Skip to content
This repository was archived by the owner on Jul 21, 2023. It is now read-only.

Commit

Permalink
Merge pull request #357 from bmw/unknown-keys
Browse files Browse the repository at this point in the history 
Reject unexpected manifest keys
  • Loading branch information
@tgeoghegan
tgeoghegan authored Feb 6, 2021
2 parents 8d58ba0 + de73590 commit 6a855e3
Showing 1 changed file with 149 additions and 21 deletions.
170 changes: 149 additions & 21 deletions facilitator/src/manifest.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ pub type BatchSigningPublicKeys = HashMap<String, UnparsedPublicKey<Vec<u8>>>;
/// Represents the description of a batch signing public key in a specific
/// manifest.
#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
struct BatchSigningPublicKey {
/// The PEM-armored base64 encoding of the ASN.1 encoding of the PKIX
/// SubjectPublicKeyInfo structure of an ECDSA P256 key.
Expand All @@ -29,7 +29,7 @@ struct BatchSigningPublicKey {
}

#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
struct PacketEncryptionCertificateSigningRequest {
/// The PEM-armored base64 encoding of the ASN.1 encoding of a PKCS#10
/// certificate signing request containing an ECDSA P256 key.
Expand All @@ -40,7 +40,7 @@ struct PacketEncryptionCertificateSigningRequest {
/// design document for the full specification.
/// https://docs.google.com/document/d/1MdfM3QT63ISU70l63bwzTrxr93Z7Tv7EDjLfammzo6Q/edit#heading=h.3j8dgxqo5h68
#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
pub struct DataShareProcessorGlobalManifest {
/// Format version of the manifest. Versions besides the currently supported
/// one are rejected.
Expand All @@ -53,7 +53,7 @@ pub struct DataShareProcessorGlobalManifest {
/// Represents the server-identity map inside a data share processor global
/// manifest.
#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
pub struct DataShareProcessorServerIdentity {
/// The numeric account ID of the AWS account this data share processor will
/// use to access peer cloud resources.
Expand Down Expand Up @@ -88,7 +88,7 @@ impl DataShareProcessorGlobalManifest {
/// specification.
/// https://docs.google.com/document/d/1MdfM3QT63ISU70l63bwzTrxr93Z7Tv7EDjLfammzo6Q/edit#heading=h.3j8dgxqo5h68
#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
pub struct SpecificManifest {
/// Format version of the manifest. Versions besides the currently supported
/// one are rejected.
Expand Down Expand Up @@ -169,7 +169,7 @@ impl SpecificManifest {
/// Represents the server-identity structure within an ingestion server global
/// manifest. One of aws_iam_entity or google_service_account should be Some.
#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
struct IngestionServerIdentity {
/// The ARN of the AWS IAM entity that this ingestion server uses to access
/// ingestion buckets,
Expand All @@ -187,7 +187,7 @@ struct IngestionServerIdentity {
/// Represents an ingestion server's manifest. This could be a global manifest
/// or a locality-specific manifest.
#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
pub struct IngestionServerManifest {
/// Format version of the manifest. Versions besides the currently supported
/// one are rejected.
Expand Down Expand Up @@ -263,7 +263,7 @@ impl IngestionServerManifest {

/// Represents the global manifest for a portal server.
#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
#[serde(deny_unknown_fields, rename_all = "kebab-case")]
pub struct PortalServerGlobalManifest {
/// Format version of the manifest. Versions besides the currently supported
/// one are rejected.
Expand Down Expand Up @@ -477,6 +477,28 @@ mod tests {
"aws-account-id": 12345678901234567,
"gcp-service-account-email": 14
}
}
"#,
// unexpected top-level field
r#"
{
"format": 0,
"server-identity": {
"aws-account-id": 12345678901234567,
"gcp-service-account-email": "[email protected]"
},
"unexpected": "some value"
}
"#,
// unexpected server-identity field
r#"
{
"format": 0,
"server-identity": {
"aws-account-id": 12345678901234567,
"gcp-service-account-email": "[email protected]",
"unexpected": "some value"
}
}
"#,
];
Expand Down Expand Up @@ -574,9 +596,9 @@ mod tests {
// No format key
r#"
{
"packet-encryption-certificates": {
"packet-encryption-keys": {
"fake-key-1": {
"certificate": "who cares"
"certificate-signing-request": "who cares"
}
},
"batch-signing-public-keys": {
Expand All @@ -594,9 +616,9 @@ mod tests {
r#"
{
"format": 0,
"packet-encryption-certificates": {
"packet-encryption-keys": {
"fake-key-1": {
"certificate": "who cares"
"certificate-signing-request": "who cares"
}
},
"batch-signing-public-keys": {
Expand All @@ -614,9 +636,9 @@ mod tests {
r#"
{
"format": "zero",
"packet-encryption-certificates": {
"packet-encryption-keys": {
"fake-key-1": {
"certificate": "who cares"
"certificate-signing-request": "who cares"
}
},
"batch-signing-public-keys": {
Expand All @@ -633,10 +655,10 @@ mod tests {
// Role ARN with wrong type
r#"
{
"format": 0,
"packet-encryption-certificates": {
"format": 1,
"packet-encryption-keys": {
"fake-key-1": {
"certificate": "who cares"
"certificate-signing-request": "who cares"
}
},
"batch-signing-public-keys": {
Expand All @@ -649,6 +671,69 @@ mod tests {
"ingestion-identity": 1,
"peer-validation-bucket": "us-west-1/validation"
}
"#,
// Unexpected top-level field
r#"
{
"format": 1,
"packet-encryption-keys": {
"fake-key-1": {
"certificate-signing-request": "who cares"
}
},
"batch-signing-public-keys": {
"fake-key-2": {
"expiration": "",
"public-key": "-----BEGIN PUBLIC KEY-----\nfoo\n-----END PUBLIC KEY-----"
}
},
"ingestion-bucket": "s3://us-west-1/ingestion",
"ingestion-identity": "arn:aws:iam:something:fake",
"peer-validation-bucket": "gs://validation",
"unexpected": "some value"
}
"#,
// Unexpected BatchSigningPublicKey field
r#"
{
"format": 1,
"packet-encryption-keys": {
"fake-key-1": {
"certificate-signing-request": "who cares"
}
},
"batch-signing-public-keys": {
"fake-key-2": {
"expiration": "",
"public-key": "-----BEGIN PUBLIC KEY-----\nfoo\n-----END PUBLIC KEY-----",
"unexpected": "some value"
}
},
"ingestion-bucket": "s3://us-west-1/ingestion",
"ingestion-identity": "arn:aws:iam:something:fake",
"peer-validation-bucket": "gs://validation"
}
"#,
// Unexpected PacketEncryptionCertificateSigningRequest field
r#"
{
"format": 1,
"packet-encryption-keys": {
"fake-key-1": {
"certificate-signing-request": "who cares",
"unexpected": "some value"
}
},
"batch-signing-public-keys": {
"fake-key-2": {
"expiration": "",
"public-key": "-----BEGIN PUBLIC KEY-----\nfoo\n-----END PUBLIC KEY-----"
}
},
"ingestion-bucket": "s3://us-west-1/ingestion",
"ingestion-identity": "arn:aws:iam:something:fake",
"peer-validation-bucket": "gs://validation"
}
"#,
];

Expand Down Expand Up @@ -808,7 +893,7 @@ mod tests {
r#"
{
"server-identity": {
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role"
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role",
"gcp-service-account-email": "[email protected]"
},
"batch-signing-public-keys": {
Expand All @@ -824,7 +909,7 @@ mod tests {
{
"format": 2,
"server-identity": {
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role"
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role",
"gcp-service-account-email": "[email protected]"
},
"batch-signing-public-keys": {
Expand All @@ -840,7 +925,24 @@ mod tests {
{
"format": "zero",
"server-identity": {
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role"
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role",
"gcp-service-account-email": "[email protected]"
},
"batch-signing-public-keys": {
"key-identifier-1": {
"public-key": "----BEGIN PUBLIC KEY----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEI3MQm+HzXvaYa2mVlhB4zknbtAT8cSxakmBoJcBKGqGw\nYS0bhxSpuvABM1kdBTDpQhXnVdcq+LSiukXJRpGHVg==\n----END PUBLIC KEY----",
"expiration": "2021-01-15T18:53:20Z"
}
}
}
"#,
// Unexpected top-level field
r#"
{
"format": 1,
"unexpected": "some value",
"server-identity": {
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role",
"gcp-service-account-email": "[email protected]"
},
"batch-signing-public-keys": {
Expand All @@ -849,6 +951,23 @@ mod tests {
"expiration": "2021-01-15T18:53:20Z"
}
}
}
"#,
// Unexpected server-identity field
r#"
{
"format": 1,
"server-identity": {
"aws-iam-entity": "arn:aws:iam::338276578713:role/ingestor-1-role",
"gcp-service-account-email": "[email protected]",
"unexpected": "some value"
},
"batch-signing-public-keys": {
"key-identifier-1": {
"public-key": "----BEGIN PUBLIC KEY----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEI3MQm+HzXvaYa2mVlhB4zknbtAT8cSxakmBoJcBKGqGw\nYS0bhxSpuvABM1kdBTDpQhXnVdcq+LSiukXJRpGHVg==\n----END PUBLIC KEY----",
"expiration": "2021-01-15T18:53:20Z"
}
}
}
"#,
];
Expand Down Expand Up @@ -925,8 +1044,17 @@ mod tests {
// Missing field
r#"
{
"format": 0,
"format": 1,
"facilitator-sum-part-bucket": "gs://facilitator-bucket"
}
"#,
// Unexpected top-level field
r#"
{
"format": 1,
"facilitator-sum-part-bucket": "gs://facilitator-bucket",
"pha-sum-part-bucket": "gs://pha-bucket",
"unexpected": "some value"
}
"#,
];
Expand Down

0 comments on commit 6a855e3

Please sign in to comment.