4 Commits

Author	SHA1	Message	Date
certctl-copilot	f5a20a6be2	feat(scep): EnvelopedData decrypt + signerInfo POPO verify (RFC 8894 §3.2) ... SCEP RFC 8894 + Intune master bundle — Phase 2 of 14. Implements the new RFC 8894 PKIMessage parse path: EnvelopedData parser + decryptor, signerInfo parser + signature verifier, handler dispatch that tries the RFC 8894 path FIRST and falls through to the legacy MVP raw-CSR path on any parse failure. Backward compat with lightweight SCEP clients is preserved by design — no behavior change for any existing deploy that doesn't set CERTCTL_SCEP_RA_*. internal/pkcs7/envelopeddata.go (new, ~330 LoC) * ParseEnvelopedData: parses CMS EnvelopedData per RFC 5652 §6.1, with optional outer ContentInfo unwrapping. Handles SET OF RecipientInfo + IssuerAndSerial form rid (RFC 8894 §3.2.2). * EnvelopedData.Decrypt: RSA PKCS#1 v1.5 key-trans + AES-CBC (128/192/ 256) or DES-EDE3-CBC content decryption with **constant-time PKCS#7 padding strip** (no branch on padding-byte values; closes the padding-oracle leak surface). Recipient mismatch is BadMessageCheck per RFC 8894 §3.3.2.2 (NOT BadCertID); every failure mode returns the same ErrEnvelopedDataDecrypt sentinel to close timing-leak legs of Bleichenbacher attacks. * Equivalent to micromdm/scep's cryptoutil/cryptoutil.go::DecryptPKCS- Envelope (cited in code comments; not vendored — fuzz-target ownership stays in this sub-package per the operating rule). internal/pkcs7/signedinfo.go (new, ~370 LoC) * ParseSignedData / ParseSignerInfos: parses CMS SignedData per RFC 5652 §5.3. Resolves each SignerInfo's SID (IssuerAndSerial v1 OR [0] SubjectKeyId v3) against the SignedData certificates SET to pluck the device's transient signing cert. * SignerInfo.VerifySignature: re-serialises signedAttrs as the canonical SET OF Attribute (the RFC 5652 §5.4 quirk every CMS implementation hits — wire form is [0] IMPLICIT but the signature is over EXPLICIT SET OF). Hashes with SHA-1/SHA-256/SHA-512 + verifies via RSA PKCS1v15 or ECDSA per the cert's pubkey type. * Auth-attr extractors: GetMessageType (PrintableString-decimal), GetTransactionID, GetSenderNonce, GetMessageDigest. SCEP attr OIDs pinned (RFC 8894 §3.2.1.4). internal/pkcs7/{envelopeddata,signedinfo}_fuzz_test.go (new) * FuzzParseEnvelopedData / FuzzParseSignedData / FuzzParseSignerInfos / FuzzVerifySignerInfoSignature — every parser certctl adds gets a panic-safety fuzzer (the fuzz-target-ownership rule from cowork/CLAUDE.md::Operating Rules). Local 5s runs hit ~270k executions per parser without panic. Errors are expected for arbitrary inputs; only panics are bugs. internal/pkcs7/{envelopeddata,signedinfo}_test.go (new) * Round-trip tests that materialise real RSA/ECDSA pairs, hand-build the wire bytes, parse + decrypt + verify, and assert plaintext / auth-attr equality. The build helpers use this package's ASN1Wrap primitives directly (asn1.Marshal of structs containing nested asn1.RawValue is finicky for mixed Class/Tag); gives byte-level control matching what real SCEP clients emit. * Negative tests: tampered ciphertext / tampered auth-attrs / wrong RA / wrong key / mismatched recipients / random garbage all return the appropriate sentinel error without panic. internal/service/scep.go * PKCSReqWithEnvelope: RFC 8894 envelope-aware variant. Returns *SCEPResponseEnvelope (not error + *SCEPEnrollResult) because RFC 8894 §3.3 mandates a CertRep PKIMessage on every response, even failures — the handler shouldn't translate Go errors into SCEP failInfo codes. Returns nil to signal 'invalid challenge password' so the caller can translate to HTTP 403 (matches MVP path's wire shape; RFC 8894 §3.3.1 is silent on this case). * mapServiceErrorToFailInfo: exact mapping table from the prompt (CSR parse → BadRequest, CSR sig → BadMessageCheck, crypto policy → BadAlg, default → BadRequest). internal/api/handler/scep.go * SCEPService interface gains PKCSReqWithEnvelope. * SCEPHandler now optionally carries an RA cert + key pair. SetRAPair upgrades the handler to the RFC 8894 path; without that call the handler stays MVP-only (the v2.0.x behavior). * pkiOperation: tries the RFC 8894 path FIRST when the RA pair is set. tryParseRFC8894 helper does the full pipeline (ParseSignedData → VerifySignature → extract auth-attrs → ParseEnvelopedData → Decrypt → x509.ParseCertificateRequest the recovered