initial tpm broker
This commit is contained in:
Audiobuzz
@@ -3,3 +3,11 @@ CA_DNS=ca.fleet.lab # DNS name(s) clients reach step-ca on (resolved by
|
||||
CA_PORT=8443 # step-ca listen port (host networking)
|
||||
CA_PASSWORD=changeme-bench # password protecting the CA keys (bench only)
|
||||
RADIUS_SECRET=testing123 # shared secret between the authenticator (hostapd) and FreeRADIUS
|
||||
|
||||
# --- enrol-broker (TPM identity enrolment; docs/tpm-enrolment-design.md) -------
|
||||
# Before `docker compose up -d enrol-broker`, issue the admin mTLS PKI (a
|
||||
# DEDICATED admin CA, separate from the fleet CA) and one client cert per admin:
|
||||
# ../enrol-broker/admin-pki.sh ./pki/broker alice
|
||||
# then import pki/broker/clients/alice.p12 (empty password) into the browser and
|
||||
# open https://127.0.0.1:9443/ . The public /enrol/ endpoint is reached via the
|
||||
# serving stack's nginx (http://boot.fleet.lab/enrol/).
|
||||
|
||||
@@ -45,3 +45,36 @@ services:
|
||||
- ./freeradius/mods-available/eap:/etc/raddb/mods-available/eap:ro
|
||||
# certs issued by bootstrap.sh: the RADIUS server cert/key + the CA root.
|
||||
- ./pki/radius:/etc/raddb/certs/fleet:ro
|
||||
|
||||
# --- TPM enrolment broker (the ONE unauthenticated, pre-auth endpoint) -------
|
||||
# docs/tpm-enrolment-design.md. Host networking so the SERVING stack's nginx
|
||||
# reaches the public listener on 127.0.0.1:9090 (proxied as /enrol/) and step-ca
|
||||
# is reachable for signing. The admin web UI (mTLS) listens on 127.0.0.1:9443 —
|
||||
# bind it to the management network ONLY; never expose it to the boot LAN.
|
||||
#
|
||||
# First issue the admin mTLS PKI (dedicated admin CA, NOT the fleet root):
|
||||
# ../enrol-broker/admin-pki.sh ./pki/broker <admin-name>
|
||||
enrol-broker:
|
||||
build: ../enrol-broker
|
||||
network_mode: host
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- step-ca
|
||||
environment:
|
||||
BROKER_PUBLIC_ADDR: "127.0.0.1:9090"
|
||||
BROKER_ADMIN_ADDR: "127.0.0.1:9443"
|
||||
BROKER_SIGNER: "step"
|
||||
STEP_CA_URL: "https://${CA_DNS:-ca.fleet.lab}:${CA_PORT:-8443}"
|
||||
STEP_CA_ROOT: "/pki/root_ca.crt"
|
||||
STEP_PROVISIONER: "enrol"
|
||||
STEP_PROVISIONER_PASSWORD_FILE: "/pki/stepca/secrets/password"
|
||||
STEP_CERT_NOT_AFTER: "720h"
|
||||
BROKER_PENDING_TTL: "10m"
|
||||
BROKER_WORDS: "8"
|
||||
HOSTNQN_BASE: "nqn.2026-06.org.example.fleet:host-"
|
||||
# Admin mTLS — server cert/key + the DEDICATED admin client CA (see above).
|
||||
BROKER_ADMIN_CERT: "/pki/broker/server.crt"
|
||||
BROKER_ADMIN_KEY: "/pki/broker/server.key"
|
||||
BROKER_ADMIN_CLIENT_CA: "/pki/broker/admin-ca.crt"
|
||||
volumes:
|
||||
- ./pki:/pki:ro
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
/fleet-enrol-broker
|
||||
*.test
|
||||
@@ -0,0 +1,22 @@
|
||||
# fleet-enrol-broker — TPM identity enrolment broker (docs/tpm-enrolment-design.md).
|
||||
#
|
||||
# Two stages: a reproducible static Go build, then the smallstep `step` CLI image
|
||||
# as the runtime base (the production signer shells out to `step ca token` +
|
||||
# `step ca sign`). The broker is stdlib-only, so the build needs no module
|
||||
# download (GOPROXY=off) and the verity-style reproducibility flags apply.
|
||||
#
|
||||
# Pin + mirror these base tags through your registry (like the rest of the stack)
|
||||
# if the build/serving host has no egress.
|
||||
FROM golang:1.23-alpine AS build
|
||||
WORKDIR /src
|
||||
COPY go.mod .
|
||||
COPY *.go wordlist.txt ./
|
||||
ENV CGO_ENABLED=0 GOPROXY=off GOTOOLCHAIN=local
|
||||
RUN go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o /enrol-broker .
|
||||
|
||||
FROM smallstep/step-cli:latest
|
||||
COPY --from=build /enrol-broker /usr/local/bin/enrol-broker
|
||||
# Non-root by default (the step-cli image runs as uid 1000 "step"); the broker
|
||||
# binds loopback ports >1024 and only READS the mounted CA root + provisioner
|
||||
# password, so no extra privilege is needed.
|
||||
ENTRYPOINT ["/usr/local/bin/enrol-broker"]
|
||||
@@ -0,0 +1,110 @@
|
||||
# fleet-enrol-broker
|
||||
|
||||
The TPM identity **enrolment broker** — the one component that turns "step-ca can
|
||||
sign" into "step-ca signs **only what a human approved**." It is the system's
|
||||
single **unauthenticated, pre-auth bootstrap endpoint**: an empty-NV host submits
|
||||
a CSR, an admin verifies a fingerprint out-of-band and approves, and the broker
|
||||
returns a step-ca-signed cert the host writes to its TPM NV.
|
||||
|
||||
Authoritative design: [`../../docs/tpm-enrolment-design.md`](../../docs/tpm-enrolment-design.md).
|
||||
This is **v1** (fingerprint-only OOB assurance; inline empty-NV vehicle on the host
|
||||
side). TPM attestation and the host-side dracut branch are the next phases.
|
||||
|
||||
## Two listeners, by design
|
||||
|
||||
```
|
||||
PUBLIC (plain HTTP, behind the serving nginx /enrol/) UNAUTHENTICATED
|
||||
POST /request {csr, context} -> {enrol_id, fingerprint, ...}
|
||||
GET /status/{id} -> pending | approved+cert | denied | expired
|
||||
GET /healthz
|
||||
|
||||
ADMIN (mTLS, management network / loopback ONLY) admin client cert
|
||||
GET / the pending-queue web UI (fingerprint + approve/deny)
|
||||
GET /pending JSON queue
|
||||
POST /approve/{id} OOB-approve -> step ca sign -> store cert
|
||||
POST /deny/{id} reject
|
||||
```
|
||||
|
||||
The public side is deliberately tiny and stdlib-only — it is the only thing
|
||||
reachable by un-enrolled devices. The admin side never touches the boot LAN.
|
||||
|
||||
## How identity is gated
|
||||
|
||||
1. Host generates a key **in** the TPM, builds a CSR, `POST /request`.
|
||||
2. Broker stores a time-boxed PENDING record and returns a **fingerprint** =
|
||||
`wordlist( SHA-256( CSR-pubkey ‖ server-nonce ) )`. The nonce is server-chosen
|
||||
per enrol-id, so an attacker can't pre-grind a colliding fingerprint.
|
||||
3. Host shows the fingerprint on its Plymouth splash. An admin opens the mTLS web
|
||||
UI, **cross-checks the fingerprint against the device's screen**, confirms the
|
||||
device context (MAC / DMI / TPM EK), and approves.
|
||||
4. Broker mints a one-time `step` token (it — not the host — holds the provisioner
|
||||
password) and `step ca sign`s the CSR; the cert is returned on the host's next
|
||||
`GET /status/{id}` poll. The hostnqn is derived from the cert serial.
|
||||
|
||||
Lifecycle (from the design): empty-NV → **enrol** (human); near-expiry → **renew**
|
||||
(automatic, not built here); auth-fail with a cert present → **alert, never
|
||||
auto-re-enrol**.
|
||||
|
||||
## Run it (bench)
|
||||
|
||||
The broker ships as a service in [`../dot1x-bench/docker-compose.yml`](../dot1x-bench/docker-compose.yml)
|
||||
alongside step-ca. From `serving/dot1x-bench/`:
|
||||
|
||||
```bash
|
||||
docker compose up -d step-ca && ./step-ca/bootstrap.sh # CA + root_ca.crt + enrol provisioner
|
||||
../enrol-broker/admin-pki.sh ./pki/broker alice # admin mTLS PKI (dedicated admin CA)
|
||||
docker compose up -d enrol-broker
|
||||
```
|
||||
|
||||
Then import `pki/broker/clients/alice.p12` (empty password) into your browser and
|
||||
open `https://127.0.0.1:9443/`. Hosts reach the public side via the serving
|
||||
stack's nginx: `http://boot.fleet.lab/enrol/`.
|
||||
|
||||
### Admin mTLS PKI — important
|
||||
|
||||
`admin-pki.sh` mints a **dedicated admin CA**, separate from the fleet CA. Do
|
||||
**not** point `BROKER_ADMIN_CLIENT_CA` at the fleet root: host *enrolment* certs
|
||||
are signed by that same root, so reusing it would let any enrolled host
|
||||
authenticate to the admin plane and approve enrolments (privilege escalation).
|
||||
|
||||
## Configuration (env)
|
||||
|
||||
| Var | Default | Notes |
|
||||
|---|---|---|
|
||||
| `BROKER_PUBLIC_ADDR` | `127.0.0.1:9090` | unauth listener (behind nginx) |
|
||||
| `BROKER_ADMIN_ADDR` | `127.0.0.1:9443` | mTLS admin listener (mgmt net only) |
|
||||
| `BROKER_SIGNER` | `step` | `step` (prod) or `mock` (dev, ephemeral CA) |
|
||||
| `STEP_CA_URL` / `STEP_CA_ROOT` | — | step-ca endpoint + root |
|
||||
| `STEP_PROVISIONER` / `STEP_PROVISIONER_PASSWORD_FILE` | `enrol` / … | the broker holds this, not hosts |
|
||||
| `STEP_CERT_NOT_AFTER` | `720h` | issued-cert validity |
|
||||
| `BROKER_PENDING_TTL` | `10m` | time-box on unapproved requests |
|
||||
| `BROKER_WORDS` | `8` | fingerprint word count (64-word list ⇒ 6 bits/word ⇒ 48 bits) |
|
||||
| `BROKER_MAX_PENDING` | `256` | flooding cap |
|
||||
| `BROKER_RATE_PER_MIN` | `12` | per-IP `/request` rate limit |
|
||||
| `HOSTNQN_BASE` | `nqn.2026-06.org.example.fleet:host-` | hostnqn = base + cert-serial |
|
||||
| `BROKER_ADMIN_CERT` / `_KEY` / `_CLIENT_CA` | — | admin mTLS (required unless insecure) |
|
||||
| `BROKER_ADMIN_INSECURE` | `false` | **dev only**: plaintext admin, no client-cert auth |
|
||||
|
||||
Swap `wordlist.txt` for the 2048-word BIP39 list (11 bits/word) for more entropy
|
||||
per word; it just needs to be a power-of-two number of lines.
|
||||
|
||||
## Dev loop without step-ca
|
||||
|
||||
```bash
|
||||
BROKER_SIGNER=mock BROKER_ADMIN_INSECURE=true \
|
||||
BROKER_PUBLIC_ADDR=127.0.0.1:9090 BROKER_ADMIN_ADDR=127.0.0.1:9443 go run .
|
||||
```
|
||||
|
||||
`mock` signs from an ephemeral in-process CA (LAB ONLY — those certs are not
|
||||
trusted by RADIUS/NVMe). For an mTLS dev run instead of `INSECURE`, generate certs
|
||||
with `admin-pki.sh` and set `BROKER_ADMIN_CERT/_KEY/_CLIENT_CA`.
|
||||
|
||||
## Not built yet (next phases)
|
||||
|
||||
- **Host side:** the dracut empty-NV enrolment branch (generate key/CSR, POST,
|
||||
show fingerprint on Plymouth, poll, write NV, reboot) + `tpm2-openssl` in the
|
||||
image. `../dot1x-bench/enrol/tpm-provision.sh` is the manual stand-in.
|
||||
- **Renew** path (automatic, near-expiry) and **TPM attestation** (ACME
|
||||
`device-attest-01`) at the approve step.
|
||||
- **Fold into the fleet-manager:** the admin routes become its authenticated
|
||||
plane; approval writes the shared inventory record.
|
||||
@@ -0,0 +1,67 @@
|
||||
#!/usr/bin/env bash
|
||||
# admin-pki.sh — issue the broker's admin-plane mTLS PKI.
|
||||
#
|
||||
# SECURITY: the admin client CA MUST be SEPARATE from the fleet CA. If you reused
|
||||
# the fleet root as the client CA, any host's *enrolment* cert (signed by that
|
||||
# same root) would also authenticate to the admin plane — a privilege escalation
|
||||
# letting an enrolled host approve enrolments. So this mints a DEDICATED admin CA,
|
||||
# the broker's TLS server cert, and one client cert (+ .p12 for browser import)
|
||||
# per named admin.
|
||||
#
|
||||
# Usage: admin-pki.sh <out-dir> [admin-name ...]
|
||||
# e.g. ./admin-pki.sh ../dot1x-bench/pki/broker alice bob
|
||||
#
|
||||
# Then point the broker at:
|
||||
# BROKER_ADMIN_CERT=<out-dir>/server.crt
|
||||
# BROKER_ADMIN_KEY=<out-dir>/server.key
|
||||
# BROKER_ADMIN_CLIENT_CA=<out-dir>/admin-ca.crt
|
||||
# and import clients/<name>.p12 (empty password) into each admin's browser.
|
||||
set -euo pipefail
|
||||
|
||||
OUT=${1:?usage: admin-pki.sh <out-dir> [admin-name ...]}
|
||||
shift || true
|
||||
ADMINS=("$@")
|
||||
[ ${#ADMINS[@]} -eq 0 ] && ADMINS=(admin)
|
||||
SAN=${BROKER_ADMIN_SAN:-"IP:127.0.0.1,DNS:localhost"}
|
||||
DAYS=${BROKER_ADMIN_DAYS:-825}
|
||||
|
||||
mkdir -p "$OUT/clients"
|
||||
cd "$OUT"
|
||||
|
||||
# --- dedicated admin CA (separate from the fleet CA) ------------------------
|
||||
if [ ! -f admin-ca.crt ]; then
|
||||
echo "==> creating admin CA"
|
||||
openssl ecparam -name prime256v1 -genkey -noout -out admin-ca.key
|
||||
openssl req -x509 -new -key admin-ca.key -days "$DAYS" \
|
||||
-subj "/CN=fleet enrol-broker admin CA" -out admin-ca.crt
|
||||
fi
|
||||
|
||||
# --- broker TLS server cert -------------------------------------------------
|
||||
echo "==> issuing broker server cert (SAN $SAN)"
|
||||
openssl ecparam -name prime256v1 -genkey -noout -out server.key
|
||||
openssl req -new -key server.key -subj "/CN=enrol-broker-admin" -out server.csr
|
||||
openssl x509 -req -in server.csr -CA admin-ca.crt -CAkey admin-ca.key -CAcreateserial \
|
||||
-days "$DAYS" -extfile <(printf "subjectAltName=%s\nextendedKeyUsage=serverAuth" "$SAN") \
|
||||
-out server.crt
|
||||
rm -f server.csr
|
||||
|
||||
# --- one client cert (+ .p12) per admin ------------------------------------
|
||||
for a in "${ADMINS[@]}"; do
|
||||
echo "==> issuing admin client cert: $a"
|
||||
openssl ecparam -name prime256v1 -genkey -noout -out "clients/$a.key"
|
||||
openssl req -new -key "clients/$a.key" -subj "/CN=$a" -out "clients/$a.csr"
|
||||
openssl x509 -req -in "clients/$a.csr" -CA admin-ca.crt -CAkey admin-ca.key -CAcreateserial \
|
||||
-days "$DAYS" -extfile <(printf "extendedKeyUsage=clientAuth") -out "clients/$a.crt"
|
||||
rm -f "clients/$a.csr"
|
||||
openssl pkcs12 -export -inkey "clients/$a.key" -in "clients/$a.crt" -certfile admin-ca.crt \
|
||||
-name "fleet enrol admin: $a" -passout pass: -out "clients/$a.p12"
|
||||
done
|
||||
|
||||
chmod 600 ./*.key clients/*.key 2>/dev/null || true
|
||||
|
||||
echo
|
||||
echo "done. broker env:"
|
||||
echo " BROKER_ADMIN_CERT=$(pwd)/server.crt"
|
||||
echo " BROKER_ADMIN_KEY=$(pwd)/server.key"
|
||||
echo " BROKER_ADMIN_CLIENT_CA=$(pwd)/admin-ca.crt"
|
||||
echo "import clients/<name>.p12 (empty password) into each admin's browser."
