fcc9c8d0ba
A leftover plaintext client secret is stored once with -cas=0 when the store holds none, so nothing rotates. A store value wins over a different file. The file is no longer read back, compared or removed, and the migration unit is gone.
269 lines
8.5 KiB
Shell
269 lines
8.5 KiB
Shell
# Cases for ./oidc-client-secrets.nix. Each case sets up the store's leaf, the
|
|
# digest and the plaintext file an earlier release left, and the stub's
|
|
# behaviour, runs the function under `set -e` as the units' scripts do, and
|
|
# compares its status, what the store holds, what is left on disk and whether
|
|
# `authelia` minted.
|
|
set -uo pipefail
|
|
|
|
failures=0
|
|
count=0
|
|
|
|
fail() {
|
|
echo "FAILED: $case: $*" >&2
|
|
failures=$((failures + 1))
|
|
}
|
|
|
|
id=swarm-grafana
|
|
leaf=secret/swarm/services/swarm-grafana/oidc/client
|
|
|
|
# setup <description>
|
|
setup() {
|
|
case=$1
|
|
count=$((count + 1))
|
|
dir=$(mktemp -d)
|
|
mkdir "$dir/kv" "$dir/clients"
|
|
export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
|
|
export FAKE_AUTHELIA_LOG=$dir/authelia.log
|
|
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_AUTHELIA_EMPTY FAKE_AUTHELIA_NODIGEST
|
|
: >"$FAKE_BAO_LOG"
|
|
: >"$FAKE_AUTHELIA_LOG"
|
|
clients=$dir/clients
|
|
digest=$clients/$id.digest
|
|
legacy=$clients/$id.secret
|
|
stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
|
|
}
|
|
|
|
# run <function> — the function for $id and $leaf, with the stubs first on
|
|
# PATH, after the store login the units make first. Sets $rc and $minted.
|
|
run() {
|
|
minted=$(
|
|
set -e
|
|
PATH="$FAKE_BIN/bin:$PATH"
|
|
unset BAO_TOKEN
|
|
# shellcheck source=/dev/null
|
|
. "$HELPER"
|
|
clients=$dir/clients
|
|
store_init
|
|
store_login 2>>"$dir/err"
|
|
rc=0
|
|
"$1" "$id" "$leaf" 2>>"$dir/err" >>"$dir/out" || rc=$?
|
|
echo "${MINTED-}"
|
|
exit "$rc"
|
|
)
|
|
rc=$?
|
|
}
|
|
|
|
# expect <status>
|
|
expect() {
|
|
if [ "$rc" != "$1" ]; then fail "exited $rc, wanted $1: $(cat "$dir/err" "$dir/out" 2>/dev/null)"; fi
|
|
}
|
|
|
|
# held <value>, or held "" for a leaf the store does not have.
|
|
held() {
|
|
if [ -z "$1" ]; then
|
|
if [ -e "$stored" ]; then fail "the store holds '$(cat "$stored")', wanted nothing"; fi
|
|
elif [ "$(cat "$stored" 2>/dev/null)" != "$1" ]; then
|
|
fail "the store holds '$(cat "$stored" 2>/dev/null)', wanted '$1'"
|
|
fi
|
|
}
|
|
|
|
# digest_is <value>, or digest_is "" for no digest file.
|
|
digest_is() {
|
|
if [ -z "$1" ]; then
|
|
if [ -e "$digest" ]; then fail "a digest was written: '$(cat "$digest")'"; fi
|
|
elif [ "$(cat "$digest" 2>/dev/null)" != "$1" ]; then
|
|
fail "the digest is '$(cat "$digest" 2>/dev/null)', wanted '$1'"
