redesign sshsigchain authority protocol
This commit is contained in:
parent
73500e1944
commit
492a37c020
5 changed files with 1542 additions and 867 deletions
|
|
@ -6505,7 +6505,6 @@ pub fn handle_request(
|
|||
let records = read_sshsigchain_jsonl_file(&input)?;
|
||||
let trust = geth_keychain::SshSigchainTrust::new(
|
||||
geth_keychain::SshSigchainChainId::from_hex(&chain_id)?,
|
||||
geth_keychain::KEYCHAIN_SSH_SIGCHAIN_PROFILE,
|
||||
namespace.unwrap_or_else(|| geth_keychain::SSH_SIGCHAIN_NAMESPACE.to_owned()),
|
||||
std::fs::read_to_string(root_key_path)?,
|
||||
)?;
|
||||
|
|
@ -6515,12 +6514,13 @@ pub fn handle_request(
|
|||
chain_id: trust.chain_id.to_hex(),
|
||||
records: verified.records,
|
||||
head: verified.head.to_hex(),
|
||||
active_admin_keys: verified.view.admin_keys.len(),
|
||||
users: verified.view.users.len(),
|
||||
devices: verified.view.devices.len(),
|
||||
nodes: verified.view.nodes.len(),
|
||||
active_keys: verified.state.active_key_count(),
|
||||
devices: verified.state.devices.values().filter(|device| device.active).count(),
|
||||
disclosed_profiles: verified.state.disclosed_profiles.len(),
|
||||
incomplete_profiles: verified.state.incomplete_profiles.len(),
|
||||
anchor_threshold: verified.state.anchor_policy.threshold,
|
||||
note:
|
||||
"verified linked SSHSIGCHAIN v1 records against the explicitly pinned root key"
|
||||
"verified sequence-free SSHSIGCHAIN v1 authority records and disclosed profile commitments against the explicitly pinned root key"
|
||||
.to_owned(),
|
||||
})
|
||||
}
|
||||
|
|
@ -9545,7 +9545,7 @@ fn verify_keychain_sigchain_entries_with_ssh(
|
|||
fn verify_keychain_sshsigchain_with_ssh(
|
||||
records: &[geth_keychain::SshSigchainRecord],
|
||||
trust: &geth_keychain::SshSigchainTrust,
|
||||
) -> Result<geth_keychain::KeychainSshSigchainVerification, NodeError> {
|
||||
) -> Result<geth_keychain::SshSigchainVerification, NodeError> {
|
||||
geth_ssh_identity::ensure_ssh_keygen_available()?;
|
||||
let verify_dir = tempfile::tempdir()?;
|
||||
|
||||
|
|
@ -9601,7 +9601,7 @@ fn verify_keychain_sshsigchain_with_ssh(
|
|||
let verifier = SshSigchainOpenSshVerifier {
|
||||
verify_dir: verify_dir.path().to_path_buf(),
|
||||
};
|
||||
Ok(geth_keychain::verify_keychain_sshsigchain(
|
||||
Ok(geth_keychain::verify_sshsigchain(
|
||||
records, trust, &verifier,
|
||||
)?)
|
||||
}
|
||||
|
|
@ -11045,14 +11045,13 @@ mod tests {
|
|||
);
|
||||
let trust = geth_keychain::SshSigchainTrust::new(
|
||||
geth_keychain::SshSigchainChainId([0x42; 32]),
|
||||
geth_keychain::KEYCHAIN_SSH_SIGCHAIN_PROFILE,
|
||||
geth_keychain::SSH_SIGCHAIN_NAMESPACE,
|
||||
&root_public_key,
|
||||
)
|
||||
.expect("trust tuple");
|
||||
|
||||
let sign = |record: geth_keychain::SshSigchainRecord| {
|
||||
let payload = dir.path().join(format!("record-{}", record.sequence));
|
||||
let payload = dir.path().join("record");
|
||||
std::fs::write(&payload, record.signing_bytes().expect("signing bytes"))
|
||||
.expect("write signing payload");
|
||||
let output = geth_ssh_identity::sign_command(
|
||||
|
|
@ -11072,50 +11071,32 @@ mod tests {
|
|||
record.with_signature(signature).expect("signed record")
|
||||
};
|
||||
|
||||
let init_op = KeychainOp {
|
||||
id: AuthOpId::new("auth-op:sshsigchain-init"),
|
||||
created_at: UnixMillis(1),
|
||||
kind: KeychainOpKind::KeychainInit,
|
||||
};
|
||||
let init = sign(
|
||||
geth_keychain::keychain_sshsigchain_unsigned_record(
|
||||
&trust,
|
||||
0,
|
||||
geth_keychain::SshSigchainRecord::unsigned(
|
||||
trust.chain_id,
|
||||
None,
|
||||
&init_op,
|
||||
&root_public_key,
|
||||
geth_keychain::AuthorityTransition::Genesis {
|
||||
device_id: "device:root".to_owned(),
|
||||
root_key: geth_keychain::AuthorityKey {
|
||||
public_key: root_public_key.clone(),
|
||||
permissions: vec![geth_keychain::Permission::All],
|
||||
delegable_permissions: vec![geth_keychain::Permission::All],
|
||||
},
|
||||
anchor_policy: geth_keychain::AnchorPolicy::default(),
|
||||
},
|
||||
vec![],
|
||||
)
|
||||
.expect("unsigned init"),
|
||||
);
|
||||
let root_add_op = KeychainOp {
|
||||
id: AuthOpId::new("auth-op:sshsigchain-root"),
|
||||
created_at: UnixMillis(2),
|
||||
kind: KeychainOpKind::AdminKeyAdd {
|
||||
key: KeyId::new(geth_keychain::admin_key_fingerprint(&root_public_key)),
|
||||
public_key: Some(root_public_key.clone()),
|
||||
principal: Some("root".to_owned()),
|
||||
valid_after_ms: None,
|
||||
valid_before_ms: None,
|
||||
},
|
||||
};
|
||||
let root_add = sign(
|
||||
geth_keychain::keychain_sshsigchain_unsigned_record(
|
||||
&trust,
|
||||
1,
|
||||
Some(init.record_hash().expect("init hash")),
|
||||
&root_add_op,
|
||||
&root_public_key,
|
||||
)
|
||||
.expect("unsigned root add"),
|
||||
);
|
||||
|
||||
let verified = verify_keychain_sshsigchain_with_ssh(&[init.clone(), root_add], &trust)
|
||||
let verified = verify_keychain_sshsigchain_with_ssh(&[init.clone()], &trust)
|
||||
.expect("verify real OpenSSH SSHSIG chain");
|
||||
assert_eq!(verified.records, 2);
|
||||
assert_eq!(verified.view.admin_keys.len(), 1);
|
||||
assert_eq!(verified.records, 1);
|
||||
assert_eq!(verified.state.active_key_count(), 1);
|
||||
|
||||
let mut tampered = init;
|
||||
tampered.payload.push(0);
|
||||
tampered.chain_id = geth_keychain::SshSigchainChainId([0x43; 32]);
|
||||
assert!(verify_keychain_sshsigchain_with_ssh(&[tampered], &trust).is_err());
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue