Files
shopdb-flask/shopdb/core/models/asset.py
Proudlock 18e5fdc000 Fix critical security vulnerabilities in client certificate authentication
CRITICAL FIXES:
- Enforce cert authentication on collector telemetry endpoint
- Add authorization check in report_command_result (prefer cert over hostname)
- Implement server certificate pinning in C# agents (optional)
- Add constant-time fingerprint comparison to prevent timing attacks
- Validate fingerprint format (40 or 64 hex chars only)

AUTHENTICATION:
- Created shopdb/core/auth/client_cert.py with authenticate_by_client_cert()
- Extracts fingerprint from nginx header (SHA1), IIS environ, or ARR header
- Validates against assets.client_cert_fingerprint in database
- Checks certificate expiration (cert_expires_at column)
- Falls back to API key when cert not present (dual-auth during rollout)

AUTHORIZATION:
- shopdb/core/api/collector.py: Added cert auth to generic_collect() before
  API key check. Sets g.cert_authenticated_asset_id when cert validates.
- plugins/endpoints/plugin.py: apply_collector_payload() compares
  g.cert_authenticated_asset_id with payload's resolved assetid. Raises
  PermissionError if mismatch (prevents agent A from submitting data for
  asset B by changing hostname field).
- plugins/endpoints/api/routes.py: report_command_result() prefers
  g.cert_authenticated_asset_id over hostname parameter. Requires either
  cert or hostname for authorization.

AGENT CHANGES:
- AgentConfig.cs: Added ServerCertThumbprint config for certificate pinning
- CollectorClient.cs: Validates server cert thumbprint when configured
- CommandClient.cs: Validates server cert on WebSocket TLS
- FleetAlertClient.cs: Validates server cert on WebSocket TLS
- When ServerCertThumbprint is empty, accepts all certs (rollout compat)

REVOCATION SUPPORT:
- Added cert_revoked_at and cert_revocation_reason columns to assets table
- Migration 0022_client_cert_revocation.py adds columns
- Revocation check uses hasattr() for backward compatibility
- Revocation requires manual database UPDATE (instant kill switch)

SECURITY HARDENING:
- Constant-time fingerprint comparison via hmac.compare_digest()
- Format validation: must be 40 (SHA1) or 64 (SHA256) hex chars
- SHA1 documented as nginx limitation, acceptable for air-gapped self-signed
- Audit logging for failed authentication attempts (AuditLog.log)

DEPLOYMENT:
- Dual-auth during rollout: cert OR API key both work
- Agents without certs continue using API key (backward compatible)
- No impact on existing fleet until certs provisioned
- Rollout: server first, pilot certs, fleet rollout, retire API key

Addresses Fable security review findings: 1 critical + 5 high vulnerabilities
related to authentication bypass, authorization flaws, and timing attacks.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-09-14 13:58:02 -04:00

