383 lines
10 KiB
Go
383 lines
10 KiB
Go
package client
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"net/url"
|
|
"os"
|
|
"strings"
|
|
"time"
|
|
|
|
"keywarden/agent/internal/accounts"
|
|
"keywarden/agent/internal/config"
|
|
)
|
|
|
|
const defaultTimeout = 15 * time.Second
|
|
|
|
type Client struct {
|
|
baseURL string
|
|
http *http.Client
|
|
tlsCfg *tls.Config
|
|
scheme string
|
|
host string
|
|
addr string
|
|
}
|
|
|
|
func New(cfg *config.Config) (*Client, error) {
|
|
baseURL := strings.TrimRight(cfg.ServerURL, "/")
|
|
if baseURL == "" {
|
|
return nil, errors.New("server url is required")
|
|
}
|
|
cert, err := tls.LoadX509KeyPair(cfg.ClientCertPath(), cfg.ClientKeyPath())
|
|
if err != nil {
|
|
return nil, fmt.Errorf("load client cert: %w", err)
|
|
}
|
|
caPool, err := x509.SystemCertPool()
|
|
if err != nil || caPool == nil {
|
|
caPool = x509.NewCertPool()
|
|
}
|
|
if cfg.ServerCAPath != "" {
|
|
caData, err := os.ReadFile(cfg.ServerCAPath)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("read server ca cert: %w", err)
|
|
}
|
|
if !caPool.AppendCertsFromPEM(caData) {
|
|
return nil, errors.New("parse server ca cert")
|
|
}
|
|
}
|
|
|
|
tlsConfig := &tls.Config{
|
|
Certificates: []tls.Certificate{cert},
|
|
RootCAs: caPool,
|
|
MinVersion: tls.VersionTLS12,
|
|
}
|
|
|
|
transport := &http.Transport{
|
|
TLSClientConfig: tlsConfig,
|
|
}
|
|
|
|
httpClient := &http.Client{
|
|
Timeout: defaultTimeout,
|
|
Transport: transport,
|
|
}
|
|
|
|
parsed, err := url.Parse(baseURL)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("parse server url: %w", err)
|
|
}
|
|
if parsed.Host == "" {
|
|
return nil, errors.New("server url missing host")
|
|
}
|
|
scheme := parsed.Scheme
|
|
if scheme == "" {
|
|
scheme = "https"
|
|
}
|
|
host := parsed.Hostname()
|
|
port := parsed.Port()
|
|
if port == "" {
|
|
if scheme == "http" {
|
|
port = "80"
|
|
} else {
|
|
port = "443"
|
|
}
|
|
}
|
|
addr := net.JoinHostPort(host, port)
|
|
|
|
return &Client{
|
|
baseURL: baseURL,
|
|
http: httpClient,
|
|
tlsCfg: tlsConfig,
|
|
scheme: scheme,
|
|
host: host,
|
|
addr: addr,
|
|
}, nil
|
|
}
|
|
|
|
type EnrollRequest struct {
|
|
Token string `json:"token"`
|
|
CSRPEM string `json:"csr_pem"`
|
|
Host string `json:"host"`
|
|
IPv4 string `json:"ipv4,omitempty"`
|
|
IPv6 string `json:"ipv6,omitempty"`
|
|
AgentID string `json:"agent_id,omitempty"`
|
|
}
|
|
|
|
type EnrollResponse struct {
|
|
ServerID string `json:"server_id"`
|
|
ClientCert string `json:"client_cert_pem"`
|
|
CACert string `json:"ca_cert_pem"`
|
|
SyncProfile string `json:"sync_profile,omitempty"`
|
|
DisplayName string `json:"display_name,omitempty"`
|
|
}
|
|
|
|
type AccountKey struct {
|
|
PublicKey string `json:"public_key"`
|
|
Fingerprint string `json:"fingerprint"`
|
|
}
|
|
|
|
type AccountAccess struct {
|
|
UserID int `json:"user_id"`
|
|
Username string `json:"username"`
|
|
Email string `json:"email"`
|
|
SystemUsername string `json:"system_username"`
|
|
Keys []AccountKey `json:"keys"`
|
|
}
|
|
|
|
type UserCAResponse struct {
|
|
PublicKey string `json:"public_key"`
|
|
Fingerprint string `json:"fingerprint"`
|
|
}
|
|
|
|
type AccountSyncEntry struct {
|
|
UserID int `json:"user_id"`
|
|
SystemUsername string `json:"system_username"`
|
|
Present bool `json:"present"`
|
|
}
|
|
|
|
type SyncReportRequest struct {
|
|
AppliedCount int `json:"applied_count"`
|
|
RevokedCount int `json:"revoked_count"`
|
|
Message string `json:"message,omitempty"`
|
|
Metadata map[string]any `json:"metadata,omitempty"`
|
|
Accounts []AccountSyncEntry `json:"accounts,omitempty"`
|
|
}
|
|
|
|
func Enroll(ctx context.Context, serverURL string, req EnrollRequest) (*EnrollResponse, error) {
