mirror of
https://github.com/gravitational/teleport
synced 2024-10-21 17:53:28 +00:00
70a73355c9
* Properly handle empty list of role requests Currently, an empty list of role requests results in an ambiguous situation: we usually use the presence of role requests to determine whether or not we'd return impersonated certs or not. An empty list of role requests returns a fresh set of non-impersonated certs (possibly renewed if allowed), while a non-empty list of role requests returns certs with just those roles. However, if a client _intends_ to request impersonated certs but provides an empty list of role requests it will instead receive non-impersonated (possibly renewable) certs with the full permissions of the original user. This could theoretically result in privilege escalation if a Machine ID bot: (a) had any worthwhile permissions of its own, which is not the case unless the bot role was manually modified and (b) accidentally handed certs off to an attacker. In practice this bug is fairly difficult to hit: `tbot` always auto-fills all requestable roles if they are otherwise unset, and `tctl bots add` requires `--roles=` to be passed. An empty string here can trigger the bug however it is unlikely a user would pass this by accident. Moreover, a bot without requestable roles cannot accomplish much of anything, so this is exceedingly unlikely to be intended behavior. Additionally, certificate generation checks help to mitigate the issue: bots currently lock themselves by accident after the first renewal when this bug is triggered as they don't explicitly handle receiving renewable certs when impersonated certs are expected. If an attacker were to attempt a renewal, the generation counter would similarly limit access, and as noted previously, the bot role grants only minimal read-only access anyway. --- To resolve the issue, this adds a new `RoleRequestsOnly` flag to `UserCertsRequest` that allows clients to unambiguously specify if they wish to receive a non-impersonated, possibly renewable, cert with all the original user's roles and permissions, or if they wish to receive only role-impersonated certs (or an error if roles are empty). Machine ID passes this flag in all situations where an impersonated cert is desired. Additionally, we also now ensure users add at least one role in `CreateBot()` (called by `tctl bots add`) as this is almost certainly an unintended situation. Fixes #13411 * Address review feedback, rename flag to UseRoleRequests * Return a local error if no roles are specified
124 lines
3.9 KiB
Go
124 lines
3.9 KiB
Go
/*
|
|
Copyright 2022 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package tbot
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/gravitational/teleport/api/identityfile"
|
|
"github.com/gravitational/teleport/api/types"
|
|
"github.com/gravitational/teleport/lib/tbot/config"
|
|
"github.com/gravitational/teleport/lib/tbot/destination"
|
|
"github.com/gravitational/teleport/lib/tbot/testhelpers"
|
|
"github.com/gravitational/teleport/lib/tlsca"
|
|
"github.com/gravitational/teleport/lib/utils"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// Note: This test lives in main to avoid otherwise inevitable import cycles
|
|
// if we tried importing renewal code from the config package.
|
|
|
|
// validateTemplate loads and validates a config template from the destination
|
|
func validateTemplate(t *testing.T, tplI config.Template, dest destination.Destination) {
|
|
t.Helper()
|
|
|
|
// First, make sure all advertised files exist.
|
|
for _, file := range tplI.Describe(dest) {
|
|
// Don't bother checking directories, they're meant to be black
|
|
// boxes. We could implement type-specific checks if we really
|
|
// wanted.
|
|
if file.IsDir {
|
|
continue
|
|
}
|
|
|
|
bytes, err := dest.Read(file.Name)
|
|
require.NoError(t, err)
|
|
|
|
// Should at least be non-empty.
|
|
t.Logf("Expected file %q for template %q has length: %d", file.Name, tplI.Name(), len(bytes))
|
|
require.Truef(t, len(bytes) > 0, "file %q in template %q must be non-empty", file.Name, tplI.Name())
|
|
}
|
|
|
|
// Next, for supported template types, make sure they're valid.
|
|
// TODO: consider adding further type-specific tests.
|
|
switch tpl := tplI.(type) {
|
|
case *config.TemplateIdentity:
|
|
// Make sure the identityfile package can read this identity file.
|
|
b, err := dest.Read(tpl.FileName)
|
|
require.NoError(t, err)
|
|
|
|
buf := bytes.NewBuffer(b)
|
|
_, err = identityfile.Read(buf)
|
|
require.NoError(t, err)
|
|
case *config.TemplateTLSCAs:
|
|
b, err := dest.Read(tpl.HostCAPath)
|
|
require.NoError(t, err)
|
|
_, err = tlsca.ParseCertificatePEM(b)
|
|
require.NoError(t, err)
|
|
|
|
b, err = dest.Read(tpl.UserCAPath)
|
|
require.NoError(t, err)
|
|
_, err = tlsca.ParseCertificatePEM(b)
|
|
require.NoError(t, err)
|
|
}
|
|
}
|
|
|
|
// TestTemplateRendering performs a full renewal and ensures all expected
|
|
// default config templates are present.
|
|
func TestDefaultTemplateRendering(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// Make a new auth server.
|
|
fc, fds := testhelpers.DefaultConfig(t)
|
|
_ = testhelpers.MakeAndRunTestAuthServer(t, fc, fds)
|
|
rootClient := testhelpers.MakeDefaultAuthClient(t, fc)
|
|
|
|
// Make and join a new bot instance.
|
|
const roleName = "dummy-role"
|
|
role, err := types.NewRole(roleName, types.RoleSpecV5{})
|
|
require.NoError(t, err)
|
|
require.NoError(t, rootClient.UpsertRole(context.Background(), role))
|
|
|
|
botParams := testhelpers.MakeBot(t, rootClient, "test", roleName)
|
|
botConfig := testhelpers.MakeMemoryBotConfig(t, fc, botParams)
|
|
storage, err := botConfig.Storage.GetDestination()
|
|
require.NoError(t, err)
|
|
b := New(botConfig, utils.NewLoggerForTests(), nil)
|
|
|
|
ident, err := b.getIdentityFromToken()
|
|
require.NoError(t, err)
|
|
botClient := testhelpers.MakeBotAuthClient(t, fc, ident)
|
|
b._ident = ident
|
|
b._client = botClient
|
|
|
|
err = b.renew(context.Background(), storage)
|
|
require.NoError(t, err)
|
|
|
|
dest := botConfig.Destinations[0]
|
|
destImpl, err := dest.GetDestination()
|
|
require.NoError(t, err)
|
|
|
|
for _, templateName := range config.GetRequiredConfigs() {
|
|
cfg := dest.GetConfigByName(templateName)
|
|
require.NotNilf(t, cfg, "template %q must exist", templateName)
|
|
|
|
validateTemplate(t, cfg, destImpl)
|
|
}
|
|
}
|