Skip to content

Commit b9b0d3c

Browse files
ebourgebourg
committed
Unit tests for HashiCorpVaultSigningService
1 parent 85c28c2 commit b9b0d3c

File tree

2 files changed

+212
-4
lines changed

2 files changed

+212
-4
lines changed

‎jsign-core/src/main/java/net/jsign/jca/HashiCorpVaultSigningService.java

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
import java.security.KeyStoreException;
2222
import java.security.UnrecoverableKeyException;
2323
import java.security.cert.Certificate;
24-
import java.util.Arrays;
24+
import java.util.ArrayList;
2525
import java.util.Base64;
2626
import java.util.HashMap;
2727
import java.util.List;
@@ -75,12 +75,14 @@ public String getName() {
7575
*/
7676
@Override
7777
public List<String> aliases() throws KeyStoreException {
78-
List<String> aliases;
78+
List<String> aliases = new ArrayList<>();
7979

8080
try {
8181
Map<String, ?> response = client.get("keys?list=true");
82-
String[] keys = ((Map<String, String[]>) response.get("data")).get("keys");
83-
aliases = Arrays.asList(keys);
82+
Object[] keys = ((Map<String, Object[]>) response.get("data")).get("keys");
83+
for (Object key : keys) {
84+
aliases.add((String) key);
85+
}
8486
} catch (IOException e) {
8587
throw new KeyStoreException(e);
8688
}

