Merge pull request #1070 from rabbitmq/rabbitmq-server-1054

Introduce credential validators

1 files changed, 311 insertions, 0 deletions

diff --git a/test/credential_validation_SUITE.erl b/test/credential_validation_SUITE.erl
new file mode 100644
index 0000000000..d6f9fb5ec2
--- /dev/null
+++ b/test/credential_validation_SUITE.erl
@@ -0,0 +1,311 @@
+%% The contents of this file are subject to the Mozilla Public License
+%% Version 1.1 (the "License"); you may not use this file except in
+%% compliance with the License. You may obtain a copy of the License
+%% at http://www.mozilla.org/MPL/
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and
+%% limitations under the License.
+%%
+%% The Original Code is RabbitMQ.
+%%
+%% The Initial Developer of the Original Code is GoPivotal, Inc.
+%% Copyright (c) 2007-2016 Pivotal Software, Inc.  All rights reserved.
+%%
+
+-module(credential_validation_SUITE).
+
+-compile(export_all).
+-include_lib("proper/include/proper.hrl").
+-include_lib("common_test/include/ct.hrl").
+-include_lib("eunit/include/eunit.hrl").
+
+all() ->
+    [
+     {group, unit},
+     {group, integration}
+    ].
+
+groups() ->
+    [
+     {integration, [], [
+                        min_length_integration_fails
+                        , regexp_integration_fails
+                        , min_length_integration_succeeds
+                        , regexp_integration_succeeds
+                        , min_length_change_password_integration_fails
+                        , regexp_change_password_integration_fails
+                        , min_length_change_password_integration_succeeds
+                        , regexp_change_password_integration_succeeds
+                       ]},
+     {unit, [parallel], [
+                         basic_unconditionally_accepting_succeeds,
+                         min_length_fails,
+                         min_length_succeeds,
+                         min_length_proper_fails,
+                         min_length_proper_succeeds,
+                         regexp_fails,
+                         regexp_succeeds,
+                         regexp_proper_fails,
+                         regexp_proper_succeeds
+                        ]}
+].
+
+suite() ->
+    [
+      {timetrap, {minutes, 4}}
+    ].
+
+%%
+%% Setup/teardown
+%%
+
+init_per_suite(Config) ->
+    rabbit_ct_helpers:log_environment(),
+    rabbit_ct_helpers:run_setup_steps(Config).
+
+end_per_suite(Config) ->
+    rabbit_ct_helpers:run_teardown_steps(Config).
+
+init_per_group(integration, Config) ->
+    Suffix = rabbit_ct_helpers:testcase_absname(Config, "", "-"),
+    Config1 = rabbit_ct_helpers:set_config(Config, [
+        {rmq_nodes_count, 1},
+        {rmq_nodename_suffix, Suffix}
+    ]),
+    rabbit_ct_helpers:run_steps(Config1,
+      rabbit_ct_broker_helpers:setup_steps());
+
+init_per_group(unit, Config) ->
+    Config.
+
+end_per_group(integration, Config) ->
+    switch_validator(Config, accept_everything),
+    rabbit_ct_helpers:run_steps(Config,
+      rabbit_ct_broker_helpers:teardown_steps());
+end_per_group(unit, Config) ->
+    Config.
+
+-define(USERNAME, <<"abc">>).
+
+init_per_testcase(Testcase, Config) ->
+    rabbit_ct_helpers:testcase_started(Config, Testcase).
+
+end_per_testcase(Testcase, Config) ->
+    rabbit_ct_helpers:testcase_finished(Config, Testcase).
