Abstract KMS code with KmsConnection and create a fake KmsConnection

This simplifies the tests for KmsKeyring and KmsUpdater.

This is a followup to []

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148496758
This commit is contained in:
shikhman 2017-02-24 13:28:20 -08:00 committed by Ben McIlwain
parent 9f90597691
commit 388dd1055e
12 changed files with 614 additions and 657 deletions

View file

@ -17,20 +17,13 @@ package google.registry.keyring.kms;
import static com.google.common.truth.Truth.assertThat;
import static google.registry.testing.DatastoreHelper.persistResources;
import static java.nio.charset.StandardCharsets.UTF_8;
import static org.mockito.Matchers.any;
import static org.mockito.Matchers.anyString;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import com.google.api.services.cloudkms.v1beta1.CloudKMS;
import com.google.api.services.cloudkms.v1beta1.model.DecryptRequest;
import com.google.api.services.cloudkms.v1beta1.model.DecryptResponse;
import com.google.common.collect.ImmutableList;
import google.registry.model.server.KmsSecret;
import google.registry.model.server.KmsSecretRevision;
import google.registry.model.server.KmsSecretRevision.Builder;
import google.registry.testing.AppEngineRule;
import java.io.IOException;
import org.bouncycastle.openpgp.PGPKeyPair;
import org.bouncycastle.openpgp.PGPPrivateKey;
import org.bouncycastle.openpgp.PGPPublicKey;
@ -38,307 +31,181 @@ import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.ArgumentCaptor;
import org.mockito.Captor;
import org.mockito.Mock;
import org.mockito.runners.MockitoJUnitRunner;
import org.junit.runners.JUnit4;
@RunWith(MockitoJUnitRunner.class)
@RunWith(JUnit4.class)
public class KmsKeyringTest {
@Rule public final AppEngineRule appEngine = AppEngineRule.builder().withDatastore().build();
@Mock private CloudKMS kms;
@Mock private CloudKMS.Projects kmsProjects;
@Mock private CloudKMS.Projects.Locations kmsLocations;
@Mock private CloudKMS.Projects.Locations.KeyRings kmsKeyRings;
@Mock private CloudKMS.Projects.Locations.KeyRings.CryptoKeys kmsCryptoKeys;
@Mock private CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Decrypt kmsCryptoKeysDecrypt;
@Captor private ArgumentCaptor<String> cryptoKeyName;
@Captor private ArgumentCaptor<DecryptRequest> decryptRequest;
private KmsKeyring keyring;
@Before
public void setUp() throws Exception {
keyring = new KmsKeyring("foo", "bar", kms);
when(kms.projects()).thenReturn(kmsProjects);
when(kmsProjects.locations()).thenReturn(kmsLocations);
when(kmsLocations.keyRings()).thenReturn(kmsKeyRings);
when(kmsKeyRings.cryptoKeys()).thenReturn(kmsCryptoKeys);
when(kmsCryptoKeys.decrypt(anyString(), any(DecryptRequest.class)))
.thenReturn(kmsCryptoKeysDecrypt);
public void setUp() {
keyring = new KmsKeyring(new FakeKmsConnection());
}
@Test
public void test_getRdeSigningKey() throws Exception {
persistSecret("rde-signing-private");
persistSecret("rde-signing-public");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(
new DecryptResponse()
.encodePlaintext(KmsTestHelper.getPublicKeyring().getPublicKey().getEncoded()))
.thenReturn(
new DecryptResponse().encodePlaintext(KmsTestHelper.getPrivateKeyring().getEncoded()));
saveKeyPairSecret("rde-signing-public", "rde-signing-private");
PGPKeyPair rdeSigningKey = keyring.getRdeSigningKey();
verify(kmsCryptoKeys, times(2)).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getAllValues())
.isEqualTo(
ImmutableList.of(
"projects/foo/locations/global/keyRings/bar/cryptoKeys/rde-signing-public",
"projects/foo/locations/global/keyRings/bar/cryptoKeys/rde-signing-private"));
assertThat(decryptRequest.getAllValues())
.isEqualTo(
ImmutableList.of(
new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE),
new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE)));
assertThat(rdeSigningKey.getKeyID())
.isEqualTo(KmsTestHelper.getPublicKeyring().getPublicKey().getKeyID());
}
@Test
public void test_getRdeStagingEncryptionKey() throws Exception {
persistSecret("rde-staging-public");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(
new DecryptResponse()
.encodePlaintext(KmsTestHelper.getPublicKeyring().getPublicKey().getEncoded()));
savePublicKeySecret("rde-staging-public");
PGPPublicKey rdeStagingEncryptionKey = keyring.getRdeStagingEncryptionKey();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/rde-staging-public");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(rdeStagingEncryptionKey.getFingerprint())
.isEqualTo(KmsTestHelper.getPublicKeyring().getPublicKey().getFingerprint());
