9c69246116
- Pass registration token from URL query parameter to install script generation - Update RenderInstallScriptFromBuild to accept registration token - Add RegistrationToken field to template data structure This lays groundwork for fixing agent registration - install scripts will be able to call the registration API with the provided token.
387 lines
11 KiB
Go
387 lines
11 KiB
Go
package handlers
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/Fimeg/RedFlag/aggregator-server/internal/config"
|
|
"github.com/Fimeg/RedFlag/aggregator-server/internal/services"
|
|
"github.com/google/uuid"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// DownloadHandler handles agent binary downloads
|
|
type DownloadHandler struct {
|
|
agentDir string
|
|
config *config.Config
|
|
installTemplateService *services.InstallTemplateService
|
|
}
|
|
|
|
func NewDownloadHandler(agentDir string, cfg *config.Config) *DownloadHandler {
|
|
return &DownloadHandler{
|
|
agentDir: agentDir,
|
|
config: cfg,
|
|
installTemplateService: services.NewInstallTemplateService(),
|
|
}
|
|
}
|
|
|
|
// getServerURL determines the server URL with proper protocol detection
|
|
func (h *DownloadHandler) getServerURL(c *gin.Context) string {
|
|
// Priority 1: Use configured public URL if set
|
|
if h.config.Server.PublicURL != "" {
|
|
return h.config.Server.PublicURL
|
|
}
|
|
|
|
// Priority 2: Construct API server URL from configuration
|
|
scheme := "http"
|
|
host := h.config.Server.Host
|
|
port := h.config.Server.Port
|
|
|
|
// Use HTTPS if TLS is enabled in config
|
|
if h.config.Server.TLS.Enabled {
|
|
scheme = "https"
|
|
}
|
|
|
|
// For default host (0.0.0.0), use localhost for client connections
|
|
if host == "0.0.0.0" {
|
|
host = "localhost"
|
|
}
|
|
|
|
// Only include port if it's not the default for the protocol
|
|
if (scheme == "http" && port != 80) || (scheme == "https" && port != 443) {
|
|
return fmt.Sprintf("%s://%s:%d", scheme, host, port)
|
|
}
|
|
|
|
return fmt.Sprintf("%s://%s", scheme, host)
|
|
}
|
|
|
|
// DownloadAgent serves agent binaries for different platforms
|
|
func (h *DownloadHandler) DownloadAgent(c *gin.Context) {
|
|
platform := c.Param("platform")
|
|
version := c.Query("version") // Optional version parameter for signed binaries
|
|
|
|
// Validate platform to prevent directory traversal
|
|
validPlatforms := map[string]bool{
|
|
"linux-amd64": true,
|
|
"linux-arm64": true,
|
|
"windows-amd64": true,
|
|
"windows-arm64": true,
|
|
}
|
|
|
|
if !validPlatforms[platform] {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid or unsupported platform"})
|
|
return
|
|
}
|
|
|
|
// Build filename based on platform
|
|
filename := "redflag-agent"
|
|
if strings.HasPrefix(platform, "windows") {
|
|
filename += ".exe"
|
|
}
|
|
|
|
var agentPath string
|
|
|
|
// Try to serve signed package first if version is specified
|
|
// TODO: Implement database lookup for signed packages
|
|
// if version != "" {
|
|
// signedPackage, err := h.packageQueries.GetSignedPackage(version, platform)
|
|
// if err == nil && fileExists(signedPackage.BinaryPath) {
|
|
// agentPath = signedPackage.BinaryPath
|
|
// }
|
|
// }
|
|
|
|
// Fallback to unsigned generic binary
|
|
if agentPath == "" {
|
|
agentPath = filepath.Join(h.agentDir, "binaries", platform, filename)
|
|
}
|
|
|
|
// Check if file exists and is not empty
|
|
info, err := os.Stat(agentPath)
|
|
if err != nil {
|
|
c.JSON(http.StatusNotFound, gin.H{
|
|
"error": "Agent binary not found",
|
|
"platform": platform,
|
|
"version": version,
|
|
})
|
|
return
|
|
}
|
|
if info.Size() == 0 {
|
|
c.JSON(http.StatusNotFound, gin.H{
|
|
"error": "Agent binary not found (empty file)",
|
|
"platform": platform,
|
|
"version": version,
|
|
})
|
|
return
|
|
}
|
|
|
|
// Handle both GET and HEAD requests
|
|
if c.Request.Method == "HEAD" {
|
|
c.Status(http.StatusOK)
|
|
return
|
|
}
|
|
|
|
c.File(agentPath)
|
|
}
|
|
|
|
// DownloadUpdatePackage serves signed agent update packages
