open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
da4e7cf688113e57fbe12129708846930bcdb1cd
qinglong/scripts/ql3-worker-credential-management-ca-rollover-evidence.cjs
T

1841 lines
56 KiB
JavaScript
Raw Blame History

#!/usr/bin/env node
'use strict';
const {
createHash,
createPrivateKey,
X509Certificate,
} = require('node:crypto');
const fs = require('node:fs');
const net = require('node:net');
const path = require('node:path');
const { createRequire } = require('node:module');
const { spawnSync } = require('node:child_process');
const { TextDecoder } = require('node:util');
const {
assertionIdentity,
validateWorkerCredentialManagementLiveCeremony,
} = require('./ql3-worker-credential-management-live-ceremony.cjs');
const {
validateWorkerCredentialManagementDurableAuditEvidence,
} = require('./ql3-worker-credential-management-durable-audit-evidence.cjs');
const {
collectKubernetesSnapshot,
REVIEWED_AUTHORITY,
} = require('./ql3-worker-credential-management-pki-rotation-evidence.cjs');
const FIXTURE =
'qinglong/worker-credential-management-ca-rollover-evidence@v1';
const STATE_FIXTURE =
'qinglong/worker-credential-management-ca-rollover-state@v1';
const CEREMONY_FIXTURE =
'qinglong/worker-credential-management-live-ceremony@v1';
const DURABLE_FIXTURE =
'qinglong/worker-credential-management-durable-audit-evidence@v1';
const CA_ANNOTATION =
'qinglong.io/worker-credential-management-client-ca-sha256';
const CRL_ANNOTATION =
'qinglong.io/worker-credential-management-client-crl-sha256';
const TYPE = 'ql3-worker-credential-management+jwt';
const PURPOSE = 'worker-credential-management';
const AUDIENCE = 'qinglong3-worker-credential-management';
const NAMESPACE = 'qinglong3-system';
const DEPLOYMENT = 'ql3-worker-credential-management';
const MAX_FILE_BYTES = 1024 * 1024;
const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/;
const CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
const BANNED_KEYS = new Set([
'assertion',
'authorization',
'bearer',
'connectionstring',
'dsn',
'kubeconfig',
'password',
'privatekey',
'secret',
'tlskey',
'token',
]);
const ROOT = path.resolve(__dirname, '..');
const clusterRequire = createRequire(
path.join(ROOT, 'packages/ql3-cluster-admin/package.json'),
);
class WorkerCredentialManagementCaRolloverEvidenceError extends Error {
constructor(message) {
super(`Worker management CA rollover evidence failed: ${message}`);
this.name = 'WorkerCredentialManagementCaRolloverEvidenceError';
}
}
function fail(message) {
throw new WorkerCredentialManagementCaRolloverEvidenceError(message);
}
function exactObject(value, keys, label) {
if (
!value ||
typeof value !== 'object' ||
Array.isArray(value) ||
JSON.stringify(Object.keys(value).sort()) !==
JSON.stringify([...keys].sort())
) {
fail(`${label} shape is invalid`);
}
return value;
}
function exactKeys(value, keys) {
return (
value !== null &&
typeof value === 'object' &&
!Array.isArray(value) &&
JSON.stringify(Object.keys(value).sort()) ===
JSON.stringify([...keys].sort())
);
}
function digest(domain, value) {
return `sha256:${createHash('sha256')
.update(domain)
.update('\0')
.update(String(value))
.digest('hex')}`;
}
function rawDigest(value) {
return `sha256:${createHash('sha256').update(value).digest('hex')}`;
}
function canonicalFile(filePath, label, options = {}) {
if (
typeof filePath !== 'string' ||
!path.isAbsolute(filePath) ||
filePath.length > 4096 ||
CONTROL_PATTERN.test(filePath)
) {
fail(`${label} path is invalid`);
}
let stat;
try {
stat = fs.lstatSync(filePath);
} catch {
fail(`${label} is unavailable`);
}
const privateFile = options.private !== false;
const uid = typeof process.getuid === 'function' ? process.getuid() : null;
if (
!stat.isFile() ||
stat.isSymbolicLink() ||
stat.size < 1 ||
stat.size > (options.maximum ?? MAX_FILE_BYTES) ||
fs.realpathSync(filePath) !== filePath ||
(privateFile && (uid === null || stat.uid !== uid)) ||
(stat.mode & (privateFile ? 0o077 : 0o022)) !== 0
) {
fail(`${label} must be one canonical bounded file`);
}
return filePath;
}
function readBuffer(filePath, label, options = {}) {
canonicalFile(filePath, label, options);
const before = fs.lstatSync(filePath);
let descriptor = -1;
let bytes;
try {
descriptor = fs.openSync(
filePath,
fs.constants.O_RDONLY |
(fs.constants.O_CLOEXEC ?? 0) |
(fs.constants.O_NOFOLLOW ?? 0),
);
const opened = fs.fstatSync(descriptor);
if (
opened.dev !== before.dev ||
opened.ino !== before.ino ||
opened.uid !== before.uid ||
opened.mode !== before.mode ||
opened.size !== before.size
) {
fail(`${label} changed before it was opened`);
}
bytes = Buffer.alloc(opened.size);
let offset = 0;
while (offset < bytes.length) {
const count = fs.readSync(
descriptor,
bytes,
offset,
bytes.length - offset,
offset,
);
if (count < 1) fail(`${label} could not be read completely`);
offset += count;
}
const after = fs.fstatSync(descriptor);
if (
after.dev !== opened.dev ||
after.ino !== opened.ino ||
after.uid !== opened.uid ||
after.mode !== opened.mode ||
after.size !== opened.size
) {
fail(`${label} changed while it was read`);
}
return bytes;
} catch (error) {
bytes?.fill(0);
if (error instanceof WorkerCredentialManagementCaRolloverEvidenceError) {
throw error;
}
fail(`${label} could not be read safely`);
} finally {
if (descriptor >= 0) fs.closeSync(descriptor);
}
}
function jsonFromBytes(bytes, label) {
try {
return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
} catch {
fail(`${label} must contain UTF-8 JSON`);
}
}
function readJson(filePath, label) {
const bytes = readBuffer(filePath, label);
try {
return Object.freeze({ bytes, value: jsonFromBytes(bytes, label) });
} catch (error) {
bytes.fill(0);
throw error;
}
}
function unusedOutput(filePath) {
if (
typeof filePath !== 'string' ||
!path.isAbsolute(filePath) ||
fs.existsSync(filePath) ||
fs.realpathSync(path.dirname(filePath)) !== path.dirname(filePath)
) {
fail('output path must be unused in one canonical directory');
}
}
function writeNoReplace(filePath, value) {
unusedOutput(filePath);
const descriptor = fs.openSync(
filePath,
fs.constants.O_WRONLY |
fs.constants.O_CREAT |
fs.constants.O_EXCL |
(fs.constants.O_CLOEXEC ?? 0) |
(fs.constants.O_NOFOLLOW ?? 0),
0o600,
);
try {
fs.writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}\n`);
fs.fsyncSync(descriptor);
