Examples with InstanceCertManager com.yahoo.athenz.zts.cert.InstanceCertManager used on opensource projects

Example 6 with InstanceCertManager

use of com.yahoo.athenz.zts.cert.InstanceCertManager in project athenz by yahoo.

the class ZTSImplTest method testPostSSHRequestException.

@Test
public void testPostSSHRequestException() throws IOException {
    ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0");
    DataStore store = new DataStore(structStore, null, ztsMetric);
    ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store);
    SignedDomain providerDomain = signedAuthorizedProviderDomain();
    store.processSignedDomain(providerDomain, false);
    SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production");
    store.processSignedDomain(tenantDomain, false);
    SSHCertRequestData data = new SSHCertRequestData();
    data.setDestinations(Arrays.asList("dest1", "dest2"));
    data.setPrincipals(Arrays.asList("user1", "user2"));
    data.setSources(Collections.singletonList("src"));
    data.setTouchPublicKey("publickey");
    SSHCertRequestMeta meta = new SSHCertRequestMeta();
    meta.setRequestor("req");
    meta.setOrigin("origin");
    meta.setClientInfo("info");
    meta.setSshClientVersion("1.2");
    meta.setCertType("user");
    SSHCertRequest certRequest = new SSHCertRequest();
    certRequest.setCertRequestData(data);
    certRequest.setCertRequestMeta(meta);
    InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager);
    Mockito.when(instanceManager.generateSSHCertificates(Mockito.any(), eq(certRequest))).thenThrow(new com.yahoo.athenz.common.server.rest.ResourceException(400, "Failed to get ssh certs"));
    ztsImpl.instanceCertManager = instanceManager;
    Path path = Paths.get("src/test/resources/athenz.instanceid.pem");
    String pem = new String(Files.readAllBytes(path));
    CertificateAuthority certAuthority = new CertificateAuthority();
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority);
    assertNotNull(principal);
    X509Certificate cert = Crypto.loadX509Certificate(pem);
    principal.setX509Certificate(cert);
    ResourceContext context = createResourceContext(principal);
    try {
        ztsImpl.postSSHCertRequest(context, certRequest);
        fail();
    } catch (ResourceException ex) {
        assertEquals(400, ex.getCode());
        assertTrue(ex.getMessage().contains("Failed to get ssh certs"));
    }
}

Example 7 with InstanceCertManager

use of com.yahoo.athenz.zts.cert.InstanceCertManager in project athenz by yahoo.

the class ZTSImplTest method testPostInstanceRegisterInformationCSRValidateFailure.

@Test
public void testPostInstanceRegisterInformationCSRValidateFailure() throws IOException {
    ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0");
    DataStore store = new DataStore(structStore, null, ztsMetric);
    ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store);
    SignedDomain providerDomain = signedAuthorizedProviderDomain();
    store.processSignedDomain(providerDomain, false);
    SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production");
    store.processSignedDomain(tenantDomain, false);
    Path path = Paths.get("src/test/resources/athenz.mismatch.cn.csr");
    String certCsr = new String(Files.readAllBytes(path));
    InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class);
    InstanceProvider providerClient = Mockito.mock(InstanceProvider.class);
    InstanceConfirmation confirmation = new InstanceConfirmation().setDomain("athenz").setService("production").setProvider("athenz.provider");
    InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager);
    Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient);
    Mockito.when(providerClient.confirmInstance(Mockito.any())).thenReturn(confirmation);
    Mockito.when(instanceManager.insertX509CertRecord(Mockito.any())).thenReturn(true);
    ztsImpl.instanceProviderManager = instanceProviderManager;
    ztsImpl.instanceCertManager = instanceManager;
    InstanceRegisterInformation info = new InstanceRegisterInformation().setAttestationData("attestationData").setCsr(certCsr).setDomain("athenz").setService("production").setProvider("athenz.provider");
    ResourceContext context = createResourceContext(null);
    try {
        ztsImpl.postInstanceRegisterInformation(context, info);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains("CSR validation failed"));
    }
}

Example 8 with InstanceCertManager

use of com.yahoo.athenz.zts.cert.InstanceCertManager in project athenz by yahoo.

the class ZTSImplTest method getTransportRulesTest.