|
||||
@@ -0,0 +1,201 @@
|
||||
// admin.go — the mTLS admin plane: the pending-queue web UI + approve/deny.
|
||||
//
|
||||
// This listener is the AUTHENTICATED half of the broker and must live on the
|
||||
// management network / loopback only — NEVER the boot LAN (docs invariant: the
|
||||
// management plane is recon-valuable). Admins authenticate with a client cert
|
||||
// issued by the fleet CA; the cert CN is recorded as who approved each enrolment.
|
||||
// The fingerprint shown here is what the admin cross-checks against the device's
|
||||
// Plymouth splash before approving (the human OOB gate).
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"html/template"
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"time"
|
||||
)
|
||||
|
||||
func (b *broker) serveAdmin() {
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("GET /", b.handleAdminIndex)
|
||||
mux.HandleFunc("GET /pending", b.handleAdminPending)
|
||||
mux.HandleFunc("POST /approve/{id}", b.handleApprove)
|
||||
mux.HandleFunc("POST /deny/{id}", b.handleDeny)
|
||||
|
||||
srv := &http.Server{
|
||||
Addr: b.cfg.adminAddr,
|
||||
Handler: mux,
|
||||
ReadHeaderTimeout: 5 * time.Second,
|
||||
ReadTimeout: 10 * time.Second,
|
||||
WriteTimeout: 40 * time.Second, // approve blocks on step-ca
|
||||
IdleTimeout: 60 * time.Second,
|
||||
}
|
||||
|
||||
if b.cfg.adminInsecure {
|
||||
log.Printf("WARNING: BROKER_ADMIN_INSECURE=true — admin UI is PLAINTEXT with NO client-cert auth. DEV ONLY. Bind to loopback and never expose it.")
|
||||
log.Fatalf("admin listener: %v", srv.ListenAndServe())
|
||||
return
|
||||
}
|
||||
|
||||
if b.cfg.adminCert == "" || b.cfg.adminKey == "" || b.cfg.adminClientCA == "" {
|
||||
log.Fatalf("admin mTLS requires BROKER_ADMIN_CERT, BROKER_ADMIN_KEY and BROKER_ADMIN_CLIENT_CA (or set BROKER_ADMIN_INSECURE=true for dev)")
|
||||
}
|
||||
cert, err := tls.LoadX509KeyPair(b.cfg.adminCert, b.cfg.adminKey)
|
||||
if err != nil {
|
||||
log.Fatalf("admin server cert: %v", err)
|
||||
}
|
||||
caPEM, err := os.ReadFile(b.cfg.adminClientCA)
|
||||
if err != nil {
|
||||
log.Fatalf("admin client CA: %v", err)
|
||||
}
|
||||
pool := x509.NewCertPool()
|
||||
if !pool.AppendCertsFromPEM(caPEM) {
|
||||
log.Fatalf("admin client CA %s contains no certificates", b.cfg.adminClientCA)
|
||||
}
|
||||
srv.TLSConfig = &tls.Config{
|
||||
Certificates: []tls.Certificate{cert},
|
||||
ClientAuth: tls.RequireAndVerifyClientCert,
|
||||
ClientCAs: pool,
|
||||
MinVersion: tls.VersionTLS12,
|
||||
}
|
||||
log.Fatalf("admin listener: %v", srv.ListenAndServeTLS("", ""))
|
||||
}
|
||||
|
||||
func adminCN(r *http.Request) string {
|
||||
if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
|
||||
if cn := r.TLS.PeerCertificates[0].Subject.CommonName; cn != "" {
|
||||
return cn
|
||||
}
|
||||
return "unknown-admin"
|
||||
}
|
||||
return "dev-insecure"
|
||||
}
|
||||
|
||||
func (b *broker) handleAdminPending(w http.ResponseWriter, _ *http.Request) {
|
||||
writeJSON(w, http.StatusOK, b.store.Pending())
|
||||
}
|
||||
|
||||
func (b *broker) handleApprove(w http.ResponseWriter, r *http.Request) {
|
||||
id := r.PathValue("id")
|
||||
admin := adminCN(r)
|
||||
csrPEM, ok := b.store.csrFor(id)
|
||||
if !ok {
|
||||
http.Error(w, "enrol-id not pending (expired/decided/unknown)", http.StatusConflict)
|
||||
return
|
||||
}
|
||||
csr, err := parseCSR(csrPEM)
|
||||
if err != nil {
|
||||
http.Error(w, "stored CSR unparsable: "+err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
ctx, cancel := ctxWithTimeout(35 * time.Second)
|
||||
defer cancel()
|
||||
certPEM, serial, err := b.signer.Sign(ctx, csrPEM, csr.Subject.CommonName)
|
||||
if err != nil {
|
||||
log.Printf("audit approve-FAILED id=%s admin=%q err=%v", id, admin, err)
|
||||
http.Error(w, "signing failed: "+err.Error(), http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
e, err := b.store.Approve(id, certPEM, serial, admin)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusConflict)
|
||||
return
|
||||
}
|
||||
log.Printf("audit APPROVE id=%s cn=%q serial=%s hostnqn=%s admin=%q", e.ID, e.CN, e.CertSerial, e.Hostnqn, admin)
|
||||
redirectOrJSON(w, r)
|
||||
}
|
||||
|
||||
func (b *broker) handleDeny(w http.ResponseWriter, r *http.Request) {
|
||||
id := r.PathValue("id")
|
||||
admin := adminCN(r)
|
||||
e, err := b.store.Deny(id, admin)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusConflict)
|
||||
return
|
||||
}
|
||||
log.Printf("audit DENY id=%s cn=%q admin=%q", e.ID, e.CN, admin)
|
||||
redirectOrJSON(w, r)
|
||||
}
|
||||
|
||||
// redirectOrJSON sends a browser form back to the queue, or a 204 for API callers.
