forked from cockroachdb/cockroach
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
rpc,security, cli: Add cert-distinguished-name root/node cli flag
Previous in sequence: cockroachdb#119958 informs cockroachdb#110616, cockroachdb#118750 fixes CRDB-35884 Epic CRDB-34126 We will be adding 2 new cli flags `root-cert-distinguished-name` and `node-cert-distinguished-name` to provide option to have subject DN for root and node user during server startup. This will enforce the provided certificate by client to exactly match the value set by the above flags both for sql client and RPC authentication. This is needed because subject role option cannot be set for root and node users. Post this the plan is to add a cluster setting `server.client_cert.subject_required` which will mandate that any auth which happens should verify certSubject with rootSubject in case of root user, with nodeSubject in case of node user, with roleSubject otherwise. Release note: None
- Loading branch information
Showing
9 changed files
with
419 additions
and
43 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
144 changes: 144 additions & 0 deletions
144
pkg/cli/interactive_tests/test_distinguished_name_validation.tcl
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| #! /usr/bin/env expect -f | ||
|
|
||
| source [file join [file dirname $argv0] common.tcl] | ||
| variable certs_dir "certs" | ||
| variable custom_ca_dir "custom-ca-directory" | ||
| variable db_dir "logs/db" | ||
|
|
||
| set ::env(COCKROACH_INSECURE) "false" | ||
| set ::env(COCKROACH_HOST) "localhost" | ||
| spawn /bin/bash | ||
| send "PS1=':''/# '\r" | ||
|
|
||
| variable prompt ":/# " | ||
| eexpect $prompt | ||
|
|
||
|
|
||
| send "mkdir -p $certs_dir\r" | ||
| eexpect $prompt | ||
| send "mkdir -p $custom_ca_dir\r" | ||
| eexpect $prompt | ||
|
|
||
| send "$argv cert create-ca --certs-dir=$certs_dir --ca-key=$certs_dir/ca.key\r" | ||
| eexpect $prompt | ||
|
|
||
| # Copy openssl CA cnf for generating custom client certs. | ||
| set ca_cnf_file [file join [file dirname $argv0] "ocsp_ca.cnf"] | ||
| send "cat $ca_cnf_file > $custom_ca_dir/ca.cnf\r" | ||
| eexpect $prompt | ||
|
|
||
| report "GENERATING serial.txt index.txt files" | ||
| send "touch index.txt; echo '01' > serial.txt\r" | ||
| eexpect $prompt | ||
|
|
||
| send "$argv cert create-node localhost --certs-dir=$certs_dir --ca-key=$certs_dir/ca.key\r" | ||
| eexpect $prompt | ||
| send "$argv cert create-client root --certs-dir=$certs_dir --ca-key=$certs_dir/ca.key\r" | ||
| eexpect $prompt | ||
|
|
||
| proc start_secure_server {argv certs_dir extra} { | ||
| report "BEGIN START SECURE SERVER" | ||
| system "$argv start-single-node --host=localhost --socket-dir=. --certs-dir=$certs_dir --store=$::db_dir --pid-file=server_pid --background $extra >>expect-cmd.log 2>&1; | ||
| $argv sql --certs-dir=$certs_dir -e 'select 1'; | ||
| $argv sql --certs-dir=$certs_dir -e 'SET CLUSTER SETTING enterprise.license = \"crl-0-EJL04ukFGAEiI0NvY2tyb2FjaCBMYWJzIC0gUHJvZHVjdGlvbiBUZXN0aW5n\"'; | ||
| $argv sql --certs-dir=$certs_dir -e 'SET CLUSTER SETTING cluster.organization = \"Cockroach Labs - Production Testing\"';" | ||
| report "END START SECURE SERVER" | ||
| } | ||
|
|
||
| proc restart_secure_server_distinguished_name_flags {argv certs_dir root_dn node_dn extra} { | ||
| stop_server $argv | ||
| report "BEGIN START SECURE SERVER WITH DN FLAGS" | ||
| system "rm -f server_pid; | ||
| $argv start-single-node --host=localhost --root-cert-distinguished-name='$root_dn' --node-cert-distinguished-name='$node_dn' --socket-dir=. --certs-dir=$certs_dir --store=$::db_dir --pid-file=server_pid --background $extra >>expect-cmd.log 2>&1;" | ||
| report "END START SECURE SERVER WITH DN FLAGS" | ||
| } | ||
|
|
||
| proc expect_exit_status {expected} { | ||
| set status [lindex [wait] 3] | ||
| if {$status != $expected} { | ||
| report "unexpected exit status $status" | ||
| exit 1 | ||
| } | ||
| } | ||
|
|
||
| proc create_user_cert {argv certs_dir name} { | ||
| report "GENERATING CERT FOR USER $name" | ||
| send "openssl genrsa -out $::certs_dir/client.$name.key\r" | ||
| eexpect $::prompt | ||
| send "openssl req -new -key $::certs_dir/client.$name.key -out client.$name.csr -batch -subj /O=Cockroach/CN=$name\r" | ||
| eexpect $::prompt | ||