|
|
func (h *DownloadHandler) DownloadUpdatePackage(c *gin.Context) {
|
|
packageID := c.Param("package_id")
|
|
|
|
// Validate package ID format (UUID)
|
|
if len(packageID) != 36 {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid package ID format"})
|
|
return
|
|
}
|
|
|
|
// TODO: Implement actual package serving from database/filesystem
|
|
// For now, return a placeholder response
|
|
c.JSON(http.StatusNotImplemented, gin.H{
|
|
"error": "Update package download not yet implemented",
|
|
"package_id": packageID,
|
|
"message": "This will serve the signed update package file",
|
|
})
|
|
}
|
|
|
|
// InstallScript serves the installation script
|
|
func (h *DownloadHandler) InstallScript(c *gin.Context) {
|
|
platform := c.Param("platform")
|
|
|
|
// Validate platform
|
|
validPlatforms := map[string]bool{
|
|
"linux": true,
|
|
"windows": true,
|
|
}
|
|
|
|
if !validPlatforms[platform] {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid or unsupported platform"})
|
|
return
|
|
}
|
|
|
|
serverURL := h.getServerURL(c)
|
|
scriptContent := h.generateInstallScript(c, platform, serverURL)
|
|
c.Header("Content-Type", "text/plain")
|
|
c.String(http.StatusOK, scriptContent)
|
|
}
|
|
|
|
// parseAgentID extracts agent ID from header → path → query with security priority
|
|
func parseAgentID(c *gin.Context) string {
|
|
// 1. Header → Secure (preferred)
|
|
if agentID := c.GetHeader("X-Agent-ID"); agentID != "" {
|
|
if _, err := uuid.Parse(agentID); err == nil {
|
|
log.Printf("[DEBUG] Parsed agent ID from header: %s", agentID)
|
|
return agentID
|
|
}
|
|
log.Printf("[DEBUG] Invalid UUID in header: %s", agentID)
|
|
}
|
|
|
|
// 2. Path parameter → Legacy compatible
|
|
if agentID := c.Param("agent_id"); agentID != "" {
|
|
if _, err := uuid.Parse(agentID); err == nil {
|
|
log.Printf("[DEBUG] Parsed agent ID from path: %s", agentID)
|
|
return agentID
|
|
}
|
|
log.Printf("[DEBUG] Invalid UUID in path: %s", agentID)
|
|
}
|
|
|
|
// 3. Query parameter → Fallback
|
|
if agentID := c.Query("agent_id"); agentID != "" {
|
|
if _, err := uuid.Parse(agentID); err == nil {
|
|
log.Printf("[DEBUG] Parsed agent ID from query: %s", agentID)
|
|
return agentID
|
|
}
|
|
log.Printf("[DEBUG] Invalid UUID in query: %s", agentID)
|
|
}
|
|
|
|
// Return placeholder for fresh installs
|
|
log.Printf("[DEBUG] No valid agent ID found, using placeholder")
|
|
return "<AGENT_ID>"
|
|
}
|
|
|
|
// HandleConfigDownload serves agent configuration templates with updated schema
|
|
// The install script injects the agent's actual credentials locally after download
|
|
func (h *DownloadHandler) HandleConfigDownload(c *gin.Context) {
|
|
agentIDParam := c.Param("agent_id")
|
|
|
|
// Validate UUID format
|
|
parsedAgentID, err := uuid.Parse(agentIDParam)
|
|
if err != nil {
|
|
log.Printf("Invalid agent ID format for config download: %s, error: %v", agentIDParam, err)
|
|
c.JSON(http.StatusBadRequest, gin.H{
|
|
"error": "Invalid agent ID format",
|
|
})
|
|
return
|
|
}
|
|
|
|
// Log for security monitoring
|
|
log.Printf("Config template download requested - agent_id: %s, remote_addr: %s",
|
|
parsedAgentID.String(), c.ClientIP())
|
|
|
|
// Get server URL for config
|
|
serverURL := h.getServerURL(c)
|
|
|
|
// Build config template with schema only (no sensitive credentials)
|
|
// Credentials are preserved locally by the install script
|
|
configTemplate := map[string]interface{}{
|
|
"version": 5, // Current schema version (v5 as of 0.1.23+)
|
|
"agent_version": "0.2.0",
|
|
"server_url": serverURL,
|
|
|
|
// Placeholder credentials - will be replaced by install script
|
|
"agent_id": "00000000-0000-0000-0000-000000000000",
|
|
"token": "",
|
|
"refresh_token": "",
|
|
"registration_token": "",
|
|
"machine_id": "",
|
|
|
|
// Standard configuration with all subsystems
|
|
"check_in_interval": 300,
|
|
"rapid_polling_enabled": false,
|
|
"rapid_polling_until": "0001-01-01T00:00:00Z",
|
|
|
|
