pinning + new version of backups

Overlord-Client/cmd/agent/handlers/files.go

@@ -8,8 +8,6 @@ import (
 	"crypto/md5"
 	"crypto/sha1"
 	"crypto/sha256"
-	"crypto/tls"
-	"crypto/x509"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -29,6 +27,7 @@ import (
 	"unicode/utf8"
 
 	agentRuntime "overlord-client/cmd/agent/runtime"
+	agentTLS "overlord-client/cmd/agent/tlsconfig"
 	"overlord-client/cmd/agent/wire"
 )
 
@@ -769,17 +768,13 @@ func HandleFileUploadHTTP(ctx context.Context, env *agentRuntime.Env, cmdID stri
 		return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{Type: "command_result", CommandID: cmdID, OK: false, Message: "unsupported upload url scheme"})
 	}
 
-	tlsConfig := &tls.Config{InsecureSkipVerify: env.Cfg.TLSInsecureSkipVerify, MinVersion: tls.VersionTLS12}
-	if caPath := strings.TrimSpace(env.Cfg.TLSCAPath); caPath != "" {
-		caBytes, err := os.ReadFile(caPath)
-		if err != nil {
-			return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{Type: "command_result", CommandID: cmdID, OK: false, Message: fmt.Sprintf("failed to read TLS CA: %v", err)})
-		}
-		pool := x509.NewCertPool()
-		if !pool.AppendCertsFromPEM(caBytes) {
-			return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{Type: "command_result", CommandID: cmdID, OK: false, Message: "failed to parse TLS CA"})
-		}
-		tlsConfig.RootCAs = pool
+	tlsConfig, err := agentTLS.Build(agentTLS.Options{
+		InsecureSkipVerify: env.Cfg.TLSInsecureSkipVerify,
+		CAPath:             env.Cfg.TLSCAPath,
+		SPKIPins:           env.Cfg.TLSSPKIPins,
+	})
+	if err != nil {
+		return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{Type: "command_result", CommandID: cmdID, OK: false, Message: fmt.Sprintf("invalid TLS configuration: %v", err)})
 	}
 
 	transport := &http.Transport{
@@ -986,6 +981,9 @@ func resolveUploadPullURL(env *agentRuntime.Env, raw string) (string, error) {
 		if scheme != "http" && scheme != "https" {
 			return "", fmt.Errorf("unsupported upload url scheme: %s", parsed.Scheme)
 		}
+		if scheme == "http" && !env.Cfg.TLSInsecureSkipVerify {
+			return "", errors.New("plaintext file transfers are disabled; use https")
+		}
 		if !strings.HasPrefix(parsed.Path, "/api/file/upload/pull/") {
 			return parsed.String(), nil
 		}
@@ -1010,8 +1008,15 @@ func resolveUploadPullURL(env *agentRuntime.Env, raw string) (string, error) {
 	case "wss":
 		server.Scheme = "https"
 	case "ws":
+		if !env.Cfg.TLSInsecureSkipVerify {
+			return "", errors.New("plaintext file transfers are disabled; use wss")
+		}
 		server.Scheme = "http"
-	case "https", "http":
+	case "https":
+	case "http":
+		if !env.Cfg.TLSInsecureSkipVerify {
+			return "", errors.New("plaintext file transfers are disabled; use https")
+		}
 	default:
 		return "", fmt.Errorf("unsupported agent server scheme: %s", server.Scheme)
 	}