} finally {
fs.closeSync(descriptor);
}
}
function externalIssuer(value) {
if (typeof value !== 'string' || value.length > 512) return false;
let parsed;
try {
parsed = new URL(value);
} catch {
return false;
}
const hostname = parsed.hostname.toLowerCase();
return (
parsed.protocol === 'https:' &&
parsed.username === '' &&
parsed.password === '' &&
parsed.search === '' &&
parsed.hash === '' &&
parsed.toString() === value &&
net.isIP(hostname) === 0 &&
hostname !== 'localhost' &&
!hostname.endsWith('.localhost') &&
!hostname.endsWith('.local') &&
!hostname.endsWith('.test') &&
!hostname.endsWith('.invalid') &&
!hostname.endsWith('.example')
);
}
function isIsoTime(value) {
return (
typeof value === 'string' &&
/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(value) &&
Number.isFinite(Date.parse(value))
);
}
function containsSensitiveMaterial(value, key = '') {
if (BANNED_KEYS.has(key.toLowerCase())) return true;
if (typeof value === 'string') {
return (
/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/.test(value) ||
/postgres(?:ql)?:\/\/[^/\s]+:[^@\s]+@/i.test(value) ||
/\beyJ[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/.test(
value,
)
);
}
if (Array.isArray(value)) {
return value.some((entry) => containsSensitiveMaterial(entry));
}
if (value && typeof value === 'object') {
return Object.entries(value).some(([childKey, child]) =>
containsSensitiveMaterial(child, childKey),
);
}
return false;
}
function exactPemBlocks(bytes, label, description) {
let value;
try {
value = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
} catch {
fail(`${description} must be strict UTF-8`);
}
const pattern = new RegExp(
`-----BEGIN ${label}-----[\\s\\S]*?-----END ${label}-----`,
'g',
);
const matches = value.match(pattern);
if (!matches || matches.length < 1 || matches.length > 16) {
fail(`${description} must contain 1 to 16 PEM blocks`);
}
if (value.replace(pattern, '').trim() !== '') {
fail(`${description} contains unsupported data`);
}
return matches.map((match) => Buffer.from(`${match}\n`, 'utf8'));
}
function openssl(args, input, label) {
const result = spawnSync('openssl', args, {
input,
encoding: 'utf8',
timeout: 10_000,
maxBuffer: 64 * 1024,
env: { PATH: process.env.PATH, LANG: 'C', LC_ALL: 'C' },
});
if (result.status !== 0 || result.signal !== null) {
fail(`${label} is not accepted by OpenSSL`);
}
return result.stdout.trim();
}
function defaultInspectAuthoritySubject(bytes) {
const output = openssl(
['x509', '-noout', '-subject', '-nameopt', 'RFC2253'],
bytes,
'client certificate authority',
);
const subject = /^subject=(.+)$/.exec(output)?.[1];
if (!subject) fail('client certificate authority subject is invalid');
return subject;
}
function defaultInspectCrl(bytes) {
const output = openssl(
[
'crl',
'-noout',
'-issuer',
'-nameopt',
'RFC2253',
'-fingerprint',
'-sha256',
'-lastupdate',
'-nextupdate',
'-crlnumber',
],
bytes,
'client certificate revocation list',
);
const lines = output.split('\n');
const issuer = lines.find((line) => line.startsWith('issuer='))?.slice(7);
const fingerprint = /^SHA256 Fingerprint=([A-F0-9:]{95})$/i.exec(
lines.find((line) => line.startsWith('SHA256 Fingerprint=')) ?? '',
)?.[1];
const lastUpdate = lines
.find((line) => line.startsWith('lastUpdate='))
?.slice(11);
const nextUpdate = lines
.find((line) => line.startsWith('nextUpdate='))
?.slice(11);
const number = /^crlNumber=(?:0x)?([A-F0-9]+)$/i.exec(
lines.find((line) => line.startsWith('crlNumber=')) ?? '',
)?.[1];
const lastUpdateMs = Date.parse(lastUpdate ?? '');
const nextUpdateMs = Date.parse(nextUpdate ?? '');
if (
!issuer ||
!fingerprint ||
!number ||
!Number.isFinite(lastUpdateMs) ||
!Number.isFinite(nextUpdateMs) ||
nextUpdateMs <= lastUpdateMs
) {
fail('client certificate revocation list metadata is invalid');
}
return Object.freeze({
issuer,
sha256: `sha256:${fingerprint.replaceAll(':', '').toLowerCase()}`,
number: number.toLowerCase().replace(/^0+/, '') || '0',
lastUpdateMs,
nextUpdateMs,
});
}
function inspectAuthorities(bytes, nowMs, inspectAuthoritySubject) {
const blocks = exactPemBlocks(
bytes,
'CERTIFICATE',
'client certificate authority bundle',
);
const fingerprints = new Set();
const subjects = new Set();
const authorities = [];
try {
for (const block of blocks) {
let certificate;
try {
certificate = new X509Certificate(block);
} catch {
fail('client certificate authority is invalid');
}
if (
!certificate.ca ||
Date.parse(certificate.validFrom) > nowMs ||
Date.parse(certificate.validTo) <= nowMs
) {
fail('client certificate authority is not active CA material');
}
const fingerprintSha256 = `sha256:${certificate.fingerprint256
.replaceAll(':', '')
.toLowerCase()}`;
const subject = inspectAuthoritySubject(block);
if (
fingerprints.has(fingerprintSha256) ||
subjects.has(subject)
) {
fail('client certificate authority bundle contains a duplicate');
}
fingerprints.add(fingerprintSha256);
subjects.add(subject);
authorities.push(
Object.freeze({ certificate, fingerprintSha256, subject }),
);
}
return Object.freeze(authorities);
} finally {
for (const block of blocks) block.fill(0);
}
}
function inspectClientConfiguration(
configFile,
nowMs,
inspectAuthoritySubject = defaultInspectAuthoritySubject,
) {
const document = readJson(configFile, 'management client config');
try {
const config = exactObject(
document.value,
[
'schemaVersion',
'endpoint',
'servername',
'caFile',
'clientCertificateFile',
'clientPrivateKeyFile',
'requestTimeoutMs',
],
'management client config',
);
if (
config.schemaVersion !== 1 ||
typeof config.endpoint !== 'string' ||
typeof config.servername !== 'string' ||
typeof config.caFile !== 'string' ||
typeof config.clientCertificateFile !== 'string' ||
typeof config.clientPrivateKeyFile !== 'string' ||
!Number.isSafeInteger(config.requestTimeoutMs)
) {
fail('management client config is invalid');
}
let endpoint;
try {
endpoint = new URL(config.endpoint);
} catch {
fail('management client endpoint is invalid');
}
if (
endpoint.protocol !== 'https:' ||
endpoint.hostname !== config.servername ||
endpoint.pathname !== '/api/v3/worker-credentials/management' ||
endpoint.username !== '' ||
endpoint.password !== '' ||
endpoint.search !== '' ||
endpoint.hash !== '' ||
net.isIP(endpoint.hostname) !== 0
) {
