mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 15:32:02 +00:00
shankar0123
5a682db8e2
+ Cisco IOS quirk fixtures + ManagedCertificate.Source provenance + EST bulk-revoke endpoint + 13 typed audit action codes. Phase 10.1 — libest reference-client sidecar: - deploy/test/libest/Dockerfile: multi-stage Debian-bookworm-slim build of Cisco's libest v3.2.0-2 from source (autoconf/automake/ libtool + libcurl4-openssl-dev + libssl-dev). Runtime stage carries only estclient + bash + openssl + ca-certificates so the exec surface stays small + predictable. - docker-compose.test.yml libest-client entry (profiles: [est-e2e]) with bind mounts for /config/est (test workspace) + /config/certs (certctl CA bundle for TLS pinning); IP 10.30.50.9 (10.30.50.8 was already taken by certctl-agent). - deploy/test/est/.gitkeep keeps the bind-mount target tracked. Phase 10.2 — 5 integration tests (//go:build integration) in deploy/test/est_e2e_test.go: - TestEST_LibESTClient_Enrollment_Integration (cacerts → simpleenroll → cert-shape assertion) - TestEST_LibESTClient_MTLSEnrollment_Integration (mTLS sibling-route cert auth; skip when bootstrap cert absent) - TestEST_LibESTClient_ServerKeygen_Integration (RFC 7030 §4.4 multipart; skip when profile gate disabled) - TestEST_LibESTClient_RateLimited_Integration (4th enroll trips per-principal cap, asserts 429-shaped error) - TestEST_LibESTClient_ChannelBinding_Integration (libest --tls-exporter; skip when libest build lacks the flag). - requireESTSidecar guard skips the suite when the operator forgot --profile est-e2e; helpful error message includes the exact command to bring the sidecar up. Phase 10.3 — Cisco IOS quirk fixtures + 3 unit tests in internal/api/handler/cisco_ios_quirks_test.go: - testdata/cisco_ios_15x_pem_csr.txt: PEM body sent with Content-Type application/x-pem-file. Handler dispatches on body-prefix not Content-Type — accepts cleanly. - testdata/cisco_ios_16x_trailing_newline_csr.txt: extra trailing newlines after base64 body. strings.TrimSpace tolerates. - testdata/cisco_ios_crlf_b64_csr.txt: CRLF-wrapped base64. base64.StdEncoding handles CRLF + LF identically. Phase 11.1 — ManagedCertificate.Source provenance: - New domain.CertificateSource enum (Unspecified/EST/SCEP/API/Agent). - Migration 000023_managed_certificates_source.up.sql adds source TEXT NOT NULL DEFAULT '' so existing rows scan as CertificateSourceUnspecified — back-compat: bulk-revoke filter treats empty as "any source". - Postgres repo Insert/Update/scan paths all wire the new column. Phase 11.2 — EST bulk-revoke endpoint: - BulkRevocationCriteria.Source field (Source-only requests rejected as too broad — must accompany at least one narrower criterion). - service.bulk_revocation.resolveCertificates post-filter by Source (empty=any, no SQL change so existing CertificateFilter callers unaffected). - New BulkRevocationHandler.BulkRevokeEST method pins Source=EST + dispatches; new route POST /api/v1/est/certificates/bulk-revoke (M-008 admin-gated). openapi.yaml documented + parity-guard green. Phase 11.3 — 13 typed audit action codes in internal/service/est_audit_actions.go: - est_simple_enroll_success / _failed - est_simple_reenroll_success / _failed - est_server_keygen_success / _failed - est_auth_failed_basic / _mtls / _channel_binding - est_rate_limited - est_csr_policy_violation - est_bulk_revoke - est_trust_anchor_reloaded - ESTService.processEnrollment + SimpleServerKeygen + ReloadTrust split-emit BOTH the legacy bare action codes (back-compat for the GUI activity-tab chip filters that match by exact string + existing audit-log analysers) AND the new typed _success / _failed variants (operator grep target + per-failure-mode counter). Tests: - internal/api/handler/bulk_revocation_est_test.go — 5 cases (admin-true happy path pins Source=EST + non-admin 403 + empty-criteria 400 + invalid-reason 400 + method-not-allowed). - internal/service/est_audit_actions_test.go — 5 cases (SimpleEnroll legacy+typed emission / SimpleReEnroll typed / IssuerError typed-failed / PolicyViolation triple-emit / unique-string invariant). Pre-commit verification (sandbox): gofmt clean, go vet clean (excluding repository/postgres testcontainers limit), staticcheck clean across api/handler/api/router/domain/service/deploy/test, go test -short -count=1 green for every non-postgres Go package + integration build (`go build -tags integration ./deploy/test/...`) clean. G-3 docs-drift guard reproduced locally clean (Phases 10-11 added zero new env vars). Spec preserved at cowork/est-rfc7030-hardening-prompt.md. Phases 12-13 (docs/est.md + WiFi/802.1X / IoT bootstrap / FreeRADIUS recipes; release prep + tag) remain — post-2.1.0 work.