356 lines
13 KiB
Python

"""Polymorphic Asset models - core of the new asset architecture."""
from shopdb.extensions import db
from .base import BaseModel, SoftDeleteMixin, AuditMixin
class AssetType(BaseModel):
"""
Registry of asset categories.
Each type maps to a plugin-owned extension table.
Examples: machine, computer, network_device, printer
"""
__tablename__ = 'assettypes'
assettypeid = db.Column(db.Integer, primary_key=True)
assettype = db.Column(
db.String(50),
unique=True,
nullable=False,
comment='Category name: machine, computer, network_device, printer'
)
pluginname = db.Column(
db.String(100),
nullable=True,
comment='Plugin that owns this type'
)
tablename = db.Column(
db.String(100),
nullable=True,
comment='Extension table name for this type'
)
description = db.Column(db.Text)
icon = db.Column(db.String(50), comment='Icon name for UI')
color = db.Column(db.String(20), comment='CSS color for UI/map markers')
def __repr__(self):
return f"<AssetType {self.assettype}>"
class AssetStatus(BaseModel):
"""Asset status options."""
__tablename__ = 'assetstatuses'
statusid = db.Column(db.Integer, primary_key=True)
status = db.Column(db.String(50), unique=True, nullable=False)
description = db.Column(db.Text)
color = db.Column(db.String(20), comment='CSS color for UI')
def __repr__(self):
return f"<AssetStatus {self.status}>"
class Asset(BaseModel, SoftDeleteMixin, AuditMixin):
"""
Core asset model - minimal shared fields.
Category-specific data lives in plugin extension tables
(machines, computers, network_devices, printers).
The assetid matches original machineid for migration compatibility.
"""
__tablename__ = 'assets'
assetid = db.Column(db.Integer, primary_key=True)
# Identification
assetnumber = db.Column(
db.String(50),
unique=True,
nullable=False,
index=True,
comment='Business identifier (e.g., CMM01, G5QX1GT3ESF)'
)
name = db.Column(
db.String(100),
comment='Display name/alias'
)
gaugelabreference = db.Column(
db.String(50),
index=True,
comment='Gauge lab asset reference (authoritative tag the gauge lab '
'assigns to machines); distinct from assetnumber'
)
maintenancereference = db.Column(
db.String(50),
index=True,
comment='Maintenance system asset reference; distinct from assetnumber'
)
serialnumber = db.Column(
db.String(100),
index=True,
comment='Hardware serial number'
)
# Classification
assettypeid = db.Column(
db.Integer,
db.ForeignKey('assettypes.assettypeid'),
nullable=False
)
statusid = db.Column(
db.Integer,
db.ForeignKey('assetstatuses.statusid'),
default=1,
comment='In Use, Spare, Retired, etc.'
)
# Location and organization
locationid = db.Column(
db.Integer,
db.ForeignKey('locations.locationid'),
nullable=True
)
businessunitid = db.Column(
db.Integer,
db.ForeignKey('businessunits.businessunitid'),
nullable=True
)
# Floor map position (ADR-001: asset-specific override; nullable).
#
# Absolute pixels in the NATIVE COORDINATE SPACE OF ITS LEVEL, not of the
# site (ADR-017). levelid says which drawing they are pixels of, and without
# it a position cannot be rendered - a marker drawn on the wrong level's
# blueprint looks perfectly correct and points at the wrong place, so the UI
# shows "level unknown" rather than assuming the default.
mapx = db.Column(db.Integer, comment='X coordinate on this level (ADR-017)')
mapy = db.Column(db.Integer, comment='Y coordinate on this level (ADR-017)')
levelid = db.Column(
db.Integer, db.ForeignKey('maplevels.levelid'), nullable=True,
index=True,
comment='Which drawing mapx/mapy are pixels of (ADR-017)')
# When the position was last CONFIRMED against the current drawing. A bulk
# transform clears it, because a transform is a starting guess: the levels
# were redrawn and machines moved, and nothing in the coordinates says which
# markers are now stale. Null means "not yet reviewed on this drawing".
mapverifiedat = db.Column(db.DateTime, nullable=True)
# Notes
notes = db.Column(db.Text, nullable=True)
# Client certificate authentication (endpoints plugin)
client_cert_fingerprint = db.Column(
db.String(64),
nullable=True,
index=True,
comment='SHA1 or SHA256 fingerprint of client certificate for mTLS auth'
)
cert_issued_at = db.Column(
db.DateTime,
nullable=True,
comment='When the client certificate was issued'
)
cert_expires_at = db.Column(
db.DateTime,
nullable=True,
comment='When the certificate expires'
)
cert_revoked_at = db.Column(
db.DateTime,
nullable=True,
comment='When the certificate was revoked (null = not revoked)'
)
cert_revocation_reason = db.Column(
db.String(255),
nullable=True,
comment='Why the certificate was revoked (admin note)'
)
# Relationships
assettype = db.relationship('AssetType', backref='assets')
status = db.relationship('AssetStatus', backref='assets')
location = db.relationship('Location', backref='assets')
businessunit = db.relationship('BusinessUnit', backref='assets')
# Communications (one-to-many) - will be migrated to use assetid
communications = db.relationship(
'Communication',
foreign_keys='Communication.assetid',
backref='asset',
cascade='all, delete-orphan',
lazy='dynamic'
)
# Indexes
__table_args__ = (
db.Index('idx_asset_type_bu', 'assettypeid', 'businessunitid'),
db.Index('idx_asset_location', 'locationid'),
db.Index('idx_asset_active', 'isactive'),
db.Index('idx_asset_status', 'statusid'),
)
def __repr__(self):
return f"<Asset {self.assetnumber}>"
@property
def display_name(self):
"""Get display name (name if set, otherwise assetnumber)."""
return self.name or self.assetnumber
@property
def primary_ip(self):
"""Get primary IP address from communications."""
