+internal openssl cert provider

This commit is contained in:
Dmitry Belyaev 2024-10-22 00:41:06 +03:00
parent e20aecea81
commit 8c1add6ff1
Signed by: b4tman
GPG Key ID: 41A00BF15EA7E5F3
6 changed files with 773 additions and 171 deletions

253
Cargo.lock generated
View File

@ -26,6 +26,21 @@ dependencies = [
"memchr",
]
[[package]]
name = "android-tzdata"
version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
[[package]]
name = "android_system_properties"
version = "0.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
dependencies = [
"libc",
]
[[package]]
name = "anstream"
version = "0.6.15"
@ -124,18 +139,53 @@ dependencies = [
"windows-targets",
]
[[package]]
name = "bitflags"
version = "2.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
[[package]]
name = "bumpalo"
version = "3.16.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
[[package]]
name = "bytes"
version = "1.7.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "428d9aa8fbc0670b7b8d6030a7fadd0f86151cae55e4dbbece15f3780a3dfaf3"
[[package]]
name = "cc"
version = "1.1.31"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2e7962b54006dcfcc61cb72735f4d89bb97061dd6a7ed882ec6b8ee53714c6f"
dependencies = [
"shlex",
]
[[package]]
name = "cfg-if"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]]
name = "chrono"
version = "0.4.38"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
dependencies = [
"android-tzdata",
"iana-time-zone",
"js-sys",
"num-traits",
"wasm-bindgen",
"windows-targets",
]
[[package]]
name = "clap"
version = "4.5.20"
@ -182,6 +232,12 @@ version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"
[[package]]
name = "core-foundation-sys"
version = "0.8.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
[[package]]
name = "encoding"
version = "0.2.33"
@ -246,6 +302,21 @@ version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
[[package]]
name = "foreign-types"
version = "0.3.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
dependencies = [
"foreign-types-shared",
]
[[package]]
name = "foreign-types-shared"
version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
[[package]]
name = "futures"
version = "0.3.31"
@ -353,18 +424,62 @@ version = "0.3.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
[[package]]
name = "iana-time-zone"
version = "0.1.61"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
dependencies = [
"android_system_properties",
"core-foundation-sys",
"iana-time-zone-haiku",
"js-sys",
"wasm-bindgen",
"windows-core",
]
[[package]]
name = "iana-time-zone-haiku"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
dependencies = [
"cc",
]
[[package]]
name = "is_terminal_polyfill"
version = "1.70.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
[[package]]
name = "js-sys"
version = "0.3.72"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a88f1bda2bd75b0452a14784937d796722fdebfe50df998aeb3f0b7603019a9"
dependencies = [
"wasm-bindgen",
]
[[package]]
name = "lazy_static"
version = "1.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
[[package]]
name = "libc"
version = "0.2.161"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e9489c2807c139ffd9c1794f4af0ebe86a828db53ecdc7fea2111d0fed085d1"
[[package]]
name = "log"
version = "0.4.22"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
[[package]]
name = "memchr"
version = "2.7.4"
@ -392,6 +507,15 @@ dependencies = [
"windows-sys",
]
[[package]]
name = "num-traits"
version = "0.2.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
dependencies = [
"autocfg",
]
[[package]]
name = "object"
version = "0.36.5"
@ -401,17 +525,64 @@ dependencies = [
"memchr",
]
[[package]]
name = "once_cell"
version = "1.20.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
[[package]]
name = "openssl"
version = "0.10.68"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6174bc48f102d208783c2c84bf931bb75927a617866870de8a4ea85597f871f5"
dependencies = [
"bitflags",
"cfg-if",
"foreign-types",
"libc",
"once_cell",
"openssl-macros",
"openssl-sys",
]
[[package]]
name = "openssl-macros"
version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "openssl-sys"
version = "0.9.104"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
dependencies = [
"cc",
"libc",
"pkg-config",
"vcpkg",
]
[[package]]
name = "peazyrsa"
version = "0.1.0"
dependencies = [
"anyhow",
"async-stream",
"chrono",
"clap",
"encoding",
"futures",
"futures-core",
"futures-util",
"lazy_static",
"openssl",
"regex",
"tokio",
]
@ -428,6 +599,12 @@ version = "0.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
[[package]]
name = "pkg-config"
version = "0.3.31"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
[[package]]
name = "proc-macro2"
version = "1.0.88"
@ -481,6 +658,12 @@ version = "0.1.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
[[package]]
name = "shlex"
version = "1.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
[[package]]
name = "signal-hook-registry"
version = "1.4.2"
@ -555,12 +738,82 @@ version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
[[package]]
name = "vcpkg"
version = "0.2.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
[[package]]
name = "wasi"
version = "0.11.0+wasi-snapshot-preview1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
[[package]]
name = "wasm-bindgen"
version = "0.2.95"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "128d1e363af62632b8eb57219c8fd7877144af57558fb2ef0368d0087bddeb2e"
dependencies = [
"cfg-if",
"once_cell",
"wasm-bindgen-macro",
]
[[package]]
name = "wasm-bindgen-backend"
version = "0.2.95"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cb6dd4d3ca0ddffd1dd1c9c04f94b868c37ff5fac97c30b97cff2d74fce3a358"
dependencies = [
"bumpalo",
"log",
"once_cell",
"proc-macro2",
"quote",
"syn",
"wasm-bindgen-shared",
]
[[package]]
name = "wasm-bindgen-macro"
version = "0.2.95"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e79384be7f8f5a9dd5d7167216f022090cf1f9ec128e6e6a482a2cb5c5422c56"
dependencies = [
"quote",
"wasm-bindgen-macro-support",
]
[[package]]
name = "wasm-bindgen-macro-support"
version = "0.2.95"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
dependencies = [
"proc-macro2",
"quote",
"syn",
"wasm-bindgen-backend",
"wasm-bindgen-shared",
]
[[package]]
name = "wasm-bindgen-shared"
version = "0.2.95"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "65fc09f10666a9f147042251e0dda9c18f166ff7de300607007e96bdebc1068d"
[[package]]
name = "windows-core"
version = "0.52.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
dependencies = [
"windows-targets",
]
[[package]]
name = "windows-sys"
version = "0.52.0"