79 lines
2.8 KiB
Docker
79 lines
2.8 KiB
Docker
# EST RFC 7030 hardening master bundle Phase 10.1 — libest sidecar.
|
|
#
|
|
# Multi-stage build of Cisco's libest reference client, used as the
|
|
# canonical RFC 7030 client for the certctl integration test suite.
|
|
#
|
|
# Source: https://github.com/cisco/libest (the upstream reference
|
|
# implementation; last tag 3.2.0-2 from 2018, but the protocol surface
|
|
# we exercise is stable RFC 7030). We build from source rather than
|
|
# pulling a published image because no official Cisco image exists on
|
|
# Docker Hub + reproducible offline-friendly builds need a pinned ref.
|
|
#
|
|
# The builder stage compiles libest + its OpenSSL dependency; the
|
|
# runtime stage carries only the compiled `estclient` binary +
|
|
# `openssl` + `bash` so the integration test (which docker-execs into
|
|
# the container) has a small, predictable surface.
|
|
#
|
|
# Build (from repo root):
|
|
# docker build -f deploy/test/libest/Dockerfile -t certctl/libest:test .
|
|
#
|
|
# CI uses `docker compose --profile est-e2e build libest-client` to
|
|
# orchestrate the build alongside the rest of the test stack.
|
|
|
|
ARG LIBEST_REF=v3.2.0-2
|
|
|
|
FROM debian:bookworm-slim AS builder
|
|
|
|
ARG LIBEST_REF
|
|
|
|
# Build deps. We use the system openssl (1.1.1n in bookworm-slim) which
|
|
# is the same major version libest 3.2.0-2 was tested against. libest
|
|
# also wants libcurl + libsafec; we install both via apt rather than
|
|
# building from source for reproducibility.
|
|
RUN apt-get update && apt-get install --no-install-recommends -y \
|
|
autoconf \
|
|
automake \
|
|
build-essential \
|
|
ca-certificates \
|
|
git \
|
|
libcurl4-openssl-dev \
|
|
libssl-dev \
|
|
libtool \
|
|
pkg-config \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /src
|
|
|
|
RUN git clone --depth 1 --branch ${LIBEST_REF} https://github.com/cisco/libest.git . \
|
|
&& ./configure --prefix=/opt/libest --disable-shared --enable-static \
|
|
&& make -j"$(nproc)" \
|
|
&& make install
|
|
|
|
# Runtime stage. Carries only what we need to docker-exec estclient
|
|
# from the integration test: the compiled binary, the openssl CLI for
|
|
# CSR generation + cert parsing, and bash for the test's exec scripts.
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install --no-install-recommends -y \
|
|
bash \
|
|
ca-certificates \
|
|
curl \
|
|
libcurl4 \
|
|
libssl3 \
|
|
openssl \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd --create-home --uid 1000 estuser
|
|
|
|
COPY --from=builder /opt/libest/bin/estclient /usr/local/bin/estclient
|
|
|
|
# /config/est is the working dir the integration test mounts; /config/certs
|
|
# carries certctl's CA bundle (./test/certs/ca.crt) for TLS pinning.
|
|
RUN mkdir -p /config/est /config/certs && chown -R estuser:estuser /config
|
|
|
|
USER estuser
|
|
WORKDIR /config/est
|
|
|
|
# Container stays alive so the integration test can docker-exec into
|
|
# it; matches the spec's `command: sleep infinity` directive.
|
|
CMD ["sleep", "infinity"]
|