feat(tunnel): zero-touch tunnel enrollment — control-plane PKI, host agent, iOS, nginx isolation
Customers install one command / log in once; hardware-generated keys never leave the device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12, no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md. Control-plane / PKI (control-plane/): - ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256) - ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing - ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers - ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert) - registry/devices.ts: device registry + per-account cap/rate-limit - auth/session.ts: device:enroll capability token mint/verify - api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default) - pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm - boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast) Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind) Host agent (agent/): - transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract) - keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE - net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient + Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap) Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403 Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85, iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy, VPS frps, physical iPhone) per PROGRESS_LOG runbook. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Yaojia Wang
133
control-plane/test/device-issue.test.ts
Normal file
133
control-plane/test/device-issue.test.ts
Normal file
@@ -0,0 +1,133 @@
|
||||
/**
|
||||
* A4 (FIX C-2) — P-256 device leaf issuance off the device-CA via `assembleCertificate`. Proves the
|
||||
* leaf re-parses + verifies against the device-CA public key; carries SAN dNSName `<sub>.terminal.yaojia.wang`
|
||||
* + the device SPIFFE URI (`.../device/<did>`, parseable by relay-auth as kind 'device'); is
|
||||
* clientAuth / CA:false; and that the registry gate rejects uniformly (unknown / revoked / pubkey mismatch).
|
||||
*/
|
||||
import 'reflect-metadata'
|
||||
import { describe, test, expect } from 'vitest'
|
||||
import * as x509 from '@peculiar/x509'
|
||||
import { webcrypto } from 'node:crypto'
|
||||
import { parseSpiffeId } from 'relay-auth/src/agent/spiffe.js'
|
||||
import { buildCsrEc } from '../src/ca/csr-ec.js'
|
||||
import { inProcessP256CaSigner } from '../src/boot/ca-wiring.js'
|
||||
import { createDeviceLeafSigner, DeviceLeafSignError } from '../src/ca/device-issue.js'
|
||||
import { createMemoryDeviceStore, type DeviceRecord } from '../src/registry/devices.js'
|
||||
|
||||
x509.cryptoProvider.set(webcrypto)
|
||||
|
||||
const SAN_BASE = 'terminal.yaojia.wang'
|
||||
const TRUST_DOMAIN = 'example.com'
|
||||
const ACCOUNT_A = 'a1'
|
||||
|
||||
async function spkiOf(pub: CryptoKey): Promise<Uint8Array> {
|
||||
return new Uint8Array(await webcrypto.subtle.exportKey('spki', pub))
|
||||
}
|
||||
|
||||
function record(overrides: Partial<DeviceRecord>): DeviceRecord {
|
||||
const now = Date.now()
|
||||
return {
|
||||
deviceId: 'dev-1',
|
||||
accountId: ACCOUNT_A,
|
||||
subdomainScope: 'alice',
|
||||
ecPubkeySpki: new Uint8Array([1, 2, 3]),
|
||||
serial: '0102030405060708090a0b0c0d0e0f10',
|
||||
status: 'active',
|
||||
notAfter: new Date(now + 24 * 60 * 60 * 1000).toISOString(),
|
||||
attestationLevel: 'none',
|
||||
createdAt: new Date(now).toISOString(),
|
||||
revokedAt: null,
|
||||
...overrides,
|
||||
}
|
||||
}
|
||||
|
||||
async function fixture() {
|
||||
const ca = inProcessP256CaSigner()
|
||||
const store = createMemoryDeviceStore()
|
||||
const signer = createDeviceLeafSigner({
|
||||
signer: ca,
|
||||
issuer: 'CN=device-CA',
|
||||
caChainDer: [ca.publicKeyRaw],
|
||||
sanBaseDomain: SAN_BASE,
|
||||
trustDomain: TRUST_DOMAIN,
|
||||
devices: store,
|
||||
})
|
||||
const { der: csr, keys } = await buildCsrEc('CN=web-terminal-device')
|
||||
const embeddedSpki = await spkiOf(keys.publicKey)
|
||||
return { ca, store, signer, csr, embeddedSpki }
|
||||
}
|
||||
|
||||
async function importP256Public(spkiDer: Uint8Array): Promise<CryptoKey> {
