func (certSuite) TestNewServer(c *gc.C) {
now := time.Now()
expiry := roundTime(now.AddDate(1, 0, 0))
caCertPEM, caKeyPEM, err := cert.NewCA("foo", expiry)
c.Assert(err, gc.IsNil)
caCert, _, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
c.Assert(err, gc.IsNil)
var noHostnames []string
srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, noHostnames)
c.Assert(err, gc.IsNil)
srvCert, srvKey, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
c.Assert(err, gc.IsNil)
c.Assert(srvCert.Subject.CommonName, gc.Equals, "*")
// Check that the certificate is valid from one week before today.
c.Check(srvCert.NotBefore.Before(now), jc.IsTrue)
c.Check(srvCert.NotBefore.Before(now.AddDate(0, 0, -6)), jc.IsTrue)
c.Check(srvCert.NotBefore.After(now.AddDate(0, 0, -8)), jc.IsTrue)
c.Assert(srvCert.NotAfter.Equal(expiry), gc.Equals, true)
c.Assert(srvCert.BasicConstraintsValid, gc.Equals, false)
c.Assert(srvCert.IsCA, gc.Equals, false)
c.Assert(srvCert.ExtKeyUsage, gc.DeepEquals, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
checkTLSConnection(c, caCert, srvCert, srvKey)
}
func (s *RsyslogSuite) TestModeAccumulate(c *gc.C) {
st, m := s.st, s.machine
worker, err := rsyslog.NewRsyslogConfigWorker(st.Rsyslog(), rsyslog.RsyslogModeAccumulate, m.Tag().String(), "", nil)
c.Assert(err, gc.IsNil)
defer func() { c.Assert(worker.Wait(), gc.IsNil) }()
defer worker.Kill()
waitForFile(c, filepath.Join(*rsyslog.LogDir, "ca-cert.pem"))
// We should have ca-cert.pem, rsyslog-cert.pem, and rsyslog-key.pem.
caCertPEM, err := ioutil.ReadFile(filepath.Join(*rsyslog.LogDir, "ca-cert.pem"))
c.Assert(err, gc.IsNil)
rsyslogCertPEM, err := ioutil.ReadFile(filepath.Join(*rsyslog.LogDir, "rsyslog-cert.pem"))
c.Assert(err, gc.IsNil)
rsyslogKeyPEM, err := ioutil.ReadFile(filepath.Join(*rsyslog.LogDir, "rsyslog-key.pem"))
c.Assert(err, gc.IsNil)
_, _, err = cert.ParseCertAndKey(string(rsyslogCertPEM), string(rsyslogKeyPEM))
c.Assert(err, gc.IsNil)
err = cert.Verify(string(rsyslogCertPEM), string(caCertPEM), time.Now().UTC())
c.Assert(err, gc.IsNil)
// Verify rsyslog configuration.
waitForFile(c, filepath.Join(*rsyslog.RsyslogConfDir, "25-juju.conf"))
rsyslogConf, err := ioutil.ReadFile(filepath.Join(*rsyslog.RsyslogConfDir, "25-juju.conf"))
c.Assert(err, gc.IsNil)
syslogPort := s.Conn.Environ.Config().SyslogPort()
syslogConfig := syslog.NewAccumulateConfig(m.Tag().String(), *rsyslog.LogDir, syslogPort, "", []string{})
syslogConfig.ConfigDir = *rsyslog.RsyslogConfDir
rendered, err := syslogConfig.Render()
c.Assert(err, gc.IsNil)
c.Assert(string(rsyslogConf), gc.DeepEquals, string(rendered))
}
func (certSuite) TestNewServerHostnames(c *gc.C) {
type test struct {
hostnames []string
expectedDNSNames []string
expectedIPAddresses []net.IP
}
tests := []test{{
[]string{},
nil,
nil,
}, {
[]string{"example.com"},