fail('management client endpoint authority is invalid');
}
const serverCa = readBuffer(config.caFile, 'management server CA', {
private: false,
maximum: 256 * 1024,
});
const certificateBytes = readBuffer(
config.clientCertificateFile,
'management client certificate',
{ private: false, maximum: 256 * 1024 },
);
const privateKeyBytes = readBuffer(
config.clientPrivateKeyFile,
'management client private key',
{ maximum: 256 * 1024 },
);
try {
const serverAuthorities = inspectAuthorities(
serverCa,
nowMs,
inspectAuthoritySubject,
);
const certificate = new X509Certificate(certificateBytes);
const privateKey = createPrivateKey(privateKeyBytes);
if (
certificate.ca ||
!certificate.checkPrivateKey(privateKey) ||
!certificate.keyUsage?.includes('1.3.6.1.5.5.7.3.2') ||
Date.parse(certificate.validFrom) > nowMs ||
Date.parse(certificate.validTo) <= nowMs
) {
fail('management client identity is invalid');
}
return Object.freeze({
endpointSha256: digest(
'qinglong3.worker-management.endpoint.v1',
endpoint.toString(),
),
servernameSha256: digest(
'qinglong3.worker-management.servername.v1',
config.servername,
),
serverTrustBundleSha256: rawDigest(serverCa),
serverAuthoritySha256: Object.freeze(
serverAuthorities.map(({ fingerprintSha256 }) => fingerprintSha256),
),
clientCertificateSha256: `sha256:${certificate.fingerprint256
.replaceAll(':', '')
.toLowerCase()}`,
certificate,
});
} catch (error) {
if (error instanceof WorkerCredentialManagementCaRolloverEvidenceError) {
throw error;
}
fail('management client certificate material is invalid');
} finally {
serverCa.fill(0);
certificateBytes.fill(0);
privateKeyBytes.fill(0);
}
} finally {
document.bytes.fill(0);
}
}
function inspectTrustBundles(
caFile,
crlFile,
nowMs,
inspectAuthoritySubject,
inspectCrl,
) {
const caBytes = readBuffer(caFile, 'client CA bundle', {
private: false,
maximum: 256 * 1024,
});
const crlBytes = readBuffer(crlFile, 'client CRL bundle', {
private: false,
maximum: 256 * 1024,
});
let crlBlocks = [];
try {
const authorities = inspectAuthorities(
caBytes,
nowMs,
inspectAuthoritySubject,
);
crlBlocks = exactPemBlocks(
crlBytes,
'X509 CRL',
'client certificate revocation list bundle',
);
const crls = crlBlocks.map((block) => inspectCrl(block));
const authoritySubjects = authorities.map(({ subject }) => subject).sort();
const crlIssuers = crls.map(({ issuer }) => issuer).sort();
if (
crls.length !== authorities.length ||
JSON.stringify(crlIssuers) !== JSON.stringify(authoritySubjects) ||
new Set(crls.map(({ sha256 }) => sha256)).size !== crls.length ||
crls.some(
({ sha256, number, lastUpdateMs, nextUpdateMs }) =>
!SHA256_PATTERN.test(sha256) ||
!/^[a-f0-9]{1,64}$/.test(number) ||
!Number.isSafeInteger(lastUpdateMs) ||
!Number.isSafeInteger(nextUpdateMs) ||
lastUpdateMs > nowMs + 5 * 60_000 ||
nextUpdateMs <= nowMs ||
nextUpdateMs <= lastUpdateMs,
)
) {
fail('CRL issuer coverage is not exact and current');
}
return Object.freeze({
caBundleSha256: rawDigest(caBytes),
crlBundleSha256: rawDigest(crlBytes),
authorities,
caFingerprintSha256: Object.freeze(
authorities.map(({ fingerprintSha256 }) => fingerprintSha256).sort(),
),
crlIssuerSha256: Object.freeze(
crls
.map(({ issuer }) =>
digest('qinglong3.worker-management.client-ca-subject.v1', issuer),
)
.sort(),
),
});
} finally {
caBytes.fill(0);
crlBytes.fill(0);
for (const block of crlBlocks) block.fill(0);
}
}
function issuerAuthority(profile, trust) {
const matches = trust.authorities.filter(
({ certificate }) =>
profile.certificate.checkIssued(certificate) &&
profile.certificate.verify(certificate.publicKey),
);
if (matches.length > 1) fail('client certificate issuer is ambiguous');
return matches[0]?.fingerprintSha256 ?? null;
}
function sameClientTransport(oldProfile, newProfile) {
if (
oldProfile.endpointSha256 !== newProfile.endpointSha256 ||
oldProfile.servernameSha256 !== newProfile.servernameSha256 ||
oldProfile.serverTrustBundleSha256 !==
newProfile.serverTrustBundleSha256 ||
JSON.stringify(oldProfile.serverAuthoritySha256) !==
JSON.stringify(newProfile.serverAuthoritySha256) ||
oldProfile.clientCertificateSha256 ===
newProfile.clientCertificateSha256
) {
fail('old and new clients must use one server trust and distinct identities');
}
}
function identityFromFile(filePath, nowMs) {
const bytes = readBuffer(filePath, 'identity assertion');
try {
if (bytes.some((byte) => byte > 0x7f)) {
fail('identity assertion encoding is invalid');
}
return assertionIdentity(bytes.toString('ascii'), nowMs);
} finally {
bytes.fill(0);
}
}
function commandFromFile(filePath, normalize) {
const document = readJson(filePath, 'management inspect command');
try {
const command = normalize(document.value);
if (command?.operation !== 'worker-credential.inspect') {
fail('evidence command must be worker-credential.inspect');
}
return Object.freeze({
sha256: digest(
'qinglong3.worker-management.ca-rollover-command.v1',
JSON.stringify(command),
),
});
} finally {
document.bytes.fill(0);
}
}
function normalizeKubernetesSnapshot(value, caSha256, crlSha256) {
if (
!value ||
typeof value !== 'object' ||
!SHA256_PATTERN.test(value.clusterServerSha256) ||
!SHA256_PATTERN.test(value.collectorSubjectSha256) ||
!Array.isArray(value.authorization) ||
value.authorization.length !== REVIEWED_AUTHORITY.length ||
value.authorization.some(
(entry, index) =>
entry?.verb !== REVIEWED_AUTHORITY[index].verb ||
entry?.resource !== REVIEWED_AUTHORITY[index].resource ||
entry?.allowed !== REVIEWED_AUTHORITY[index].allowed ||
entry?.observed !== REVIEWED_AUTHORITY[index].allowed,
)
) {
fail('Kubernetes evidence collector authority is not exact read-only');
}
const deployment = value.deployment;
const metadata = deployment?.metadata;
const spec = deployment?.spec;
const status = deployment?.status;
if (
deployment?.apiVersion !== 'apps/v1' ||
deployment?.kind !== 'Deployment' ||
metadata?.name !== DEPLOYMENT ||
metadata?.namespace !== NAMESPACE ||
typeof metadata.uid !== 'string' ||
typeof metadata.resourceVersion !== 'string' ||
!Number.isSafeInteger(metadata.generation) ||
metadata.generation < 1 ||
spec?.replicas !== 2 ||
spec?.strategy?.type !== 'RollingUpdate' ||
spec?.strategy?.rollingUpdate?.maxUnavailable !== 0 ||
spec?.template?.metadata?.annotations?.[CA_ANNOTATION] !== caSha256 ||
