Add mTLS support to fleetd (#11319)

#7970

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [x] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [x] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).

orbit/pkg/packaging/linux_shared.go

@@ -2,6 +2,7 @@ package packaging
 
 import (
 	"bytes"
+	"crypto/tls"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -39,6 +40,15 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 
 	updateOpt.RootDirectory = orbitRoot
 	updateOpt.Targets = update.LinuxTargets
+	updateOpt.ServerCertificatePath = opt.UpdateTLSServerCertificate
+
+	if opt.UpdateTLSClientCertificate != "" {
+		updateClientCrt, err := tls.LoadX509KeyPair(opt.UpdateTLSClientCertificate, opt.UpdateTLSClientKey)
+		if err != nil {
+			return "", fmt.Errorf("error loading update client certificate and key: %w", err)
+		}
+		updateOpt.ClientCertificate = &updateClientCrt
+	}
 
 	if opt.Desktop {
 		updateOpt.Targets["desktop"] = update.DesktopLinuxTarget
@@ -105,8 +115,26 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 	}
 
 	if opt.FleetCertificate != "" {
-		if err := writeCertificate(opt, orbitRoot); err != nil {
-			return "", fmt.Errorf("write fleet certificate: %w", err)
+		if err := writeFleetServerCertificate(opt, orbitRoot); err != nil {
+			return "", fmt.Errorf("write fleet server certificate: %w", err)
+		}
+	}
+
+	if opt.FleetTLSClientCertificate != "" {
+		if err := writeFleetClientCertificate(opt, orbitRoot); err != nil {
+			return "", fmt.Errorf("write fleet client certificate: %w", err)
+		}
+	}
+
+	if opt.UpdateTLSServerCertificate != "" {
+		if err := writeUpdateServerCertificate(opt, orbitRoot); err != nil {
+			return "", fmt.Errorf("write update server certificate: %w", err)
+		}
+	}
+
+	if opt.UpdateTLSClientCertificate != "" {
+		if err := writeUpdateClientCertificate(opt, orbitRoot); err != nil {
+			return "", fmt.Errorf("write update client certificate: %w", err)
 		}
 	}
 
@@ -249,11 +277,15 @@ ORBIT_UPDATE_INTERVAL={{ .OrbitUpdateInterval }}
 {{ if .Desktop }}
 ORBIT_FLEET_DESKTOP=true
 ORBIT_DESKTOP_CHANNEL={{ .DesktopChannel }}
+{{ if .FleetDesktopAlternativeBrowserHost }}
+ORBIT_FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST={{ .FleetDesktopAlternativeBrowserHost }}
+{{ end }}
 {{ end }}
 {{ if .Insecure }}ORBIT_INSECURE=true{{ end }}
 {{ if .DisableUpdates }}ORBIT_DISABLE_UPDATES=true{{ end }}
 {{ if .FleetURL }}ORBIT_FLEET_URL={{.FleetURL}}{{ end }}
 {{ if .FleetCertificate }}ORBIT_FLEET_CERTIFICATE=/opt/orbit/fleet.pem{{ end }}
+{{ if .UpdateTLSServerCertificate }}ORBIT_UPDATE_TLS_CERTIFICATE=/opt/orbit/update.pem{{ end }}
 {{ if .EnrollSecret }}ORBIT_ENROLL_SECRET={{.EnrollSecret}}{{ end }}
 {{ if .Debug }}ORBIT_DEBUG=true{{ end }}
 `))