[]string{"example.com"},
nil,
}, {
[]string{"example.com", "127.0.0.1"},
[]string{"example.com"},
[]net.IP{net.IPv4(127, 0, 0, 1).To4()},
}, {
[]string{"::1"},
nil,
[]net.IP{net.IPv6loopback},
}}
for i, t := range tests {
c.Logf("test %d: %v", i, t.hostnames)
expiry := roundTime(time.Now().AddDate(1, 0, 0))
srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, t.hostnames)
c.Assert(err, jc.ErrorIsNil)
srvCert, _, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
c.Assert(err, jc.ErrorIsNil)
c.Assert(srvCert.DNSNames, gc.DeepEquals, t.expectedDNSNames)
c.Assert(srvCert.IPAddresses, gc.DeepEquals, t.expectedIPAddresses)
}
}
func mustParseCertAndKey(certPEM, keyPEM string) (*x509.Certificate, *rsa.PrivateKey) {
cert, key, err := cert.ParseCertAndKey(certPEM, keyPEM)
if err != nil {
panic(err)
}
return cert, key
}
func (certSuite) TestParseCertAndKey(c *gc.C) {
xcert, key, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
c.Assert(err, jc.ErrorIsNil)
c.Assert(xcert.Subject.CommonName, gc.Equals, "juju testing")
c.Assert(key, gc.NotNil)
c.Assert(xcert.PublicKey.(*rsa.PublicKey), gc.DeepEquals, &key.PublicKey)
}
func (*OpenSuite) TestPrepare(c *gc.C) {
baselineAttrs := dummy.SampleConfig().Merge(testing.Attrs{
"state-server": false,
"name": "erewhemos",
}).Delete(
"ca-cert",
"ca-private-key",
"admin-secret",
"uuid",
)
cfg, err := config.New(config.NoDefaults, baselineAttrs)
c.Assert(err, gc.IsNil)
store := configstore.NewMem()
ctx := testing.Context(c)
env, err := environs.Prepare(cfg, ctx, store)
c.Assert(err, gc.IsNil)
// Check we can access storage ok, which implies the environment has been prepared.
c.Assert(env.Storage(), gc.NotNil)
// Check that the environment info file was correctly created.
info, err := store.ReadInfo("erewhemos")
c.Assert(err, gc.IsNil)
c.Assert(info.Initialized(), jc.IsTrue)
c.Assert(info.BootstrapConfig(), gc.DeepEquals, env.Config().AllAttrs())
c.Logf("bootstrap config: %#v", info.BootstrapConfig())
// Check that an admin-secret was chosen.
adminSecret := env.Config().AdminSecret()
c.Assert(adminSecret, gc.HasLen, 32)
c.Assert(adminSecret, gc.Matches, "^[0-9a-f]*$")
// Check that the CA cert was generated.
cfgCertPEM, cfgCertOK := env.Config().CACert()
cfgKeyPEM, cfgKeyOK := env.Config().CAPrivateKey()
c.Assert(cfgCertOK, gc.Equals, true)
c.Assert(cfgKeyOK, gc.Equals, true)
// Check the common name of the generated cert
caCert, _, err := cert.ParseCertAndKey(cfgCertPEM, cfgKeyPEM)
c.Assert(err, gc.IsNil)
c.Assert(caCert.Subject.CommonName, gc.Equals, `juju-generated CA for environment "`+testing.SampleEnvName+`"`)
// Check that a uuid was chosen.
uuid, exists := env.Config().UUID()
c.Assert(exists, gc.Equals, true)
c.Assert(uuid, gc.Matches, `[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`)
// Check we can call Prepare again.
