Add envelope sign/verify IPC commands and pilotctl front-ends #350
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| // SPDX-License-Identifier: AGPL-3.0-or-later | ||
|
|
||
| package main | ||
|
|
||
| import ( | ||
| "os" | ||
|
|
||
| "github.com/pilot-protocol/common/reqsig" | ||
|
Check failure on line 8 in cmd/pilotctl/sign_request.go
|
||
| ) | ||
|
|
||
| // cmdSignRequest asks the daemon to sign a request-signature envelope | ||
| // (common/reqsig) for a consuming service. The daemon constructs the | ||
| // envelope itself (its own address, current timestamp, fresh nonce) — the | ||
| // CLI only supplies the audience and the body hash. Exactly one body | ||
| // source is required: | ||
| // | ||
| // pilotctl sign-request --audience svc.example.io --body-file req.json | ||
| // pilotctl sign-request --audience svc.example.io --body '{"q":"x"}' | ||
| // pilotctl sign-request --audience svc.example.io --body-hash <64 hex> | ||
| func cmdSignRequest(args []string) { | ||
| flags, _ := parseFlags(args) | ||
| audience := flagString(flags, "audience", "") | ||
| if audience == "" { | ||
| fatalCode("invalid_argument", "usage: pilotctl sign-request --audience <a> (--body-file <f> | --body-hash <64hex> | --body '<string>')") | ||
| } | ||
|
|
||
| bodyHash := flagString(flags, "body-hash", "") | ||
| bodyFile := flagString(flags, "body-file", "") | ||
| body, bodySet := flags["body"] | ||
| sources := 0 | ||
| if bodyHash != "" { | ||
| sources++ | ||
| } | ||
| if bodyFile != "" { | ||
| sources++ | ||
| } | ||
| if bodySet { | ||
| sources++ | ||
| } | ||
| if sources != 1 { | ||
| fatalCode("invalid_argument", "sign-request: exactly one of --body-file, --body-hash, --body is required") | ||
| } | ||
| switch { | ||
| case bodyFile != "": | ||
| data, err := os.ReadFile(bodyFile) | ||
Check failureCode scanning / gosec Potential file inclusion via variable Error |
||
| if err != nil { | ||
| fatalCode("invalid_argument", "sign-request: read %s: %v", bodyFile, err) | ||
| } | ||
| bodyHash = reqsig.HashBody(data) | ||
| case bodySet: | ||
| bodyHash = reqsig.HashBody([]byte(body)) | ||
| } | ||
|
|
||
| d := connectDriver() | ||
| defer d.Close() | ||
| resp, err := d.SignEnvelope(audience, bodyHash) | ||
| if err != nil { | ||
| fatalCode("connection_failed", "sign-request: %v", err) | ||
| } | ||
| output(map[string]interface{}{ | ||
| "envelope": resp["envelope"], | ||
| "signature": resp["signature"], | ||
| "address": resp["address"], | ||
| }) | ||
| } | ||
|
|
||
| // cmdVerifyRequest checks a reqsig envelope + signature via the daemon, | ||
| // which resolves the claimed node's key from its local cache first and the | ||
| // registry on miss. Prints the daemon's reply; exits 1 when the daemon | ||
| // reports valid:false. | ||
| func cmdVerifyRequest(args []string) { | ||
| flags, _ := parseFlags(args) | ||
| envelope := flagString(flags, "envelope", "") | ||
| sig := flagString(flags, "signature", "") | ||
| if envelope == "" || sig == "" { | ||
| fatalCode("invalid_argument", "usage: pilotctl verify-request --envelope '<canonical>' --signature '<b64>' [--standing] [--max-skew <secs>]") | ||
| } | ||
| standing := flagBool(flags, "standing") | ||
| maxSkew := flagInt(flags, "max-skew", 0) | ||
| if maxSkew < 0 { | ||
| fatalCode("invalid_argument", "verify-request: --max-skew must be >= 0") | ||
| } | ||
|
|
||
| d := connectDriver() | ||
| defer d.Close() | ||
| resp, err := d.VerifyEnvelopeMaxSkew(envelope, sig, standing, uint32(maxSkew)) | ||
|
Check failure on line 86 in cmd/pilotctl/sign_request.go
|
||
|
github-advanced-security[bot] marked this conversation as resolved.
Fixed
github-advanced-security[bot] marked this conversation as resolved.
