Skip to content

Commit 810657b

Browse files
author
GitLab Runner
committed
Merge branch 'main' of github.com:securosys-com/hcvault-ce-rest-integration
2 parents 8d2220d + a2c8aaa commit 810657b

33 files changed

Lines changed: 34099 additions & 0 deletions

‎builtin/credential/aws/pkcs7/verify_dsa_test.go‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
//go:build go1.11 || go1.12 || go1.13 || go1.14 || go1.15
2+
3+
package pkcs7
4+
5+
import (
6+
"crypto/x509"
7+
"encoding/pem"
8+
"io/ioutil"
9+
"os"
10+
"os/exec"
11+
"testing"
12+
)
13+
14+
func TestVerifyEC2(t *testing.T) {
15+
fixture := UnmarshalDSATestFixture(EC2IdentityDocumentFixture)
16+
p7, err := Parse(fixture.Input)
17+
if err != nil {
18+
t.Errorf("Parse encountered unexpected error: %v", err)
19+
}
20+
p7.Certificates = []*x509.Certificate{fixture.Certificate}
21+
if err := p7.Verify(); err != nil {
22+
t.Errorf("Verify failed with error: %v", err)
23+
}
24+
}
25+
26+
var EC2IdentityDocumentFixture = `
27+
-----BEGIN PKCS7-----
28+
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAaCA
29+
JIAEggGmewogICJwcml2YXRlSXAiIDogIjE3Mi4zMC4wLjI1MiIsCiAgImRldnBh
30+
eVByb2R1Y3RDb2RlcyIgOiBudWxsLAogICJhdmFpbGFiaWxpdHlab25lIiA6ICJ1
31+
cy1lYXN0LTFhIiwKICAidmVyc2lvbiIgOiAiMjAxMC0wOC0zMSIsCiAgImluc3Rh
32+
bmNlSWQiIDogImktZjc5ZmU1NmMiLAogICJiaWxsaW5nUHJvZHVjdHMiIDogbnVs
33+
bCwKICAiaW5zdGFuY2VUeXBlIiA6ICJ0Mi5taWNybyIsCiAgImFjY291bnRJZCIg
34+
OiAiMTIxNjU5MDE0MzM0IiwKICAiaW1hZ2VJZCIgOiAiYW1pLWZjZTNjNjk2IiwK
35+
ICAicGVuZGluZ1RpbWUiIDogIjIwMTYtMDQtMDhUMDM6MDE6MzhaIiwKICAiYXJj
36+
aGl0ZWN0dXJlIiA6ICJ4ODZfNjQiLAogICJrZXJuZWxJZCIgOiBudWxsLAogICJy
37+
YW1kaXNrSWQiIDogbnVsbCwKICAicmVnaW9uIiA6ICJ1cy1lYXN0LTEiCn0AAAAA
38+
AAAxggEYMIIBFAIBATBpMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5n
39+
dG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2Vi
40+
IFNlcnZpY2VzIExMQwIJAJa6SNnlXhpnMAkGBSsOAwIaBQCgXTAYBgkqhkiG9w0B
41+
CQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA0MDgwMzAxNDRaMCMG
42+
CSqGSIb3DQEJBDEWBBTuUc28eBXmImAautC+wOjqcFCBVjAJBgcqhkjOOAQDBC8w
43+
LQIVAKA54NxGHWWCz5InboDmY/GHs33nAhQ6O/ZI86NwjA9Vz3RNMUJrUPU5tAAA
44+
AAAAAA==
45+
-----END PKCS7-----
46+
-----BEGIN CERTIFICATE-----
47+
MIIC7TCCAq0CCQCWukjZ5V4aZzAJBgcqhkjOOAQDMFwxCzAJBgNVBAYTAlVTMRkw
48+
FwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYD
49+
VQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAeFw0xMjAxMDUxMjU2MTJaFw0z
50+
ODAxMDUxMjU2MTJaMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9u
51+
IFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNl
52+
cnZpY2VzIExMQzCCAbcwggEsBgcqhkjOOAQBMIIBHwKBgQCjkvcS2bb1VQ4yt/5e
53+
ih5OO6kK/n1Lzllr7D8ZwtQP8fOEpp5E2ng+D6Ud1Z1gYipr58Kj3nssSNpI6bX3
54+
VyIQzK7wLclnd/YozqNNmgIyZecN7EglK9ITHJLP+x8FtUpt3QbyYXJdmVMegN6P
55+
hviYt5JH/nYl4hh3Pa1HJdskgQIVALVJ3ER11+Ko4tP6nwvHwh6+ERYRAoGBAI1j
56+
k+tkqMVHuAFcvAGKocTgsjJem6/5qomzJuKDmbJNu9Qxw3rAotXau8Qe+MBcJl/U
57+
hhy1KHVpCGl9fueQ2s6IL0CaO/buycU1CiYQk40KNHCcHfNiZbdlx1E9rpUp7bnF
58+
lRa2v1ntMX3caRVDdbtPEWmdxSCYsYFDk4mZrOLBA4GEAAKBgEbmeve5f8LIE/Gf
59+
MNmP9CM5eovQOGx5ho8WqD+aTebs+k2tn92BBPqeZqpWRa5P/+jrdKml1qx4llHW
60+
MXrs3IgIb6+hUIB+S8dz8/mmO0bpr76RoZVCXYab2CZedFut7qc3WUH9+EUAH5mw
61+
vSeDCOUMYQR7R9LINYwouHIziqQYMAkGByqGSM44BAMDLwAwLAIUWXBlk40xTwSw
62+
7HX32MxXYruse9ACFBNGmdX2ZBrVNGrN9N2f6ROk0k9K
63+
-----END CERTIFICATE-----`
64+
65+
func TestDSASignWithOpenSSLAndVerify(t *testing.T) {
66+
content := []byte(`
67+
A ship in port is safe,
68+
but that's not what ships are built for.
69+
-- Grace Hopper`)
70+
// write the content to a temp file
71+
tmpContentFile, err := ioutil.TempFile("", "TestDSASignWithOpenSSLAndVerify_content")
72+
if err != nil {
73+
t.Fatal(err)
74+
}
75+
ioutil.WriteFile(tmpContentFile.Name(), content, 0o755)
76+
77+
// write the signer cert to a temp file
78+
tmpSignerCertFile, err := ioutil.TempFile("", "TestDSASignWithOpenSSLAndVerify_signer")
79+
if err != nil {
80+
t.Fatal(err)
81+
}
82+
ioutil.WriteFile(tmpSignerCertFile.Name(), dsaPublicCert, 0o755)
83+
84+
// write the signer key to a temp file
85+
