Have TLS server take certificate and key from command line

1 files changed, 80 insertions, 223 deletions

diff --git a/src/cmd/credentials.h b/src/cmd/credentials.h
index c67fe22e3..b5ee701f3 100644
--- a/src/cmd/credentials.h
+++ b/src/cmd/credentials.h
@@ -27,277 +27,134 @@ inline bool value_exists(const std::vector<std::string>& vec,
    return false;
    }
 
-class Credentials_Manager_Simple : public Botan::Credentials_Manager
+class Basic_Credentials_Manager : public Credentials_Manager
    {
    public:
-      Credentials_Manager_Simple(Botan::RandomNumberGenerator& rng) :
-         rng(rng)
+      Basic_Credentials_Manager()
          {
-         try
-            {
-            m_certstores.push_back(new Botan::Certificate_Store_In_Memory("/usr/share/ca-certificates"));
-            }
-         catch(...) {}
+
          }
 
-      std::string srp_identifier(const std::string& type,
-                                 const std::string& hostname)
+      Basic_Credentials_Manager(RandomNumberGenerator& rng,
+                                const std::string& server_crt,
+                                const std::string& server_key)
          {
-         if(type == "tls-client" && hostname == "srp-host")
-            return "user";
-         return "";
+         Certificate_Info cert;
+
+         cert.key.reset(PKCS8::load_key(server_key, rng));
+
+         DataSource_Stream in(server_crt);
+         while(!in.end_of_data())
+            {
+            try
+               {
+               cert.certs.push_back(X509_Certificate(in));
+               }
+            catch(std::exception& e)
+               {
+
+               }
+            }
+
+         // TODO: attempt to validate chain ourselves
+
+         m_creds.push_back(cert);
          }
 
-      bool attempt_srp(const std::string& type,
-                       const std::string& hostname)
+      void load_certstores()
          {
-         if(hostname == "srp-host" && (type == "tls-client" || type == "tls-server"))
-            return true;
-         return false;
+         try
+            {
+            // TODO: make path configurable
+            const std::vector<std::string> paths = { "/usr/share/ca-certificates" };
+
+            for(auto&& path : paths)
+               {
+               std::shared_ptr<Certificate_Store> cs(new Certificate_Store_In_Memory(path));
+               m_certstores.push_back(cs);
+               }
+            }
+         catch(std::exception& e)
+            {
+            //std::cout << e.what() << "\n";
+            }
          }
 
       std::vector<Botan::Certificate_Store*>
       trusted_certificate_authorities(const std::string& type,
                                       const std::string& /*hostname*/)
          {
-         // don't ask for client cert
+         std::vector<Botan::Certificate_Store*> v;
+
+         // don't ask for client certs
          if(type == "tls-server")
-            return std::vector<Botan::Certificate_Store*>();
+            return v;
 
-         return m_certstores;
+         for(auto&& cs : m_certstores)
+            v.push_back(cs.get());
+
+         return v;
          }
 
       void verify_certificate_chain(
          const std::string& type,
          const std::string& purported_hostname,
-         const std::vector<Botan::X509_Certificate>& cert_chain)
+         const std::vector<X509_Certificate>& cert_chain)
          {
          try
             {
-            Botan::Credentials_Manager::verify_certificate_chain(type,
-                                                                 purported_hostname,
-                                                                 cert_chain);
+            Credentials_Manager::verify_certificate_chain(type,
+                                                          purported_hostname,
+                                                          cert_chain);
             }
          catch(std::exception& e)
             {
-            std::cout << "Certificate verification failed - " << e.what() << " - but will ignore\n";
+            std::cout << e.what() << "\n";
+            //throw;
             }
          }
 