}
@Test
public void test_getRdeStagingDecryptionKey() throws Exception {
persistSecret("rde-staging-private");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(
new DecryptResponse().encodePlaintext(KmsTestHelper.getPrivateKeyring().getEncoded()));
savePrivateKeySecret("rde-staging-private");
PGPPrivateKey rdeStagingDecryptionKey = keyring.getRdeStagingDecryptionKey();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/rde-staging-private");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(rdeStagingDecryptionKey.getKeyID())
.isEqualTo(KmsTestHelper.getPrivateKeyring().getSecretKey().getKeyID());
}
@Test
public void test_getRdeReceiverKey() throws Exception {
persistSecret("rde-receiver-public");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(
new DecryptResponse().encodePlaintext(KmsTestHelper.getPublicKeyring().getEncoded()));
savePublicKeySecret("rde-receiver-public");
PGPPublicKey rdeReceiverKey = keyring.getRdeReceiverKey();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/rde-receiver-public");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(rdeReceiverKey.getFingerprint())
.isEqualTo(KmsTestHelper.getPublicKeyring().getPublicKey().getFingerprint());
}
@Test
public void test_getBrdaSigningKey() throws Exception {
persistSecret("brda-signing-public");
persistSecret("brda-signing-private");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(
new DecryptResponse()
.encodePlaintext(KmsTestHelper.getPublicKeyring().getPublicKey().getEncoded()))
.thenReturn(
new DecryptResponse().encodePlaintext(KmsTestHelper.getPrivateKeyring().getEncoded()));
saveKeyPairSecret("brda-signing-public", "brda-signing-private");
PGPKeyPair brdaSigningKey = keyring.getBrdaSigningKey();
verify(kmsCryptoKeys, times(2)).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getAllValues())
.isEqualTo(
ImmutableList.of(
"projects/foo/locations/global/keyRings/bar/cryptoKeys/brda-signing-public",
"projects/foo/locations/global/keyRings/bar/cryptoKeys/brda-signing-private"));
assertThat(decryptRequest.getAllValues())
.isEqualTo(
ImmutableList.of(
new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE),
new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE)));
assertThat(brdaSigningKey.getKeyID())
.isEqualTo(KmsTestHelper.getPrivateKeyring().getPublicKey().getKeyID());
}
@Test
public void test_getBrdaReceiverKey() throws Exception {
persistSecret("brda-receiver-public");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(
new DecryptResponse()
.encodePlaintext(KmsTestHelper.getPublicKeyring().getPublicKey().getEncoded()));
savePublicKeySecret("brda-receiver-public");
PGPPublicKey brdaReceiverKey = keyring.getBrdaReceiverKey();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/brda-receiver-public");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(brdaReceiverKey.getFingerprint())
.isEqualTo(KmsTestHelper.getPublicKeyring().getPublicKey().getFingerprint());
}
@Test
public void test_getRdeSshClientPublicKey() throws Exception {
persistSecret("rde-ssh-client-public");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext(KmsTestHelper.DUMMY_KEY.getBytes(UTF_8)));
saveCleartextSecret("rde-ssh-client-public");
String rdeSshClientPublicKey = keyring.getRdeSshClientPublicKey();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/rde-ssh-client-public");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(rdeSshClientPublicKey).isEqualTo(KmsTestHelper.DUMMY_KEY);
assertThat(rdeSshClientPublicKey).isEqualTo("rde-ssh-client-publicmoo");
}
@Test
public void test_getRdeSshClientPrivateKey() throws Exception {
persistSecret("rde-ssh-client-private");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext(KmsTestHelper.DUMMY_KEY.getBytes(UTF_8)));
saveCleartextSecret("rde-ssh-client-private");
String rdeSshClientPrivateKey = keyring.getRdeSshClientPrivateKey();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/rde-ssh-client-private");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(rdeSshClientPrivateKey).isEqualTo(KmsTestHelper.DUMMY_KEY);
assertThat(rdeSshClientPrivateKey).isEqualTo("rde-ssh-client-privatemoo");
}
@Test
public void test_getIcannReportingPassword() throws Exception {
persistSecret("icann-reporting-password");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext("icann123".getBytes(UTF_8)));
saveCleartextSecret("icann-reporting-password");
String icannReportingPassword = keyring.getIcannReportingPassword();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo(