View File

@ -6,11 +6,14 @@ edition = "2021"
[dependencies]
anyhow = "1.0.90"
async-stream = "0.3.6"
chrono = "0.4.38"
clap = { version = "4.5.20", features = ["derive"] }
encoding = "0.2.33"
futures = "0.3.31"
futures-core = "0.3.31"
futures-util = "0.3.31"
lazy_static = "1.5.0"
openssl = { version="0.10.68" }
regex = "1.11.0"
tokio = { version = "1.40.0", features = ["fs", "rt", "process", "macros", "io-util"] }

View File

@ -1,9 +1,9 @@
use anyhow::{anyhow, Result};
use anyhow::{anyhow, Context, Result};
use std::{path::PathBuf, sync::Arc};
use crate::common::{is_file_exist, read_file, write_file, AppConfig};
use crate::crypto::ICryptoProvider;
use crate::common::{is_file_exist, read_file, write_file, AppConfig, OpenSSLProviderArg, VarsMap};
use crate::crypto::{ICryptoProvider, OpenSSLBinProvider, OpenSSLLibProvider};
pub(crate) struct Certs<T>
where
@ -56,8 +56,8 @@ where
return Ok(false);
}
self.request().await?;
self.sign().await?;
self.request().await.context("req error")?;
self.sign().await.context("sign error")?;
let (template_file, ca_file, cert_file, key_file) = (
self.template_file.clone(),
@ -87,3 +87,35 @@ where
}
}
}
pub async fn build_client_config(config: &AppConfig, vars: VarsMap) -> Result<()> {
let result_file: PathBuf;
let created: bool;
if let OpenSSLProviderArg::ExternalBin(_) = config.openssl {
let certs = Certs::new(config, OpenSSLBinProvider::from_cfg(config, vars));
created = certs
.build_client_config()
.await
.context("external openssl error")?;
result_file = certs.config_file;
} else {
let certs = Certs::new(config, OpenSSLLibProvider::from_cfg(config, vars));
created = certs
.build_client_config()
.await
.context("internal openssl error")?;
result_file = certs.config_file;
}
let result_file = result_file
.to_str()
.ok_or(anyhow!("result_file PathBuf to str convert error"))?;
if created {
println!("created: {result_file}");
Ok(())
} else {
Err(anyhow!("file exists: {result_file}"))
}
}

