keep authelia's keys in bao, seeded from the existing key files
This commit is contained in:
atlas
mara
parent
a70b25847e
commit
99fab06348
2 changed files with 557 additions and 89 deletions
63
nix/script-tests/store-seeded-secret.nix
Normal file
63
nix/script-tests/store-seeded-secret.nix
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
# `checks.script-test-store-seeded-secret` — runs
|
||||
# ../host-modules/lib/store-seeded-secret.nix's `store_seeded` against a stub
|
||||
# `bao` that keeps its leaves in files. The cases are in
|
||||
# ./store-seeded-secret.sh.
|
||||
#
|
||||
# What runs is the rendered helper, sourced as its callers' scripts include it.
|
||||
{
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
# `login` answers from `FAKE_BAO_LOGIN_RC`. `kv get` and `kv put -cas=0` act
|
||||
# on a file per leaf under `FAKE_BAO_KV`; `FAKE_BAO_DENY_READ` and
|
||||
# `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does.
|
||||
# `FAKE_BAO_RACE` has another run create the leaf between this one's read and
|
||||
# its write. Every call is logged without the value `put` reads from stdin.
|
||||
fakeBao = pkgs.writeShellScriptBin "bao" ''
|
||||
echo "$*" >> "$FAKE_BAO_LOG"
|
||||
case "$1 $2" in
|
||||
"login -method=cert")
|
||||
[ "$FAKE_BAO_LOGIN_RC" = 0 ] || { echo "fake bao: certificate refused" >&2; exit 2; }
|
||||
printf 's.fake'
|
||||
;;
|
||||
"kv get")
|
||||
[ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
|
||||
leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
|
||||
[ -z "''${FAKE_BAO_DENY_READ-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
|
||||
if [ -n "''${FAKE_BAO_RACE-}" ] && [ ! -e "$FAKE_BAO_KV/.raced" ]; then
|
||||
touch "$FAKE_BAO_KV/.raced"
|
||||
printf '%s' "$FAKE_BAO_RACE" > "$leaf"
|
||||
echo "fake bao: no value found" >&2
|
||||
exit 2
|
||||
fi
|
||||
[ -e "$leaf" ] || { echo "fake bao: no value found" >&2; exit 2; }
|
||||
cat "$leaf"
|
||||
;;
|
||||
"kv put")
|
||||
[ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
|
||||
[ "$3" = -cas=0 ] || { echo "fake bao: put without -cas=0" >&2; exit 96; }
|
||||
leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
|
||||
[ -z "''${FAKE_BAO_DENY_WRITE-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
|
||||
[ ! -e "$leaf" ] || { echo "fake bao: check-and-set parameter did not match" >&2; exit 2; }
|
||||
cat > "$leaf"
|
||||
;;
|
||||
*)
|
||||
echo "fake bao: unexpected call: $*" >&2
|
||||
exit 98
|
||||
;;
|
||||
esac
|
||||
'';
|
||||
in
|
||||
pkgs.runCommand "hyperhive-script-test-store-seeded-secret"
|
||||
{
|
||||
HELPER = pkgs.writeText "store-seeded-secret.sh" (
|
||||
import ../host-modules/lib/store-seeded-secret.nix { }
|
||||
);
|
||||
FAKE_BAO_BIN = "${fakeBao}/bin";
|
||||
nativeBuildInputs = [ pkgs.coreutils ];
|
||||
}
|
||||
''
|
||||
${pkgs.bash}/bin/bash ${./store-seeded-secret.sh}
|
||||
touch "$out"
|
||||
''
|
||||
145
nix/script-tests/store-seeded-secret.sh
Normal file
145
nix/script-tests/store-seeded-secret.sh
Normal file
|
|
@ -0,0 +1,145 @@
|
|||
# Cases for ./store-seeded-secret.nix. Each case sets up the store's leaf, the
|
||||
# earlier file and the stub's behaviour, runs `store_seeded` under `set -e` as
|
||||
# the callers' scripts do, and compares its exit status, its output, what the
|
||||
# store holds afterwards and whether the mint command ran.
|
||||
set -uo pipefail
|
||||
|
||||
failures=0
|
||||
count=0
|
||||
|
||||
fail() {
|
||||
echo "FAILED: $case: $*" >&2
|
||||
failures=$((failures + 1))
|
||||
}
|
||||
|
||||
leaf=secret/swarm/services/t/keys/k
|
||||
pem=$'-----BEGIN PRIVATE KEY-----\nMIIfake\nline2\n-----END PRIVATE KEY-----'
|
||||
|
||||
# setup <description>
|
||||
setup() {
|
||||
case=$1
|
||||
count=$((count + 1))
|
||||
dir=$(mktemp -d)
|
||||
mkdir "$dir/kv"
|
||||
export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
|
||||
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE
|
||||
: >"$FAKE_BAO_LOG"
|
||||
earlier=$dir/earlier
|
||||
minted=$dir/minted
|
||||
stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
|
||||
}
|
||||
|
||||
mint() {
|
||||
echo run >>"$minted"
|
||||
printf 'minted-value\n'
