privateLibrary).client"
clientConfig := &clientConfig{
Addr: pl.VaultAddress,
@@ -273,7 +273,7 @@ func (pl *privateLibrary) client() (*client, error) {
clientConfig.ClientKey = pl.ClientKey
}
client, err := newClient(clientConfig)
client, err := newClient(ctx, clientConfig)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to create vault client"))
}
@@ -297,7 +297,7 @@ func (pl *privateLibrary) retrieveCredential(ctx context.Context, op errors.Op,
return nil, errors.Wrap(ctx, err, op)
}
client, err := pl.client()
client, err := pl.client(ctx)
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -305,9 +305,9 @@ func (pl *privateLibrary) retrieveCredential(ctx context.Context, op errors.Op,
var secret *vault.Secret
switch Method(pl.HttpMethod) {
case MethodGet:
secret, err = client.get(pl.VaultPath)
secret, err = client.get(ctx, pl.VaultPath)
case MethodPost:
secret, err = client.post(pl.VaultPath, pl.HttpRequestBody)
secret, err = client.post(ctx, pl.VaultPath, pl.HttpRequestBody)
default:
return nil, errors.New(ctx, errors.Internal, op, fmt.Sprintf("unknown http method: library: %s", pl.PublicId))
}
internal/credential/vault/private_store.go
+2 -2
View File
@@ -182,7 +182,7 @@ func (ps *privateStore) decrypt(ctx context.Context, cipher wrapping.Wrapper) er
return nil
}
func (ps *privateStore) client() (*client, error) {
func (ps *privateStore) client(ctx context.Context) (*client, error) {
const op = "vault.(privateStore).client"
clientConfig := &clientConfig{
Addr: ps.VaultAddress,
@@ -198,7 +198,7 @@ func (ps *privateStore) client() (*client, error) {
clientConfig.ClientKey = ps.ClientKey
}
client, err := newClient(clientConfig)
client, err := newClient(ctx, clientConfig)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to create vault client"))
}
internal/credential/vault/repository_credential_store.go
+8 -8
View File
@@ -74,11 +74,11 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
cs.clientCert.StoreId = id
}
client, err := cs.client()
client, err := cs.client(ctx)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create vault client"))
}
tokenLookup, err := client.lookupToken()
tokenLookup, err := client.lookupToken(ctx)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to lookup vault token"))
}
@@ -86,7 +86,7 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
return nil, err
}
available, err := client.capabilities(requiredCapabilities.paths())
available, err := client.capabilities(ctx, requiredCapabilities.paths())
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get vault capabilities"))
}
@@ -96,7 +96,7 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
errors.New(ctx, errors.VaultTokenMissingCapabilities, op, fmt.Sprintf("missing capabilites: %v", missing))
}
renewedToken, err := client.renewToken()
renewedToken, err := client.renewToken(ctx)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to renew vault token"))
}
@@ -473,12 +473,12 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
}
var token *Token
client, err := updatedStore.client()
client, err := updatedStore.client(ctx)
if err != nil {
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get client for updated store"))
}
if validateToken {
tokenLookup, err := client.lookupToken()
tokenLookup, err := client.lookupToken(ctx)
if err != nil {
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("cannot lookup token for updated store"))
}
@@ -486,7 +486,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op)
}
available, err := client.capabilities(requiredCapabilities.paths())
available, err := client.capabilities(ctx, requiredCapabilities.paths())
if err != nil {
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get vault capabilities"))
}
@@ -498,7 +498,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
}
}
if updateToken {
renewedToken, err := client.renewToken()
renewedToken, err := client.renewToken(ctx)
if err != nil {
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to renew vault token"))
}
internal/credential/vault/testing.go
+5 -3
View File
@@ -627,6 +627,7 @@ func (v *TestVaultServer) client(t testing.TB) *client {
func (v *TestVaultServer) clientUsingToken(t testing.TB, token string) *client {
t.Helper()
ctx := context.Background()
require := require.New(t)
conf := &clientConfig{
Addr: v.Addr,
@@ -636,10 +637,10 @@ func (v *TestVaultServer) clientUsingToken(t testing.TB, token string) *client {
ClientKey: v.ClientKey,
}
client, err := newClient(conf)
client, err := newClient(ctx, conf)
require.NoError(err)
require.NotNil(client)
require.NoError(client.ping())
require.NoError(client.ping(ctx))
return client
}
@@ -823,10 +824,11 @@ func (v *TestVaultServer) AddKVPolicy(t testing.TB, _ ...TestOption) {
// https://www.vaultproject.io/api-docs/secret/kv/kv-v2#create-update-secret
func (v *TestVaultServer) CreateKVSecret(t testing.TB, p string, data []byte) *vault.Secret {
t.Helper()
ctx := context.Background()
require := require.New(t)
vc := v.client(t)
cred, err := vc.post(path.Join("secret", "data", p), data)
cred, err := vc.post(ctx, path.Join("secret", "data", p), data)
require.NoError(err)
return cred
}
internal/credential/vault/testing_test.go
+19 -14
View File
@@ -1,6 +1,7 @@
package vault
import (
"context"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
