"constellation recover" CLI command

Signed-off-by: Malte Poll <mp@edgeless.systems>

cli/cmd/recover.go

@@ -0,0 +1,155 @@
+package cmd
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"net"
+	"regexp"
+	"strings"
+
+	"github.com/edgelesssys/constellation/cli/cloud/cloudcmd"
+	"github.com/edgelesssys/constellation/cli/cloudprovider"
+	"github.com/edgelesssys/constellation/cli/file"
+	"github.com/edgelesssys/constellation/cli/proto"
+	"github.com/edgelesssys/constellation/coordinator/util"
+	"github.com/edgelesssys/constellation/internal/config"
+	"github.com/edgelesssys/constellation/internal/constants"
+	"github.com/edgelesssys/constellation/internal/state"
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+)
+
+var diskUUIDRegexp = regexp.MustCompile("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")
+
+func newRecoverCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "recover",
+		Short: "Recover a Constellation.",
+		Long: "Recover a Constellation by sending a recovery key to an instance in the boot stage." +
+			"\nThis is only required if instances restart without other instances available for bootstrapping.",
+		Args: cobra.ExactArgs(0),
+		RunE: runRecover,
+	}
+	cmd.Flags().String("ip", "", "Instance IP address.")
+	_ = cmd.MarkFlagRequired("ip")
+	cmd.Flags().String("disk-uuid", "", "Disk UUID of the encrypted state disk.")
+	_ = cmd.MarkFlagRequired("disk-uuid")
+	cmd.Flags().String("master-secret", "", "Path to base64 encoded master secret.")
+	return cmd
+}
+
+func runRecover(cmd *cobra.Command, args []string) error {
+	fileHandler := file.NewHandler(afero.NewOsFs())
+	recoveryClient := &proto.KeyClient{}
+	defer recoveryClient.Close()
+	return recover(cmd.Context(), cmd, fileHandler, recoveryClient)
+}
+
+func recover(ctx context.Context, cmd *cobra.Command, fileHandler file.Handler, recoveryClient recoveryClient) error {
+	flags, err := parseRecoverFlags(cmd, fileHandler)
+	if err != nil {
+		return err
+	}
+
+	config, err := config.FromFile(fileHandler, flags.devConfigPath)
+	if err != nil {
+		return err
+	}
+
+	var stat state.ConstellationState
+	if err := fileHandler.ReadJSON(constants.StateFilename, &stat); err != nil {
+		return err
+	}
+
+	validators, err := cloudcmd.NewValidators(cloudprovider.FromString(stat.CloudProvider), config)
+	if err != nil {
+		return err
+	}
+	cmd.Print(validators.WarningsIncludeInit())
+
+	if err := recoveryClient.Connect(flags.ip, *config.CoordinatorPort, validators.V()); err != nil {
+		return err
+	}
+
+	diskKey, err := deriveStateDiskKey(flags.masterSecret, flags.diskUUID)
+	if err != nil {
+		return err
+	}
+
+	if err := recoveryClient.PushStateDiskKey(ctx, diskKey); err != nil {
+		return err
+	}
+
+	cmd.Println("Pushed recovery key.")
+	return nil
+}
+
+func parseRecoverFlags(cmd *cobra.Command, fileHandler file.Handler) (recoverFlags, error) {
+	ip, err := cmd.Flags().GetString("ip")
+	if err != nil {
+		return recoverFlags{}, err
+	}
+	if netIP := net.ParseIP(ip); netIP == nil {
+		return recoverFlags{}, errors.New("flag '--ip' isn't a valid IP address")
+	}
+
+	diskUUID, err := cmd.Flags().GetString("disk-uuid")
+	if err != nil {
+		return recoverFlags{}, err
+	}
+	if match := diskUUIDRegexp.MatchString(diskUUID); !match {
+		return recoverFlags{}, errors.New("flag '--disk-uuid' isn't a valid LUKS UUID")
+	}
+	diskUUID = strings.ToLower(diskUUID)
+
+	masterSecretPath, err := cmd.Flags().GetString("master-secret")
+	if err != nil {
+		return recoverFlags{}, err
+	}
+	if masterSecretPath == "" {
+		masterSecretPath = constants.MasterSecretFilename
+	}
+	masterSecret, err := readMasterSecret(fileHandler, masterSecretPath)
+	if err != nil {
+		return recoverFlags{}, err
+	}
+
+	devConfigPath, err := cmd.Flags().GetString("dev-config")
+	if err != nil {
+		return recoverFlags{}, err
+	}
+
+	return recoverFlags{
+		ip:            ip,
+		diskUUID:      diskUUID,
+		masterSecret:  masterSecret,
+		devConfigPath: devConfigPath,
+	}, nil
+}
+
+type recoverFlags struct {
+	ip            string
+	diskUUID      string
+	masterSecret  []byte
+	devConfigPath string
+}
+
+// readMasterSecret reads a base64 encoded master secret from file.
+func readMasterSecret(fileHandler file.Handler, filename string) ([]byte, error) {
+	// Try to read the base64 secret from file
+	encodedSecret, err := fileHandler.Read(filename)
+	if err != nil {
+		return nil, err
+	}
+	decoded, err := base64.StdEncoding.DecodeString(string(encodedSecret))
+	if err != nil {
+		return nil, err
+	}
+	return decoded, nil
+}
+
+// deriveStateDiskKey derives a state disk key from a master secret and a disk UUID.
+func deriveStateDiskKey(masterKey []byte, diskUUID string) ([]byte, error) {
+	return util.DeriveKey(masterKey, []byte("Constellation"), []byte("key"+diskUUID), constants.StateDiskKeyLength)
+}