nic-6443 commented on code in PR #13833:
URL: https://github.com/apache/apisix/pull/13833#discussion_r3792152718
##########
apisix/admin/stream_routes.lua:
##########
@@ -151,12 +152,18 @@ local function delete_checker(id)
end
+local function encrypt_conf(id, conf)
+ apisix_upstream.encrypt_conf(conf.upstream)
Review Comment:
The return value isn't part of the contract: `resource.lua` calls
`self.encrypt_conf(id, conf)` and ignores what comes back, and the hook mutates
`conf` in place — `routes.lua`, `services.lua` and `upstreams.lua` all return
nothing the same way. Returning `conf` here would make this one look different
from its three siblings without changing behaviour, so I'd rather keep it
identical to them.
##########
t/admin/stream-routes.t:
##########
@@ -654,3 +654,51 @@ passed
GET /t
--- response_body
passed
+
+
+
+=== TEST 18: an inline upstream client key is encrypted at rest
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local etcd = require("apisix.core.etcd")
+ local t = require("lib.test_admin")
+
+ local ssl_cert = t.read_file("t/certs/apisix.crt")
+ local ssl_key = t.read_file("t/certs/apisix.key")
+ local code, body = t.test('/apisix/admin/stream_routes/enc',
+ ngx.HTTP_PUT,
+ core.json.encode({
+ remote_addr = "127.0.0.1",
+ upstream = {
+ nodes = { ["127.0.0.1:8080"] = 1 },
+ type = "roundrobin",
+ scheme = "tls",
+ tls = {
+ client_cert = ssl_cert,
+ client_key = ssl_key,
+ },
+ },
+ })
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ local res = assert(etcd.get('/stream_routes/enc'))
+ local stored = res.body.node.value.upstream.tls.client_key
+ assert(stored ~= ssl_key, "the client key must be encrypted at
rest")
Review Comment:
Right, normalization would have slipped through. Strengthened in 205c07c96:
it asserts the stored value no longer contains the PEM `PRIVATE KEY` marker.
##########
t/admin/stream-routes.t:
##########
@@ -654,3 +654,51 @@ passed
GET /t
--- response_body
passed
+
+
+
+=== TEST 18: an inline upstream client key is encrypted at rest
Review Comment:
That's the convention in this suite: test blocks are separated by three
blank lines, and `utils/reindex` (what the CI style check runs) reports this
file as clean.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