"projects/foo/locations/global/keyRings/bar/cryptoKeys/icann-reporting-password");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(icannReportingPassword).isEqualTo("icann123");
assertThat(icannReportingPassword).isEqualTo("icann-reporting-passwordmoo");
}
@Test
public void test_getMarksdbDnlLogin() throws Exception {
persistSecret("marksdb-dnl-login");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext(KmsTestHelper.DUMMY_KEY.getBytes(UTF_8)));
saveCleartextSecret("marksdb-dnl-login");
String marksdbDnlLogin = keyring.getMarksdbDnlLogin();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/marksdb-dnl-login");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(marksdbDnlLogin).isEqualTo(KmsTestHelper.DUMMY_KEY);
assertThat(marksdbDnlLogin).isEqualTo("marksdb-dnl-loginmoo");
}
@Test
public void test_getMarksdbLordnPassword() throws Exception {
persistSecret("marksdb-lordn-password");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext(KmsTestHelper.DUMMY_KEY.getBytes(UTF_8)));
saveCleartextSecret("marksdb-lordn-password");
String marksdbLordnPassword = keyring.getMarksdbLordnPassword();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/marksdb-lordn-password");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(marksdbLordnPassword).isEqualTo(KmsTestHelper.DUMMY_KEY);
assertThat(marksdbLordnPassword).isEqualTo("marksdb-lordn-passwordmoo");
}
@Test
public void test_getMarksdbSmdrlLogin() throws Exception {
persistSecret("marksdb-smdrl-login");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext(KmsTestHelper.DUMMY_KEY.getBytes(UTF_8)));
saveCleartextSecret("marksdb-smdrl-login");
String marksdbSmdrlLogin = keyring.getMarksdbSmdrlLogin();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/marksdb-smdrl-login");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(marksdbSmdrlLogin).isEqualTo(KmsTestHelper.DUMMY_KEY);
assertThat(marksdbSmdrlLogin).isEqualTo("marksdb-smdrl-loginmoo");
}
@Test
public void test_getJsonCredential() throws Exception {
persistSecret("json-credential");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext(KmsTestHelper.DUMMY_KEY.getBytes(UTF_8)));
saveCleartextSecret("json-credential");
String jsonCredential = keyring.getJsonCredential();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/json-credential");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(jsonCredential).isEqualTo(KmsTestHelper.DUMMY_KEY);
assertThat(jsonCredential).isEqualTo("json-credentialmoo");
}
@Test
public void test_getBraintreePrivateKey() throws Exception {
persistSecret("braintree-private-key");
when(kmsCryptoKeysDecrypt.execute())
.thenReturn(new DecryptResponse().encodePlaintext(KmsTestHelper.DUMMY_KEY.getBytes(UTF_8)));
saveCleartextSecret("braintree-private-key");
String braintreePrivateKey = keyring.getBraintreePrivateKey();
verify(kmsCryptoKeys).decrypt(cryptoKeyName.capture(), decryptRequest.capture());
assertThat(cryptoKeyName.getValue())
.isEqualTo("projects/foo/locations/global/keyRings/bar/cryptoKeys/braintree-private-key");
assertThat(decryptRequest.getValue())
.isEqualTo(new DecryptRequest().setCiphertext(KmsTestHelper.DUMMY_ENCRYPTED_VALUE));
assertThat(braintreePrivateKey).isEqualTo(KmsTestHelper.DUMMY_KEY);
assertThat(braintreePrivateKey).isEqualTo("braintree-private-keymoo");
}
private static void persistSecret(String secretName) {
private static void persistSecret(String secretName, byte[] secretValue) throws IOException {
KmsConnection kmsConnection = new FakeKmsConnection();
KmsSecretRevision secretRevision =
new Builder()
.setEncryptedValue(KmsTestHelper.DUMMY_ENCRYPTED_VALUE)
.setEncryptedValue(kmsConnection.encrypt(secretName, secretValue).ciphertext())
.setKmsCryptoKeyVersionName(KmsTestHelper.DUMMY_CRYPTO_KEY_VERSION)
.setParent(secretName)
.build();
KmsSecret secret = KmsSecret.create(secretName, secretRevision);
persistResources(ImmutableList.of(secretRevision, secret));
}
private static void saveCleartextSecret(String secretName) throws Exception {
persistSecret(secretName, (secretName + "moo").getBytes(UTF_8));
}
private static void savePublicKeySecret(String publicKeyName) throws Exception {
persistSecret(publicKeyName, KmsTestHelper.getPublicKeyring().getPublicKey().getEncoded());
}
private static void savePrivateKeySecret(String privateKeyName) throws Exception {
persistSecret(privateKeyName, KmsTestHelper.getPrivateKeyring().getEncoded());
}
private static void saveKeyPairSecret(String publicKeyName, String privateKeyName)
throws Exception {
savePublicKeySecret(publicKeyName);
savePrivateKeySecret(privateKeyName);
}
}