View File

@ -4,7 +4,9 @@ use clap::Parser;
use encoding::{label::encoding_from_whatwg_label, EncoderTrap};
use std::{
collections::BTreeMap,
fmt::Display,
path::{Path, PathBuf},
str::FromStr,
};
use tokio::{
fs::{self, File},
@ -15,6 +17,31 @@ use futures_core::stream::Stream;
pub(crate) type VarsMap = BTreeMap<String, String>;
#[derive(Debug, Clone, PartialEq)]
pub enum OpenSSLProviderArg {
Internal,
ExternalBin(String),
}
impl FromStr for OpenSSLProviderArg {
type Err = anyhow::Error;
fn from_str(s: &str) -> Result<Self, Self::Err> {
match s.to_ascii_lowercase().as_str() {
"internal" => Ok(OpenSSLProviderArg::Internal),
x => Ok(OpenSSLProviderArg::ExternalBin(x.to_string())),
}
}
}
impl Display for OpenSSLProviderArg {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
match self {
OpenSSLProviderArg::ExternalBin(x) => write!(f, "{}", x),
_ => write!(f, "internal"),
}
}
}
#[derive(Parser)]
#[command(author, version, about, long_about = None)]
pub(crate) struct Args {
@ -42,12 +69,12 @@ pub(crate) struct Args {
pub(crate) config_dir: String,
/// valid days
#[arg(long, default_value = "30650")]
#[arg(long, default_value = "3650")]
pub(crate) days: u32,
/// openssl binary
#[arg(long, default_value = "openssl")]
pub(crate) openssl: String,
/// openssl binary or (internal)
#[arg(long, short, default_value = "internal")]
pub(crate) openssl: OpenSSLProviderArg,
/// template file
#[arg(long, default_value = "template.ovpn")]
@ -64,7 +91,7 @@ pub(crate) struct AppConfig {
pub(crate) openssl_cnf_env: String,
pub(crate) ca_filename: String,
pub(crate) default_email_domain: String,
pub(crate) openssl: String,
pub(crate) openssl: OpenSSLProviderArg,
pub(crate) base_directory: String,
pub(crate) email: String,
pub(crate) name: String,
@ -82,7 +109,7 @@ impl Default for AppConfig {
openssl_cnf_env: "KEY_CONFIG".into(),
ca_filename: "ca.crt".into(),
default_email_domain: "example.com".into(),
openssl: "openssl".into(),
openssl: OpenSSLProviderArg::Internal,
base_directory: ".".into(),
email: "name@example.com".into(),
name: "user".into(),