tmpSignerKeyFile, err := ioutil.TempFile("", "TestDSASignWithOpenSSLAndVerify_key")
86+
if err != nil {
87+
t.Fatal(err)
88+
}
89+
ioutil.WriteFile(tmpSignerKeyFile.Name(), dsaPrivateKey, 0o755)
90+
91+
tmpSignedFile, err := ioutil.TempFile("", "TestDSASignWithOpenSSLAndVerify_signature")
92+
if err != nil {
93+
t.Fatal(err)
94+
}
95+
// call openssl to sign the content
96+
opensslCMD := exec.Command("openssl", "smime", "-sign", "-nodetach", "-md", "sha1",
97+
"-in", tmpContentFile.Name(), "-out", tmpSignedFile.Name(),
98+
"-signer", tmpSignerCertFile.Name(), "-inkey", tmpSignerKeyFile.Name(),
99+
"-certfile", tmpSignerCertFile.Name(), "-outform", "PEM")
100+
out, err := opensslCMD.CombinedOutput()
101+
if err != nil {
102+
t.Fatalf("openssl command failed with %s: %s", err, out)
103+
}
104+
105+
// verify the signed content
106+
pemSignature, err := ioutil.ReadFile(tmpSignedFile.Name())
107+
if err != nil {
108+
t.Fatal(err)
109+
}
110+
t.Logf("%s\n", pemSignature)
111+
derBlock, _ := pem.Decode(pemSignature)
112+
if derBlock == nil {
113+
t.Fatalf("failed to read DER block from signature PEM %s", tmpSignedFile.Name())
114+
}
115+
p7, err := Parse(derBlock.Bytes)
116+
if err != nil {
117+
t.Fatalf("Parse encountered unexpected error: %v", err)
118+
}
119+
if err := p7.Verify(); err != nil {
120+
t.Fatalf("Verify failed with error: %v", err)
121+
}
122+
os.Remove(tmpSignerCertFile.Name()) // clean up
123+
os.Remove(tmpSignerKeyFile.Name()) // clean up
124+
os.Remove(tmpContentFile.Name()) // clean up
125+
}
126+
127+
var dsaPrivateKey = []byte(`-----BEGIN PRIVATE KEY-----
128+
MIIBSwIBADCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdS
129+
PO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVCl
130+
pJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith
131+
1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7L
132+
vKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3
133+
zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImo
134+
g9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoEFgIUfW4aPdQBn9gJZp2KuNpzgHzvfsE=
135+
-----END PRIVATE KEY-----`)
136+
137+
var dsaPublicCert = []byte(`-----BEGIN CERTIFICATE-----
138+
MIIDOjCCAvWgAwIBAgIEPCY/UDANBglghkgBZQMEAwIFADBsMRAwDgYDVQQGEwdV
139+
bmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYD
140+
VQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwdVbmtub3du
141+
MB4XDTE4MTAyMjEzNDMwN1oXDTQ2MDMwOTEzNDMwN1owbDEQMA4GA1UEBhMHVW5r
142+
bm93bjEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4GA1UE
143+
ChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEQMA4GA1UEAxMHVW5rbm93bjCC
144+
AbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADD
145+
Hj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gE
146+
exAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/Ii
147+
Axmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4
148+
V7l5lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozI
149+
puE8FnqLVHyNKOCjrh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4Vrl
150+
nwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQDCriMPbEVBoRK4SOUeFwg7+VRf4TTp
151+
rcOQC9IVVoCjXzuWEGrp3ZI7YWJSpFnSch4lk29RH8O0HpI/NOzKnOBtnKr782pt
152+
1k/bJVMH9EaLd6MKnAVjrCDMYBB0MhebZ8QHY2elZZCWoqDYAcIDOsEx+m4NLErT
153+
ypPnjS5M0jm1PKMhMB8wHQYDVR0OBBYEFC0Yt5XdM0Kc95IX8NQ8XRssGPx7MA0G
154+
CWCGSAFlAwQDAgUAAzAAMC0CFQCIgQtrZZ9hdZG1ROhR5hc8nYEmbgIUAIlgC688
155+
qzy/7yePTlhlpj+ahMM=
156+
-----END CERTIFICATE-----`)
157+
158+
type DSATestFixture struct {
159+
Input []byte
160+
Certificate *x509.Certificate
161+
}
162+
163+
func UnmarshalDSATestFixture(testPEMBlock string) DSATestFixture {
164+
var result DSATestFixture
165+
var derBlock *pem.Block
166+
pemBlock := []byte(testPEMBlock)
167+
for {
168+
derBlock, pemBlock = pem.Decode(pemBlock)
169+
if derBlock == nil {
170+
break
171+
}
172+
switch derBlock.Type {
173+
case "PKCS7":
174+
result.Input = derBlock.Bytes
175+
case "CERTIFICATE":
176+
result.Certificate, _ = x509.ParseCertificate(derBlock.Bytes)
177+
}
178+
}
179+
180+
return result
181+
}