|
|
baseURL := strings.TrimRight(serverURL, "/")
|
|
if baseURL == "" {
|
|
return nil, errors.New("server url is required")
|
|
}
|
|
body, err := json.Marshal(req)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("encode enroll request: %w", err)
|
|
}
|
|
httpClient := &http.Client{Timeout: defaultTimeout}
|
|
httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, baseURL+"/agent/enroll", bytes.NewReader(body))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("build enroll request: %w", err)
|
|
}
|
|
httpReq.Header.Set("Content-Type", "application/json")
|
|
resp, err := httpClient.Do(httpReq)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("enroll request: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode != http.StatusOK {
|
|
return nil, fmt.Errorf("enroll failed: status %s", resp.Status)
|
|
}
|
|
var out EnrollResponse
|
|
if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
|
|
return nil, fmt.Errorf("decode enroll response: %w", err)
|
|
}
|
|
if out.ServerID == "" || out.ClientCert == "" || out.CACert == "" {
|
|
return nil, errors.New("enroll response missing required fields")
|
|
}
|
|
return &out, nil
|
|
}
|
|
|
|
func (c *Client) SyncAccounts(ctx context.Context, cfg *config.Config) error {
|
|
if cfg == nil {
|
|
return errors.New("config required for account sync")
|
|
}
|
|
ca, err := c.FetchUserCA(ctx, cfg.ServerID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := accounts.EnsureCA(ca.PublicKey); err != nil {
|
|
return err
|
|
}
|
|
users, err := c.FetchAccountAccess(ctx, cfg.ServerID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
accessUsers := make([]accounts.AccessUser, 0, len(users))
|
|
for _, user := range users {
|
|
accessUsers = append(accessUsers, accounts.AccessUser{
|
|
UserID: user.UserID,
|
|
Username: user.Username,
|
|
Email: user.Email,
|
|
SystemUsername: user.SystemUsername,
|
|
})
|
|
}
|
|
result, syncErr := accounts.Sync(cfg.AccountPolicy, cfg.StateDir, accessUsers)
|
|
report := SyncReportRequest{
|
|
AppliedCount: result.Applied,
|
|
RevokedCount: result.Revoked,
|
|
Accounts: make([]AccountSyncEntry, 0, len(result.Accounts)),
|
|
}
|
|
for _, account := range result.Accounts {
|
|
report.Accounts = append(report.Accounts, AccountSyncEntry{
|
|
UserID: account.UserID,
|
|
SystemUsername: account.SystemUser,
|
|
Present: account.Present,
|
|
})
|
|
}
|
|
if syncErr != nil {
|
|
report.Message = syncErr.Error()
|
|
}
|
|
if err := c.SendSyncReport(ctx, cfg.ServerID, report); err != nil {
|
|
if syncErr != nil {
|
|
return fmt.Errorf("sync report failed: %w (sync error: %v)", err, syncErr)
|
|
}
|
|
return err
|
|
}
|
|
return syncErr
|
|
}
|
|
|
|
func (c *Client) FetchAccountAccess(ctx context.Context, serverID string) ([]AccountAccess, error) {
|
|
req, err := http.NewRequestWithContext(
|
|
ctx,
|
|
http.MethodGet,
|
|
c.baseURL+"/agent/servers/"+serverID+"/accounts",
|
|
nil,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("build account access request: %w", err)
|
|
}
|
|
resp, err := c.http.Do(req)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("fetch account access: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode >= 300 {
|
|
return nil, &HTTPStatusError{StatusCode: resp.StatusCode, Status: resp.Status}
|
|
}
|
|
var out []AccountAccess
|
|
if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
|
|
return nil, fmt.Errorf("decode account access: %w", err)
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func (c *Client) FetchUserCA(ctx context.Context, serverID string) (*UserCAResponse, error) {
|
|
req, err := http.NewRequestWithContext(
|
|
ctx,
|
|
http.MethodGet,
|
|
c.baseURL+"/agent/servers/"+serverID+"/ssh-ca",
|
|
