Examples with HostnameResolver com.yahoo.athenz.common.server.dns.HostnameResolver used on opensource projects

Example 21 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class X509CertRequestTest method testValidateDnsNamesWithCnameValuesWithSameSuffix.

@Test
public void testValidateDnsNamesWithCnameValuesWithSameSuffix() throws IOException {
    Path path = Paths.get("src/test/resources/athenz.instanceid.cname.suffix.csr");
    String csr = new String(Files.readAllBytes(path));
    String service = "athenz.production";
    X509CertRequest certReq = new X509CertRequest(csr);
    assertNotNull(certReq);
    DataCache athenzSysDomainCache = Mockito.mock(DataCache.class);
    Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")).thenReturn(Collections.singletonList("ostk.athenz.cloud"));
    List<String> allowedSuffixList = new ArrayList<>();
    allowedSuffixList.add("athenz.info");
    allowedSuffixList.add("athenz.cloud");
    Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")).thenReturn(allowedSuffixList);
    Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")).thenReturn(null);
    List<String> cnameList = new ArrayList<>();
    cnameList.add("cname1.ostk.athenz.cloud");
    cnameList.add("cname2.athenz.info");
    HostnameResolver resolver = Mockito.mock(HostnameResolver.class);
    Mockito.when(resolver.isValidHostCnameList(service, "host1.athenz.cloud", cnameList, CertType.X509)).thenReturn(true);
    Mockito.when(resolver.isValidHostname("host1.athenz.cloud")).thenReturn(true);
    assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", "host1.athenz.cloud", cnameList, resolver));
}

Example 22 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceZTSProviderTest method testConfirmInstanceUnknownHostname.

@Test
public void testConfirmInstanceUnknownHostname() {
    KeyStore keystore = Mockito.mock(KeyStore.class);
    Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0);
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    Mockito.when(hostnameResolver.isValidHostname("hostabc.athenz.com")).thenReturn(true);
    Mockito.when(hostnameResolver.getAllByName("hostabc.athenz.com")).thenReturn(new HashSet<>(Collections.singletonList("10.1.1.2")));
    InstanceZTSProvider provider = new InstanceZTSProvider();
    provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, keystore);
    provider.setHostnameResolver(hostnameResolver);
    PrincipalToken tokenToSign = new PrincipalToken.Builder("S1", "sports", "api").keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000).expirationWindow(3600).build();
    tokenToSign.sign(servicePrivateKeyStringK0);
    InstanceConfirmation confirmation = new InstanceConfirmation();
    confirmation.setAttestationData(tokenToSign.getSignedToken());
    confirmation.setDomain("sports");
    confirmation.setService("api");
    confirmation.setProvider("sys.auth.zts");
    Map<String, String> attributes = new HashMap<>();
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_DNS, "api.sports.zts.athenz.cloud,inst1.instanceid.athenz.zts.athenz.cloud");
    attributes.put(InstanceProvider.ZTS_INSTANCE_HOSTNAME, "hostabc.athenz.com");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CLIENT_IP, "10.1.1.1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_IP, "10.1.1.1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CSR_PUBLIC_KEY, servicePublicKeyStringK0);
    confirmation.setAttributes(attributes);
    try {
        provider.confirmInstance(confirmation);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
        assertTrue(ex.getMessage().contains("validate certificate request hostname"));
    }
    provider.close();
}

Example 23 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceZTSProviderTest method testConfirmInstanceValidHostnameIpv6.

@Test
public void testConfirmInstanceValidHostnameIpv6() {
    KeyStore keystore = Mockito.mock(KeyStore.class);
    Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0);
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    Mockito.when(hostnameResolver.isValidHostname("hostabc.athenz.com")).thenReturn(true);
    Mockito.when(hostnameResolver.getAllByName("hostabc.athenz.com")).thenReturn(new HashSet<>(Arrays.asList("10.1.1.1", "2001:db8:a0b:12f0:0:0:0:1")));
    InstanceZTSProvider provider = new InstanceZTSProvider();
    provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, keystore);
    provider.setHostnameResolver(hostnameResolver);
    PrincipalToken tokenToSign = new PrincipalToken.Builder("S1", "sports", "api").keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000).expirationWindow(3600).build();
    tokenToSign.sign(servicePrivateKeyStringK0);
    InstanceConfirmation confirmation = new InstanceConfirmation();
    confirmation.setAttestationData(tokenToSign.getSignedToken());
    confirmation.setDomain("sports");
    confirmation.setService("api");
    confirmation.setProvider("sys.auth.zts");
    Map<String, String> attributes = new HashMap<>();
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_DNS, "api.sports.zts.athenz.cloud,inst1.instanceid.athenz.zts.athenz.cloud");
    attributes.put(InstanceProvider.ZTS_INSTANCE_HOSTNAME, "hostabc.athenz.com");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CLIENT_IP, "2001:db8:a0b:12f0:0:0:0:1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_IP, "10.1.1.1,2001:db8:a0b:12f0:0:0:0:1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_URI, "athenz://instanceid/zts/hostabc.athenz.com,athenz://hostname/hostabc.athenz.com");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CSR_PUBLIC_KEY, servicePublicKeyStringK0);
    confirmation.setAttributes(attributes);
    assertNotNull(provider.confirmInstance(confirmation));
    provider.close();
}

Example 24 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceZTSProviderTest method testConfirmInstanceInvalidHostnameUri.

