sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use user system config to store tls artifacts

Browse Source
This commit is contained in:
A.Unger
2021-06-07 15:00:52 +02:00
parent e11e286d33
commit 2508ce0ef7
10 changed files with 90 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/go.sum
-3
View File
@@ -304,7 +304,6 @@ github.com/cs3org/reva v1.6.1-0.20210329145723-ed244aac4ddc/go.mod h1:exwJqEJ8lV
github.com/cs3org/reva v1.7.1-0.20210531093513-b74a2b156af6 h1:8KrCDk1GtDJUl0d1TqHEyH29yc8Wo+J6mMGYXDBh+uo=
github.com/cs3org/reva v1.7.1-0.20210531093513-b74a2b156af6/go.mod h1:5hetpRcAS6Scj8FhGc6/kLf1phWdOLvI3RbHdJZ6sfo=
github.com/cucumber/godog v0.8.1/go.mod h1:vSh3r/lM+psC1BPXvdkSEuNjmXfpVqrMGYAElF6hxnA=
github.com/cznic/b v0.0.0-20181122101859-a26611c4d92d/go.mod h1:URriBxXwVq5ijiJ12C7iIZqlA69nTlI+LgI6/pwftG8=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -969,7 +968,6 @@ github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a/go.mod h1:yL958EeXv8
github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
github.com/jmhodges/levigo v1.0.0/go.mod h1:Q6Qx+uH3RAqyK4rFQroq9RL7mdkABMcfhEI+nNuzMJQ=
github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0/go.mod h1:IiEW3SEiiErVyFdH8NTuWjSifiEQKUoyK3LNqr2kCHU=
github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks=
github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901/go.mod h1:Z86h9688Y0wesXCyonoVr47MasHilkuLMqGhRZ4Hpak=
@@ -1588,7 +1586,6 @@ github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69
github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ=
github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
github.com/tecbot/gorocksdb v0.0.0-20191217155057-f0fad39f321c/go.mod h1:ahpPrc7HpcfEWDQRZEmnXMzHY03mLDYMCxeDzy46i+8=
github.com/technoweenie/multipartstreamer v1.0.1/go.mod h1:jNVxdtShOxzAsukZwTSw6MDx5eUJoiEBsSvzDU9uzog=
github.com/thejerf/suture/v4 v4.0.0 h1:GX3X+1Qaewtj9flL2wgoTBfLA5NcmrCY39TJRpPbUrI=
github.com/thejerf/suture/v4 v4.0.0/go.mod h1:g0e8vwskm9tI0jRjxrnA6lSr0q6OfPdWJVX7G5bVWRs=
proxy/pkg/crypto/gencert.go
+29 -8
View File
@@ -10,6 +10,7 @@ import (
"math/big"
"net"
"os"
"path/filepath"
"time"
"github.com/owncloud/ocis/ocis-pkg/log"
@@ -41,13 +42,20 @@ func pemBlockForKey(priv interface{}, l log.Logger) *pem.Block {
}
}
// GenCert generates TLS-Certificates
func GenCert(l log.Logger) error {
// GenCert generates TLS-Certificates and persists them to the filesystem.
