Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Code

392 commit(s) on main

Compare History
Merge change request 01M70WES5ZZDJ6RP226WB11BBZ: Let people rename and remove their own passkeys keenan · 1h ago 4b8c9e1d
history blame raw 7.2 KiB
1package audit
2
3import (
4 "errors"
5 "fmt"
6 "os"
7 "path/filepath"
8 "strings"
9 "sync"
10 "testing"
11 "time"
12 "unicode/utf8"
13
14 "rodent.software/vole/internal/secure"
15)
16
17func TestFormatHasFiveColumns(t *testing.T) {
18 at := time.Date(2026, 10, 27, 12, 0, 0, 0, time.UTC)
19 line := Format(Record{Action: "acl.update", Actor: "keenan", Subject: "vole", Detail: "role=admin"}, at)
20 if got, want := line, "2026-10-27T12:00:00Z\tacl.update\tkeenan\tvole\trole=admin\n"; got != want {
21 t.Fatalf("Format() = %q, want %q", got, want)
22 }
23}
24
25func TestFormatRendersEmptyActorAndSubject(t *testing.T) {
26 line := Format(Record{Action: "session.revoke-all", Detail: "2 session(s)"}, time.Now())
27 fields := strings.Split(strings.TrimSuffix(line, "\n"), "\t")
28 if len(fields) != 5 {
29 t.Fatalf("got %d columns in %q, want 5", len(fields), line)
30 }
31 if fields[2] != "-" || fields[3] != "-" {
32 t.Fatalf("empty actor/subject = %q/%q, want %q", fields[2], fields[3], "-")
33 }
34}
35
36// A key comment, an LFS lock path, an admin argument and a repository name are
37// all user content. None of them may add a column or a second record.
38func TestFormatEscapesFieldInjection(t *testing.T) {
39 injected := "evil\tadmin\troot\n2020-01-01T00:00:00Z\tauth.grant\troot\tall\r-carriage"
40 line := Format(Record{Action: "identity.add-key", Actor: injected, Subject: injected, Detail: injected}, time.Now())
41 if n := strings.Count(line, "\n"); n != 1 {
42 t.Fatalf("record has %d newlines, want 1:\n%q", n, line)
43 }
44 if strings.HasSuffix(line, "\n") == false {
45 t.Fatalf("record does not end with a newline: %q", line)
46 }
47 fields := strings.Split(strings.TrimSuffix(line, "\n"), "\t")
48 if len(fields) != 5 {
49 t.Fatalf("got %d columns, want 5:\n%q", len(fields), line)
50 }
51 for _, f := range fields[1:] {
52 if strings.ContainsAny(f, "\t\r\n") {
53 t.Fatalf("field %q still contains a separator", f)
54 }
55 }
56}
57
58func TestFormatEscapesControlCharacters(t *testing.T) {
59 line := Format(Record{Action: "x", Detail: "a\x00b\x1bc\x7fd\u009be\u2028f"}, time.Now())
60 for _, bad := range []string{"\x00", "\x1b", "\x7f", "\u009b", "\u2028"} {
61 if strings.Contains(line, bad) {
62 t.Fatalf("control character %q survived: %q", bad, line)
63 }
64 }
65 if !strings.Contains(line, "a b c d e f") {
66 t.Fatalf("control characters were not replaced with spaces: %q", line)
67 }
68}
69
70func TestFormatTruncatesLongFields(t *testing.T) {
71 detail := strings.Repeat("é", FieldLimit)
72 got := Sanitize(detail)
73 if !utf8.ValidString(got) {
74 t.Fatalf("truncation split a rune: %q", got)
75 }
76 if !strings.HasSuffix(got, " (truncated)") {
77 t.Fatalf("truncated field does not say so: %q", got)
78 }
79 if len(got) > FieldLimit+len(" (truncated)") {
80 t.Fatalf("truncated field is %d bytes, want at most %d", len(got), FieldLimit+len(" (truncated)"))
81 }
82}
83
84func TestAppendCreatesFileAtFileMode(t *testing.T) {
85 path := filepath.Join(t.TempDir(), "audit.log")
86 if err := Append(path, Record{Action: "acl.update", Actor: "keenan", Subject: "vole"}); err != nil {
87 t.Fatalf("Append: %v", err)
88 }
89 st, err := os.Stat(path)
90 if err != nil {
91 t.Fatalf("stat: %v", err)
92 }
93 if st.Mode().Perm() != secure.FileMode {
94 t.Fatalf("mode = %04o, want %04o", st.Mode().Perm(), secure.FileMode)
95 }
96}
97
98// An instance upgraded from a version that created the log 0644 must stop being
99// world-readable the next time it is written, not only when it is recreated.