|
||||
func redirectOrJSON(w http.ResponseWriter, r *http.Request) {
|
||||
if isBrowser(r) {
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
|
||||
func isBrowser(r *http.Request) bool {
|
||||
a := r.Header.Get("Accept")
|
||||
return len(a) >= 9 && a[:9] == "text/html" || // explicit
|
||||
r.Header.Get("Sec-Fetch-Mode") == "navigate"
|
||||
}
|
||||
|
||||
func (b *broker) handleAdminIndex(w http.ResponseWriter, r *http.Request) {
|
||||
data := struct {
|
||||
Admin string
|
||||
Pending []*Enrolment
|
||||
Now time.Time
|
||||
}{
|
||||
Admin: adminCN(r),
|
||||
Pending: b.store.Pending(),
|
||||
Now: time.Now(),
|
||||
}
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
if err := adminTmpl.Execute(w, data); err != nil {
|
||||
log.Printf("admin template: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
var adminTmpl = template.Must(template.New("admin").Funcs(template.FuncMap{
|
||||
"age": func(t time.Time) string { return time.Since(t).Round(time.Second).String() },
|
||||
}).Parse(adminHTML))
|
||||
|
||||
const adminHTML = `<!doctype html>
|
||||
<html lang="en"><head><meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>fleet enrolment — pending</title>
|
||||
<style>
|
||||
:root{color-scheme:dark}
|
||||
body{background:#0b0f14;color:#cfe3ee;font:14px/1.5 ui-monospace,Menlo,Consolas,monospace;margin:0;padding:1.5rem}
|
||||
h1{font-size:1.1rem;color:#7fd1ff;margin:0 0 .25rem}
|
||||
.sub{color:#6b8294;margin:0 0 1.25rem}
|
||||
.empty{color:#6b8294;padding:2rem 0}
|
||||
.card{background:#111923;border:1px solid #1f2d3a;border-radius:8px;padding:1rem 1.1rem;margin:0 0 1rem}
|
||||
.fp{font-size:1.25rem;color:#aef9b0;letter-spacing:.5px;word-break:break-word}
|
||||
.meta{display:grid;grid-template-columns:max-content 1fr;gap:.1rem .8rem;margin:.6rem 0;color:#9fb6c4}
|
||||
.meta b{color:#6b8294;font-weight:400}
|
||||
.actions{margin-top:.7rem}
|
||||
button{font:inherit;border:0;border-radius:6px;padding:.45rem .9rem;cursor:pointer}
|
||||
.approve{background:#15602f;color:#d6ffe0}
|
||||
.deny{background:#5e1b1b;color:#ffd9d9;margin-left:.5rem}
|
||||
form{display:inline}
|
||||
code{color:#cfe3ee}
|
||||
</style></head><body>
|
||||
<h1>fleet enrolment — pending approvals</h1>
|
||||
<p class="sub">admin: <code>{{.Admin}}</code> · {{len .Pending}} pending · cross-check each fingerprint against the device's splash before approving</p>
|
||||
{{if not .Pending}}<div class="empty">no pending enrolments.</div>{{end}}
|
||||
{{range .Pending}}
|
||||
<div class="card">
|
||||
<div class="fp">{{.Fingerprint}}</div>
|
||||
<div class="meta">
|
||||
<b>enrol-id</b><code>{{.ID}}</code>
|
||||
<b>CN</b><code>{{.CN}}</code>
|
||||
{{if .Context.MAC}}<b>MAC</b><code>{{.Context.MAC}}</code>{{end}}
|
||||
{{if .Context.DMISerial}}<b>DMI serial</b><code>{{.Context.DMISerial}}</code>{{end}}
|
||||
{{if .Context.DMIUUID}}<b>DMI uuid</b><code>{{.Context.DMIUUID}}</code>{{end}}
|
||||
{{if .Context.EKHash}}<b>TPM EK</b><code>{{.Context.EKHash}}</code>{{end}}
|
||||
<b>pubkey</b><code>{{.PubKeyHash}}</code>
|
||||
<b>age</b><code>{{age .CreatedAt}}</code>
|
||||
</div>
|
||||
<div class="actions">
|
||||
<form method="post" action="/approve/{{.ID}}"><button class="approve" type="submit">approve</button></form>
|
||||
<form method="post" action="/deny/{{.ID}}"><button class="deny" type="submit">deny</button></form>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
</body></html>`
|
||||
@@ -0,0 +1,8 @@
|
||||
// fleet-enrol-broker — TPM identity enrolment broker.
|
||||
// See docs/tpm-enrolment-design.md. Stdlib only (no external modules) so the
|
||||
// container build is trivially reproducible and the system's one UNAUTHENTICATED
|
||||
// edge carries a minimal dependency surface. step-ca signing is done by shelling
|
||||
// out to the bundled `step` CLI, not a Go dependency.
|
||||
module fleet-enrol-broker
|
||||
|
||||
go 1.22
|
||||
@@ -0,0 +1,369 @@
|
||||
// fleet-enrol-broker — TPM identity enrolment broker.
|
||||
//
|
||||
// The ONE unauthenticated, pre-auth bootstrap endpoint of the fleet. An empty-NV
|
||||
// host generates a key IN its TPM, builds a CSR, POSTs it here, and shows the
|
||||
// returned fingerprint on its Plymouth splash. An admin cross-checks that
|
||||
// fingerprint against the pending queue (a separate mTLS web UI) and approves;
|
||||
// the broker has step-ca sign the CSR and hands the cert back on the host's next
|
||||
// status poll. The host writes it to TPM NV and authenticates.
|
||||
//
|
||||
// See docs/tpm-enrolment-design.md. Two listeners, by design:
|
||||
//
|
||||
// PUBLIC (plain HTTP, behind the serving nginx /enrol/) -- unauthenticated:
|
||||
// POST /request submit a CSR -> {enrol_id, fingerprint}
|
||||
// GET /status/{id} poll -> pending | approved+cert | denied | expired
|
||||
//
|
||||
// ADMIN (mTLS, management network / loopback only) -- admin client cert:
|
||||
// GET / the pending-queue web UI
|
||||
// GET /pending JSON queue
|
||||
// POST /approve/{id} OOB-approve -> sign -> store cert
|
||||
// POST /deny/{id} reject
|
||||
//
|
||||
// Stdlib only; signing shells out to `step`. Nothing here is per-host baked state.
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
_ "embed"
|
||||
"encoding/json"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
//go:embed wordlist.txt
|
||||
var wordlistRaw string
|
||||
|
||||
type config struct {
|
||||
publicAddr string
|
||||
adminAddr string
|
||||
ttl time.Duration
|
||||
retention time.Duration
|
||||
maxPending int
|
||||
fpWords int
|
||||
ratePerMin int
|
||||
trustXFF bool
|
||||
hostBase string
|
||||
|
||||
signerKind string
|
||||
// step signer
|
||||
stepBin string
|
||||
caURL string
|
||||
caRoot string
|
||||
provisioner string
|
||||
passwordFile string
|
||||
notAfter string
|
||||
// admin mTLS
|
||||
adminCert string
|
||||
adminKey string
|
||||
adminClientCA string
|
||||
adminInsecure bool
|
||||
}
|
||||
|
||||
func loadConfig() config {
|
||||
return config{
|
||||
publicAddr: env("BROKER_PUBLIC_ADDR", "127.0.0.1:9090"),
|
||||
adminAddr: env("BROKER_ADMIN_ADDR", "127.0.0.1:9443"),
|
||||
ttl: envDur("BROKER_PENDING_TTL", 10*time.Minute),
|
||||
retention: envDur("BROKER_RETENTION", time.Hour),
|
||||
maxPending: envInt("BROKER_MAX_PENDING", 256),
|
||||
fpWords: envInt("BROKER_WORDS", 8),
|
||||
ratePerMin: envInt("BROKER_RATE_PER_MIN", 12),
|
||||
trustXFF: envBool("BROKER_TRUST_XFF", true),
|
||||
hostBase: env("HOSTNQN_BASE", "nqn.2026-06.org.example.fleet:host-"),
|
||||
signerKind: env("BROKER_SIGNER", "step"),
|
||||
stepBin: env("STEP_BIN", "step"),
|
||||
caURL: env("STEP_CA_URL", "https://ca.fleet.lab:8443"),
|
||||
caRoot: env("STEP_CA_ROOT", "/pki/root_ca.crt"),
|
||||
provisioner: env("STEP_PROVISIONER", "enrol"),
|
||||
passwordFile: env("STEP_PROVISIONER_PASSWORD_FILE", "/pki/stepca/secrets/password"),
|
||||
notAfter: env("STEP_CERT_NOT_AFTER", "720h"),
|
||||
adminCert: env("BROKER_ADMIN_CERT", ""),
|
||||
adminKey: env("BROKER_ADMIN_KEY", ""),
|
||||
adminClientCA: env("BROKER_ADMIN_CLIENT_CA", ""),
|
||||
adminInsecure: envBool("BROKER_ADMIN_INSECURE", false),
|
||||
}
|
||||
}
|
||||
|
||||
type broker struct {
|
||||
cfg config
|
||||
store *Store
|
||||
signer Signer
|
||||
rl *rateLimiter
|
||||
}
|
||||
|
||||
func main() {
|
||||
log.SetFlags(log.LstdFlags | log.LUTC)
|
||||
cfg := loadConfig()
|
||||
|
||||
words := parseWordlist(wordlistRaw)
|
||||
store, err := NewStore(cfg.ttl, cfg.retention, cfg.maxPending, words, cfg.fpWords, cfg.hostBase)
|
||||
if err != nil {
|
||||
log.Fatalf("store: %v", err)
|
||||
}
|
||||
|
||||
var signer Signer
|
||||
switch cfg.signerKind {
|
||||
case "step":
|
||||
signer = &stepSigner{
|
||||
bin: cfg.stepBin, caURL: cfg.caURL, root: cfg.caRoot,
|
||||
provisioner: cfg.provisioner, passwordFile: cfg.passwordFile, notAfter: cfg.notAfter,
|
||||
}
|
||||
case "mock":
|
||||
signer, err = newMockSigner()
|
||||
if err != nil {
|
||||
log.Fatalf("mock signer: %v", err)
|
||||
}
|
||||
default:
|
||||
log.Fatalf("unknown BROKER_SIGNER %q (want step|mock)", cfg.signerKind)
|
||||
}
|
||||
|
||||
b := &broker{cfg: cfg, store: store, signer: signer, rl: newRateLimiter(cfg.ratePerMin)}
|
||||
|
||||
// background reaper: expire timed-out requests + evict old decided ones.