‎jsign-core/src/test/java/net/jsign/jca/HashiCorpVaultSigningServiceTest.java

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
/**
2+
* Copyright 2023 Emmanuel Bourg
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package net.jsign.jca;
18+
19+
import java.io.FileInputStream;
20+
import java.io.IOException;
21+
import java.security.GeneralSecurityException;
22+
import java.security.KeyStoreException;
23+
import java.security.UnrecoverableKeyException;
24+
import java.security.cert.Certificate;
25+
import java.security.cert.CertificateException;
26+
import java.security.cert.CertificateFactory;
27+
import java.util.Arrays;
28+
import java.util.Base64;
29+
import java.util.Collection;
30+
import java.util.List;
31+
32+
import org.junit.After;
33+
import org.junit.Before;
34+
import org.junit.Test;
35+
36+
import net.jsign.DigestAlgorithm;
37+
38+
import static net.jadler.Jadler.*;
39+
import static org.junit.Assert.*;
40+
41+
public class HashiCorpVaultSigningServiceTest {
42+
43+
@Before
44+
public void setUp() {
45+
initJadler().withDefaultResponseStatus(404);
46+
}
47+
48+
@After
49+
public void tearDown() {
50+
closeJadler();
51+
}
52+
53+
@Test
54+
public void testGetCertificateChain() throws Exception {
55+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port() + "/", "token", alias -> {
56+
try (FileInputStream in = new FileInputStream("target/test-classes/keystores/jsign-test-certificate-full-chain.pem")) {
57+
CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
58+
Collection<? extends Certificate> certificates = certificateFactory.generateCertificates(in);
59+
return certificates.toArray(new Certificate[0]);
60+
} catch (IOException | CertificateException e) {
61+
throw new RuntimeException("Failed to load the certificate", e);
62+
}
63+
});
64+
65+
Certificate[] chain = service.getCertificateChain("key1");
66+
assertNotNull("chain", chain);
67+
assertEquals("number of certificates", 3, chain.length);
68+
}
69+
70+
@Test
71+
public void testGetAliases() throws Exception {
72+
onRequest()
73+
.havingMethodEqualTo("GET")
74+
.havingPathEqualTo("/keys")
75+
.havingQueryStringEqualTo("list=true")
76+
.havingHeaderEqualTo("Authorization", "Bearer token")
77+
.respond()
78+
.withStatus(200)
79+
.withBody("{" +
80+
" \"data\": {" +
81+
" \"keys\": [\"key1\", \"key2\", \"key3\"]" +
82+
" }" +
83+
"}");
84+
85+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port(), "token", null);
86+
List<String> aliases = service.aliases();
87+
88+
assertEquals("aliases", Arrays.asList("key1", "key2", "key3"), aliases);
89+
}
90+
91+
@Test(expected = KeyStoreException.class)
92+
public void testGetAliasesError() throws Exception {
93+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port(), "token", null);
94+
service.aliases();
95+
}
96+
97+
@Test
98+
public void testMissingKeyVersion() {
99+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port(), "token", null);
100+
try {
101+
service.getPrivateKey("key1", null);
102+
fail("Exception not thrown");
103+
} catch (UnrecoverableKeyException e) {
104+
assertEquals("message", "Unable to fetch HashiCorp Vault Google Cloud private key 'key1' (missing key version)", e.getMessage());
105+
}
106+
}
107+
108+
@Test
109+
public void testGetPrivateKey() throws Exception {
110+
onRequest()
111+
.havingMethodEqualTo("GET")
112+
.havingPathEqualTo("/keys/key1")
113+
.havingHeaderEqualTo("Authorization", "Bearer token")
114+
.respond()
115+
.withStatus(200)
116+
.withBody("{" +
117+
" \"data\": {" +
118+
" \"id\": \"projects/first-rain-123/locations/global/keyRings/mykeyring/cryptoKeys/key1\", " +
119+
" \"algorithm\": \"rsa_sign_pkcs1_2048_sha256\"" +
120+
" }" +
121+
"}");
122+
123+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port(), "token", null);
124+
SigningServicePrivateKey privateKey = service.getPrivateKey("key1:7", null);
125+
assertNotNull("privateKey", privateKey);
126+
assertEquals("algorithm", "key1:7", privateKey.getId());
127+
assertEquals("algorithm", "RSA", privateKey.getAlgorithm());
128+
129+
// check if the key is cached
130+
SigningServicePrivateKey privateKey2 = service.getPrivateKey("key1:7", null);
131+
assertSame("privateKey", privateKey, privateKey2);
132+
}
133+
134+
@Test
135+
public void testGetPrivateError() {
136+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port(), "token", null);
137+
try {
138+
service.getPrivateKey("key1:7", null);
139+
fail("Exception not thrown");
140+
} catch (UnrecoverableKeyException e) {
141+
assertEquals("message", "Unable to fetch HashiCorp Vault Google Cloud private key 'key1:7'", e.getMessage());
142+
}
143+
}
144+
145+
@Test
146+
public void testSign() throws Exception {
147+
byte[] data = "0123456789ABCDEF0123456789ABCDEF".getBytes();
148+
byte[] digest = DigestAlgorithm.SHA256.getMessageDigest().digest(data);
149+
150+
onRequest()
151+
.havingMethodEqualTo("GET")
152+
.havingPathEqualTo("/keys/key1")
153+
.havingHeaderEqualTo("Authorization", "Bearer token")
154+
.respond()
155+
.withStatus(200)
156+
.withBody("{" +
157+
" \"data\": {" +
158+
" \"id\": \"projects/first-rain-123/locations/global/keyRings/mykeyring/cryptoKeys/key1\", " +
159+
" \"algorithm\": \"rsa_sign_pkcs1_2048_sha256\"" +
160+
" }" +
161+
"}");
162+
163+
onRequest()
164+
.havingMethodEqualTo("POST")
165+
.havingPathEqualTo("/sign/key1")
166+
.havingHeaderEqualTo("Authorization", "Bearer token")
167+
.havingBodyEqualTo("{\"key_version\":\"7\",\"digest\":\"" + Base64.getEncoder().encodeToString(digest) + "\"}")
168+
.respond()
169+
.withStatus(200)
170+
.withBody("{" +
171+
" \"data\": {" +
172+
" \"signature\": \"" + Base64.getEncoder().encodeToString(new byte[32]) + "\"" +
173+
" }" +
174+
"}");
175+
176+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port(), "token", null);
177+
SigningServicePrivateKey privateKey = service.getPrivateKey("key1:7", null);
178+
179+
byte[] signature = service.sign(privateKey, "SHA256withRSA", data);
180+
assertNotNull("signature", signature);
181+
assertArrayEquals("signature", new byte[32], signature);
182+
}
183+
184+
@Test(expected = GeneralSecurityException.class)
185+
public void testSignError() throws Exception {
186+
byte[] data = "0123456789ABCDEF0123456789ABCDEF".getBytes();
187+
188+
onRequest()
189+
.havingMethodEqualTo("GET")
190+
.havingPathEqualTo("/keys/key1")
191+
.havingHeaderEqualTo("Authorization", "Bearer token")
192+
.respond()
193+
.withStatus(200)
194+
.withBody("{" +
195+
" \"data\": {" +
196+
" \"id\": \"projects/first-rain-123/locations/global/keyRings/mykeyring/cryptoKeys/key1\", " +
197+
" \"algorithm\": \"rsa_sign_pkcs1_2048_sha256\"" +
198+
" }" +
199+
"}");
200+
201+
SigningService service = new HashiCorpVaultSigningService("http://localhost:" + port(), "token", null);
202+
SigningServicePrivateKey privateKey = service.getPrivateKey("key1:7", null);
203+
204+
service.sign(privateKey, "SHA256withRSA", data);
205+
}
206+
}

0 commit comments

Comments
 (0)