"network": map[string]interface{}{
|
|
"timeout": 30000000000,
|
|
"retry_count": 3,
|
|
"retry_delay": 5000000000,
|
|
"max_idle_conn": 10,
|
|
},
|
|
|
|
"proxy": map[string]interface{}{
|
|
"enabled": false,
|
|
},
|
|
|
|
"tls": map[string]interface{}{
|
|
"enabled": false,
|
|
"insecure_skip_verify": false,
|
|
},
|
|
|
|
"logging": map[string]interface{}{
|
|
"level": "info",
|
|
"max_size": 100,
|
|
"max_backups": 3,
|
|
"max_age": 28,
|
|
},
|
|
|
|
"subsystems": map[string]interface{}{
|
|
"system": map[string]interface{}{
|
|
"enabled": true,
|
|
"timeout": 10000000000,
|
|
"circuit_breaker": map[string]interface{}{
|
|
"enabled": true,
|
|
"failure_threshold": 3,
|
|
"failure_window": 600000000000,
|
|
"open_duration": 1800000000000,
|
|
"half_open_attempts": 2,
|
|
},
|
|
},
|
|
"filesystem": map[string]interface{}{
|
|
"enabled": true,
|
|
"timeout": 10000000000,
|
|
"circuit_breaker": map[string]interface{}{
|
|
"enabled": true,
|
|
"failure_threshold": 3,
|
|
"failure_window": 600000000000,
|
|
"open_duration": 1800000000000,
|
|
"half_open_attempts": 2,
|
|
},
|
|
},
|
|
"network": map[string]interface{}{
|
|
"enabled": true,
|
|
"timeout": 30000000000,
|
|
"circuit_breaker": map[string]interface{}{
|
|
"enabled": true,
|
|
"failure_threshold": 3,
|
|
"failure_window": 600000000000,
|
|
"open_duration": 1800000000000,
|
|
"half_open_attempts": 2,
|
|
},
|
|
},
|
|
"processes": map[string]interface{}{
|
|
"enabled": true,
|
|
"timeout": 30000000000,
|
|
"circuit_breaker": map[string]interface{}{
|
|
"enabled": true,
|
|
"failure_threshold": 3,
|
|
"failure_window": 600000000000,
|
|
"open_duration": 1800000000000,
|
|
"half_open_attempts": 2,
|
|
},
|
|
},
|
|
"updates": map[string]interface{}{
|
|
"enabled": true,
|
|
"timeout": 30000000000,
|
|
"circuit_breaker": map[string]interface{}{
|
|
"enabled": false,
|
|
"failure_threshold": 0,
|
|
"failure_window": 0,
|
|
"open_duration": 0,
|
|
"half_open_attempts": 0,
|
|
},
|
|
},
|
|
"storage": map[string]interface{}{
|
|
"enabled": true,
|
|
"timeout": 10000000000,
|
|
"circuit_breaker": map[string]interface{}{
|
|
"enabled": true,
|
|
"failure_threshold": 3,
|
|
"failure_window": 600000000000,
|
|
"open_duration": 1800000000000,
|
|
"half_open_attempts": 2,
|
|
},
|
|
},
|
|
},
|
|
|
|
"security": map[string]interface{}{
|
|
"ed25519_verification": true,
|
|
"nonce_validation": true,
|
|
"machine_id_binding": true,
|
|
},
|
|
}
|
|
|
|
// Return config template as JSON
|
|
c.Header("Content-Type", "application/json")
|
|
c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"redflag-config.json\""))
|
|
c.JSON(http.StatusOK, configTemplate)
|
|
}
|
|
|
|
func (h *DownloadHandler) generateInstallScript(c *gin.Context, platform, baseURL string) string {
|
|
// Parse agent ID with defense-in-depth priority
|
|
agentIDParam := parseAgentID(c)
|
|
|
|
// Extract registration token from query parameters
|
|
registrationToken := c.Query("token")
|
|
if registrationToken == "" {
|
|
return "# Error: registration token is required\n# Please include token in URL: ?token=YOUR_TOKEN\n"
|
|
}
|
|
|
|
// Determine architecture based on platform string
|
|
var arch string
|
|
switch platform {
|
|
case "linux":
|
|
arch = "amd64" // Default for generic linux downloads
|
|
case "windows":
|
|
arch = "amd64" // Default for generic windows downloads
|
|
default:
|
|
arch = "amd64" // Fallback
|
|
}
|
|
|
|
// Use template service to generate install scripts
|
|
// Pass actual agent ID for upgrades, fallback placeholder for fresh installs
|
|
script, err := h.installTemplateService.RenderInstallScriptFromBuild(
|
|
agentIDParam, // Real agent ID or placeholder
|
|
platform, // Platform (linux/windows)
|
|
arch, // Architecture
|
|
"latest", // Version
|
|
baseURL, // Server base URL
|
|
registrationToken, // Registration token from query param
|
|
)
|
|
if err != nil {
|
|
return fmt.Sprintf("# Error generating install script: %v", err)
|
|
}
|
|
return script
|
|
}
|
|
|