constellation/cli/cmd/recover.go

package cmd

import (
	"context"
	"encoding/base64"
	"errors"
	"net"
	"regexp"
	"strings"

	"github.com/edgelesssys/constellation/cli/cloud/cloudcmd"
	"github.com/edgelesssys/constellation/cli/cloudprovider"
	"github.com/edgelesssys/constellation/cli/file"
	"github.com/edgelesssys/constellation/cli/proto"
	"github.com/edgelesssys/constellation/coordinator/util"
	"github.com/edgelesssys/constellation/internal/config"
	"github.com/edgelesssys/constellation/internal/constants"
	"github.com/edgelesssys/constellation/internal/state"
	"github.com/spf13/afero"
	"github.com/spf13/cobra"
)

var diskUUIDRegexp = regexp.MustCompile("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")

func newRecoverCmd() *cobra.Command {
	cmd := &cobra.Command{
		Use:   "recover",
		Short: "Recover a Constellation.",
		Long: "Recover a Constellation by sending a recovery key to an instance in the boot stage." +
			"\nThis is only required if instances restart without other instances available for bootstrapping.",
		Args: cobra.ExactArgs(0),
		RunE: runRecover,
	}
	cmd.Flags().String("ip", "", "Instance IP address.")
	_ = cmd.MarkFlagRequired("ip")
	cmd.Flags().String("disk-uuid", "", "Disk UUID of the encrypted state disk.")
	_ = cmd.MarkFlagRequired("disk-uuid")
	cmd.Flags().String("master-secret", "", "Path to base64 encoded master secret.")
	return cmd
}

func runRecover(cmd *cobra.Command, args []string) error {
	fileHandler := file.NewHandler(afero.NewOsFs())
	recoveryClient := &proto.KeyClient{}
	defer recoveryClient.Close()
	return recover(cmd.Context(), cmd, fileHandler, recoveryClient)
}

func recover(ctx context.Context, cmd *cobra.Command, fileHandler file.Handler, recoveryClient recoveryClient) error {
	flags, err := parseRecoverFlags(cmd, fileHandler)
	if err != nil {
		return err
	}

	config, err := config.FromFile(fileHandler, flags.devConfigPath)
	if err != nil {
		return err
	}

	var stat state.ConstellationState
	if err := fileHandler.ReadJSON(constants.StateFilename, &stat); err != nil {
		return err
	}

	validators, err := cloudcmd.NewValidators(cloudprovider.FromString(stat.CloudProvider), config)
	if err != nil {
		return err
	}
	cmd.Print(validators.WarningsIncludeInit())

	if err := recoveryClient.Connect(flags.ip, *config.CoordinatorPort, validators.V()); err != nil {
		return err
	}

	diskKey, err := deriveStateDiskKey(flags.masterSecret, flags.diskUUID)
	if err != nil {
		return err
	}

	if err := recoveryClient.PushStateDiskKey(ctx, diskKey); err != nil {
		return err
	}

	cmd.Println("Pushed recovery key.")
	return nil
}

func parseRecoverFlags(cmd *cobra.Command, fileHandler file.Handler) (recoverFlags, error) {
	ip, err := cmd.Flags().GetString("ip")
	if err != nil {
		return recoverFlags{}, err
	}
	if netIP := net.ParseIP(ip); netIP == nil {
		return recoverFlags{}, errors.New("flag '--ip' isn't a valid IP address")
	}

	diskUUID, err := cmd.Flags().GetString("disk-uuid")
	if err != nil {
		return recoverFlags{}, err
	}
	if match := diskUUIDRegexp.MatchString(diskUUID); !match {
		return recoverFlags{}, errors.New("flag '--disk-uuid' isn't a valid LUKS UUID")
	}
	diskUUID = strings.ToLower(diskUUID)

	masterSecretPath, err := cmd.Flags().GetString("master-secret")
	if err != nil {
		return recoverFlags{}, err
	}
	if masterSecretPath == "" {
		masterSecretPath = constants.MasterSecretFilename
	}
	masterSecret, err := readMasterSecret(fileHandler, masterSecretPath)
	if err != nil {
		return recoverFlags{}, err
	}

	devConfigPath, err := cmd.Flags().GetString("dev-config")
	if err != nil {
		return recoverFlags{}, err
	}

	return recoverFlags{
		ip:            ip,
		diskUUID:      diskUUID,
		masterSecret:  masterSecret,
		devConfigPath: devConfigPath,
	}, nil
}

type recoverFlags struct {
	ip            string
	diskUUID      string
	masterSecret  []byte
	devConfigPath string
}

// readMasterSecret reads a base64 encoded master secret from file.
func readMasterSecret(fileHandler file.Handler, filename string) ([]byte, error) {
	// Try to read the base64 secret from file
	encodedSecret, err := fileHandler.Read(filename)
	if err != nil {
		return nil, err
	}
	decoded, err := base64.StdEncoding.DecodeString(string(encodedSecret))
	if err != nil {
		return nil, err
	}
	return decoded, nil
}

// deriveStateDiskKey derives a state disk key from a master secret and a disk UUID.
func deriveStateDiskKey(masterKey []byte, diskUUID string) ([]byte, error) {
	return util.DeriveKey(masterKey, []byte("Constellation"), []byte("key"+diskUUID), constants.StateDiskKeyLength)
}