eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden signed node authorization flow

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 18:15:10 +02:00
commit 1336fa38e8
9 changed files with 382 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

50
crates/geth/tests/bootstrap.rs
View file

@ -786,12 +786,15 @@ fn auth_grant_revoke_and_explain_use_local_auth_log() {
resource: "resource:cas:local".to_owned(),
capability: "cas.fetch".to_owned(),
grant_id: Some("grant:test-fetch".to_owned()),
signing_key_path: None,
admin_key_path: None,
},
)
.expect("grant capability");
match response {
geth_control::ControlResponse::AuthOpRecorded { op } => {
geth_control::ControlResponse::AuthOpRecorded { op, signatures } => {
assert_eq!(op.resource.to_string(), "resource:cas:local");
assert!(signatures.is_empty());
}
other => panic!("unexpected response: {other:?}"),
}
@ -819,6 +822,8 @@ fn auth_grant_revoke_and_explain_use_local_auth_log() {
geth_control::ControlRequest::AuthRevoke {
resource: "resource:cas:local".to_owned(),
grant_id: "grant:test-fetch".to_owned(),
signing_key_path: None,
admin_key_path: None,
},
)
.expect("revoke grant");
@ -1006,7 +1011,7 @@ fn init_owned_node_records_signed_owner_device_and_node() {
geth_control::ControlRequest::NodeRename {
node: "laptop".to_owned(),
name: "work-laptop".to_owned(),
signing_key_path: Some(admin_key_path),
signing_key_path: Some(admin_key_path.clone()),
},
)
.expect("rename node");
@ -1017,6 +1022,41 @@ fn init_owned_node_records_signed_owner_device_and_node() {
other => panic!("unexpected response: {other:?}"),
}
let endpoint_added = geth_node::handle_request(
&node,
geth_control::ControlRequest::NodeEndpointAdd {
node: "work-laptop".to_owned(),
endpoint: "endpoint:test-rotated".to_owned(),
signing_key_path: Some(admin_key_path.clone()),
},
)
.expect("add endpoint");
match endpoint_added {
geth_control::ControlResponse::NodeKeychainUpdated { signatures, .. } => {
assert_eq!(signatures.len(), 1);
}
other => panic!("unexpected response: {other:?}"),
}
let grant = geth_node::handle_request(
&node,
geth_control::ControlRequest::NodeGrant {
node: "work-laptop".to_owned(),
resource: "resource:cas:local".to_owned(),
capability: "cas.fetch".to_owned(),
grant_id: Some("grant:work-laptop-cas-fetch".to_owned()),
signing_key_path: Some(admin_key_path.clone()),
admin_key_path: None,
},
)
.expect("signed node grant");
match grant {
geth_control::ControlResponse::NodeGrantUpdated { signatures, .. } => {
assert_eq!(signatures.len(), 1);
}
other => panic!("unexpected response: {other:?}"),
}
let explained = geth_node::handle_request(
&node,
geth_control::ControlRequest::AuthExplain {
@ -1388,6 +1428,8 @@ fn kv_create_set_get_use_local_store() {
resource: "resource:kv:prefs".to_owned(),
capability: "kv.write_prefix:apps/foo/".to_owned(),
grant_id: None,
signing_key_path: None,
admin_key_path: None,
},
)
.expect("grant prefix write");
@ -2134,6 +2176,8 @@ fn ssh_cert_and_revocation_commands_check_subject_capabilities() {
resource: "resource:ssh:certs".to_owned(),
capability: "ssh_cert.request".to_owned(),
grant_id: Some("grant:ssh-cert-request".to_owned()),
signing_key_path: None,
admin_key_path: None,
},
)
.expect("grant cert request");
@ -2171,6 +2215,8 @@ fn ssh_cert_and_revocation_commands_check_subject_capabilities() {
resource: "resource:ssh:revocations".to_owned(),
capability: "ssh_revocation.publish".to_owned(),
grant_id: Some("grant:ssh-revocation-publish".to_owned()),
signing_key_path: None,
admin_key_path: None,
},
)
.expect("grant revocation publish");