bytes). On any failure it falls through to the legacy extractCSRFromPKCS7 MVP path — backward compat is non-negotiable. * Phase 2 emits the legacy certs-only response on RFC 8894 success; Phase 3 (next commit) swaps in writeCertRepPKIMessage with the proper status / failInfo / nonce-echo wire shape. cmd/server/main.go * Per-profile loop now calls loadSCEPRAPair after preflight to load the cert + key + inject via SetRAPair. crypto + crypto/tls imports added. * loadSCEPRAPair helper: tls.X509KeyPair-based parse + leaf cert extraction. Failures here indicate TOCTOU between preflight + load. internal/api/handler/scep_handler_test.go + internal/api/router/router_scep_profiles_test.go * mockSCEPService / scepProfileMockService gain PKCSReqWithEnvelope stubs to satisfy the extended interface. Existing test cases unchanged (they exercise the MVP path; RA pair is unset). Verification: * gofmt + go vet clean for the files I touched. * go test -short -count=1 green across pkcs7 / api/handler / api/router / service / cmd/server. * Coverage: pkcs7 78.4% (was 100% — drops because new code includes paths the round-trip tests don't yet hit, like decryption alg fall-through and v3 SubjectKeyId SID matching). * Fuzz-target seed-corpus runs (5s each, ~270k execs/parser): no panic. Pre-merge fuzz-time bumps to 30s per the prompt's verification gate. Phase 2 of 14 in SCEP RFC 8894 + Intune master bundle. Living progress at cowork/scep-rfc8894-intune/progress.md.	2026-04-29 12:36:27 +00:00
cowork	9a01ec4023	Bundle Q (Coverage Audit Closure): property-based pilot + hygiene — L-001/L-002/L-003/L-004/I-001 closed ... Five small closures wrapping the Low-tier and Info-tier audit findings. Q.1 — cmd/cli round-out (L-001 closed) ====================================== cmd/cli/dispatch_test.go: ~30 dispatch tests across handleCerts / handleAgents / handleJobs / handleImport / handleStatus. httptest.NewTLSServer mocks the API; cli.NewClient(_, _, _, _, true) constructs an insecure-skip-verify client. Each test pins the missing-args usage-print path AND the happy-path delegation. Result: 7.1% -> 63.5% coverage (gate: >=30%). Q.2 — awssm round-out (L-002 closed) ====================================== internal/connector/discovery/awssm/awssm_edge_test.go: New() default constructor, extractKeyInfo (ECDSA/Ed25519/unknown — was RSA-only), processSecret filter arms (NamePrefix mismatch / TagFilter mismatch / empty-value / GetSecretValue error), realSMClient stub-contract pin (ListSecrets / GetSecretValue / NewRealSMClient), and EmailAddresses SAN extraction. Result: 78.2% -> 96.0% coverage (gate: >=85%). Q.3 — Property-based testing pilot (L-003 closed) ====================================== gopter@v0.2.11 added to go.mod (test-only). internal/crypto/encryption_property_test.go: - TestProperty_EncryptDecryptRoundTrip — 50 successful tests, DecryptIfKeySet(EncryptIfKeySet(x, k), k) == x - TestProperty_WrongPassphraseRejected — 30 successful tests, AEAD never returns nil-error AND bytes-equal plaintext under wrong passphrase Both skipped under -short to keep developer loop fast (PBKDF2 600k rounds × 50 iters ≈ 15s on -race CI). internal/pkcs7/length_property_test.go: - TestProperty_ASN1LengthRoundTrip — three sub-properties: decodeLength(encode(x)) == x for x ∈ [0, 2³¹−1]; short-form invariant (length<128 → 1 byte == length); long-form invariant (length>=128 → high bit set + N bytes follow). 500 successful tests in <10ms. Q.4 — Architecture diagram multi-agent update (L-004 closed) ====================================== docs/qa-test-guide.md::Architecture: ASCII diagram updated to show 'certctl-agent (×N)' + callout explaining seed_demo.sql provisions 12 agent rows (1 active, 2 retired, 9 reserved/sentinel) for Parts 04, 05, 55 + FSM coverage. Operators running parallel-agent topologies guided to AGENT_COUNT=N + 'make qa-stats'. Q.5 — Test-naming CI guard (I-001 closed) ====================================== .github/workflows/ci.yml: Test-naming convention guard added after the QA-doc seed-count drift guard. Greps for func Test<X>( missing the <X>_<Scenario> suffix. Prints first 20 non-conformant as ::warning:: annotations. continue-on-error: true (informational). Excludes TestMain + TestProperty_*. Promotion to hard-fail tracked as I-001-extended. Verification ====================================== - python3 yaml.safe_load on ci.yml: OK - go vet ./cmd/cli/... ./internal/connector/discovery/awssm/... ./internal/crypto/... ./internal/pkcs7/...: clean - go test -short -count=1 across all four packages: PASS - go test -count=1 (full property tests): PASS - crypto 15.4s (50 + 30 × 600k PBKDF2) - pkcs7 5ms Audit deliverables ====================================== - gap-backlog.md: strikethroughs on L-001/L-002/L-003/L-004/I-001 with per-finding closure note - closure-plan.md: ticks Bundle Q [x] with per-item breakdown Closes: L-001, L-002, L-003, L-004, I-001 Bundle: Q (Property-Based + Hygiene)	2026-04-27 18:36:47 +00:00