Fixed
|
||
| if err != nil { | ||
| fatalCode("connection_failed", "verify-request: %v", err) | ||
| } | ||
| output(resp) | ||
| if valid, _ := resp["valid"].(bool); !valid { | ||
| os.Exit(1) | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,184 @@ | ||
| // SPDX-License-Identifier: AGPL-3.0-or-later | ||
|
|
||
| package main | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "github.com/pilot-protocol/common/reqsig" | ||
| ) | ||
|
|
||
| // IPC cmd codes for the request-signature envelope commands — must match | ||
| // daemon CmdSignEnvelope/CmdVerifyEnvelope and driver cmdSignEnvelope/ | ||
| // cmdVerifyEnvelope. Kept here (not zz_fake_daemon_test.go) alongside the | ||
| // only tests that use them. | ||
| const ( | ||
| tdCmdSignEnvelope byte = 0x33 | ||
| tdCmdSignEnvelopeOK byte = 0x34 | ||
| tdCmdVerifyEnvelope byte = 0x35 | ||
| tdCmdVerifyEnvelopeOK byte = 0x36 | ||
| ) | ||
|
|
||
| // receivedPayload scans the fake daemon's received frames for cmd and | ||
| // returns the decoded JSON payload of the first match. | ||
| func receivedPayload(t *testing.T, d *fakeDaemon, cmd byte) map[string]interface{} { | ||
| t.Helper() | ||
| d.mu.Lock() | ||
| defer d.mu.Unlock() | ||
| for _, frame := range d.received { | ||
| if len(frame) > 1 && frame[0] == cmd { | ||
| var got map[string]interface{} | ||
| if err := json.Unmarshal(frame[1:], &got); err != nil { | ||
| t.Fatalf("frame 0x%02X payload not JSON: %v", cmd, err) | ||
| } | ||
| return got | ||
| } | ||
| } | ||
| t.Fatalf("no frame with cmd 0x%02X received", cmd) | ||
| return nil | ||
| } | ||
|
|
||
| // TestCLISignRequestEnvelope covers the happy path: the CLI hashes --body | ||
| // locally, sends {audience, body_hash} to the daemon, and prints | ||
| // {envelope, signature, address}. | ||
| func TestCLISignRequestEnvelope(t *testing.T) { | ||
| t.Parallel() | ||
| d := newFakeDaemon(t) | ||
| d.onJSON(tdCmdSignEnvelope, tdCmdSignEnvelopeOK, | ||
| `{"type":"sign_envelope_ok","envelope":"pilot-req-v1|env","signature":"c2ln","address":"0:0000.0000.0007"}`) | ||
|
|
||
| stdout, stderr, code := runCLI(t, []string{ | ||
| "--json", "sign-request", | ||
| "--audience", "svc.example.io", | ||
| "--body", "hello envelope", | ||
| }, map[string]string{"PILOT_SOCKET": d.path}) | ||
| if code != 0 { | ||
| t.Fatalf("exit=%d\nstdout=%s\nstderr=%s", code, stdout, stderr) | ||
| } | ||
|
|
||
| var env map[string]interface{} | ||
| if err := json.Unmarshal([]byte(stdout), &env); err != nil { | ||
| t.Fatalf("json: %v (stdout=%q)", err, stdout) | ||
| } | ||
| data, _ := env["data"].(map[string]interface{}) | ||
| if data["envelope"] != "pilot-req-v1|env" || data["signature"] != "c2ln" || data["address"] != "0:0000.0000.0007" { | ||
| t.Errorf("data = %+v", data) | ||
| } | ||
|
|
||
| // The daemon must have been asked for the locally computed sha256, never | ||
| // the raw body. | ||
| got := receivedPayload(t, d, tdCmdSignEnvelope) | ||
| if got["audience"] != "svc.example.io" { | ||
| t.Errorf("audience = %v", got["audience"]) | ||
| } | ||
| if got["body_hash"] != reqsig.HashBody([]byte("hello envelope")) { | ||
| t.Errorf("body_hash = %v, want sha256 of --body", got["body_hash"]) | ||
| } | ||
| } | ||
|
|
||
| func TestCLISignRequestEnvelopeRequiresAudience(t *testing.T) { | ||
| t.Parallel() | ||
| _, stderr, code := runCLI(t, []string{"sign-request", "--body", "x"}, nil) | ||
| if code == 0 { | ||
| t.Error("expected non-zero exit without --audience") | ||
| } | ||
| if !strings.Contains(stderr, "audience") { | ||
| t.Errorf("expected usage mention of --audience, got: %s", stderr) | ||
| } | ||
| } | ||
|
|
||
| func TestCLISignRequestEnvelopeRequiresOneBodySource(t *testing.T) { | ||
| t.Parallel() | ||
| // None given. | ||