@Test
public void testConfirmInstanceInvalidHostnameUri() throws UnknownHostException {
    KeyStore keystore = Mockito.mock(KeyStore.class);
    Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0);
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    Mockito.when(hostnameResolver.isValidHostname("hostabc.athenz.com")).thenReturn(true);
    Mockito.when(hostnameResolver.getAllByName("hostabc.athenz.com")).thenReturn(new HashSet<>(Collections.singletonList("10.1.1.1")));
    InstanceZTSProvider provider = new InstanceZTSProvider();
    provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, keystore);
    provider.setHostnameResolver(hostnameResolver);
    PrincipalToken tokenToSign = new PrincipalToken.Builder("S1", "sports", "api").keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000).expirationWindow(3600).build();
    tokenToSign.sign(servicePrivateKeyStringK0);
    InstanceConfirmation confirmation = new InstanceConfirmation();
    confirmation.setAttestationData(tokenToSign.getSignedToken());
    confirmation.setDomain("sports");
    confirmation.setService("api");
    confirmation.setProvider("sys.auth.zts");
    Map<String, String> attributes = new HashMap<>();
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_DNS, "api.sports.zts.athenz.cloud,inst1.instanceid.athenz.zts.athenz.cloud");
    attributes.put(InstanceProvider.ZTS_INSTANCE_HOSTNAME, "hostabc.athenz.com");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CLIENT_IP, "10.1.1.1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_IP, "10.1.1.1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_URI, "athenz://instanceid/zts/def.athenz.com,athenz://hostname/def.athenz.com");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CSR_PUBLIC_KEY, servicePublicKeyStringK0);
    confirmation.setAttributes(attributes);
    try {
        provider.confirmInstance(confirmation);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
        assertTrue(ex.getMessage().contains("validate certificate request URI hostname"));
    }
    provider.close();
}

Example 25 with HostnameResolver

use of com.yahoo.athenz.common.server.dns.HostnameResolver in project athenz by yahoo.

the class InstanceZTSProviderTest method testConfirmInstanceValidHostname.

@Test
public void testConfirmInstanceValidHostname() {
    KeyStore keystore = Mockito.mock(KeyStore.class);
    Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0);
    HostnameResolver hostnameResolver = Mockito.mock(HostnameResolver.class);
    Mockito.when(hostnameResolver.isValidHostname("hostabc.athenz.com")).thenReturn(true);
    Mockito.when(hostnameResolver.getAllByName("hostabc.athenz.com")).thenReturn(new HashSet<>(Arrays.asList("10.1.1.1", "2001:db8:a0b:12f0:0:0:0:1")));
    InstanceZTSProvider provider = new InstanceZTSProvider();
    provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, keystore);
    provider.setHostnameResolver(hostnameResolver);
    PrincipalToken tokenToSign = new PrincipalToken.Builder("S1", "sports", "api").keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000).expirationWindow(3600).build();
    tokenToSign.sign(servicePrivateKeyStringK0);
    InstanceConfirmation confirmation = new InstanceConfirmation();
    confirmation.setAttestationData(tokenToSign.getSignedToken());
    confirmation.setDomain("sports");
    confirmation.setService("api");
    confirmation.setProvider("sys.auth.zts");
    Map<String, String> attributes = new HashMap<>();
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_DNS, "api.sports.zts.athenz.cloud,inst1.instanceid.athenz.zts.athenz.cloud");
    attributes.put(InstanceProvider.ZTS_INSTANCE_HOSTNAME, "hostabc.athenz.com");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CLIENT_IP, "10.1.1.1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_IP, "10.1.1.1,2001:db8:a0b:12f0:0:0:0:1");
    attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_URI, "athenz://instanceid/zts/hostabc.athenz.com,athenz://hostname/hostabc.athenz.com");
    attributes.put(InstanceProvider.ZTS_INSTANCE_CSR_PUBLIC_KEY, servicePublicKeyStringK0);
    confirmation.setAttributes(attributes);
    assertNotNull(provider.confirmInstance(confirmation));
    provider.close();
}