|
||||
go func() {
|
||||
t := time.NewTicker(30 * time.Second)
|
||||
defer t.Stop()
|
||||
for range t.C {
|
||||
if n := store.Reap(); n > 0 {
|
||||
log.Printf("audit reap expired_pending=%d", n)
|
||||
}
|
||||
b.rl.sweep()
|
||||
}
|
||||
}()
|
||||
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(2)
|
||||
go func() { defer wg.Done(); b.servePublic() }()
|
||||
go func() { defer wg.Done(); b.serveAdmin() }()
|
||||
log.Printf("enrol-broker up: public=%s admin=%s signer=%s words=%d ttl=%s",
|
||||
cfg.publicAddr, cfg.adminAddr, signer.Kind(), len(words), cfg.ttl)
|
||||
wg.Wait()
|
||||
}
|
||||
|
||||
// --- public listener (unauthenticated) -------------------------------------
|
||||
|
||||
func (b *broker) servePublic() {
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("POST /request", b.handleRequest)
|
||||
mux.HandleFunc("GET /status/{id}", b.handleStatus)
|
||||
mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
})
|
||||
srv := &http.Server{
|
||||
Addr: b.cfg.publicAddr,
|
||||
Handler: mux,
|
||||
ReadHeaderTimeout: 5 * time.Second,
|
||||
ReadTimeout: 10 * time.Second,
|
||||
WriteTimeout: 15 * time.Second,
|
||||
IdleTimeout: 30 * time.Second,
|
||||
MaxHeaderBytes: 8 << 10,
|
||||
}
|
||||
log.Fatalf("public listener: %v", srv.ListenAndServe())
|
||||
}
|
||||
|
||||
type enrolRequest struct {
|
||||
CSR string `json:"csr"`
|
||||
Context DeviceContext `json:"context"`
|
||||
}
|
||||
|
||||
type enrolRequestResp struct {
|
||||
EnrolID string `json:"enrol_id"`
|
||||
Fingerprint string `json:"fingerprint"`
|
||||
State string `json:"state"`
|
||||
PollAfter int `json:"poll_after_seconds"`
|
||||
ExpiresIn int `json:"expires_in_seconds"`
|
||||
}
|
||||
|
||||
type statusResp struct {
|
||||
State string `json:"state"`
|
||||
Cert string `json:"cert,omitempty"`
|
||||
Hostnqn string `json:"hostnqn,omitempty"`
|
||||
CertSerial string `json:"cert_serial,omitempty"`
|
||||
}
|
||||
|
||||
func (b *broker) handleRequest(w http.ResponseWriter, r *http.Request) {
|
||||
ip := b.clientIP(r)
|
||||
if !b.rl.allow(ip) {
|
||||
writeJSONErr(w, http.StatusTooManyRequests, "rate limit exceeded")
|
||||
return
|
||||
}
|
||||
r.Body = http.MaxBytesReader(w, r.Body, 16<<10) // a CSR is ~1KB
|
||||
var req enrolRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
writeJSONErr(w, http.StatusBadRequest, "invalid JSON body")
|
||||
return
|
||||
}
|
||||
csr, err := parseCSR(req.CSR)
|
||||
if err != nil {
|
||||
writeJSONErr(w, http.StatusBadRequest, "invalid CSR: "+err.Error())
|
||||
return
|
||||
}
|
||||
e, err := b.store.Add(csr.RawSubjectPublicKeyInfo, csr.Subject.CommonName, req.CSR, req.Context)
|
||||
if err != nil {
|
||||
if err == errTooManyPending {
|
||||
writeJSONErr(w, http.StatusServiceUnavailable, "broker busy: too many pending enrolments")
|
||||
return
|
||||
}
|
||||
writeJSONErr(w, http.StatusInternalServerError, "internal error")
|
||||
return
|
||||
}
|
||||
log.Printf("audit request id=%s cn=%q pubkey=%s mac=%q fp=%q from=%s",
|
||||
e.ID, e.CN, short(e.PubKeyHash), e.Context.MAC, e.Fingerprint, ip)
|
||||
writeJSON(w, http.StatusAccepted, enrolRequestResp{
|
||||
EnrolID: e.ID,
|
||||
Fingerprint: e.Fingerprint,
|
||||
State: string(e.State),
|
||||
PollAfter: 5,
|
||||
ExpiresIn: int(time.Until(e.ExpiresAt).Seconds()),
|
||||
})
|
||||
}
|
||||
|
||||
func (b *broker) handleStatus(w http.ResponseWriter, r *http.Request) {
|
||||
id := r.PathValue("id")
|
||||
e := b.store.Get(id)
|
||||
if e == nil {
|
||||
writeJSONErr(w, http.StatusNotFound, "unknown enrol-id")
|
||||
return
|
||||
}
|
||||
resp := statusResp{State: string(e.State)}
|
||||
if e.State == StateApproved {
|
||||
resp.Cert = e.certPEM
|
||||
resp.Hostnqn = e.Hostnqn
|
||||
resp.CertSerial = e.CertSerial
|
||||
}
|
||||
writeJSON(w, http.StatusOK, resp)
|
||||
}
|
||||
|
||||
func (b *broker) clientIP(r *http.Request) string {
|
||||
if b.cfg.trustXFF {
|
||||
if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
|
||||
return strings.TrimSpace(strings.Split(xff, ",")[0])
|
||||
}
|
||||
}
|
||||
host, _, err := net.SplitHostPort(r.RemoteAddr)
|
||||
if err != nil {
|
||||
return r.RemoteAddr
|
||||
}
|
||||
return host
|
||||
}
|
||||
|
||||
// --- rate limiter (per-IP fixed window) ------------------------------------
|
||||
|
||||
type rateLimiter struct {
|
||||
mu sync.Mutex
|
||||
perMin int
|
||||
windows map[string]*window
|
||||
}
|
||||
|
||||
type window struct {
|
||||
start time.Time
|
||||
count int
|
||||
}
|
||||
|
||||
func newRateLimiter(perMin int) *rateLimiter {
|
||||
return &rateLimiter{perMin: perMin, windows: make(map[string]*window)}
|
||||
}
|
||||
|
||||
func (rl *rateLimiter) allow(ip string) bool {
|
||||
if rl.perMin <= 0 {
|
||||
return true
|
||||
}
|
||||
rl.mu.Lock()
|
||||
defer rl.mu.Unlock()
|
||||
now := time.Now()
|
||||
w := rl.windows[ip]
|
||||
if w == nil || now.Sub(w.start) >= time.Minute {
|
||||
rl.windows[ip] = &window{start: now, count: 1}
|
||||
return true
|
||||
}
|
||||
if w.count >= rl.perMin {
|
||||
return false
|
||||
}
|
||||
w.count++
|
||||
return true
|
||||
}
|
||||
|
||||
func (rl *rateLimiter) sweep() {
|
||||
rl.mu.Lock()
|
||||
defer rl.mu.Unlock()
|
||||
for ip, w := range rl.windows {
|
||||
if time.Since(w.start) >= time.Minute {
|
||||
delete(rl.windows, ip)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// --- small helpers ---------------------------------------------------------
|
||||
|
||||
func parseWordlist(s string) []string {
|
||||
var out []string
|
||||
for _, line := range strings.Split(s, "\n") {
|
||||
if w := strings.TrimSpace(line); w != "" {
|
||||
out = append(out, w)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func writeJSON(w http.ResponseWriter, code int, v any) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(code)
|
||||
_ = json.NewEncoder(w).Encode(v)
|
||||
}
|
||||
|
||||
func writeJSONErr(w http.ResponseWriter, code int, msg string) {
|
||||
writeJSON(w, code, map[string]string{"error": msg})
|
||||
}
|
||||
|
||||
func short(s string) string {
|
||||
if len(s) > 16 {
|
||||
return s[:16]
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func env(k, def string) string {
|
||||
if v := os.Getenv(k); v != "" {
|
||||
return v
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
func envInt(k string, def int) int {
|
||||
if v := os.Getenv(k); v != "" {
|
||||
if n, err := strconv.Atoi(v); err == nil {
|
||||
return n
|
||||
}
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
func envBool(k string, def bool) bool {
|
||||
if v := os.Getenv(k); v != "" {
|
||||
b, err := strconv.ParseBool(v)
|
||||
if err == nil {
|
||||
return b
|
||||
}
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
func envDur(k string, def time.Duration) time.Duration {
|
||||
if v := os.Getenv(k); v != "" {
|
||||
if d, err := time.ParseDuration(v); err == nil {
|
||||
return d
|
||||
}
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
// ctxWithTimeout is used by admin approve to bound the step-ca call.