func GenCert(certName string, keyName string, l log.Logger) error {
var priv interface{}
var err error
priv, err = rsa.GenerateKey(rand.Reader, 2048)
_, certErr := os.Stat(certName)
_, keyErr := os.Stat(keyName)
if certErr == nil || keyErr == nil {
l.Debug().Msg("Proxy certificate or key already present, using these")
return nil
}
priv, err = rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
l.Fatal().Err(err).Msg("Failed to generate private key")
}
@@ -84,15 +92,20 @@ func GenCert(l log.Logger) error {
}
}
//template.IsCA = true
//template.KeyUsage |= x509.KeyUsageCertSign
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, publicKey(priv), priv)
if err != nil {
l.Fatal().Err(err).Msg("Failed to create certificate")
}
certOut, err := os.Create("server.crt")
certPath := filepath.Dir(certName)
if _, err := os.Stat(certPath); os.IsNotExist(err) {
err = os.MkdirAll(certPath, 0700)
if err != nil {
l.Fatal().Err(err).Msg("Failed to create path " + certPath)
}
}
certOut, err := os.Create(certName)
if err != nil {
l.Fatal().Err(err).Msg("Failed to open server.crt for writing")
}
@@ -106,7 +119,15 @@ func GenCert(l log.Logger) error {
}
l.Info().Msg("Written server.crt")
keyOut, err := os.OpenFile("server.key", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
keyPath := filepath.Dir(keyName)
if _, err := os.Stat(keyPath); os.IsNotExist(err) {
err = os.MkdirAll(keyPath, 0700)
if err != nil {
l.Fatal().Err(err).Msg("Failed to create path " + keyPath)
}
}
keyOut, err := os.OpenFile(keyName, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
if err != nil {
l.Fatal().Err(err).Msg("Failed to open server.key for writing")
}
proxy/pkg/flagset/flagset.go
+6 -2
View File
@@ -1,6 +1,9 @@
package flagset
import (
"path"
"github.com/ProtonMail/go-appdir"
"github.com/micro/cli/v2"
"github.com/owncloud/ocis/ocis-pkg/flags"
"github.com/owncloud/ocis/proxy/pkg/config"
@@ -45,6 +48,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
// ServerWithConfig applies cfg to the root flagset
func ServerWithConfig(cfg *config.Config) []cli.Flag {
dirs := appdir.New("proxy")
return []cli.Flag{
&cli.StringFlag{
Name: "log-file",
@@ -156,14 +160,14 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
},
&cli.StringFlag{
Name: "transport-tls-cert",
Value: flags.OverrideDefaultString(cfg.HTTP.TLSCert, ""),
Value: flags.OverrideDefaultString(cfg.HTTP.TLSCert, path.Join(dirs.UserConfig(), "server.crt")),
Usage: "Certificate file for transport encryption",
EnvVars: []string{"PROXY_TRANSPORT_TLS_CERT"},
Destination: &cfg.HTTP.TLSCert,
},
&cli.StringFlag{
Name: "transport-tls-key",
Value: flags.OverrideDefaultString(cfg.HTTP.TLSKey, ""),
Value: flags.OverrideDefaultString(cfg.HTTP.TLSKey, path.Join(dirs.UserConfig(), "server.key")),
Usage: "Secret file for transport encryption",
EnvVars: []string{"PROXY_TRANSPORT_TLS_KEY"},
Destination: &cfg.HTTP.TLSKey,
proxy/pkg/server/http/server.go
+8 -14
View File
@@ -17,25 +17,19 @@ func Server(opts ...Option) (svc.Service, error) {
httpCfg := options.Config.HTTP
var cer tls.Certificate
var certErr error
var tlsConfig *tls.Config
if options.Config.HTTP.TLS {
if httpCfg.TLSCert == "" || httpCfg.TLSKey == "" {
l.Warn().Msgf("No tls certificate provided, using a generated one")
_, certErr := os.Stat("./server.crt")
_, keyErr := os.Stat("./server.key")
l.Warn().Msgf("No tls certificate provided, using a generated one")
_, certErr := os.Stat(httpCfg.TLSCert)
_, keyErr := os.Stat(httpCfg.TLSKey)
if os.IsNotExist(certErr) || os.IsNotExist(keyErr) {
// GenCert has side effects as it writes 2 files to the binary running location
if err := crypto.GenCert(l); err != nil {
l.Fatal().Err(err).Msgf("Could not generate test-certificate")
os.Exit(1)
}
if os.IsNotExist(certErr) || os.IsNotExist(keyErr) {
// GenCert has side effects as it writes 2 files to the binary running location
if err := crypto.GenCert(httpCfg.TLSCert, httpCfg.TLSKey, l); err != nil {
l.Fatal().Err(err).Msgf("Could not generate test-certificate")
os.Exit(1)
}
httpCfg.TLSCert = "server.crt"
httpCfg.TLSKey = "server.key"
}
cer, certErr = tls.LoadX509KeyPair(httpCfg.TLSCert, httpCfg.TLSKey)