mirror of https://github.com/hashicorp/boundary
* refact(e2e): Move -remote-command check into ssh test
* refact(e2e): Remove duplicate test
* fix(e2e): Modify unnecessary use of Logf
* fix(e2e): Add error checks
* fix(e2e): Remove unused parameter
(cherry picked from commit 8533433868)
# Conflicts:
# testing/internal/e2e/tests/base/target_tcp_connect_ssh_remote_command_test.go
Co-authored-by: Michael Li <michael.li@hashicorp.com>
pull/4582/head
hc-github-team-secure-boundary
2 years ago
committed by
GitHub
parent
85c361b47d
commit
871dc267cf
@ -1,84 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package base_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/api/targets"
|
||||
"github.com/hashicorp/boundary/testing/internal/e2e"
|
||||
"github.com/hashicorp/boundary/testing/internal/e2e/boundary"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// TestCliTcpTargetConnectTargetWithSshRemoteCommand uses the boundary cli to
|
||||
// connect to a target using `connect ssh -remote-commmand`
|
||||
func TestCliTcpTargetConnectTargetWithSshRemoteCommand(t *testing.T) {
|
||||
e2e.MaybeSkipTest(t)
|
||||
c, err := loadTestConfig()
|
||||
require.NoError(t, err)
|
||||
|
||||
ctx := context.Background()
|
||||
boundary.AuthenticateAdminCli(t, ctx)
|
||||
newOrgId := boundary.CreateNewOrgCli(t, ctx)
|
||||
t.Cleanup(func() {
|
||||
ctx := context.Background()
|
||||
boundary.AuthenticateAdminCli(t, ctx)
|
||||
output := e2e.RunCommand(ctx, "boundary", e2e.WithArgs("scopes", "delete", "-id", newOrgId))
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
})
|
||||
newProjectId := boundary.CreateNewProjectCli(t, ctx, newOrgId)
|
||||
newHostCatalogId := boundary.CreateNewHostCatalogCli(t, ctx, newProjectId)
|
||||
newHostSetId := boundary.CreateNewHostSetCli(t, ctx, newHostCatalogId)
|
||||
newHostId := boundary.CreateNewHostCli(t, ctx, newHostCatalogId, c.TargetAddress)
|
||||
boundary.AddHostToHostSetCli(t, ctx, newHostSetId, newHostId)
|
||||
newTargetId := boundary.CreateNewTargetCli(t, ctx, newProjectId, c.TargetPort)
|
||||
boundary.AddHostSourceToTargetCli(t, ctx, newTargetId, newHostSetId)
|
||||
newCredentialStoreId := boundary.CreateNewCredentialStoreStaticCli(t, ctx, newProjectId)
|
||||
newCredentialsId := boundary.CreateNewStaticCredentialPrivateKeyCli(t, ctx, newCredentialStoreId, c.TargetSshUser, c.TargetSshKeyPath)
|
||||
boundary.AddBrokeredCredentialSourceToTargetCli(t, ctx, newTargetId, newCredentialsId)
|
||||
|
||||
// Get credentials for target
|
||||
output := e2e.RunCommand(ctx, "boundary",
|
||||
e2e.WithArgs("targets", "authorize-session", "-id", newTargetId, "-format", "json"),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
var newSessionAuthorizationResult targets.SessionAuthorizationResult
|
||||
err = json.Unmarshal(output.Stdout, &newSessionAuthorizationResult)
|
||||
require.NoError(t, err)
|
||||
|
||||
newSessionAuthorization := newSessionAuthorizationResult.Item
|
||||
retrievedUser, ok := newSessionAuthorization.Credentials[0].Credential["username"].(string)
|
||||
require.True(t, ok)
|
||||
retrievedKey, ok := newSessionAuthorization.Credentials[0].Credential["private_key"].(string)
|
||||
require.True(t, ok)
|
||||
retrievedKey += "\n"
|
||||
assert.Equal(t, c.TargetSshUser, retrievedUser)
|
||||
|
||||
k, err := os.ReadFile(c.TargetSshKeyPath)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, string(k), retrievedKey)
|
||||
t.Log("Successfully retrieved credentials for target")
|
||||
|
||||
// Connect to target using ssh option
|
||||
output = e2e.RunCommand(ctx, "boundary",
|
||||
e2e.WithArgs(
|
||||
"connect", "ssh",
|
||||
"-target-id", newTargetId,
|
||||
"-remote-command", "hostname -i",
|
||||
"--",
|
||||
"-o", "UserKnownHostsFile=/dev/null",
|
||||
"-o", "StrictHostKeyChecking=no",
|
||||
"-o", "IdentitiesOnly=yes", // forces the use of the provided key
|
||||
),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
require.Equal(t, c.TargetAddress, strings.TrimSpace(string(output.Stdout)))
|
||||
t.Log("Successfully connected to target")
|
||||
}
|
||||
@ -1,167 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package base_with_vault_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/api/targets"
|
||||
"github.com/hashicorp/boundary/testing/internal/e2e"
|
||||
"github.com/hashicorp/boundary/testing/internal/e2e/boundary"
|
||||
"github.com/hashicorp/boundary/testing/internal/e2e/vault"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// TestCliTcpTargetVaultConnectTarget uses the boundary and vault clis to add secrets management
|
||||
// for a target. The test sets up vault as a credential store, creates a set of credentials
|
||||
// in vault to be attached to a target, and attempts to connect to that target using those
|
||||
// credentials.
