Privatae
287 lines
11 KiB
Go
287 lines
11 KiB
Go
package main
|
|
|
|
// DCN handler walls — the verification gates that are testable without a
|
|
// live relay: signature verify + tamper + expiry (dcnVerifyRec), the path sandbox
|
|
// incl. symlink escape (dcnResolvePath), excludes matching, and mask checks.
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func signedRec(t *testing.T, priv ed25519.PrivateKey, terms map[string]any) dcnGrantRec {
|
|
t.Helper()
|
|
canonical, err := json.Marshal(terms)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return dcnGrantRec{
|
|
TermsCanonical: base64.StdEncoding.EncodeToString(canonical),
|
|
Signature: base64.StdEncoding.EncodeToString(ed25519.Sign(priv, canonical)),
|
|
}
|
|
}
|
|
|
|
func TestDcnVerifyRec(t *testing.T) {
|
|
pub, priv, _ := ed25519.GenerateKey(nil)
|
|
pubB64 := base64.StdEncoding.EncodeToString(pub)
|
|
terms := map[string]any{"kind": "dcn_store_grant", "class": "machine",
|
|
"server": "box1", "root": "/data", "mask": []string{"read"},
|
|
"expires": time.Now().Add(24 * time.Hour).UTC().Format(time.RFC3339)}
|
|
|
|
rec := signedRec(t, priv, terms)
|
|
got, err := dcnVerifyRec(pubB64, rec)
|
|
if err != nil || got.Root != "/data" {
|
|
t.Fatalf("valid grant must verify: %v", err)
|
|
}
|
|
|
|
// Tamper: widen the mask inside the canonical bytes → signature must fail.
|
|
bad := terms
|
|
bad["mask"] = []string{"read", "write"}
|
|
canonical, _ := json.Marshal(bad)
|
|
tampered := dcnGrantRec{TermsCanonical: base64.StdEncoding.EncodeToString(canonical),
|
|
Signature: rec.Signature}
|
|
if _, err := dcnVerifyRec(pubB64, tampered); err == nil {
|
|
t.Fatal("a grant mutated after signing must NOT verify")
|
|
}
|
|
|
|
// Wrong key → fail.
|
|
otherPub, _, _ := ed25519.GenerateKey(nil)
|
|
if _, err := dcnVerifyRec(base64.StdEncoding.EncodeToString(otherPub), rec); err == nil {
|
|
t.Fatal("a grant must not verify under a different pinned key")
|
|
}
|
|
|
|
// Signed expiry in the past → fail (the signed expiry is authoritative).
|
|
terms["mask"] = []string{"read"}
|
|
terms["expires"] = time.Now().Add(-time.Hour).UTC().Format(time.RFC3339)
|
|
if _, err := dcnVerifyRec(pubB64, signedRec(t, priv, terms)); err == nil {
|
|
t.Fatal("an expired grant must NOT verify")
|
|
}
|
|
}
|
|
|
|
func TestDcnResolvePathSandbox(t *testing.T) {
|
|
root := t.TempDir()
|
|
if err := os.MkdirAll(filepath.Join(root, "sub"), 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(root, "sub", "a.txt"), []byte("x"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if _, ok := dcnResolvePath(root, "sub/a.txt"); !ok {
|
|
t.Fatal("an in-root path must resolve")
|
|
}
|
|
for _, esc := range []string{"../etc/passwd", "sub/../../x", "/etc/passwd", ""} {
|
|
if _, ok := dcnResolvePath(root, esc); ok {
|
|
t.Fatalf("path %q must be rejected (traversal wall)", esc)
|
|
}
|
|
}
|
|
|
|
// Symlink escape: a link inside the store pointing outside it must be refused.
|
|
outside := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(outside, "secret"), []byte("s"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
link := filepath.Join(root, "leak")
|
|
if err := os.Symlink(outside, link); err != nil {
|
|
t.Skipf("symlinks unavailable: %v", err)
|
|
}
|
|
if _, ok := dcnResolvePath(root, "leak/secret"); ok {
|
|
t.Fatal("a symlink pointing outside the root must be rejected (store escape)")
|
|
}
|
|
|
|
// A missing path inside the root is fine (stat-of-missing → typed gone, not escape).
|
|
if _, ok := dcnResolvePath(root, "sub/nope.txt"); !ok {
|
|
t.Fatal("a missing in-root path must still resolve (it becomes state=gone)")
|
|
}
|
|
|
|
// A broken link is fine as the last part (a stat reads it as gone, a move
|
|
// renames the link itself); a path THROUGH it is refused.
