ZTSImpl implements KeyStore, ZTSHandler { @Deprecated @Override public Identity postInstanceRefreshRequest(ResourceContext ctx, String domain, String service, InstanceRefreshRequest req) { final String caller = ctx.getApiName(); final String principalDomain = logPrincipalAndGetDomain(ctx); if (readOnlyMode) { throw requestError("Server in Maintenance Read-Only mode. Please try your request later", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN, principalDomain); } validateRequest(ctx.request(), principalDomain, caller); validate(domain, TYPE_DOMAIN_NAME, principalDomain, caller); validate(service, TYPE_SIMPLE_NAME, principalDomain, caller); validate(req, TYPE_INSTANCE_REFRESH_REQUEST, principalDomain, caller); final Principal principal = ((RsrcCtxWrapper) ctx).principal(); validatePrincipalNotRoleIdentity(principal, caller); domain = domain.toLowerCase(); setRequestDomain(ctx, domain); service = service.toLowerCase(); String fullServiceName = domain + "." + service; final String principalName = principal.getFullName(); boolean userRequest = false; if (!fullServiceName.equals(principalName)) { try { userRequest = authorizer.access("update", domain + ":service", principal, null); } catch (ResourceException ex) { LOGGER.error("postInstanceRefreshRequest: access check failure for {}: {}", principalName, ex.getMessage()); } if (!userRequest) { throw requestError("Principal mismatch: " + fullServiceName + " vs. " + principalName, caller, domain, principalDomain); } } if (userDomain.equalsIgnoreCase(domain)) { throw requestError("TLS Certificates require ServiceTokens: " + fullServiceName, caller, domain, principalDomain); } final Authority authority = principal.getAuthority(); boolean refreshOperation = (!userRequest && (authority instanceof CertificateAuthority)); final String keyId = userRequest || refreshOperation ? req.getKeyId() : principal.getKeyId(); String publicKey = getPublicKey(domain, service, keyId); if (publicKey == null) { throw requestError("Unable to retrieve public key for " + fullServiceName + " with key id: " + keyId, caller, domain, principalDomain); } X509CertRequest x509CertReq; try { x509CertReq = new X509CertRequest(req.getCsr()); } catch (CryptoException ex) { throw requestError("Unable to parse PKCS10 certificate request", caller, domain, principalDomain); } final PKCS10CertificationRequest certReq = x509CertReq.getCertReq(); if (!ZTSUtils.verifyCertificateRequest(certReq, domain, service, null)) { throw requestError("Invalid CSR - data mismatch", caller, domain, principalDomain); } if (!x509CertReq.validateSubjectOField(validCertSubjectOrgValues)) { throw requestError("Invalid CSR - invalid Subject O field", caller, domain, principalDomain); } if (verifyCertSubjectOU && !x509CertReq.validateSubjectOUField(null, null, validCertSubjectOrgUnitValues)) { throw requestError("Invalid CSR - invalid Subject OU field", caller, domain, principalDomain); } if (!x509CertReq.validatePublicKeys(publicKey)) { throw requestError("Invalid CSR - public key mismatch", caller, domain, principalDomain); } final String ipAddress = ServletRequestUtil.getRemoteAddress(ctx.request()); if (verifyCertRequestIP && !x509CertReq.validateIPAddress(ipAddress)) { throw requestError("Invalid CSR - IP address mismatch", caller, domain, principalDomain); } if (refreshOperation) { ServiceX509RefreshRequestStatus status = validateServiceX509RefreshRequest(principal, x509CertReq, ipAddress); if (status == ServiceX509RefreshRequestStatus.IP_NOT_ALLOWED) { throw forbiddenError("IP not allowed for refresh: " + ipAddress, caller, domain, principalDomain); } if (status != ServiceX509RefreshRequestStatus.SUCCESS) { throw requestError("Request validation failed: " + status, caller, domain, principalDomain); } } int expiryTime = req.getExpiryTime() != null ? req.getExpiryTime() : 0; Identity identity = ZTSUtils.generateIdentity(instanceCertManager, req.getCsr(), fullServiceName, null, expiryTime); if (identity == null) { throw serverError("Unable to generate identity", caller, domain, principalDomain); } identity.setCaCertBundle(instanceCertManager.getX509CertificateSigner()); instanceCertManager.logX509Cert(principal, ipAddress, ZTSConsts.ZTS_SERVICE, ZTSUtils.extractCertReqInstanceId(certReq), Crypto.loadX509Certificate(identity.getCertificate())); return identity; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testPostInstanceRefreshRequestPrincipalMismatch() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("hockey", "kings", "v=S1,d=hockey;n=kings;s=sig", 0, new PrincipalAuthority()); ResourceContext context = createResourceContext(principal); try { zts.postInstanceRefreshRequest(context, "basketbal", "kings", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("Principal mismatch"), ex.getMessage()); } try { zts.postInstanceRefreshRequest(context, "hockey", "bruins", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("Principal mismatch"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestUserAuthority() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "joe", "v=U1,d=user;n=joe;s=sig", 0, new PrincipalAuthority()); ResourceContext context = createResourceContext(principal); try { zts.postInstanceRefreshRequest(context, "user", "joe", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("TLS Certificates require ServiceTokens"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestUnknownAuthority() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "kings", "v=U1,d=user;n=kings;s=sig", 0, new UserAuthority()); ResourceContext context = createResourceContext(principal); try { zts.postInstanceRefreshRequest(context, "user", "kings", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testPostInstanceRefreshRequest() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "syncer", "v=S1,d=athenz;n=syncer;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.syncer_0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrvfvBgXWqWAorw5hYJu3dpOJe0gp3n\n" + "TgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwmYw2uMK8CAwEAAQ==\n" + "-----END PUBLIC KEY-----"; zts.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); Identity identity = zts.postInstanceRefreshRequest(context, "athenz", "syncer", req); assertNotNull(identity); X509Certificate cert = Crypto.loadX509Certificate(identity.getCertificate()); assertNotNull(cert); req.setExpiryTime(1000); identity = zts.postInstanceRefreshRequest(context, "athenz", "syncer", req); assertNotNull(identity); }
@Test public void testPostInstanceRefreshRequestSubjectOU() throws IOException { Path path = Paths.get("src/test/resources/athenz.cert_ou.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1,d=athenz;n=production;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.production_0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALaJDb8CSq9tuzwSbe5bJurHLLvfkQ3a\n" + "jFGGJU4M8cz5+CbkJXRl/Cx1R0zOA+fdX5cGxYxL0Td31YDVw3tECWUCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; zts.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); zts.verifyCertSubjectOU = true; zts.verifyCertRequestIP = false; try { zts.postInstanceRefreshRequest(context, "athenz", "production", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } Set<String> ouValues = new HashSet<>(); ouValues.add("Athenz"); zts.validCertSubjectOrgUnitValues = ouValues; Identity identity = zts.postInstanceRefreshRequest(context, "athenz", "production", req); assertNotNull(identity); }
@Test public void testPostInstanceRefreshRequestSubjOMismatch() throws IOException { Set<String> origOrgValues = zts.validCertSubjectOrgValues; Set<String> newOrgValues = new HashSet<>(); newOrgValues.add("Mismatch Org"); zts.validCertSubjectOrgValues = newOrgValues; Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "syncer", "v=S1,d=athenz;n=syncer;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.syncer_0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrvfvBgXWqWAorw5hYJu3dpOJe0gp3n\n" + "TgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwmYw2uMK8CAwEAAQ==\n" + "-----END PUBLIC KEY-----"; zts.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { zts.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } zts.validCertSubjectOrgValues = origOrgValues; }
@Test public void testPostInstanceRefreshRequestMismatchIP() throws IOException { Path path = Paths.get("src/test/resources/athenz.single_ip.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1,d=athenz;n=production;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.production_0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMCfPNQO/3+rIwR4B1Ulr4w/CZR2i3LY\n" + "XH/dNcm+DCxpmEUtMVsnbYAJm2uVUVKk0UX1mxu5L8pDepBY+X1LEHsCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; zts.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("10.0.0.1"); ResourceContext context = createResourceContext(principal, servletRequest); try { zts.postInstanceRefreshRequest(context, "athenz", "production", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testPostInstanceRefreshRequestMismatchIPVerifyDisabled() throws IOException { Path path = Paths.get("src/test/resources/athenz.single_ip.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1,d=athenz;n=production;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.production_0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMCfPNQO/3+rIwR4B1Ulr4w/CZR2i3LY\n" + "XH/dNcm+DCxpmEUtMVsnbYAJm2uVUVKk0UX1mxu5L8pDepBY+X1LEHsCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; zts.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("10.0.0.1"); ResourceContext context = createResourceContext(principal, servletRequest); zts.verifyCertRequestIP = false; Identity identity = zts.postInstanceRefreshRequest(context, "athenz", "production", req); assertNotNull(identity); zts.verifyCertRequestIP = true; }