|
||||
func ctxWithTimeout(d time.Duration) (context.Context, context.CancelFunc) {
|
||||
return context.WithTimeout(context.Background(), d)
|
||||
}
|
||||
@@ -0,0 +1,209 @@
|
||||
// signer.go — turning an APPROVED CSR into a signed cert.
|
||||
//
|
||||
// Production path (stepSigner) shells out to the bundled `step` CLI exactly as
|
||||
// the bench's tpm-provision.sh does: mint a one-time provisioner token, then
|
||||
// `step ca sign` the CSR. The broker — not the host — holds the provisioner
|
||||
// password, so a host can never self-sign; signing happens ONLY after an admin
|
||||
// approves (the human OOB gate).
|
||||
//
|
||||
// Dev path (mockSigner) signs with an ephemeral in-process CA so the whole
|
||||
// request -> approve -> cert flow is testable without a running step-ca. It is
|
||||
// LAB-ONLY and announces itself loudly; never select it in production.
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"math/big"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Signer issues a cert for an approved CSR. Returns the cert PEM and its serial
|
||||
// (lowercase hex, the value the hostnqn is derived from).
|
||||
type Signer interface {
|
||||
Sign(ctx context.Context, csrPEM, cn string) (certPEM, serial string, err error)
|
||||
Kind() string
|
||||
}
|
||||
|
||||
// --- production: step-ca via the `step` CLI ---------------------------------
|
||||
|
||||
type stepSigner struct {
|
||||
bin string
|
||||
caURL string
|
||||
root string
|
||||
provisioner string
|
||||
passwordFile string
|
||||
notAfter string
|
||||
}
|
||||
|
||||
func (s *stepSigner) Kind() string { return "step" }
|
||||
|
||||
func (s *stepSigner) Sign(ctx context.Context, csrPEM, cn string) (string, string, error) {
|
||||
if cn == "" {
|
||||
return "", "", fmt.Errorf("CSR has no CommonName; cannot mint a token subject")
|
||||
}
|
||||
dir, err := os.MkdirTemp("", "enrol-*")
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
defer os.RemoveAll(dir)
|
||||
csrPath := filepath.Join(dir, "req.csr")
|
||||
outPath := filepath.Join(dir, "out.pem")
|
||||
if err := os.WriteFile(csrPath, []byte(csrPEM), 0o600); err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
|
||||
// 1. one-time token (subject MUST equal the CSR CN for the JWK provisioner).
|
||||
tokArgs := []string{
|
||||
"ca", "token", cn,
|
||||
"--provisioner", s.provisioner,
|
||||
"--ca-url", s.caURL,
|
||||
"--root", s.root,
|
||||
"--provisioner-password-file", s.passwordFile,
|
||||
}
|
||||
if s.notAfter != "" {
|
||||
tokArgs = append(tokArgs, "--not-after", s.notAfter)
|
||||
}
|
||||
token, err := s.run(ctx, tokArgs...)
|
||||
if err != nil {
|
||||
return "", "", fmt.Errorf("step ca token: %w", err)
|
||||
}
|
||||
token = strings.TrimSpace(token)
|
||||
|
||||
// 2. sign the CSR with that token.
|
||||
if _, err := s.run(ctx,
|
||||
"ca", "sign", csrPath, outPath,
|
||||
"--token", token,
|
||||
"--ca-url", s.caURL,
|
||||
"--root", s.root,
|
||||
"--force",
|
||||
); err != nil {
|
||||
return "", "", fmt.Errorf("step ca sign: %w", err)
|
||||
}
|
||||
certPEM, err := os.ReadFile(outPath)
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
serial, err := serialFromPEM(certPEM)
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
return string(certPEM), serial, nil
|
||||
}
|
||||
|
||||
// run executes `step ...`, returning stdout. The token is sensitive but is passed
|
||||
// as an argv element to the trusted local `step`; we never log argv or the
|
||||
// password-file contents.
|
||||
func (s *stepSigner) run(ctx context.Context, args ...string) (string, error) {
|
||||
cmd := exec.CommandContext(ctx, s.bin, args...)
|
||||
out, err := cmd.Output()
|
||||
if err != nil {
|
||||
var ee *exec.ExitError
|
||||
if errors.As(err, &ee) {
|
||||
return "", fmt.Errorf("%w: %s", err, strings.TrimSpace(string(ee.Stderr)))
|
||||
}
|
||||
return "", err
|
||||
}
|
||||
return string(out), nil
|
||||
}
|
||||
|
||||
// --- dev only: ephemeral in-process CA -------------------------------------
|
||||
|
||||
type mockSigner struct {
|
||||
caCert *x509.Certificate
|
||||
caKey *ecdsa.PrivateKey
|
||||
}
|
||||
|
||||
func newMockSigner() (*mockSigner, error) {
|
||||
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
tmpl := &x509.Certificate{
|
||||
SerialNumber: big.NewInt(1),
|
||||
Subject: pkix.Name{CommonName: "fleet-enrol-broker DEV mock CA"},
|
||||
NotBefore: time.Now().Add(-time.Hour),
|
||||
NotAfter: time.Now().Add(24 * time.Hour),
|
||||
KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
|
||||
BasicConstraintsValid: true,
|
||||
IsCA: true,
|
||||
}
|
||||
der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
caCert, err := x509.ParseCertificate(der)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
log.Printf("WARNING: BROKER_SIGNER=mock — issuing certs from an EPHEMERAL in-process CA. LAB ONLY; these certs are NOT trusted by RADIUS/NVMe. Set BROKER_SIGNER=step for real enrolment.")
