From f2106c27336d7d03671dbbbcd1401232c2beb61f Mon Sep 17 00:00:00 2001 From: Felix Scheinost Date: Wed, 4 Jan 2023 18:28:56 +0100 Subject: Implement `rpc_secret_file` --- src/util/config.rs | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) (limited to 'src/util') diff --git a/src/util/config.rs b/src/util/config.rs index 04f8375a..e1120822 100644 --- a/src/util/config.rs +++ b/src/util/config.rs @@ -34,7 +34,10 @@ pub struct Config { pub compression_level: Option, /// RPC secret key: 32 bytes hex encoded - pub rpc_secret: String, + pub rpc_secret: Option, + + /// Optional file where RPC secret key is read from + pub rpc_secret_file: Option, /// Address to bind for RPC pub rpc_bind_addr: SocketAddr, @@ -177,7 +180,26 @@ pub fn read_config(config_file: PathBuf) -> Result { let mut config = String::new(); file.read_to_string(&mut config)?; - Ok(toml::from_str(&config)?) + let mut parsed_config: Config = toml::from_str(&config)?; + + match (&parsed_config.rpc_secret, &parsed_config.rpc_secret_file) { + (Some(_), _) => {} + (None, Some(rpc_secret_file_path_string)) => { + let mut rpc_secret_file = std::fs::OpenOptions::new() + .read(true) + .open(rpc_secret_file_path_string)?; + let mut rpc_secret_from_file = String::new(); + rpc_secret_file.read_to_string(&mut rpc_secret_from_file)?; + // trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`. + // also editors sometimes add a trailing newline + parsed_config.rpc_secret = Some(String::from(rpc_secret_from_file.trim_end())); + } + (None, None) => { + return Err("either `rpc_secret` or `rpc_secret_file` needs to be set".into()) + } + }; + + Ok(parsed_config) } fn default_compression() -> Option { -- cgit v1.2.3 From 7b62fe3f0b1dcb336f153e54e72d8587292aa01b Mon Sep 17 00:00:00 2001 From: Felix Scheinost Date: Sat, 7 Jan 2023 13:49:03 +0100 Subject: Error on both `rpc_secret` and `rpc_secret_file` --- src/util/config.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'src/util') diff --git a/src/util/config.rs b/src/util/config.rs index e1120822..5471fc41 100644 --- a/src/util/config.rs +++ b/src/util/config.rs @@ -34,6 +34,7 @@ pub struct Config { pub compression_level: Option, /// RPC secret key: 32 bytes hex encoded + /// Note: When using `read_config` this should never be `None` pub rpc_secret: Option, /// Optional file where RPC secret key is read from @@ -183,7 +184,12 @@ pub fn read_config(config_file: PathBuf) -> Result { let mut parsed_config: Config = toml::from_str(&config)?; match (&parsed_config.rpc_secret, &parsed_config.rpc_secret_file) { - (Some(_), _) => {} + (Some(_), None) => { + // no-op + } + (Some(_), Some(_)) => { + return Err("only one of `rpc_secret` and `rpc_secret_file` can be set".into()) + } (None, Some(rpc_secret_file_path_string)) => { let mut rpc_secret_file = std::fs::OpenOptions::new() .read(true) -- cgit v1.2.3 From d6ea0cbefa6dcf89ea30e1cd2d36854d8160d6b1 Mon Sep 17 00:00:00 2001 From: Felix Scheinost Date: Sat, 7 Jan 2023 13:49:15 +0100 Subject: Add tests for `rpc_secret_file` --- src/util/Cargo.toml | 2 + src/util/config.rs | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 122 insertions(+) (limited to 'src/util') diff --git a/src/util/Cargo.toml b/src/util/Cargo.toml index 32e9c851..1017b1ce 100644 --- a/src/util/Cargo.toml +++ b/src/util/Cargo.toml @@ -47,6 +47,8 @@ hyper = "0.14" opentelemetry = { version = "0.17", features = [ "rt-tokio", "metrics", "trace" ] } +[dev-dependencies] +mktemp = "0.4" [features] k2v = [] diff --git a/src/util/config.rs b/src/util/config.rs index 5471fc41..f0a881aa 100644 --- a/src/util/config.rs +++ b/src/util/config.rs @@ -261,3 +261,123 @@ where deserializer.deserialize_any(OptionVisitor) } + +#[cfg(test)] +mod tests { + use crate::error::Error; + use std::fs::File; + use std::io::Write; + + #[test] + fn test_rpc_secret_is_required() -> Result<(), Error> { + let path1 = mktemp::Temp::new_file()?; + let mut file1 = File::create(path1.as_path())?; + writeln!( + file1, + r#" + metadata_dir = "/tmp/garage/meta" + data_dir = "/tmp/garage/data" + replication_mode = "3" + rpc_bind_addr = "[::]:3901" + + [s3_api] + s3_region = "garage" + api_bind_addr = "[::]:3900" + "# + )?; + assert_eq!( + "either `rpc_secret` or `rpc_secret_file` needs to be set", + super::read_config(path1.to_path_buf()) + .unwrap_err() + .to_string() + ); + drop(path1); + drop(file1); + + let path2 = mktemp::Temp::new_file()?; + let mut file2 = File::create(path2.as_path())?; + writeln!( + file2, + r#" + metadata_dir = "/tmp/garage/meta" + data_dir = "/tmp/garage/data" + replication_mode = "3" + rpc_bind_addr = "[::]:3901" + rpc_secret = "foo" + + [s3_api] + s3_region = "garage" + api_bind_addr = "[::]:3900" + "# + )?; + + let config = super::read_config(path2.to_path_buf())?; + assert_eq!("foo", config.rpc_secret.unwrap()); + drop(path2); + drop(file2); + + Ok(()) + } + + #[test] + fn test_rpc_secret_file_works() -> Result<(), Error> { + let path_secret = mktemp::Temp::new_file()?; + let mut file_secret = File::create(path_secret.as_path())?; + writeln!(file_secret, "foo")?; + drop(file_secret); + + let path_config = mktemp::Temp::new_file()?; + let mut file_config = File::create(path_config.as_path())?; + let path_secret_path = path_secret.as_path().display(); + writeln!( + file_config, + r#" + metadata_dir = "/tmp/garage/meta" + data_dir = "/tmp/garage/data" + replication_mode = "3" + rpc_bind_addr = "[::]:3901" + rpc_secret_file = "{path_secret_path}" + + [s3_api] + s3_region = "garage" + api_bind_addr = "[::]:3900" + "# + )?; + let config = super::read_config(path_config.to_path_buf())?; + assert_eq!("foo", config.rpc_secret.unwrap()); + drop(path_config); + drop(path_secret); + drop(file_config); + Ok(()) + } + + #[test] + fn test_rcp_secret_and_rpc_secret_file_cannot_be_set_both() -> Result<(), Error> { + let path_config = mktemp::Temp::new_file()?; + let mut file_config = File::create(path_config.as_path())?; + writeln!( + file_config, + r#" + metadata_dir = "/tmp/garage/meta" + data_dir = "/tmp/garage/data" + replication_mode = "3" + rpc_bind_addr = "[::]:3901" + rpc_secret= "dummy" + rpc_secret_file = "dummy" + + [s3_api] + s3_region = "garage" + api_bind_addr = "[::]:3900" + "# + )?; + assert_eq!( + "only one of `rpc_secret` and `rpc_secret_file` can be set", + super::read_config(path_config.to_path_buf()) + .unwrap_err() + .to_string() + ); + drop(path_config); + drop(file_config); + Ok(()) + } +} -- cgit v1.2.3