|
||||
return webcrypto.subtle.importKey('spki', new Uint8Array(spkiDer), { name: 'ECDSA', namedCurve: 'P-256' }, true, [
|
||||
'verify',
|
||||
])
|
||||
}
|
||||
|
||||
describe('A4 device-issue — real P-256 device leaf', () => {
|
||||
test('leaf re-parses and verifies against the device-CA public key', async () => {
|
||||
const { ca, store, signer, csr, embeddedSpki } = await fixture()
|
||||
await store.insert(record({ deviceId: 'dev-1', ecPubkeySpki: embeddedSpki }))
|
||||
const { cert } = await signer.signDeviceLeaf('dev-1', csr)
|
||||
const leaf = new x509.X509Certificate(cert)
|
||||
expect(() => new x509.X509Certificate(cert)).not.toThrow()
|
||||
const caPub = await importP256Public(ca.publicKeyRaw)
|
||||
expect(await leaf.verify({ publicKey: caPub, signatureOnly: true })).toBe(true)
|
||||
})
|
||||
|
||||
test('SAN carries dNSName <sub>.terminal.yaojia.wang + the device SPIFFE URI', async () => {
|
||||
const { store, signer, csr, embeddedSpki } = await fixture()
|
||||
await store.insert(record({ deviceId: 'dev-1', accountId: ACCOUNT_A, subdomainScope: 'alice', ecPubkeySpki: embeddedSpki }))
|
||||
const { cert } = await signer.signDeviceLeaf('dev-1', csr)
|
||||
const san = new x509.X509Certificate(cert).getExtension(x509.SubjectAlternativeNameExtension)
|
||||
const names = san!.names.toJSON()
|
||||
expect(names).toContainEqual({ type: 'dns', value: 'alice.terminal.yaojia.wang' })
|
||||
const uri = names.find((n) => n.type === 'url')!.value
|
||||
const parsed = parseSpiffeId(uri)
|
||||
expect(parsed).toEqual({ accountId: ACCOUNT_A, kind: 'device', id: 'dev-1' })
|
||||
})
|
||||
|
||||
test('leaf is EKU clientAuth and CA:false', async () => {
|
||||
const { store, signer, csr, embeddedSpki } = await fixture()
|
||||
await store.insert(record({ deviceId: 'dev-1', ecPubkeySpki: embeddedSpki }))
|
||||
const { cert } = await signer.signDeviceLeaf('dev-1', csr)
|
||||
const leaf = new x509.X509Certificate(cert)
|
||||
const bc = leaf.getExtension(x509.BasicConstraintsExtension)
|
||||
expect(bc!.ca).toBe(false)
|
||||
const eku = leaf.getExtension(x509.ExtendedKeyUsageExtension)
|
||||
expect(eku!.usages).toContain(x509.ExtendedKeyUsage.clientAuth)
|
||||
})
|
||||
|
||||
test('result reports serial + validity from the gated record', async () => {
|
||||
const { store, signer, csr, embeddedSpki } = await fixture()
|
||||
const rec = record({ deviceId: 'dev-1', ecPubkeySpki: embeddedSpki })
|
||||
await store.insert(rec)
|
||||
const res = await signer.signDeviceLeaf('dev-1', csr)
|
||||
expect(res.serial).toBe(rec.serial)
|
||||
expect(res.notAfter.toISOString()).toBe(rec.notAfter)
|
||||
expect(res.notBefore.getTime()).toBeLessThan(Date.now())
|
||||
})
|
||||
|
||||
test('gate rejects an UNKNOWN device uniformly', async () => {
|
||||
const { signer, csr } = await fixture()
|
||||
await expect(signer.signDeviceLeaf('ghost', csr)).rejects.toBeInstanceOf(DeviceLeafSignError)
|
||||
})
|
||||
|
||||
test('gate rejects a REVOKED device uniformly', async () => {
|
||||
const { store, signer, csr, embeddedSpki } = await fixture()
|
||||
await store.insert(record({ deviceId: 'dev-1', status: 'revoked', revokedAt: new Date().toISOString(), ecPubkeySpki: embeddedSpki }))
|
||||
await expect(signer.signDeviceLeaf('dev-1', csr)).rejects.toBeInstanceOf(DeviceLeafSignError)
|
||||
})
|
||||
|
||||
test('gate rejects a pubkey MISMATCH (CSR key ≠ registered key) uniformly', async () => {
|
||||
const { store, signer, csr } = await fixture()
|
||||
// register with a DIFFERENT pubkey than the CSR embeds
|
||||
await store.insert(record({ deviceId: 'dev-1', ecPubkeySpki: new Uint8Array([7, 7, 7, 7]) }))
|
||||
await expect(signer.signDeviceLeaf('dev-1', csr)).rejects.toBeInstanceOf(DeviceLeafSignError)
|
||||
})
|
||||
|
||||
test('gate rejects a malformed CSR uniformly', async () => {
|
||||
const { store, signer, embeddedSpki } = await fixture()
|
||||
await store.insert(record({ deviceId: 'dev-1', ecPubkeySpki: embeddedSpki }))
|
||||
await expect(signer.signDeviceLeaf('dev-1', new Uint8Array([0, 1, 2, 3]))).rejects.toBeInstanceOf(DeviceLeafSignError)
|
||||
})
|
||||
})
|
||||
Reference in New Issue
Block a user