131 lines
3.3 KiB
Go
131 lines
3.3 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"sort"
|
|
"strings"
|
|
|
|
"ocspcrl/internal/ocsp_source"
|
|
)
|
|
|
|
const (
|
|
crlFileName = "crl.pem"
|
|
keyFileName = "key.pem"
|
|
responderFileName = "responder.crt"
|
|
caFileName = "ca.crt"
|
|
)
|
|
|
|
type caFiles struct {
|
|
key string
|
|
responder string
|
|
ca string
|
|
crl string
|
|
}
|
|
|
|
func newCaFiles(directory string) caFiles {
|
|
return caFiles{
|
|
key: filepath.Join(directory, keyFileName),
|
|
responder: filepath.Join(directory, responderFileName),
|
|
ca: filepath.Join(directory, caFileName),
|
|
crl: filepath.Join(directory, crlFileName),
|
|
}
|
|
}
|
|
|
|
func (f caFiles) ensureExist(caName string) error {
|
|
for _, path := range []string{f.key, f.responder, f.ca, f.crl} {
|
|
if _, statError := os.Stat(path); statError != nil {
|
|
return fmt.Errorf("ca %q: %w", caName, statError)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func verifyResponderIssuedByCa(responder tls.Certificate, ca *x509.Certificate) error {
|
|
if responder.Leaf == nil {
|
|
return fmt.Errorf("responder leaf certificate could not be parsed")
|
|
}
|
|
if !bytes.Equal(ca.RawSubject, responder.Leaf.RawIssuer) {
|
|
return fmt.Errorf("responder certificate issuer does not match ca certificate subject; %+q != %+q",
|
|
ca.Subject.String(), responder.Leaf.Issuer.String())
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func loadCa(name, directory string) (*caInstance, error) {
|
|
files := newCaFiles(directory)
|
|
if existsError := files.ensureExist(name); existsError != nil {
|
|
return nil, existsError
|
|
}
|
|
|
|
responderKeyPair, loadResponderError := tls.LoadX509KeyPair(files.responder, files.key)
|
|
if loadResponderError != nil {
|
|
return nil, fmt.Errorf("ca %q: failed to load responder key pair: %w", name, loadResponderError)
|
|
}
|
|
|
|
caCertificate, loadCaError := loadCertificateFromFile(files.ca)
|
|
if loadCaError != nil {
|
|
return nil, fmt.Errorf("ca %q: failed to load ca certificate: %w", name, loadCaError)
|
|
}
|
|
|
|
if verifyError := verifyResponderIssuedByCa(responderKeyPair, caCertificate); verifyError != nil {
|
|
return nil, fmt.Errorf("ca %q: %w", name, verifyError)
|
|
}
|
|
|
|
instance := &caInstance{
|
|
name: name,
|
|
crlPath: files.crl,
|
|
caCertificate: caCertificate,
|
|
source: ocsp_source.NewCrlSource(caCertificate, responderKeyPair),
|
|
}
|
|
|
|
if reloadError := instance.reloadCrl(); reloadError != nil {
|
|
return nil, fmt.Errorf("ca %q: failed to load crl: %w", name, reloadError)
|
|
}
|
|
|
|
return instance, nil
|
|
}
|
|
|
|
func listCaSubdirectories(rootDir string) ([]string, error) {
|
|
entries, readDirError := os.ReadDir(rootDir)
|
|
if readDirError != nil {
|
|
return nil, fmt.Errorf("failed to read cas directory: %w", readDirError)
|
|
}
|
|
names := []string{}
|
|
for _, entry := range entries {
|
|
if !entry.IsDir() {
|
|
continue
|
|
}
|
|
if strings.HasPrefix(entry.Name(), ".") {
|
|
continue
|
|
}
|
|
names = append(names, entry.Name())
|
|
}
|
|
sort.Strings(names)
|
|
return names, nil
|
|
}
|
|
|
|
func discoverCas(rootDir string) ([]*caInstance, error) {
|
|
names, listError := listCaSubdirectories(rootDir)
|
|
if listError != nil {
|
|
return nil, listError
|
|
}
|
|
if len(names) == 0 {
|
|
return nil, fmt.Errorf("no ca subdirectories found in %s", rootDir)
|
|
}
|
|
|
|
cas := make([]*caInstance, 0, len(names))
|
|
for _, name := range names {
|
|
instance, loadError := loadCa(name, filepath.Join(rootDir, name))
|
|
if loadError != nil {
|
|
return nil, loadError
|
|
}
|
|
cas = append(cas, instance)
|
|
}
|
|
return cas, nil
|
|
}
|