e7f3bd05f0
Customers install one command / log in once; hardware-generated keys never leave the device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12, no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md. Control-plane / PKI (control-plane/): - ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256) - ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing - ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers - ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert) - registry/devices.ts: device registry + per-account cap/rate-limit - auth/session.ts: device:enroll capability token mint/verify - api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default) - pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm - boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast) Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind) Host agent (agent/): - transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract) - keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE - net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient + Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap) Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403 Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85, iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy, VPS frps, physical iPhone) per PROGRESS_LOG runbook. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
64 lines
2.6 KiB
TypeScript
64 lines
2.6 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { AgentConfigSchema, isLoopbackWsUrl, loadAgentConfig } from '../src/config/agentConfig.js'
|
|
|
|
const base = {
|
|
relayUrl: 'wss://relay.example.com/agent',
|
|
enrollUrl: 'https://example.com/enroll',
|
|
stateDir: '/tmp/wta',
|
|
localTargetUrl: 'ws://127.0.0.1:3000',
|
|
subdomain: null,
|
|
hostId: null,
|
|
}
|
|
|
|
describe('AgentConfig validation', () => {
|
|
it('parses a valid config', () => {
|
|
expect(() => AgentConfigSchema.parse(base)).not.toThrow()
|
|
})
|
|
|
|
it('rejects a non-wss relayUrl', () => {
|
|
expect(() => AgentConfigSchema.parse({ ...base, relayUrl: 'http://relay.example.com' })).toThrow()
|
|
expect(() => AgentConfigSchema.parse({ ...base, relayUrl: 'ws://relay.example.com' })).toThrow()
|
|
})
|
|
|
|
it('rejects a non-https enrollUrl', () => {
|
|
expect(() => AgentConfigSchema.parse({ ...base, enrollUrl: 'http://example.com/enroll' })).toThrow()
|
|
})
|
|
|
|
it('rejects a non-loopback localTargetUrl (anti-SSRF)', () => {
|
|
expect(() => AgentConfigSchema.parse({ ...base, localTargetUrl: 'ws://10.0.0.5:3000' })).toThrow()
|
|
expect(() => AgentConfigSchema.parse({ ...base, localTargetUrl: 'ws://evil.example.com:3000' })).toThrow()
|
|
})
|
|
|
|
it('accepts loopback localTargetUrl variants', () => {
|
|
expect(isLoopbackWsUrl('ws://127.0.0.1:3000')).toBe(true)
|
|
expect(isLoopbackWsUrl('ws://localhost:3000')).toBe(true)
|
|
expect(isLoopbackWsUrl('ws://127.5.5.5:3000')).toBe(true)
|
|
expect(isLoopbackWsUrl('ws://[::1]:3000')).toBe(true)
|
|
expect(isLoopbackWsUrl('ws://10.0.0.5:3000')).toBe(false)
|
|
expect(isLoopbackWsUrl('wss://127.0.0.1:3000')).toBe(false)
|
|
})
|
|
|
|
it('REGRESSION: rejects a crafted suffixed-hostname target (anti-SSRF bypass)', () => {
|
|
// Hostname, not a loopback literal — the outbound dial would DNS-resolve and connect out.
|
|
expect(isLoopbackWsUrl('ws://127.0.0.1.attacker.example.com:3000/x')).toBe(false)
|
|
expect(isLoopbackWsUrl('ws://127.evil.net:3000')).toBe(false)
|
|
expect(() =>
|
|
AgentConfigSchema.parse({ ...base, localTargetUrl: 'ws://127.0.0.1.attacker.example.com:3000' }),
|
|
).toThrow()
|
|
})
|
|
|
|
it('loadAgentConfig fails fast on a missing relayUrl', () => {
|
|
expect(() => loadAgentConfig({} as NodeJS.ProcessEnv, {})).toThrow()
|
|
})
|
|
|
|
it('loadAgentConfig reads env and lets argv override', () => {
|
|
const cfg = loadAgentConfig(
|
|
{ RELAY_URL: 'wss://a/agent', ENROLL_URL: 'https://a/enroll' } as unknown as NodeJS.ProcessEnv,
|
|
{ subdomain: 'host-42' },
|
|
)
|
|
expect(cfg.relayUrl).toBe('wss://a/agent')
|
|
expect(cfg.subdomain).toBe('host-42')
|
|
expect(cfg.localTargetUrl).toBe('ws://127.0.0.1:3000')
|
|
})
|
|
})
|