spec?.template?.metadata?.annotations?.[CRL_ANNOTATION] !== crlSha256 ||
status?.observedGeneration !== metadata.generation ||
status?.replicas !== 2 ||
status?.updatedReplicas !== 2 ||
status?.readyReplicas !== 2 ||
status?.availableReplicas !== 2 ||
(status?.unavailableReplicas ?? 0) !== 0
) {
fail('Kubernetes Deployment is not one converged CA/CRL-bound rollout');
}
if (
value.pods?.apiVersion !== 'v1' ||
value.pods?.kind !== 'List' ||
!Array.isArray(value.pods.items) ||
value.pods.items.length < 2 ||
value.pods.items.length > 4
) {
fail('Kubernetes Pod snapshot is invalid');
}
const current = value.pods.items.filter(
(pod) => pod?.metadata?.deletionTimestamp === undefined,
);
const ready = (conditions) =>
Array.isArray(conditions) &&
conditions.some(
(condition) =>
condition?.type === 'Ready' && condition?.status === 'True',
);
if (
current.length !== 2 ||
current.some(
(pod) =>
pod.metadata?.namespace !== NAMESPACE ||
typeof pod.metadata?.uid !== 'string' ||
pod.metadata?.labels?.['app.kubernetes.io/name'] !== DEPLOYMENT ||
pod.metadata?.labels?.['app.kubernetes.io/component'] !==
'worker-credential-management' ||
typeof pod.metadata?.labels?.['pod-template-hash'] !== 'string' ||
pod.spec?.serviceAccountName !== DEPLOYMENT ||
pod.spec?.automountServiceAccountToken !== false ||
typeof pod.spec?.nodeName !== 'string' ||
pod.status?.phase !== 'Running' ||
!ready(pod.status?.conditions) ||
!pod.status?.containerStatuses?.some(
(container) =>
container.name === 'management' && container.ready === true,
),
) ||
new Set(current.map((pod) => pod.spec.nodeName)).size !== 2 ||
new Set(current.map((pod) => pod.metadata.labels['pod-template-hash']))
.size !== 1
) {
fail('Kubernetes manager Pods are not two Ready tokenless replicas');
}
return Object.freeze({
clusterServerSha256: value.clusterServerSha256,
collectorSubjectSha256: value.collectorSubjectSha256,
deploymentUidSha256: digest(
'qinglong3.worker-management.deployment-uid.v1',
metadata.uid,
),
deploymentResourceVersionSha256: digest(
'qinglong3.worker-management.deployment-resource-version.v1',
metadata.resourceVersion,
),
deploymentGeneration: metadata.generation,
caAnnotationSha256: caSha256,
crlAnnotationSha256: crlSha256,
podUidSha256: Object.freeze(
current
.map((pod) =>
digest('qinglong3.worker-management.pod-uid.v1', pod.metadata.uid),
)
.sort(),
),
podNodeSha256: Object.freeze(
current
.map((pod) =>
digest('qinglong3.worker-management.node.v1', pod.spec.nodeName),
)
.sort(),
),
exactReadOnlyCollectorAuthority: true,
});
}
function expectedAccess(phase) {
return Object.freeze(
phase === 'old'
? { old: 200, next: 401 }
: phase === 'overlap'
? { old: 200, next: 200 }
: { old: 401, next: 200 },
);
}
async function invokeClient(execute, options, configFile, expected) {
try {
await execute({
configFile,
commandFile: options.commandFile,
assertionFile: options.assertionFile,
});
if (expected !== 200) fail('retired client certificate was accepted');
return Object.freeze({ statusCode: 200, responseCode: null });
} catch (error) {
if (
expected === 401 &&
error?.statusCode === 401 &&
error?.responseCode === 'client_certificate_required'
) {
return Object.freeze({
statusCode: 401,
responseCode: 'client_certificate_required',
});
}
if (error instanceof WorkerCredentialManagementCaRolloverEvidenceError) {
throw error;
}
fail('management client observation did not match the required status');
}
}
function defaultDependencies() {
const { executeClusterWorkerCredentialManagementClient } = clusterRequire(
'@qinglong/cluster-admin/worker-credential-management-client',
);
const { normalizeClusterWorkerCredentialManagementCommand } = clusterRequire(
'@qinglong/cluster-admin/worker-credential-management-transport',
);
return Object.freeze({
now: Date.now,
execute: executeClusterWorkerCredentialManagementClient,
normalize: normalizeClusterWorkerCredentialManagementCommand,
inspectClient: inspectClientConfiguration,
inspectTrust: inspectTrustBundles,
inspectAuthoritySubject: defaultInspectAuthoritySubject,
inspectCrl: defaultInspectCrl,
collectKubernetes: collectKubernetesSnapshot,
});
}
function reviewedDependencies(overrides = {}) {
const defaults = overrides.useDefaults === false ? {} : defaultDependencies();
const dependencies = { ...defaults, ...overrides };
delete dependencies.useDefaults;
exactObject(
dependencies,
[
'now',
'execute',
'normalize',
'inspectClient',
'inspectTrust',
'inspectAuthoritySubject',
'inspectCrl',
'collectKubernetes',
],
'evidence dependencies',
);
if (Object.values(dependencies).some((entry) => typeof entry !== 'function')) {
fail('evidence dependencies are invalid');
}
return Object.freeze(dependencies);
}
function validDigestArray(value, length) {
return (
Array.isArray(value) &&
value.length === length &&
value.every((entry) => SHA256_PATTERN.test(entry)) &&
new Set(value).size === value.length &&
JSON.stringify(value) === JSON.stringify([...value].sort())
);
}
function validDigestSequence(value, length) {
return (
Array.isArray(value) &&
value.length === length &&
value.every((entry) => SHA256_PATTERN.test(entry)) &&
new Set(value).size === value.length
);
}
function validKubernetes(value) {
return (
exactKeys(value, [
'clusterServerSha256',
'collectorSubjectSha256',
'deploymentUidSha256',
'deploymentResourceVersionSha256',
'deploymentGeneration',
'caAnnotationSha256',
'crlAnnotationSha256',
'podUidSha256',
'podNodeSha256',
'exactReadOnlyCollectorAuthority',
]) &&
[
value.clusterServerSha256,
value.collectorSubjectSha256,
value.deploymentUidSha256,
value.deploymentResourceVersionSha256,
value.caAnnotationSha256,
value.crlAnnotationSha256,
].every((entry) => SHA256_PATTERN.test(entry)) &&
Number.isSafeInteger(value.deploymentGeneration) &&
value.deploymentGeneration >= 1 &&
validDigestArray(value.podUidSha256, 2) &&
validDigestArray(value.podNodeSha256, 2) &&
value.exactReadOnlyCollectorAuthority === true
);
}
function validateStageState(state) {
const findings = [];
const add = (code) => findings.push(Object.freeze({ code }));
if (
!exactKeys(state, [
'schemaVersion',
'fixture',
'phase',
'observedAt',
'previousStateSha256',
'identity',
'transport',
'trust',
'kubernetes',
'access',
'gates',
]) ||
state?.schemaVersion !== 1 ||
state?.fixture !== STATE_FIXTURE ||
!['old', 'overlap'].includes(state?.phase) ||
