diff --git a/crates/geth/tests/bootstrap.rs b/crates/geth/tests/bootstrap.rs index 10251f7..5b626fa 100644 --- a/crates/geth/tests/bootstrap.rs +++ b/crates/geth/tests/bootstrap.rs @@ -789,6 +789,210 @@ fn unsigned_keychain_and_auth_ops_are_rejected_during_peer_sync() { ); } +#[test] +fn invalidly_signed_keychain_and_auth_ops_are_rejected_during_peer_sync() { + let left_home = tempfile::tempdir().expect("left tempdir"); + let right_home = tempfile::tempdir().expect("right tempdir"); + if !unix_sockets_available(left_home.path()) || !unix_sockets_available(right_home.path()) { + return; + } + assert!(run_geth(left_home.path(), &["init"]).status.success()); + assert!(run_geth(right_home.path(), &["init"]).status.success()); + for home in [left_home.path(), right_home.path()] { + std::fs::write( + home.join("config.toml"), + "[iroh]\nrelay_mode = \"disabled\"\nlocal_discovery = false\n", + ) + .expect("write config"); + } + let fake_admin_public_key = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakeAdminKeyMaterialForNegativeTests test@geth\n"; + let fake_admin_public_key_path = left_home.path().join("fake-admin.pub"); + std::fs::write(&fake_admin_public_key_path, fake_admin_public_key) + .expect("write fake admin public key"); + + let mut left_daemon = spawn_daemon(left_home.path()); + let mut right_daemon = spawn_daemon(right_home.path()); + wait_for_socket(&left_home.path().join("run/geth.sock")); + wait_for_socket(&right_home.path().join("run/geth.sock")); + + let trust_admin = run_geth( + left_home.path(), + &[ + "keychain", + "init", + "--admin-key", + fake_admin_public_key_path + .to_str() + .expect("fake admin public key path"), + ], + ); + assert!( + trust_admin.status.success(), + "trust admin stderr: {}", + String::from_utf8_lossy(&trust_admin.stderr) + ); + + let left_card_path = left_home.path().join("left-peer-card.json"); + let right_card_path = right_home.path().join("right-peer-card.json"); + assert!( + run_geth( + left_home.path(), + &[ + "peer", + "export", + "--out", + left_card_path.to_str().expect("left card path"), + ], + ) + .status + .success() + ); + assert!( + run_geth( + right_home.path(), + &[ + "peer", + "export", + "--out", + right_card_path.to_str().expect("right card path"), + ], + ) + .status + .success() + ); + let right_card_json = std::fs::read_to_string(&right_card_path).expect("read right card"); + let right_card: geth_discovery::PeerCard = + serde_json::from_str(&right_card_json).expect("decode right card"); + assert!( + run_geth( + left_home.path(), + &[ + "peer", + "import", + right_card_path.to_str().expect("right card path"), + ], + ) + .status + .success() + ); + assert!( + run_geth( + right_home.path(), + &[ + "peer", + "import", + left_card_path.to_str().expect("left card path"), + ], + ) + .status + .success() + ); + + let signer = geth_types::KeyId::new(geth_ssh_identity::ssh_public_key_fingerprint( + fake_admin_public_key, + )); + let keychain_op = geth_keychain::KeychainOp { + id: geth_types::AuthOpId::new("keychain-op:invalid-signature-user-add"), + created_at: geth_types::UnixMillis(20), + kind: geth_keychain::KeychainOpKind::UserAdd { + user: geth_types::UserId::new("user:invalid-signature"), + name: "Invalid Signature".to_owned(), + }, + }; + let auth_op = geth_auth::AuthOp { + id: geth_types::AuthOpId::new("auth-op:invalid-signature-grant"), + resource: geth_types::ResourceId::new("resource:ssh-proxy:local"), + created_at: geth_types::UnixMillis(21), + kind: geth_auth::AuthOpKind::GrantCreate { + grant_id: "grant:invalid-signature".to_owned(), + principal: geth_types::PrincipalId::new("node:invalid-signature"), + capabilities: vec![geth_types::Capability::new("ssh_proxy.connect")], + }, + }; + let right_paths = geth_config::GethPaths::from_home(right_home.path()); + let right_store = + geth_store::Store::open(&right_paths.metadata_db()).expect("open right store"); + right_store + .insert_keychain_op(&geth_store::StoredKeychainOp { + op_id: keychain_op.id.to_string(), + op_json: serde_json::to_string(&keychain_op).expect("encode keychain