+
+%%
+%% Test Cases
+%%
+
+basic_unconditionally_accepting_succeeds(_Config) ->
+    F = fun rabbit_credential_validator_accept_everything:validate/2,
+
+    Pwd1 = crypto:strong_rand_bytes(1),
+    ?assertEqual(ok, F(?USERNAME, Pwd1)),
+    Pwd2 = crypto:strong_rand_bytes(5),
+    ?assertEqual(ok, F(?USERNAME, Pwd2)),
+    Pwd3 = crypto:strong_rand_bytes(10),
+    ?assertEqual(ok, F(?USERNAME, Pwd3)),
+    Pwd4 = crypto:strong_rand_bytes(50),
+    ?assertEqual(ok, F(?USERNAME, Pwd4)),
+    Pwd5 = crypto:strong_rand_bytes(100),
+    ?assertEqual(ok, F(?USERNAME, Pwd5)),
+    Pwd6 = crypto:strong_rand_bytes(1000),
+    ?assertEqual(ok, F(?USERNAME, Pwd6)).
+
+min_length_fails(_Config) ->
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+
+    Pwd1 = crypto:strong_rand_bytes(1),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd1, 5)),
+    Pwd2 = crypto:strong_rand_bytes(5),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd2, 6)),
+    Pwd3 = crypto:strong_rand_bytes(10),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd3, 15)),
+    Pwd4 = crypto:strong_rand_bytes(50),
+    ?assertMatch({error, _}, F(?USERNAME, Pwd4, 60)).
+
+min_length_succeeds(_Config) ->
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(1), 1)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(6), 6)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(7), 6)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(20), 20)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(40), 30)),
+    ?assertEqual(ok, F(?USERNAME, crypto:strong_rand_bytes(50), 50)).
+
+min_length_proper_fails(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_min_length_fails_validation/0, [], 500).
+
+min_length_proper_succeeds(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_min_length_passes_validation/0, [], 500).
+
+regexp_fails(_Config) ->
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+
+    ?assertMatch({error, _}, F(?USERNAME, <<"abc">>,    "^xyz")),
+    ?assertMatch({error, _}, F(?USERNAME, <<"abcdef">>, "^xyz")),
+    ?assertMatch({error, _}, F(?USERNAME, <<"abcxyz">>, "^abc\\d+")).
+
+regexp_succeeds(_Config) ->
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+
+    ?assertEqual(ok, F(?USERNAME, <<"abc">>,    "^abc")),
+    ?assertEqual(ok, F(?USERNAME, <<"abcdef">>, "^abc")),
+    ?assertEqual(ok, F(?USERNAME, <<"abc123">>, "^abc\\d+")).
+
+regexp_proper_fails(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_regexp_fails_validation/0, [], 500).
+
+regexp_proper_succeeds(_Config) ->
+    rabbit_ct_proper_helpers:run_proper(fun prop_regexp_passes_validation/0, [], 500).
+
+min_length_integration_fails(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, min_length, 50),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch({error, "minimum required password length is 50"},
+                 add_user(Config, ?USERNAME, <<"_">>)).
+
+regexp_integration_fails(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch({error, _}, add_user(Config, ?USERNAME, <<"_">>)).
+
+min_length_integration_succeeds(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, min_length, 5),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch(ok, add_user(Config, ?USERNAME, <<"abcdefghi">>)).
+
+regexp_integration_succeeds(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch(ok, add_user(Config, ?USERNAME, <<"xyz12345678901">>)).
+
+min_length_change_password_integration_fails(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, accept_everything),
+    add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    switch_validator(Config, min_length, 50),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch({error, "minimum required password length is 50"},
+                 change_password(Config, ?USERNAME, <<"_">>)).
+
+regexp_change_password_integration_fails(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, accept_everything),
+    add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    switch_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch({error, _}, change_password(Config, ?USERNAME, <<"_">>)).
+
+min_length_change_password_integration_succeeds(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, accept_everything),
+    add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    switch_validator(Config, min_length, 5),
+    ?assertMatch(rabbit_credential_validator_min_password_length, validator_backend(Config)),
+    ?assertMatch(ok, change_password(Config, ?USERNAME, <<"abcdefghi">>)).