env, err = environs.Prepare(cfg, ctx, store)
c.Assert(err, gc.IsNil)
c.Assert(env.Storage(), gc.NotNil)
c.Assert(env.Config().AllAttrs(), gc.DeepEquals, info.BootstrapConfig())
}
func checkCertificate(c *gc.C, caCert *x509.Certificate, srvCertPEM, srvKeyPEM string, now, expiry time.Time) {
srvCert, srvKey, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
c.Assert(err, jc.ErrorIsNil)
c.Assert(srvCert.Subject.CommonName, gc.Equals, "*")
checkNotBefore(c, srvCert, now)
checkNotAfter(c, srvCert, expiry)
c.Assert(srvCert.BasicConstraintsValid, jc.IsFalse)
c.Assert(srvCert.IsCA, jc.IsFalse)
c.Assert(srvCert.ExtKeyUsage, gc.DeepEquals, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
checkTLSConnection(c, caCert, srvCert, srvKey)
}
func (certSuite) TestNewServer(c *gc.C) {
now := time.Now()
expiry := roundTime(now.AddDate(1, 0, 0))
caCertPEM, caKeyPEM, err := cert.NewCA("foo", expiry)
c.Assert(err, jc.ErrorIsNil)
caCert, _, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
c.Assert(err, jc.ErrorIsNil)
srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, nil)
c.Assert(err, jc.ErrorIsNil)
checkCertificate(c, caCert, srvCertPEM, srvKeyPEM, now, expiry)
}
func (certSuite) TestNewServer(c *gc.C) {
expiry := roundTime(time.Now().AddDate(1, 0, 0))
caCertPEM, caKeyPEM, err := cert.NewCA("foo", expiry)
c.Assert(err, gc.IsNil)
caCert, _, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
c.Assert(err, gc.IsNil)
var noHostnames []string
srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, noHostnames)
c.Assert(err, gc.IsNil)
srvCert, srvKey, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
c.Assert(err, gc.IsNil)
c.Assert(srvCert.Subject.CommonName, gc.Equals, "*")
c.Assert(srvCert.NotAfter.Equal(expiry), gc.Equals, true)
c.Assert(srvCert.BasicConstraintsValid, gc.Equals, false)
c.Assert(srvCert.IsCA, gc.Equals, false)
c.Assert(srvCert.ExtKeyUsage, gc.DeepEquals, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
checkTLSConnection(c, caCert, srvCert, srvKey)
}
func (s *RsyslogSuite) TestModeAccumulate(c *gc.C) {
st, m := s.st, s.machine
worker, err := rsyslog.NewRsyslogConfigWorker(st.Rsyslog(), rsyslog.RsyslogModeAccumulate, m.Tag(), "", nil, s.ConfDir())
c.Assert(err, jc.ErrorIsNil)
defer func() { c.Assert(worker.Wait(), gc.IsNil) }()
defer worker.Kill()
dirname := filepath.Join(s.ConfDir(), "rsyslog")
waitForFile(c, filepath.Join(dirname, "ca-cert.pem"))
// We should have ca-cert.pem, rsyslog-cert.pem, and rsyslog-key.pem.
caCertPEM, err := ioutil.ReadFile(filepath.Join(dirname, "ca-cert.pem"))
c.Assert(err, jc.ErrorIsNil)
rsyslogCertPEM, err := ioutil.ReadFile(filepath.Join(dirname, "rsyslog-cert.pem"))
c.Assert(err, jc.ErrorIsNil)
rsyslogKeyPEM, err := ioutil.ReadFile(filepath.Join(dirname, "rsyslog-key.pem"))
c.Assert(err, jc.ErrorIsNil)
_, _, err = cert.ParseCertAndKey(string(rsyslogCertPEM), string(rsyslogKeyPEM))
c.Assert(err, jc.ErrorIsNil)
err = cert.Verify(string(rsyslogCertPEM), string(caCertPEM), time.Now().UTC())
c.Assert(err, jc.ErrorIsNil)
// Verify rsyslog configuration.
waitForFile(c, filepath.Join(*rsyslog.RsyslogConfDir, "25-juju.conf"))
rsyslogConf, err := ioutil.ReadFile(filepath.Join(*rsyslog.RsyslogConfDir, "25-juju.conf"))
c.Assert(err, jc.ErrorIsNil)
syslogPort := s.Environ.Config().SyslogPort()
syslogConfig := &syslog.SyslogConfig{
LogFileName: m.Tag().String(),
LogDir: *rsyslog.LogDir,
Port: syslogPort,
Namespace: "",
StateServerAddresses: []string{},
}
syslog.NewAccumulateConfig(syslogConfig)
syslogConfig.ConfigDir = *rsyslog.RsyslogConfDir
syslogConfig.JujuConfigDir = filepath.Join(s.ConfDir(), "rsyslog")
rendered, err := syslogConfig.Render()
c.Assert(err, jc.ErrorIsNil)
c.Assert(string(rsyslogConf), gc.DeepEquals, string(rendered))
// Verify logrotate files
assertPathExists(c, filepath.Join(dirname, "logrotate.conf"))
assertPathExists(c, filepath.Join(dirname, "logrotate.run"))
}
func (s *ConfigSuite) TestGenerateStateServerCertAndKey(c *gc.C) {
// Add a cert.
