1
1
mirror of https://github.com/quexten/goldwarden.git synced 2024-12-22 19:01:40 +03:00
goldwarden/agent/unixsocketagent.go

281 lines
6.7 KiB
Go
Raw Normal View History

2023-07-17 04:23:26 +03:00
package agent
import (
"context"
"encoding/json"
"fmt"
"net"
"os"
"time"
"github.com/quexten/goldwarden/agent/actions"
"github.com/quexten/goldwarden/agent/bitwarden"
"github.com/quexten/goldwarden/agent/bitwarden/crypto"
"github.com/quexten/goldwarden/agent/config"
2023-08-24 04:22:03 +03:00
"github.com/quexten/goldwarden/agent/processsecurity"
2023-07-17 04:23:26 +03:00
"github.com/quexten/goldwarden/agent/sockets"
"github.com/quexten/goldwarden/agent/ssh"
"github.com/quexten/goldwarden/agent/vault"
2023-09-20 04:05:44 +03:00
"github.com/quexten/goldwarden/ipc/messages"
2023-08-21 19:37:34 +03:00
"github.com/quexten/goldwarden/logging"
2023-07-17 04:23:26 +03:00
)
const (
FullSyncInterval = 60 * time.Minute
TokenRefreshInterval = 30 * time.Minute
)
2023-08-21 19:37:34 +03:00
var log = logging.GetLogger("Goldwarden", "Agent")
2023-07-17 04:23:26 +03:00
func writeError(c net.Conn, errMsg error) error {
2023-09-20 04:05:44 +03:00
payload := messages.ActionResponse{
2023-07-17 04:23:26 +03:00
Success: false,
Message: errMsg.Error(),
}
payloadBytes, err := json.Marshal(payload)
if err != nil {
return err
}
_, err = c.Write(payloadBytes)
if err != nil {
return err
}
return nil
}
func serveAgentSession(c net.Conn, ctx context.Context, vault *vault.Vault, cfg *config.Config) {
for {
buf := make([]byte, 1024*1024)
nr, err := c.Read(buf)
if err != nil {
return
}
data := buf[0:nr]
2023-09-20 04:05:44 +03:00
var msg messages.IPCMessage
2023-07-17 04:23:26 +03:00
err = json.Unmarshal(data, &msg)
if err != nil {
writeError(c, err)
continue
}
responseBytes := []byte{}
if action, actionFound := actions.AgentActionsRegistry.Get(msg.Type); actionFound {
callingContext := sockets.GetCallingContext(c)
2023-09-12 19:56:35 +03:00
payload, err := action(msg, cfg, vault, &callingContext)
2023-07-17 04:23:26 +03:00
if err != nil {
writeError(c, err)
continue
}
responseBytes, err = json.Marshal(payload)
if err != nil {
writeError(c, err)
continue
}
} else {
2023-09-20 04:05:44 +03:00
payload := messages.ActionResponse{
2023-07-17 04:23:26 +03:00
Success: false,
Message: "Action not found",
}
payloadBytes, err := json.Marshal(payload)
if err != nil {
writeError(c, err)
continue
}
responseBytes = payloadBytes
}
_, err = c.Write(responseBytes)
if err != nil {
log.Error("Failed writing to socket " + err.Error())
}
}
}
type AgentState struct {
}
2023-08-21 19:37:34 +03:00
func StartUnixAgent(path string, runtimeConfig config.RuntimeConfig) error {
2023-07-17 04:23:26 +03:00
ctx := context.Background()
2023-12-22 10:02:23 +03:00
var keyring crypto.Keyring
if runtimeConfig.UseMemguard {
keyring = crypto.NewMemguardKeyring(nil)
} else {
keyring = crypto.NewMemoryKeyring(nil)
}
2023-07-17 04:23:26 +03:00
var vault = vault.NewVault(&keyring)
2023-08-21 19:37:34 +03:00
cfg, err := config.ReadConfig(runtimeConfig)
2023-07-17 04:23:26 +03:00
if err != nil {
log.Warn("Could not read config: %s", err.Error())
2023-12-22 14:01:21 +03:00
cfg = config.DefaultConfig(runtimeConfig.UseMemguard)
2023-09-11 15:14:27 +03:00
cfg.ConfigFile.RuntimeConfig = runtimeConfig
2023-07-17 04:23:26 +03:00
cfg.WriteConfig()
}
2023-08-21 19:37:34 +03:00
cfg.ConfigFile.RuntimeConfig = runtimeConfig
if cfg.ConfigFile.RuntimeConfig.ApiURI != "" {
cfg.ConfigFile.ApiUrl = cfg.ConfigFile.RuntimeConfig.ApiURI
}
if cfg.ConfigFile.RuntimeConfig.IdentityURI != "" {
cfg.ConfigFile.IdentityUrl = cfg.ConfigFile.RuntimeConfig.IdentityURI
}
2023-09-11 15:14:27 +03:00
if cfg.ConfigFile.RuntimeConfig.NotificationsURI != "" {
cfg.ConfigFile.NotificationsUrl = cfg.ConfigFile.RuntimeConfig.NotificationsURI
}
2023-08-21 19:37:34 +03:00
if cfg.ConfigFile.RuntimeConfig.DeviceUUID != "" {
cfg.ConfigFile.DeviceUUID = cfg.ConfigFile.RuntimeConfig.DeviceUUID
}
2023-07-17 04:23:26 +03:00
if !cfg.IsLocked() {
2023-07-17 06:02:56 +03:00
log.Warn("Config is not locked. SET A PIN!!")
