-
Notifications
You must be signed in to change notification settings - Fork 175
/
test_bootstrap_tls.py
274 lines (220 loc) · 8.62 KB
/
test_bootstrap_tls.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
#
# Licensed under the MIT License. See the LICENSE accompanying this file
# for the specific language governing permissions and limitations under
# the License.
import os
import tempfile
from unittest.mock import MagicMock
import mount_efs
AP_ID = "fsap-beefdead"
FS_ID = "fs-deadbeef"
CLIENT_SOURCE = "test"
DNS_NAME = "%s.efs.us-east-1.amazonaws.com" % FS_ID
MOUNT_POINT = "/mnt"
REGION = "us-east-1"
DEFAULT_TLS_PORT = 20049
EXPECTED_STUNNEL_CONFIG_FILE_BASE = "stunnel-config.fs-deadbeef.mnt."
EXPECTED_STUNNEL_CONFIG_FILE = EXPECTED_STUNNEL_CONFIG_FILE_BASE + str(DEFAULT_TLS_PORT)
INIT_SYSTEM = "upstart"
MOCK_CONFIG = MagicMock()
def setup_mocks(mocker):
mocker.patch("mount_efs.start_watchdog")
mocker.patch(
"mount_efs.get_tls_port_range",
return_value=(DEFAULT_TLS_PORT, DEFAULT_TLS_PORT + 10),
)
mocker.patch("socket.socket", return_value=MagicMock())
mocker.patch(
"mount_efs.get_dns_name_and_fallback_mount_target_ip_address",
return_value=(DNS_NAME, None),
)
mocker.patch("mount_efs.get_target_region", return_value=REGION)
mocker.patch("mount_efs.write_tls_tunnel_state_file", return_value="~mocktempfile")
mocker.patch("mount_efs.create_certificate")
mocker.patch("os.rename")
mocker.patch("os.kill")
process_mock = MagicMock()
process_mock.communicate.return_value = (
"stdout",
"stderr",
)
process_mock.returncode = 0
popen_mock = mocker.patch("subprocess.Popen", return_value=process_mock)
write_config_mock = mocker.patch(
"mount_efs.write_stunnel_config_file", return_value=EXPECTED_STUNNEL_CONFIG_FILE
)
return popen_mock, write_config_mock
def setup_mocks_without_popen(mocker):
mocker.patch("mount_efs.start_watchdog")
mocker.patch(
"mount_efs.get_tls_port_range",
return_value=(DEFAULT_TLS_PORT, DEFAULT_TLS_PORT + 10),
)
mocker.patch("socket.gethostname", return_value=DNS_NAME)
mocker.patch(
"mount_efs.get_dns_name_and_fallback_mount_target_ip_address",
return_value=(DNS_NAME, None),
)
mocker.patch("mount_efs.write_tls_tunnel_state_file", return_value="~mocktempfile")
mocker.patch("os.kill")
write_config_mock = mocker.patch(
"mount_efs.write_stunnel_config_file", return_value=EXPECTED_STUNNEL_CONFIG_FILE
)
return write_config_mock
def test_bootstrap_tls_state_file_dir_exists(mocker, tmpdir):
popen_mock, _ = setup_mocks(mocker)
state_file_dir = str(tmpdir)
mocker.patch("mount_efs._stunnel_bin", return_value="/usr/bin/stunnel")
with mount_efs.bootstrap_tls(
MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {}, state_file_dir
):
pass
args, _ = popen_mock.call_args
args = args[0]
assert "/usr/bin/stunnel" in args
assert EXPECTED_STUNNEL_CONFIG_FILE in args
def test_bootstrap_tls_state_file_nonexistent_dir(mocker, tmpdir):
popen_mock, _ = setup_mocks(mocker)
state_file_dir = str(tmpdir.join(tempfile.mkdtemp()[1]))
def config_get_side_effect(section, field):
if section == mount_efs.CONFIG_SECTION and field == "state_file_dir_mode":
return "0755"
elif section == mount_efs.CONFIG_SECTION and field == "dns_name_format":
return "{fs_id}.efs.{region}.amazonaws.com"
elif section == mount_efs.CLIENT_INFO_SECTION and field == "source":
return CLIENT_SOURCE
else:
raise ValueError("Unexpected arguments")
MOCK_CONFIG.get.side_effect = config_get_side_effect
assert not os.path.exists(state_file_dir)
mocker.patch("mount_efs._stunnel_bin", return_value="/usr/bin/stunnel")
with mount_efs.bootstrap_tls(
MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {}, state_file_dir
):
pass
assert os.path.exists(state_file_dir)
def test_bootstrap_tls_cert_created(mocker, tmpdir):
setup_mocks_without_popen(mocker)
mocker.patch("mount_efs.get_mount_specific_filename", return_value=DNS_NAME)
mocker.patch("mount_efs.get_target_region", return_value=REGION)
