Merge commit from fork

Advisory fix

Author: aojea

api/network.go

@@ -19,6 +19,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"regexp"
+	"strconv"
 	"strings"
 	"time"
 
@@ -74,6 +75,33 @@ const (
 	TokenRefreshCheckInterval = 10 * time.Minute
 )
 
+// EnrollChallenge is the payload a bootstrap enrollee signs to prove
+// possession of the private half of BootstrapEnrollRequest.public_key at
+// POST /enroll, carried in that message's timestamp/challenge_signature
+// fields. Binding the peer ID keeps a captured signature useless for any
+// other peer; the domain prefix keeps it useless at any other endpoint.
+func EnrollChallenge(peerID string, ts int64) []byte {
+	return []byte("sam:enroll:" + peerID + ":" + strconv.FormatInt(ts, 10))
+}
+
+// EnrollStatusChallenge is the payload a bootstrap enrollee signs to prove
+// possession of the key it submitted at /enroll when polling
+// GET /enroll/status. ts is unix milliseconds; the signature travels in the
+// HeaderChallengeSignature header (unpadded base64url) alongside
+// HeaderChallengeTimestamp.
+func EnrollStatusChallenge(peerID string, ts int64) []byte {
+	return []byte("sam:enroll-status:" + peerID + ":" + strconv.FormatInt(ts, 10))
+}
+
+// RefreshChallenge is the payload an enrolled peer signs to prove possession
+// of its identity key at POST /refresh, carried in TokenRefreshRequest's
+// timestamp/challenge_signature fields alongside the expiring biscuit. Same
+// shape as the other enrollment challenges: peer- and endpoint-bound, so a
+// captured signature is useless anywhere else.
+func RefreshChallenge(peerID string, ts int64) []byte {
+	return []byte("sam:refresh:" + peerID + ":" + strconv.FormatInt(ts, 10))
+}
+
 // ============================================================================
 // SAM Custom HTTP Headers
 // ============================================================================
@@ -87,6 +115,14 @@ const (
 	// are forwarded to backend services.
 	HeaderSamBiscuit = "X-Sam-Biscuit"
 
+	// HeaderChallengeTimestamp and HeaderChallengeSignature carry the signed
+	// freshness challenge on GET /enroll/status: unix milliseconds and an
+	// unpadded base64url signature over EnrollStatusChallenge. Headers rather
+	// than query parameters, so the signature never lands in access logs,
+	// where it would be replayable for its freshness window.
+	HeaderChallengeTimestamp = "X-Sam-Challenge-Ts"
+	HeaderChallengeSignature = "X-Sam-Challenge-Sig"
+
 	// HeaderPeerID carries the authenticated libp2p peer ID of the caller.
 	// The mesh ingress handler stamps it after authorization succeeds,
 	// overwriting any inbound value, so backend services get verified caller

api/sam.pb.go

@@ -85,8 +85,22 @@ message BootstrapEnrollRequest {
   // Operator-declared labels; the admin approving the enrollment attests
   // them (see EnrollRequest.labels).
   map<string, string> labels = 5;
-}
-
+  // Proof of possession of public_key's private half: timestamp is unix
+  // milliseconds and challenge_signature signs the UTF-8 bytes of
+  // "sam:enroll:<peer_id>:<timestamp>". Required, and peer_id must be
+  // derived from public_key: this is what entitles a repeated POST /enroll
+  // to re-fetch an existing enrollment's biscuit, so a bootstrap token
+  // alone must never satisfy it.
+  int64 timestamp = 6;
+  bytes challenge_signature = 7;
+}
+
+// BootstrapEnrollResponse answers POST /enroll and GET /enroll/status.
+// Polling GET /enroll/status requires proof of possession of the key
+// submitted at /enroll: alongside the `peer_id` query parameter, the caller
+// sends the X-Sam-Challenge-Ts header (unix milliseconds) and the
+// X-Sam-Challenge-Sig header (unpadded base64url signature over the UTF-8
+// bytes of "sam:enroll-status:<peer_id>:<ts>").
 message BootstrapEnrollResponse {
   EnrollmentStatus status = 1;
   bytes biscuit_token = 2;         // Populated only if APPROVED
@@ -216,7 +230,10 @@ message KeysResponse {
 }
 
 message TokenRefreshRequest {
-  // Signature over the decimal string form of timestamp, made with the node key.
+  // Signature with the node key over the UTF-8 bytes of
+  // "sam:refresh:<peer_id>:<timestamp>", where peer_id is the one bound in
+  // the presented biscuit. Peer- and endpoint-bound so a captured signature
+  // verifies nowhere else.
   bytes challenge_signature = 1;
   // Unix milliseconds. Must be within the control plane's freshness window.
   int64 timestamp = 2;

api/sam.proto

@@ -96,12 +96,19 @@ func TestApprovalRefusesLabelsTheRoleDoesNotGrant(t *testing.T) {
 			t.Fatal(err)
 		}
 
+		enrollTS := time.Now().UnixMilli()
+		enrollSig, err := priv.Sign(api.EnrollChallenge(pID.String(), enrollTS))
+		if err != nil {
+			t.Fatal(err)
+		}
 		enrollData, err := proto.Marshal(&api.BootstrapEnrollRequest{
-			BootstrapToken: tokenDetails.Token,
-			PeerId:         pID.String(),
-			PublicKey:      pubBytes,
-			RequestedRole:  api.RoleNode,
-			Labels:         labels,
+			BootstrapToken:     tokenDetails.Token,
+			PeerId:             pID.String(),
+			PublicKey:          pubBytes,
+			RequestedRole:      api.RoleNode,
+			Labels:             labels,
+			Timestamp:          enrollTS,
+			ChallengeSignature: enrollSig,
 		})
 		if err != nil {
 			t.Fatal(err)

internal/controlplane/approval_labels_test.go

@@ -119,7 +119,11 @@ func refreshNode(t *testing.T, cpURL string, priv crypto.PrivKey, currentBiscuit
 	t.Helper()
 
 	timestamp := time.Now().UnixMilli()
-	sig, err := priv.Sign([]byte(fmt.Sprintf("%d", timestamp)))
+	pid, err := peer.IDFromPrivateKey(priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sig, err := priv.Sign(api.RefreshChallenge(pid.String(), timestamp))
 	if err != nil {
 		t.Fatal(err)
 	}