s.FakeHomeSuite.Home.AddFiles(c, gitjujutesting.TestFile{".ssh/id_rsa.pub", "rsa\n"})
for _, test := range []struct {
configValues map[string]interface{}
errMatch string
}{{
configValues: map[string]interface{}{
"name": "test-no-certs",
"type": "dummy",
},
errMatch: "environment configuration has no ca-cert",
}, {
configValues: map[string]interface{}{
"name": "test-no-certs",
"type": "dummy",
"ca-cert": testing.CACert,
},
errMatch: "environment configuration has no ca-private-key",
}, {
configValues: map[string]interface{}{
"name": "test-no-certs",
"type": "dummy",
"ca-cert": testing.CACert,
"ca-private-key": testing.CAKey,
},
}} {
cfg, err := config.New(config.UseDefaults, test.configValues)
c.Assert(err, gc.IsNil)
certPEM, keyPEM, err := cfg.GenerateStateServerCertAndKey()
if test.errMatch == "" {
c.Assert(err, gc.IsNil)
_, _, err = cert.ParseCertAndKey(certPEM, keyPEM)
c.Check(err, gc.IsNil)
err = cert.Verify(certPEM, testing.CACert, time.Now())
c.Assert(err, gc.IsNil)
err = cert.Verify(certPEM, testing.CACert, time.Now().AddDate(9, 0, 0))
c.Assert(err, gc.IsNil)
err = cert.Verify(certPEM, testing.CACert, time.Now().AddDate(10, 0, 1))
c.Assert(err, gc.NotNil)
} else {
c.Assert(err, gc.ErrorMatches, test.errMatch)
c.Assert(certPEM, gc.Equals, "")
c.Assert(keyPEM, gc.Equals, "")
}
}
}
func (*OpenSuite) TestPrepare(c *gc.C) {
baselineAttrs := dummy.SampleConfig().Merge(testing.Attrs{
"controller": false,
"name": "erewhemos",
}).Delete(
"ca-cert",
"ca-private-key",
"admin-secret",
)
cfg, err := config.New(config.NoDefaults, baselineAttrs)
c.Assert(err, jc.ErrorIsNil)
controllerStore := jujuclienttesting.NewMemStore()
ctx := envtesting.BootstrapContext(c)
env, err := environs.Prepare(ctx, controllerStore, environs.PrepareParams{
ControllerName: cfg.Name(),
BaseConfig: cfg.AllAttrs(),
CloudName: "dummy",
})
c.Assert(err, jc.ErrorIsNil)
// Check that an admin-secret was chosen.
adminSecret := env.Config().AdminSecret()
c.Assert(adminSecret, gc.HasLen, 32)
c.Assert(adminSecret, gc.Matches, "^[0-9a-f]*$")
// Check that the CA cert was generated.
cfgCertPEM, cfgCertOK := env.Config().CACert()
cfgKeyPEM, cfgKeyOK := env.Config().CAPrivateKey()
c.Assert(cfgCertOK, jc.IsTrue)
c.Assert(cfgKeyOK, jc.IsTrue)
// Check the common name of the generated cert
caCert, _, err := cert.ParseCertAndKey(cfgCertPEM, cfgKeyPEM)
c.Assert(err, jc.ErrorIsNil)
c.Assert(caCert.Subject.CommonName, gc.Equals, `juju-generated CA for model "`+testing.SampleModelName+`"`)
// Check that controller was cached
foundController, err := controllerStore.ControllerByName(cfg.Name())
c.Assert(err, jc.ErrorIsNil)
c.Assert(foundController.ControllerUUID, gc.DeepEquals, cfg.UUID())
// Check we cannot call Prepare again.