|
||||
}
|
||||
|
||||
# run — `store_seeded` for $leaf and $earlier with the stub first on PATH.
|
||||
# Sets $rc and $got.
|
||||
run() {
|
||||
got=$(
|
||||
set -e
|
||||
PATH="$FAKE_BAO_BIN:$PATH"
|
||||
unset BAO_TOKEN
|
||||
# shellcheck source=/dev/null
|
||||
. "$HELPER"
|
||||
store_init
|
||||
store_login 2>>"$dir/err"
|
||||
store_seeded "$leaf" "$earlier" mint 2>"$dir/err"
|
||||
)
|
||||
rc=$?
|
||||
}
|
||||
|
||||
# expect <status> <output>
|
||||
expect() {
|
||||
if [ "$rc" != "$1" ]; then fail "exited $rc, wanted $1: $(cat "$dir/err")"; fi
|
||||
if [ "$got" != "$2" ]; then fail "printed '$got', wanted '$2'"; fi
|
||||
}
|
||||
|
||||
# held <value>, or held "" for a leaf the store does not have.
|
||||
held() {
|
||||
if [ -z "$1" ]; then
|
||||
if [ -e "$stored" ]; then fail "the store holds '$(cat "$stored")', wanted nothing"; fi
|
||||
elif [ "$(cat "$stored" 2>/dev/null)" != "$1" ]; then
|
||||
fail "the store holds '$(cat "$stored" 2>/dev/null)', wanted '$1'"
|
||||
fi
|
||||
}
|
||||
|
||||
ran_mint() {
|
||||
[ -s "$minted" ]
|
||||
}
|
||||
|
||||
setup "an empty store is seeded from the file, unchanged, and nothing is minted"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
run
|
||||
expect 0 old-value
|
||||
held old-value
|
||||
if ran_mint; then fail "minted although the file held a value"; fi
|
||||
if ! grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG"; then fail "no create-only write was made"; fi
|
||||
|
||||
setup "a multi-line file is seeded unchanged"
|
||||
printf '%s\n' "$pem" >"$earlier"
|
||||
run
|
||||
expect 0 "$pem"
|
||||
held "$pem"
|
||||
|
||||
setup "the store's value wins over the file and is not written over"
|
||||
printf 'stored-value' >"$stored"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
run
|
||||
expect 0 stored-value
|
||||
held stored-value
|
||||
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
|
||||
if ran_mint; then fail "minted although the store held a value"; fi
|
||||
|
||||
setup "the store's value is used when there is no file"
|
||||
printf 'stored-value' >"$stored"
|
||||
run
|
||||
expect 0 stored-value
|
||||
if ran_mint; then fail "minted although the store held a value"; fi
|
||||
|
||||
setup "a value is minted into the store when neither holds one"
|
||||
run
|
||||
expect 0 minted-value
|
||||
held minted-value
|
||||
if ! ran_mint; then fail "did not mint"; fi
|
||||
|
||||
setup "a run that loses the race takes the winner's value, not its own seed"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
export FAKE_BAO_RACE=winner-value
|
||||
run
|
||||
expect 0 winner-value
|
||||
held winner-value
|
||||
|
||||
setup "a store that grants neither read nor write leaves the file's value in use"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
|
||||
run
|
||||
expect 0 old-value
|
||||
held ""
|
||||
if ran_mint; then fail "minted although the file held a value"; fi
|
||||
|
||||
setup "a store that grants neither, and no file, gives no value and mints nothing into it"
|
||||
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
|
||||
run
|
||||
expect 1 ""
|
||||
held ""
|
||||
|
||||
setup "a store that refuses the login leaves the file's value in use and is not called again"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
export FAKE_BAO_LOGIN_RC=1
|
||||
run
|
||||
expect 0 old-value
|
||||
if grep -q '^kv' "$FAKE_BAO_LOG"; then fail "called kv after a refused login"; fi
|
||||
|
||||
setup "a store that refuses the login, and no file, gives no value"
|
||||
export FAKE_BAO_LOGIN_RC=1
|
||||
run
|
||||
expect 1 ""
|
||||
if ran_mint; then fail "minted with no store to hold the value"; fi
|
||||
|
||||
if [ "$failures" != 0 ]; then
|
||||
echo "$failures of $count cases failed" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "$count cases passed"
|
||||
Loading…
Reference in a new issue