ZTSImpl implements KeyStore, ZTSHandler { @Override public InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider, String domain, String service, String instanceId, InstanceRefreshInformation info) { final String caller = ctx.getApiName(); final String principalDomain = logPrincipalAndGetDomain(ctx); if (readOnlyMode) { throw requestError("Server in Maintenance Read-Only mode. Please try your request later", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN, principalDomain); } validateRequest(ctx.request(), principalDomain, caller); validate(provider, TYPE_SERVICE_NAME, principalDomain, caller); validate(domain, TYPE_DOMAIN_NAME, principalDomain, caller); validate(service, TYPE_SIMPLE_NAME, principalDomain, caller); validate(instanceId, TYPE_PATH_ELEMENT, principalDomain, caller); validate(info, TYPE_INSTANCE_REFRESH_INFO, principalDomain, caller); provider = provider.toLowerCase(); domain = domain.toLowerCase(); setRequestDomain(ctx, domain); service = service.toLowerCase(); final String ipAddress = ServletRequestUtil.getRemoteAddress(ctx.request()); if (!instanceCertManager.verifyInstanceCertIPAddress(provider, ipAddress)) { throw forbiddenError("Unknown IP: " + ipAddress + " for Provider: " + provider, caller, domain, principalDomain); } final String x509Csr = convertEmptyStringToNull(info.getCsr()); final String sshCsr = convertEmptyStringToNull(info.getSsh()); if (x509Csr == null && sshCsr == null) { throw requestError("no csr provided", caller, domain, principalDomain); } Principal principal = ((RsrcCtxWrapper) ctx).principal(); final String principalName = domain + "." + service; if (!principalName.equals(principal.getFullName())) { throw requestError("Principal mismatch: " + principalName + " vs. " + principal.getFullName(), caller, domain, principalDomain); } Authority authority = principal.getAuthority(); if (!(authority instanceof CertificateAuthority)) { throw requestError("Unsupported authority for TLS Certs: " + authority.toString(), caller, domain, principalDomain); } Principal providerService = createPrincipalForName(provider); StringBuilder errorMsg = new StringBuilder(256); if (!instanceCertManager.authorizeLaunch(providerService, domain, service, errorMsg)) { throw forbiddenError(errorMsg.toString(), caller, domain, principalDomain); } X509Certificate cert = principal.getX509Certificate(); InstanceIdentity identity; if (x509Csr != null) { identity = processProviderX509RefreshRequest(ctx, principal, domain, service, provider, instanceId, info, cert, caller); } else { identity = processProviderSSHRefreshRequest(ctx, principal, domain, service, provider, instanceId, sshCsr, caller); } return identity; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testPostInstanceRefreshInformationSshHostCert() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); path = Paths.get("src/test/resources/sshhost_valid_sample.csr"); String sshCsr = new String(Files.readAllBytes(path)); Map<String, String> attrs = new HashMap<>(); attrs.put("certSSH", "true"); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider") .setAttributes(attrs); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); Mockito.when(instanceManager.generateSSHIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem) .setSshCertificate("test ssh host certificate"); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setToken(true) .setHostname("host1.athenz.cloud") .setSsh(sshCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); List<String> cnames = new ArrayList<>(); cnames.add("cname.athenz.info"); cnames.add("vip.athenz.info"); HostnameResolver resolver = Mockito.mock(HostnameResolver.class); Mockito.when(resolver.isValidHostCnameList(principal.getFullName(), "host1.athenz.cloud", cnames, CertType.SSH_HOST)).thenReturn(true); Mockito.when(resolver.isValidHostname("host1.athenz.cloud")).thenReturn(true); ztsImpl.hostnameResolver = resolver; InstanceIdentity instanceIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(instanceIdentity); assertNotNull(instanceIdentity.getServiceToken()); assertNotNull(instanceIdentity.getSshCertificate()); }
@Test public void testPostInstanceRefreshInformationNoCertRefeshCheck() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); Map<String, String> attrs = new HashMap<>(); attrs.put("certRefresh", "false"); attrs.put("certSSH", "true"); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider") .setAttributes(attrs); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")) .thenThrow(new ResourceException(400, "unknown record")); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setToken(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); InstanceIdentity instanceIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(instanceIdentity); assertNotNull(instanceIdentity.getServiceToken()); }
@Test public void testPostInstanceRefreshInformationSubjectOU() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setToken(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); ztsImpl.verifyCertSubjectOU = true; try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } Set<String> ouValues = new HashSet<>(); ouValues.add("Athenz"); ouValues.add("Testing Domain"); ztsImpl.validCertSubjectOrgUnitValues = ouValues; InstanceIdentity instanceIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(instanceIdentity); assertNotNull(instanceIdentity.getServiceToken()); }