env, err = environs.Prepare(ctx, controllerStore, environs.PrepareParams{
ControllerName: cfg.Name(),
BaseConfig: cfg.AllAttrs(),
CloudName: "dummy",
})
c.Assert(err, jc.Satisfies, errors.IsAlreadyExists)
c.Assert(err, gc.ErrorMatches, `controller "erewhemos" already exists`)
}
func (certSuite) TestNewCA(c *gc.C) {
expiry := roundTime(time.Now().AddDate(0, 0, 1))
caCertPEM, caKeyPEM, err := cert.NewCA("foo", expiry)
c.Assert(err, gc.IsNil)
caCert, caKey, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
c.Assert(err, gc.IsNil)
c.Assert(caKey, gc.FitsTypeOf, (*rsa.PrivateKey)(nil))
c.Assert(caCert.Subject.CommonName, gc.Equals, `juju-generated CA for environment "foo"`)
c.Assert(caCert.NotAfter.Equal(expiry), gc.Equals, true)
c.Assert(caCert.BasicConstraintsValid, gc.Equals, true)
c.Assert(caCert.IsCA, gc.Equals, true)
//c.Assert(caCert.MaxPathLen, Equals, 0) TODO it ends up as -1 - check that this is ok.
}
func (certSuite) TestNewCA(c *gc.C) {
now := time.Now()
expiry := roundTime(now.AddDate(0, 0, 1))
caCertPEM, caKeyPEM, err := cert.NewCA("foo", expiry)
c.Assert(err, jc.ErrorIsNil)
caCert, caKey, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
c.Assert(err, jc.ErrorIsNil)
c.Check(caKey, gc.FitsTypeOf, (*rsa.PrivateKey)(nil))
c.Check(caCert.Subject.CommonName, gc.Equals, `juju-generated CA for model "foo"`)
checkNotBefore(c, caCert, now)
checkNotAfter(c, caCert, expiry)
c.Check(caCert.BasicConstraintsValid, jc.IsTrue)
c.Check(caCert.IsCA, jc.IsTrue)
//c.Assert(caCert.MaxPathLen, Equals, 0) TODO it ends up as -1 - check that this is ok.
}
// upgradeCertificateDNSNames ensure that the controller certificate
// recorded in the agent config and also mongo server.pem contains the
// DNSNames entries required by Juju.
func upgradeCertificateDNSNames(config agent.ConfigSetter) error {
si, ok := config.StateServingInfo()
if !ok || si.CAPrivateKey == "" {
// No certificate information exists yet, nothing to do.
return nil
}
// Validate the current certificate and private key pair, and then
// extract the current DNS names from the certificate. If the
// certificate validation fails, or it does not contain the DNS
// names we require, we will generate a new one.
var dnsNames set.Strings
serverCert, _, err := cert.ParseCertAndKey(si.Cert, si.PrivateKey)
if err != nil {
// The certificate is invalid, so create a new one.
logger.Infof("parsing certificate/key failed, will generate a new one: %v", err)
dnsNames = set.NewStrings()
} else {
dnsNames = set.NewStrings(serverCert.DNSNames...)
}
update := false
requiredDNSNames := []string{"local", "juju-apiserver", "juju-mongodb"}
for _, dnsName := range requiredDNSNames {
if dnsNames.Contains(dnsName) {
continue
}
dnsNames.Add(dnsName)
update = true
}
if !update {
return nil
}
// Write a new certificate to the mongo pem and agent config files.