| _, stderr, code := runCLI(t, []string{"sign-request", "--audience", "svc.example.io"}, nil) | ||
| if code == 0 { | ||
| t.Error("expected non-zero exit without a body source") | ||
| } | ||
| if !strings.Contains(stderr, "exactly one") { | ||
| t.Errorf("expected 'exactly one' error, got: %s", stderr) | ||
| } | ||
| // Two given. | ||
| _, stderr, code = runCLI(t, []string{ | ||
| "sign-request", "--audience", "svc.example.io", | ||
| "--body", "x", "--body-hash", strings.Repeat("a", 64), | ||
| }, nil) | ||
| if code == 0 { | ||
| t.Error("expected non-zero exit with two body sources") | ||
| } | ||
| if !strings.Contains(stderr, "exactly one") { | ||
| t.Errorf("expected 'exactly one' error, got: %s", stderr) | ||
| } | ||
| } | ||
|
|
||
| // TestCLIVerifyRequestEnvelopeValid: a valid verdict prints the daemon reply | ||
| // and exits 0; flags round-trip onto the wire. | ||
| func TestCLIVerifyRequestEnvelopeValid(t *testing.T) { | ||
| t.Parallel() | ||
| d := newFakeDaemon(t) | ||
| d.onJSON(tdCmdVerifyEnvelope, tdCmdVerifyEnvelopeOK, | ||
| `{"type":"verify_envelope_ok","valid":true,"node_id":7,"address":"0:0000.0000.0007","verified_via":"cache","trusted":true}`) | ||
|
|
||
| stdout, stderr, code := runCLI(t, []string{ | ||
| "--json", "verify-request", | ||
| "--envelope", "pilot-req-v1|env", | ||
| "--signature", "c2ln", | ||
| "--standing", | ||
| "--max-skew", "600", | ||
| }, map[string]string{"PILOT_SOCKET": d.path}) | ||
| if code != 0 { | ||
| t.Fatalf("exit=%d\nstdout=%s\nstderr=%s", code, stdout, stderr) | ||
| } | ||
| var env map[string]interface{} | ||
| if err := json.Unmarshal([]byte(stdout), &env); err != nil { | ||
| t.Fatalf("json: %v (stdout=%q)", err, stdout) | ||
| } | ||
| data, _ := env["data"].(map[string]interface{}) | ||
| if valid, _ := data["valid"].(bool); !valid { | ||
| t.Errorf("data = %+v, want valid=true", data) | ||
| } | ||
|
|
||
| got := receivedPayload(t, d, tdCmdVerifyEnvelope) | ||
| if got["envelope"] != "pilot-req-v1|env" || got["signature"] != "c2ln" { | ||
| t.Errorf("payload = %+v", got) | ||
| } | ||
| if cs, _ := got["check_standing"].(bool); !cs { | ||
| t.Errorf("check_standing = %v, want true (--standing)", got["check_standing"]) | ||
| } | ||
| if skew, _ := got["max_skew_secs"].(float64); skew != 600 { | ||
| t.Errorf("max_skew_secs = %v, want 600 (--max-skew)", got["max_skew_secs"]) | ||
| } | ||
| } | ||
|
|
||
| // TestCLIVerifyRequestEnvelopeInvalidExitsOne: valid:false still prints the | ||
| // verdict but the process exits 1 (scriptable gate). | ||
| func TestCLIVerifyRequestEnvelopeInvalidExitsOne(t *testing.T) { | ||
| t.Parallel() | ||
| d := newFakeDaemon(t) | ||
| d.onJSON(tdCmdVerifyEnvelope, tdCmdVerifyEnvelopeOK, | ||
| `{"type":"verify_envelope_ok","valid":false,"reason":"reqsig: signature verification failed"}`) | ||
|
|
||
| stdout, _, code := runCLI(t, []string{ | ||
| "--json", "verify-request", | ||
| "--envelope", "pilot-req-v1|env", | ||
| "--signature", "c2ln", | ||
| }, map[string]string{"PILOT_SOCKET": d.path}) | ||
| if code != 1 { | ||
| t.Fatalf("exit=%d, want 1 on valid:false", code) | ||
| } | ||
| if !strings.Contains(stdout, "signature verification failed") { | ||
| t.Errorf("verdict reason missing from output: %s", stdout) | ||
| } | ||
| } | ||
|
|
||
| func TestCLIVerifyRequestEnvelopeRequiresArgs(t *testing.T) { | ||
| t.Parallel() | ||
| _, stderr, code := runCLI(t, []string{"verify-request", "--envelope", "e"}, nil) | ||
| if code == 0 { | ||
| t.Error("expected non-zero exit without --signature") | ||
| } | ||
| if !strings.Contains(stderr, "--signature") && !strings.Contains(stderr, "signature") { | ||
| t.Errorf("expected usage mention of --signature, got: %s", stderr) | ||
| } | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.