@@ -224,6 +225,7 @@ func TestTestVaultServer_CreateToken(t *testing.T) {
func TestNewVaultServer(t *testing.T) {
t.Parallel()
ctx := context.Background()
t.Run("TestNoTLS", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
v := NewTestVaultServer(t, WithTestVaultTLS(TestNoTLS))
@@ -237,10 +239,10 @@ func TestNewVaultServer(t *testing.T) {
Token: TokenSecret(v.RootToken),
}
client, err := newClient(conf)
client, err := newClient(ctx, conf)
require.NoError(err)
require.NotNil(client)
require.NoError(client.ping())
require.NoError(client.ping(ctx))
})
t.Run("TestServerTLS", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
@@ -257,10 +259,10 @@ func TestNewVaultServer(t *testing.T) {
CaCert: v.CaCert,
}
client, err := newClient(conf)
client, err := newClient(ctx, conf)
require.NoError(err)
require.NotNil(client)
require.NoError(client.ping())
require.NoError(client.ping(ctx))
})
t.Run("TestClientTLS", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
@@ -281,10 +283,10 @@ func TestNewVaultServer(t *testing.T) {
ClientKey: v.ClientKey,
}
client, err := newClient(conf)
client, err := newClient(ctx, conf)
require.NoError(err)
require.NotNil(client)
require.NoError(client.ping())
require.NoError(client.ping(ctx))
})
t.Run("TestClientTLS-with-client-key", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
@@ -313,10 +315,10 @@ func TestNewVaultServer(t *testing.T) {
ClientKey: v.ClientKey,
}
client, err := newClient(conf)
client, err := newClient(ctx, conf)
require.NoError(err)
require.NotNil(client)
require.NoError(client.ping())
require.NoError(client.ping(ctx))
})
}
@@ -457,6 +459,7 @@ func TestTestVaultServer_MountDatabase(t *testing.T) {
func TestTestVaultServer_LookupLease(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert, require := assert.New(t), require.New(t)
v := NewTestVaultServer(t, WithDockerNetwork(true))
v.MountDatabase(t)
@@ -469,14 +472,14 @@ func TestTestVaultServer_LookupLease(t *testing.T) {
Token: TokenSecret(v.RootToken),
}
client, err := newClient(conf)
client, err := newClient(ctx, conf)
require.NoError(err)
require.NotNil(client)
assert.NoError(client.ping())
assert.NoError(client.ping(ctx))
// Create secret
credPath := path.Join("database", "creds", "opened")
cred, err := client.get(credPath)
cred, err := client.get(ctx, credPath)
require.NoError(err)
// Sleep to move ttl
@@ -499,12 +502,13 @@ func TestTestVaultServer_LookupLease(t *testing.T) {
func TestTestVaultServer_VerifyTokenInvalid(t *testing.T) {
t.Parallel()
ctx := context.Background()
require := require.New(t)
v := NewTestVaultServer(t, WithDockerNetwork(true))
_, token := v.CreateToken(t)
client := v.clientUsingToken(t, token)
err := client.revokeToken()
err := client.revokeToken(ctx)
require.NoError(err)
v.VerifyTokenInvalid(t, token)
@@ -546,6 +550,7 @@ func Test_testClientCert(t *testing.T) {
func TestTestVaultServer_AddKVPolicy(t *testing.T) {
t.Run("defaults", func(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert, require := assert.New(t), require.New(t)
v := NewTestVaultServer(t)
@@ -556,7 +561,7 @@ func TestTestVaultServer_AddKVPolicy(t *testing.T) {
require.NotNil(token)
client := v.clientUsingToken(t, token)
_, err := client.get("/secret/data/my-secret")
_, err := client.get(ctx, "/secret/data/my-secret")
assert.Error(err)
// An attempt to get my-secret should now fail with a 403
@@ -571,7 +576,7 @@ func TestTestVaultServer_AddKVPolicy(t *testing.T) {
require.NotNil(token)
client = v.clientUsingToken(t, token)
_, err = client.get("/secret/data/my-secret")
_, err = client.get(ctx, "/secret/data/my-secret")
assert.NoError(err)
})
}
internal/credential/vault/vault.go
+27 -27
View File
@@ -44,10 +44,10 @@ type client struct {
token TokenSecret
}
func newClient(c *clientConfig) (*client, error) {
func newClient(ctx context.Context, c *clientConfig) (*client, error) {
const op = "vault.newClient"
if !c.isValid() {
return nil, errors.NewDeprecated(errors.InvalidParameter, op, "invalid configuration")
return nil, errors.New(ctx, errors.InvalidParameter, op, "invalid configuration")
}
vc := vault.DefaultConfig()
vc.Address = c.Addr
@@ -58,14 +58,14 @@ func newClient(c *clientConfig) (*client, error) {
tlsConfig := vc.HttpClient.Transport.(*http.Transport).TLSClientConfig
tlsConfig.InsecureSkipVerify = c.TlsSkipVerify
if err := rootcerts.ConfigureTLS(tlsConfig, rootConfig); err != nil {
return nil, errors.WrapDeprecated(err, op)
return nil, errors.Wrap(ctx, err, op)
}
}
if c.isClientTLS() {
clientCert, err := tls.X509KeyPair(c.ClientCert, c.ClientKey)
if err != nil {
return nil, errors.WrapDeprecated(err, op)
return nil, errors.Wrap(ctx, err, op)
}
tlsConfig := vc.HttpClient.Transport.(*http.Transport).TLSClientConfig
tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
@@ -75,7 +75,7 @@ func newClient(c *clientConfig) (*client, error) {
vClient, err := vault.NewClient(vc)
if err != nil {
return nil, errors.WrapDeprecated(err, op)
return nil, errors.Wrap(ctx, err, op)
}
vClient.SetToken(string(c.Token))
@@ -93,16 +93,16 @@ func newClient(c *clientConfig) (*client, error) {
// response is returned. This endpoint is accessible with the default
// policy in Vault 1.7.2. See
// https://www.vaultproject.io/api-docs/system/health#read-health-information.
