Skip to content

Commit dbd38a6

Browse files
lubomarinskilubomarinski
committed
MB-66374 Add setting-encryption --kmip-server-verification
Add a flag to set which certificates to trust to verify the server certificates for KMIP. Change-Id: Ic8ab54ab4fea48546b5985ae382613883c0d776d Reviewed-on: https://review.couchbase.org/c/couchbase-cli/+/227469 Reviewed-by: Matt Hall <matt.hall@couchbase.com> Tested-by: Build Bot <build@couchbase.com>
1 parent 15ef919 commit dbd38a6

3 files changed

Lines changed: 115 additions & 5 deletions

File tree

‎cbmgr.py‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3426,6 +3426,13 @@ def __init__(self):
34263426
group.add_argument("--kmip-key-passphrase", dest="kmip_key_passphrase", metavar="<passphrase>",
34273427
action=CBNonEchoedAction, envvar="CB_KMIP_KEY_PASSPHRASE",
34283428
help="The passphrase to use to decode the key")
3429+
group.add_argument("--kmip-server-verification", dest="kmip_server_verification",
3430+
choices=["use-system-ca", "use-cb-ca", "use-system-and-cb-ca", "do-not-verify"],
3431+
metavar="<verification_option>", help="How to verify the KMIP server. Available options: " +
3432+
"use-system-ca (Use system CA certificates), " +
3433+
"use-cb-ca (Use Couchbase trusted certificates), " +
3434+
"use-system-and-cb-ca (Use system CA certificates and Couchbase trusted certificates), " +
3435+
"do-not-verify (Do not verify server certificate - insecure)")
34293436

34303437
group.add_argument("--auto-rotate-every", dest="auto_rotate_every", metavar="<days>",
34313438
help="How often to rotate the generated key")
@@ -3525,9 +3532,9 @@ def _add_edit_parse_opts(self, opts):
35253532
typ = "kmip-aes-key-256"
35263533

35273534
if not (opts.kmip_ops and opts.kmip_key and opts.kmip_host and opts.kmip_port and opts.kmip_key_path
3528-
and opts.kmip_cert_path):
3535+
and opts.kmip_cert_path and opts.kmip_server_verification):
35293536
_exit_if_errors(["--kmip-operations, --kmip-key, --kmip-host --kmip-port, --kmip-key-path, "
3530-
"--kmip-cert-path must be specified"])
3537+
"--kmip-cert-path, --kmip-server-verification must be specified"])
35313538

35323539
if not opts.encrypt_with_master and opts.encrypt_with_key is None:
35333540
_exit_if_errors(["one of --encrypt-with-master-password, --encrypt-with-key must be specified"])
@@ -3554,6 +3561,16 @@ def _add_edit_parse_opts(self, opts):
35543561
if opts.kmip_key_passphrase:
35553562
data["keyPassphrase"] = opts.kmip_key_passphrase
35563563

3564+
if opts.kmip_server_verification:
3565+
if opts.kmip_server_verification == "use-system-ca":
3566+
data["caSelection"] = "useSysCa"
3567+
elif opts.kmip_server_verification == "use-cb-ca":
3568+
data["caSelection"] = "useCbCa"
3569+
elif opts.kmip_server_verification == "use-system-and-cb-ca":
3570+
data["caSelection"] = "useSysAndCbCa"
3571+
elif opts.kmip_server_verification == "do-not-verify":
3572+
data["caSelection"] = "skipServerCertVerification"
3573+
35573574
elif opts.key_type == "auto-generated":
35583575
typ = "auto-generated-aes-key-256"
35593576

‎docs/modules/cli/pages/cbcli/couchbase-cli-setting-encryption.adoc‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ _couchbase-cli setting-enable_ [--cluster <url>] [--username <user>]
2929
[--encrypt-with-master-password] [--encrypt-with-key <keyid>]
3030
[--kmip-operations <ops>] [--kmip-key <key>] [--kmip-host <host>]
3131
[--kmip-port <port>] [--kmip-key-path <path>] [--kmip-cert-path <path>]
32-
[--kmip-key-passphrase <passphrase>]
32+
[--kmip-key-passphrase <passphrase>] [--kmip-server-verification <verification_option>]
3333
[--auto-rotate-every <days>] [--auto-rotate-start-on <iso8601>]
3434