View File

@ -1,20 +1,63 @@
use anyhow::{anyhow, Result};
use anyhow::{anyhow, Context, Result};
use openssl::{
asn1::Asn1Time,
conf::{Conf, ConfMethod},
hash::MessageDigest,
pkey::{PKey, Private},
rsa::Rsa,
stack::Stack,
x509::{
extension::{ExtendedKeyUsage, KeyUsage, SubjectAlternativeName},
X509Name, X509NameBuilder, X509Req, X509ReqBuilder, X509,
},
};
use std::path::PathBuf;
use tokio::process::Command;
use tokio::{fs, process::Command};
use crate::common::{is_file_exist, AppConfig, VarsMap};
use crate::common::{is_file_exist, read_file, AppConfig, VarsMap};
use lazy_static::lazy_static;
use std::collections::HashMap;
use chrono::{Datelike, Days, Timelike, Utc};
lazy_static! {
static ref KEYMAP: HashMap<&'static str, &'static str> = {
let mut m = HashMap::new();
m.insert("C", "KEY_COUNTRY");
m.insert("ST", "KEY_PROVINCE");
m.insert("O", "KEY_ORG");
m.insert("OU", "KEY_OU");
m.insert("CN", "KEY_CN");
m.insert("name", "KEY_NAME");
m
};
}
fn get_time_str_x509(days: u32) -> Result<String> {
let dt = Utc::now();
let dt = dt
.checked_add_days(Days::new(days as u64))
.ok_or(anyhow!("failed to add days"))
.context("checked_add_days")?;
let year = dt.year() % 10000;
let month = dt.month() % 13;
let day = dt.day() % 32;
let hour = dt.hour() % 25;
let minute = dt.minute() % 60;
let second = dt.second() % 60;
let s = format!("{year:04}{month:02}{day:02}{hour:02}{minute:02}{second:02}Z");
Ok(s)
}
pub(crate) trait ICryptoProvider {
async fn request(&self) -> Result<()>;
async fn sign(&self) -> Result<()>;
}
pub(crate) fn make_certs_provider(cfg: &AppConfig, vars: VarsMap) -> impl ICryptoProvider {
OpenSSLProvider::from_cfg(cfg, vars)
}
pub(crate) struct OpenSSLProvider {
pub(crate) struct OpenSSLBinProvider {
vars: VarsMap,
base_dir: PathBuf,
openssl_cnf: PathBuf,
@ -26,7 +69,7 @@ pub(crate) struct OpenSSLProvider {
req_days: u32,
}
impl OpenSSLProvider {
impl OpenSSLBinProvider {
async fn is_ca_exists(&self) -> bool {
is_file_exist(&self.ca_file).await
}
@ -61,7 +104,7 @@ impl OpenSSLProvider {
vars,
base_dir,
openssl_cnf,
openssl: cfg.openssl.clone(),
openssl: cfg.openssl.to_string(),
ca_file,
req_file,
key_file,
@ -71,7 +114,7 @@ impl OpenSSLProvider {
}
}
impl ICryptoProvider for OpenSSLProvider {
impl ICryptoProvider for OpenSSLBinProvider {
async fn request(&self) -> Result<()> {
if self.is_req_exists().await {
return Ok(());
@ -144,3 +187,258 @@ impl ICryptoProvider for OpenSSLProvider {
}
}
}
pub(crate) struct OpenSSLLibProvider {
vars: VarsMap,
#[allow(unused)]
base_dir: PathBuf,
#[allow(unused)]
openssl_cnf: PathBuf,
ca_file: PathBuf,
ca_key_file: PathBuf,
req_file: PathBuf,
key_file: PathBuf,
cert_file: PathBuf,
req_days: u32,
key_size: u32,
encoding: String,
}
impl OpenSSLLibProvider {
async fn is_ca_exists(&self) -> bool {
is_file_exist(&self.ca_file).await
}
async fn is_cert_exists(&self) -> bool {
is_file_exist(&self.cert_file).await
}
async fn is_req_exists(&self) -> bool {
is_file_exist(&self.req_file).await
}
pub(crate) fn from_cfg(cfg: &AppConfig, vars: VarsMap) -> Self {
let base_dir = PathBuf::from(&cfg.base_directory);
let keys_dir = base_dir.clone().join(cfg.keys_subdir.clone());
let name = cfg.name.clone();
let mut vars = vars;
vars.insert("KEY_CN".into(), name.clone());
vars.insert("KEY_NAME".into(), name.clone());
vars.insert("KEY_EMAIL".into(), cfg.email.clone());