func (c *client) ping() error {
func (c *client) ping(ctx context.Context) error {
const op = "vault.(client).ping"
h, err := c.cl.Sys().Health()
switch {
case err != nil:
return errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
case h == nil:
return errors.NewDeprecated(errors.Unavailable, op, fmt.Sprintf("no response: vault: %s", c.cl.Address()))
return errors.New(ctx, errors.Unavailable, op, fmt.Sprintf("no response: vault: %s", c.cl.Address()))
case !h.Initialized || h.Sealed:
return errors.NewDeprecated(errors.Unavailable, op, fmt.Sprintf("vault (%s): initialized: %t, sealed: %t ", c.cl.Address(), h.Initialized, h.Sealed))
return errors.New(ctx, errors.Unavailable, op, fmt.Sprintf("vault (%s): initialized: %t, sealed: %t ", c.cl.Address(), h.Initialized, h.Sealed))
}
return nil
@@ -112,11 +112,11 @@ func (c *client) ping() error {
// the vault.Secret response. This endpoint is accessible with the default
// policy in Vault 1.7.2. See
// https://www.vaultproject.io/api-docs/auth/token#renew-a-token-self.
func (c *client) renewToken() (*vault.Secret, error) {
func (c *client) renewToken(ctx context.Context) (*vault.Secret, error) {
const op = "vault.(client).renewToken"
t, err := c.cl.Auth().Token().RenewSelf(0)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
}
return t, nil
}
@@ -124,11 +124,11 @@ func (c *client) renewToken() (*vault.Secret, error) {
// revokeToken calls the /auth/token/revoke-self Vault endpoint. This
// endpoint is accessible with the default policy in Vault 1.7.2. See
// https://www.vaultproject.io/api-docs/auth/token#revoke-a-token-self.
func (c *client) revokeToken() error {
func (c *client) revokeToken(ctx context.Context) error {
const op = "vault.(client).revokeToken"
// The `token` parameter is kept for backwards compatibility but is ignored, so use ""
if err := c.cl.Auth().Token().RevokeSelf(""); err != nil {
return errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
}
return nil
}
@@ -137,11 +137,11 @@ func (c *client) revokeToken() error {
// vault.Secret response. This endpoint is accessible with the default
// policy in Vault 1.7.2. See
// https://www.vaultproject.io/api-docs/system/leases#renew-lease.
func (c *client) renewLease(leaseId string, leaseDuration time.Duration) (*vault.Secret, error) {
func (c *client) renewLease(ctx context.Context, leaseId string, leaseDuration time.Duration) (*vault.Secret, error) {
const op = "vault.(client).renewLease"
t, err := c.cl.Sys().Renew(leaseId, int(leaseDuration.Round(time.Second).Seconds()))
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
}
return t, nil
}
@@ -149,10 +149,10 @@ func (c *client) renewLease(leaseId string, leaseDuration time.Duration) (*vault
// revokeLease calls the /sys/leases/revoke Vault endpoint. This endpoint
// is NOT accessible with the default policy in Vault 1.7.2. See
// https://www.vaultproject.io/api-docs/system/leases#revoke-lease.
func (c *client) revokeLease(leaseId string) error {
func (c *client) revokeLease(ctx context.Context, leaseId string) error {
const op = "vault.(client).revokeLease"
if err := c.cl.Sys().Revoke(leaseId); err != nil {
return errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
}
return nil
}
@@ -161,33 +161,33 @@ func (c *client) revokeLease(leaseId string) error {
// the vault.Secret response. This endpoint is accessible with the default
// policy in Vault 1.7.2. See
// https://www.vaultproject.io/api-docs/auth/token#lookup-a-token-self.
func (c *client) lookupToken() (*vault.Secret, error) {
func (c *client) lookupToken(ctx context.Context) (*vault.Secret, error) {
const op = "vault.(client).lookupToken"
t, err := c.cl.Auth().Token().LookupSelf()
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
}
return t, nil
}
// swapToken replaces the token in the Vault client with t and returns the
// token that was replaced.
func (c *client) swapToken(new TokenSecret) (old TokenSecret) {
func (c *client) swapToken(ctx context.Context, new TokenSecret) (old TokenSecret) {
old = TokenSecret(c.cl.Token())
c.cl.SetToken(string(new))
return
}
func (c *client) get(path string) (*vault.Secret, error) {
func (c *client) get(ctx context.Context, path string) (*vault.Secret, error) {
const op = "vault.(client).get"
s, err := c.cl.Logical().Read(path)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
}
return s, nil
}
func (c *client) post(path string, data []byte) (*vault.Secret, error) {
func (c *client) post(ctx context.Context, path string, data []byte) (*vault.Secret, error) {
const op = "vault.(client).post"
if len(data) == 0 {
@@ -197,7 +197,7 @@ func (c *client) post(path string, data []byte) (*vault.Secret, error) {
}
s, err := c.cl.Logical().WriteBytes(path, data)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
}
return s, nil
}
@@ -206,10 +206,10 @@ func (c *client) post(path string, data []byte) (*vault.Secret, error) {
// the vault.Secret response. This endpoint is accessible with the default
// policy in Vault 1.7.2. See
// https://www.vaultproject.io/api-docs/system/capabilities-self.