si.Cert, si.PrivateKey, err = cert.NewDefaultServer(config.CACert(), si.CAPrivateKey, dnsNames.Values())
if err != nil {
return err
}
if err := mongo.UpdateSSLKey(config.DataDir(), si.Cert, si.PrivateKey); err != nil {
return err
}
config.SetStateServingInfo(si)
return nil
}
func (s *CloudInitSuite) TestFinishBootstrapConfig(c *gc.C) {
attrs := dummySampleConfig().Merge(testing.Attrs{
"authorized-keys": "we-are-the-keys",
"admin-secret": "lisboan-pork",
"agent-version": "1.2.3",
"controller": false,
})
cfg, err := config.New(config.NoDefaults, attrs)
c.Assert(err, jc.ErrorIsNil)
oldAttrs := cfg.AllAttrs()
icfg := &instancecfg.InstanceConfig{
Bootstrap: true,
}
err = instancecfg.FinishInstanceConfig(icfg, cfg)
c.Assert(err, jc.ErrorIsNil)
c.Check(icfg.AuthorizedKeys, gc.Equals, "we-are-the-keys")
c.Check(icfg.DisableSSLHostnameVerification, jc.IsFalse)
password := "******"
c.Check(icfg.APIInfo, gc.DeepEquals, &api.Info{
Password: password, CACert: testing.CACert,
ModelTag: testing.ModelTag,
})
c.Check(icfg.MongoInfo, gc.DeepEquals, &mongo.MongoInfo{
Password: password, Info: mongo.Info{CACert: testing.CACert},
})
c.Check(icfg.StateServingInfo.StatePort, gc.Equals, cfg.StatePort())
c.Check(icfg.StateServingInfo.APIPort, gc.Equals, cfg.APIPort())
c.Check(icfg.StateServingInfo.CAPrivateKey, gc.Equals, oldAttrs["ca-private-key"])
oldAttrs["ca-private-key"] = ""
oldAttrs["admin-secret"] = ""
c.Check(icfg.Config.AllAttrs(), gc.DeepEquals, oldAttrs)
srvCertPEM := icfg.StateServingInfo.Cert
srvKeyPEM := icfg.StateServingInfo.PrivateKey
_, _, err = cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
c.Check(err, jc.ErrorIsNil)
err = cert.Verify(srvCertPEM, testing.CACert, time.Now())
c.Assert(err, jc.ErrorIsNil)
err = cert.Verify(srvCertPEM, testing.CACert, time.Now().AddDate(9, 0, 0))
c.Assert(err, jc.ErrorIsNil)
err = cert.Verify(srvCertPEM, testing.CACert, time.Now().AddDate(10, 0, 1))
c.Assert(err, gc.NotNil)
}
func (s *CloudInitSuite) TestFinishBootstrapConfig(c *gc.C) {
attrs := dummySampleConfig().Merge(testing.Attrs{
"authorized-keys": "we-are-the-keys",
"admin-secret": "lisboan-pork",
"agent-version": "1.2.3",
"state-server": false,
})
cfg, err := config.New(config.NoDefaults, attrs)
c.Assert(err, gc.IsNil)
oldAttrs := cfg.AllAttrs()
mcfg := &cloudinit.MachineConfig{
Bootstrap: true,
}
cons := constraints.MustParse("mem=1T cpu-power=999999999")
err = environs.FinishMachineConfig(mcfg, cfg, cons)
c.Assert(err, gc.IsNil)
c.Check(mcfg.AuthorizedKeys, gc.Equals, "we-are-the-keys")
c.Check(mcfg.DisableSSLHostnameVerification, jc.IsFalse)
password := utils.UserPasswordHash("lisboan-pork", utils.CompatSalt)
c.Check(mcfg.APIInfo, gc.DeepEquals, &api.Info{
Password: password, CACert: testing.CACert,
})
c.Check(mcfg.StateInfo, gc.DeepEquals, &state.Info{
Password: password, Info: mongo.Info{CACert: testing.CACert},
})
c.Check(mcfg.StateServingInfo.StatePort, gc.Equals, cfg.StatePort())
c.Check(mcfg.StateServingInfo.APIPort, gc.Equals, cfg.APIPort())
c.Check(mcfg.Constraints, gc.DeepEquals, cons)
oldAttrs["ca-private-key"] = ""
oldAttrs["admin-secret"] = ""
c.Check(mcfg.Config.AllAttrs(), gc.DeepEquals, oldAttrs)
srvCertPEM := mcfg.StateServingInfo.Cert
srvKeyPEM := mcfg.StateServingInfo.PrivateKey
_, _, err = cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
c.Check(err, gc.IsNil)
err = cert.Verify(srvCertPEM, testing.CACert, time.Now())
c.Assert(err, gc.IsNil)
err = cert.Verify(srvCertPEM, testing.CACert, time.Now().AddDate(9, 0, 0))
c.Assert(err, gc.IsNil)
err = cert.Verify(srvCertPEM, testing.CACert, time.Now().AddDate(10, 0, 1))
c.Assert(err, gc.NotNil)
}
func (certSuite) TestNewCA(c *gc.C) {
now := time.Now()
expiry := roundTime(now.AddDate(0, 0, 1))
caCertPEM, caKeyPEM, err := cert.NewCA("foo", expiry)
c.Assert(err, gc.IsNil)
caCert, caKey, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
c.Assert(err, gc.IsNil)
c.Check(caKey, gc.FitsTypeOf, (*rsa.PrivateKey)(nil))
c.Check(caCert.Subject.CommonName, gc.Equals, `juju-generated CA for environment "foo"`)
// Check that the certificate is valid from one week before today.
