wmantly
d47d08ecab
Implements protocol v1.2.0. verifySignature() returned true when no public_key was configured, logging "skipping signature verification". The SSO installer never wrote a public_key, so a default install executed reboot, service_restart, configure_ldap, arbitrary_bash and update_binary UNVERIFIED from anything that could reach its socket. An agent that cannot verify now refuses. Canonicalization also disagreed with the server. Go's encoding/json escapes <, > and & by default; JSON.stringify does not. Any payload containing them hashed differently on each side and failed verification -- for arbitrary_bash that is most real scripts (`>` redirection, `&&`). Now uses json.Encoder with SetEscapeHTML(false), trailing newline trimmed. The SSO now rejects tokens it did not issue. Handles its close codes (4001/4002/4003/4004) and backs off 5 minutes on an enrollment failure instead of retrying every 5s forever. The connect log no longer prints the URL, which carried ?token=. install.sh gains --public-key and warns when none is configured. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.0 KiB
Go
37 lines
1.0 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"testing"
|
|
)
|
|
|
|
// Cross-implementation check: a payload signed by the Node server (utils/
|
|
// agent_manager.js) must verify with the agent's own verifySignature. Skips
|
|
// unless the fixture is present, so it never breaks a normal `go test`.
|
|
func TestInteropWithServerSignature(t *testing.T) {
|
|
raw, err := os.ReadFile(os.Getenv("INTEROP_FIXTURE"))
|
|
if err != nil {
|
|
t.Skip("no INTEROP_FIXTURE provided")
|
|
}
|
|
var fx struct {
|
|
Pub string `json:"pub"`
|
|
Payload map[string]interface{} `json:"payload"`
|
|
Sig string `json:"sig"`
|
|
}
|
|
if err := json.Unmarshal(raw, &fx); err != nil {
|
|
t.Fatalf("bad fixture: %v", err)
|
|
}
|
|
payload := map[string]interface{}{}
|
|
for k, v := range fx.Payload {
|
|
payload[k] = v
|
|
}
|
|
payload["signature"] = fx.Sig
|
|
|
|
cfg := &Config{PublicKey: fx.Pub}
|
|
if !verifySignature(cfg, WSMessage{Type: "arbitrary_bash", Payload: payload}) {
|
|
t.Fatal("agent REJECTED a signature produced by the SSO server")
|
|
}
|
|
t.Log("agent accepted the server-produced signature")
|
|
}
|