feat(firewall): HTTPS remote TLS pins + security policy keys

EvaluateRemote pins TrustedFirewallSigners/Thumbprint; trusted modules on policy roots.

Co-authored-by: Cursor 

Author: coreybutler

modulefirewall/remote.go

@@ -2,8 +2,10 @@ package modulefirewall
 
 import (
 	"bytes"
+	"crypto/sha1"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"net/http"
@@ -26,11 +28,20 @@ type RemoteResult struct {
 	ErrorMsg string
 }
 
+// RemoteTLSOptions configures HTTPS policy client behavior.
+type RemoteTLSOptions struct {
+	TimeoutSec         int
+	AllowedOrgs        []string // TrustedFirewallSigners (O= match); empty = any valid CA chain
+	AllowedThumbprints []string // TrustedFirewallThumbprint (SHA-1 leaf hex); empty = no pin
+}
+
 // EvaluateRemote POSTs newline-delimited module names to an HTTPS endpoint.
-func EvaluateRemote(endpoint string, modules []PackageSpec, timeoutSec int, rootCAs *x509.CertPool, insecureSkipVerify bool) RemoteResult {
+func EvaluateRemote(endpoint string, modules []PackageSpec, opts RemoteTLSOptions) RemoteResult {
+	timeoutSec := opts.TimeoutSec
 	if timeoutSec <= 0 {
 		timeoutSec = 3
 	}
+
 	var body bytes.Buffer
 	for _, m := range modules {
 		line := m.Raw
@@ -44,14 +55,15 @@ func EvaluateRemote(endpoint string, modules []PackageSpec, timeoutSec int, root
 		body.WriteByte('\n')
 	}
 
+	tlsCfg := &tls.Config{
+		MinVersion: tls.VersionTLS12,
+		VerifyPeerCertificate: makePeerVerifier(opts.AllowedOrgs, opts.AllowedThumbprints),
+	}
+
 	client := &http.Client{
 		Timeout: time.Duration(timeoutSec) * time.Second,
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				RootCAs:            rootCAs,
-				InsecureSkipVerify: insecureSkipVerify, //nolint:gosec // only when policy explicitly allows
-				MinVersion:         tls.VersionTLS12,
-			},
+			TLSClientConfig: tlsCfg,
 		},
 	}
 
@@ -89,6 +101,79 @@ func EvaluateRemote(endpoint string, modules []PackageSpec, timeoutSec int, root
 	}
 }
 
+func makePeerVerifier(orgs, thumbs []string) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+	orgs = normalizePinList(orgs)
+	thumbs = normalizeThumbList(thumbs)
+	if len(orgs) == 0 && len(thumbs) == 0 {
+		return nil
+	}
+	return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+		if len(rawCerts) == 0 {
+			return fmt.Errorf("firewall remote: empty peer certificate")
+		}
+		leaf, err := x509.ParseCertificate(rawCerts[0])
+		if err != nil {
+			return fmt.Errorf("firewall remote: parse leaf: %w", err)
+		}
+		if len(thumbs) > 0 {
+			sum := sha1.Sum(leaf.Raw)
+			got := strings.ToLower(hex.EncodeToString(sum[:]))
+			ok := false
+			for _, want := range thumbs {
+				if got == want {
+					ok = true
+					break
+				}
+			}
+			if !ok {
+				return fmt.Errorf("firewall remote: leaf thumbprint not in TrustedFirewallThumbprint")
+			}
+		}
+		if len(orgs) > 0 {
+			ok := false
+			for _, o := range leaf.Subject.Organization {
+				for _, want := range orgs {
+					if strings.EqualFold(strings.TrimSpace(o), want) {
+						ok = true
+						break
+					}
+				}
+				if ok {
+					break
+				}
+			}
+			if !ok {
+				return fmt.Errorf("firewall remote: leaf O= not in TrustedFirewallSigners")
+			}
+		}
+		_ = verifiedChains
+		return nil
+	}
+}
+
+func normalizePinList(in []string) []string {
+	out := make([]string, 0, len(in))
+	for _, s := range in {
+		s = strings.TrimSpace(s)
+		if s != "" {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+func normalizeThumbList(in []string) []string {
+	out := make([]string, 0, len(in))
+	for _, s := range in {
+		s = strings.ToLower(strings.ReplaceAll(strings.TrimSpace(s), ":", ""))
+		s = strings.ReplaceAll(s, " ", "")
+		if s != "" {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
 func parseForbiddenBody(body string) []RemoteBlock {
 	var blocks []RemoteBlock
 	for _, line := range strings.Split(body, "\n") {

settings/settings.go

@@ -209,8 +209,8 @@ func applyMachineOnlySettings() {
 func isSecurityPolicySetting(name string) bool {
 	switch name {
 	case "allowed_signers", "allow_insecure_downloads", "local_install_only", "air_gapped",
-		"approved_modules", "approved_global_modules", "trusted_firewall_signers", "trusted_firewall_thumbprint",
-		"firewall_http_timeout_seconds":
+		"approved_modules", "approved_global_modules", "trusted_modules", "untrusted_module_handler_action",
+		"trusted_firewall_signers", "trusted_firewall_thumbprint", "firewall_http_timeout_seconds":
 		return true
 	default:
 		return false