let ca_file = keys_dir.join(cfg.ca_filename.clone());
let ca_key_file = ca_file.with_extension("key");
let req_file = keys_dir.join(format!("{}.csr", &name));
let key_file = keys_dir.join(format!("{}.key", &name));
let cert_file = keys_dir.join(format!("{}.crt", &name));
let openssl_cnf = base_dir.clone().join(
std::env::var(cfg.openssl_cnf_env.clone()).unwrap_or(cfg.openssl_default_cnf.clone()),
);
let default_key_size = "2048".to_string();
let key_size_s = vars.get("KEY_SIZE").unwrap_or(&default_key_size);
let key_size: u32 = key_size_s.parse().unwrap();
let encoding = cfg.encoding.clone();
Self {
vars,
base_dir,
openssl_cnf,
ca_file,
ca_key_file,
req_file,
key_file,
cert_file,
req_days: cfg.req_days,
key_size,
encoding,
}
}
fn generate_key_pair(&self) -> Result<(Rsa<Private>, PKey<Private>)> {
let rsa = Rsa::generate(self.key_size)?;
let pkey = PKey::from_rsa(rsa.clone())?;
Ok((rsa, pkey))
}
async fn get_ca_cert(&self) -> Result<X509> {
let text = read_file(self.ca_file.clone(), &self.encoding).await?;
Ok(X509::from_pem(text.as_bytes())?)
}
async fn get_ca_key(&self) -> Result<Rsa<Private>> {
let text = read_file(self.ca_key_file.clone(), &self.encoding).await?;
Ok(Rsa::private_key_from_pem(text.as_bytes())?)
}
async fn get_key(&self) -> Result<(Rsa<Private>, PKey<Private>)> {
let text = read_file(self.key_file.clone(), &self.encoding).await?;
let rsa = Rsa::private_key_from_pem(text.as_bytes())?;
let pkey = PKey::from_rsa(rsa.clone())?;
Ok((rsa, pkey))
}
async fn get_req(&self) -> Result<X509Req> {
let text = read_file(self.req_file.clone(), &self.encoding).await?;
Ok(X509Req::from_pem(text.as_bytes())?)
}
async fn ensure_key(&self) -> Result<(Rsa<Private>, PKey<Private>)> {
if is_file_exist(&self.key_file).await {
self.get_key().await
} else {
let (rsa, pkey) = self.generate_key_pair()?;
let key_data = pkey.private_key_to_pem_pkcs8()?;
tokio::fs::write(self.key_file.as_path(), key_data).await?;
Ok((rsa, pkey))
}
}
fn build_x509_name(&self) -> Result<X509Name> {
let mut name_builder =
X509NameBuilder::new().context("Failed to create X509 name builder")?;
for (&key, &var) in KEYMAP.iter() {
let value = self
.vars
.get(var)
.ok_or(anyhow!("variable not set: {}", var))?;
name_builder.append_entry_by_text(key, value).unwrap();
}
Ok(name_builder.build())
}
}
impl ICryptoProvider for OpenSSLLibProvider {
async fn request(&self) -> Result<()> {
if self.is_req_exists().await {
return Ok(());
}
if !self.is_ca_exists().await {
return Err(anyhow!(
"ca file not found: {}",
&self.ca_file.to_str().unwrap()
));
}
let (_, pkey) = self.ensure_key().await?;
let name = self.build_x509_name()?;
let key_usage = KeyUsage::new()
.key_agreement()
.digital_signature()
.build()?;
let key_extended_ext = ExtendedKeyUsage::new().client_auth().build()?;
let mut st = Stack::new()?;
st.push(key_usage).context("push key usage")?;
st.push(key_extended_ext).context("push key_extended_ext")?;
let conf = Conf::new(ConfMethod::default()).context("conf new")?;
// Create certificate signing request (CSR)
let mut csr_builder = X509ReqBuilder::new()?;
csr_builder.set_pubkey(&pkey).context("set pubkey")?;
csr_builder.set_version(2).context("set version")?;
let context = csr_builder.x509v3_context(Some(&conf));
let mut san_extension = SubjectAlternativeName::new();
san_extension.dns(self.vars.get("KEY_NAME").unwrap());
let san_ext = san_extension.build(&context).context("build san")?;
