327 lines
8.2 KiB
Python
327 lines
8.2 KiB
Python
"""
|
|
Python interface to EasyRSA CA.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import functools
|
|
import subprocess
|
|
from enum import Enum, auto
|
|
from pathlib import Path
|
|
|
|
from cryptography import x509
|
|
from passlib import pwd
|
|
from pydantic import BaseModel
|
|
|
|
from .config import Config, KeyAlgorithm, Settings
|
|
from .db import Connection, Device
|
|
|
|
|
|
class DistinguishedName(BaseModel):
|
|
"""
|
|
An `X.509 distinguished name` (DN) as specified in RFC 5280
|
|
"""
|
|
|
|
country: str
|
|
state: str
|
|
city: str
|
|
organization: str
|
|
organizational_unit: str
|
|
email: str
|
|
common_name: str
|
|
|
|
@classmethod
|
|
def build(cls, device: Device | None = None) -> DistinguishedName:
|
|
"""
|
|
Create a DN from the current config and an optional device
|
|
"""
|
|
|
|
# extract server DN config
|
|
server_dn = Config._.server_dn
|
|
result = cls(
|
|
country=server_dn.country.value,
|
|
state=server_dn.state.value,
|
|
city=server_dn.city.value,
|
|
organization=server_dn.organization.value,
|
|
organizational_unit=server_dn.organizational_unit.value,
|
|
email=server_dn.email.value,
|
|
common_name=server_dn.common_name,
|
|
)
|
|
|
|
# no device specified -> done
|
|
if device is None:
|
|
return result
|
|
|
|
# don't override locked or empty fields
|
|
if not (server_dn.country.locked
|
|
or device.owner.country is None):
|
|
result.country = device.owner.country
|
|
|
|
if not (server_dn.state.locked
|
|
or device.owner.state is None):
|
|
result.state = device.owner.state
|
|
|
|
if not (server_dn.city.locked
|
|
or device.owner.city is None):
|
|
result.city = device.owner.city
|
|
|
|
if not (server_dn.organization.locked
|
|
or device.owner.organization is None):
|
|
result.organization = device.owner.organization
|
|
|
|
if not (server_dn.organizational_unit.locked
|
|
or device.owner.organizational_unit is None):
|
|
result.organizational_unit = device.owner.organizational_unit
|
|
|
|
# definitely use derived email and common_name
|
|
result.email = device.owner.email
|
|
result.common_name = f"{device.owner.name}_{device.name}"
|
|
|
|
return result
|
|
|
|
@property
|
|
def easyrsa_env(self) -> dict[str, str]:
|
|
"""
|
|
Pass this DN as arguments to easyrsa
|
|
"""
|
|
|
|
return {
|
|
"EASYRSA_DN": "org",
|
|
|
|
"EASYRSA_REQ_COUNTRY": self.country,
|
|
"EASYRSA_REQ_PROVINCE": self.state,
|
|
"EASYRSA_REQ_CITY": self.city,
|
|
"EASYRSA_REQ_ORG": self.organization,
|
|
"EASYRSA_REQ_OU": self.organizational_unit,
|
|
"EASYRSA_REQ_EMAIL": self.email,
|
|
"EASYRSA_REQ_CN": self.common_name,
|
|
}
|
|
|
|
|
|
class CertificateType(Enum):
|
|
"""
|
|
Possible types of certificates
|
|
"""
|
|
|
|
ca = auto()
|
|
client = auto()
|
|
server = auto()
|
|
|
|
def __str__(self) -> str:
|
|
return self._name_
|
|
|
|
|
|
class EasyRSA:
|
|
"""
|
|
Represents an EasyRSA PKI.
|
|
"""
|
|
|
|
__mapKeyAlgorithm = {
|
|
KeyAlgorithm.rsa2048: {
|
|
"EASYRSA_ALGO": "rsa",
|
|
"EASYRSA_KEY_SIZE": "2048",
|
|
},
|
|
KeyAlgorithm.rsa4096: {
|
|
"EASYRSA_ALGO": "rsa",
|
|
"EASYRSA_KEY_SIZE": "4096",
|
|
},
|
|
KeyAlgorithm.secp256r1: {
|
|
"EASYRSA_ALGO": "ec",
|
|
"EASYRSA_CURVE": "secp256r1",
|
|
},
|
|
KeyAlgorithm.secp384r1: {
|
|
"EASYRSA_ALGO": "ec",
|
|
"EASYRSA_CURVE": "secp384r1",
|
|
},
|
|
KeyAlgorithm.ed25519: {
|
|
"EASYRSA_ALGO": "ed",
|
|
"EASYRSA_CURVE": "ed25519",
|
|
},
|
|
None: {},
|
|
}
|
|
|
|
@classmethod
|
|
@functools.lru_cache
|
|
def _load(cls) -> EasyRSA:
|
|
return cls()
|
|
|
|
@classmethod
|
|
@property
|
|
def _(cls) -> EasyRSA:
|
|
"""
|
|
Get the singleton
|
|
"""
|
|
|
|
return cls._load()
|
|
|
|
@property
|
|
def output_directory(self) -> Path:
|
|
"""
|
|
