Fix panic when reading unconfigured PKI mount URLs

go.mod

@@ -4,18 +4,14 @@ go 1.12
 
 require (
 	github.com/aws/aws-sdk-go v1.22.0
-	github.com/go-sql-driver/mysql v1.4.1
-	github.com/google/btree v1.0.0 // indirect
 	github.com/gosimple/slug v1.4.1
 	github.com/hashicorp/go-cleanhttp v0.5.1
-	github.com/hashicorp/go-hclog v0.9.2
 	github.com/hashicorp/go-multierror v1.0.0
 	github.com/hashicorp/terraform-plugin-sdk v1.1.1
 	github.com/hashicorp/vault v1.2.0
 	github.com/hashicorp/vault/api v1.0.5-0.20190730042357-746c0b111519
 	github.com/hashicorp/vault/sdk v0.1.14-0.20190730042320-0dc007d98cc8
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/ory/dockertest v3.3.4+incompatible
 	github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be // indirect
 	github.com/ulikunitz/xz v0.5.6 // indirect
 )

vault/resource_pki_secret_backend_config_urls.go

@@ -82,9 +82,13 @@ func pkiSecretBackendConfigUrlsRead(d *schema.ResourceData, meta interface{}) er
 	config, err := client.Logical().Read(path)
 
 	if err != nil {
-		log.Printf("[WARN] Removing path %q its ID is invalid", path)
+		return fmt.Errorf("error reading URL config on PKI secret backend %q: %s", path, err)
+	}
+
+	if config == nil {
+		log.Printf("[WARN] Removing URL config path %q as its ID is invalid", path)
 		d.SetId("")
-		return fmt.Errorf("invalid path ID %q: %s", path, err)
+		return nil
 	}
 
 	d.Set("issuing_certificates", config.Data["issuing_certificates"])

vault/resource_pki_secret_backend_config_urls_test.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/terraform"
 	"github.com/hashicorp/vault/api"
 )
@@ -24,6 +25,11 @@ func TestPkiSecretBackendConfigUrls_basic(t *testing.T) {
 		PreCheck:     func() { testAccPreCheck(t) },
 		CheckDestroy: testPkiSecretBackendConfigUrlsDestroy,
 		Steps: []resource.TestStep{
+			{
+				// Test that reading from an unconfigured mount succeeds
+				Config: testPkiSecretBackendCertConfigUrlsConfig_rootOnly(rootPath),
+				Check:  testPkiSecretBackendConfigUrlsEmptyRead,
+			},
 			{
 				Config: testPkiSecretBackendCertConfigUrlsConfig_basic(rootPath, issuingCertificates, crlDistributionPoints, ocspServers),
 				Check: resource.ComposeTestCheckFunc(
@@ -36,12 +42,41 @@ func TestPkiSecretBackendConfigUrls_basic(t *testing.T) {
 	})
 }
 
+func testPkiSecretBackendConfigUrlsEmptyRead(s *terraform.State) error {
+	paths, err := listPkiPaths(s)
+	if err != nil {
+		return err
+	}
+	for _, path := range paths {
+		d := &schema.ResourceData{}
+		d.SetId(path)
+		if err := pkiSecretBackendConfigUrlsRead(d, testProvider.Meta()); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func testPkiSecretBackendConfigUrlsDestroy(s *terraform.State) error {
+	paths, err := listPkiPaths(s)
+	if err != nil {
+		return err
+	}
+	for _, path := range paths {
+		return fmt.Errorf("mount %q still exists", path)
+	}
+
+	return nil
+}
+
+func listPkiPaths(s *terraform.State) ([]string, error) {
+	var paths []string
+
 	client := testProvider.Meta().(*api.Client)
 
 	mounts, err := client.Sys().ListMounts()
 	if err != nil {
-		return err
+		return nil, err
 	}
 
 	for _, rs := range s.RootModule().Resources {
@@ -52,11 +87,23 @@ func testPkiSecretBackendConfigUrlsDestroy(s *terraform.State) error {
 			path = strings.Trim(path, "/")
 			rsPath := strings.Trim(rs.Primary.Attributes["path"], "/")
 			if mount.Type == "pki" && path == rsPath {
-				return fmt.Errorf("mount %q still exists", path)
+				paths = append(paths, path)
 			}
 		}
 	}
-	return nil
+
+	return paths, nil
+}
+
+func testPkiSecretBackendCertConfigUrlsConfig_rootOnly(rootPath string) string {
+	return fmt.Sprintf(`
+resource "vault_pki_secret_backend" "test-root" {
+  path = "%s"
+  description = "test root"
+  default_lease_ttl_seconds = "8640000"
+  max_lease_ttl_seconds = "8640000"
+}
+`, rootPath)
 }
 
 func testPkiSecretBackendCertConfigUrlsConfig_basic(rootPath string, issuingCertificates string, crlDistributionPoints string, ocspServers string) string {