@Test public void testPostInstanceRefreshInformationRefreshRequired() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); certRecord.setClientCert(true); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setToken(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); InstanceIdentity instanceIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(instanceIdentity); assertNotNull(instanceIdentity.getServiceToken()); }
@Test public void testPostInstanceRefreshInformationInvalidIP() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceCertManager instanceManager = Mockito.mock(InstanceCertManager.class); Mockito.when(instanceManager.verifyCertRefreshIPAddress(Mockito.any())).thenReturn(false); ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setToken(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403, ex.getMessage()); assertTrue(ex.getMessage().contains("Unknown IP"), ex.getMessage()); } }
@Test public void testPostInstanceRefreshInformationForbidden() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())) .thenThrow(new com.yahoo.athenz.instance.provider.ResourceException(403, "Forbidden")) .thenThrow(new com.yahoo.athenz.instance.provider.ResourceException(504, "Connect Timeout")) .thenThrow(new ResourceException(403, "Forbidden")); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setToken(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403, ex.getMessage()); assertTrue(ex.getMessage().contains("unable to verify attestation data"), ex.getMessage()); } try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 504, ex.getMessage()); assertTrue(ex.getMessage().contains("Connect Timeout")); } try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403, ex.getMessage()); } }
@Test public void testPostInstanceRefreshInformationNotFound() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenThrow(new com.yahoo.athenz.instance.provider.ResourceException(404, "Not Found")); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setToken(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), ResourceException.FORBIDDEN); } }
@Test public void testPostInstanceRefreshInformationSSHFailure() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); Mockito.when(instanceManager.generateSSHIdentity(Mockito.any(), Mockito.any(), Mockito.any(), eq("ssh-csr"), Mockito.any(), eq("user"))).thenReturn(false); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr).setSsh("ssh-csr").setToken(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); identity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNull(identity.getSshCertificate()); }
@Test public void testPostInstanceRefreshInformationPrevSerialMatch() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("101"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); InstanceIdentity instanceIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(instanceIdentity); }
@Test public void testPostInstanceRefreshInformationInvalidCSR() { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation().setCsr("csr"); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("unable to parse PKCS10 CSR")); } }
@Test public void testPostInstanceRefreshInformationProviderNotAuthorized() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider2", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); assertTrue(ex.getMessage().contains("not authorized to launch instances in Athenz")); } }
@Test public void testPostInstanceRefreshInformationCSRValidateFailure() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.mismatch.cn.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("CSR validation failed")); } }
@Test public void testPostInstanceRefreshInformationInstanceIdMismatch() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); path = Paths.get("src/test/resources/valid_cn_x509.cert"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400, ex.getMessage()); assertTrue(ex.getMessage().contains("instance id mismatch")); } }
@Test public void testPostInstanceRefreshInformationGetCertDBFailure() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(null); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); assertTrue(ex.getMessage().contains("Unable to find certificate record")); } }
@Test public void testPostInstanceRefreshInformationCertRecordCNMismatch() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz2.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("service name mismatch")); } }
@Test public void testPostInstanceRefreshInformationSerialMismatch() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("101"); certRecord.setPrevSerial("101"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); assertTrue(ex.getMessage().contains("Certificate revoked")); } }
@Test public void testPostInstanceRefreshInformationSerialMismatchRevokeMigration() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("101"); certRecord.setPrevSerial("101"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; ztsImpl.x509CertRefreshResetTime = System.currentTimeMillis(); InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); InstanceIdentity refreshIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(refreshIdentity); }
