Examples with HostnameResolver com.yahoo.athenz.common.server.dns.HostnameResolver used on opensource projects

Example 16 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceCertManagerTest method testValidPrincipalsSSHRequest.

@Test
public void testValidPrincipalsSSHRequest() {
    final String hostname = "host1.athenz.cloud";
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    when(hostnameResolver.isValidHostname(hostname)).thenReturn(true);
    InstanceCertManager instanceManager = new InstanceCertManager(null, null, hostnameResolver, true, null);
    SSHCertRecord sshCertRecord = new SSHCertRecord();
    sshCertRecord.setService("athenz.examples.httpd");
    SSHCertRequest sshCertRequest = new SSHCertRequest();
    sshCertRequest.setCertRequestData(new SSHCertRequestData().setPrincipals(Collections.singletonList("host1.athenz.cloud")));
    sshCertRequest.setCertRequestMeta(new SSHCertRequestMeta());
    assertTrue(instanceManager.validPrincipals(hostname, sshCertRecord, sshCertRequest));
    instanceManager.shutdown();
}

Example 17 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceCertManagerTest method testValidPrincipalsInvalidHostname.

@Test
public void testValidPrincipalsInvalidHostname() throws IOException {
    Path path = Paths.get("src/test/resources/sshhost_valid_sample.csr");
    String sshCsr = new String(Files.readAllBytes(path));
    SSHCertRecord sshCertRecord = new SSHCertRecord();
    sshCertRecord.setService("athenz.examples.httpd");
    // setup the hostname resolver for our request
    String hostname = "host1.athenz.cloud";
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    when(hostnameResolver.isValidHostname(hostname)).thenReturn(false);
    InstanceCertManager instanceManager = new InstanceCertManager(null, null, hostnameResolver, true, null);
    ObjectMapper objectMapper = new ObjectMapper();
    boolean result = instanceManager.validPrincipals("host1.athenz.cloud", sshCertRecord, objectMapper.readValue(sshCsr, SshHostCsr.class));
    assertFalse(result);
    instanceManager.shutdown();
}

Example 18 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceCertManagerTest method testGenerateSshIdentityCertRequestValidPrincipals.

@Test
public void testGenerateSshIdentityCertRequestValidPrincipals() {
    SSHSigner sshSigner = Mockito.mock(com.yahoo.athenz.common.server.ssh.SSHSigner.class);
    SSHCertRequest sshRequest = new SSHCertRequest();
    sshRequest.setCertRequestData(new SSHCertRequestData().setPrincipals(Arrays.asList("host1.athenz.cloud", "cname.athenz.info", "vip.athenz.info", "10.1.2.3")).setPublicKey("sample public key"));
    sshRequest.setCertRequestMeta(new SSHCertRequestMeta().setKeyIdPrincipals(Arrays.asList("service.domain.athenz.cloud", "host1.athenz.cloud", "cname.athenz.info", "vip.athenz.info", "10.1.2.3")).setCertType("host").setTransId("123456").setOrigin("10.1.2.3"));
    SSHCertificates certs = new SSHCertificates();
    SSHCertificate cert = new SSHCertificate();
    cert.setCertificate("ssh-cert");
    SSHCertRecord sshCertRecord = new SSHCertRecord();
    sshCertRecord.setPrincipals("127.0.0.1");
    sshCertRecord.setService("athenz.service");
    InstanceIdentity identity = new InstanceIdentity().setName("athenz.service");
    final SSHCertificates sshCertificates = certs.setCertificates(Collections.singletonList(cert));
    when(sshSigner.generateCertificate(null, sshRequest, sshCertRecord, "host")).thenReturn(sshCertificates);
    when(sshSigner.getSignerCertificate(ZTSConsts.ZTS_SSH_HOST)).thenReturn("ssh-host");
    // setup the hostname resolver for our request
    String hostname = "host1.athenz.cloud";
    List<String> cnames = new ArrayList<>();
    cnames.add("cname.athenz.info");
    cnames.add("vip.athenz.info");
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    when(hostnameResolver.isValidHostCnameList(sshCertRecord.getService(), hostname, cnames, CertType.SSH_HOST)).thenReturn(true);
    when(hostnameResolver.isValidHostname(hostname)).thenReturn(true);
    InstanceCertManager instanceManager = new InstanceCertManager(null, null, hostnameResolver, true, null);
    instanceManager.setSSHSigner(sshSigner);
    assertTrue(instanceManager.generateSSHIdentity(null, identity, hostname, null, sshRequest, sshCertRecord, "host"));
    assertEquals(identity.getSshCertificate(), "ssh-cert");
    assertEquals(identity.getSshCertificateSigner(), "ssh-host");
    instanceManager.shutdown();
}

Example 19 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceCertManagerTest method testGenerateSshIdentityCertRequestNoHostname.