|
|
if err := os.Symlink(filepath.Join(outside, "missing"), filepath.Join(root, "broken")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, ok := dcnResolvePath(root, "broken"); !ok {
|
|
t.Fatal("a broken link inside the root must still resolve as itself")
|
|
}
|
|
if _, ok := dcnResolvePath(root, "broken/x"); ok {
|
|
t.Fatal("a path through a broken link must be refused")
|
|
}
|
|
if len(dcnCheckPlan(root, nil, []dcnMove{{From: "broken", To: "sub/moved-link"}})) != 0 {
|
|
t.Fatal("moving a broken link renames the link, and must pass")
|
|
}
|
|
}
|
|
|
|
func TestDcnExcludes(t *testing.T) {
|
|
excludes := []string{".ssh", "*.key", ".env*", "id_rsa*"}
|
|
for _, hit := range []string{".ssh/id_rsa", "deep/.ssh/config", "certs/server.key",
|
|
".env.production", "keys/id_rsa.pub"} {
|
|
if !dcnExcluded(excludes, hit) {
|
|
t.Fatalf("%q must be excluded", hit)
|
|
}
|
|
}
|
|
// A host's path is judged as cleanRel will open it: these are spelled with
|
|
// whitespace cleanRel trims, and a ".." it resolves.
|
|
for _, hit := range []string{" .ssh/id_rsa", "certs/server.key ", "\t.env", "docs/../.ssh/x"} {
|
|
if !dcnExcludedAsSent(excludes, "/srv/store", hit) {
|
|
t.Fatalf("%q must be excluded as sent", hit)
|
|
}
|
|
}
|
|
for _, ok := range []string{"docs/readme.md", "ssh-notes.txt", "envelope.pdf"} {
|
|
if dcnExcluded(excludes, ok) {
|
|
t.Fatalf("%q must NOT be excluded", ok)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Names are compared the way each platform's file system tells them apart.
|
|
// Judged per platform from any OS, so a Windows or macOS rule is tested on Linux.
|
|
func TestDcnExcludesCompareNamesAsTheFileSystemDoes(t *testing.T) {
|
|
excludes := []string{".ssh", "*.key"}
|
|
for _, c := range []struct {
|
|
goos, path string
|
|
want bool
|
|
}{
|
|
{"linux", ".SSH/id_rsa", false}, // a different folder on Linux
|
|
{"darwin", ".SSH/id_rsa", true},
|
|
{"windows", ".SSH/id_rsa", true},
|
|
{"windows", ".ssh./id_rsa", true},
|
|
{"windows", ".ssh /id_rsa", true},
|
|
{"windows", "certs/server.key::$DATA", true},
|
|
{"windows", "certs/SERVER.KEY", true},
|
|
{"linux", "certs/server.key.", false},
|
|
{"darwin", "docs/readme.md", false},
|
|
{"windows", "docs/readme.md", false},
|
|
} {
|
|
if got := dcnExcludedOn(c.goos, excludes, c.path); got != c.want {
|
|
t.Errorf("%s: %q excluded=%v, want %v", c.goos, c.path, got, c.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
// A link inside the store to an excluded folder opens that folder, so a path
|
|
// through it is excluded, for a read and for a move alike.
|
|
func TestDcnExcludesHoldThroughALinkInsideTheStore(t *testing.T) {
|
|
root := t.TempDir()
|
|
if err := os.MkdirAll(filepath.Join(root, ".ssh"), 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(root, ".ssh", "id_rsa"), []byte("k"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.Symlink(".ssh", filepath.Join(root, "keys")); err != nil {
|
|
t.Skipf("symlinks unavailable: %v", err)
|
|
}
|
|
if err := os.Symlink(".ssh/id_rsa", filepath.Join(root, "key")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
excludes := []string{".ssh"}
|
|
for _, p := range []string{"keys/id_rsa", "keys", "key", " keys/id_rsa"} {
|
|
if !dcnExcludedAsSent(excludes, root, p) {
|
|
t.Errorf("%q opens the excluded .ssh, and must be excluded", p)
|
|
}
|
|
}
|
|
if dcnExcludedAsSent(excludes, root, "docs/new.txt") {
|
|
t.Error("a path that leads nowhere excluded must not be")
|
|
}
|
|
if len(dcnCheckPlan(root, excludes, []dcnMove{{From: "keys/id_rsa", To: "moved"}})) == 0 {
|
|
t.Error("a move out of the excluded folder through a link must be refused")
|
|
}
|
|
if len(dcnCheckPlan(root, excludes, []dcnMove{{From: "docs", To: "keys/x"}})) == 0 {
|
|
t.Error("a move into the excluded folder through a link must be refused")
|
|
}
|
|
}
|
|
|
|
func TestDcnMask(t *testing.T) {
|
|
terms := &dcnTerms{Mask: []string{"read", "search"}}
|
|
if !dcnHasMask(terms, "read") || dcnHasMask(terms, "write") {
|
|
t.Fatal("mask membership check broken")
|
|
}
|
|
if dcnHasMask(terms, "delete") {
|
|
t.Fatal("delete can never be in a mask")
|
|
}
|
|
}
|
|
|
|
// A revoke reaches the box — pushed (dcn_grant_drop)
|
|
// or reconciled from the heartbeat reply — instead of living on until the signed
|
|
// expiry. The absent field is "no instruction", never "drop everything".