@Test
public void getTransportRulesTest() {
    final String domainName = "transportrules";
    DataCache domain = new DataCache();
    DomainData domainData = new DomainData();
    domainData.setName(domainName);
    domain.setDomainData(domainData);
    domainData.setRoles(new ArrayList<>());
    Role role1 = ZTSTestUtils.createRoleObject(domainName, "ACL.api.inbound-4443", "dom1.svc1", "dom2.svc2");
    Role role2 = ZTSTestUtils.createRoleObject(domainName, "ACL.api.inbound-8443", "dom3.svc3");
    Role role3 = ZTSTestUtils.createRoleObject(domainName, "ACL.api.outbound-4443", "dom1.svc1");
    domainData.getRoles().add(role1);
    domainData.getRoles().add(role2);
    domainData.getRoles().add(role3);
    Policy policy1 = ZTSTestUtils.createPolicyObject(domainName, "ACL.api.inbound", domainName + ":role.ACL.api.inbound-4443", false, "TCP-IN:1024-65535:4443", domainName + ":api", AssertionEffect.ALLOW);
    policy1.getAssertions().add(new Assertion().setResource(domainName + ":api").setRole(domainName + ":role.ACL.api.inbound-8443").setAction("TCP-IN:49152-65535:8443").setEffect(AssertionEffect.ALLOW));
    domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies());
    domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies());
    domainData.getPolicies().getContents().setPolicies(new ArrayList<>());
    domainData.getPolicies().getContents().getPolicies().add(policy1);
    Policy policy2 = ZTSTestUtils.createPolicyObject(domainName, "ACL.api.outbound", domainName + ":role.ACL.api.outbound-4443", false, "TCP-OUT:1024-65535:4443", domainName + ":api", AssertionEffect.ALLOW);
    domainData.getPolicies().getContents().getPolicies().add(policy2);
    store.getCacheStore().put(domainName, domain);
    addDomainToDataStore("dom1", "svc1");
    addDomainToDataStore("dom2", "svc2");
    addDomainToDataStore("dom3", "svc3");
    Map<String, Role> rolesMap = new HashMap<>();
    rolesMap.put(domainName + ":role.ACL.api.inbound-4443", role1);
    rolesMap.put(domainName + ":role.ACL.api.inbound-8443", role2);
    rolesMap.put(domainName + ":role.ACL.api.outbound-4443", role3);
    domain.processPolicy(domainName, policy1, rolesMap);
    domain.processPolicy(domainName, policy2, rolesMap);
    InstanceCertManager mockICM = Mockito.mock(InstanceCertManager.class);
    InstanceCertManager origICM = zts.instanceCertManager;
    zts.instanceCertManager = mockICM;
    List<Workload> svc1Wl = Collections.singletonList(new Workload().setProvider("openstack").setIpAddresses(Collections.singletonList("10.0.1.1")).setUuid("instance-id1"));
    Mockito.when(mockICM.getWorkloadsByService("dom1", "svc1")).thenReturn(svc1Wl);
    List<Workload> svc2Wl = Collections.singletonList(new Workload().setProvider("openstack").setIpAddresses(Collections.singletonList("10.0.2.1")).setUuid("instance-id2"));
    Mockito.when(mockICM.getWorkloadsByService("dom2", "svc2")).thenReturn(svc2Wl);
    List<String> svc3Ips = Arrays.asList("10.0.3.1", "10.0.3.2", "10.0.3.3");
    List<Workload> svc3Wl = Collections.singletonList(new Workload().setProvider("openstack").setIpAddresses(svc3Ips).setUuid("instance-id3"));
    Mockito.when(mockICM.getWorkloadsByService("dom3", "svc3")).thenReturn(svc3Wl);
    Principal principal = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    TransportRules transportRules = zts.getTransportRules(context, "transportrules", "api");
    assertNotNull(transportRules);
    assertNotNull(transportRules.getIngressRules());
    assertNotNull(transportRules.getEgressRules());
    assertEquals(transportRules.getIngressRules().size(), 5);
    TransportRule expectedIRule1 = new TransportRule().setEndPoint("10.0.1.1").setPort(4443).setProtocol("TCP").setSourcePortRange("1024-65535").setDirection(TransportDirection.IN);
    TransportRule expectedIRule2 = new TransportRule().setEndPoint("10.0.2.1").setPort(4443).setProtocol("TCP").setSourcePortRange("1024-65535").setDirection(TransportDirection.IN);
    TransportRule expectedIRule3 = new TransportRule().setEndPoint("10.0.3.1").setPort(8443).setProtocol("TCP").setSourcePortRange("49152-65535").setDirection(TransportDirection.IN);
    assertThat(transportRules.getIngressRules(), hasItems(expectedIRule1, expectedIRule2, expectedIRule3));
    TransportRule expectedERule1 = new TransportRule().setEndPoint("10.0.1.1").setPort(4443).setProtocol("TCP").setSourcePortRange("1024-65535").setDirection(TransportDirection.OUT);
    assertThat(transportRules.getEgressRules(), hasItems(expectedERule1));
    zts.instanceCertManager = origICM;
    store.getCacheStore().invalidate(domainName);
    store.getCacheStore().invalidate("dom1");
    store.getCacheStore().invalidate("dom2");
    store.getCacheStore().invalidate("dom3");
}

