diff options
| -rw-r--r-- | qa/suites/rgw/multifs/overrides.yaml | 2 | ||||
| -rw-r--r-- | qa/suites/rgw/verify/overrides.yaml | 2 | ||||
| -rw-r--r-- | qa/tasks/s3tests.py | 41 |
3 files changed, 45 insertions, 0 deletions
diff --git a/qa/suites/rgw/multifs/overrides.yaml b/qa/suites/rgw/multifs/overrides.yaml index 9b2063f0699..3aaef75af7b 100644 --- a/qa/suites/rgw/multifs/overrides.yaml +++ b/qa/suites/rgw/multifs/overrides.yaml @@ -3,3 +3,5 @@ overrides: conf: client: debug rgw: 20 + rgw crypt s3 kms encryption keys: testkey-1=YmluCmJvb3N0CmJvb3N0LWJ1aWxkCmNlcGguY29uZgo= testkey-2=aWIKTWFrZWZpbGUKbWFuCm91dApzcmMKVGVzdGluZwo= + rgw crypt require ssl: false diff --git a/qa/suites/rgw/verify/overrides.yaml b/qa/suites/rgw/verify/overrides.yaml index ed696bff5c0..5611cbfe139 100644 --- a/qa/suites/rgw/verify/overrides.yaml +++ b/qa/suites/rgw/verify/overrides.yaml @@ -4,5 +4,7 @@ overrides: client: debug rgw: 20 rgw compression type: random + rgw crypt s3 kms encryption keys: testkey-1=YmluCmJvb3N0CmJvb3N0LWJ1aWxkCmNlcGguY29uZgo= testkey-2=aWIKTWFrZWZpbGUKbWFuCm91dApzcmMKVGVzdGluZwo= + rgw crypt require ssl: false rgw: frontend: civetweb diff --git a/qa/tasks/s3tests.py b/qa/tasks/s3tests.py index 305025ff545..7d3df2bb9c6 100644 --- a/qa/tasks/s3tests.py +++ b/qa/tasks/s3tests.py @@ -360,6 +360,46 @@ def run_tests(ctx, config): yield @contextlib.contextmanager +def scan_for_leaked_encryption_keys(ctx, config): + """ + Scan radosgw logs for the encryption keys used by s3tests to + verify that we're not leaking secrets. + + :param ctx: Context passed to task + :param config: specific configuration information + """ + assert isinstance(config, dict) + + try: + yield + finally: + # x-amz-server-side-encryption-customer-key + s3test_customer_key = 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=' + + log.debug('Scanning radosgw logs for leaked encryption keys...') + procs = list() + for client, client_config in config.iteritems(): + (remote,) = ctx.cluster.only(client).remotes.keys() + proc = remote.run( + args=[ + 'grep', + '--binary-files=text', + s3test_customer_key, + '/var/log/ceph/rgw.{client}.log'.format(client=client), + ], + wait=False, + check_status=False, + ) + procs.append(proc) + + for proc in procs: + proc.wait() + if proc.returncode == 1: # 1 means no matches + continue + log.error('radosgw log is leaking encryption keys!') + raise Exception('radosgw log is leaking encryption keys') + +@contextlib.contextmanager def task(ctx, config): """ Run the s3-tests suite against rgw. @@ -451,6 +491,7 @@ def task(ctx, config): s3tests_conf=s3tests_conf, )), lambda: run_tests(ctx=ctx, config=config), + lambda: scan_for_leaked_encryption_keys(ctx=ctx, config=config), ): pass yield |