2023-07-17 04:23:26 +03:00
token, err := cfg.GetToken()
if err == nil {
if token.AccessToken != "" {
2023-09-20 04:32:37 +03:00
// attempt to sync every minute until successful
for {
bitwarden.RefreshToken(ctx, &cfg)
userSymmetricKey, err := cfg.GetUserSymmetricKey()
if err != nil {
fmt.Println(err)
time.Sleep(60 * time.Second)
continue
}
2023-12-22 10:02:23 +03:00
var protectedUserSymetricKey crypto.SymmetricEncryptionKey
if vault.Keyring.IsMemguard {
protectedUserSymetricKey, err = crypto.MemguardSymmetricEncryptionKeyFromBytes(userSymmetricKey)
} else {
protectedUserSymetricKey, err = crypto.MemorySymmetricEncryptionKeyFromBytes(userSymmetricKey)
}
2023-09-20 04:32:37 +03:00
err = bitwarden.DoFullSync(context.WithValue(ctx, bitwarden.AuthToken{}, token.AccessToken), vault, &cfg, &protectedUserSymetricKey, true)
if err != nil {
fmt.Println(err)
time.Sleep(60 * time.Second)
continue
} else {
break
}
2023-07-17 04:23:26 +03:00
}
}
}
}
2023-08-24 04:22:03 +03:00
processsecurity.DisableDumpable()
2023-12-28 03:04:46 +03:00
go func() {
err = processsecurity.MonitorLocks(func() {
cfg.Lock()
vault.Clear()
vault.Keyring.Lock()
})
if err != nil {
log.Warn("Could not monitor screensaver: %s", err.Error())
}
}()
go func() {
err = processsecurity.MonitorIdle(func() {
log.Warn("Idling detected but no action is implemented")
})
if err != nil {
log.Warn("Could not monitor idle: %s", err.Error())
}
}()
2023-12-23 10:37:17 +03:00
2023-12-28 13:45:36 +03:00
go func() {
if !runtimeConfig.WebsocketDisabled {
for {
// polling, switch this to signal based later
if !cfg.IsLocked() && cfg.IsLoggedIn() {
bitwarden.RunWebsocketDaemon(ctx, vault, &cfg)
}
time.Sleep(60 * time.Second)
}
}
}()
2023-07-17 04:23:26 +03:00
2023-08-21 19:37:34 +03:00
if !runtimeConfig.DisableSSHAgent {
2023-09-19 22:49:56 +03:00
vaultAgent := ssh.NewVaultAgent(vault, &cfg)
2023-08-21 14:52:06 +03:00
vaultAgent.SetUnlockRequestAction(func() bool {
err := cfg.TryUnlock(vault)
2023-07-17 04:23:26 +03:00
if err == nil {
2023-08-21 14:52:06 +03:00
token, err := cfg.GetToken()
if err == nil {
if token.AccessToken != "" {
bitwarden.RefreshToken(ctx, &cfg)
userSymmetricKey, err := cfg.GetUserSymmetricKey()
if err != nil {
fmt.Println(err)
}
2023-12-22 10:02:23 +03:00
var protectedUserSymetricKey crypto.SymmetricEncryptionKey
if vault.Keyring.IsMemguard {
protectedUserSymetricKey, err = crypto.MemguardSymmetricEncryptionKeyFromBytes(userSymmetricKey)
} else {
protectedUserSymetricKey, err = crypto.MemorySymmetricEncryptionKeyFromBytes(userSymmetricKey)
}
2023-08-21 14:52:06 +03:00
err = bitwarden.DoFullSync(context.WithValue(ctx, bitwarden.AuthToken{}, token.AccessToken), vault, &cfg, &protectedUserSymetricKey, true)
if err != nil {
fmt.Println(err)
}
2023-07-17 04:23:26 +03:00
}
}
2023-08-21 14:52:06 +03:00
return true
2023-07-17 04:23:26 +03:00
}
2023-08-21 14:52:06 +03:00
return false
})
go vaultAgent.Serve()
}
2023-07-17 04:23:26 +03:00
go func() {
for {
time.Sleep(TokenRefreshInterval)
if !cfg.IsLocked() {
bitwarden.RefreshToken(ctx, &cfg)
}
}
}()
go func() {
for {
time.Sleep(FullSyncInterval)
if !cfg.IsLocked() {
token, err := cfg.GetToken()
if err != nil {
log.Warn("Could not get token: %s", err.Error())
continue
}
2023-07-17 07:00:26 +03:00
bitwarden.DoFullSync(context.WithValue(ctx, bitwarden.AuthToken{}, token), vault, &cfg, nil, false)
2023-07-17 04:23:26 +03:00
}
}
}()
if _, err := os.Stat(path); err == nil {
if err := os.Remove(path); err != nil {
return err
}
}
l, err := net.Listen("unix", path)
if err != nil {
println("listen error", err.Error())
return err
}
log.Info("Agent listening on %s...", path)
2023-09-20 19:00:00 +03:00
go func() {
for {
fd, err := l.Accept()
if err != nil {
println("accept error", err.Error())
}
go serveAgentSession(fd, ctx, vault, &cfg)
2023-07-17 04:23:26 +03:00
}
2023-09-20 19:00:00 +03:00
}()
2023-07-17 04:23:26 +03:00
2023-09-20 19:00:00 +03:00
mainloop()
return nil
2023-07-17 04:23:26 +03:00
}