c.Check(caCert.NotBefore.Before(now), jc.IsTrue)
c.Check(caCert.NotBefore.Before(now.AddDate(0, 0, -6)), jc.IsTrue)
c.Check(caCert.NotBefore.After(now.AddDate(0, 0, -8)), jc.IsTrue)
c.Check(caCert.NotAfter.Equal(expiry), gc.Equals, true)
c.Check(caCert.BasicConstraintsValid, gc.Equals, true)
c.Check(caCert.IsCA, gc.Equals, true)
//c.Assert(caCert.MaxPathLen, Equals, 0) TODO it ends up as -1 - check that this is ok.
}
func (s *ConfigSuite) TestGenerateControllerCertAndKey(c *gc.C) {
// Add a cert.
s.FakeHomeSuite.Home.AddFiles(c, gitjujutesting.TestFile{".ssh/id_rsa.pub", "rsa\n"})
for _, test := range []struct {
caCert string
caKey string
sanValues []string
}{{
caCert: testing.CACert,
caKey: testing.CAKey,
}, {
caCert: testing.CACert,
caKey: testing.CAKey,
sanValues: []string{"10.0.0.1", "192.168.1.1"},
}} {
certPEM, keyPEM, err := controller.GenerateControllerCertAndKey(test.caCert, test.caKey, test.sanValues)
c.Assert(err, jc.ErrorIsNil)
_, _, err = cert.ParseCertAndKey(certPEM, keyPEM)
c.Check(err, jc.ErrorIsNil)
err = cert.Verify(certPEM, testing.CACert, time.Now())
c.Assert(err, jc.ErrorIsNil)
err = cert.Verify(certPEM, testing.CACert, time.Now().AddDate(9, 0, 0))
c.Assert(err, jc.ErrorIsNil)
err = cert.Verify(certPEM, testing.CACert, time.Now().AddDate(10, 0, 1))
c.Assert(err, gc.NotNil)
srvCert, err := cert.ParseCert(certPEM)
c.Assert(err, jc.ErrorIsNil)
sanIPs := make([]string, len(srvCert.IPAddresses))
for i, ip := range srvCert.IPAddresses {
sanIPs[i] = ip.String()
}
c.Assert(sanIPs, jc.SameContents, test.sanValues)
}
}
func (s *MachineSuite) testCertificateDNSUpdated(c *gc.C, a *MachineAgent) {
// Disable the certificate worker so that the certificate could
// only have been updated during agent startup.
newUpdater := func(certupdater.AddressWatcher, certupdater.StateServingInfoGetter, certupdater.ControllerConfigGetter,
certupdater.APIHostPortsGetter, certupdater.StateServingInfoSetter,
) worker.Worker {
return worker.NewNoOpWorker()
}
s.PatchValue(&newCertificateUpdater, newUpdater)
// Set up a channel which fires when State is opened.
started := make(chan struct{}, 16)
s.PatchValue(&reportOpenedState, func(*state.State) {
started <- struct{}{}
})
// Start the agent.
go func() { c.Check(a.Run(nil), jc.ErrorIsNil) }()
defer func() { c.Check(a.Stop(), jc.ErrorIsNil) }()
// Wait for State to be opened. Once this occurs we know that the
// agent's initial startup has happened.
