Lukasz Janyst
4 years ago
parent
c81cfd0d57
commit
0576dcddff
8 changed files with 29 additions and 374 deletions
@ -1,53 +0,0 @@ |
||||
// Copyright (c) 2022 Proton Technologies AG
|
||||
//
|
||||
// This file is part of ProtonMail Bridge.
|
||||
//
|
||||
// ProtonMail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// ProtonMail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with ProtonMail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
package tls |
||||
|
||||
import "os/exec" |
||||
|
||||
func addTrustedCert(certPath string) error { |
||||
return exec.Command( // nolint[gosec]
|
||||
"/usr/bin/security", |
||||
"execute-with-privileges", |
||||
"/usr/bin/security", |
||||
"add-trusted-cert", |
||||
"-d", |
||||
"-r", "trustRoot", |
||||
"-p", "ssl", |
||||
"-k", "/Library/Keychains/System.keychain", |
||||
certPath, |
||||
).Run() |
||||
} |
||||
|
||||
func removeTrustedCert(certPath string) error { |
||||
return exec.Command( // nolint[gosec]
|
||||
"/usr/bin/security", |
||||
"execute-with-privileges", |
||||
"/usr/bin/security", |
||||
"remove-trusted-cert", |
||||
"-d", |
||||
certPath, |
||||
).Run() |
||||
} |
||||
|
||||
func (t *TLS) InstallCerts() error { |
||||
return addTrustedCert(t.getTLSCertPath()) |
||||
} |
||||
|
||||
func (t *TLS) UninstallCerts() error { |
||||
return removeTrustedCert(t.getTLSCertPath()) |
||||
} |
||||
@ -1,26 +0,0 @@ |
||||
// Copyright (c) 2022 Proton Technologies AG
|
||||
//
|
||||
// This file is part of ProtonMail Bridge.
|
||||
//
|
||||
// ProtonMail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// ProtonMail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with ProtonMail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
package tls |
||||
|
||||
func (t *TLS) InstallCerts() error { |
||||
return nil // Linux doesn't have a root cert store.
|
||||
} |
||||
|
||||
func (t *TLS) UninstallCerts() error { |
||||
return nil // Linux doesn't have a root cert store.
|
||||
} |
||||
@ -1,26 +0,0 @@ |
||||
// Copyright (c) 2022 Proton Technologies AG
|
||||
//
|
||||
// This file is part of ProtonMail Bridge.
|
||||
//
|
||||
// ProtonMail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// ProtonMail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with ProtonMail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
package tls |
||||
|
||||
func (t *TLS) InstallCerts() error { |
||||
return nil // NOTE(GODT-986): Install certs to root cert store?
|
||||
} |
||||
|
||||
func (t *TLS) UninstallCerts() error { |
||||
return nil // NOTE(GODT-986): Uninstall certs from root cert store?
|
||||
} |
||||
@ -1,155 +0,0 @@ |
||||
// Copyright (c) 2022 Proton Technologies AG
|
||||
//
|
||||
// This file is part of ProtonMail Bridge.
|
||||
//
|
||||
// ProtonMail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// ProtonMail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with ProtonMail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
package tls |
||||
|
||||
import ( |
||||
"crypto/rand" |
||||
"crypto/rsa" |
||||
"crypto/tls" |
||||
"crypto/x509" |
||||
"crypto/x509/pkix" |
||||
"encoding/pem" |
||||
"fmt" |
||||
"math/big" |
||||
"net" |
||||
"os" |
||||
"path/filepath" |
||||
"time" |
||||
|
||||
"github.com/pkg/errors" |
||||
) |
||||
|
||||
type TLS struct { |
||||
settingsPath string |
||||
} |
||||
|
||||
func New(settingsPath string) *TLS { |
||||
return &TLS{ |
||||
settingsPath: settingsPath, |
||||
} |
||||
} |
||||
|
||||
// NewTLSTemplate creates a new TLS template certificate with a random serial number.
|
||||
func NewTLSTemplate() (*x509.Certificate, error) { |
||||
serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128)) |
||||
if err != nil { |
||||
return nil, errors.Wrap(err, "failed to generate serial number") |
||||
} |
||||
|
||||
return &x509.Certificate{ |
||||
SerialNumber: serialNumber, |
||||
Subject: pkix.Name{ |
||||
Country: []string{"CH"}, |
||||
Organization: []string{"Proton Technologies AG"}, |
||||
OrganizationalUnit: []string{"ProtonMail"}, |
||||
CommonName: "127.0.0.1", |
||||
}, |
||||
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign, |
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}, |
||||
BasicConstraintsValid: true, |
||||
IsCA: true, |
||||
IPAddresses: []net.IP{net.ParseIP("127.0.0.1")}, |
||||
NotBefore: time.Now(), |
||||
NotAfter: time.Now().Add(20 * 365 * 24 * time.Hour), |
||||
}, nil |
||||
} |
||||
|
||||
var ErrTLSCertExpiresSoon = fmt.Errorf("TLS certificate will expire soon") |
||||
|
||||
// getTLSCertPath returns path to certificate; used for TLS servers (IMAP, SMTP).
|
||||
func (t *TLS) getTLSCertPath() string { |
||||
return filepath.Join(t.settingsPath, "cert.pem") |
||||
} |
||||
|
||||
// getTLSKeyPath returns path to private key; used for TLS servers (IMAP, SMTP).
|
||||
func (t *TLS) getTLSKeyPath() string { |
||||
return filepath.Join(t.settingsPath, "key.pem") |
||||
} |
||||
|
||||
// HasCerts returns whether TLS certs have been generated.