!isIsoTime(state?.observedAt) ||
(state?.phase === 'old'
? state?.previousStateSha256 !== null
: !SHA256_PATTERN.test(state?.previousStateSha256))
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_SHAPE');
}
if (
!exactKeys(state?.identity, [
'providerKind',
'issuer',
'audience',
'type',
'purpose',
'subjectSha256',
]) ||
state?.identity?.providerKind !== 'external_oidc' ||
!externalIssuer(state?.identity?.issuer) ||
state?.identity?.audience !== AUDIENCE ||
state?.identity?.type !== TYPE ||
state?.identity?.purpose !== PURPOSE ||
!SHA256_PATTERN.test(state?.identity?.subjectSha256)
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_IDENTITY');
}
if (
!exactKeys(state?.transport, [
'endpointSha256',
'servernameSha256',
'serverTrustBundleSha256',
'serverAuthoritySha256',
'commandSha256',
'oldClientCertificateSha256',
'newClientCertificateSha256',
]) ||
![
state?.transport?.endpointSha256,
state?.transport?.servernameSha256,
state?.transport?.serverTrustBundleSha256,
state?.transport?.commandSha256,
state?.transport?.oldClientCertificateSha256,
state?.transport?.newClientCertificateSha256,
].every((entry) => SHA256_PATTERN.test(entry)) ||
!Array.isArray(state?.transport?.serverAuthoritySha256) ||
state.transport.serverAuthoritySha256.length < 1 ||
state.transport.serverAuthoritySha256.length > 16 ||
state.transport.serverAuthoritySha256.some(
(entry) => !SHA256_PATTERN.test(entry),
) ||
state.transport.oldClientCertificateSha256 ===
state.transport.newClientCertificateSha256
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_TRANSPORT');
}
const expectedAuthorities = state?.phase === 'old' ? 1 : 2;
if (
!exactKeys(state?.trust, [
'caBundleSha256',
'crlBundleSha256',
'caFingerprintSha256',
'crlIssuerSha256',
'oldIssuerCaSha256',
'newIssuerCaSha256',
]) ||
!SHA256_PATTERN.test(state?.trust?.caBundleSha256) ||
!SHA256_PATTERN.test(state?.trust?.crlBundleSha256) ||
!validDigestArray(
state?.trust?.caFingerprintSha256,
expectedAuthorities,
) ||
!validDigestArray(state?.trust?.crlIssuerSha256, expectedAuthorities) ||
!SHA256_PATTERN.test(state?.trust?.oldIssuerCaSha256) ||
(state?.phase === 'old'
? state?.trust?.newIssuerCaSha256 !== null
: !SHA256_PATTERN.test(state?.trust?.newIssuerCaSha256)) ||
!state?.trust?.caFingerprintSha256.includes(
state?.trust?.oldIssuerCaSha256,
) ||
(state?.phase === 'overlap' &&
(!state.trust.caFingerprintSha256.includes(
state.trust.newIssuerCaSha256,
) ||
state.trust.oldIssuerCaSha256 === state.trust.newIssuerCaSha256))
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_TRUST');
}
if (!validKubernetes(state?.kubernetes)) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_KUBERNETES');
}
const expected = expectedAccess(state?.phase);
if (
!exactKeys(state?.access, [
'oldCertificateStatus',
'oldCertificateCode',
'newCertificateStatus',
'newCertificateCode',
]) ||
state?.access?.oldCertificateStatus !== expected.old ||
state?.access?.newCertificateStatus !== expected.next ||
state?.access?.oldCertificateCode !==
(expected.old === 401 ? 'client_certificate_required' : null) ||
state?.access?.newCertificateCode !==
(expected.next === 401 ? 'client_certificate_required' : null)
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_ACCESS');
}
if (
!exactKeys(state?.gates, [
'trustSetExact',
'crlIssuerCoverageExact',
'deploymentReady',
'previousGenerationReplaced',
'readOnlyCollectorAuthority',
'expectedClientAccess',
'passed',
]) ||
Object.values(state?.gates ?? {}).some((entry) => entry !== true)
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_GATES');
}
if (containsSensitiveMaterial(state)) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_STATE_SECRET_EXPOSURE');
}
return Object.freeze({
compatible: findings.length === 0,
findings: Object.freeze(findings),
});
}
function sameStageAuthority(previous, current) {
if (
previous.identity.issuer !== current.identity.issuer ||
previous.identity.subjectSha256 !== current.identity.subjectSha256 ||
JSON.stringify(previous.transport) !== JSON.stringify(current.transport) ||
previous.kubernetes.clusterServerSha256 !==
current.kubernetes.clusterServerSha256 ||
previous.kubernetes.collectorSubjectSha256 !==
current.kubernetes.collectorSubjectSha256 ||
previous.kubernetes.deploymentUidSha256 !==
current.kubernetes.deploymentUidSha256
) {
fail('rollover phase authority does not match the previous state');
}
if (
current.kubernetes.deploymentGeneration <=
previous.kubernetes.deploymentGeneration ||
current.kubernetes.deploymentResourceVersionSha256 ===
previous.kubernetes.deploymentResourceVersionSha256 ||
previous.kubernetes.podUidSha256.some((entry) =>
current.kubernetes.podUidSha256.includes(entry),
)
) {
fail('rollover did not replace the complete previous generation');
}
}
function phaseTrust(phase, oldProfile, newProfile, trust, previous) {
const oldIssuer = issuerAuthority(oldProfile, trust);
const newIssuer = issuerAuthority(newProfile, trust);
if (phase === 'old') {
if (trust.authorities.length !== 1 || oldIssuer === null || newIssuer !== null) {
fail('old phase trust set is not exact');
}
return Object.freeze({ oldIssuer, newIssuer: null });
}
if (phase === 'overlap') {
if (
trust.authorities.length !== 2 ||
oldIssuer === null ||
newIssuer === null ||
oldIssuer === newIssuer ||
oldIssuer !== previous.trust.oldIssuerCaSha256
) {
fail('overlap phase trust set is not the exact old plus new union');
}
return Object.freeze({ oldIssuer, newIssuer });
}
if (
trust.authorities.length !== 1 ||
oldIssuer !== null ||
newIssuer === null ||
newIssuer !== previous.trust.newIssuerCaSha256
) {
fail('new phase trust set did not safely retire the old CA');
}
return Object.freeze({
oldIssuer: previous.trust.oldIssuerCaSha256,
newIssuer,
});
}
async function observePhase(phase, options, runtime, previous) {
const nowMs = runtime.now();
if (!Number.isSafeInteger(nowMs) || nowMs < 0) fail('clock is invalid');
const identity = identityFromFile(options.assertionFile, nowMs);
const command = commandFromFile(options.commandFile, runtime.normalize);
const oldProfile = runtime.inspectClient(
options.oldConfigFile,
nowMs,
runtime.inspectAuthoritySubject,
);
const newProfile = runtime.inspectClient(
options.newConfigFile,
nowMs,
runtime.inspectAuthoritySubject,
);
sameClientTransport(oldProfile, newProfile);