func (c *client) capabilities(paths []string) (pathCapabilities, error) {
func (c *client) capabilities(ctx context.Context, paths []string) (pathCapabilities, error) {
const op = "vault.(client).capabilities"
if len(paths) == 0 {
return nil, errors.NewDeprecated(errors.InvalidParameter, op, "empty paths")
return nil, errors.New(ctx, errors.InvalidParameter, op, "empty paths")
}
body := map[string]string{
"paths": strings.Join(paths, ","),
@@ -234,7 +234,7 @@ func (c *client) capabilities(paths []string) (pathCapabilities, error) {
return nil, err
}
if secret == nil || secret.Data == nil {
return nil, errors.NewDeprecated(errors.Unknown, op, "data from Vault is empty")
return nil, errors.New(ctx, errors.Unknown, op, "data from Vault is empty")
}
var res map[string][]string
internal/credential/vault/vault_test.go
+24 -14
View File
@@ -1,6 +1,7 @@
package vault
import (
"context"
"fmt"
"net/http"
"path"
@@ -16,6 +17,7 @@ import (
func Test_newClient(t *testing.T) {
t.Parallel()
v := NewTestVaultServer(t)
ctx := context.Background()
tests := []struct {
name string
@@ -52,7 +54,7 @@ func Test_newClient(t *testing.T) {
tt := tt
t.Run(tt.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
client, err := newClient(tt.clientConfig)
client, err := newClient(ctx, tt.clientConfig)
if tt.wantErr {
require.Error(err)
assert.Nil(client)
@@ -66,6 +68,7 @@ func Test_newClient(t *testing.T) {
func TestClient_RenewToken(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert := assert.New(t)
v := NewTestVaultServer(t)
@@ -76,7 +79,7 @@ func TestClient_RenewToken(t *testing.T) {
time.Sleep(100 * time.Millisecond)
client := v.clientUsingToken(t, token)
renewedToken, err := client.renewToken()
renewedToken, err := client.renewToken(ctx)
require.NoError(t, err)
assert.NotNil(renewedToken)
@@ -102,6 +105,7 @@ func tokenExpirationTime(t *testing.T, s *vault.Secret) time.Time {
func TestClient_LookupToken(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert, require := assert.New(t), require.New(t)
v := NewTestVaultServer(t)
@@ -109,7 +113,7 @@ func TestClient_LookupToken(t *testing.T) {
secretLookup := v.LookupToken(t, token)
client := v.clientUsingToken(t, token)
tokenLookup, err := client.lookupToken()
tokenLookup, err := client.lookupToken(ctx)
assert.NoError(err)
require.NotNil(tokenLookup)
@@ -119,20 +123,21 @@ func TestClient_LookupToken(t *testing.T) {
func TestClient_RevokeToken(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert, require := assert.New(t), require.New(t)
v := NewTestVaultServer(t)
_, token := v.CreateToken(t)
client := v.clientUsingToken(t, token)
tokenLookup, err := client.lookupToken()
tokenLookup, err := client.lookupToken(ctx)
assert.NoError(err)
assert.NotNil(tokenLookup)
require.NoError(client.revokeToken())
require.NoError(client.revokeToken(ctx))
// An attempt to lookup should now fail with a 403
tokenLookup, err = client.lookupToken()
tokenLookup, err = client.lookupToken(ctx)
require.Error(err)
assert.Nil(tokenLookup)
@@ -144,19 +149,21 @@ func TestClient_RevokeToken(t *testing.T) {
func TestClient_Get(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert := assert.New(t)
v := NewTestVaultServer(t, WithDockerNetwork(true))
v.MountDatabase(t)
client := v.client(t)
cred, err := client.get(path.Join("database", "creds", "opened"))
cred, err := client.get(ctx, path.Join("database", "creds", "opened"))
assert.NoError(err)
assert.NotNil(cred)
}
func TestClient_Post(t *testing.T) {
t.Parallel()
ctx := context.Background()
v := NewTestVaultServer(t, WithTestVaultTLS(TestServerTLS))
v.MountPKI(t)
client := v.client(t)
@@ -164,13 +171,13 @@ func TestClient_Post(t *testing.T) {
t.Run("post-body", func(t *testing.T) {
assert := assert.New(t)
credData := []byte(`{"common_name":"boundary.com"}`)
cred, err := client.post(credPath, credData)
cred, err := client.post(ctx, credPath, credData)
assert.NoError(err)
assert.NotNil(cred)
})
t.Run("nil-body", func(t *testing.T) {
assert := assert.New(t)
cred, err := client.post(credPath, nil)
cred, err := client.post(ctx, credPath, nil)
assert.Error(err)
assert.Contains(err.Error(), "common_name field is required")
assert.Nil(cred)
@@ -179,6 +186,7 @@ func TestClient_Post(t *testing.T) {
func TestClient_RenewLease(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert, require := assert.New(t), require.New(t)
v := NewTestVaultServer(t, WithDockerNetwork(true))
v.MountDatabase(t)
@@ -187,7 +195,7 @@ func TestClient_RenewLease(t *testing.T) {
client := v.clientUsingToken(t, token)
// Create secret
cred, err := client.get(path.Join("database", "creds", "opened"))
cred, err := client.get(ctx, path.Join("database", "creds", "opened"))
assert.NoError(err)
require.NotNil(cred)
@@ -198,7 +206,7 @@ func TestClient_RenewLease(t *testing.T) {
// Verify lease has not been renewed
assert.Empty(leaseLookup.Data["last_renewal"])
renewedLease, err := client.renewLease(cred.LeaseID, time.Hour)