+
+regexp_change_password_integration_succeeds(Config) ->
+    delete_user(Config, ?USERNAME),
+    switch_validator(Config, accept_everything),
+    add_user(Config, ?USERNAME, <<"abcdefghi">>),
+    switch_validator(Config, regexp),
+    ?assertMatch(rabbit_credential_validator_password_regexp, validator_backend(Config)),
+    ?assertMatch(ok, change_password(Config, ?USERNAME, <<"xyz12345678901">>)).
+
+%%
+%% PropEr
+%%
+
+prop_min_length_fails_validation() ->
+    N = 5,
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+    ?FORALL(Val, binary(N),
+            ?FORALL(Length, choose(N + 1, 100),
+                   failed_validation(F(?USERNAME, Val, Length + 1)))).
+
+prop_min_length_passes_validation() ->
+    N = 20,
+    F = fun rabbit_credential_validator_min_password_length:validate/3,
+    ?FORALL(Val, binary(N),
+            ?FORALL(Length, choose(1, N - 1),
+                   passed_validation(F(?USERNAME, Val, Length)))).
+
+prop_regexp_fails_validation() ->
+    N = 5,
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+    ?FORALL(Val, binary(N),
+            ?FORALL(Length, choose(N + 1, 100),
+                   failed_validation(F(?USERNAME, Val, regexp_that_requires_length_of_at_least(Length + 1))))).
+
+prop_regexp_passes_validation() ->
+    N = 5,
+    F = fun rabbit_credential_validator_password_regexp:validate/3,
+    ?FORALL(Val, binary(N),
+            passed_validation(F(?USERNAME, Val, regexp_that_requires_length_of_at_most(size(Val) + 1)))).
+
+%%
+%% Helpers
+%%
+
+passed_validation(ok) ->
+    true;
+passed_validation({error, _}) ->
+    false.
+
+failed_validation(Result) ->
+    not passed_validation(Result).
+
+regexp_that_requires_length_of_at_least(N) when is_integer(N) ->
+    rabbit_misc:format("^[a-zA-Z0-9]{~p,~p}", [N, N + 10]).
+
+regexp_that_requires_length_of_at_most(N) when is_integer(N) ->
+    rabbit_misc:format("^[a-zA-Z0-9]{0,~p}", [N]).
+
+switch_validator(Config, accept_everything) ->
+    rabbit_ct_broker_helpers:rpc(Config, 0, application, set_env,
+                                 [rabbit, credential_validator,
+                                  [{validation_backend, rabbit_credential_validator_accept_everything}]]);
+
+switch_validator(Config, min_length) ->
+    switch_validator(Config, min_length, 5);
+
+switch_validator(Config, regexp) ->
+    switch_validator(Config, regexp, <<"^xyz\\d{10,12}$">>).
+
+
+switch_validator(Config, min_length, MinLength) ->
+    ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, set_env,
+                                 [rabbit, credential_validator,
+                                  [{validation_backend, rabbit_credential_validator_min_password_length},
+                                   {min_length,         MinLength}]]);
+
+switch_validator(Config, regexp, RegExp) ->
+    ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, set_env,
+                                 [rabbit, credential_validator,
+                                  [{validation_backend, rabbit_credential_validator_password_regexp},
+                                   {regexp,             RegExp}]]).
+
+add_user(Config, Username, Password) ->
+    rabbit_ct_broker_helpers:rpc(Config, 0,
+                                 rabbit_auth_backend_internal, add_user, [Username, Password]).
+
+delete_user(Config, Username) ->
+    rabbit_ct_broker_helpers:rpc(Config, 0,
+                                 rabbit_auth_backend_internal, delete_user, [Username]).
+
+change_password(Config, Username, Password) ->
+    rabbit_ct_broker_helpers:rpc(Config, 0,
+                                 rabbit_auth_backend_internal, change_password, [Username, Password]).
+
+validator_backend(Config) ->
+    rabbit_ct_broker_helpers:rpc(Config, 0, rabbit_credential_validation, backend, []).
+