Audiobuzz
d5c833addf
Build the on-host agent that pairs with fleet-hostapi and feeds the fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the workstation talked to the manager before this; Monitor + InfluxDB stayed empty. Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello + periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk, probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot, drain) are deferred until the telemetry half is bench-verified. - files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi. Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1 proto so it stays self-contained without importing the initramfs enrol module. - files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth handshake (RequireAndVerifyClientCert) against the go-tpm software simulator. - files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state. - fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress). - CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test. - Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust. Post-switch-root only, so no dracut/initramfs changes. - docs: TODO #14 + fleet-management-design as-built updated. Requires the host already enrolled (broker approve births the inventory row) — else the manager returns PermissionDenied, the correct "not enrolled yet" signal.
97 lines
3.2 KiB
Go
97 lines
3.2 KiB
Go
// identity.go — the host's mTLS identity for the agent plane, reused from the TPM.
|
|
//
|
|
// The private key never leaves the TPM: we present the enrolment cert (DER read
|
|
// from NV 0x01800100) as the leaf and hand crypto/tls a crypto.Signer backed by the
|
|
// persistent signing key at 0x81000100 (tpmkey.LoadSigner). The manager verifies
|
|
// this chain to the fleet CA and derives the cert SERIAL as the inventory key
|
|
// (agent.go: RequireAndVerifyClientCert + peerSerial), so a host can only ever be
|
|
// itself. The server cert is verified against the same fleet CA bundle.
|
|
package main
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"os"
|
|
|
|
"fleet-agent/tpmkey"
|
|
|
|
"github.com/google/go-tpm/tpm2"
|
|
"github.com/google/go-tpm/tpm2/transport"
|
|
)
|
|
|
|
// tpmIdentity holds the open TPM transport plus the loaded identity so the caller
|
|
// can close the device when the agent exits.
|
|
type tpmIdentity struct {
|
|
dev *os.File
|
|
cert tls.Certificate
|
|
}
|
|
|
|
func (id *tpmIdentity) Close() error {
|
|
if id.dev != nil {
|
|
return id.dev.Close()
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// loadTPMIdentity opens the TPM, loads the signing key at handle, reads the cert
|
|
// from NV index, and assembles a tls.Certificate whose PrivateKey is the TPM
|
|
// signer. The cert must parse and its public key must match the loaded signer
|
|
// (a stale NV cert for a rotated key would fail the handshake anyway — we surface
|
|
// it here with a clear error instead).
|
|
func loadTPMIdentity(tpmPath string, handle, nvIndex tpm2.TPMHandle) (*tpmIdentity, error) {
|
|
// /dev/tpmrm0 (kernel resource manager) is a command/response char device;
|
|
// transport.FromReadWriter over the *os.File avoids the linuxtpm transport and
|
|
// its extra deps — the same lean approach fleet-enrol uses.
|
|
f, err := os.OpenFile(tpmPath, os.O_RDWR, 0)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("open TPM %s: %w", tpmPath, err)
|
|
}
|
|
tpm := transport.FromReadWriter(f)
|
|
|
|
signer, err := tpmkey.LoadSigner(tpm, handle)
|
|
if err != nil {
|
|
f.Close()
|
|
return nil, fmt.Errorf("load signing key: %w (host enrolled?)", err)
|
|
}
|
|
der, err := tpmkey.ReadNVCert(tpm, nvIndex)
|
|
if err != nil {
|
|
f.Close()
|
|
return nil, fmt.Errorf("read identity cert from NV %#x: %w (host enrolled?)", uint32(nvIndex), err)
|
|
}
|
|
leaf, err := x509.ParseCertificate(der)
|
|
if err != nil {
|
|
f.Close()
|
|
return nil, fmt.Errorf("parse identity cert: %w", err)
|
|
}
|
|
|
|
return &tpmIdentity{
|
|
dev: f,
|
|
cert: tls.Certificate{
|
|
Certificate: [][]byte{der},
|
|
PrivateKey: signer, // crypto.Signer — TLS signs the handshake in the TPM
|
|
Leaf: leaf,
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
// clientTLS builds the mTLS config: our TPM-backed client cert + the fleet CA as
|
|
// the root that verifies the manager's server cert. serverName is the manager's
|
|
// DNS name (SNI + hostname verification).
|
|
func clientTLS(id *tpmIdentity, caFile, serverName string) (*tls.Config, error) {
|
|
pem, err := os.ReadFile(caFile)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("read fleet CA %s: %w", caFile, err)
|
|
}
|
|
pool := x509.NewCertPool()
|
|
if !pool.AppendCertsFromPEM(pem) {
|
|
return nil, fmt.Errorf("no certificates parsed from fleet CA %s", caFile)
|
|
}
|
|
return &tls.Config{
|
|
MinVersion: tls.VersionTLS12,
|
|
Certificates: []tls.Certificate{id.cert},
|
|
RootCAs: pool,
|
|
ServerName: serverName,
|
|
}, nil
|
|
}
|