‎enos/modules/seal_key_awskms/main.tf‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: BUSL-1.1
3+
4+
variable "cluster_id" {
5+
type = string
6+
}
7+
8+
variable "cluster_meta" {
9+
type = string
10+
default = null
11+
}
12+
13+
variable "common_tags" {
14+
type = map(string)
15+
default = null
16+
}
17+
18+
variable "other_resources" {
19+
type = list(string)
20+
default = []
21+
}
22+
23+
locals {
24+
cluster_name = var.cluster_meta == null ? var.cluster_id : "${var.cluster_id}-${var.cluster_meta}"
25+
}
26+
27+
resource "aws_kms_key" "key" {
28+
description = "auto-unseal-key-${local.cluster_name}"
29+
deletion_window_in_days = 7 // 7 is the shortest allowed window
30+
tags = var.common_tags
31+
}
32+
33+
resource "aws_kms_alias" "alias" {
34+
name = "alias/auto-unseal-key-${local.cluster_name}"
35+
target_key_id = aws_kms_key.key.key_id
36+
}
37+
38+
output "alias" {
39+
description = "The key alias name"
40+
value = aws_kms_alias.alias.name
41+
}
42+
43+
output "id" {
44+
description = "The key ID"
45+
value = aws_kms_key.key.key_id
46+
}
47+
48+
output "resource_name" {
49+
description = "The ARN"
50+
value = aws_kms_key.key.arn
51+
}
52+
53+
output "resource_names" {
54+
description = "The list of names"
55+
value = compact(concat([aws_kms_key.key.arn], var.other_resources))
56+
}

‎enos/modules/seal_key_shamir/main.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: BUSL-1.1
3+
4+
# A shim unseal key module for shamir seal types
5+
6+
variable "cluster_id" { default = null }
7+
variable "cluster_meta" { default = null }
8+
variable "common_tags" { default = null }
9+
variable "names" {
10+
type = list(string)
11+
default = []
12+
}
13+
14+
output "alias" { value = null }
15+
output "id" { value = null }
16+
output "resource_name" { value = null }
17+
output "resource_names" { value = var.names }