comm = self.communications.filter_by(
isprimary=True,
comtypeid=1 # IP type
).first()
if comm:
return comm.ipaddress
# Fall back to any IP
comm = self.communications.filter_by(comtypeid=1).first()
return comm.ipaddress if comm else None
def get_inherited_location(self):
"""
Get location data from a related asset if this asset has none.
Returns dict with locationid, location_name, mapx, mapy, and
inherited_from (assetnumber of source asset) if location was inherited.
Returns None if no location data available.
"""
if self.locationid is not None or (self.mapx is not None and self.mapy is not None):
return None
related_assets = []
if hasattr(self, 'incoming_relationships'):
for rel in self.incoming_relationships:
if rel.sourceasset and rel.isactive:
related_assets.append(rel.sourceasset)
if hasattr(self, 'outgoing_relationships'):
for rel in self.outgoing_relationships:
if rel.targetasset and rel.isactive:
related_assets.append(rel.targetasset)
for related in related_assets:
if related.locationid is not None or (related.mapx is not None and related.mapy is not None):
return {
'locationid': related.locationid,
'locationname': related.location.locationname if related.location else None,
'mapx': related.mapx,
'mapy': related.mapy,
# The level belongs to whichever asset supplied the
# coordinates (ADR-017). Inheriting a position without its
# level draws it on the borrower's drawing instead.
'levelid': related.levelid,
'inheritedfrom': related.assetnumber
}
return None
def to_dict(self, include_type_data=False, include_inherited_location=True):
"""
Convert model to dictionary.
Args:
include_type_data: If True, include category-specific data from extension table
include_inherited_location: If True, include location from related assets when missing
"""
result = super().to_dict()
# Add related object names for convenience
if self.assettype:
result['assettypename'] = self.assettype.assettype
result['assettypecolor'] = getattr(self.assettype, 'color', None)
if self.status:
result['statusname'] = self.status.status
result['statuscolor'] = self.status.color
if self.location:
result['locationname'] = self.location.locationname
if self.businessunit:
result['businessunitname'] = self.businessunit.businessunit
# Add plugin-specific ID for navigation purposes
if hasattr(self, 'machine') and self.machine:
result['pluginid'] = self.machine.machineid
elif hasattr(self, 'computer') and self.computer:
result['pluginid'] = self.computer.computerid
elif hasattr(self, 'network_device') and self.network_device:
result['pluginid'] = self.network_device.networkdeviceid
elif hasattr(self, 'printer') and self.printer:
result['pluginid'] = self.printer.printerid
elif hasattr(self, 'measuringtool') and self.measuringtool:
result['pluginid'] = self.measuringtool.measuringtoolid
# What this asset OWNS, before any inheritance is merged in below.
#
# The merge is right for a reader: a detail page, a list and the map all
# want the resolved location, whoever it came from. It is wrong for a
# FORM, which reads the same payload and cannot tell an owned value
# from a derived one - so the PC form pre-selected an inherited
# location, the operator saved something else entirely, and the
# inherited value was written back as the record's own. The asset then
# stopped following its parent, silently, on an edit that never touched
# location.
#
# Always emitted, even when nothing is inherited, so a client can bind
# to these without checking whether the merge happened.
result['ownlocationid'] = self.locationid
result['ownmapx'] = self.mapx
result['ownmapy'] = self.mapy
result['ownlevelid'] = self.levelid
# Include inherited location if this asset has no location data
if include_inherited_location:
inherited = self.get_inherited_location()
if inherited:
result['inheritedlocation'] = inherited
# Also set the location fields if they're missing
if result.get('locationid') is None:
result['locationid'] = inherited['locationid']
result['locationname'] = inherited['locationname']
if result.get('mapx') is None:
result['mapx'] = inherited['mapx']
if result.get('mapy') is None:
result['mapy'] = inherited['mapy']
# Coordinates and their level move together, always. Copying the
# position while leaving levelid as this asset's own is how an
# inherited marker lands on the wrong drawing.
if result.get('levelid') is None:
result['levelid'] = inherited.get('levelid')
# Operation/short code of the resolved location (own or inherited).
# Derived from the location name's leading token; labels can encode a
# tool's inspection operation instead of the tool. None when unplaced.
from .location import derive_locationcode
result['locationcode'] = derive_locationcode(result.get('locationname'))
# Include extension data if requested
if include_type_data:
ext_data = self._get_extension_data()
if ext_data:
result['typedata'] = ext_data
return result
def _get_extension_data(self):
"""Get category-specific data from extension table."""
# Check for machine extension
if hasattr(self, 'machine') and self.machine:
return self.machine.to_dict()
# Check for computer extension
if hasattr(self, 'computer') and self.computer:
return self.computer.to_dict()
# Check for network_device extension
if hasattr(self, 'network_device') and self.network_device:
return self.network_device.to_dict()
# Check for printer extension
if hasattr(self, 'printer') and self.printer:
return self.printer.to_dict()
# Check for measuring-tool extension
if hasattr(self, 'measuringtool') and self.measuringtool:
return self.measuringtool.to_dict()
return None