mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-26 02:04:50 -06:00
Ashutosh Narkar
338583c18a
These changes add support for digital signatures for policy bundles which can be used to verify their authenticity. Bundle signature verification involves the following steps: * Verify the JWT signature * Verify the files in the JWT payload exist in the bundle * Verify the file content of the files in bundle match with those in the payload This commit adds a new `sign` command to generate a digital signature for policy bundles. For more details, run "opa sign --help" The signatures generated by the 'sign' command can be verified by the 'build' command. The 'build' command can also sign the bundle it generates. The 'run' command can verify a signed bundle or skip verification altogether. OPA 'sign', 'build' and 'run' can be used to sign/verify bundles in bundle mode (--bundle) mode only. Verification can be also be performed when bundle downloading is enabled. Fixes: #1757 Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
132 lines
2.7 KiB
Go
132 lines
2.7 KiB
Go
// Copyright 2020 The OPA Authors. All rights reserved.
|
|
// Use of this source code is governed by an Apache2
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/open-policy-agent/opa/test/e2e"
|
|
)
|
|
|
|
func TestRunServerBase(t *testing.T) {
|
|
params := newTestRunParams()
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
|
|
rt, err := initRuntime(ctx, params, nil)
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error: %v", err)
|
|
}
|
|
|
|
testRuntime := e2e.WrapRuntime(ctx, cancel, rt)
|
|
|
|
done := make(chan bool)
|
|
go func() {
|
|
err := rt.Serve(ctx)
|
|
if err != nil {
|
|
t.Errorf("Unexpected error: %s", err)
|
|
}
|
|
done <- true
|
|
}()
|
|
|
|
err = testRuntime.WaitForServer()
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error: %s", err)
|
|
}
|
|
|
|
validateBasicServe(t, testRuntime)
|
|
|
|
cancel()
|
|
<-done
|
|
}
|
|
|
|
func TestRunServerWithDiagnosticAddr(t *testing.T) {
|
|
params := newTestRunParams()
|
|
params.rt.DiagnosticAddrs = &[]string{":0"}
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
|
|
rt, err := initRuntime(ctx, params, nil)
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error: %v", err)
|
|
}
|
|
|
|
testRuntime := e2e.WrapRuntime(ctx, cancel, rt)
|
|
|
|
done := make(chan bool)
|
|
go func() {
|
|
err := rt.Serve(ctx)
|
|
if err != nil {
|
|
t.Errorf("Unexpected error: %s", err)
|
|
}
|
|
done <- true
|
|
}()
|
|
|
|
err = testRuntime.WaitForServer()
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error: %s", err)
|
|
}
|
|
|
|
validateBasicServe(t, testRuntime)
|
|
|
|
diagURL, err := testRuntime.AddrToURL(rt.DiagnosticAddrs()[0])
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error: %s", err)
|
|
}
|
|
if err := testRuntime.HealthCheck(diagURL); err != nil {
|
|
t.Error(err)
|
|
}
|
|
|
|
cancel()
|
|
<-done
|
|
}
|
|
|
|
func TestInitRuntimeVerifyNonBundle(t *testing.T) {
|
|
|
|
params := newTestRunParams()
|
|
params.pubKey = "secret"
|
|
params.serverMode = false
|
|
|
|
_, err := initRuntime(context.Background(), params, nil)
|
|
if err == nil {
|
|
t.Fatal("Expected error but got nil")
|
|
}
|
|
|
|
exp := "enable bundle mode (ie. --bundle) to verify bundle files or directories"
|
|
if err.Error() != exp {
|
|
t.Fatalf("expected error message %v but got %v", exp, err.Error())
|
|
}
|
|
}
|
|
|
|
func newTestRunParams() runCmdParams {
|
|
params := newRunParams()
|
|
params.rt.GracefulShutdownPeriod = 1
|
|
params.rt.Addrs = &[]string{":0"}
|
|
params.rt.DiagnosticAddrs = &[]string{}
|
|
params.serverMode = true
|
|
return params
|
|
}
|
|
|
|
func validateBasicServe(t *testing.T, runtime *e2e.TestRuntime) {
|
|
t.Helper()
|
|
|
|
err := runtime.UploadData(bytes.NewBufferString(`{"x": 1}`))
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error: %s", err)
|
|
}
|
|
|
|
resp := struct {
|
|
Result int `json:"result"`
|
|
}{}
|
|
err = runtime.GetDataWithInputTyped("x", nil, &resp)
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error: %s", err)
|
|
}
|
|
|
|
if resp.Result != 1 {
|
|
t.Fatalf("Expected x to be 1, got %v", resp)
|
|
}
|
|
}
|