s.assertChannelActive(c, started, "agent to start up")
// Check that certificate was updated when the agent started.
stateInfo, _ := a.CurrentConfig().StateServingInfo()
srvCert, _, err := cert.ParseCertAndKey(stateInfo.Cert, stateInfo.PrivateKey)
c.Assert(err, jc.ErrorIsNil)
expectedDnsNames := set.NewStrings("local", "juju-apiserver", "juju-mongodb")
certDnsNames := set.NewStrings(srvCert.DNSNames...)
c.Check(expectedDnsNames.Difference(certDnsNames).IsEmpty(), jc.IsTrue)
// Check the mongo certificate file too.
pemContent, err := ioutil.ReadFile(filepath.Join(s.DataDir(), "server.pem"))
c.Assert(err, jc.ErrorIsNil)
c.Check(string(pemContent), gc.Equals, stateInfo.Cert+"\n"+stateInfo.PrivateKey)
}
func (s *bootstrapSuite) TestFinishBootstrapConfig(c *gc.C) {
path := filepath.Join(c.MkDir(), "key")
ioutil.WriteFile(path, []byte("publickey"), 0644)
s.PatchEnvironment("JUJU_STREAMS_PUBLICKEY_FILE", path)
password := "******"
cloudName := "dummy"
dummyCloud := cloud.Cloud{
RegionConfig: cloud.RegionConfig{
"a-region": cloud.Attrs{
"a-key": "a-value",
},
"b-region": cloud.Attrs{
"b-key": "b-value",
},
},
}
env := newEnviron("foo", useDefaultKeys, nil)
err := bootstrap.Bootstrap(envtesting.BootstrapContext(c), env, bootstrap.BootstrapParams{
ControllerConfig: coretesting.FakeControllerConfig(),
ControllerInheritedConfig: map[string]interface{}{"ftp-proxy": "http://proxy"},
CloudName: cloudName,
Cloud: dummyCloud,
AdminSecret: password,
CAPrivateKey: coretesting.CAKey,
})
c.Assert(err, jc.ErrorIsNil)
icfg := env.instanceConfig
c.Check(icfg.APIInfo, jc.DeepEquals, &api.Info{
Password: password,
CACert: coretesting.CACert,
ModelTag: coretesting.ModelTag,
})
c.Check(icfg.Controller.MongoInfo, jc.DeepEquals, &mongo.MongoInfo{
Password: password, Info: mongo.Info{CACert: coretesting.CACert},
})
c.Check(icfg.Bootstrap.ControllerInheritedConfig, gc.DeepEquals, map[string]interface{}{"ftp-proxy": "http://proxy"})
c.Check(icfg.Bootstrap.RegionInheritedConfig, jc.DeepEquals, cloud.RegionConfig{
"a-region": cloud.Attrs{
"a-key": "a-value",
},
"b-region": cloud.Attrs{
"b-key": "b-value",
},
})
controllerCfg := icfg.Controller.Config
c.Check(controllerCfg["ca-private-key"], gc.IsNil)
c.Check(icfg.Bootstrap.StateServingInfo.StatePort, gc.Equals, controllerCfg.StatePort())
c.Check(icfg.Bootstrap.StateServingInfo.APIPort, gc.Equals, controllerCfg.APIPort())
c.Check(icfg.Bootstrap.StateServingInfo.CAPrivateKey, gc.Equals, coretesting.CAKey)
srvCertPEM := icfg.Bootstrap.StateServingInfo.Cert
srvKeyPEM := icfg.Bootstrap.StateServingInfo.PrivateKey
_, _, err = cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
c.Check(err, jc.ErrorIsNil)
// TODO(perrito666) 2016-05-02 lp:1558657
err = cert.Verify(srvCertPEM, coretesting.CACert, time.Now())
c.Assert(err, jc.ErrorIsNil)
err = cert.Verify(srvCertPEM, coretesting.CACert, time.Now().AddDate(9, 0, 0))
c.Assert(err, jc.ErrorIsNil)
err = cert.Verify(srvCertPEM, coretesting.CACert, time.Now().AddDate(10, 0, 1))
c.Assert(err, gc.NotNil)
}