Example 9 with InstanceCertManager

use of com.yahoo.athenz.zts.cert.InstanceCertManager in project athenz by yahoo.

the class ZTSImplTest method testPostInstanceRefreshInformationInvalidIP.

@Test
public void testPostInstanceRefreshInformationInvalidIP() throws IOException {
    ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0");
    DataStore store = new DataStore(structStore, null, ztsMetric);
    ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store);
    Path path = Paths.get("src/test/resources/athenz.instanceid.csr");
    String certCsr = new String(Files.readAllBytes(path));
    InstanceCertManager instanceManager = Mockito.mock(InstanceCertManager.class);
    Mockito.when(instanceManager.verifyCertRefreshIPAddress(Mockito.any())).thenReturn(false);
    ztsImpl.instanceCertManager = instanceManager;
    InstanceRefreshInformation info = new InstanceRefreshInformation().setCsr(certCsr).setToken(true);
    CertificateAuthority certAuthority = new CertificateAuthority();
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority);
    ResourceContext context = createResourceContext(principal);
    try {
        ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403, ex.getMessage());
        assertTrue(ex.getMessage().contains("Unknown IP"), ex.getMessage());
    }
}

Example 10 with InstanceCertManager

use of com.yahoo.athenz.zts.cert.InstanceCertManager in project athenz by yahoo.

the class ZTSImplTest method testPostRoleCertificateRequestNullCertReturn.

@Test
public void testPostRoleCertificateRequestNullCertReturn() {
    // this csr is for sports:role.readers role
    RoleCertificateRequest req = new RoleCertificateRequest().setCsr(ROLE_CERT_CORETECH_REQUEST).setExpiryTime(3600L);
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processSignedDomain(signedDomain, false);
    CloudStore cloudStore = new MockCloudStore();
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    Principal principal = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    InstanceCertManager certManager = Mockito.mock(InstanceCertManager.class);
    Mockito.when(certManager.generateIdentity("aws", null, ROLE_CERT_CORETECH_REQUEST, "coretech.weathers", "client", 3600, Priority.Unspecified_priority)).thenReturn(null);
    zts.instanceCertManager = certManager;
    try {
        zts.postRoleCertificateRequest(context, "coretech", "readers", req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 500);
        assertTrue(ex.getMessage().contains("Unable to create certificate from the cert signer"));
    }
}