100func TestAppendTightensExistingFile(t *testing.T) {
101 path := filepath.Join(t.TempDir(), "audit.log")
102 if err := os.WriteFile(path, []byte("old line\n"), 0o644); err != nil {
103 t.Fatalf("seed: %v", err)
104 }
105 if err := os.Chmod(path, 0o644); err != nil {
106 t.Fatalf("chmod: %v", err)
107 }
108 if err := Append(path, Record{Action: "acl.update"}); err != nil {
109 t.Fatalf("Append: %v", err)
110 }
111 st, err := os.Stat(path)
112 if err != nil {
113 t.Fatalf("stat: %v", err)
114 }
115 if st.Mode().Perm() != secure.FileMode {
116 t.Fatalf("mode = %04o after append, want %04o", st.Mode().Perm(), secure.FileMode)
117 }
118}
119
120func TestAppendRefusesMissingSinkAndAction(t *testing.T) {
121 if err := Append("", Record{Action: "acl.update"}); !errors.Is(err, ErrNoSink) {
122 t.Fatalf("Append with no path = %v, want ErrNoSink", err)
123 }
124 path := filepath.Join(t.TempDir(), "audit.log")
125 if err := Append(path, Record{}); err == nil {
126 t.Fatal("Append with no action succeeded, want an error")
127 }
128 if _, err := os.Stat(path); !os.IsNotExist(err) {
129 t.Fatalf("a refused record created %s", path)
130 }
131}
132
133func TestAppendReportsWriteFailure(t *testing.T) {
134 dir := t.TempDir()
135 blocker := filepath.Join(dir, "not-a-dir")
136 if err := os.WriteFile(blocker, []byte("x"), 0o600); err != nil {
137 t.Fatalf("seed: %v", err)
138 }
139 if err := Append(filepath.Join(blocker, "audit.log"), Record{Action: "acl.update"}); err == nil {
140 t.Fatal("Append under a non-directory succeeded, want an error")
141 }
142}
143
144// The web, the SSH server and every hook process append to one file. O_APPEND
145// plus one write per line is what keeps their lines from interleaving.
146func TestAppendKeepsConcurrentLinesWhole(t *testing.T) {
147 path := filepath.Join(t.TempDir(), "audit.log")
148 const writers, lines = 8, 25
149 var wg sync.WaitGroup
150 errs := make(chan error, writers)
151 for w := 0; w < writers; w++ {
152 wg.Add(1)
153 go func(w int) {
154 defer wg.Done()
155 for i := 0; i < lines; i++ {
156 err := Append(path, Record{
157 Action: "push.force",
158 Actor: fmt.Sprintf("acct-%d", w),
159 Subject: fmt.Sprintf("refs/heads/branch-%d", w),
160 Detail: fmt.Sprintf("line %d", i),
161 })
162 if err != nil {
163 errs <- err
164 return
165 }
166 }
167 }(w)
168 }
169 wg.Wait()
170 close(errs)
171 for err := range errs {
172 t.Fatalf("Append: %v", err)
173 }
174 raw, err := os.ReadFile(path)
175 if err != nil {
176 t.Fatalf("read: %v", err)
177 }
178 rows := strings.Split(strings.TrimSuffix(string(raw), "\n"), "\n")
179 if len(rows) != writers*lines {
180 t.Fatalf("got %d lines, want %d", len(rows), writers*lines)
181 }
182 for _, row := range rows {
183 cols := strings.Split(row, "\t")
184 if len(cols) != 5 {
185 t.Fatalf("interleaved line %q has %d columns", row, len(cols))
186 }
187 if _, err := time.Parse(time.RFC3339, cols[0]); err != nil {
188 t.Fatalf("line %q has no timestamp: %v", row, err)
189 }
190 }
191}
192
193func TestCheckCreatesAndTightens(t *testing.T) {
194 path := filepath.Join(t.TempDir(), "audit.log")
195 if err := Check(path); err != nil {
196 t.Fatalf("Check on a missing log: %v", err)
197 }
198 st, err := os.Stat(path)
199 if err != nil {
200 t.Fatalf("Check did not create the log: %v", err)
201 }
202 if st.Mode().Perm() != secure.FileMode {
203 t.Fatalf("mode = %04o, want %04o", st.Mode().Perm(), secure.FileMode)
204 }
205 if err := Check(""); !errors.Is(err, ErrNoSink) {
206 t.Fatalf("Check with no path = %v, want ErrNoSink", err)
207 }
208}
209
210// A symlink lets whoever can write the data directory point the audit log at
211// /dev/null and keep every privileged change.
212func TestCheckRefusesSymlink(t *testing.T) {
213 dir := t.TempDir()
214 target := filepath.Join(dir, "real.log")
215 if err := os.WriteFile(target, nil, 0o600); err != nil {
216 t.Fatalf("seed: %v", err)
217 }
218 link := filepath.Join(dir, "audit.log")
219 if err := os.Symlink(target, link); err != nil {
220 t.Fatalf("symlink: %v", err)
221 }
222 if err := Check(link); err == nil || !strings.Contains(err.Error(), "symlink") {
223 t.Fatalf("Check on a symlink = %v, want a symlink error", err)
224 }
225}
226
227func TestCheckRefusesDirectory(t *testing.T) {
228 if err := Check(t.TempDir()); err == nil {
229 t.Fatal("Check on a directory succeeded, want an error")
230 }
231}
232