Where certificates are stored
|
|
"""
|
|
|
|
return Settings._.data_dir.joinpath("pki")
|
|
|
|
@property
|
|
def ca_password(self) -> str:
|
|
"""
|
|
Get CA password from config, or generate a new one
|
|
"""
|
|
|
|
config = Config._
|
|
|
|
if (ca_password := config.crypto.ca_password) is None:
|
|
# generate and save new CA password
|
|
ca_password = pwd.genword(
|
|
length=32,
|
|
charset="ascii_62",
|
|
)
|
|
|
|
config.crypto.ca_password = ca_password
|
|
config.save()
|
|
|
|
return ca_password
|
|
|
|
def __easyrsa(
|
|
self,
|
|
*easyrsa_cmd: str,
|
|
**easyrsa_env: str,
|
|
) -> subprocess.CompletedProcess:
|
|
"""
|
|
Call the `easyrsa` executable
|
|
"""
|
|
|
|
return subprocess.run(
|
|
[
|
|
"/usr/local/bin/easyrsa",
|
|
*easyrsa_cmd,
|
|
],
|
|
env={
|
|
"EASYRSA_BATCH": "1",
|
|
"EASYRSA_PKI": str(self.output_directory),
|
|
**easyrsa_env,
|
|
},
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
|
|
check=True,
|
|
)
|
|
|
|
def __build_cert(
|
|
self,
|
|
cert_filename: Path,
|
|
*easyrsa_cmd: str,
|
|
**easyrsa_env: str,
|
|
) -> x509.Certificate:
|
|
"""
|
|
Create an X.509 certificate
|
|
"""
|
|
|
|
config = Config._
|
|
|
|
if ((algorithm := config.crypto.key_algorithm)
|
|
not in EasyRSA.__mapKeyAlgorithm):
|
|
raise ValueError(f"Unexpected algorithm: {algorithm}")
|
|
|
|
# include expiry options
|
|
if (ca_expiry_days := config.crypto.ca_expiry_days) is not None:
|
|
easyrsa_env["EASYRSA_CA_EXPIRE"] = str(ca_expiry_days)
|
|
|
|
if (cert_expiry_days := config.crypto.cert_expiry_days) is not None:
|
|
easyrsa_env["EASYRSA_CERT_EXPIRE"] = str(cert_expiry_days)
|
|
|
|
# call easyrsa
|
|
self.__easyrsa(
|
|
*easyrsa_cmd,
|
|
|
|
# include CA password
|
|
EASYRSA_PASSOUT=f"pass:{self.ca_password}",
|
|
EASYRSA_PASSIN=f"pass:{self.ca_password}",
|
|
|
|
# include algorithm options
|
|
**EasyRSA.__mapKeyAlgorithm[algorithm],
|
|
**easyrsa_env,
|
|
)
|
|
|
|
# parse the new certificate
|
|
with open(
|
|
self.output_directory.joinpath(cert_filename), "rb"
|
|
) as cert_file:
|
|
return x509.load_pem_x509_certificate(
|
|
cert_file.read()
|
|
)
|
|
|
|
def init_pki(self) -> None:
|
|
"""
|
|
Clean working directory
|
|
"""
|
|
|
|
self.__easyrsa("init-pki")
|
|
|
|
def build_ca(self) -> x509.Certificate:
|
|
"""
|
|
Build the CA certificate
|
|
"""
|
|
|
|
cert = self.__build_cert(
|
|
Path("ca.crt"),
|
|
"build-ca",
|
|
|
|
EASYRSA_DN="cn_only",
|
|
EASYRSA_REQ_CN="kiwi-vpn-ca",
|
|
)
|
|
|
|
# # this takes long!
|
|
# self.__easyrsa("gen-dh")
|
|
return cert
|
|
|
|
def issue(
|
|
self,
|
|
cert_type: CertificateType = CertificateType.client,
|
|
dn: DistinguishedName | None = None,
|
|
) -> x509.Certificate | None:
|
|
"""
|
|
Issue a client or server certificate
|
|
"""
|
|
|
|
if dn is None:
|
|
dn = DistinguishedName.build()
|
|
|
|
if not (cert_type is CertificateType.client
|
|
or cert_type is CertificateType.server):
|
|
return None
|
|
|
|
return self.__build_cert(
|
|
Path("issued").joinpath(f"{dn.common_name}.crt"),
|
|
|
|
f"build-{cert_type}-full",
|
|
dn.common_name,
|
|
"nopass",
|
|
|
|
**dn.easyrsa_env,
|
|
)
|
|
|
|
|
|
# some basic test
|
|
|
|
if __name__ == "__main__":
|
|
easy_rsa = EasyRSA()
|
|
easy_rsa.init_pki()
|
|
|
|
ca = easy_rsa.build_ca()
|
|
server = easy_rsa.issue(CertificateType.server)
|
|
client = None
|
|
|
|
# check if configured
|
|
if (current_config := Config.load()) is not None:
|
|
# connect to database
|
|
Connection.connect(current_config.db.uri)
|
|
|
|
if (device := Device.get(1)) is not None:
|
|
client = easy_rsa.issue(
|
|
dn=DistinguishedName.build(device)
|
|
)
|
|
|
|
for cert in (ca, server, client):
|
|
if cert is not None:
|
|
print(cert.subject)
|
|
print(cert.signature_hash_algorithm)
|
|
print(cert.not_valid_after)
|