feat: delegation chains, session tracking, audit CLI, CE rules (v0.13.0)#81
Merged
feat: delegation chains, session tracking, audit CLI, CE rules (v0.13.0)#81
Conversation
Delegation chain verification (stage 2.5): parses X-Oktsec-Delegation header, verifies Ed25519 signatures, scope, expiry, and chain depth. Invalid chains always rejected (403). Optional via require_delegation config (default false). Auto session tracking: resolves or creates session IDs per agent with 30-min TTL. Metadata enrichment only, never rejects. Supports explicit X-Oktsec-Session header override.
Thread-safe session store for auto-generating per-agent session IDs. 30-min idle TTL, background eviction every 60s, crypto/rand UUIDs. 10 tests including concurrent access and handler integration.
Offline verification of the tamper-evident audit chain. Opens SQLite directly, verifies SHA-256 hash chain and optional Ed25519 signatures. Supports --db, --key, --limit, --json flags. Exit codes: 0=valid, 1=broken, 2=error. 9 tests.
Load proxy public key and pass to VerifyChain for full signature verification. Shows green badge when chain + signatures valid, yellow when chain valid but no proxy key, red when broken. Graceful fallback if proxy.pub missing.
12 CE- rules (container escape): Docker socket probe, capability enum, host filesystem probe, cgroup escape, namespace escape, runc exploit, eBPF exploitation, kernel memory exploits, Docker API abuse, and more. 2 IAP rules (vuln knowledge transfer): CVE+exploit keyword detection and container escape instruction detection. Both use match_mode:all to require multiple signals. Total rules: 244 (230 + 14 new).
Audit writes are async (batched via channel). On slower CI machines the handler goroutine may not have enqueued the entry before Flush polls the channel. Add 50ms sleep before Flush calls to prevent flaky failures.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
X-Oktsec-Delegationheader in pipeline (stage 2.5). Ed25519 signature, scope, expiry, depth validation. Invalid chains always rejected. Optional viarequire_delegationconfig (default false, backwards compatible)X-Oktsec-Sessionheaderoktsec audit verify-chain: Offline CLI verification of tamper-evident audit chain. Opens SQLite directly, verifies SHA-256 hashes + Ed25519 signatures. Exit codes: 0=valid, 1=broken, 2=errorBreaking changes
None. All new features are additive:
require_delegationdefaults to false (no enforcement unless explicitly enabled)oktsec auditunchangedTest plan
make build && make test && make lint && make vetall passmodprobe nf_tables