ciagent
31ccb52114
Wave B/C/D of P01 mTLS implementation.
- internal/audit/audit.go — thin wrapper around engine.Audit for
cert/handshake events (Action* and Result* constants; REQ-038).
- internal/certpaths/ — extracted path constants out of cli to break
the cli<->doctor import cycle; cli re-exports the helpers for
backward compat.
- internal/security/ca.go — public WriteCert/WriteKey helpers (0600
for keys, 0644 for certs; REQ-033); used by the cert CLI and
integration test.
- internal/daemon/tls.go — mTLS server with GetCertificate hot-swap
callback. Plaintext HTTP remains the default for v0.1 compat;
StartMTLS() flips the server into mTLS mode.
- internal/daemon/server.go — adds mtls *MTLSState field; MTLSActive()
getter for health endpoints.
- internal/transport/mtls.go — mTLS client with VerifyPeerCertificate
for pinned peer identity; DialContext for raw TLS.
- internal/transport/handshake_log.go — structured slog helpers for
handshake ok/fail (REQ-038 fields: event, result, peer, cert_fp).
- internal/cli/cert.go — orca cert {ca-init,gen,show,renew,fingerprint}
subcommands; file mode enforcement at every entry; redacted cert
show (REQ-035).
- internal/cli/doctor.go — orca doctor {cert,network,db} subcommands
(REQ-032); --json output supported.
- internal/cli/node.go — adds --ca-fingerprint to orca node join
(REQ-026); fails fast on mismatch.
- internal/doctor/doctor.go — 6 checks: cert.ca, cert.server,
cert.expiry, cert.fingerprint, network stub, db stub.
- internal/doctor/doctor_test.go — happy + sad path coverage.
- internal/security/integration_test.go — end-to-end: CA-init, CSR
generation, mTLS handshake, mismatch failure, rotation alarm,
redaction, file mode enforcement.
All tests pass with -race; gofmt -l . clean; go vet ./... clean.
---ci---
project: orca
phase: 8
milestone: v0.2
status: execute
---/ci---
67 lines
1.9 KiB
Go
67 lines
1.9 KiB
Go
package transport
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"encoding/hex"
|
|
"log/slog"
|
|
)
|
|
|
|
// LogHandshakeOK emits a structured slog record for a successful mTLS
|
|
// handshake. Per REQ-038, the fields are: event=mtls.handshake,
|
|
// result=ok, peer, cert_fp.
|
|
func LogHandshakeOK(log *slog.Logger, peer, certFP string) {
|
|
if log == nil {
|
|
return
|
|
}
|
|
log.Info("mtls.handshake",
|
|
slog.String("event", "mtls.handshake"),
|
|
slog.String("result", "ok"),
|
|
slog.String("peer", peer),
|
|
slog.String("cert_fp", certFP),
|
|
)
|
|
}
|
|
|
|
// LogHandshakeFailed emits a structured slog record for a failed mTLS
|
|
// handshake. Per REQ-038, the fields are: event=mtls.handshake,
|
|
// result=failed, peer, cert_fp (may be empty if no cert was presented
|
|
// before the failure), err. The log level is WARN — handshake failures
|
|
// are operationally interesting but not always fatal (e.g., a scanner
|
|
// probing the port).
|
|
func LogHandshakeFailed(log *slog.Logger, peer, certFP string, err error) {
|
|
if log == nil {
|
|
return
|
|
}
|
|
attrs := []any{
|
|
slog.String("event", "mtls.handshake"),
|
|
slog.String("result", "failed"),
|
|
slog.String("peer", peer),
|
|
slog.String("cert_fp", certFP),
|
|
}
|
|
if err != nil {
|
|
attrs = append(attrs, slog.String("err", err.Error()))
|
|
}
|
|
log.Warn("mtls.handshake", attrs...)
|
|
}
|
|
|
|
// LogHandshakeFromCert is a convenience wrapper that pulls the fingerprint
|
|
// off a parsed *x509.Certificate and calls LogHandshakeOK.
|
|
func LogHandshakeFromCert(log *slog.Logger, peer string, cert *x509.Certificate) {
|
|
if cert == nil {
|
|
LogHandshakeOK(log, peer, "")
|
|
return
|
|
}
|
|
LogHandshakeOK(log, peer, FingerprintOfCert(cert))
|
|
}
|
|
|
|
// FingerprintOfCert is a thin wrapper that returns the SHA-256 hex of a
|
|
// cert's DER bytes. Re-exported here so transport callers don't need
|
|
// to import the security package directly.
|
|
func FingerprintOfCert(cert *x509.Certificate) string {
|
|
if cert == nil {
|
|
return ""
|
|
}
|
|
sum := sha256.Sum256(cert.Raw)
|
|
return hex.EncodeToString(sum[:])
|
|
}
|