op"), + created_at_ms: keychain_op.created_at.0, + }) + .expect("insert invalidly signed keychain op"); + right_store + .insert_keychain_signature(&geth_store::StoredKeychainSignature { + op_id: keychain_op.id.to_string(), + signer: signer.to_string(), + signer_public_key: fake_admin_public_key.to_owned(), + namespace: geth_keychain::KEYCHAIN_SIGNATURE_NAMESPACE.to_owned(), + signature: b"not a valid openssh signature".to_vec(), + created_at_ms: 22, + }) + .expect("insert invalid keychain signature"); + right_store + .insert_auth_op(&geth_store::StoredAuthOp { + op_id: auth_op.id.to_string(), + resource_id: auth_op.resource.to_string(), + op_json: serde_json::to_string(&auth_op).expect("encode auth op"), + created_at_ms: auth_op.created_at.0, + }) + .expect("insert invalidly signed auth op"); + right_store + .insert_auth_signature(&geth_store::StoredAuthSignature { + op_id: auth_op.id.to_string(), + signer: signer.to_string(), + signer_public_key: fake_admin_public_key.to_owned(), + namespace: geth_auth::AUTH_SIGNATURE_NAMESPACE.to_owned(), + signature: b"not a valid openssh signature".to_vec(), + created_at_ms: 23, + }) + .expect("insert invalid auth signature"); + + let keychain_sync = run_geth( + left_home.path(), + &["keychain", "sync", right_card.node_id.as_str()], + ); + let auth_sync = run_geth( + left_home.path(), + &["auth", "sync", right_card.node_id.as_str()], + ); + let _ = left_daemon.kill(); + let _ = right_daemon.kill(); + let _ = left_daemon.wait(); + let _ = right_daemon.wait(); + + assert!( + keychain_sync.status.success(), + "keychain sync stderr: {}", + String::from_utf8_lossy(&keychain_sync.stderr) + ); + assert!( + auth_sync.status.success(), + "auth sync stderr: {}", + String::from_utf8_lossy(&auth_sync.stderr) + ); + assert!(String::from_utf8_lossy(&keychain_sync.stdout).contains("invalid_ops_rejected: 1")); + assert!(String::from_utf8_lossy(&auth_sync.stdout).contains("invalid_ops_rejected: 1")); + + let left_paths = geth_config::GethPaths::from_home(left_home.path()); + let left_store = geth_store::Store::open(&left_paths.metadata_db()).expect("open left store"); + assert!( + !left_store + .list_keychain_ops() + .expect("list left keychain ops") + .iter() + .any(|op| op.op_id == keychain_op.id.as_str()) + ); + assert!( + !left_store + .list_auth_ops() + .expect("list left auth ops") + .iter() + .any(|op| op.op_id == auth_op.id.as_str()) + ); +} + #[test] fn peer_card_export_import_and_list_are_candidate_only() { let source_home = tempfile::tempdir().expect("source tempdir"); diff --git a/docs/roadmap.md b/docs/roadmap.md index 6a76dc0..cc48d17 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -23,8 +23,10 @@ Implementation order: node state. - `[x]` Add initial two-daemon tests proving unsigned replicated keychain/auth operations are rejected and not imported. - - `[ ]` Add tests proving invalidly signed and conflicting replicated - keychain/auth records do not mutate trust/resource state. + - `[x]` Add initial two-daemon tests proving invalidly signed replicated + keychain/auth operations are rejected and not imported. + - `[ ]` Add tests proving conflicting replicated keychain/auth records do + not mutate trust/resource state. - `[ ]` Improve `auth explain` diagnostics enough for operators to distinguish discovered-only peers, missing endpoint bindings, missing grants, matching grants, revocations, and bearer access. @@ -71,8 +73,10 @@ Implementation order: enrolled node without using the old one-off `node enroll sync` shortcut. - `[x]` Tests assert unsigned replicated keychain/auth records do not mutate local trust or resource state. - - `[ ]` Tests assert invalidly signed/conflicting replicated keychain/auth - records do not mutate local trust or resource state. + - `[x]` Tests assert invalidly signed replicated keychain/auth records do not + mutate local trust or resource state. + - `[ ]` Tests assert conflicting replicated keychain/auth records do not + mutate local trust or resource state. - `[~]` Remote authorization enforcement audit. Acceptance criteria: