 shankar0123
|
5a682db8e2
|
EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e
+ Cisco IOS quirk fixtures + ManagedCertificate.Source provenance +
EST bulk-revoke endpoint + 13 typed audit action codes.
Phase 10.1 — libest reference-client sidecar:
- deploy/test/libest/Dockerfile: multi-stage Debian-bookworm-slim
build of Cisco's libest v3.2.0-2 from source (autoconf/automake/
libtool + libcurl4-openssl-dev + libssl-dev). Runtime stage
carries only estclient + bash + openssl + ca-certificates so the
exec surface stays small + predictable.
- docker-compose.test.yml libest-client entry (profiles: [est-e2e])
with bind mounts for /config/est (test workspace) + /config/certs
(certctl CA bundle for TLS pinning); IP 10.30.50.9 (10.30.50.8
was already taken by certctl-agent).
- deploy/test/est/.gitkeep keeps the bind-mount target tracked.
Phase 10.2 — 5 integration tests (//go:build integration) in
deploy/test/est_e2e_test.go:
- TestEST_LibESTClient_Enrollment_Integration (cacerts → simpleenroll
→ cert-shape assertion)
- TestEST_LibESTClient_MTLSEnrollment_Integration (mTLS sibling-route
cert auth; skip when bootstrap cert absent)
- TestEST_LibESTClient_ServerKeygen_Integration (RFC 7030 §4.4
multipart; skip when profile gate disabled)
- TestEST_LibESTClient_RateLimited_Integration (4th enroll trips
per-principal cap, asserts 429-shaped error)
- TestEST_LibESTClient_ChannelBinding_Integration (libest
--tls-exporter; skip when libest build lacks the flag).
- requireESTSidecar guard skips the suite when the operator forgot
--profile est-e2e; helpful error message includes the exact
command to bring the sidecar up.
Phase 10.3 — Cisco IOS quirk fixtures + 3 unit tests in
internal/api/handler/cisco_ios_quirks_test.go:
- testdata/cisco_ios_15x_pem_csr.txt: PEM body sent with
Content-Type application/x-pem-file. Handler dispatches on
body-prefix not Content-Type — accepts cleanly.
- testdata/cisco_ios_16x_trailing_newline_csr.txt: extra trailing
newlines after base64 body. strings.TrimSpace tolerates.
- testdata/cisco_ios_crlf_b64_csr.txt: CRLF-wrapped base64.
base64.StdEncoding handles CRLF + LF identically.
Phase 11.1 — ManagedCertificate.Source provenance:
- New domain.CertificateSource enum (Unspecified/EST/SCEP/API/Agent).
- Migration 000023_managed_certificates_source.up.sql adds source
TEXT NOT NULL DEFAULT '' so existing rows scan as
CertificateSourceUnspecified — back-compat: bulk-revoke filter
treats empty as "any source".
- Postgres repo Insert/Update/scan paths all wire the new column.
Phase 11.2 — EST bulk-revoke endpoint:
- BulkRevocationCriteria.Source field (Source-only requests rejected
as too broad — must accompany at least one narrower criterion).
- service.bulk_revocation.resolveCertificates post-filter by Source
(empty=any, no SQL change so existing CertificateFilter callers
unaffected).
- New BulkRevocationHandler.BulkRevokeEST method pins Source=EST +
dispatches; new route POST /api/v1/est/certificates/bulk-revoke
(M-008 admin-gated). openapi.yaml documented + parity-guard green.
Phase 11.3 — 13 typed audit action codes in
internal/service/est_audit_actions.go:
- est_simple_enroll_success / _failed
- est_simple_reenroll_success / _failed
- est_server_keygen_success / _failed
- est_auth_failed_basic / _mtls / _channel_binding
- est_rate_limited
- est_csr_policy_violation
- est_bulk_revoke
- est_trust_anchor_reloaded
- ESTService.processEnrollment + SimpleServerKeygen + ReloadTrust
split-emit BOTH the legacy bare action codes (back-compat for the
GUI activity-tab chip filters that match by exact string +
existing audit-log analysers) AND the new typed _success / _failed
variants (operator grep target + per-failure-mode counter).
Tests:
- internal/api/handler/bulk_revocation_est_test.go — 5 cases
(admin-true happy path pins Source=EST + non-admin 403 +
empty-criteria 400 + invalid-reason 400 + method-not-allowed).
- internal/service/est_audit_actions_test.go — 5 cases (SimpleEnroll
legacy+typed emission / SimpleReEnroll typed / IssuerError
typed-failed / PolicyViolation triple-emit /
unique-string invariant).
Pre-commit verification (sandbox): gofmt clean, go vet clean
(excluding repository/postgres testcontainers limit), staticcheck
clean across api/handler/api/router/domain/service/deploy/test,
go test -short -count=1 green for every non-postgres Go package +
integration build (`go build -tags integration ./deploy/test/...`)
clean. G-3 docs-drift guard reproduced locally clean (Phases 10-11
added zero new env vars).
Spec preserved at cowork/est-rfc7030-hardening-prompt.md. Phases
12-13 (docs/est.md + WiFi/802.1X / IoT bootstrap / FreeRADIUS
recipes; release prep + tag) remain — post-2.1.0 work.
|
2026-04-30 00:52:43 +00:00 |
|
|
shankar0123
|
13cd4d98ba
|
feat(V2.2): bulk revocation — filter-based fleet-wide certificate revocation
Add POST /api/v1/certificates/bulk-revoke with filter criteria (profile_id,
owner_id, agent_id, issuer_id, team_id, certificate_ids), partial-failure
tolerance, and audit trail. Includes MCP tool, CLI command (certs bulk-revoke),
server-side bulk modal in GUI replacing client-side sequential loop, OpenAPI
spec, compliance mapping updates, and 21 new tests (12 service, 7 handler,
1 CLI, 1 frontend).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
2026-04-16 00:06:34 -04:00 |
|