use in-memory keystore to avoid file locks

Author: jetersen

src/test-integration/java/com/bettercloud/vault/api/AuthBackendCertTests.java

@@ -6,20 +6,16 @@
 import com.bettercloud.vault.VaultException;
 import com.bettercloud.vault.util.SSLUtils;
 import com.bettercloud.vault.util.VaultContainer;
-import org.bouncycastle.operator.OperatorCreationException;
 import org.junit.BeforeClass;
 import org.junit.ClassRule;
 import org.junit.Test;
 
 import java.io.File;
 import java.io.IOException;
-import java.security.InvalidKeyException;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.SignatureException;
-import java.security.cert.CertificateException;
+import java.security.KeyStore;
+import java.util.HashMap;
 
+import static com.bettercloud.vault.util.TestConstants.PASSWORD;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNotSame;
 
@@ -34,14 +30,15 @@ public class AuthBackendCertTests {
 
     @ClassRule
     public static final VaultContainer container = new VaultContainer();
+    private static HashMap<String, Object> clientCertAndKey;
+    private static String cert;
 
     @BeforeClass
-    public static void setupClass() throws IOException, InterruptedException, CertificateException, SignatureException,
-            NoSuchAlgorithmException, KeyStoreException, OperatorCreationException, NoSuchProviderException,
-            InvalidKeyException {
+    public static void setupClass() throws IOException, InterruptedException {
+        clientCertAndKey = SSLUtils.createClientCertAndKey();
+        cert = (String) clientCertAndKey.get("cert");
         container.initAndUnsealVault();
-        SSLUtils.createClientCertAndKey();
-        container.setupBackendCert();
+        container.setupBackendCert(cert);
     }
 
     @Test
@@ -53,8 +50,8 @@ public void testLoginByCert_usingJksConfig() throws VaultException {
                         .readTimeout(30)
                         .sslConfig(
                                 new SslConfig()
-                                        .keyStoreFile(new File(VaultContainer.CLIENT_KEYSTORE), "password")
-                                        .trustStoreFile(new File(VaultContainer.CLIENT_TRUSTSTORE))
+                                        .keyStore((KeyStore) clientCertAndKey.get("clientKeystore"), PASSWORD)
+                                        .trustStore((KeyStore) clientCertAndKey.get("clientTrustStore"))
                                         .build()
                         )
                         .build();
@@ -76,8 +73,8 @@ public void testLoginByCert_usingPemConfig() throws VaultException {
                         .sslConfig(
                                 new SslConfig()
                                         .pemFile(new File(VaultContainer.CERT_PEMFILE))
-                                        .clientPemFile(new File(VaultContainer.CLIENT_CERT_PEMFILE))
-                                        .clientKeyPemFile(new File(VaultContainer.CLIENT_PRIVATE_KEY_PEMFILE))
+                                        .clientPemUTF8(cert)
+                                        .clientKeyPemUTF8((String) clientCertAndKey.get("privateKey"))
                                         .build()
                         )
                         .build();

src/test-integration/java/com/bettercloud/vault/util/SSLUtils.java

@@ -6,6 +6,7 @@
 import org.bouncycastle.asn1.x509.GeneralName;
 import org.bouncycastle.asn1.x509.GeneralNames;
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+import org.bouncycastle.cert.CertIOException;
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.X509v3CertificateBuilder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
@@ -27,8 +28,6 @@
 
 import javax.security.auth.x500.X500Principal;
 import java.io.ByteArrayOutputStream;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
 import java.io.FileReader;
 import java.io.IOException;
 import java.io.OutputStreamWriter;
@@ -51,6 +50,7 @@
 import java.security.cert.X509Certificate;
 import java.util.Base64;
 import java.util.Date;
+import java.util.HashMap;
 