|
||||
func TestCliTcpTargetVaultConnectTarget(t *testing.T) {
|
||||
e2e.MaybeSkipTest(t)
|
||||
c, err := loadTestConfig()
|
||||
require.NoError(t, err)
|
||||
|
||||
ctx := context.Background()
|
||||
boundary.AuthenticateAdminCli(t, ctx)
|
||||
newOrgId := boundary.CreateNewOrgCli(t, ctx)
|
||||
t.Cleanup(func() {
|
||||
ctx := context.Background()
|
||||
boundary.AuthenticateAdminCli(t, ctx)
|
||||
output := e2e.RunCommand(ctx, "boundary", e2e.WithArgs("scopes", "delete", "-id", newOrgId))
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
})
|
||||
newProjectId := boundary.CreateNewProjectCli(t, ctx, newOrgId)
|
||||
newHostCatalogId := boundary.CreateNewHostCatalogCli(t, ctx, newProjectId)
|
||||
newHostSetId := boundary.CreateNewHostSetCli(t, ctx, newHostCatalogId)
|
||||
newHostId := boundary.CreateNewHostCli(t, ctx, newHostCatalogId, c.TargetAddress)
|
||||
boundary.AddHostToHostSetCli(t, ctx, newHostSetId, newHostId)
|
||||
newTargetId := boundary.CreateNewTargetCli(t, ctx, newProjectId, c.TargetPort)
|
||||
boundary.AddHostSourceToTargetCli(t, ctx, newTargetId, newHostSetId)
|
||||
|
||||
// Configure vault
|
||||
boundaryPolicyName, kvPolicyFilePath := vault.Setup(t, "testdata/boundary-controller-policy.hcl")
|
||||
t.Cleanup(func() {
|
||||
output := e2e.RunCommand(ctx, "vault",
|
||||
e2e.WithArgs("policy", "delete", boundaryPolicyName),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
})
|
||||
|
||||
output := e2e.RunCommand(ctx, "vault",
|
||||
e2e.WithArgs("secrets", "enable", fmt.Sprintf("-path=%s", c.VaultSecretPath), "kv-v2"),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
t.Cleanup(func() {
|
||||
output := e2e.RunCommand(ctx, "vault",
|
||||
e2e.WithArgs("secrets", "disable", c.VaultSecretPath),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
})
|
||||
|
||||
// Create credential in vault
|
||||
privateKeySecretName := vault.CreateKvPrivateKeyCredential(t, c.VaultSecretPath, c.TargetSshUser, c.TargetSshKeyPath, kvPolicyFilePath)
|
||||
kvPolicyName := vault.WritePolicy(t, ctx, kvPolicyFilePath)
|
||||
t.Cleanup(func() {
|
||||
output := e2e.RunCommand(ctx, "vault",
|
||||
e2e.WithArgs("policy", "delete", kvPolicyName),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
})
|
||||
t.Log("Created Vault Credential")
|
||||
|
||||
// Create vault token for boundary
|
||||
output = e2e.RunCommand(ctx, "vault",
|
||||
e2e.WithArgs(
|
||||
"token", "create",
|
||||
"-no-default-policy=true",
|
||||
fmt.Sprintf("-policy=%s", boundaryPolicyName),
|
||||
fmt.Sprintf("-policy=%s", kvPolicyName),
|
||||
"-orphan=true",
|
||||
"-period=20m",
|
||||
"-renewable=true",
|
||||
"-format=json",
|
||||
),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
var tokenCreateResult vault.CreateTokenResponse
|
||||
err = json.Unmarshal(output.Stdout, &tokenCreateResult)
|
||||
require.NoError(t, err)
|
||||
credStoreToken := tokenCreateResult.Auth.Client_Token
|
||||