renewedLease, err := client.renewLease(ctx, cred.LeaseID, time.Hour)
assert.NoError(err)
require.NotNil(renewedLease)
assert.Equal(cred.LeaseID, renewedLease.LeaseID)
@@ -213,6 +221,7 @@ func TestClient_RenewLease(t *testing.T) {
func TestClient_capabilities(t *testing.T) {
t.Parallel()
ctx := context.Background()
v := NewTestVaultServer(t)
tests := []struct {
@@ -245,7 +254,7 @@ func TestClient_capabilities(t *testing.T) {
_, token := v.CreateToken(t, WithPolicies(tt.polices))
client := v.clientUsingToken(t, token)
have, err := client.capabilities(tt.require.paths())
have, err := client.capabilities(ctx, tt.require.paths())
assert.NoError(err)
got := have.missing(tt.require)
assert.Equalf(tt.wantMissing, got, "pathCapabilities: want: {%s} got: {%s}", tt.wantMissing, got)
@@ -255,6 +264,7 @@ func TestClient_capabilities(t *testing.T) {
func TestClient_revokeLease(t *testing.T) {
t.Parallel()
ctx := context.Background()
assert, require := assert.New(t), require.New(t)
v := NewTestVaultServer(t, WithDockerNetwork(true), WithTestVaultTLS(TestClientTLS))
testDatabase := v.MountDatabase(t)
@@ -262,7 +272,7 @@ func TestClient_revokeLease(t *testing.T) {
_, token := v.CreateToken(t, WithPolicies([]string{"boundary-controller", "database"}))
client := v.clientUsingToken(t, token)
cred, err := client.get(path.Join("database", "creds", "opened"))
cred, err := client.get(ctx, path.Join("database", "creds", "opened"))
assert.NoError(err)
require.NotNil(cred)
@@ -270,7 +280,7 @@ func TestClient_revokeLease(t *testing.T) {
assert.NoError(testDatabase.ValidateCredential(t, cred))
// revoke the database credentials
assert.NoError(client.revokeLease(cred.LeaseID))
assert.NoError(client.revokeLease(ctx, cred.LeaseID))
// verify the database credentials no longer work
assert.Error(testDatabase.ValidateCredential(t, cred))
internal/daemon/controller/handler.go
+1 -1
View File
@@ -212,7 +212,7 @@ func (c *Controller) registerGrpcServices(s *grpc.Server) error {
services.RegisterManagedGroupServiceServer(s, mgs)
}
if _, ok := currentServices[services.CredentialStoreService_ServiceDesc.ServiceName]; !ok {
cs, err := credentialstores.NewService(c.VaultCredentialRepoFn, c.StaticCredentialRepoFn, c.IamRepoFn)
cs, err := credentialstores.NewService(c.baseContext, c.VaultCredentialRepoFn, c.StaticCredentialRepoFn, c.IamRepoFn)
if err != nil {
return fmt.Errorf("failed to create credential store handler service: %w", err)
}
internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
+29 -28
View File
@@ -94,19 +94,20 @@ type Service struct {
// NewService returns a credential store service which handles credential store related requests to boundary.
func NewService(
ctx context.Context,
vaultRepo common.VaultCredentialRepoFactory,
staticRepo common.StaticCredentialRepoFactory,
iamRepo common.IamRepoFactory,
) (Service, error) {
const op = "credentialstores.NewService"
if iamRepo == nil {
return Service{}, errors.NewDeprecated(errors.InvalidParameter, op, "missing iam repository")
return Service{}, errors.New(ctx, errors.InvalidParameter, op, "missing iam repository")
}
if vaultRepo == nil {
return Service{}, errors.NewDeprecated(errors.InvalidParameter, op, "missing vault credential repository")
return Service{}, errors.New(ctx, errors.InvalidParameter, op, "missing vault credential repository")
}
if staticRepo == nil {
return Service{}, errors.NewDeprecated(errors.InvalidParameter, op, "missing static credential repository")
return Service{}, errors.New(ctx, errors.InvalidParameter, op, "missing static credential repository")
}
return Service{iamRepoFn: iamRepo, vaultRepoFn: vaultRepo, staticRepoFn: staticRepo}, nil
}
@@ -183,7 +184,7 @@ func (s Service) ListCredentialStores(ctx context.Context, req *pbs.ListCredenti
outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
}
item, err := toProto(item, outputOpts...)
item, err := toProto(ctx, item, outputOpts...)
if err != nil {
return nil, err
}
@@ -236,7 +237,7 @@ func (s Service) GetCredentialStore(ctx context.Context, req *pbs.GetCredentialS
outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
}
item, err := toProto(cs, outputOpts...)
item, err := toProto(ctx, cs, outputOpts...)
if err != nil {
return nil, err
}
@@ -248,7 +249,7 @@ func (s Service) GetCredentialStore(ctx context.Context, req *pbs.GetCredentialS
func (s Service) CreateCredentialStore(ctx context.Context, req *pbs.CreateCredentialStoreRequest) (*pbs.CreateCredentialStoreResponse, error) {
const op = "credentialstores.(Service).CreateCredentialStore"
if err := validateCreateRequest(req); err != nil {
if err := validateCreateRequest(ctx, req); err != nil {
return nil, err
}
authResults := s.authResult(ctx, req.GetItem().GetScopeId(), action.Create)
@@ -281,7 +282,7 @@ func (s Service) CreateCredentialStore(ctx context.Context, req *pbs.CreateCrede
outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
}
item, err := toProto(cs, outputOpts...)