state_file_dir = str(tmpdir)
tls_dict = mount_efs.tls_paths_dictionary(DNS_NAME + "+", state_file_dir)
pk_path = os.path.join(str(tmpdir), "privateKey.pem")
mocker.patch("mount_efs.get_private_key_path", return_value=pk_path)
def config_get_side_effect(section, field):
if section == mount_efs.CONFIG_SECTION and field == "state_file_dir_mode":
return "0755"
elif section == mount_efs.CONFIG_SECTION and field == "dns_name_format":
return "{fs_id}.efs.{region}.amazonaws.com"
elif section == mount_efs.CLIENT_INFO_SECTION and field == "source":
return CLIENT_SOURCE
else:
raise ValueError("Unexpected arguments")
MOCK_CONFIG.get.side_effect = config_get_side_effect
mocker.patch("mount_efs._stunnel_bin", return_value="/usr/bin/stunnel")
try:
with mount_efs.bootstrap_tls(
MOCK_CONFIG,
INIT_SYSTEM,
DNS_NAME,
FS_ID,
MOUNT_POINT,
{"accesspoint": AP_ID},
state_file_dir,
):
pass
except OSError as e:
assert "[Errno 2] No such file or directory" in str(e)
assert os.path.exists(os.path.join(tls_dict["mount_dir"], "certificate.pem"))
assert os.path.exists(os.path.join(tls_dict["mount_dir"], "request.csr"))
assert os.path.exists(os.path.join(tls_dict["mount_dir"], "config.conf"))
assert os.path.exists(pk_path)
def test_bootstrap_tls_non_default_port(mocker, tmpdir):
popen_mock, write_config_mock = setup_mocks(mocker)
mocker.patch("os.rename")
state_file_dir = str(tmpdir)
fake_sock = MagicMock()
fake_sock.getsockname.return_value = ("localhost", 1000)
mocker.patch("socket.socket", return_value=fake_sock)
tls_port = 1000
mocker.patch("mount_efs._stunnel_bin", return_value="/usr/bin/stunnel")
with mount_efs.bootstrap_tls(
MOCK_CONFIG,
INIT_SYSTEM,
DNS_NAME,
FS_ID,
MOUNT_POINT,
{"tlsport": tls_port},
state_file_dir,
):
pass
popen_args, _ = popen_mock.call_args
popen_args = popen_args[0]
write_config_args, _ = write_config_mock.call_args
assert "/usr/bin/stunnel" in popen_args
assert EXPECTED_STUNNEL_CONFIG_FILE in popen_args
assert 1000 == write_config_args[4] # positional argument for tls_port
def test_bootstrap_tls_non_default_verify_level(mocker, tmpdir):
popen_mock, write_config_mock = setup_mocks(mocker)
state_file_dir = str(tmpdir)
verify = 0
mocker.patch("mount_efs._stunnel_bin", return_value="/usr/bin/stunnel")
with mount_efs.bootstrap_tls(
MOCK_CONFIG,
INIT_SYSTEM,
DNS_NAME,
FS_ID,
MOUNT_POINT,
{"verify": verify},
state_file_dir,
):
pass
popen_args, _ = popen_mock.call_args
popen_args = popen_args[0]
write_config_args, _ = write_config_mock.call_args
assert "/usr/bin/stunnel" in popen_args
assert EXPECTED_STUNNEL_CONFIG_FILE in popen_args
assert 0 == write_config_args[6] # positional argument for verify_level
def test_bootstrap_tls_ocsp_option(mocker, tmpdir):
popen_mock, write_config_mock = setup_mocks(mocker)
state_file_dir = str(tmpdir)
mocker.patch("mount_efs._stunnel_bin", return_value="/usr/bin/stunnel")
with mount_efs.bootstrap_tls(
MOCK_CONFIG,
INIT_SYSTEM,
DNS_NAME,
FS_ID,
MOUNT_POINT,
{"ocsp": None},
state_file_dir,
):
pass
popen_args, _ = popen_mock.call_args
popen_args = popen_args[0]
write_config_args, _ = write_config_mock.call_args
assert "/usr/bin/stunnel" in popen_args
assert EXPECTED_STUNNEL_CONFIG_FILE in popen_args
# positional argument for ocsp_override
assert write_config_args[7] is True
def test_bootstrap_tls_noocsp_option(mocker, tmpdir):
popen_mock, write_config_mock = setup_mocks(mocker)
state_file_dir = str(tmpdir)
mocker.patch("mount_efs._stunnel_bin", return_value="/usr/bin/stunnel")
with mount_efs.bootstrap_tls(
MOCK_CONFIG,
INIT_SYSTEM,
DNS_NAME,
FS_ID,
MOUNT_POINT,
{"noocsp": None},
state_file_dir,
):
pass
popen_args, _ = popen_mock.call_args
popen_args = popen_args[0]
write_config_args, _ = write_config_mock.call_args
assert "/usr/bin/stunnel" in popen_args
assert EXPECTED_STUNNEL_CONFIG_FILE in popen_args
# positional argument for ocsp_override
assert write_config_args[7] is False