1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
#
# Author:: Tyler Ball (<tball@getchef.com>)
# Copyright:: Copyright (c) 2010-2014 Opscode, Inc.
# License:: Apache License, Version 2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
require 'spec_helper'
require 'chef/encrypted_data_bag_item/check_encrypted'
class CheckEncryptedTester
include Chef::EncryptedDataBagItem::CheckEncrypted
end
describe Chef::EncryptedDataBagItem::CheckEncrypted do
let(:tester) { CheckEncryptedTester.new }
it "detects the item is not encrypted when the data is empty" do
expect(tester.encrypted?({})).to eq(false)
end
it "detects the item is not encrypted when the data only contains an id" do
expect(tester.encrypted?({id: "foo"})).to eq(false)
end
context "when the item is encrypted" do
let(:default_secret) { "abc123SECRET" }
let(:item_name) { "item_name" }
let(:raw_data) {{
"id" => item_name,
"greeting" => "hello",
"nested" => {
"a1" => [1, 2, 3],
"a2" => { "b1" => true }
}
}}
let(:version) { 1 }
let(:encoded_data) do
Chef::Config[:data_bag_encrypt_version] = version
Chef::EncryptedDataBagItem.encrypt_data_bag_item(raw_data, default_secret)
end
it "does not detect encryption when the item version is unknown" do
# It shouldn't be possible for someone to normally encrypt an item with an unknown version - they would have to
# do something funky like encrypting it and then manually changing the version
modified_encoded_data = encoded_data
modified_encoded_data["greeting"]["version"] = 4
expect(tester.encrypted?(modified_encoded_data)).to eq(false)
end
shared_examples_for "encryption detected" do
it "detects encrypted data bag" do
expect( encryptor ).to receive(:encryptor_keys).at_least(:once).and_call_original
expect(tester.encrypted?(encoded_data)).to eq(true)
end
end
context "when encryption version is 1" do
include_examples "encryption detected" do
let(:version) { 1 }
let(:encryptor) { Chef::EncryptedDataBagItem::Encryptor::Version1Encryptor }
end
end
context "when encryption version is 2" do
include_examples "encryption detected" do
let(:version) { 2 }
let(:encryptor) { Chef::EncryptedDataBagItem::Encryptor::Version2Encryptor }
end
end
context "when encryption version is 3", :aes_256_gcm_only, :ruby_20_only do
include_examples "encryption detected" do
let(:version) { 3 }
let(:encryptor) { Chef::EncryptedDataBagItem::Encryptor::Version3Encryptor }
end
end
end
end
|
