2022-04-11 08:25:19 -04:00
|
|
|
package setup
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/rand"
|
|
|
|
"errors"
|
|
|
|
"net"
|
|
|
|
"os"
|
|
|
|
"path/filepath"
|
|
|
|
"syscall"
|
|
|
|
|
2022-06-29 09:26:29 -04:00
|
|
|
"github.com/edgelesssys/constellation/bootstrapper/nodestate"
|
2022-07-26 04:58:39 -04:00
|
|
|
"github.com/edgelesssys/constellation/internal/attestation"
|
2022-06-01 09:08:42 -04:00
|
|
|
"github.com/edgelesssys/constellation/internal/attestation/vtpm"
|
2022-07-26 04:58:39 -04:00
|
|
|
"github.com/edgelesssys/constellation/internal/crypto"
|
2022-05-16 11:32:00 -04:00
|
|
|
"github.com/edgelesssys/constellation/internal/file"
|
2022-06-28 10:51:30 -04:00
|
|
|
"github.com/edgelesssys/constellation/internal/logger"
|
2022-04-11 08:25:19 -04:00
|
|
|
"github.com/spf13/afero"
|
2022-06-28 10:51:30 -04:00
|
|
|
"go.uber.org/zap"
|
2022-04-11 08:25:19 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
RecoveryPort = "9000"
|
|
|
|
keyPath = "/run/cryptsetup-keys.d"
|
|
|
|
keyFile = "state.key"
|
|
|
|
stateDiskMappedName = "state"
|
|
|
|
stateDiskMountPath = "/var/run/state"
|
|
|
|
stateInfoPath = stateDiskMountPath + "/constellation/node_state.json"
|
|
|
|
)
|
|
|
|
|
|
|
|
// SetupManager handles formating, mapping, mounting and unmounting of state disks.
|
|
|
|
type SetupManager struct {
|
2022-06-28 10:51:30 -04:00
|
|
|
log *logger.Logger
|
2022-04-11 08:25:19 -04:00
|
|
|
csp string
|
|
|
|
fs afero.Afero
|
|
|
|
keyWaiter KeyWaiter
|
|
|
|
mapper DeviceMapper
|
|
|
|
mounter Mounter
|
|
|
|
openTPM vtpm.TPMOpenFunc
|
|
|
|
}
|
|
|
|
|
|
|
|
// New initializes a SetupManager with the given parameters.
|
2022-06-28 10:51:30 -04:00
|
|
|
func New(log *logger.Logger, csp string, fs afero.Afero, keyWaiter KeyWaiter, mapper DeviceMapper, mounter Mounter, openTPM vtpm.TPMOpenFunc) *SetupManager {
|
2022-04-11 08:25:19 -04:00
|
|
|
return &SetupManager{
|
2022-06-28 10:51:30 -04:00
|
|
|
log: log,
|
2022-04-11 08:25:19 -04:00
|
|
|
csp: csp,
|
|
|
|
fs: fs,
|
|
|
|
keyWaiter: keyWaiter,
|
|
|
|
mapper: mapper,
|
|
|
|
mounter: mounter,
|
|
|
|
openTPM: openTPM,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// PrepareExistingDisk requests and waits for a decryption key to remap the encrypted state disk.
|
|
|
|
// Once the disk is mapped, the function taints the node as initialized by updating it's PCRs.
|
|
|
|
func (s *SetupManager) PrepareExistingDisk() error {
|
2022-06-28 10:51:30 -04:00
|
|
|
s.log.Infof("Preparing existing state disk")
|
2022-04-11 08:25:19 -04:00
|
|
|
uuid := s.mapper.DiskUUID()
|
|
|
|
|
|
|
|
getKey:
|
2022-07-26 04:58:39 -04:00
|
|
|
passphrase, measurementSecret, err := s.keyWaiter.WaitForDecryptionKey(uuid, net.JoinHostPort("0.0.0.0", RecoveryPort))
|
2022-04-11 08:25:19 -04:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := s.mapper.MapDisk(stateDiskMappedName, string(passphrase)); err != nil {
|
|
|
|
// retry key fetching if disk mapping fails
|
2022-06-28 10:51:30 -04:00
|
|
|
s.log.With(zap.Error(err)).Errorf("Failed to map state disk, retrying...")
|
2022-04-11 08:25:19 -04:00
|
|
|
s.keyWaiter.ResetKey()
|
|
|
|
goto getKey
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := s.mounter.MkdirAll(stateDiskMountPath, os.ModePerm); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
// we do not care about cleaning up the mount point on error, since any errors returned here should result in a kernel panic in the main function
|
|
|
|
if err := s.mounter.Mount(filepath.Join("/dev/mapper/", stateDiskMappedName), stateDiskMountPath, "ext4", syscall.MS_RDONLY, ""); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-07-26 04:58:39 -04:00
|
|
|
measurementSalt, err := s.readMeasurementSalt(stateInfoPath)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2022-07-29 03:52:47 -04:00
|
|
|
clusterID, err := attestation.DeriveClusterID(measurementSecret, measurementSalt)
|
2022-04-11 08:25:19 -04:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// taint the node as initialized
|
2022-07-26 04:58:39 -04:00
|
|
|
if err := vtpm.MarkNodeAsBootstrapped(s.openTPM, clusterID); err != nil {
|
2022-04-11 08:25:19 -04:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return s.mounter.Unmount(stateDiskMountPath, 0)
|
|
|
|
}
|
|
|
|
|
|
|
|
// PrepareNewDisk prepares an instances state disk by formatting the disk as a LUKS device using a random passphrase.
|
|
|
|
func (s *SetupManager) PrepareNewDisk() error {
|
2022-06-28 10:51:30 -04:00
|
|
|
s.log.Infof("Preparing new state disk")
|
2022-04-11 08:25:19 -04:00
|
|
|
|
|
|
|
// generate and save temporary passphrase
|
|
|
|
if err := s.fs.MkdirAll(keyPath, os.ModePerm); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-07-26 04:58:39 -04:00
|
|
|
passphrase := make([]byte, crypto.RNGLengthDefault)
|
2022-04-11 08:25:19 -04:00
|
|
|
if _, err := rand.Read(passphrase); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := s.fs.WriteFile(filepath.Join(keyPath, keyFile), passphrase, 0o400); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := s.mapper.FormatDisk(string(passphrase)); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return s.mapper.MapDisk(stateDiskMappedName, string(passphrase))
|
|
|
|
}
|
|
|
|
|
2022-07-26 04:58:39 -04:00
|
|
|
func (s *SetupManager) readMeasurementSalt(path string) ([]byte, error) {
|
2022-04-11 08:25:19 -04:00
|
|
|
handler := file.NewHandler(s.fs)
|
|
|
|
var state nodestate.NodeState
|
|
|
|
if err := handler.ReadJSON(path, &state); err != nil {
|
2022-07-26 04:58:39 -04:00
|
|
|
return nil, err
|
2022-04-11 08:25:19 -04:00
|
|
|
}
|
|
|
|
|
2022-07-26 04:58:39 -04:00
|
|
|
if len(state.MeasurementSalt) != crypto.RNGLengthDefault {
|
|
|
|
return nil, errors.New("missing state information to retaint node")
|
2022-04-11 08:25:19 -04:00
|
|
|
}
|
|
|
|
|
2022-07-26 04:58:39 -04:00
|
|
|
return state.MeasurementSalt, nil
|
2022-04-11 08:25:19 -04:00
|
|
|
}
|