vicarian 0.2.2

Vicarian is a reverse proxy server with ACME support
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

use std::{
    hash::{Hash, Hasher},
    sync::Arc,
};

use anyhow::{anyhow, bail, Context, Result};
use boring::{
    asn1::{Asn1Time, Asn1TimeRef},
    x509::GeneralNameRef,
};
use camino::{Utf8Path, Utf8PathBuf};
use chrono::{DateTime, Utc};

use itertools::Itertools;
use pingora_boringssl::{
    pkey::{PKey, Private},
    x509::X509,
};
use tracing_log::log::info;

use crate::errors::VicarianError;

#[derive(Debug)]
pub struct HostCertificate {
    pub hostnames: Vec<String>,
    pub keyfile: Utf8PathBuf,
    pub key: PKey<Private>,
    pub certfile: Utf8PathBuf,
    pub certs: Vec<X509>,
    pub expires: DateTime<Utc>,
    pub watch: bool,
}

impl HostCertificate {

    /// Load and check a public/private keypair & certs. Checks are
    /// performed, and Error::CertificateMismatch may be returned; as
    /// this may be expected (e.g. while certs are being updated) it
    /// should be checked for if necessary.
    pub async fn new(keyfile: Utf8PathBuf, certfile: Utf8PathBuf, watch: bool) -> Result<Self> {
        let (key, certs) = load_hostcert(&keyfile, &certfile).await?;

        let subject_p = certs[0].subject_name().entries().next()
            .and_then(|e| e.data().as_utf8().ok())
            .map(|os| os.to_string());

        let alts = certs[0].subject_alt_names();
        let aliases = alts.iter()
            .flatten()
            .filter_map(GeneralNameRef::dnsname)
            .map(str::to_owned);

        let hostnames: Vec<String> = subject_p.into_iter()
            .chain(aliases)
            .unique() // Subject may also appear in aliases
            .collect();

        let not_after = certs[0].not_after();
        let expires = asn1time_to_datetime(not_after)?;

        info!("Loaded certificate {:?}, expires {}", hostnames, expires);
        Ok(HostCertificate {
            hostnames,
            keyfile,
            key,
            certfile,
            certs,
            expires,
            watch,
        })
    }

    /// Generates a fresh certificate from an existing one. This is
    /// effectively a reload.
    pub async fn from(hc: &Arc<HostCertificate>) -> Result<HostCertificate> {
        HostCertificate::new(hc.keyfile.clone(), hc.certfile.clone(), hc.watch).await
    }
}

pub(crate) fn asn1time_to_datetime(not_after: &Asn1TimeRef) -> Result<DateTime<Utc>> {
    let epoch = Asn1Time::from_unix(0)?;
    let time_diff = not_after.diff(&epoch)?; // Returns -(expected_value)

    // Calculate total seconds and convert to positive
    let total_seconds = -((time_diff.days as i64 * 86400) + time_diff.secs as i64);

    let datetime = DateTime::<Utc>::from_timestamp(total_seconds, 0)
        .ok_or(anyhow!("Failed to create DateTime from timestamp"))?;

    Ok(datetime)
}

impl PartialEq<HostCertificate> for HostCertificate {
    fn eq(&self, other: &Self) -> bool {
        self.certs[0].signature().as_slice() == other.certs[0].signature().as_slice()
    }
}

impl Eq for HostCertificate {
}

impl Hash for HostCertificate {
    fn hash<H: Hasher>(&self, state: &mut H) {
        self.certs[0].signature().as_slice()
            .hash(state)
    }
}

pub(crate) async fn load_hostcert(keyfile: &Utf8Path, certfile: &Utf8Path) -> Result<(PKey<Private>, Vec<X509>)> {
    let kdata = tokio::fs::read(keyfile).await
        .context("Failed to load keyfile {keyfile}")?;
    let cdata = tokio::fs::read(certfile).await
        .context("Failed to load certfile {certfile}")?;

    let key = PKey::private_key_from_pem(&kdata)?;
    let certs = X509::stack_from_pem(&cdata)?;
    if certs.is_empty() {
        bail!("No certificates found in TLS .crt file");
    }

    // Verify that the private key and cert match
    let cert_pubkey = certs[0].public_key()?;
    if !key.public_eq(&cert_pubkey) {
        let err = VicarianError::CertificateMismatch(
            keyfile.to_path_buf(),
            certfile.to_path_buf())
            .into();
        return Err(err)
    }

    Ok((key, certs))
}