feat: send x-machine-id header on OpenFrame TLS requests

openframe/CMakeLists.txt

@@ -15,6 +15,7 @@ function(generateOsqueryOpenframeLibrary)
     openframe_token_extractor.cpp
     openframe_token_refresher.cpp
     openframe_authorization_manager.cpp
+    openframe_machine_id_provider.cpp
   )
 
   target_link_libraries(osquery_openframe PUBLIC
@@ -33,6 +34,7 @@ function(generateOsqueryOpenframeLibrary)
     openframe_token_refresher.h
     openframe_authorization_manager.h
     openframe_authorization_manager_provider.h
+    openframe_machine_id_provider.h
   )
 
   generateIncludeNamespace(osquery_openframe "openframe" "FILE_ONLY" ${public_header_files})

openframe/openframe_machine_id_provider.cpp

@@ -0,0 +1,72 @@
+/**
+ * Copyright (c) 2014-present, The osquery authors
+ *
+ * This source code is licensed as defined by the LICENSE file found in the
+ * root directory of this source tree.
+ *
+ * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
+ */
+
+#include "openframe_machine_id_provider.h"
+
+#include <cstdlib>
+#include <fstream>
+
+#include <boost/algorithm/string/trim.hpp>
+#include <glog/logging.h>
+
+namespace osquery {
+
+const std::string kOpenframeMachineIdHeader = "x-machine-id";
+
+namespace {
+
+// Must match the openframe-client's app-support dir on each platform.
+std::string machineIdFilePath() {
+#ifdef WIN32
+  const char* program_data = std::getenv("ProgramData");
+  std::string base =
+      (program_data != nullptr) ? program_data : "C:\\ProgramData";
+  return base + "\\OpenFrame\\machine_id";
+#elif defined(__APPLE__)
+  return "/Library/Application Support/OpenFrame/machine_id";
+#else
+  return "/var/lib/openframe/machine_id";
+#endif
+}
+
+} // namespace
+
+OpenframeMachineIdProvider& OpenframeMachineIdProvider::getInstance() {
+  static OpenframeMachineIdProvider instance;
+  return instance;
+}
+
+std::string OpenframeMachineIdProvider::getMachineId() {
+  std::lock_guard<std::mutex> lock(mutex_);
+  if (!machine_id_.empty()) {
+    return machine_id_;
+  }
+
+  auto path = machineIdFilePath();
+  std::string machine_id;
+  std::ifstream machine_id_file(path);
+  if (machine_id_file.is_open()) {
+    std::getline(machine_id_file, machine_id);
+    boost::algorithm::trim(machine_id);
+  }
+
+  if (machine_id.empty()) {
+    if (!warned_) {
+      LOG(WARNING) << "Could not read OpenFrame machine id from: " << path;
+      warned_ = true;
+    }
+    return "";
+  }
+
+  machine_id_ = machine_id;
+  LOG(INFO) << "OpenFrame machine id loaded from: " << path;
+  return machine_id_;
+}
+
+} // namespace osquery

openframe/openframe_machine_id_provider.h

@@ -0,0 +1,52 @@
+/**
+ * Copyright (c) 2014-present, The osquery authors
+ *
+ * This source code is licensed as defined by the LICENSE file found in the
+ * root directory of this source tree.
+ *
+ * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
+ */
+
+#pragma once
+
+#include <mutex>
+#include <string>
+#include <boost/noncopyable.hpp>
+
+namespace osquery {
+
+/// HTTP header carrying the locally generated OpenFrame machine id.
+extern const std::string kOpenframeMachineIdHeader;
+
+/**
+ * @brief Provides the locally generated OpenFrame machine id
+ *
+ * Reads the machine id written by the openframe-client to the shared
+ * OpenFrame data directory and caches it for the process lifetime.
+ */
+class OpenframeMachineIdProvider : private boost::noncopyable {
+ public:
+  /**
+   * @brief Get the singleton instance of OpenframeMachineIdProvider
+   *
+   * @return Reference to the singleton instance
+   */
+  static OpenframeMachineIdProvider& getInstance();
+
+  /**
+   * @brief Get the machine id, reading it from disk on first success
+   *
+   * @return The machine id, or an empty string if not available yet
+   */
+  std::string getMachineId();
+
+ private:
+  OpenframeMachineIdProvider() = default;
+  ~OpenframeMachineIdProvider() = default;
+
+  std::mutex mutex_;
+  std::string machine_id_;
+  bool warned_ = false;
+};
+
+} // namespace osquery

osquery/remote/transports/tls.cpp

@@ -10,6 +10,7 @@
 #include "tls.h"
 #include "openframe/openframe_authorization_manager.h"
 #include "openframe/openframe_authorization_manager_provider.h"
+#include "openframe/openframe_machine_id_provider.h"
 
 #include <chrono>
 #include <osquery/core/core.h>
@@ -103,6 +104,11 @@ void TLSTransport::decorateRequest(http::Request& r) {
     if (!token.empty()) {
       r << http::Request::Header("Authorization", "Bearer " + token);
     }
+
+    auto machine_id = OpenframeMachineIdProvider::getInstance().getMachineId();
+    if (!machine_id.empty()) {
+      r << http::Request::Header(kOpenframeMachineIdHeader, machine_id);
+    }
   }
 }