const trust = runtime.inspectTrust(
options.caBundleFile,
options.crlBundleFile,
nowMs,
runtime.inspectAuthoritySubject,
runtime.inspectCrl,
);
const issuers = phaseTrust(phase, oldProfile, newProfile, trust, previous);
const kubernetes = normalizeKubernetesSnapshot(
await runtime.collectKubernetes(
options.kubernetesFile,
trust.crlBundleSha256,
),
trust.caBundleSha256,
trust.crlBundleSha256,
);
const expected = expectedAccess(phase);
const oldAccess = await invokeClient(
runtime.execute,
options,
options.oldConfigFile,
expected.old,
);
const newAccess = await invokeClient(
runtime.execute,
options,
options.newConfigFile,
expected.next,
);
const state = Object.freeze({
schemaVersion: 1,
fixture: STATE_FIXTURE,
phase,
observedAt: new Date(nowMs).toISOString(),
previousStateSha256:
previous === null ? null : options.previousStateSha256,
identity: Object.freeze({
providerKind: 'external_oidc',
issuer: identity.issuer,
audience: AUDIENCE,
type: TYPE,
purpose: PURPOSE,
subjectSha256: digest(
'qinglong3.worker-management.subject.v1',
identity.subject,
),
}),
transport: Object.freeze({
endpointSha256: oldProfile.endpointSha256,
servernameSha256: oldProfile.servernameSha256,
serverTrustBundleSha256: oldProfile.serverTrustBundleSha256,
serverAuthoritySha256: oldProfile.serverAuthoritySha256,
commandSha256: command.sha256,
oldClientCertificateSha256: oldProfile.clientCertificateSha256,
newClientCertificateSha256: newProfile.clientCertificateSha256,
}),
trust: Object.freeze({
caBundleSha256: trust.caBundleSha256,
crlBundleSha256: trust.crlBundleSha256,
caFingerprintSha256: trust.caFingerprintSha256,
crlIssuerSha256: trust.crlIssuerSha256,
oldIssuerCaSha256: issuers.oldIssuer,
newIssuerCaSha256: issuers.newIssuer,
}),
kubernetes,
access: Object.freeze({
oldCertificateStatus: oldAccess.statusCode,
oldCertificateCode: oldAccess.responseCode,
newCertificateStatus: newAccess.statusCode,
newCertificateCode: newAccess.responseCode,
}),
gates: Object.freeze({
trustSetExact: true,
crlIssuerCoverageExact: true,
deploymentReady: true,
previousGenerationReplaced: true,
readOnlyCollectorAuthority: true,
expectedClientAccess: true,
passed: true,
}),
});
if (phase !== 'old') sameStageAuthority(previous, state);
return Object.freeze({ state, identity });
}
function readStage(filePath, expectedPhase) {
const document = readJson(filePath, `${expectedPhase} rollover state`);
const audit = validateStageState(document.value);
if (!audit.compatible || document.value.phase !== expectedPhase) {
document.bytes.fill(0);
fail(`${expectedPhase} rollover state is incompatible`);
}
return document;
}
function commonOptionKeys() {
return [
'oldConfigFile',
'newConfigFile',
'assertionFile',
'commandFile',
'kubernetesFile',
'caBundleFile',
'crlBundleFile',
'outputFile',
];
}
async function runOldEvidence(options, dependencies = {}) {
exactObject(options, commonOptionKeys(), 'old evidence options');
unusedOutput(options.outputFile);
const runtime = reviewedDependencies(dependencies);
const { state } = await observePhase('old', options, runtime, null);
const audit = validateStageState(state);
if (!audit.compatible) fail('assembled old state failed audit');
writeNoReplace(options.outputFile, state);
return state;
}
async function runOverlapEvidence(options, dependencies = {}) {
exactObject(
options,
['previousFile', ...commonOptionKeys()],
'overlap evidence options',
);
unusedOutput(options.outputFile);
const previousDocument = readStage(options.previousFile, 'old');
try {
const runtime = reviewedDependencies(dependencies);
const phaseOptions = {
...options,
previousStateSha256: rawDigest(previousDocument.bytes),
};
delete phaseOptions.previousFile;
const { state } = await observePhase(
'overlap',
phaseOptions,
runtime,
previousDocument.value,
);
const audit = validateStageState(state);
if (!audit.compatible) fail('assembled overlap state failed audit');
writeNoReplace(options.outputFile, state);
return state;
} finally {
previousDocument.bytes.fill(0);
}
}
function assertSourceReports(ceremonyDocument, durableDocument) {
const ceremonyAudit = validateWorkerCredentialManagementLiveCeremony(
ceremonyDocument.value,
);
const durableAudit = validateWorkerCredentialManagementDurableAuditEvidence(
durableDocument.value,
);
if (!ceremonyAudit.compatible || !durableAudit.compatible) {
fail('ceremony or durable audit source report is incompatible');
}
if (
durableDocument.value.source.ceremonyReportSha256 !==
rawDigest(ceremonyDocument.bytes) ||
durableDocument.value.durableState.requesterSubjectSha256 !==
ceremonyDocument.value.identity.requesterSubjectSha256 ||
durableDocument.value.durableState.reviewerSubjectSha256 !==
ceremonyDocument.value.identity.reviewerSubjectSha256 ||
durableDocument.value.durableState.planDigest !==
ceremonyDocument.value.ceremony.planDigest ||
durableDocument.value.durableState.previewDigest !==
ceremonyDocument.value.ceremony.previewDigest
) {
fail('durable audit report is not bound to the ceremony report');
}
}
function validateWorkerCredentialManagementCaRolloverEvidence(report) {
const findings = [];
const add = (code) => findings.push(Object.freeze({ code }));
if (
!exactKeys(report, [
'schemaVersion',
'fixture',
'observedAt',
'source',
'identity',
'transport',
'trustTransition',
'access',
'kubernetes',
'gates',
]) ||
report?.schemaVersion !== 1 ||
report?.fixture !== FIXTURE ||
!isIsoTime(report?.observedAt)
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_SHAPE');
}
if (
!exactKeys(report?.source, [
'oldStateSha256',
'overlapStateSha256',
'ceremonyReportSha256',
'durableAuditReportSha256',
'ceremonyFixture',
'durableAuditFixture',
]) ||
![
report?.source?.oldStateSha256,
report?.source?.overlapStateSha256,
report?.source?.ceremonyReportSha256,
report?.source?.durableAuditReportSha256,
].every((entry) => SHA256_PATTERN.test(entry)) ||
report?.source?.ceremonyFixture !== CEREMONY_FIXTURE ||
report?.source?.durableAuditFixture !== DURABLE_FIXTURE
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_SOURCE');
}
if (
!exactKeys(report?.identity, [
'providerKind',
'issuer',
'audience',
'type',
'purpose',
'subjectSha256',
'ceremonyIdentityBound',
'durableAuditBound',
]) ||
report?.identity?.providerKind !== 'external_oidc' ||
!externalIssuer(report?.identity?.issuer) ||