|
||||
return &mockSigner{caCert: caCert, caKey: key}, nil
|
||||
}
|
||||
|
||||
func (m *mockSigner) Kind() string { return "mock" }
|
||||
|
||||
func (m *mockSigner) Sign(_ context.Context, csrPEM, cn string) (string, string, error) {
|
||||
csr, err := parseCSR(csrPEM)
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
tmpl := &x509.Certificate{
|
||||
SerialNumber: serial,
|
||||
Subject: csr.Subject,
|
||||
NotBefore: time.Now().Add(-time.Minute),
|
||||
NotAfter: time.Now().Add(720 * time.Hour),
|
||||
KeyUsage: x509.KeyUsageDigitalSignature,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
|
||||
}
|
||||
der, err := x509.CreateCertificate(rand.Reader, tmpl, m.caCert, csr.PublicKey, m.caKey)
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
|
||||
return string(certPEM), strings.ToLower(fmt.Sprintf("%x", serial)), nil
|
||||
}
|
||||
|
||||
// --- shared helpers --------------------------------------------------------
|
||||
|
||||
func parseCSR(csrPEM string) (*x509.CertificateRequest, error) {
|
||||
blk, _ := pem.Decode([]byte(csrPEM))
|
||||
if blk == nil || blk.Type != "CERTIFICATE REQUEST" {
|
||||
return nil, fmt.Errorf("not a PEM CERTIFICATE REQUEST")
|
||||
}
|
||||
csr, err := x509.ParseCertificateRequest(blk.Bytes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := csr.CheckSignature(); err != nil {
|
||||
return nil, fmt.Errorf("CSR self-signature invalid: %w", err)
|
||||
}
|
||||
return csr, nil
|
||||
}
|
||||
|
||||
func serialFromPEM(certPEM []byte) (string, error) {
|
||||
blk, _ := pem.Decode(certPEM)
|
||||
if blk == nil || blk.Type != "CERTIFICATE" {
|
||||
return "", fmt.Errorf("issued cert is not PEM")
|
||||
}
|
||||
cert, err := x509.ParseCertificate(blk.Bytes)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return strings.ToLower(fmt.Sprintf("%x", cert.SerialNumber)), nil
|
||||
}
|
||||
@@ -0,0 +1,338 @@
|
||||
// store.go — the in-memory enrolment state machine + the OOB fingerprint.
|
||||
//
|
||||
// The store holds short-lived PENDING records keyed by a random enrol-id. State
|
||||
// transitions are the load-bearing lifecycle from docs/tpm-enrolment-design.md:
|
||||
//
|
||||
// PENDING --(admin approve)--> APPROVED (cert minted, returned on poll)
|
||||
// PENDING --(admin deny)-----> DENIED
|
||||
// PENDING --(ttl elapsed)----> EXPIRED
|
||||
//
|
||||
// Records are time-boxed (a flooding bound) and evicted after a retention window.
|
||||
// Nothing here is durable: a broker restart drops pending requests, which is
|
||||
// acceptable — an un-enrolled host simply re-requests on its next poll/boot.
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/binary"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"math/bits"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
type State string
|
||||
|
||||
const (
|
||||
StatePending State = "pending"
|
||||
StateApproved State = "approved"
|
||||
StateDenied State = "denied"
|
||||
StateExpired State = "expired"
|
||||
)
|
||||
|
||||
// DeviceContext is what an un-enrolled host self-reports so the admin knows WHAT
|
||||
// they are approving. It is advisory only — the fingerprint is the cryptographic
|
||||
// anchor that binds the queue entry to the device on the console.
|
||||
type DeviceContext struct {
|
||||
MAC string `json:"mac,omitempty"`
|
||||
DMIUUID string `json:"dmi_uuid,omitempty"`
|
||||
DMISerial string `json:"dmi_serial,omitempty"`
|
||||
EKHash string `json:"ek_hash,omitempty"`
|
||||
Extra map[string]string `json:"extra,omitempty"`
|
||||
}
|
||||
|
||||
// Enrolment is one pending/decided enrolment. Unexported fields (nonce, csrPEM,
|
||||
// certPEM) are deliberately NOT serialised into the admin queue view; the cert is
|
||||
// only ever handed back to the requesting host via the status poll.
|
||||
type Enrolment struct {
|
||||
ID string `json:"id"`
|
||||
State State `json:"state"`
|
||||
Fingerprint string `json:"fingerprint"`
|
||||
Context DeviceContext `json:"context"`
|
||||
PubKeyHash string `json:"pubkey_hash"`
|
||||
CN string `json:"cn"`
|
||||
CreatedAt time.Time `json:"created_at"`
|
||||
ExpiresAt time.Time `json:"expires_at"`
|
||||
DecidedAt time.Time `json:"decided_at,omitempty"`
|
||||
DecidedBy string `json:"decided_by,omitempty"`
|
||||
CertSerial string `json:"cert_serial,omitempty"`
|
||||
Hostnqn string `json:"hostnqn,omitempty"`
|
||||
|
||||
nonce []byte
|
||||
csrPEM string
|
||||
certPEM string
|
||||
}
|
||||
|
||||
// Age returns how long the record has existed (for the UI).
|
||||
func (e *Enrolment) Age() time.Duration { return time.Since(e.CreatedAt) }
|
||||
|
||||
type Store struct {
|
||||
mu sync.Mutex
|
||||
items map[string]*Enrolment
|
||||
ttl time.Duration
|
||||
retention time.Duration
|
||||
maxPending int
|
||||
|
||||
words []string
|
||||
fpWords int
|
||||
hostBase string
|
||||
}
|
||||
|
||||
func NewStore(ttl, retention time.Duration, maxPending int, words []string, fpWords int, hostBase string) (*Store, error) {
|
||||
if !isPow2(len(words)) {
|
||||
return nil, fmt.Errorf("wordlist size %d is not a power of two (needed for whole bits/word)", len(words))
|
||||
}
|
||||
if fpWords < 4 {
|
||||
return nil, fmt.Errorf("fingerprint word count %d too small", fpWords)
|
||||
}
|
||||
return &Store{
|
||||
items: make(map[string]*Enrolment),
|
||||
ttl: ttl,
|
||||
retention: retention,
|
||||
maxPending: maxPending,
|
||||
words: words,
|
||||
fpWords: fpWords,
|
||||
hostBase: hostBase,
|
||||
}, nil
|
||||
}
|
||||
|
||||
var errTooManyPending = errors.New("too many pending enrolments")
|
||||
|
||||
// Add creates a PENDING record for a parsed CSR's public-key DER + CN + context.
|
||||
func (s *Store) Add(pubDER []byte, cn string, csrPEM string, ctx DeviceContext) (*Enrolment, error) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
|
||||
if s.countPendingLocked() >= s.maxPending {
|
||||
return nil, errTooManyPending
|
||||
}
|
||||
|
||||
id, err := randHex(16)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
nonce := make([]byte, 16)
|
||||
if _, err := rand.Read(nonce); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
fp, err := fingerprint(pubDER, nonce, s.words, s.fpWords)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
sum := sha256.Sum256(pubDER)
|
||||
now := time.Now()
|
||||
e := &Enrolment{
|
||||
ID: id,
|
||||
State: StatePending,
|
||||
Fingerprint: fp,
|
||||
Context: ctx,
|
||||
PubKeyHash: hex.EncodeToString(sum[:]),
|
||||
CN: cn,
|
||||
CreatedAt: now,
|
||||
ExpiresAt: now.Add(s.ttl),
|
||||
nonce: nonce,
|
||||
csrPEM: csrPEM,
|
||||
}
|
||||
s.items[id] = e
|
||||
return e.copy(), nil
|
||||
}
|
||||
|
||||
// Get returns a copy of a record (or nil), refreshing EXPIRED lazily.
|
||||
func (s *Store) Get(id string) *Enrolment {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
e := s.items[id]
|
||||
if e == nil {
|
||||
return nil
|
||||
}
|
||||
s.expireLocked(e)
|
||||
return e.copy()
|
||||
}
|
||||
|
||||
// csrFor returns the stored CSR PEM for a still-pending id (for the signer).
|
||||
func (s *Store) csrFor(id string) (string, bool) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
e := s.items[id]
|
||||
if e == nil {
|
||||
return "", false
|
||||
}
|
||||
s.expireLocked(e)
|
||||
if e.State != StatePending {
|
||||
return "", false
|
||||
}
|
||||
return e.csrPEM, true
|
||||
}
|
||||
|
||||
// Approve attaches the issued cert and flips the record to APPROVED. The signer
|
||||
// runs OUTSIDE the lock (it shells out to step) so we re-check state here.
|
||||
func (s *Store) Approve(id, certPEM, serial, admin string) (*Enrolment, error) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
e := s.items[id]
|
||||
if e == nil {
|
||||
return nil, errors.New("unknown enrol-id")
|
||||
}
|
||||
s.expireLocked(e)
|
||||
if e.State != StatePending {
|
||||
return nil, fmt.Errorf("enrol-id is %s, not pending", e.State)
|
||||
}
|
||||
e.State = StateApproved
|
||||
e.certPEM = certPEM
|
||||
e.CertSerial = serial
|
||||
e.Hostnqn = s.hostBase + serial
|
||||
e.DecidedAt = time.Now()
|
||||
e.DecidedBy = admin
|
||||
return e.copy(), nil
|
||||
}
|
||||
|
||||
// Deny rejects a pending record.