| send "openssl ca -config $::custom_ca_dir/ca.cnf -keyfile $::certs_dir/ca.key -cert $::certs_dir/ca.crt -policy signing_policy -extensions signing_client_req -out $certs_dir/client.$name.crt -outdir . -in client.$name.csr -batch\r" | ||
| eexpect $::prompt | ||
| # Uncomment the next line to see more details about the generated cert | ||
| #system "openssl x509 -in $::certs_dir/client.$name.crt -text" | ||
| send "$argv sql --certs-dir=$::certs_dir -e 'create user $name'\r" | ||
| eexpect $::prompt | ||
| send "$argv sql --certs-dir=$::certs_dir --user=$name -e 'select 1'\r" | ||
| eexpect $::prompt | ||
| } | ||
|
|
||
| proc generate_root_or_node_cert {argv certs_dir name} { | ||
| report "GENERATING CERT FOR USER $name" | ||
| system "openssl genrsa -out $::certs_dir/client.$name.key" | ||
| system "openssl req -new -key $::certs_dir/client.$name.key -out client.$name.csr -batch -subj /O=Cockroach/CN=$name" | ||
| system "openssl ca -config $::custom_ca_dir/ca.cnf -keyfile $::certs_dir/ca.key -cert $::certs_dir/ca.crt -policy signing_policy -extensions signing_client_req -out $certs_dir/client.$name.crt -outdir . -in client.$name.csr -batch" | ||
| # Uncomment the next line to see more details about the generated cert | ||
| #system "openssl x509 -in $::certs_dir/client.$name.crt -text" | ||
| system "$argv sql --certs-dir=$::certs_dir --user=$name -e 'select 1'" | ||
| } | ||
|
|
||
| proc set_role_subject_for_user {argv name role_subject} { | ||
| report "SETTING SUBJECT ROLE OPTION for USER $name with SUBJECT $role_subject" | ||
| system "$argv sql --certs-dir=$::certs_dir -e 'alter role $name with subject \"$role_subject\" login'" | ||
| } | ||
|
|
||
| start_secure_server $argv $certs_dir "" | ||
|
|
||
| # Create users and make sure they can each log in. | ||
| create_user_cert $argv $certs_dir goofus | ||
| create_user_cert $argv $certs_dir gallant | ||
|
|
||
| # Check cert still works without setting role subject option | ||
| system "$argv sql --certs-dir=$certs_dir --user=goofus -e 'select 1'" | ||
|
|
||
| report "Validating subject role option can be set and enforced" | ||
|
|
||
| start_test "invalid role option for cert user goofus" | ||
| # Set invalid role subject option for user and check login fails | ||
| set_role_subject_for_user $argv goofus "O=foo" | ||
| spawn $argv "sql" "--certs-dir=$certs_dir" "--user=goofus" "-e" "select 1" | ||
| eexpect "certificate authentication failed for user \"goofus\"" | ||
| expect_exit_status 1 | ||
| end_test | ||
|
|
||
| start_test "valid role option for cert user goofus" | ||
| # Set valid role subject option for user and check login fails | ||
| set_role_subject_for_user $argv goofus "O=Cockroach,CN=goofus" | ||
| spawn $argv "sql" "--certs-dir=$certs_dir" "--user=goofus" "-e" "select 1" | ||
| end_test | ||
|
|
||
| report "Validating node-cert-distinguished-nane and root-cert-distinguished-name can be set and enforced" | ||
| # create a new root certificate using custom ca | ||
| send "rm -f $certs_dir/client.root.*\r" | ||
| eexpect $::prompt | ||
| generate_root_or_node_cert $argv $certs_dir root | ||
|
|
||
| start_test "invalid root-cert-distinguished-name" | ||
| # Set invalid root-cert-distinguished-nane for cockroach server and check root login fails | ||
| set root_dn "O=foo,CN=invalid" | ||
| # need to provide correct node dn to start cockroach server as it depends on this to be equal to node.crt dn subject | ||
| set node_dn "O=Cockroach,CN=node" | ||
| restart_secure_server_distinguished_name_flags $argv $certs_dir "O=foo,CN=invalid" "O=bar,CN=invalid" "" | ||
| spawn $argv "sql" "--certs-dir=$certs_dir" "--user=root" "-e" "select 1" | ||
| eexpect "certificate authentication failed for user \"root\" (DN: o=foo,cn=invalid)" | ||
| expect_exit_status 1 | ||
| end_test | ||
|
|
||
| start_test "valid node-cert-distinguished-nane and root-cert-distinguished-name" | ||
| # Set valid role subject option for user and check login fails | ||
| stop_server $argv | ||
| restart_secure_server_distinguished_name_flags $argv $certs_dir "O=Cockroach,CN=root" "O=Cockroach,CN=node" "" | ||
| spawn $argv "sql" "--certs-dir=$certs_dir" "--user=root" "-e" "select 1" | ||
| end_test | ||
|
|
||
| stop_server $argv |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.