report?.identity?.audience !== AUDIENCE ||
report?.identity?.type !== TYPE ||
report?.identity?.purpose !== PURPOSE ||
!SHA256_PATTERN.test(report?.identity?.subjectSha256) ||
report?.identity?.ceremonyIdentityBound !== true ||
report?.identity?.durableAuditBound !== true
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_IDENTITY');
}
if (
!exactKeys(report?.transport, [
'endpointSha256',
'servernameSha256',
'serverTrustBundleSha256',
'commandSha256',
'oldClientCertificateSha256',
'newClientCertificateSha256',
]) ||
Object.values(report?.transport ?? {}).some(
(entry) => !SHA256_PATTERN.test(entry),
) ||
report?.transport?.oldClientCertificateSha256 ===
report?.transport?.newClientCertificateSha256
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_TRANSPORT');
}
const trust = report?.trustTransition;
if (
!exactKeys(trust, [
'oldCaBundleSha256',
'overlapCaBundleSha256',
'newCaBundleSha256',
'oldCrlBundleSha256',
'overlapCrlBundleSha256',
'newCrlBundleSha256',
'oldIssuerCaSha256',
'newIssuerCaSha256',
'oldSet',
'overlapSet',
'newSet',
'crlIssuerCoverageExact',
]) ||
![
trust?.oldCaBundleSha256,
trust?.overlapCaBundleSha256,
trust?.newCaBundleSha256,
trust?.oldCrlBundleSha256,
trust?.overlapCrlBundleSha256,
trust?.newCrlBundleSha256,
trust?.oldIssuerCaSha256,
trust?.newIssuerCaSha256,
].every((entry) => SHA256_PATTERN.test(entry)) ||
trust?.oldIssuerCaSha256 === trust?.newIssuerCaSha256 ||
!validDigestArray(trust?.oldSet, 1) ||
!validDigestArray(trust?.overlapSet, 2) ||
!validDigestArray(trust?.newSet, 1) ||
trust.oldSet[0] !== trust.oldIssuerCaSha256 ||
trust.newSet[0] !== trust.newIssuerCaSha256 ||
!trust.overlapSet.includes(trust.oldIssuerCaSha256) ||
!trust.overlapSet.includes(trust.newIssuerCaSha256) ||
trust?.crlIssuerCoverageExact !== true
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_TRUST');
}
if (
!exactKeys(report?.access, [
'oldCertificateStatus',
'newCertificateStatus',
]) ||
JSON.stringify(report?.access?.oldCertificateStatus) !==
JSON.stringify([200, 200, 401]) ||
JSON.stringify(report?.access?.newCertificateStatus) !==
JSON.stringify([401, 200, 200])
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_ACCESS');
}
const kubernetes = report?.kubernetes;
if (
!exactKeys(kubernetes, [
'clusterServerSha256',
'collectorSubjectSha256',
'deploymentUidSha256',
'generations',
'resourceVersionSha256',
'podUidSha256',
'allGenerationsFullyReplaced',
'twoReadyReplicasOnDistinctNodes',
'exactReadOnlyCollectorAuthority',
]) ||
![
kubernetes?.clusterServerSha256,
kubernetes?.collectorSubjectSha256,
kubernetes?.deploymentUidSha256,
].every((entry) => SHA256_PATTERN.test(entry)) ||
!Array.isArray(kubernetes?.generations) ||
kubernetes.generations.length !== 3 ||
!kubernetes.generations.every(Number.isSafeInteger) ||
!(
kubernetes.generations[0] < kubernetes.generations[1] &&
kubernetes.generations[1] < kubernetes.generations[2]
) ||
!validDigestSequence(kubernetes?.resourceVersionSha256, 3) ||
!Array.isArray(kubernetes?.podUidSha256) ||
kubernetes.podUidSha256.length !== 3 ||
kubernetes.podUidSha256.some((set) => !validDigestArray(set, 2)) ||
new Set(kubernetes.podUidSha256.flat()).size !== 6 ||
kubernetes?.allGenerationsFullyReplaced !== true ||
kubernetes?.twoReadyReplicasOnDistinctNodes !== true ||
kubernetes?.exactReadOnlyCollectorAuthority !== true
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_KUBERNETES');
}
if (
!exactKeys(report?.gates, [
'sourceReportsBound',
'externalIdentityBound',
'serverTrustSeparatedFromClientIssuer',
'oldOnlyObserved',
'exactOverlapObserved',
'safeRetirementObserved',
'crlCoverageObservedEveryPhase',
'allPodGenerationsReplaced',
'readOnlyCollectorAuthority',
'passed',
]) ||
Object.values(report?.gates ?? {}).some((entry) => entry !== true)
) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_GATES');
}
if (containsSensitiveMaterial(report)) {
add('QL3_WORKER_MANAGEMENT_CA_ROLLOVER_EVIDENCE_SECRET_EXPOSURE');
}
return Object.freeze({
compatible: findings.length === 0,
findings: Object.freeze(findings),
});
}
async function runNewEvidence(options, dependencies = {}) {
exactObject(
options,
[
'oldFile',
'previousFile',
...commonOptionKeys(),
'ceremonyReportFile',
'durableAuditReportFile',
],
'new evidence options',
);
unusedOutput(options.outputFile);
const oldDocument = readStage(options.oldFile, 'old');
const overlapDocument = readStage(options.previousFile, 'overlap');
const ceremonyDocument = readJson(
options.ceremonyReportFile,
'ceremony report',
);
const durableDocument = readJson(
options.durableAuditReportFile,
'durable audit report',
);
try {
if (
overlapDocument.value.previousStateSha256 !==
rawDigest(oldDocument.bytes)
) {
fail('overlap state is not chained to the old state');
}
assertSourceReports(ceremonyDocument, durableDocument);
const runtime = reviewedDependencies(dependencies);
const phaseOptions = {
...options,
previousStateSha256: rawDigest(overlapDocument.bytes),
};
delete phaseOptions.oldFile;
delete phaseOptions.previousFile;
delete phaseOptions.ceremonyReportFile;
delete phaseOptions.durableAuditReportFile;
const { state: current, identity } = await observePhase(
'new',
phaseOptions,
runtime,
overlapDocument.value,
);
sameStageAuthority(oldDocument.value, overlapDocument.value);
if (
oldDocument.value.trust.oldIssuerCaSha256 !==
overlapDocument.value.trust.oldIssuerCaSha256 ||
current.trust.oldIssuerCaSha256 !==
overlapDocument.value.trust.oldIssuerCaSha256 ||
current.trust.newIssuerCaSha256 !==
overlapDocument.value.trust.newIssuerCaSha256
) {
fail('client CA identities drifted across rollover phases');
}
const subjectSha256 = digest(
'qinglong3.worker-management.subject.v1',
identity.subject,
);
const ceremonySubjects = [
ceremonyDocument.value.identity.requesterSubjectSha256,
ceremonyDocument.value.identity.reviewerSubjectSha256,
];
if (
current.identity.subjectSha256 !== subjectSha256 ||
identity.issuer !== ceremonyDocument.value.identity.issuer ||
!ceremonySubjects.includes(subjectSha256) ||
![
durableDocument.value.durableState.requesterSubjectSha256,
durableDocument.value.durableState.reviewerSubjectSha256,
].includes(subjectSha256)
) {
fail('new phase identity is not bound to the reviewed ceremony');
}
const report = Object.freeze({
schemaVersion: 1,
fixture: FIXTURE,
observedAt: current.observedAt,