|
||||
func (t *TLS) HasCerts() bool { |
||||
if _, err := os.Stat(t.getTLSCertPath()); err != nil { |
||||
return false |
||||
} |
||||
|
||||
if _, err := os.Stat(t.getTLSKeyPath()); err != nil { |
||||
return false |
||||
} |
||||
|
||||
return true |
||||
} |
||||
|
||||
// GenerateCerts generates certs from the given template.
|
||||
func (t *TLS) GenerateCerts(template *x509.Certificate) error { |
||||
priv, err := rsa.GenerateKey(rand.Reader, 2048) |
||||
if err != nil { |
||||
return errors.Wrap(err, "failed to generate private key") |
||||
} |
||||
|
||||
derBytes, err := x509.CreateCertificate(rand.Reader, template, template, &priv.PublicKey, priv) |
||||
if err != nil { |
||||
return errors.Wrap(err, "failed to create certificate") |
||||
} |
||||
|
||||
certOut, err := os.Create(t.getTLSCertPath()) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
defer certOut.Close() // nolint[errcheck]
|
||||
|
||||
if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil { |
||||
return err |
||||
} |
||||
|
||||
keyOut, err := os.OpenFile(t.getTLSKeyPath(), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
defer keyOut.Close() // nolint[errcheck]
|
||||
|
||||
return pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}) |
||||
} |
||||
|
||||
// GetConfig tries to load TLS config or generate new one which is then returned.
|
||||
func (t *TLS) GetConfig() (*tls.Config, error) { |
||||
c, err := tls.LoadX509KeyPair(t.getTLSCertPath(), t.getTLSKeyPath()) |
||||
if err != nil { |
||||
return nil, errors.Wrap(err, "failed to load keypair") |
||||
} |
||||
|
||||
c.Leaf, err = x509.ParseCertificate(c.Certificate[0]) |
||||
if err != nil { |
||||
return nil, errors.Wrap(err, "failed to parse certificate") |
||||
} |
||||
|
||||
if time.Now().Add(31 * 24 * time.Hour).After(c.Leaf.NotAfter) { |
||||
return nil, ErrTLSCertExpiresSoon |
||||
} |
||||
|
||||
caCertPool := x509.NewCertPool() |
||||
caCertPool.AddCert(c.Leaf) |
||||
|
||||
// nolint[gosec]: We need to support older TLS versions for AppleMail and Outlook.
|
||||
return &tls.Config{ |
||||
Certificates: []tls.Certificate{c}, |
||||
ServerName: "127.0.0.1", |
||||
ClientAuth: tls.VerifyClientCertIfGiven, |
||||
RootCAs: caCertPool, |
||||
ClientCAs: caCertPool, |
||||
}, nil |
||||
} |
||||
@ -1,77 +0,0 @@ |
||||
// Copyright (c) 2022 Proton Technologies AG
|
||||
//
|
||||
// This file is part of ProtonMail Bridge.
|
||||
//
|
||||
// ProtonMail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// ProtonMail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with ProtonMail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
package tls |
||||
|
||||
import ( |
||||
"io/ioutil" |
||||
"testing" |
||||
"time" |
||||
|
||||
"github.com/stretchr/testify/require" |
||||
) |
||||
|
||||
func TestGetOldConfig(t *testing.T) { |
||||
dir, err := ioutil.TempDir("", "test-tls") |
||||
require.NoError(t, err) |
||||
|
||||
// Create new tls object.
|
||||
tls := New(dir) |
||||
|
||||
// Create new TLS template.
|
||||
tlsTemplate, err := NewTLSTemplate() |
||||
require.NoError(t, err) |
||||
|
||||
// Make the template be an old key.
|
||||
tlsTemplate.NotBefore = time.Now().Add(-365 * 24 * time.Hour) |
||||
tlsTemplate.NotAfter = time.Now() |
||||
|
||||
// Generate the certs from the template.
|
||||
require.NoError(t, tls.GenerateCerts(tlsTemplate)) |
||||
|
||||
// Generate the config from the certs -- it's going to expire soon so we don't want to use it.
|
||||
_, err = tls.GetConfig() |
||||
require.Equal(t, err, ErrTLSCertExpiresSoon) |
||||
} |
||||
|
||||
func TestGetValidConfig(t *testing.T) { |
||||
dir, err := ioutil.TempDir("", "test-tls") |
||||
require.NoError(t, err) |
||||
|
||||
// Create new tls object.
|
||||
tls := New(dir) |
||||
|
||||
// Create new TLS template.
|
||||
tlsTemplate, err := NewTLSTemplate() |
||||
require.NoError(t, err) |
||||
|
||||
// Make the template be a new key.
|
||||
tlsTemplate.NotBefore = time.Now() |
||||
tlsTemplate.NotAfter = time.Now().Add(2 * 365 * 24 * time.Hour) |
||||
|
||||
// Generate the certs from the template.
|
||||
require.NoError(t, tls.GenerateCerts(tlsTemplate)) |
||||
|
||||
// Generate the config from the certs -- it's not going to expire soon so we want to use it.
|
||||
config, err := tls.GetConfig() |
||||
require.NoError(t, err) |
||||
require.Equal(t, len(config.Certificates), 1) |
||||
|
||||
// Check the cert is valid.
|
||||
now, notValidAfter := time.Now(), config.Certificates[0].Leaf.NotAfter |
||||
require.False(t, now.After(notValidAfter), "new certificate expected to be valid at %v but have valid until %v", now, notValidAfter) |
||||
} |
||||
Loading…
Reference in new issue