baseline: P1 契约、agent 核心与中继投递（既有工作首次入库）
This commit is contained in:
chick
@@ -0,0 +1,109 @@
|
||||
// Package config loads the agent's startup file.
|
||||
//
|
||||
// The shape is deliberately small and has no host field. The local SimAdmin is reached by port
|
||||
// number alone: a config entry naming a host would be the one thing standing between a mistyped
|
||||
// value and an agent that proxies commands to somebody else's machine.
|
||||
package config
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"regexp"
|
||||
)
|
||||
|
||||
var nodePattern = regexp.MustCompile(`^nd_[A-Za-z0-9_-]{8,64}$`)
|
||||
var appPattern = regexp.MustCompile(`^ap_[A-Za-z0-9_-]{8,64}$`)
|
||||
|
||||
// Device is a paired phone.
|
||||
type Device struct {
|
||||
ID string `json:"id"`
|
||||
// SignKey is the phone's Ed25519 public key, base64. The agent verifies every request against
|
||||
// it and holds no corresponding secret, so a phone cannot be impersonated from the relay side.
|
||||
SignKey string `json:"signKey"`
|
||||
Name string `json:"name,omitempty"`
|
||||
}
|
||||
|
||||
// File is the on-disk shape.
|
||||
type File struct {
|
||||
NodeID string `json:"nodeId"`
|
||||
// RelayURL is https and is the only outbound destination.
|
||||
RelayURL string `json:"relayUrl"`
|
||||
// AgentToken is the relay bearer credential. It authorises nothing on its own; the challenge
|
||||
// signature does the identifying.
|
||||
AgentToken string `json:"agentToken"`
|
||||
// LocalPort is the SimAdmin port on 127.0.0.1. There is deliberately no host field.
|
||||
LocalPort int `json:"localPort"`
|
||||
// SignKey is the agent's Ed25519 private key, base64.
|
||||
SignKey string `json:"signKey"`
|
||||
// KxKey is the agent's X25519 private key, base64.
|
||||
KxKey string `json:"kxKey"`
|
||||
// AuditPath is where the audit log is appended.
|
||||
AuditPath string `json:"auditPath"`
|
||||
Devices []Device `json:"devices"`
|
||||
}
|
||||
|
||||
// Load reads and validates a config file.
|
||||
//
|
||||
// Validation is exhaustive rather than partial on purpose: an agent that starts with a missing
|
||||
// device or a bad port would sit there healthy and uncommandable, which is harder to notice than a
|
||||
// crash at boot.
|
||||
func Load(path string) (File, error) {
|
||||
var cfg File
|
||||
raw, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return cfg, fmt.Errorf("config: %w", err)
|
||||
}
|
||||
decoder := json.NewDecoder(bytes.NewReader(raw))
|
||||
if err := decoder.Decode(&cfg); err != nil {
|
||||
return cfg, fmt.Errorf("config: decode %s: %w", path, err)
|
||||
}
|
||||
if err := cfg.Validate(); err != nil {
|
||||
return cfg, fmt.Errorf("config: %s: %w", path, err)
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
// Validate checks every field the agent depends on.
|
||||
func (c File) Validate() error {
|
||||
if !nodePattern.MatchString(c.NodeID) {
|
||||
return errors.New("nodeId must look like nd_xxxxxxxx")
|
||||
}
|
||||
if c.RelayURL == "" {
|
||||
return errors.New("relayUrl is required")
|
||||
}
|
||||
if c.AgentToken == "" {
|
||||
return errors.New("agentToken is required")
|
||||
}
|
||||
if c.LocalPort <= 0 || c.LocalPort > 65535 {
|
||||
return fmt.Errorf("localPort %d is out of range", c.LocalPort)
|
||||
}
|
||||
if c.SignKey == "" {
|
||||
return errors.New("signKey is required")
|
||||
}
|
||||
if c.KxKey == "" {
|
||||
return errors.New("kxKey is required")
|
||||
}
|
||||
if c.AuditPath == "" {
|
||||
return errors.New("auditPath is required")
|
||||
}
|
||||
if len(c.Devices) == 0 {
|
||||
return errors.New("devices is empty, so no phone could ever be authorised")
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for _, device := range c.Devices {
|
||||
if !appPattern.MatchString(device.ID) {
|
||||
return fmt.Errorf("device id %q must look like ap_xxxxxxxx", device.ID)
|
||||
}
|
||||
if device.SignKey == "" {
|
||||
return fmt.Errorf("device %q has no signKey", device.ID)
|
||||
}
|
||||
if seen[device.ID] {
|
||||
return fmt.Errorf("device %q is listed twice", device.ID)
|
||||
}
|
||||
seen[device.ID] = true
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
package config
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// The interesting property is not that a good file parses, it is that a bad one is refused at boot.