|
|
fi
|
|
}
|
|
|
|
# Whether a new secret was minted, as opposed to a digest computed.
|
|
ran_authelia() {
|
|
grep -q -e "--random" "$FAKE_AUTHELIA_LOG"
|
|
}
|
|
|
|
store_called() {
|
|
grep -q '^kv' "$FAKE_BAO_LOG"
|
|
}
|
|
|
|
logged() {
|
|
grep -qF -- "$1" "$dir/err" "$dir/out" 2>/dev/null
|
|
}
|
|
|
|
no_secret_in_argv() {
|
|
if grep -q -e minted-secret -e old-secret "$FAKE_BAO_LOG" "$FAKE_AUTHELIA_LOG"; then
|
|
fail "a secret reached a command line"
|
|
fi
|
|
}
|
|
|
|
# --- mint_client_secret ---------------------------------------------------
|
|
|
|
setup "mint: a fresh client is minted into the store and only its digest is written"
|
|
run mint_client_secret
|
|
expect 0
|
|
held minted-secret
|
|
digest_is '$pbkdf2-sha512$fake'
|
|
if [ "$minted" != 1 ]; then fail "did not report the mint"; fi
|
|
if [ -e "$legacy" ]; then fail "wrote a plaintext file"; fi
|
|
if [ "$(stat -c %a "$digest")" != 600 ]; then fail "digest mode is $(stat -c %a "$digest")"; fi
|
|
if ! logged "minted client secret for $id into the store"; then fail "no mint line"; fi
|
|
no_secret_in_argv
|
|
|
|
setup "mint: a client the store and the disk both hold is left alone"
|
|
printf 'old-secret' >"$stored"
|
|
printf 'old-digest\n' >"$digest"
|
|
run mint_client_secret
|
|
expect 0
|
|
held old-secret
|
|
digest_is old-digest
|
|
if ran_authelia; then fail "minted although the store held a value"; fi
|
|
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
|
|
if [ "$minted" = 1 ]; then fail "reported a mint"; fi
|
|
|
|
setup "mint: a digest whose secret is gone from the store is minted again"
|
|
printf 'old-digest\n' >"$digest"
|
|
run mint_client_secret
|
|
expect 0
|
|
held minted-secret
|
|
digest_is '$pbkdf2-sha512$fake'
|
|
if [ "$minted" != 1 ]; then fail "did not report the mint"; fi
|
|
|
|
setup "mint: a store that refuses the login leaves the digest, and mints nothing"
|
|
printf 'old-digest\n' >"$digest"
|
|
export FAKE_BAO_LOGIN_RC=1
|
|
run mint_client_secret
|
|
expect 0
|
|
digest_is old-digest
|
|
if ran_authelia; then fail "minted with the store down"; fi
|
|
if store_called; then fail "called kv after a refused login"; fi
|
|
|
|
setup "mint: a store that refuses the read leaves the digest, and mints nothing"
|
|
printf 'old-digest\n' >"$digest"
|
|
export FAKE_BAO_DENY_READ=1
|
|
run mint_client_secret
|
|
expect 0
|
|
digest_is old-digest
|
|
if ran_authelia; then fail "minted although the read was refused"; fi
|
|
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote although the read was refused"; fi
|
|
|
|
setup "mint: no digest and a store that is down fails to retry, and mints nothing"
|
|
export FAKE_BAO_LOGIN_RC=1
|
|
run mint_client_secret
|
|
expect 1
|
|
digest_is ""
|
|
if ran_authelia; then fail "minted with the store down"; fi
|
|
|
|
setup "mint: no digest and a store that refuses the read fails to retry, and mints nothing"
|
|
export FAKE_BAO_DENY_READ=1
|
|
run mint_client_secret
|
|
expect 1
|
|
digest_is ""
|
|
if ran_authelia; then fail "minted although the read was refused"; fi
|
|
|
|
setup "mint: no digest but a secret in the store gets the digest of that secret, and the secret is unchanged"
|
|
printf 'old-secret' >"$stored"
|
|
run mint_client_secret
|
|
expect 0
|
|
held old-secret
|
|
digest_is digest-of-old-secret
|
|
if ran_authelia; then fail "minted over the store's secret"; fi
|
|
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
|
|
if [ "$minted" != 1 ]; then fail "did not report the new digest"; fi
|
|