3535
== DESCRIPTION
@@ -55,6 +55,7 @@ arguments, each having their own set of options:
5555
** For KMIP keys: `--kmip-operations <ops>`, `--kmip-key <key>`,
5656
`--kmip-host <host>`, `--kmip-port <port>`, `--kmip-key-path <path>`,
5757
`--kmip-cert-path <path>`, `--kmip-key-passphrase <passphrase>`,
58+
`--kmip-server-verification <verification_option>`
5859
`--encrypt-with-master-password`, `--encrypt-with-key <keyid>`
5960
** For auto-generated keys: `--auto-rotate-every <days>`,
6061
`--auto-rotate-start-on <iso8601>`, `--encrypt-with-master-password`,
@@ -168,6 +169,9 @@ include::{partialsdir}/cbcli/part-common-options.adoc[]
168169
--kmip-key-passphrase <passphrase>::
169170
The passphrase to use to decode the key.
170171

172+
--kmip-server-verification <verification_option>::
173+
Which certificates should be used for server verification.
174+
171175
--auto-rotate-every <days>::
172176
How often to rotate the generated key, in days.
173177

‎test/test_cli.py‎

Lines changed: 91 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1539,6 +1539,12 @@ def test_add_edit_key_kmip_no_ops(self):
15391539
args = base_args + ['--name', 'key01', '--kek-usage', '--key-type', 'kmip']
15401540
self.system_exit_run(self.command + args, None, start_server=False)
15411541
self.assertIn('--kmip-operations', self.str_output)
1542+
self.assertIn('--kmip-key', self.str_output)
1543+
self.assertIn('--kmip-host', self.str_output)
1544+
self.assertIn('--kmip-port', self.str_output)
1545+
self.assertIn('--kmip-key-path', self.str_output)
1546+
self.assertIn('--kmip-cert-path', self.str_output)
1547+
self.assertIn('--kmip-server-verification', self.str_output)
15421548

