eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce SSH workflow capabilities locally

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:44:13 +02:00
commit f7e85960f7
8 changed files with 328 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

92
crates/geth/tests/bootstrap.rs
View file

@ -1375,6 +1375,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
requested_validity: Some("+52w".to_owned()),
renewal_of: None,
reason: Some("renewal".to_owned()),
subject: None,
},
)
.expect("request cert");
@ -1391,6 +1392,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
valid_for: Some("+4w".to_owned()),
serial: Some(42),
out: None,
subject: None,
},
)
.expect("approve cert");
@ -1410,6 +1412,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
kind: "public-key".to_owned(),
target: "ssh:blake3:test".to_owned(),
reason: Some("lost key".to_owned()),
subject: None,
},
)
.expect("add revocation");
@ -1419,6 +1422,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
out: export_path.clone(),
format: "jsonl".to_owned(),
ca_public: None,
subject: None,
},
)
.expect("export revocations");
@ -1435,6 +1439,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
out: krl_spec_path.clone(),
format: "openssh-krl-spec".to_owned(),
ca_public: None,
subject: None,
},
)
.expect("export revocation krl spec");
@ -1465,6 +1470,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
geth_control::ControlRequest::SshRevocationImport {
path: krl_spec_path,
format: "openssh-krl-spec".to_owned(),
subject: None,
},
)
.expect("import krl spec");
@ -1490,6 +1496,7 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
geth_control::ControlRequest::SshRevocationImport {
path: home.path().join("revocations.jsonl"),
format: "jsonl".to_owned(),
subject: None,
},
)
.expect("import jsonl revocations");
@ -1501,6 +1508,89 @@ fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
}
}
#[test]
fn ssh_cert_and_revocation_commands_check_subject_capabilities() {
let home = tempfile::tempdir().expect("tempdir");
let paths = geth_config::GethPaths::from_home(home.path());
let node = geth_node::init_node(&paths).expect("init node");
let public_key_path = home.path().join("id_ed25519.pub");
std::fs::write(&public_key_path, "ssh-ed25519 AAAATEST eric@geth\n").expect("write pubkey");
assert!(
geth_node::handle_request(
&node,
geth_control::ControlRequest::SshCertRequest {
public_key_path: public_key_path.clone(),
cert_kind: "user".to_owned(),
principals: vec!["eric".to_owned()],
requested_validity: Some("+52w".to_owned()),
renewal_of: None,
reason: Some("unauthorized".to_owned()),
subject: Some("node:ssh-operator".to_owned()),
},
)
.is_err()
);
geth_node::handle_request(
&node,
geth_control::ControlRequest::AuthGrant {
subject: "node:ssh-operator".to_owned(),
resource: "resource:ssh:certs".to_owned(),
capability: "ssh_cert.request".to_owned(),
grant_id: Some("grant:ssh-cert-request".to_owned()),
},
)
.expect("grant cert request");
geth_node::handle_request(
&node,
geth_control::ControlRequest::SshCertRequest {
public_key_path,
cert_kind: "user".to_owned(),
principals: vec!["eric".to_owned()],
requested_validity: Some("+52w".to_owned()),
renewal_of: None,
reason: Some("authorized".to_owned()),
subject: Some("node:ssh-operator".to_owned()),
},
)
.expect("authorized cert request");
assert!(
geth_node::handle_request(
&node,
geth_control::ControlRequest::SshRevocationAdd {
kind: "key-id".to_owned(),
target: "old-key".to_owned(),
reason: Some("unauthorized".to_owned()),
subject: Some("node:ssh-operator".to_owned()),
},
)
.is_err()
);
geth_node::handle_request(
&node,
geth_control::ControlRequest::AuthGrant {
subject: "node:ssh-operator".to_owned(),
resource: "resource:ssh:revocations".to_owned(),
capability: "ssh_revocation.publish".to_owned(),
grant_id: Some("grant:ssh-revocation-publish".to_owned()),
},
)
.expect("grant revocation publish");
geth_node::handle_request(
&node,
geth_control::ControlRequest::SshRevocationAdd {
kind: "key-id".to_owned(),
target: "old-key".to_owned(),
reason: Some("authorized".to_owned()),
subject: Some("node:ssh-operator".to_owned()),
},
)
.expect("authorized revocation add");
}
#[test]
fn ssh_revocation_export_can_write_binary_openssh_krl() {
if Command::new("ssh-keygen").arg("-?").output().is_err() {
@ -1531,6 +1621,7 @@ fn ssh_revocation_export_can_write_binary_openssh_krl() {
kind: "public-key".to_owned(),
target: public_key,
reason: Some("test binary krl".to_owned()),
subject: None,
},
)
.expect("add revocation");
@ -1541,6 +1632,7 @@ fn ssh_revocation_export_can_write_binary_openssh_krl() {
out: krl_path.clone(),
format: "openssh-krl".to_owned(),
ca_public: None,
subject: None,
},
)
.expect("export binary krl");