|
||||
// An agent that starts half-configured sits there answering nothing, and "why does nothing work" is
|
||||
// much harder to diagnose than a service that will not start.
|
||||
func valid() File {
|
||||
return File{
|
||||
NodeID: "nd_7f3a9c2e",
|
||||
RelayURL: "https://relay.example",
|
||||
AgentToken: "tok",
|
||||
LocalPort: 8788,
|
||||
SignKey: "AAAA",
|
||||
KxKey: "AAAA",
|
||||
AuditPath: "/var/log/msa-agent/audit.log",
|
||||
Devices: []Device{{ID: "ap_5b1d0000", SignKey: "AAAA"}},
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateAcceptsACompleteFile(t *testing.T) {
|
||||
if err := valid().Validate(); err != nil {
|
||||
t.Fatalf("a complete file was refused: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateNamesEveryMissingField(t *testing.T) {
|
||||
cases := map[string]func(*File){
|
||||
"nodeId": func(c *File) { c.NodeID = "" },
|
||||
"relayUrl": func(c *File) { c.RelayURL = "" },
|
||||
"token": func(c *File) { c.AgentToken = "" },
|
||||
"signKey": func(c *File) { c.SignKey = "" },
|
||||
"kxKey": func(c *File) { c.KxKey = "" },
|
||||
"auditPath": func(c *File) { c.AuditPath = "" },
|
||||
"devices": func(c *File) { c.Devices = nil },
|
||||
"badNode": func(c *File) { c.NodeID = "node-1" },
|
||||
"badApp": func(c *File) { c.Devices[0].ID = "phone" },
|
||||
"noSignKey": func(c *File) { c.Devices[0].SignKey = "" },
|
||||
"port0": func(c *File) { c.LocalPort = 0 },
|
||||
"portHigh": func(c *File) { c.LocalPort = 70000 },
|
||||
"duplicate": func(c *File) { c.Devices = append(c.Devices, c.Devices[0]) },
|
||||
}
|
||||
for name, mutate := range cases {
|
||||
cfg := valid()
|
||||
mutate(&cfg)
|
||||
if err := cfg.Validate(); err == nil {
|
||||
t.Errorf("%s: a broken config was accepted", name)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// There is no host field, and this test is what keeps it that way: a "localHost" entry would be the
|
||||
// one setting able to turn the agent into a LAN pivot.
|
||||
func TestThereIsNoHostField(t *testing.T) {
|
||||
raw := []byte(`{"nodeId":"nd_7f3a9c2e","relayUrl":"https://r","agentToken":"t","localHost":"10.0.0.5",
|
||||
"localPort":8788,"signKey":"AAAA","kxKey":"AAAA","auditPath":"/tmp/a.log",
|
||||
"devices":[{"id":"ap_5b1d0000","signKey":"AAAA"}]}`)
|
||||
path := filepath.Join(t.TempDir(), "config.json")
|
||||
if err := os.WriteFile(path, raw, 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
cfg, err := Load(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// The unknown field is ignored, and the port is all the agent knows about the local service.
|
||||
if cfg.LocalPort != 8788 {
|
||||
t.Fatalf("localPort is %d", cfg.LocalPort)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadReportsMissingAndMalformedFiles(t *testing.T) {
|
||||
if _, err := Load(filepath.Join(t.TempDir(), "absent.json")); err == nil {
|
||||
t.Fatal("a missing file was accepted")
|
||||
}
|
||||
path := filepath.Join(t.TempDir(), "broken.json")
|
||||
if err := os.WriteFile(path, []byte("{"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := Load(path); err == nil {
|
||||
t.Fatal("a malformed file was accepted")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user