@Test
public void testGenerateSshIdentityCertRequestNoHostname() {
    SSHSigner sshSigner = Mockito.mock(com.yahoo.athenz.common.server.ssh.SSHSigner.class);
    SSHCertRequest sshRequest = new SSHCertRequest();
    sshRequest.setCertRequestData(new SSHCertRequestData().setPrincipals(Arrays.asList("host1.athenz.cloud", "cname.athenz.info", "vip.athenz.info", "10.1.2.3")).setPublicKey("sample public key"));
    sshRequest.setCertRequestMeta(new SSHCertRequestMeta().setKeyIdPrincipals(Arrays.asList("service.domain.athenz.cloud", "host1.athenz.cloud", "cname.athenz.info", "vip.athenz.info", "10.1.2.3")).setCertType("host").setTransId("123456").setOrigin("10.1.2.3"));
    SSHCertificates certs = new SSHCertificates();
    SSHCertificate cert = new SSHCertificate();
    cert.setCertificate("ssh-cert");
    SSHCertRecord sshCertRecord = new SSHCertRecord();
    sshCertRecord.setPrincipals("127.0.0.1");
    sshCertRecord.setService("athenz.service");
    InstanceIdentity identity = new InstanceIdentity().setName("athenz.service");
    final SSHCertificates sshCertificates = certs.setCertificates(Collections.singletonList(cert));
    when(sshSigner.generateCertificate(null, sshRequest, sshCertRecord, "host")).thenReturn(sshCertificates);
    when(sshSigner.getSignerCertificate(ZTSConsts.ZTS_SSH_HOST)).thenReturn("ssh-host");
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    InstanceCertManager instanceManager = new InstanceCertManager(null, null, hostnameResolver, true, null);
    instanceManager.setSSHSigner(sshSigner);
    assertTrue(instanceManager.generateSSHIdentity(null, identity, null, null, sshRequest, sshCertRecord, "host"));
    assertEquals(identity.getSshCertificate(), "ssh-cert");
    assertEquals(identity.getSshCertificateSigner(), "ssh-host");
    instanceManager.shutdown();
}

Example 20 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class X509CertRequestTest method testValidateInstanceCnames.

@Test
public void testValidateInstanceCnames() throws IOException {
    Path path = Paths.get("src/test/resources/athenz.instanceid.uri.csr");
    String csr = new String(Files.readAllBytes(path));
    String service = "athenz.api";
    X509CertRequest certReq = new X509CertRequest(csr);
    assertNotNull(certReq);
    // cnames null and empty is always true
    assertTrue(certReq.validateInstanceCnames(null, null, service, null, null, null));
    assertTrue(certReq.validateInstanceCnames(null, null, service, null, Collections.emptyList(), null));
    // if the name is empty or null, then it's failure
    assertFalse(certReq.validateInstanceCnames(null, null, service, null, Collections.singletonList("host1.athenz.cloud"), null));
    assertFalse(certReq.validateInstanceCnames(null, null, service, "", Collections.singletonList("host1.athenz.cloud"), null));
    DataCache athenzSysDomainCache = Mockito.mock(DataCache.class);
    List<String> providerHostnameAllowedSuffixList = Collections.singletonList("athenz.cloud");
    Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")).thenReturn(providerHostnameAllowedSuffixList);
    List<String> providerHostnameDeniedSuffixList = Collections.singletonList("athenz.info");
    Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")).thenReturn(providerHostnameDeniedSuffixList);
    // cname does not match allowed suffix list thus denied
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.data"), null));
    List<String> cnameList = new ArrayList<>();
    cnameList.add("host1.athenz.cloud");
    cnameList.add("host1.athenz.data");
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", cnameList, null));
    // cname is explicitly denied
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.info"), null));
    cnameList.add("host1.athenz.info");
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", cnameList, null));
    // no hostname resolver thus denied
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.cloud"), null));
    HostnameResolver resolver = Mockito.mock(HostnameResolver.class);
    Mockito.when(resolver.isValidHostCnameList(service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.cloud"), CertType.X509)).thenReturn(false);
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.cloud"), resolver));
    // set resolver to return true for host2
    Mockito.when(resolver.isValidHostCnameList(service, "hostname.athenz.cloud", Collections.singletonList("host2.athenz.cloud"), CertType.X509)).thenReturn(true);
    assertTrue(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host2.athenz.cloud"), resolver));
}