item, err := toProto(ctx, cs, outputOpts...)
if err != nil {
return nil, err
}
@@ -296,7 +297,7 @@ func (s Service) CreateCredentialStore(ctx context.Context, req *pbs.CreateCrede
func (s Service) UpdateCredentialStore(ctx context.Context, req *pbs.UpdateCredentialStoreRequest) (*pbs.UpdateCredentialStoreResponse, error) {
const op = "credentialstores.(Service).UpdateCredentialStore"
if err := validateUpdateRequest(req); err != nil {
if err := validateUpdateRequest(ctx, req); err != nil {
return nil, err
}
authResults := s.authResult(ctx, req.GetId(), action.Update)
@@ -329,7 +330,7 @@ func (s Service) UpdateCredentialStore(ctx context.Context, req *pbs.UpdateCrede
outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
}
item, err := toProto(cs, outputOpts...)
item, err := toProto(ctx, cs, outputOpts...)
if err != nil {
return nil, err
}
@@ -424,7 +425,7 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.Crede
switch item.Type {
case vault.Subtype.String():
cs, err := toStorageVaultStore(projId, item)
cs, err := toStorageVaultStore(ctx, projId, item)
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -439,7 +440,7 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.Crede
return out, nil
case static.Subtype.String():
cs, err := toStorageStaticStore(projId, item)
cs, err := toStorageStaticStore(ctx, projId, item)
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -471,7 +472,7 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
switch subtypes.SubtypeFromId(domain, id) {
case vault.Subtype:
cs, err := toStorageVaultStore(projId, item)
cs, err := toStorageVaultStore(ctx, projId, item)
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -487,7 +488,7 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
}
case static.Subtype:
cs, err := toStorageStaticStore(projId, item)
cs, err := toStorageStaticStore(ctx, projId, item)
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -607,7 +608,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
return auth.Verify(ctx, opts...)
}
func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore, error) {
func toProto(ctx context.Context, in credential.Store, opt ...handlers.Option) (*pb.CredentialStore, error) {
const op = "credentialstores.toProto"
opts := handlers.GetOpts(opt...)
@@ -655,7 +656,7 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
case vault.Subtype:
vaultIn, ok := in.(*vault.CredentialStore)
if !ok {
return nil, errors.NewDeprecated(errors.Internal, op, "unable to cast to vault credential store")
return nil, errors.New(ctx, errors.Internal, op, "unable to cast to vault credential store")
}
attrs := &pb.VaultCredentialStoreAttributes{
Address: wrapperspb.String(vaultIn.GetVaultAddress()),
@@ -695,7 +696,7 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
return &out, nil
}
func toStorageStaticStore(scopeId string, in *pb.CredentialStore) (out *static.CredentialStore, err error) {
func toStorageStaticStore(ctx context.Context, scopeId string, in *pb.CredentialStore) (out *static.CredentialStore, err error) {
const op = "credentialstores.toStorageStaticStore"
var opts []static.Option
if in.GetName() != nil {
@@ -707,12 +708,12 @@ func toStorageStaticStore(scopeId string, in *pb.CredentialStore) (out *static.C
cs, err := static.NewCredentialStore(scopeId, opts...)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to build credential store for creation"))
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to build credential store for creation"))
}
return cs, err
}
func toStorageVaultStore(scopeId string, in *pb.CredentialStore) (out *vault.CredentialStore, err error) {
func toStorageVaultStore(ctx context.Context, scopeId string, in *pb.CredentialStore) (out *vault.CredentialStore, err error) {
const op = "credentialstores.toStorageVaultStore"
var opts []vault.Option
if in.GetName() != nil {
@@ -741,9 +742,9 @@ func toStorageVaultStore(scopeId string, in *pb.CredentialStore) (out *vault.Cre
if attrs.GetCaCert() != nil {
opts = append(opts, vault.WithCACert([]byte(attrs.GetCaCert().GetValue())))
}
pemCerts, pemPk, err := extractClientCertAndPk(attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
pemCerts, pemPk, err := extractClientCertAndPk(ctx, attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
if err != nil {
return nil, errors.WrapDeprecated(err, op)
return nil, errors.Wrap(ctx, err, op)
}
if len(pemCerts) != 0 {
var cert []byte
@@ -756,14 +757,14 @@ func toStorageVaultStore(scopeId string, in *pb.CredentialStore) (out *vault.Cre
}
cc, err := vault.NewClientCertificate(cert, pk)
if err != nil {
return nil, errors.WrapDeprecated(err, op)
return nil, errors.Wrap(ctx, err, op)
}
opts = append(opts, vault.WithClientCert(cc))
}
cs, err := vault.NewCredentialStore(scopeId, attrs.GetAddress().GetValue(), []byte(attrs.GetToken().GetValue()), opts...)
if err != nil {
return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to build credential store for creation"))
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to build credential store for creation"))
}
return cs, err
}
@@ -777,7 +778,7 @@ func validateGetRequest(req *pbs.GetCredentialStoreRequest) error {
return handlers.ValidateGetRequest(handlers.NoopValidatorFn, req, vault.CredentialStorePrefix, static.CredentialStorePrefix, static.PreviousCredentialStorePrefix)
}
func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
func validateCreateRequest(ctx context.Context, req *pbs.CreateCredentialStoreRequest) error {
return handlers.ValidateCreateRequest(req.GetItem(), func() map[string]string {
badFields := map[string]string{}
if !handlers.ValidId(handlers.Id(req.GetItem().GetScopeId()), scope.Project.Prefix()) {
@@ -806,12 +807,12 @@ func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
}
}
// TODO(ICU-1478 and ICU-1479): Validate client and CA certificate payloads
_, err := decodePemBlocks(attrs.GetCaCert().GetValue())
_, err := decodePemBlocks(ctx, attrs.GetCaCert().GetValue())
if attrs.GetCaCert() != nil && err != nil {
badFields[caCertsField] = "Incorrectly formatted value."
