v0.25.1

src/tls/certificates.rs

@@ -0,0 +1,417 @@
+/// Build the fixed administration TLS configuration. A named inventory
+/// certificate may be selected; otherwise the app-managed default pair is used.
+pub fn compile_admin(
+    settings: &Settings,
+    administration: &crate::settings::Administration,
+    directory: Option<&Path>,
+) -> Result<Option<Arc<ServerConfig>>> {
+    if !administration.tls {
+        return Ok(None);
+    }
+    let directory = directory.context("administration TLS requires a certificate directory")?;
+    settings.policy.validate()?;
+    let key = if let Some(id) = administration.certificate_id.as_deref() {
+        let certificate = settings
+            .certificates
+            .iter()
+            .find(|certificate| certificate.id == id)
+            .context("administration certificate id is unknown")?;
+        Arc::new(load_pair(
+            directory,
+            &certificate.cert_file,
+            &certificate.key_file,
+        )?)
+    } else {
+        Arc::new(load_pair(directory, "default.pem", "default.key")?)
+    };
+    #[derive(Debug)]
+    struct Fixed(Arc<CertifiedKey>);
+    impl ResolvesServerCert for Fixed {
+        fn resolve(&self, _: ClientHello<'_>) -> Option<Arc<CertifiedKey>> {
+            Some(self.0.clone())
+        }
+    }
+    Ok(Some(server_config(
+        Arc::new(Fixed(key)),
+        &settings.policy,
+        true,
+    )?))
+}
+fn write_new(path: &Path, bytes: &[u8]) -> Result<()> {
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600).custom_flags(libc::O_NOFOLLOW);
+    }
+    let mut file = options.open(path)?;
+    file.write_all(bytes)?;
+    file.sync_all()?;
+    Ok(())
+}
+fn store_pair(directory: &Path, name: &str, cert: &[u8], key: &[u8]) -> Result<()> {
+    safe_name(name)?;
+    let cert_path = directory.join(format!("{name}.pem"));
+    let key_path = directory.join(format!("{name}.key"));
+    ensure!(
+        !cert_path.try_exists()? && !key_path.try_exists()?,
+        "certificate files already exist; use a new name for safe rotation"
+    );
+    parse_pair(cert, key)?;
+    write_new(&key_path, key)?;
+    if let Err(error) = write_new(&cert_path, cert) {
+        let _ = fs::remove_file(&key_path);
+        return Err(error);
+    }
+    #[cfg(unix)]
+    std::fs::File::open(directory)?.sync_all()?;
+    Ok(())
+}
+fn generate_locked(directory: &Path, name: &str, hosts: Vec<String>) -> Result<()> {
+    ensure!(!hosts.is_empty(), "provide at least one certificate SAN");
+    let hosts = hosts
+        .into_iter()
+        .map(|host| {
+            if host.parse::<std::net::IpAddr>().is_ok() {
+                Ok(host)
+            } else {
+                normalize_host_pattern(&host)
+            }
+        })
+        .collect::<Result<Vec<_>>>()?;
+    let rcgen::CertifiedKey { cert, key_pair } = rcgen::generate_simple_self_signed(hosts)?;
+    let key = Zeroizing::new(key_pair.serialize_pem());
+    store_pair(directory, name, cert.pem().as_bytes(), key.as_bytes())
+}
+pub fn initialize_default(directory: &Path) -> Result<()> {
+    crate::auth::prepare_directory(directory)?;
+    let _lock = crate::auth::lock_directory(directory)?;
+    let cert = directory.join("default.pem").try_exists()?;
+    let key = directory.join("default.key").try_exists()?;
+    ensure!(
+        cert == key,
+        "incomplete default certificate pair; restore both default.pem and default.key"
+    );
+    if !cert {
+        generate_locked(
+            directory,
+            "default",
+            vec![
+                "localhost".into(),
+                "demo.localhost".into(),
+                "127.0.0.1".into(),
+                "::1".into(),
+            ],
+        )?;
+    }
+    load_pair(directory, "default.pem", "default.key")?;
+    Ok(())
+}
+pub fn generate(directory: &Path, name: &str, hosts: Vec<String>) -> Result<()> {
+    ensure!(
+        name != "default",
+        "the default certificate is managed at startup; use another name"
+    );
+    crate::auth::prepare_directory(directory)?;
+    let _lock = crate::auth::lock_directory(directory)?;
+    generate_locked(directory, name, hosts)
+}
+pub fn import(directory: &Path, name: &str, cert: PathBuf, key: PathBuf) -> Result<()> {
+    ensure!(
+        name != "default",
+        "use a named certificate and configure default_certificate instead"
+    );
+    crate::auth::prepare_directory(directory)?;
+    let _lock = crate::auth::lock_directory(directory)?;
+    store_pair(
+        directory,
+        name,
+        &read_pem(&cert, false)?,
+        &read_pem(&key, true)?,
+    )
+}
+
+/// Result of reconciling an externally supplied certificate/key pair with the
+/// immutable generation currently selected by a manual certificate id.