‎enos/modules/vault_cluster/scripts/create_audit_log_dir.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/usr/bin/env bash
2+
# Copyright (c) HashiCorp, Inc.
3+
# SPDX-License-Identifier: BUSL-1.1
4+
5+
6+
set -eux
7+
8+
LOG_DIR=$(dirname "$LOG_FILE_PATH")
9+
10+
function retry {
11+
local retries=$1
12+
shift
13+
local count=0
14+
15+
until "$@"; do
16+
exit=$?
17+
wait=10
18+
count=$((count + 1))
19+
20+
if [ "$count" -lt "$retries" ]; then
21+
sleep "$wait"
22+
else
23+
return "$exit"
24+
fi
25+
done
26+
27+
return 0
28+
}
29+
30+
retry 7 id -a "$SERVICE_USER"
31+
32+
sudo mkdir -p "$LOG_DIR"
33+
sudo chown -R "$SERVICE_USER":"$SERVICE_USER" "$LOG_DIR"

‎enos/modules/vault_cluster/scripts/enable_audit_logging.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/env bash
2+
# Copyright (c) HashiCorp, Inc.
3+
# SPDX-License-Identifier: BUSL-1.1
4+
5+
set -exo pipefail
6+
7+
# Run nc to listen on port 9090 for the socket auditor. We spawn nc
8+
# with nohup to ensure that the listener doesn't expect a SIGHUP and
9+
# thus block the SSH session from exiting or terminating on exit.
10+
# We immediately write to STDIN from /dev/null to give nc an
11+
# immediate EOF so as to not block on expecting STDIN.
12+
nohup nc -kl 9090 &> /dev/null < /dev/null &
13+
14+
# Wait for nc to be listening before we attempt to enable the socket auditor.
15+
attempts=3
16+
count=0
17+
until nc -zv 127.0.0.1 9090 &> /dev/null < /dev/null; do
18+
wait=$((2 ** count))
19+
count=$((count + 1))
20+
21+
if [ "$count" -le "$attempts" ]; then
22+
sleep "$wait"
23+
if ! pgrep -x nc; then
24+
nohup nc -kl 9090 &> /dev/null < /dev/null &
25+
fi
26+
else
27+
28+
echo "Timed out waiting for nc to listen on 127.0.0.1:9090" 1>&2
29+
exit 1
30+
fi
31+
done
32+
33+
sleep 1
34+
35+
# Enable the auditors.
36+
$VAULT_BIN_PATH audit enable file file_path="$LOG_FILE_PATH"
37+
$VAULT_BIN_PATH audit enable syslog tag="vault" facility="AUTH"
38+
$VAULT_BIN_PATH audit enable socket address="127.0.0.1:9090" || true

‎enos/modules/vault_cluster/scripts/install-packages.sh‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
# Copyright (c) HashiCorp, Inc.
3+
# SPDX-License-Identifier: BUSL-1.1
4+
5+
6+
set -ex -o pipefail
7+
8+
if [ "$PACKAGES" == "" ]
9+
then
10+
echo "No dependencies to install."
11+
exit 0
12+
fi
13+
14+
function retry {
15+
local retries=$1
16+
shift
17+
local count=0
18+
19+
until "$@"; do
20+
exit=$?
21+
wait=$((2 ** count))
22+
count=$((count + 1))
23+
if [ "$count" -lt "$retries" ]; then
24+
sleep "$wait"
25+
else
26+
exit "$exit"
27+
fi
28+
done
29+
30+
return 0
31+
}
32+
33+
echo "Installing Dependencies: $PACKAGES"
34+
if [ -f /etc/debian_version ]; then
35+
# Do our best to make sure that we don't race with cloud-init. Wait a reasonable time until we
36+
# see ec2 in the sources list. Very rarely cloud-init will take longer than we wait. In that case
37+
# we'll just install our packages.
38+
retry 7 grep ec2 /etc/apt/sources.list || true
39+
40+
cd /tmp
41+
retry 5 sudo apt update
42+
# shellcheck disable=2068
43+
retry 5 sudo apt install -y ${PACKAGES[@]}
44+
else
45+
cd /tmp
46+
# shellcheck disable=2068
47+
retry 7 sudo yum -y install ${PACKAGES[@]}
48+
fi

0 commit comments

Comments
 (0)