nil,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("build user ca request: %w", err)
|
|
}
|
|
resp, err := c.http.Do(req)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("fetch user ca: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode >= 300 {
|
|
return nil, &HTTPStatusError{StatusCode: resp.StatusCode, Status: resp.Status}
|
|
}
|
|
var out UserCAResponse
|
|
if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
|
|
return nil, fmt.Errorf("decode user ca: %w", err)
|
|
}
|
|
if strings.TrimSpace(out.PublicKey) == "" {
|
|
return nil, errors.New("user ca missing public key")
|
|
}
|
|
return &out, nil
|
|
}
|
|
|
|
func (c *Client) SendSyncReport(ctx context.Context, serverID string, report SyncReportRequest) error {
|
|
body, err := json.Marshal(report)
|
|
if err != nil {
|
|
return fmt.Errorf("encode sync report: %w", err)
|
|
}
|
|
req, err := http.NewRequestWithContext(
|
|
ctx,
|
|
http.MethodPost,
|
|
c.baseURL+"/agent/servers/"+serverID+"/sync-report",
|
|
bytes.NewReader(body),
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("build sync report: %w", err)
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
resp, err := c.http.Do(req)
|
|
if err != nil {
|
|
return fmt.Errorf("send sync report: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode >= 300 {
|
|
return &HTTPStatusError{StatusCode: resp.StatusCode, Status: resp.Status}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (c *Client) SendLogBatch(ctx context.Context, serverID string, payload []byte) error {
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/agent/servers/"+serverID+"/logs", bytes.NewReader(payload))
|
|
if err != nil {
|
|
return fmt.Errorf("build log request: %w", err)
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
resp, err := c.http.Do(req)
|
|
if err != nil {
|
|
return fmt.Errorf("send log batch: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode >= 300 {
|
|
return &HTTPStatusError{StatusCode: resp.StatusCode, Status: resp.Status}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
type HeartbeatRequest struct {
|
|
Host string `json:"host,omitempty"`
|
|
IPv4 string `json:"ipv4,omitempty"`
|
|
IPv6 string `json:"ipv6,omitempty"`
|
|
PingMs *int `json:"ping_ms,omitempty"`
|
|
}
|
|
|
|
func (c *Client) UpdateHost(ctx context.Context, serverID string, reqBody HeartbeatRequest) error {
|
|
body, err := json.Marshal(reqBody)
|
|
if err != nil {
|
|
return fmt.Errorf("encode host update: %w", err)
|
|
}
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/agent/servers/"+serverID+"/heartbeat", bytes.NewReader(body))
|
|
if err != nil {
|
|
return fmt.Errorf("build host update: %w", err)
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
resp, err := c.http.Do(req)
|
|
if err != nil {
|
|
return fmt.Errorf("send host update: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode >= 300 {
|
|
return &HTTPStatusError{StatusCode: resp.StatusCode, Status: resp.Status}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (c *Client) Ping(ctx context.Context) (int, error) {
|
|
if c.addr == "" {
|
|
return 0, errors.New("server address not configured")
|
|
}
|
|
start := time.Now()
|
|
dialer := &net.Dialer{Timeout: defaultTimeout}
|
|
if c.scheme == "http" {
|
|
conn, err := dialer.DialContext(ctx, "tcp", c.addr)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
_ = conn.Close()
|
|
return int(time.Since(start).Milliseconds()), nil
|
|
}
|
|
cfg := c.tlsCfg.Clone()
|
|
if cfg.ServerName == "" && c.host != "" {
|
|
cfg.ServerName = c.host
|
|
}
|
|
conn, err := tls.DialWithDialer(dialer, "tcp", c.addr, cfg)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
_ = conn.Close()
|
|
return int(time.Since(start).Milliseconds()), nil
|
|
}
|