+#[derive(Debug, PartialEq, Eq)]
+pub enum ExternalPairDeployment {
+    /// The configured RustProxy-owned generation already contains the exact
+    /// certificate chain and private key supplied by the external issuer.
+    Unchanged { covered_hosts: Vec<String> },
+    /// A new immutable generation was written and must be published through the
+    /// revisioned configuration path before the old generation can be removed.
+    Staged {
+        cert_file: String,
+        key_file: String,
+        covered_hosts: Vec<String>,
+    },
+}
+
+fn external_generation_pair(certificate_id: &str, cert_file: &str, key_file: &str) -> bool {
+    let prefix = format!("external-{certificate_id}-");
+    let Some(cert_stem) = cert_file.strip_suffix(".pem") else {
+        return false;
+    };
+    let Some(key_stem) = key_file.strip_suffix(".key") else {
+        return false;
+    };
+    cert_stem == key_stem && cert_stem.starts_with(&prefix)
+}
+
+/// Validate an externally supplied pair and reconcile it with the currently
+/// selected RustProxy-owned immutable generation. Repeating the same deploy is
+/// therefore a no-op, while a missing/different pair stages a fresh generation.
+///
+/// `current_pair` is advisory: unreadable/missing current files are treated as
+/// drift and repaired by staging a new generation instead of failing the deploy.
+pub fn reconcile_external_pair(
+    directory: &Path,
+    certificate_id: &str,
+    current_pair: Option<(&str, &str)>,
+    certificate: &[u8],
+    key: &[u8],
+) -> Result<ExternalPairDeployment> {
+    ensure!(
+        crate::config::valid_id(certificate_id),
+        "invalid certificate id"
+    );
+    ensure!(
+        certificate.len() <= MAX_PEM as usize && key.len() <= MAX_PEM as usize,
+        "each PEM input is limited to 128 KiB"
+    );
+    parse_pair(certificate, key)?;
+    let covered_hosts = certificate_dns_names(certificate)?;
+    crate::auth::prepare_directory(directory)?;
+    let _lock = crate::auth::lock_directory(directory)?;
+
+    if let Some((cert_file, key_file)) = current_pair {
+        if external_generation_pair(certificate_id, cert_file, key_file) {
+            let current_certificate = read_pem(&directory.join(cert_file), false);
+            let current_key = read_pem(&directory.join(key_file), true);
+            if let (Ok(current_certificate), Ok(current_key)) = (current_certificate, current_key) {
+                if current_certificate.as_slice() == certificate && current_key.as_slice() == key {
+                    return Ok(ExternalPairDeployment::Unchanged { covered_hosts });
+                }
+            }
+        }
+    }
+
+    let name = format!(
+        "external-{}-{:032x}",
+        certificate_id,
+        rand::random::<u128>()
+    );
+    store_pair(directory, &name, certificate, key)?;
+    Ok(ExternalPairDeployment::Staged {
+        cert_file: format!("{name}.pem"),
+        key_file: format!("{name}.key"),
+        covered_hosts,
+    })
+}
+
+/// Stage a locally supplied certificate/key pair under generation-specific
+/// filenames. This compatibility wrapper always stages a new generation.
