forked from gravitational/teleport
/
api.go
163 lines (140 loc) · 5.56 KB
/
api.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
/*
* Teleport
* Copyright (C) 2023 Gravitational, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
package native
import (
"runtime"
"sync"
"time"
"github.com/gravitational/trace"
log "github.com/sirupsen/logrus"
"google.golang.org/protobuf/proto"
"google.golang.org/protobuf/types/known/timestamppb"
devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
)
// EnrollDeviceInit creates the initial enrollment data for the device.
// This includes fetching or creating a device credential, collecting device
// data and filling in any OS-specific fields.
func EnrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
return enrollDeviceInit()
}
// CollectDataMode is the mode of collection used by CollectDeviceData.
type CollectDataMode int
const (
// CollectedDataNeverEscalate will never escalate privileges, even in the
// absence of cached data.
CollectedDataNeverEscalate CollectDataMode = iota
// CollectedDataMaybeEscalate will attempt to use cached DMI data before
// privilege escalation, but it may choose to escalate if no cached data is
// available.
//
// Used by `tsh login` and similar operations (ie, device authn).
CollectedDataMaybeEscalate
// CollectedDataAlwaysEscalate avoids using cached DMI data and instead will
// always escalate privileges if necessary.
//
// Used by `tsh device enroll`, `tsh device collect` and
// `tsh device asset-tag`.
CollectedDataAlwaysEscalate
// IMPORTANT: CollectDataMode declarations must go from least to most strict.
)
var cachedDeviceData = struct {
skipCache bool // Set to true for testing.
mu sync.Mutex
mode CollectDataMode
value *devicepb.DeviceCollectedData
}{}
func readCachedDeviceDataUnderLock(mode CollectDataMode) (cdd *devicepb.DeviceCollectedData, ok bool) {
// Use cached data if present and the cached mode is at least as strict as the
// one requested.
// This can save some time, but mainly it avoids needless escalation attempts
// on Linux (past the first).
if cachedDeviceData.skipCache || cachedDeviceData.mode < mode || cachedDeviceData.value == nil {
return nil, false
}
// Default sudo cache is around 5m, so this seems like a resonable interval.
const maxAgeSeconds = 60
cdd = cachedDeviceData.value
now := time.Now()
if now.Unix()-cdd.CollectTime.Seconds > maxAgeSeconds {
// "Evict" cache.
cachedDeviceData.mode = 0
cachedDeviceData.value = nil
return nil, false
}
log.Debug("Device Trust: Using in-process cached device data")
cdd = proto.Clone(cachedDeviceData.value).(*devicepb.DeviceCollectedData)
cdd.CollectTime = timestamppb.Now()
return cdd, true
}
func writeCachedDeviceDataUnderLock(mode CollectDataMode, cdd *devicepb.DeviceCollectedData) {
cachedDeviceData.mode = mode
cachedDeviceData.value = proto.Clone(cdd).(*devicepb.DeviceCollectedData)
}
// CollectDeviceData collects OS-specific device data for device enrollment or
// device authentication ceremonies.
func CollectDeviceData(mode CollectDataMode) (*devicepb.DeviceCollectedData, error) {
cachedDeviceData.mu.Lock()
defer cachedDeviceData.mu.Unlock()
if cdd, ok := readCachedDeviceDataUnderLock(mode); ok {
return cdd, nil
}
cdd, err := collectDeviceData(mode)
if err != nil {
return nil, trace.Wrap(err)
}
writeCachedDeviceDataUnderLock(mode, cdd)
return cdd, nil
}
// SignChallenge signs a device challenge for device enrollment or device
// authentication ceremonies.
func SignChallenge(chal []byte) (sig []byte, err error) {
return signChallenge(chal)
}
// GetDeviceCredential returns the current device credential, if it exists.
func GetDeviceCredential() (*devicepb.DeviceCredential, error) {
return getDeviceCredential()
}
// SolveTPMEnrollChallenge completes a TPM enrollment challenge.
func SolveTPMEnrollChallenge(challenge *devicepb.TPMEnrollChallenge, debug bool) (*devicepb.TPMEnrollChallengeResponse, error) {
return solveTPMEnrollChallenge(challenge, debug)
}
// SolveTPMAuthnDeviceChallenge completes a TPM device authetication challenge.
func SolveTPMAuthnDeviceChallenge(challenge *devicepb.TPMAuthenticateDeviceChallenge) (*devicepb.TPMAuthenticateDeviceChallengeResponse, error) {
return solveTPMAuthnDeviceChallenge(challenge)
}
// HandleTPMActivateCredential completes the credential activation part of an
// enrollment challenge. This is usually called in an elevated process that's
// created by SolveTPMEnrollChallenge.
//
//nolint:staticcheck // HandleTPMActivateCredential works depending on the platform.
func HandleTPMActivateCredential(encryptedCredential, encryptedCredentialSecret string) error {
return handleTPMActivateCredential(encryptedCredential, encryptedCredentialSecret)
}
// GetDeviceOSType returns the devicepb.OSType for the current OS
func GetDeviceOSType() devicepb.OSType {
switch runtime.GOOS {
case "darwin":
return devicepb.OSType_OS_TYPE_MACOS
case "linux":
return devicepb.OSType_OS_TYPE_LINUX
case "windows":
return devicepb.OSType_OS_TYPE_WINDOWS
default:
return devicepb.OSType_OS_TYPE_UNSPECIFIED
}
}