st.push(san_ext).context("push san")?;
csr_builder
.set_subject_name(&name)
.context("set subject name")?;
csr_builder.add_extensions(&st)?;
csr_builder.sign(&pkey, MessageDigest::sha512())?;
let csr = csr_builder.build();
let pem = csr.to_pem()?;
fs::write(self.req_file.as_path(), pem).await?;
Ok(())
}
async fn sign(&self) -> Result<()> {
if self.is_cert_exists().await {
return Ok(());
}
if !self.is_ca_exists().await {
return Err(anyhow!(
"ca file not found: {}",
&self.ca_file.to_str().unwrap()
));
}
if !self.is_req_exists().await {
return Err(anyhow!(
"csr file not found: {}",
&self.req_file.to_str().unwrap()
));
}
let ca_key = self.get_ca_key().await?;
let ca_cert = self.get_ca_cert().await?;
let ca_pkey = PKey::from_rsa(ca_key.clone())?;
let req = self.get_req().await?;
let pub_key = req.public_key()?;
let subject_name = req.subject_name();
let key_usage = KeyUsage::new()
.key_agreement()
.digital_signature()
.build()
.context("new key_usage")?;
let key_extended_ext = ExtendedKeyUsage::new()
.client_auth()
.build()
.context("new key_extended_ext")?;
let mut builder = openssl::x509::X509Builder::new().context("new builder")?;
let not_before = Asn1Time::days_from_now(0).context("days_from_now 0")?;
let na_s = get_time_str_x509(self.req_days).context("na_s get_time_str_x509")?;
let not_after = Asn1Time::from_str_x509(&na_s)
.context(format!("not_after from_str_x509: {}", &na_s))?;
builder.set_version(2).context("set version")?;
builder
.set_not_before(&not_before)
.context("set not_before")?;
builder.set_not_after(&not_after).context("set not_after")?;
builder
.set_issuer_name(ca_cert.issuer_name())
.context("set_issuer_name")?;
builder.set_pubkey(&pub_key).context("set_pubkey")?;
builder
.set_subject_name(subject_name)
.context("set_subject_name")?;
let context = builder.x509v3_context(Some(&ca_cert), None);
let mut san_extension = SubjectAlternativeName::new();
san_extension.dns(self.vars.get("KEY_NAME").unwrap());
let san_ext = san_extension.build(&context).context("build san")?;
builder
.append_extension(san_ext)
.context("append san ext")?;
builder
.append_extension(key_usage)
.context("append key_usage ext")?;
builder
.append_extension(key_extended_ext)
.context("append key_extended_ext ext")?;
builder
.sign(&ca_pkey, MessageDigest::sha512())
.context("builder.sign")?;
let cert = builder.build();
let pem = cert.to_pem().context("cert.to_pem()")?;
fs::write(self.cert_file.as_path(), pem)
.await
.context("fs::write")?;
Ok(())
}
}

View File

@ -6,9 +6,8 @@ mod common;
mod crypto;
mod vars;
use crate::certs::Certs;
use crate::certs::build_client_config;
use crate::common::{AppConfig, Args};
use crate::crypto::make_certs_provider;
use crate::vars::VarsFile;
#[tokio::main(flavor = "current_thread")]
@ -21,16 +20,6 @@ async fn main() -> Result<()> {
println!("found vars: {}", vars.filepath.to_str().expect("fff"));
println!("loaded: {:#?}", &vars.vars);
let provider = make_certs_provider(&config, vars.vars.unwrap());
let certs = Certs::new(&config, provider);
let created = certs.build_client_config().await?;
let result_file = certs.config_file.to_str().unwrap();
if created {
println!("created: {result_file}");
Ok(())
} else {
Err(anyhow!("file exists: {result_file}"))
}
let vars = vars.vars.ok_or(anyhow!("no vars loaded"))?;
build_client_config(&config, vars).await
}