+pub fn stage_external_pair(
+    directory: &Path,
+    certificate_id: &str,
+    certificate: &[u8],
+    key: &[u8],
+) -> Result<(String, String, Vec<String>)> {
+    match reconcile_external_pair(directory, certificate_id, None, certificate, key)? {
+        ExternalPairDeployment::Staged {
+            cert_file,
+            key_file,
+            covered_hosts,
+        } => Ok((cert_file, key_file, covered_hosts)),
+        ExternalPairDeployment::Unchanged { .. } => {
+            unreachable!("reconcile without a current pair always stages")
+        }
+    }
+}
+
+/// Best-effort rollback for a generation created by `stage_external_pair`.
+/// Only generation-specific external files may be removed through this helper.
+pub fn remove_external_pair(directory: &Path, cert_file: &str, key_file: &str) -> Result<()> {
+    safe_name(cert_file)?;
+    safe_name(key_file)?;
+    ensure!(
+        cert_file.starts_with("external-")
+            && cert_file.ends_with(".pem")
+            && key_file.starts_with("external-")
+            && key_file.ends_with(".key"),
+        "refusing to remove non-external certificate files"
+    );
+    for file in [cert_file, key_file] {
+        match fs::remove_file(directory.join(file)) {
+            Ok(()) => {}
+            Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+            Err(error) => return Err(error.into()),
+        }
+    }
+    #[cfg(unix)]
+    std::fs::File::open(directory)?.sync_all()?;
+    Ok(())
+}
+
+/// Select named inventory certificates per vhost/redirect host. A single global
+/// SNI resolver cannot give the same name different certificates by destination IP.
+pub fn for_all_frontends(
+    settings: &Settings,
+    vhosts: &[crate::vhost::Vhost],
+    redirects: &[crate::redirect::Host],
+    not_found_hosts: &[crate::not_found::Host],
+) -> Result<Settings> {
+    let mut result = settings.clone();
+    let certificate_ids: std::collections::HashSet<_> =
+        result.certificates.iter().map(|c| c.id.clone()).collect();
+    let mut assignments = std::collections::HashMap::<String, String>::new();
+    let mut assign = |hosts: &[String], id: &str, owner: &str| -> Result<()> {
+        ensure!(
+            certificate_ids.contains(id),
+            "{owner} references unknown certificate id"
+        );
+        for host in hosts {
+            if let Some(old) = assignments.insert(host.clone(), id.to_owned()) {
+                ensure!(
+                    old == id,
+                    "same hostname cannot select different TLS certificates"
+                );
+            }
+        }
+        Ok(())
+    };
+    for vhost in vhosts {
+        if let Some(id) = &vhost.certificate_id {
+            assign(&vhost.frontend.hosts, id, "vhost")?;
+        }
+    }
+    for redirect in redirects {
+        if let Some(id) = &redirect.certificate_id {
+            assign(&redirect.frontend.hosts, id, "redirect")?;
+        }
+    }
+    for host in not_found_hosts {
+        if let Some(id) = &host.certificate_id {
+            assign(&host.frontend.hosts, id, "404 host")?;
+        }
+    }
+    for cert in &mut result.certificates {
+        cert.hosts.retain(|host| {
+            !assignments.contains_key(&host.to_ascii_lowercase().trim_end_matches('.').to_string())
+        });
+        for (host, id) in &assignments {
+            if id == &cert.id {
+                cert.hosts.push(host.clone());
+            }
+        }
+        cert.hosts.sort();
+        cert.hosts.dedup();
+    }
+    Ok(result)
+}
+
+/// Compatibility helper for callers without dedicated local-response hosts.
+pub fn for_frontends(
+    settings: &Settings,
+    vhosts: &[crate::vhost::Vhost],
+    redirects: &[crate::redirect::Host],
+) -> Result<Settings> {
+    for_all_frontends(settings, vhosts, redirects, &[])
+}
+
+/// Compatibility helper used by focused TLS tests and callers that only have vhosts.