@Test public void testPostInstanceRefreshInformationIdentityFailure() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); Mockito.doReturn(null).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 500); assertTrue(ex.getMessage().contains("unable to generate identity")); } }
@Test public void testPostInstanceRefreshInformationCertRecordFailure() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(providerClient); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(false); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 500); assertTrue(ex.getMessage().contains("unable to update cert db")); } }
@Test public void testPostInstanceRefreshInformationNoCertAuthority() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); PrincipalAuthority authority = new PrincipalAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenzn=production;s=signature", 0, authority); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("Unsupported authority for TLS Certs")); } }
@Test public void testPostInstanceRefreshInformationInvalidPrincipal() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); PrincipalAuthority authority = new PrincipalAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, authority); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz2", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("Principal mismatch")); } }
@Test public void testPostInstanceRefreshInformationNullCSRs() { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(null).setSsh(""); PrincipalAuthority authority = new PrincipalAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenzn=production;s=signature", 0, authority); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertTrue(ex.getMessage().contains("no csr provided")); } }
@Test public void testPostInstanceRefreshInformationNoProviderClient() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String certCsr = new String(Files.readAllBytes(path)); InstanceProviderManager instanceProviderManager = Mockito.mock(InstanceProviderManager.class); InstanceProvider providerClient = Mockito.mock(InstanceProvider.class); InstanceConfirmation confirmation = new InstanceConfirmation() .setDomain("athenz").setService("production").setProvider("athenz.provider"); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceProviderManager.getProvider(eq("athenz.provider"), Mockito.any())).thenReturn(null); Mockito.when(providerClient.refreshInstance(Mockito.any())).thenReturn(confirmation); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(false); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production") .setX509Certificate(pem); Mockito.doReturn(identity).when(instanceManager).generateIdentity(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt()); ztsImpl.instanceProviderManager = instanceProviderManager; ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation() .setCsr(certCsr); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400, ex.getMessage()); assertTrue(ex.getMessage().contains("unable to get instance for provider")); } }
@Test public void testPostInstanceRefreshInformationSSH() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production"); Mockito.when(instanceManager.generateSSHIdentity(principal, identity, null, "ssh-csr", null, "user")).thenReturn(true); ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation().setSsh("ssh-csr"); Path path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); InstanceIdentity instanceIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(instanceIdentity); }
@Test public void testPostInstanceRefreshInformationSSHMatchPrevSerial() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("123413"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production"); Mockito.when(instanceManager.generateSSHIdentity(principal, identity, null, "ssh-csr", null, "user")).thenReturn(true); ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation().setSsh("ssh-csr"); Path path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); InstanceIdentity instanceIdentity = ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); assertNotNull(instanceIdentity); }
@Test public void testPostInstanceRefreshInformationSSHIdentityFailure() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); X509CertRecord certRecord = new X509CertRecord(); certRecord.setInstanceId("1001"); certRecord.setProvider("athenz.provider"); certRecord.setService("athenz.production"); certRecord.setCurrentSerial("16503746516960996918"); certRecord.setPrevSerial("16503746516960996918"); Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord); Mockito.when(instanceManager.updateX509CertRecord(Mockito.any())).thenReturn(true); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); InstanceIdentity identity = new InstanceIdentity().setName("athenz.production"); Mockito.when(instanceManager.generateSSHIdentity(principal, identity, null, "ssh-csr", null, "user")).thenReturn(false); ztsImpl.instanceCertManager = instanceManager; InstanceRefreshInformation info = new InstanceRefreshInformation().setSsh("ssh-csr"); Path path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 500); } }