}
cs, pk, err := extractClientCertAndPk(attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
cs, pk, err := extractClientCertAndPk(ctx, attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
if err != nil {
badFields[clientCertField] = fmt.Sprintf("Invalid values: %q", err.Error())
}
@@ -830,7 +831,7 @@ func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
})
}
func validateUpdateRequest(req *pbs.UpdateCredentialStoreRequest) error {
func validateUpdateRequest(ctx context.Context, req *pbs.UpdateCredentialStoreRequest) error {
return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
badFields := map[string]string{}
switch subtypes.SubtypeFromId(domain, req.GetId()) {
@@ -859,12 +860,12 @@ func validateUpdateRequest(req *pbs.UpdateCredentialStoreRequest) error {
}
// TODO(ICU-1478 and ICU-1479): Validate client and CA certificate payloads
_, err := decodePemBlocks(attrs.GetCaCert().GetValue())
_, err := decodePemBlocks(ctx, attrs.GetCaCert().GetValue())
if attrs.GetCaCert() != nil && err != nil {
badFields[caCertsField] = "Incorrectly formatted value."
}
_, _, err = extractClientCertAndPk(attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
_, _, err = extractClientCertAndPk(ctx, attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
if err != nil {
badFields[clientCertField] = fmt.Sprintf("Invalid values: %q", err.Error())
}
internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
+12 -7
View File
@@ -57,6 +57,7 @@ var (
)
func TestList(t *testing.T) {
ctx := context.Background()
conn, _ := db.TestSetup(t, "postgres")
wrapper := db.TestWrapper(t)
kms := kms.TestKms(t, conn, wrapper)
@@ -168,7 +169,7 @@ func TestList(t *testing.T) {
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
require.NoError(t, err, "Couldn't create new host set service.")
// Test non-anonymous listing
@@ -197,6 +198,7 @@ func TestList(t *testing.T) {
}
func TestCreateVault(t *testing.T) {
ctx := context.Background()
conn, _ := db.TestSetup(t, "postgres")
wrapper := db.TestWrapper(t)
kms := kms.TestKms(t, conn, wrapper)
@@ -524,7 +526,7 @@ func TestCreateVault(t *testing.T) {
t.Run(tc.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
require.NoError(err, "Error when getting new credential store service.")
defer cleanup(s)
@@ -577,6 +579,7 @@ func TestCreateVault(t *testing.T) {
}
func TestCreateStatic(t *testing.T) {
ctx := context.Background()
conn, _ := db.TestSetup(t, "postgres")
wrapper := db.TestWrapper(t)
kms := kms.TestKms(t, conn, wrapper)
@@ -700,7 +703,7 @@ func TestCreateStatic(t *testing.T) {
t.Run(tc.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
require.NoError(err, "Error when getting new credential store service.")
defer cleanup(s)
@@ -742,6 +745,7 @@ func TestCreateStatic(t *testing.T) {
}
func TestGet(t *testing.T) {
ctx := context.Background()
conn, _ := db.TestSetup(t, "postgres")
wrapper := db.TestWrapper(t)
kms := kms.TestKms(t, conn, wrapper)
@@ -764,7 +768,7 @@ func TestGet(t *testing.T) {
vaultStore := vault.TestCredentialStores(t, conn, wrapper, prj.GetPublicId(), 1)[0]
staticStore := credstatic.TestCredentialStore(t, conn, wrapper, prj.GetPublicId())
staticStorePrev := credstatic.TestCredentialStore(t, conn, wrapper, prj.GetPublicId(), credstatic.WithPublicId(fmt.Sprintf("%s_1234567890", credstatic.PreviousCredentialStorePrefix)))
s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
require.NoError(t, err)
cases := []struct {
@@ -872,6 +876,7 @@ func TestGet(t *testing.T) {
}
func TestDelete(t *testing.T) {
ctx := context.Background()
conn, _ := db.TestSetup(t, "postgres")
wrapper := db.TestWrapper(t)
kms := kms.TestKms(t, conn, wrapper)
@@ -895,7 +900,7 @@ func TestDelete(t *testing.T) {
vaultStore := vault.TestCredentialStores(t, conn, wrapper, prj.GetPublicId(), 2)[0]
staticStore := credstatic.TestCredentialStore(t, conn, wrapper, prj.GetPublicId())
s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
require.NoError(t, err)
cases := []struct {
@@ -968,7 +973,7 @@ func TestUpdateVault(t *testing.T) {
_, prj := iam.TestScopes(t, iamRepo)
ctx := auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId())
s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
require.NoError(t, err)
fieldmask := func(paths ...string) *fieldmaskpb.FieldMask {
@@ -1300,7 +1305,7 @@ func TestUpdateStatic(t *testing.T) {
_, prj := iam.TestScopes(t, iamRepo)
ctx := auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId())
s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
require.NoError(t, err)
fieldmask := func(paths ...string) *fieldmaskpb.FieldMask {
internal/daemon/controller/handlers/credentialstores/vault.go
+11 -10
View File
@@ -1,6 +1,7 @@
package credentialstores
import (
"context"
"encoding/pem"
"fmt"
"strings"
@@ -12,11 +13,11 @@ import (
// certificate and client certificate key and parses them into pem blocks.