-      std::string srp_password(const std::string& type,
-                               const std::string& hostname,
-                               const std::string& identifier)
-         {
-         if(type == "tls-client" && hostname == "srp-host" && identifier == "user")
-            return "password";
-
-         return "";
-         }
-
-      bool srp_verifier(const std::string& /*type*/,
-                        const std::string& context,
-                        const std::string& identifier,
-                        std::string& group_id,
-                        Botan::BigInt& verifier,
-                        std::vector<Botan::byte>& salt,
-                        bool generate_fake_on_unknown)
+      std::vector<X509_Certificate> cert_chain(
+         const std::vector<std::string>& algos,
+         const std::string& type,
+         const std::string& hostname)
          {
-
-         std::string pass = srp_password("tls-client", context, identifier);
-         if(pass == "")
+         for(auto&& i : m_creds)
             {
-            if(!generate_fake_on_unknown)
-               return false;
-
-            pass.resize(16);
-            rng.randomize(reinterpret_cast<byte*>(&pass[0]), pass.size());
-            }
-
-         group_id = "modp/srp/2048";
-
-         salt.resize(16);
-         rng.randomize(&salt[0], salt.size());
+            if(std::find(algos.begin(), algos.end(), i.key->algo_name()) == algos.end())
+               continue;
 
-         verifier = Botan::generate_srp6_verifier(identifier,
-                                                  pass,
-                                                  salt,
-                                                  group_id,
-                                                  "SHA-1");
+            if(hostname != "" && !i.certs[0].matches_dns_name(hostname))
+               continue;
 
-         return true;
-         }
-
-      std::string psk_identity_hint(const std::string&,
-                                    const std::string&)
-         {
-         return "";
-         }
-
-      std::string psk_identity(const std::string&, const std::string&,
-                               const std::string& identity_hint)
-         {
-         std::cout << "Server sent PSK identity_hint " << identity_hint << "\n";
-         return "Client_identity";
-         }
-
-      Botan::SymmetricKey psk(const std::string& type, const std::string& context,
-                              const std::string& identity)
-         {
-         if(type == "tls-server" && context == "session-ticket")
-            {
-            if(session_ticket_key.length() == 0)
-               session_ticket_key = Botan::SymmetricKey(rng, 32);
-            return session_ticket_key;
+            return i.certs;
             }
 
-         if(identity == "Client_identity")
-            return Botan::SymmetricKey("b5a72e1387552e6dc10766dc0eda12961f5b21e17f98ef4c41e6572e53bd7527");
-         if(identity == "lloyd")
-            return Botan::SymmetricKey("85b3c1b7dc62b507636ac767999c9630");
-
-         throw Botan::Internal_Error("No PSK set for " + identity);
+         return std::vector<X509_Certificate>();
          }
 
-      std::pair<Botan::X509_Certificate,Botan::Private_Key*>
-      load_or_make_cert(const std::string& hostname,
-                        const std::string& key_type,
-                        Botan::RandomNumberGenerator& rng)
+      Private_Key* private_key_for(const X509_Certificate& cert,
+                                   const std::string& /*type*/,
+                                   const std::string& /*context*/)
          {
-         using namespace Botan;
-
-         const std::string key_fsname_prefix = hostname + "." + key_type + ".";
-         const std::string key_file_name = key_fsname_prefix + "key";
-         const std::string cert_file_name = key_fsname_prefix + "crt";
-
-         try
+         for(auto&& i : m_creds)
             {
-            X509_Certificate cert(cert_file_name);
-            Private_Key* key = PKCS8::load_key(key_file_name, rng);
-
-            //std::cout << "Loaded existing key/cert from " << cert_file_name << " and " << key_file_name << "\n";
-
-            return std::make_pair(cert, key);
+            if(cert == i.certs[0])
+               return i.key.get();
             }
-         catch(...) {}
-
-         // Failed. Instead, make a new one
-
-         std::cout << "Creating new certificate for identifier '" << hostname << "'\n";
-
-         X509_Cert_Options opts;
-
-         opts.common_name = hostname;
-         opts.country = "US";
-         opts.email = "root@" + hostname;
-         opts.dns = hostname;
-
-         std::unique_ptr<Private_Key> key;
-         if(key_type == "rsa")
-            key.reset(new RSA_PrivateKey(rng, 1024));
-         else if(key_type == "dsa")
-            key.reset(new DSA_PrivateKey(rng, DL_Group("dsa/jce/1024")));
-         else if(key_type == "ecdsa")
-            key.reset(new ECDSA_PrivateKey(rng, EC_Group("secp256r1")));
-         else
-            throw std::runtime_error("Don't know what to do about key type '" + key_type + "'");
-
-         X509_Certificate cert =
-            X509::create_self_signed_cert(opts, *key, "SHA-1", rng);
-
-         // Now save both
 