15431549
def test_add_edit_key_kmip_no_encrypt_method(self):
15441550
self.server.set_args(self.server_args)
@@ -1547,7 +1553,8 @@ def test_add_edit_key_kmip_no_encrypt_method(self):
15471553
for base_args in [['--add-key'], ['--edit-key', '1']]:
15481554
args = base_args + ['--name', 'key01', '--kek-usage', '--key-type', 'kmip', '--kmip-operations', 'get',
15491555
'--kmip-key', 'key', '--kmip-host', 'localhost', '--kmip-port', '1470',
1550-
'--kmip-key-path', '/key', '--kmip-cert-path', '/cert']
1556+
'--kmip-key-path', '/key', '--kmip-cert-path', '/cert', '--kmip-server-verification',
1557+
'use-system-and-cb-ca']
15511558
self.system_exit_run(self.command + args, None, start_server=False)
15521559
self.assertIn(
15531560
'one of --encrypt-with-master-password, --encrypt-with-key must be specified',
@@ -1561,7 +1568,7 @@ def test_add_edit_key_kmip(self):
15611568
args = base_args + ['--name', 'key01', '--kek-usage', '--key-type', 'kmip', '--kmip-operations', 'get',
15621569
'--kmip-key', 'key', '--kmip-host', 'localhost', '--kmip-port', '1470',
15631570
'--kmip-key-path', '/key', '--kmip-cert-path', '/cert',
1564-
'--encrypt-with-master-password']
1571+
'--encrypt-with-master-password', '--kmip-server-verification', 'use-system-and-cb-ca']
15651572
self.no_error_run(self.command + args, None, start_server=False)
15661573
expected = json.dumps({
15671574
'usage': ['KEK-encryption'],
@@ -1575,6 +1582,88 @@ def test_add_edit_key_kmip(self):
15751582
'encryptionApproach': 'useGet',
15761583
'keyPath': '/key',
15771584
'certPath': '/cert',
1585+
'caSelection': "useSysAndCbCa"
1586+
}
1587+
}, sort_keys=True)
1588+
self.rest_parameter_match([expected], length_match=False)
1589+
1590+
def test_add_edit_key_kmip_do_not_verify(self):
1591+
self.server.set_args(self.server_args)
1592+
self.server.run()
1593+
1594+
for base_args in [['--add-key'], ['--edit-key', '1']]:
1595+
args = base_args + ['--name', 'key01', '--kek-usage', '--key-type', 'kmip', '--kmip-operations', 'get',
1596+
'--kmip-key', 'key', '--kmip-host', 'localhost', '--kmip-port', '1470',
1597+
'--kmip-key-path', '/key', '--kmip-cert-path', '/cert',
1598+
'--encrypt-with-master-password', '--kmip-server-verification', 'do-not-verify']
1599+
self.no_error_run(self.command + args, None, start_server=False)
1600+
expected = json.dumps({
1601+
'usage': ['KEK-encryption'],
1602+
'name': 'key01',
1603+
'type': 'kmip-aes-key-256',
1604+
'data': {
1605+
'encryptWith': 'nodeSecretManager',
1606+
'activeKey': {'kmipId': 'key'},
1607+
'host': 'localhost',
1608+
'port': 1470,
1609+
'encryptionApproach': 'useGet',
1610+
'keyPath': '/key',
1611+
'certPath': '/cert',
1612+
'caSelection': "skipServerCertVerification"
1613+
}
1614+
}, sort_keys=True)
1615+
self.rest_parameter_match([expected], length_match=False)
1616+
1617+
def test_add_edit_key_kmip_use_system_ca(self):
1618+
self.server.set_args(self.server_args)
1619+
self.server.run()
1620+
1621+
for base_args in [['--add-key'], ['--edit-key', '1']]:
1622+
args = base_args + ['--name', 'key01', '--kek-usage', '--key-type', 'kmip', '--kmip-operations', 'get',
1623+
'--kmip-key', 'key', '--kmip-host', 'localhost', '--kmip-port', '1470',
1624+
'--kmip-key-path', '/key', '--kmip-cert-path', '/cert',
1625+
'--encrypt-with-master-password', '--kmip-server-verification', 'use-system-ca']
1626+
self.no_error_run(self.command + args, None, start_server=False)
1627+
expected = json.dumps({
1628+
'usage': ['KEK-encryption'],
1629+
'name': 'key01',
1630+
'type': 'kmip-aes-key-256',
1631+
'data': {
1632+
'encryptWith': 'nodeSecretManager',
1633+
'activeKey': {'kmipId': 'key'},
1634+
'host': 'localhost',
1635+
'port': 1470,
1636+
'encryptionApproach': 'useGet',
1637+
'keyPath': '/key',
1638+
'certPath': '/cert',
1639+
'caSelection': "useSysCa"
1640+
}
1641+
}, sort_keys=True)
1642+
self.rest_parameter_match([expected], length_match=False)
1643+
1644+
def test_add_edit_key_kmip_use_cb_ca(self):
1645+
self.server.set_args(self.server_args)
1646+
self.server.run()
1647+
1648+
for base_args in [['--add-key'], ['--edit-key', '1']]:
1649+
args = base_args + ['--name', 'key01', '--kek-usage', '--key-type', 'kmip', '--kmip-operations', 'get',
1650+
'--kmip-key', 'key', '--kmip-host', 'localhost', '--kmip-port', '1470',
1651+
'--kmip-key-path', '/key', '--kmip-cert-path', '/cert',
1652+
'--encrypt-with-master-password', '--kmip-server-verification', 'use-cb-ca']
1653+
self.no_error_run(self.command + args, None, start_server=False)
1654+
expected = json.dumps({
1655+
'usage': ['KEK-encryption'],
1656+
'name': 'key01',
1657+
'type': 'kmip-aes-key-256',
1658+
'data': {
1659+
'encryptWith': 'nodeSecretManager',
1660+
'activeKey': {'kmipId': 'key'},
1661+
'host': 'localhost',
1662+
'port': 1470,
1663+
'encryptionApproach': 'useGet',
1664+
'keyPath': '/key',
1665+
'certPath': '/cert',
1666+
'caSelection': "useCbCa"
15781667
}
15791668
}, sort_keys=True)
15801669
self.rest_parameter_match([expected], length_match=False)

0 commit comments

Comments
 (0)