|
||||
func (s *Store) Deny(id, admin string) (*Enrolment, error) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
e := s.items[id]
|
||||
if e == nil {
|
||||
return nil, errors.New("unknown enrol-id")
|
||||
}
|
||||
s.expireLocked(e)
|
||||
if e.State != StatePending {
|
||||
return nil, fmt.Errorf("enrol-id is %s, not pending", e.State)
|
||||
}
|
||||
e.State = StateDenied
|
||||
e.DecidedAt = time.Now()
|
||||
e.DecidedBy = admin
|
||||
return e.copy(), nil
|
||||
}
|
||||
|
||||
// Pending returns copies of the still-pending records, oldest first.
|
||||
func (s *Store) Pending() []*Enrolment {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
var out []*Enrolment
|
||||
for _, e := range s.items {
|
||||
s.expireLocked(e)
|
||||
if e.State == StatePending {
|
||||
out = append(out, e.copy())
|
||||
}
|
||||
}
|
||||
sortByCreated(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// Reap expires timed-out pending records and evicts old decided ones. Returns the
|
||||
// number expired (for audit logging).
|
||||
func (s *Store) Reap() int {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
expired := 0
|
||||
for id, e := range s.items {
|
||||
before := e.State
|
||||
s.expireLocked(e)
|
||||
if before == StatePending && e.State == StateExpired {
|
||||
expired++
|
||||
}
|
||||
if e.State != StatePending && time.Since(e.decidedOrExpired()) > s.retention {
|
||||
delete(s.items, id)
|
||||
}
|
||||
}
|
||||
return expired
|
||||
}
|
||||
|
||||
func (s *Store) countPendingLocked() int {
|
||||
n := 0
|
||||
for _, e := range s.items {
|
||||
if e.State == StatePending && time.Now().Before(e.ExpiresAt) {
|
||||
n++
|
||||
}
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func (s *Store) expireLocked(e *Enrolment) {
|
||||
if e.State == StatePending && !time.Now().Before(e.ExpiresAt) {
|
||||
e.State = StateExpired
|
||||
e.DecidedAt = e.ExpiresAt
|
||||
}
|
||||
}
|
||||
|
||||
func (e *Enrolment) decidedOrExpired() time.Time {
|
||||
if !e.DecidedAt.IsZero() {
|
||||
return e.DecidedAt
|
||||
}
|
||||
return e.ExpiresAt
|
||||
}
|
||||
|
||||
func (e *Enrolment) copy() *Enrolment {
|
||||
c := *e
|
||||
return &c
|
||||
}
|
||||
|
||||
// --- fingerprint -----------------------------------------------------------
|
||||
|
||||
// fingerprint deterministically maps (CSR public key, server nonce) to a short
|
||||
// word sequence. Both broker and host can compute it identically. The nonce is
|
||||
// server-chosen per enrol-id so an attacker cannot pre-grind a key whose
|
||||
// fingerprint collides with a target device's. Words (not hex) keep it short to
|
||||
// read aloud yet resistant to casual collision. Swap wordlist.txt for the 2048-
|
||||
// word BIP39 list (11 bits/word) if more entropy per word is wanted.
|
||||
func fingerprint(pubDER, nonce []byte, words []string, n int) (string, error) {
|
||||
if !isPow2(len(words)) {
|
||||
return "", fmt.Errorf("wordlist size %d not a power of two", len(words))
|
||||
}
|
||||
bpw := bits.TrailingZeros(uint(len(words)))
|
||||
stream := digestStream(pubDER, nonce, (n*bpw+7)/8)
|
||||
out := make([]string, 0, n)
|
||||
bitpos := 0
|
||||
for i := 0; i < n; i++ {
|
||||
idx := 0
|
||||
for k := 0; k < bpw; k++ {
|
||||
byteIdx := bitpos / 8
|
||||
bit := 7 - uint(bitpos%8)
|
||||
b := (stream[byteIdx] >> bit) & 1
|
||||
idx = (idx << 1) | int(b)
|
||||
bitpos++
|
||||
}
|
||||
out = append(out, words[idx])
|
||||
}
|
||||
return strings.Join(out, "-"), nil
|
||||
}
|
||||
|
||||
// digestStream is a SHA-256 counter-mode KDF producing >= n bytes deterministically.
|
||||
func digestStream(a, b []byte, n int) []byte {
|
||||
var stream []byte
|
||||
var ctr uint32
|
||||
for len(stream) < n {
|
||||
h := sha256.New()
|
||||
h.Write(a)
|
||||
h.Write(b)
|
||||
var c [4]byte
|
||||
binary.BigEndian.PutUint32(c[:], ctr)
|
||||
h.Write(c[:])
|
||||
stream = h.Sum(stream)
|
||||
ctr++
|
||||
}
|
||||
return stream
|
||||
}
|
||||
|
||||
func isPow2(n int) bool { return n > 0 && n&(n-1) == 0 }
|
||||
|
||||
func randHex(nbytes int) (string, error) {
|
||||
b := make([]byte, nbytes)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return hex.EncodeToString(b), nil
|
||||
}
|
||||
|
||||
// sortByCreated is a tiny insertion sort (oldest first); the queue is small.
|
||||
func sortByCreated(xs []*Enrolment) {
|
||||
for i := 1; i < len(xs); i++ {
|
||||
for j := i; j > 0 && xs[j-1].CreatedAt.After(xs[j].CreatedAt); j-- {
|
||||
xs[j-1], xs[j] = xs[j], xs[j-1]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
amber
|
||||
anchor
|
||||
apple
|
||||
arrow
|
||||
aspen
|
||||
atlas
|
||||
basil
|
||||
beacon
|
||||
birch
|
||||
bishop
|
||||
bramble
|
||||
bronze
|
||||
canyon
|
||||
cedar
|
||||
cobalt
|
||||
comet
|
||||
copper
|
||||
coral
|
||||
cosmos
|
||||
cougar
|
||||
dahlia
|
||||
delta
|
||||
ember
|
||||
falcon
|
||||
fjord
|
||||
garnet
|
||||
ginger
|
||||
granite
|
||||
harbor
|
||||
hazel
|
||||
indigo
|
||||
ivory
|
||||
jasper
|
||||
jungle
|
||||
kayak
|
||||
kernel
|
||||
lagoon
|
||||
lantern
|
||||
maple
|
||||
marble
|
||||
meadow
|
||||
nectar
|
||||
nimbus
|
||||
nutmeg
|
||||
onyx
|
||||
orbit
|
||||
otter
|
||||
pepper
|
||||
pewter
|
||||
quartz
|
||||
quiver
|
||||
raven
|
||||
ridge
|
||||
saffron
|
||||
sienna
|
||||
sparrow
|
||||
tundra
|
||||
umber
|
||||
valley
|
||||
velvet
|
||||
walnut
|
||||
willow
|
||||
zephyr
|
||||
zinc
|
||||
@@ -20,6 +20,21 @@ server {
|
||||
autoindex on;
|
||||
}
|
||||
|
||||
# TPM enrolment broker (docs/tpm-enrolment-design.md) — the ONE unauthenticated,
|
||||
# pre-auth endpoint. An empty-NV host POSTs its CSR and polls for the signed
|
||||
# cert; the admin approve/deny plane is a SEPARATE mTLS listener and is NOT
|
||||
# exposed here. Proxied to the broker (dot1x-bench stack) on loopback; the
|
||||
# trailing slash strips /enrol/ so the broker sees /request and /status/{id}.
|
||||
location /enrol/ {
|
||||
proxy_pass http://127.0.0.1:9090/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header Connection "";
|
||||
client_max_body_size 16k; # a CSR is ~1KB — cap abuse
|
||||
proxy_read_timeout 30s;
|
||||
}
|
||||
|
||||
# Kiosk SPA. The diskless kiosk (kiosk_url) points at
|
||||
# http://boot.fleet.lab/kiosk/ — resolved to this host by the stack's dnsmasq
|
||||
# and proxied to the kiosk-app container.
|
||||
|
||||
Reference in New Issue
Block a user