source: Object.freeze({
oldStateSha256: rawDigest(oldDocument.bytes),
overlapStateSha256: rawDigest(overlapDocument.bytes),
ceremonyReportSha256: rawDigest(ceremonyDocument.bytes),
durableAuditReportSha256: rawDigest(durableDocument.bytes),
ceremonyFixture: CEREMONY_FIXTURE,
durableAuditFixture: DURABLE_FIXTURE,
}),
identity: Object.freeze({
...current.identity,
ceremonyIdentityBound: true,
durableAuditBound: true,
}),
transport: Object.freeze({
endpointSha256: current.transport.endpointSha256,
servernameSha256: current.transport.servernameSha256,
serverTrustBundleSha256:
current.transport.serverTrustBundleSha256,
commandSha256: current.transport.commandSha256,
oldClientCertificateSha256:
current.transport.oldClientCertificateSha256,
newClientCertificateSha256:
current.transport.newClientCertificateSha256,
}),
trustTransition: Object.freeze({
oldCaBundleSha256: oldDocument.value.trust.caBundleSha256,
overlapCaBundleSha256:
overlapDocument.value.trust.caBundleSha256,
newCaBundleSha256: current.trust.caBundleSha256,
oldCrlBundleSha256: oldDocument.value.trust.crlBundleSha256,
overlapCrlBundleSha256:
overlapDocument.value.trust.crlBundleSha256,
newCrlBundleSha256: current.trust.crlBundleSha256,
oldIssuerCaSha256: current.trust.oldIssuerCaSha256,
newIssuerCaSha256: current.trust.newIssuerCaSha256,
oldSet: oldDocument.value.trust.caFingerprintSha256,
overlapSet: overlapDocument.value.trust.caFingerprintSha256,
newSet: current.trust.caFingerprintSha256,
crlIssuerCoverageExact: true,
}),
access: Object.freeze({
oldCertificateStatus: Object.freeze([
oldDocument.value.access.oldCertificateStatus,
overlapDocument.value.access.oldCertificateStatus,
current.access.oldCertificateStatus,
]),
newCertificateStatus: Object.freeze([
oldDocument.value.access.newCertificateStatus,
overlapDocument.value.access.newCertificateStatus,
current.access.newCertificateStatus,
]),
}),
kubernetes: Object.freeze({
clusterServerSha256: current.kubernetes.clusterServerSha256,
collectorSubjectSha256:
current.kubernetes.collectorSubjectSha256,
deploymentUidSha256: current.kubernetes.deploymentUidSha256,
generations: Object.freeze([
oldDocument.value.kubernetes.deploymentGeneration,
overlapDocument.value.kubernetes.deploymentGeneration,
current.kubernetes.deploymentGeneration,
]),
resourceVersionSha256: Object.freeze([
oldDocument.value.kubernetes.deploymentResourceVersionSha256,
overlapDocument.value.kubernetes
.deploymentResourceVersionSha256,
current.kubernetes.deploymentResourceVersionSha256,
]),
podUidSha256: Object.freeze([
oldDocument.value.kubernetes.podUidSha256,
overlapDocument.value.kubernetes.podUidSha256,
current.kubernetes.podUidSha256,
]),
allGenerationsFullyReplaced: true,
twoReadyReplicasOnDistinctNodes: true,
exactReadOnlyCollectorAuthority: true,
}),
gates: Object.freeze({
sourceReportsBound: true,
externalIdentityBound: true,
serverTrustSeparatedFromClientIssuer: true,
oldOnlyObserved: true,
exactOverlapObserved: true,
safeRetirementObserved: true,
crlCoverageObservedEveryPhase: true,
allPodGenerationsReplaced: true,
readOnlyCollectorAuthority: true,
passed: true,
}),
});
const audit = validateWorkerCredentialManagementCaRolloverEvidence(report);
if (!audit.compatible) {
fail(
`assembled report failed audit: ${audit.findings
.map(({ code }) => code)
.join(',')}`,
);
}
writeNoReplace(options.outputFile, report);
return report;
} finally {
oldDocument.bytes.fill(0);
overlapDocument.bytes.fill(0);
ceremonyDocument.bytes.fill(0);
durableDocument.bytes.fill(0);
}
}
function parseArguments(argv) {
const values = {};
for (const argument of argv) {
if (argument === '--') continue;
const match = /^--([a-z-]+)=(.+)$/.exec(argument);
if (!match || Object.hasOwn(values, match[1])) fail('arguments are invalid');
values[match[1]] = match[2];
}
if (!['old', 'overlap', 'new'].includes(values.phase)) {
fail('phase must be old, overlap or new');
}
const common = [
'phase',
'old-config',
'new-config',
'assertion',
'command',
'kubernetes',
'client-ca-bundle',
'client-crl-bundle',
'output',
];
const expected =
values.phase === 'old'
? common
: values.phase === 'overlap'
? [...common, 'previous']
: [
...common,
'old',
'previous',
'ceremony-report',
'durable-audit-report',
];
if (
JSON.stringify(Object.keys(values).sort()) !==
JSON.stringify(expected.sort())
) {
fail('arguments are invalid');
}
const shared = {
oldConfigFile: values['old-config'],
newConfigFile: values['new-config'],
assertionFile: values.assertion,
commandFile: values.command,
kubernetesFile: values.kubernetes,
caBundleFile: values['client-ca-bundle'],
crlBundleFile: values['client-crl-bundle'],
outputFile: values.output,
};
return Object.freeze(
values.phase === 'old'
? { phase: 'old', options: Object.freeze(shared) }
: values.phase === 'overlap'
? {
phase: 'overlap',
options: Object.freeze({
previousFile: values.previous,
...shared,
}),
}
: {
phase: 'new',
options: Object.freeze({
oldFile: values.old,
previousFile: values.previous,
...shared,
ceremonyReportFile: values['ceremony-report'],
durableAuditReportFile: values['durable-audit-report'],
}),
},
);
}
async function runCli(argv) {
if (
process.env.QL3_WORKER_CREDENTIAL_MANAGEMENT_CA_ROLLOVER_EVIDENCE !== '1'
) {
fail('explicit CA rollover evidence opt-in is required');
}
const parsed = parseArguments(argv);
if (parsed.phase === 'old') await runOldEvidence(parsed.options);
else if (parsed.phase === 'overlap') {
await runOverlapEvidence(parsed.options);
} else await runNewEvidence(parsed.options);
process.stdout.write(
`${JSON.stringify({
schemaVersion: 1,
fixture: FIXTURE,
phase: parsed.phase,
compatible: true,
})}\n`,
);
}
if (require.main === module) {
runCli(process.argv.slice(2)).catch((error) => {
process.stderr.write(
`${error instanceof Error ? error.message : 'CA rollover evidence failed'}\n`,
);
process.exitCode = 1;
});
}
module.exports = {
CA_ANNOTATION,
CRL_ANNOTATION,
FIXTURE,
STATE_FIXTURE,
WorkerCredentialManagementCaRolloverEvidenceError,
defaultInspectAuthoritySubject,
defaultInspectCrl,
inspectClientConfiguration,
inspectTrustBundles,
normalizeKubernetesSnapshot,
parseArguments,
runNewEvidence,
runOldEvidence,
runOverlapEvidence,
validateStageState,
validateWorkerCredentialManagementCaRolloverEvidence,
};
Reference in New Issue View Git Blame Copy Permalink