-         std::cout << "Saving new " << key_type << " key to " << key_file_name << "\n";
-         std::ofstream key_file(key_file_name.c_str());
-         key_file << PKCS8::PEM_encode(*key, rng, "");
-         key_file.close();
-
-         std::cout << "Saving new " << key_type << " cert to " << key_file_name << "\n";
-         std::ofstream cert_file(cert_file_name.c_str());
-         cert_file << cert.PEM_encode() << "\n";
-         cert_file.close();
-
-         return std::make_pair(cert, key.release());
+         return nullptr;
          }
 
-      std::vector<Botan::X509_Certificate> cert_chain(
-         const std::vector<std::string>& cert_key_types,
-         const std::string& type,
-         const std::string& context)
+   private:
+      struct Certificate_Info
          {
-         using namespace Botan;
-
          std::vector<X509_Certificate> certs;
+         std::shared_ptr<Private_Key> key;
+         };
 
-         try
-            {
-            if(type == "tls-server")
-               {
-               const std::string hostname = (context == "" ? "localhost" : context);
-
-               if(hostname == "nosuchname")
-                  return std::vector<Botan::X509_Certificate>();
-
-               for(auto i : certs_and_keys)
-                  {
-                  if(hostname != "" && !i.first.matches_dns_name(hostname))
-                     continue;
-
-                  if(!value_exists(cert_key_types, i.second->algo_name()))
-                     continue;
-
-                  certs.push_back(i.first);
-                  }
-
-               if(!certs.empty())
-                  return certs;
-
-               std::string key_name = "";
-
-               if(value_exists(cert_key_types, "RSA"))
-                  key_name = "rsa";
-               else if(value_exists(cert_key_types, "DSA"))
-                  key_name = "dsa";
-               else if(value_exists(cert_key_types, "ECDSA"))
-                  key_name = "ecdsa";
-
-               std::pair<X509_Certificate, Private_Key*> cert_and_key =
-                  load_or_make_cert(hostname, key_name, rng);
-
-               certs_and_keys[cert_and_key.first] = cert_and_key.second;
-               certs.push_back(cert_and_key.first);
-               }
-            else if(type == "tls-client")
-               {
-               X509_Certificate cert("user-rsa.crt");
-               Private_Key* key = PKCS8::load_key("user-rsa.key", rng);
-
-               certs_and_keys[cert] = key;
-               certs.push_back(cert);
-               }
-            }
-         catch(std::exception& e)
-            {
-            std::cout << e.what() << "\n";
-            }
-
-         return certs;
-         }
-
-      Botan::Private_Key* private_key_for(const Botan::X509_Certificate& cert,
-                                          const std::string& /*type*/,
-                                          const std::string& /*context*/)
-         {
-         return certs_and_keys[cert];
-         }
-
-   private:
-      Botan::RandomNumberGenerator& rng;
-
-      Botan::SymmetricKey session_ticket_key;
-
-      std::map<Botan::X509_Certificate, Botan::Private_Key*> certs_and_keys;
-
-      std::vector<Botan::Certificate_Store*> m_certstores;
+      std::vector<Certificate_Info> m_creds;
+      std::vector<std::shared_ptr<Certificate_Store>> m_certstores;
    };
 
 #endif