+pub fn for_vhosts(settings: &Settings, vhosts: &[crate::vhost::Vhost]) -> Result<Settings> {
+    for_frontends(settings, vhosts, &[])
+}
+/// Upload staging: files are private and immutable; configuration publication is
+/// a separate revisioned operation. Unbound files never alter active TLS state.
+pub fn upload(
+    directory: &Path,
+    certificate: &[u8],
+    key: &[u8],
+    hosts: Vec<String>,
+) -> Result<Certificate> {
+    ensure!(
+        certificate.len() <= MAX_PEM as usize && key.len() <= MAX_PEM as usize,
+        "each PEM input is limited to 128 KiB"
+    );
+    ensure!(!hosts.is_empty(), "provide at least one vhost name");
+    let certified = parse_pair(certificate, key)?;
+    let covered_hosts = certificate_dns_names(certificate)?;
+    let mut resolver = ResolvesServerCertUsingSni::new();
+    for host in &hosts {
+        let host = normalize_host_pattern(host)?;
+        let validation_name = host
+            .strip_prefix("*.")
+            .map(|base| format!("rustproxy-wildcard-check.{base}"))
+            .unwrap_or_else(|| host.clone());
+        resolver
+            .add(&validation_name, certified.clone())
+            .context("certificate does not cover vhost name")?;
+    }
+    crate::auth::prepare_directory(directory)?;
+    let _lock = crate::auth::lock_directory(directory)?;
+    // Bound abandoned staging files. Admins may remove unreferenced upload-* pairs
+    // locally; never delete potentially active files automatically.
+    let staged = fs::read_dir(directory)?
+        .filter_map(|e| e.ok())
+        .filter(|e| {
+            e.file_name().to_string_lossy().starts_with("upload-")
+                && e.path().extension().is_some_and(|x| x == "key")
+        })
+        .count();
+    ensure!(
+        staged < 128,
+        "upload storage limit reached; remove unused upload-* pairs locally"
+    );
+    let id = format!("upload-{:032x}", rand::random::<u128>());
+    store_pair(directory, &id, certificate, key)?;
+    Ok(Certificate {
+        issuer: None,
+        cert_file: format!("{id}.pem"),
+        key_file: format!("{id}.key"),
+        id,
+        covered_hosts,
+        hosts: Vec::new(),
+    })
+}
+/// Validate immutable ACME outputs before they may be published to the library.
+pub fn validate_acme(
+    directory: &Path,
+    id: String,
+    cert_file: String,
+    key_file: String,
+    domains: &[String],
+) -> Result<Certificate> {
+    ensure!(crate::config::valid_id(&id), "invalid ACME certificate id");
+    ensure!(
+        cert_file.starts_with("acme-") && key_file.starts_with("acme-"),
+        "invalid ACME output name"
+    );
+    ensure!(!domains.is_empty(), "ACME requires at least one domain");
+    let key = load_pair(directory, &cert_file, &key_file)?;
+    let certificate_pem = read_pem(&directory.join(&cert_file), false)?;
+    let covered_hosts = certificate_dns_names(&certificate_pem)?;
+    let mut resolver = ResolvesServerCertUsingSni::new();
+    for domain in domains {
+        let domain = normalize_host_pattern(domain)?;
+        // A concrete name checks a wildcard SAN without relying on wildcard
+        // behavior in rustls' stock validation resolver.
+        let name = domain
+            .strip_prefix("*.")
+            .map(|d| format!("rustproxy-acme-check.{d}"))
+            .unwrap_or_else(|| domain.clone());
+        resolver
+            .add(&normalize_host(&name)?, key.clone())
+            .context("ACME certificate does not cover requested domain")?;
+    }
+    Ok(Certificate {
+        issuer: None,
+        id,
+        covered_hosts,
+        hosts: Vec::new(),
+        cert_file,
+        key_file,
+    })
+}