 /**
  * Static utility methods for generating client-side SSL certs and keys, for tests that use Vault's TLS Certificate
@@ -67,148 +67,191 @@ private SSLUtils() {
      *
      * <p>Also constructs a JKS keystore, with a client certificate to use for authentication with Vault's TLS
      * Certificate auth backend.  Stores this cert as a PEM file as well, so that can be registered with Vault
-     * as a recognized certificate in {@link VaultContainer#setupBackendCert()}.</p>
+     * as a recognized certificate in {@link VaultContainer#setupBackendCert(String)}.</p>
      *
      * <p>This method must be called AFTER {@link VaultContainer#initAndUnsealVault()}, and BEFORE
-     * {@link VaultContainer#setupBackendCert()}.</p>
+     * {@link VaultContainer#setupBackendCert(String)}.</p>
      *
-     * @throws KeyStoreException
-     * @throws IOException
-     * @throws CertificateException
-     * @throws NoSuchAlgorithmException
+     * @throws IOException When certificate was not created
+     * @return
      */
-    public static void createClientCertAndKey() throws KeyStoreException, IOException, CertificateException,
-            NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException, SignatureException,
-            OperatorCreationException {
+    public static HashMap<String, Object> createClientCertAndKey() throws IOException {
 
         Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
-        final FileReader fileReader = new FileReader(CERT_PEMFILE);
-        final PEMParser pemParser = new PEMParser(fileReader);
-        final X509CertificateHolder certificateHolder = (X509CertificateHolder) pemParser.readObject();
-        final X509Certificate vaultCertificate = new JcaX509CertificateConverter()
-                .setProvider(BouncyCastleProvider.PROVIDER_NAME)
-                .getCertificate(certificateHolder);
+        final X509CertificateHolder certificateHolder = getX509CertificateHolder();
+        final X509Certificate vaultCertificate = getCertificate(certificateHolder);
+
+        KeyStore clientTrustStore = getClientTrustStore(vaultCertificate);
 
         // Store the Vault's server certificate as a trusted cert in the truststore
-        final KeyStore trustStore = KeyStore.getInstance("jks");
-        trustStore.load(null);
-        trustStore.setCertificateEntry("cert", vaultCertificate);
-        try (final FileOutputStream keystoreOutputStream = new FileOutputStream(CLIENT_TRUSTSTORE)) {
-            trustStore.store(keystoreOutputStream, "password".toCharArray());
-        }
 
         // Generate a client certificate, and store it in a Java keystore
         final KeyPair keyPair = generateKeyPair();
-        final X509Certificate clientCertificate =
-                generateCert(keyPair, "C=AU, O=The Legion of the Bouncy Castle, OU=Client Certificate, CN=localhost");
-        final KeyStore keyStore = KeyStore.getInstance("jks");
-        keyStore.load(null);
-        keyStore.setKeyEntry("privatekey", keyPair.getPrivate(), "password".toCharArray(), new Certificate[]{clientCertificate});
-        keyStore.setCertificateEntry("cert", clientCertificate);
-        try (final FileOutputStream keystoreOutputStream = new FileOutputStream(CLIENT_KEYSTORE)) {
-            keyStore.store(keystoreOutputStream, "password".toCharArray());
+        final X509Certificate clientCertificate = generateCert(keyPair);
+        if (clientCertificate == null) {
+            throw new IOException("Failed to generate certificate");
         }
+        final KeyStore clientKeystore = getClientKeystore(keyPair, clientCertificate);
 
         // Also write the client certificate to a PEM file, so it can be registered with Vault
-        writeCertToPem(clientCertificate, CLIENT_CERT_PEMFILE);
-        writePrivateKeyToPem(keyPair.getPrivate(), CLIENT_PRIVATE_KEY_PEMFILE);
+        String certToPem = certToPem(clientCertificate);
+        String privateKeyToPem = privateKeyToPem(keyPair.getPrivate());
+        return new HashMap<String, Object>() {
+            {
+                put("clientKeystore", clientKeystore);
+                put("clientTrustStore", clientTrustStore);
+                put("cert", certToPem);
+                put("privateKey", privateKeyToPem);
+            }
+        };
+    }
+
+    private static KeyStore getClientTrustStore(X509Certificate vaultCertificate) throws IOException {
+        final KeyStore trustStore = emptyStore();
+        try {
+            trustStore.setCertificateEntry("cert", vaultCertificate);
+        } catch (KeyStoreException e) {
+            throw new IOException("Cannot create trust keystore.", e);
+        }
+        return trustStore;
+    }
+
+    private static KeyStore getClientKeystore(KeyPair keyPair, X509Certificate clientCertificate) {
+        try {
+            final KeyStore keyStore = emptyStore();
+            keyStore.setKeyEntry("privatekey", keyPair.getPrivate(), PASSWORD.toCharArray(), new Certificate[]{clientCertificate});
+            keyStore.setCertificateEntry("cert", clientCertificate);
+            return keyStore;
+        } catch (KeyStoreException | IOException e) {
+            return null;
+        }
+    }
+
+    private static X509CertificateHolder getX509CertificateHolder() {
+        final PEMParser pemParser;
+        try (FileReader fileReader = new FileReader(CERT_PEMFILE)) {
+            pemParser = new PEMParser(fileReader);
+            return (X509CertificateHolder) pemParser.readObject();
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
+    private static X509Certificate getCertificate(X509CertificateHolder certificateHolder) {
+        try {
+            return new JcaX509CertificateConverter()
+                    .setProvider(BouncyCastleProvider.PROVIDER_NAME)
+                    .getCertificate(certificateHolder);
+        } catch (CertificateException e) {
+            return null;
+        }
     }
 
     /**
      * See https://www.cryptoworkshop.com/guide/, chapter 3
      *
      * @return A 4096-bit RSA key pair
-     * @throws NoSuchAlgorithmException
      */
-    private static KeyPair generateKeyPair() throws NoSuchAlgorithmException {
-        final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", new BouncyCastleProvider());
-        keyPairGenerator.initialize(4096);
-        return keyPairGenerator.genKeyPair();
+    private static KeyPair generateKeyPair() throws IOException {
+        try {
+            final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", new BouncyCastleProvider());
+            keyPairGenerator.initialize(4096);
+            KeyPair keyPair = keyPairGenerator.genKeyPair();
+            if (keyPair == null) {
+                throw new IOException("Failed to generate keypair");
+            }
+            return keyPair;
+        } catch (NoSuchAlgorithmException e) {
+            throw new IOException("Failed to generate keypair", e);
+        }
     }
 
     /**
      * See http://www.programcreek.com/java-api-examples/index.php?api=org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder
      *
      * @param keyPair The RSA keypair with which to generate the certificate
-     * @param issuer  The issuer (and subject) to use for the certificate
      * @return An X509 certificate
-     * @throws IOException
-     * @throws CertificateException
-     * @throws NoSuchProviderException
-     * @throws NoSuchAlgorithmException
-     * @throws InvalidKeyException
-     * @throws SignatureException
      */
-    private static X509Certificate generateCert(final KeyPair keyPair, final String issuer) throws IOException,
-            CertificateException, NoSuchProviderException, NoSuchAlgorithmException, InvalidKeyException,
-            SignatureException, OperatorCreationException {
-        final String subject = issuer;
+    private static X509Certificate generateCert(final KeyPair keyPair) {
+        String issuer = "C=AU, O=The Legion of the Bouncy Castle, OU=Client Certificate, CN=localhost";
         final X509v3CertificateBuilder certificateBuilder = new X509v3CertificateBuilder(
                 new X500Name(issuer),
                 BigInteger.ONE,
                 new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30),
                 new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 30)),
-                new X500Name(subject),
+                new X500Name(issuer),
                 SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded())
         );
 
         final GeneralNames subjectAltNames = new GeneralNames(new GeneralName(GeneralName.iPAddress, "127.0.0.1"));
-        certificateBuilder.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
+        try {
+            certificateBuilder.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
+        } catch (CertIOException e) {
+            e.printStackTrace();
+            return null;
+        }
 
         final AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1WithRSAEncryption");
         final AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
         final BcContentSignerBuilder signerBuilder = new BcRSAContentSignerBuilder(sigAlgId, digAlgId);
-        final AsymmetricKeyParameter keyp = PrivateKeyFactory.createKey(keyPair.getPrivate().getEncoded());
-        final ContentSigner signer = signerBuilder.build(keyp);
-        final X509CertificateHolder x509CertificateHolder = certificateBuilder.build(signer);
-
-        final X509Certificate certificate = new JcaX509CertificateConverter()
-                .getCertificate(x509CertificateHolder);
-        certificate.checkValidity(new Date());
-        certificate.verify(keyPair.getPublic());
+        final X509CertificateHolder x509CertificateHolder;
+        try {
+            final AsymmetricKeyParameter keyp = PrivateKeyFactory.createKey(keyPair.getPrivate().getEncoded());
+            final ContentSigner signer = signerBuilder.build(keyp);
+            x509CertificateHolder = certificateBuilder.build(signer);
+        } catch (IOException | OperatorCreationException e) {
+            e.printStackTrace();
+            return null;
+        }
+
+        final X509Certificate certificate;
+        try {
+            certificate = new JcaX509CertificateConverter().getCertificate(x509CertificateHolder);
+            certificate.checkValidity(new Date());
+            certificate.verify(keyPair.getPublic());
+        } catch (CertificateException | SignatureException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException e) {
+            e.printStackTrace();
+            return null;
+        }
+
         return certificate;
     }
 
     /**
      * See https://stackoverflow.com/questions/3313020/write-x509-certificate-into-pem-formatted-string-in-java
      *
      * @param certificate An X509 certificate
-     * @param filename    The name (including path) of a file to which the certificate will be written in PEM format
-     * @throws CertificateEncodingException
-     * @throws FileNotFoundException
+     * @return String certificate  in pem format
      */
-    private static void writeCertToPem(final X509Certificate certificate, final String filename)
-            throws CertificateEncodingException, FileNotFoundException {
+    private static String certToPem(final X509Certificate certificate) throws IOException {
         final Base64.Encoder encoder = Base64.getMimeEncoder();
 
         final String certHeader = "-----BEGIN CERTIFICATE-----\n";
         final String certFooter = "\n-----END CERTIFICATE-----";
-        final byte[] certBytes = certificate.getEncoded();
-        final String certContents = new String(encoder.encode(certBytes));
-        final String certPem = certHeader + certContents + certFooter;
-        try (final PrintWriter out = new PrintWriter(filename)) {
-            out.println(certPem);
+        final byte[] certBytes;
+        try {
+            certBytes = certificate.getEncoded();
+        } catch (CertificateEncodingException e) {
+            throw new IOException("Failed to encode certificate", e);
         }
+        final String certContents = new String(encoder.encode(certBytes));
+        return certHeader + certContents + certFooter;
     }
 
     /**
      * See https://stackoverflow.com/questions/3313020/write-x509-certificate-into-pem-formatted-string-in-java
      *
      * @param key      An RSA private key
-     * @param filename The name (including path) of a file to which the private key will be written in PEM format
-     * @throws FileNotFoundException
+     * @return String private key in pem format
      */
-    private static void writePrivateKeyToPem(final PrivateKey key, final String filename) throws FileNotFoundException {
+    private static String privateKeyToPem(final PrivateKey key) {
         final Base64.Encoder encoder = Base64.getMimeEncoder();
 
         final String keyHeader = "-----BEGIN PRIVATE KEY-----\n";
         final String keyFooter = "\n-----END PRIVATE KEY-----";
         final byte[] keyBytes = key.getEncoded();
         final String keyContents = new String(encoder.encode(keyBytes));
-        final String keyPem = keyHeader + keyContents + keyFooter;
-        try (final PrintWriter out = new PrintWriter(filename)) {
-            out.println(keyPem);
-        }
+        return keyHeader + keyContents + keyFooter;
     }
 
     /**
@@ -228,13 +271,25 @@ public static String generatePKCS10(KeyPair kp, String CN, String OU, String O,
         ContentSigner signGen = new JcaContentSignerBuilder("SHA256withRSA").build(kp.getPrivate());
         PKCS10CertificationRequestBuilder builder = new JcaPKCS10CertificationRequestBuilder(subject, kp.getPublic());
         PKCS10CertificationRequest csr = builder.build(signGen);
-        ByteArrayOutputStream output = new ByteArrayOutputStream();
-        Writer osWriter = new OutputStreamWriter(output);
-        JcaPEMWriter pem = new JcaPEMWriter(osWriter);
-        pem.writeObject(csr);
-        pem.close();
-        return new String(output.toByteArray());
+        try (ByteArrayOutputStream output = new ByteArrayOutputStream()) {
+            try (Writer osWriter = new OutputStreamWriter(output)) {
+                try (JcaPEMWriter pem = new JcaPEMWriter(osWriter)) {
+                    pem.writeObject(csr);
+                }
+            }
+            return new String(output.toByteArray());
+        }
     }
 
+    public static KeyStore emptyStore() throws IOException {
+        try {
+            KeyStore ks = KeyStore.getInstance("JKS");
 
+            // Loading creates the store, can't do anything with it until it's loaded
+            ks.load(null, PASSWORD.toCharArray());
+            return ks;
+        } catch (KeyStoreException | CertificateException | NoSuchAlgorithmException | IOException e) {
+            throw new IOException("Cannot create empty keystore.", e);
+        }
+    }
 }