mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-15 19:29:08 +02:00
mlsmaycon
422912e7d5
A root daemon cannot reach a login keychain: securityd is per session and a key ACL needs a session to prompt in, so dropping uid is not enough. The daemon now answers certificate challenges from the System keychain itself, where MDM installs device identities, and launches "netbird posture cert-proof" into the console user's desktop session with launchctl asuser for the login keychain. Only the signature and the chain cross back, never the private key. The console user comes from SCDynamicStoreCopyConsoleUser, bound with purego like the keychain calls. The login window reports no user, root, or "loginwindow", and all three are treated as no keychain to read, so a Mac at the lock screen sends device proofs alone. Adds info logging across the path: the keychain search list, per class query status and item counts, the chain built per candidate, and the verification error for every rejected candidate. A run that sends nothing now says why. README.md documents the trust model, the console user limitation and how to read the logs.
64 lines
2.4 KiB
Go
64 lines
2.4 KiB
Go
package certproof
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/netbirdio/netbird/shared/management/certposture"
|
|
"github.com/netbirdio/netbird/shared/management/certposture/certtest"
|
|
)
|
|
|
|
func TestRunHelper_ProofSurvivesTheProcessBoundary(t *testing.T) {
|
|
ca := certtest.NewCA(t, "corp-root")
|
|
dir := t.TempDir()
|
|
key := certtest.ECDSAKey(t)
|
|
writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
|
|
|
|
challenger := certposture.NewChallenger([]byte("secret"))
|
|
nonce := challenger.Nonce(peerKey, time.Now())
|
|
request, err := json.Marshal(HelperRequest{
|
|
PeerKey: peerKey,
|
|
Challenges: []HelperChallenge{{Nonce: nonce, CACertificates: []string{ca.PEM}}},
|
|
})
|
|
require.NoError(t, err, "request must encode")
|
|
|
|
var stdout bytes.Buffer
|
|
require.NoError(t, runHelper(context.Background(), NewFileStore(dir), bytes.NewReader(request), &stdout))
|
|
|
|
var resp HelperResponse
|
|
require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "helper must emit decodable JSON")
|
|
require.Len(t, resp.Proofs, 1, "the matching certificate should produce one proof")
|
|
|
|
// Verify exactly as management does, so the proof is proven to survive the encode,
|
|
// the process boundary and the decode intact.
|
|
chain, err := challenger.Verify(resp.Proofs[0], peerKey, time.Now())
|
|
require.NoError(t, err, "the decoded proof must verify against the issued nonce")
|
|
assert.Equal(t, "device", chain[0].Subject.CommonName, "the proven leaf should be the device certificate")
|
|
}
|
|
|
|
func TestRunHelper_NoChallengesYieldsEmptyResponse(t *testing.T) {
|
|
request, err := json.Marshal(HelperRequest{PeerKey: peerKey})
|
|
require.NoError(t, err)
|
|
|
|
var stdout bytes.Buffer
|
|
require.NoError(t, runHelper(context.Background(), NewFileStore(t.TempDir()), bytes.NewReader(request), &stdout))
|
|
|
|
var resp HelperResponse
|
|
require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "an empty request must still emit valid JSON")
|
|
assert.Empty(t, resp.Proofs, "no challenges should produce no proofs")
|
|
}
|
|
|
|
func TestRunHelper_RejectsMalformedRequest(t *testing.T) {
|
|
var stdout bytes.Buffer
|
|
err := runHelper(context.Background(), NewFileStore(t.TempDir()), bytes.NewReader([]byte("not json")), &stdout)
|
|
|
|
require.Error(t, err, "a malformed request must fail rather than emit an empty proof set")
|
|
assert.Empty(t, stdout.String(), "nothing should be written to stdout on a decode failure")
|
|
}
|