// Any non certificate pem blocks are treated as a private key. An error is
// returned if there is more than 1 private key provided across both fields.
func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
func extractClientCertAndPk(ctx context.Context, cert, pk string) ([]*pem.Block, *pem.Block, error) {
const op = "credentialstores.extractClientCertAndPk"
pks, err := decodePemBlocks(pk)
pks, err := decodePemBlocks(ctx, pk)
if err != nil {
return nil, nil, errors.WrapDeprecated(err, op, errors.WithMsg("failed to parse client certificate private key"))
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("failed to parse client certificate private key"))
}
var pkPem *pem.Block
switch len(pks) {
@@ -24,12 +25,12 @@ func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
case 1:
pkPem = pks[0]
default:
return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, "private key payload contained multiple pem blocks")
return nil, nil, errors.New(ctx, errors.InvalidParameter, op, "private key payload contained multiple pem blocks")
}
bs, err := decodePemBlocks(cert)
bs, err := decodePemBlocks(ctx, cert)
if err != nil {
return nil, nil, errors.WrapDeprecated(err, op, errors.WithMsg("failed to parse client certificate into pem blocks"))
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("failed to parse client certificate into pem blocks"))
}
pkIdx := -1
for i, b := range bs {
@@ -38,9 +39,9 @@ func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
case pkPem == nil:
pkIdx, pkPem = i, b
case pkIdx < 0:
return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, "client certificate contains a private key when one was also provided separately")
return nil, nil, errors.New(ctx, errors.InvalidParameter, op, "client certificate contains a private key when one was also provided separately")
default:
return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, fmt.Sprintf("second primary key found at %d after previous one found at %d", i, pkIdx))
return nil, nil, errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("second primary key found at %d after previous one found at %d", i, pkIdx))
}
}
}
@@ -50,7 +51,7 @@ func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
return bs, pkPem, nil
}
func decodePemBlocks(input string) ([]*pem.Block, error) {
func decodePemBlocks(ctx context.Context, input string) ([]*pem.Block, error) {
const op = "credentialstores.decodePemBlocks"
cpIn := make([]byte, len(input))
copy(cpIn, input)
@@ -64,7 +65,7 @@ func decodePemBlocks(input string) ([]*pem.Block, error) {
ret = append(ret, p)
}
if len(cpIn) > 0 {
return nil, errors.NewDeprecated(errors.InvalidParameter, op, "not all data parseable by pem block")
return nil, errors.New(ctx, errors.InvalidParameter, op, "not all data parseable by pem block")
}
return ret, nil
}
internal/daemon/controller/handlers/credentialstores/vault_test.go
+9 -7
View File
@@ -1,6 +1,7 @@
package credentialstores
import (
"context"
"encoding/pem"
"testing"
@@ -10,10 +11,11 @@ import (
)
func TestPkAndClientCerts(t *testing.T) {
ctx := context.Background()
s := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
t.Run("seperate client cert and key", func(t *testing.T) {
c, k, err := extractClientCertAndPk(string(s.ClientCert), string(s.ClientKey))
c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert), string(s.ClientKey))
assert.NoError(t, err)
require.NotNil(t, k)
assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
@@ -22,7 +24,7 @@ func TestPkAndClientCerts(t *testing.T) {
})
t.Run("client cert and key bundled in cert", func(t *testing.T) {
c, k, err := extractClientCertAndPk(string(s.ClientCert)+string(s.ClientKey), "")
c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert)+string(s.ClientKey), "")
assert.NoError(t, err)
require.NotNil(t, k)
assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
@@ -31,7 +33,7 @@ func TestPkAndClientCerts(t *testing.T) {
})
t.Run("cert with no private key", func(t *testing.T) {
c, k, err := extractClientCertAndPk(string(s.ClientCert), "")
c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert), "")
assert.NoError(t, err)
assert.Nil(t, k)
require.Len(t, c, 1)
@@ -39,7 +41,7 @@ func TestPkAndClientCerts(t *testing.T) {
})
t.Run("private key with no cert", func(t *testing.T) {
c, k, err := extractClientCertAndPk("", string(s.ClientKey))
c, k, err := extractClientCertAndPk(ctx, "", string(s.ClientKey))
assert.NoError(t, err)
assert.NotNil(t, k)
assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
@@ -47,13 +49,13 @@ func TestPkAndClientCerts(t *testing.T) {
})
t.Run("error cases", func(t *testing.T) {
_, _, err := extractClientCertAndPk(string(s.ClientCert), "invalid key")
_, _, err := extractClientCertAndPk(ctx, string(s.ClientCert), "invalid key")
assert.Error(t, err)
_, _, err = extractClientCertAndPk("invalid cert", string(s.ClientKey))
_, _, err = extractClientCertAndPk(ctx, "invalid cert", string(s.ClientKey))
assert.Error(t, err)
// private key with the cert and the private key
c, k, err := extractClientCertAndPk(string(s.ClientCert)+string(s.ClientKey), string(s.ClientKey))
c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert)+string(s.ClientKey), string(s.ClientKey))
assert.Error(t, err)
assert.Nil(t, k)
assert.Empty(t, c)