mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 15:11:29 +00:00
shankar0123
5a682db8e2
+ Cisco IOS quirk fixtures + ManagedCertificate.Source provenance + EST bulk-revoke endpoint + 13 typed audit action codes. Phase 10.1 — libest reference-client sidecar: - deploy/test/libest/Dockerfile: multi-stage Debian-bookworm-slim build of Cisco's libest v3.2.0-2 from source (autoconf/automake/ libtool + libcurl4-openssl-dev + libssl-dev). Runtime stage carries only estclient + bash + openssl + ca-certificates so the exec surface stays small + predictable. - docker-compose.test.yml libest-client entry (profiles: [est-e2e]) with bind mounts for /config/est (test workspace) + /config/certs (certctl CA bundle for TLS pinning); IP 10.30.50.9 (10.30.50.8 was already taken by certctl-agent). - deploy/test/est/.gitkeep keeps the bind-mount target tracked. Phase 10.2 — 5 integration tests (//go:build integration) in deploy/test/est_e2e_test.go: - TestEST_LibESTClient_Enrollment_Integration (cacerts → simpleenroll → cert-shape assertion) - TestEST_LibESTClient_MTLSEnrollment_Integration (mTLS sibling-route cert auth; skip when bootstrap cert absent) - TestEST_LibESTClient_ServerKeygen_Integration (RFC 7030 §4.4 multipart; skip when profile gate disabled) - TestEST_LibESTClient_RateLimited_Integration (4th enroll trips per-principal cap, asserts 429-shaped error) - TestEST_LibESTClient_ChannelBinding_Integration (libest --tls-exporter; skip when libest build lacks the flag). - requireESTSidecar guard skips the suite when the operator forgot --profile est-e2e; helpful error message includes the exact command to bring the sidecar up. Phase 10.3 — Cisco IOS quirk fixtures + 3 unit tests in internal/api/handler/cisco_ios_quirks_test.go: - testdata/cisco_ios_15x_pem_csr.txt: PEM body sent with Content-Type application/x-pem-file. Handler dispatches on body-prefix not Content-Type — accepts cleanly. - testdata/cisco_ios_16x_trailing_newline_csr.txt: extra trailing newlines after base64 body. strings.TrimSpace tolerates. - testdata/cisco_ios_crlf_b64_csr.txt: CRLF-wrapped base64. base64.StdEncoding handles CRLF + LF identically. Phase 11.1 — ManagedCertificate.Source provenance: - New domain.CertificateSource enum (Unspecified/EST/SCEP/API/Agent). - Migration 000023_managed_certificates_source.up.sql adds source TEXT NOT NULL DEFAULT '' so existing rows scan as CertificateSourceUnspecified — back-compat: bulk-revoke filter treats empty as "any source". - Postgres repo Insert/Update/scan paths all wire the new column. Phase 11.2 — EST bulk-revoke endpoint: - BulkRevocationCriteria.Source field (Source-only requests rejected as too broad — must accompany at least one narrower criterion). - service.bulk_revocation.resolveCertificates post-filter by Source (empty=any, no SQL change so existing CertificateFilter callers unaffected). - New BulkRevocationHandler.BulkRevokeEST method pins Source=EST + dispatches; new route POST /api/v1/est/certificates/bulk-revoke (M-008 admin-gated). openapi.yaml documented + parity-guard green. Phase 11.3 — 13 typed audit action codes in internal/service/est_audit_actions.go: - est_simple_enroll_success / _failed - est_simple_reenroll_success / _failed - est_server_keygen_success / _failed - est_auth_failed_basic / _mtls / _channel_binding - est_rate_limited - est_csr_policy_violation - est_bulk_revoke - est_trust_anchor_reloaded - ESTService.processEnrollment + SimpleServerKeygen + ReloadTrust split-emit BOTH the legacy bare action codes (back-compat for the GUI activity-tab chip filters that match by exact string + existing audit-log analysers) AND the new typed _success / _failed variants (operator grep target + per-failure-mode counter). Tests: - internal/api/handler/bulk_revocation_est_test.go — 5 cases (admin-true happy path pins Source=EST + non-admin 403 + empty-criteria 400 + invalid-reason 400 + method-not-allowed). - internal/service/est_audit_actions_test.go — 5 cases (SimpleEnroll legacy+typed emission / SimpleReEnroll typed / IssuerError typed-failed / PolicyViolation triple-emit / unique-string invariant). Pre-commit verification (sandbox): gofmt clean, go vet clean (excluding repository/postgres testcontainers limit), staticcheck clean across api/handler/api/router/domain/service/deploy/test, go test -short -count=1 green for every non-postgres Go package + integration build (`go build -tags integration ./deploy/test/...`) clean. G-3 docs-drift guard reproduced locally clean (Phases 10-11 added zero new env vars). Spec preserved at cowork/est-rfc7030-hardening-prompt.md. Phases 12-13 (docs/est.md + WiFi/802.1X / IoT bootstrap / FreeRADIUS recipes; release prep + tag) remain — post-2.1.0 work.
41 lines
2.0 KiB
Go
41 lines
2.0 KiB
Go
package service
|
|
|
|
// EST RFC 7030 hardening master bundle Phase 11.3 — typed audit action
|
|
// codes. Each maps to a unique counter label so operators grep the
|
|
// audit log on these exact strings.
|
|
//
|
|
// Naming contract: every code is `est_<flow>_<outcome>` where
|
|
//
|
|
// <flow> = simple_enroll | simple_reenroll | server_keygen | auth_failed_<mode> | rate_limited | csr_policy_violation | bulk_revoke | trust_anchor_reloaded
|
|
// <outcome> = success | failed (only on the three success/failure-paired flows)
|
|
//
|
|
// Pre-Phase-11 the audit log carried bare action codes (est_simple_enroll
|
|
// without the _success suffix). The GUI activity-tab filter chips
|
|
// (web/src/pages/ESTAdminPage.tsx) match by `startsWith()` after the
|
|
// Phase 11 cutover so both old + new strings continue to render under
|
|
// the right chip.
|
|
const (
|
|
// Three success/failure-paired enrollment flows. The success codes
|
|
// share a prefix with the legacy bare codes so a deployment running
|
|
// the old audit-log analyser continues to find every enrollment.
|
|
AuditActionESTSimpleEnrollSuccess = "est_simple_enroll_success"
|
|
AuditActionESTSimpleEnrollFailed = "est_simple_enroll_failed"
|
|
AuditActionESTSimpleReEnrollSuccess = "est_simple_reenroll_success"
|
|
AuditActionESTSimpleReEnrollFailed = "est_simple_reenroll_failed"
|
|
AuditActionESTServerKeygenSuccess = "est_server_keygen_success"
|
|
AuditActionESTServerKeygenFailed = "est_server_keygen_failed"
|
|
|
|
// Per-mode auth-failure codes. Emitted by the handler at the auth-
|
|
// gate trip points so operators can filter "Basic-auth failures
|
|
// from this source IP" cleanly.
|
|
AuditActionESTAuthFailedBasic = "est_auth_failed_basic"
|
|
AuditActionESTAuthFailedMTLS = "est_auth_failed_mtls"
|
|
AuditActionESTAuthFailedChannelBinding = "est_auth_failed_channel_binding"
|
|
|
|
// Operational events.
|
|
AuditActionESTRateLimited = "est_rate_limited"
|
|
AuditActionESTCSRPolicyViolation = "est_csr_policy_violation"
|
|
AuditActionESTBulkRevoke = "est_bulk_revoke"
|
|
AuditActionESTTrustAnchorReloaded = "est_trust_anchor_reloaded"
|
|
)
|