|
|
func TestDcnGrantDropAndReconcile(t *testing.T) {
|
|
dir := t.TempDir()
|
|
pub, priv, _ := ed25519.GenerateKey(nil)
|
|
mk := func(server string) dcnGrantRec {
|
|
return signedRec(t, priv, map[string]any{"kind": "dcn_store_grant", "class": "machine",
|
|
"server": server, "root": "/data", "mask": []string{"read"},
|
|
"expires": time.Now().Add(24 * time.Hour).UTC().Format(time.RFC3339)})
|
|
}
|
|
f := &dcnGrantFile{VerifyPubkey: base64.StdEncoding.EncodeToString(pub),
|
|
Stores: map[string]dcnGrantRec{"1": mk("box1"), "2": mk("box1"), "3": mk("box1")}}
|
|
if err := dcnSaveFile(dir, f); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
stores := func() map[string]dcnGrantRec {
|
|
g, err := dcnLoadFile(dir)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return g.Stores
|
|
}
|
|
|
|
// 1. absent field → nothing happens
|
|
r := maybeReconcileGrants([]byte(`{"ok":true}`), dir)
|
|
if len(r.Dropped)+len(r.Stale)+len(r.Missing) != 0 || len(stores()) != 3 {
|
|
t.Fatalf("no dcn_grants field must be a no-op: %+v stores=%d", r, len(stores()))
|
|
}
|
|
if reconcileReport(dir) != nil {
|
|
t.Fatal("a clean reconcile must leave no pending report")
|
|
}
|
|
|
|
// 2. host lists 1 (same sig), 2 (different sig), 9 (not on disk); 3 unlisted
|
|
body := []byte(`{"dcn_grants":{"stores":[{"store_id":1,"signature":"` + f.Stores["1"].Signature +
|
|
`"},{"store_id":2,"signature":"different"},{"store_id":9,"signature":"x"}]}}`)
|
|
r = maybeReconcileGrants(body, dir)
|
|
if len(r.Dropped) != 0 || len(stores()) != 3 {
|
|
t.Fatalf("ONE unlisted reply must not drop (a sync in flight is unlisted by timing): %+v", r)
|
|
}
|
|
r = maybeReconcileGrants(body, dir)
|
|
if len(r.Dropped) != 1 || r.Dropped[0] != 3 {
|
|
t.Fatalf("store 3 (unlisted twice) must be dropped: %+v", r)
|
|
}
|
|
if len(r.Stale) != 1 || r.Stale[0] != 2 {
|
|
t.Fatalf("store 2 (signature differs) must be reported stale, not dropped: %+v", r)
|
|
}
|
|
if len(r.Missing) != 1 || r.Missing[0] != 9 {
|
|
t.Fatalf("store 9 (listed, not on disk) must be reported missing: %+v", r)
|
|
}
|
|
s := stores()
|
|
if _, ok := s["3"]; ok {
|
|
t.Fatal("dropped store must be gone from grants.json")
|
|
}
|
|
if _, ok := s["2"]; !ok {
|
|
t.Fatal("a stale store must stay on disk (the box never fabricates or discards a valid grant on a hint)")
|
|
}
|
|
if rep := reconcileReport(dir); rep == nil || len(rep.Stale) != 1 || len(rep.Missing) != 1 {
|
|
t.Fatalf("drift must be carried for the next heartbeat: %+v", rep)
|
|
}
|
|
|
|
// 3. explicit empty list (twice) → the host says this box holds nothing → all dropped
|
|
maybeReconcileGrants([]byte(`{"dcn_grants":{"stores":[]}}`), dir)
|
|
r = maybeReconcileGrants([]byte(`{"dcn_grants":{"stores":[]}}`), dir)
|
|
if len(r.Dropped) != 2 || len(stores()) != 0 {
|
|
t.Fatalf("an explicit empty set must drop every store: %+v stores=%d", r, len(stores()))
|
|
}
|
|
|
|
// 4. pushed drop on an absent store is a clean no-op, not an error
|
|
if present, err := dcnDropStore(dir, 42, "test"); err != nil || present {
|
|
t.Fatalf("dropping an unknown store: present=%v err=%v", present, err)
|
|
}
|
|
// audit rows landed for the drops
|
|
raw, _ := os.ReadFile(filepath.Join(dir, "audit.jsonl"))
|
|
if !strings.Contains(string(raw), `"op":"grant_drop"`) {
|
|
t.Fatal("grant drops must be audited on the box")
|
|
}
|
|
}
|