@Test public void testPostInstanceRefreshRequestHcaCNMismatch() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("abc", "xyz", "v=S1,d=abc;n=xyz;s=sig", 0, new PrincipalAuthority()); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { zts.postInstanceRefreshRequest(context, "abc", "xyz", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testPostInstanceRefreshRequestHcaPrincipalMismatch() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("abc", "xyz", "v=S1,d=abc;n=xyz;s=sig", 0, null); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { zts.postInstanceRefreshRequest(context, "iaas.athenz", "syncer", req); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testPostInstanceRefreshRequestByUserPrincipalMismatch() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(false); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("Principal mismatch")); } }
@Test public void testPostInstanceRefreshRequestByUser() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); Identity identity = ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); assertNotNull(identity); assertNotNull(identity.getCertificate()); }
@Test public void testPostInstanceRefreshRequestByUserIdentityFailure() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); InstanceCertManager certManager = Mockito.mock(InstanceCertManager.class); Mockito.when(certManager.generateX509Certificate(Mockito.anyString(), Mockito.anyString(), Mockito.anyInt())).thenReturn(null); ztsImpl.instanceCertManager = certManager; try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("Unable to generate identity"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestByUserCert() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("0"); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "user", "doe", req); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("TLS Certificates require ServiceTokens"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestByUserNoPublicKey() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("1"); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("Unable to retrieve public key"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestByUserInvalidRequest() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("1"); String publicKeyName = "athenz.api_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "api", req); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("Invalid CSR - data mismatch"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestByUserPublicKeyMismatch() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("1"); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "ABCwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("Invalid CSR - public key mismatch"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestByServiceCert() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); path = Paths.get("src/test/resources/valid_provider_refresh.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "syncer", "v=S1,d=athenz;n=syncer;s=sig", 0, new CertificateAuthority()); principal.setX509Certificate(cert); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("10.0.0.1"); ResourceContext context = createResourceContext(principal, servletRequest); Identity identity = ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); assertNotNull(identity); assertNotNull(identity.getCertificate()); }
@Test public void testPostInstanceRefreshRequestByServiceCertValidateFail() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "syncer", "v=S1,d=athenz;n=syncer;s=sig", 0, new CertificateAuthority()); principal.setX509Certificate(cert); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (ResourceException ex) { assertTrue(ex.getMessage().contains("DNS_NAME_MISMATCH"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshRequestByServiceCertValidateIPFail() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr) .setKeyId("v0"); path = Paths.get("src/test/resources/valid_provider_refresh.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "syncer", "v=S1,d=athenz;n=syncer;s=sig", 0, new CertificateAuthority()); principal.setX509Certificate(cert); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("10.0.0.1"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceManager.verifyCertRefreshIPAddress("10.0.0.1")).thenReturn(false); ztsImpl.instanceCertManager = instanceManager; ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (ResourceException ex) { assertEquals(403, ex.getCode()); } }
@Test public void testPostInstanceRefreshRequestByUserInvalidCsr() { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); String publicKeyName = "athenz.syncer_v0"; final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----"; ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey); InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr("csr") .setKeyId("v0"); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority()); principal.setKeyId("1"); ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class); Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true); ztsImpl.authorizer = authorizer; HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.isSecure()).thenReturn(true); ResourceContext context = createResourceContext(principal, servletRequest); try { ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("Unable to parse PKCS10 certificate request"), ex.getMessage()); } }