t.Log("Created Vault Cred Store Token")
|
||||
|
||||
// Create a credential store
|
||||
newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, c.VaultAddr, credStoreToken)
|
||||
|
||||
// Create a credential library
|
||||
newCredentialLibraryId, err := boundary.CreateVaultGenericCredentialLibraryCli(
|
||||
t,
|
||||
ctx,
|
||||
newCredentialStoreId,
|
||||
fmt.Sprintf("%s/data/%s", c.VaultSecretPath, privateKeySecretName),
|
||||
"ssh_private_key",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Add brokered credentials to target
|
||||
boundary.AddBrokeredCredentialSourceToTargetCli(t, ctx, newTargetId, newCredentialLibraryId)
|
||||
|
||||
// Get credentials for target
|
||||
output = e2e.RunCommand(ctx, "boundary",
|
||||
e2e.WithArgs("targets", "authorize-session", "-id", newTargetId, "-format", "json"),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
var newSessionAuthorizationResult targets.SessionAuthorizationResult
|
||||
err = json.Unmarshal(output.Stdout, &newSessionAuthorizationResult)
|
||||
require.NoError(t, err)
|
||||
|
||||
newSessionAuthorization := newSessionAuthorizationResult.Item
|
||||
retrievedUser, ok := newSessionAuthorization.Credentials[0].Credential["username"].(string)
|
||||
require.True(t, ok)
|
||||
retrievedKey, ok := newSessionAuthorization.Credentials[0].Credential["private_key"].(string)
|
||||
require.True(t, ok)
|
||||
assert.Equal(t, c.TargetSshUser, retrievedUser)
|
||||
|
||||
k, err := os.ReadFile(c.TargetSshKeyPath)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, string(k), retrievedKey)
|
||||
t.Log("Successfully retrieved credentials for target")
|
||||
|
||||
// Create key file
|
||||
retrievedKeyPath := fmt.Sprintf("%s/%s", t.TempDir(), "target_private_key.pem")
|
||||
f, err := os.Create(retrievedKeyPath)
|
||||
require.NoError(t, err)
|
||||
_, err = f.WriteString(retrievedKey)
|
||||
require.NoError(t, err)
|
||||
err = os.Chmod(retrievedKeyPath, 0o400)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Connect to target and print host's IP address using retrieved credentials
|
||||
output = e2e.RunCommand(ctx, "boundary",
|
||||
e2e.WithArgs(
|
||||
"connect",
|
||||
"-target-id", newTargetId,
|
||||
"-exec", "/usr/bin/ssh", "--",
|
||||
"-l", retrievedUser,
|
||||
"-i", retrievedKeyPath,
|
||||
"-o", "UserKnownHostsFile=/dev/null",
|
||||
"-o", "StrictHostKeyChecking=no",
|
||||
"-o", "IdentitiesOnly=yes", // forces the use of the provided key
|
||||
"-p", "{{boundary.port}}", // this is provided by boundary
|
||||
"{{boundary.ip}}",
|
||||
"hostname", "-i",
|
||||
),
|
||||
)
|
||||
require.NoError(t, output.Err, string(output.Stderr))
|
||||
|
||||
parts := strings.Fields(string(output.Stdout))
|
||||
hostIp := parts[len(parts)-1]
|
||||
require.Equal(t, c.TargetAddress, hostIp, "SSH session did not return expected output")
|
||||
t.Log("Successfully connected to target")
|
||||
}
|
||||
Loading…
Reference in new issue