if [ "$(stat -c %a "$digest")" != 600 ]; then fail "digest mode is $(stat -c %a "$digest")"; fi
|
|
if ! logged "oidc client $id: wrote the digest from the secret in the store"; then fail "no info line"; fi
|
|
no_secret_in_argv
|
|
|
|
setup "mint: a plaintext file the store lacks seeds the store once, mints nothing and keeps the digest and the file"
|
|
printf 'old-secret\n' >"$legacy"
|
|
printf 'old-digest\n' >"$digest"
|
|
run mint_client_secret
|
|
expect 0
|
|
held old-secret
|
|
digest_is old-digest
|
|
if ran_authelia; then fail "minted although a file held the secret"; fi
|
|
if [ "$(cat "$legacy")" != old-secret ]; then fail "changed or removed the file"; fi
|
|
if ! grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG"; then fail "no create-only write was made"; fi
|
|
no_secret_in_argv
|
|
|
|
setup "mint: a plaintext file with no digest seeds the store and gets the digest of the file's secret"
|
|
printf 'old-secret\n' >"$legacy"
|
|
run mint_client_secret
|
|
expect 0
|
|
held old-secret
|
|
digest_is digest-of-old-secret
|
|
if [ "$(cat "$legacy")" != old-secret ]; then fail "changed the file"; fi
|
|
if ran_authelia; then fail "minted over the file's secret"; fi
|
|
no_secret_in_argv
|
|
|
|
setup "mint: the store's secret wins over a different file, silently, and nothing is written"
|
|
printf 'old-secret\n' >"$legacy"
|
|
printf 'other-secret' >"$stored"
|
|
printf 'old-digest\n' >"$digest"
|
|
run mint_client_secret
|
|
expect 0
|
|
held other-secret
|
|
digest_is old-digest
|
|
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
|
|
if ran_authelia; then fail "minted"; fi
|
|
|
|
setup "mint: a file with a store that refuses the login keeps the digest and mints nothing"
|
|
printf 'old-secret\n' >"$legacy"
|
|
printf 'old-digest\n' >"$digest"
|
|
export FAKE_BAO_LOGIN_RC=1
|
|
run mint_client_secret
|
|
expect 0
|
|
digest_is old-digest
|
|
if ran_authelia; then fail "minted with the store down"; fi
|
|
|
|
setup "mint: a file whose seed write is refused is a failure, and nothing is minted"
|
|
printf 'old-secret\n' >"$legacy"
|
|
printf 'old-digest\n' >"$digest"
|
|
export FAKE_BAO_DENY_WRITE=1
|
|
run mint_client_secret
|
|
expect 1
|
|
held ""
|
|
if ran_authelia; then fail "minted although the file held the secret"; fi
|
|
|
|
setup "mint: a secret whose digest cannot be computed is a failure and writes no digest"
|
|
printf 'old-secret' >"$stored"
|
|
export FAKE_AUTHELIA_NODIGEST=1
|
|
run mint_client_secret
|
|
expect 1
|
|
digest_is ""
|
|
held old-secret
|
|
|
|
setup "mint: an authelia that prints nothing writes nothing"
|
|
export FAKE_AUTHELIA_EMPTY=1
|
|
run mint_client_secret
|
|
expect 1
|
|
held ""
|
|
digest_is ""
|
|
|
|
setup "mint: a store that refuses the write leaves no digest"
|
|
export FAKE_BAO_DENY_WRITE=1
|
|
run mint_client_secret
|
|
expect 1
|
|
held ""
|
|
digest_is ""
|
|
|
|
setup "mint: losing the race to another run takes the winner's secret and writes its digest"
|
|
export FAKE_BAO_RACE=winner-secret
|
|
run mint_client_secret
|
|
expect 0
|
|
held winner-secret
|
|
digest_is digest-of-winner-secret
|
|
|
|
if [ "$(id -u)" != 0 ]; then
|
|
setup "mint: a digest that cannot be written is a failure, not a mint"
|
|
chmod 500 "$clients"
|
|
run mint_client_secret
|
|
chmod 700 "$clients"
|
|
expect 1
|
|
if [ "$minted" = 1 ]; then fail "reported a mint without a digest"; fi
|
|
digest_is ""
|
|
fi
|
|
|
|
if [ "$failures" != 0 ]; then
|
|
echo "$failures of $count cases failed" >&2
|
|
exit 1
|
|
fi
|
|
echo "$count cases passed"
|