cowork	84d0aa2d5a	fix(bundle-4): EST/SCEP Attack Surface Hardening — 3 audit findings closed ... Closes 3 findings (1 High + 1 Medium + 1 Low) from /Users/shankar/Desktop/cowork/comprehensive-audit-2026-04-25/. Bundle 4 hardens the only attack surface reachable by an anonymous network attacker in certctl: the unauthenticated EST + SCEP enrollment endpoints. Findings closed: - H-004 (High): Hand-rolled ASN.1 parser had no fuzz target. The audit's original framing pointed at internal/pkcs7/, but recon confirmed that package is an ASN.1 ENCODER (BuildCertsOnlyPKCS7, ASN1Wrap*, ASN1EncodeLength) — not a parser. The actual hand-rolled PKCS#7 PARSING reachable via anonymous network is in internal/api/handler/scep.go::extractCSRFromPKCS7 + parseSignedDataForCSR. Added native go fuzz targets: * internal/api/handler/scep_fuzz_test.go::FuzzExtractCSRFromPKCS7 * internal/api/handler/scep_fuzz_test.go::FuzzParseSignedDataForCSR * internal/pkcs7/pkcs7_fuzz_test.go::FuzzPEMToDERChain (defense-in-depth) * internal/pkcs7/pkcs7_fuzz_test.go::FuzzASN1EncodeLength (defense-in-depth) Local 15s fuzz session: 150k execs on FuzzExtractCSRFromPKCS7, 937k on FuzzPEMToDERChain, 925k on FuzzASN1EncodeLength — zero panics. - M-021 (Medium): EST TLS-Unique channel binding (RFC 7030 §3.2.3). Added internal/api/handler/est.go::verifyESTTransport — defense-in-depth TLS pre-conditions (r.TLS != nil; HandshakeComplete; TLS ≥ 1.2). The full §3.2.3 channel binding only applies when EST mTLS is in use; certctl does not currently support EST mTLS, so the §3.2.3 requirement is moot today. RFC 9266 (TLS 1.3 tls-exporter) and EST mTLS are documented as deferred follow-ups in the verifyESTTransport doc comment. - L-005 (Low): EST/SCEP issuer-binding fail-loud at startup. Pre-Bundle-4 cmd/server/main.go validated that CERTCTL_EST_ISSUER_ID and CERTCTL_SCEP_ISSUER_ID existed in the registry but did NOT validate the issuer TYPE could emit a CA cert. An operator binding EST to an ACME issuer (whose GetCACertPEM returns explicit error) booted successfully and only failed at first /est/cacerts request. Post-Bundle-4: new preflightEnrollmentIssuer helper calls GetCACertPEM(ctx) at startup with a 10s timeout. Failure logs the connector error + the candidate issuer types and os.Exit(1). Tests added/modified: - internal/api/handler/est_transport_test.go (new) — 5 verifyESTTransport table cases covering plaintext-rejected, incomplete-handshake-rejected, TLS 1.0 rejected, TLS 1.2/1.3 accepted - cmd/server/preflight_test.go (new) — TestPreflightEnrollmentIssuer covering nil-connector, error-from-issuer, empty-PEM, valid cases - internal/api/handler/est_handler_test.go (modified) — 7 POST sites now stamp r.TLS to satisfy the new transport pre-condition - internal/integration/negative_test.go (modified) — setupTestServer wraps the test handler with a fake-TLS-state injector so the EST handler receives r.TLS != nil; production paths still rely on the real TLS listener Threat model reference: TB-11 (EST/SCEP client ↔ Server) per cowork/comprehensive-audit-2026-04-25/threat-model.md. Standards: RFC 7030 §3.2.3, RFC 8894 §3, RFC 5652, RFC 9266 (deferred).	2026-04-25 21:14:41 +00:00
Shankar	98bb57e6b4	feat(M51): add SCEP server (RFC 8894) for MDM and network device enrollment ... Implements Simple Certificate Enrollment Protocol with single-endpoint operation-based dispatch (GetCACaps, GetCACert, PKIOperation), PKCS#7 SignedData CSR extraction with fallback for raw/base64 CSR, challenge password authentication via CSR attributes, and shared internal/pkcs7 package extracted from EST handler to eliminate code duplication. 24 new tests (11 service + 13 handler) plus 5 shared pkcs7 package tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-15 16:47:18 -04:00