Permalink
Switch branches/tags
Nothing to show
Find file
Fetching contributors…
Cannot retrieve contributors at this time
479 lines (385 sloc) 12.2 KB
require 'rubygems'
require 'fileutils'
require 'yaml'
require 'erb'
require 'socket'
class String
def path(p)
File.join(File.dirname(__FILE__), p)
end
end
class HashBinding < Object
def self.from_hash(h)
hb = self.new
h.each do |k, v|
hb.instance_variable_set("@#{k}", v)
end
hb
end
def binding; super; end # normally private
end
module VPNMaker
class ConfigGenerator
def initialize(mgr)
@mgr = mgr
end
def client_conf(client)
{
:gen_host => Socket.gethostname,
:server => @mgr.config[:server],
:client => @mgr.config[:client]
}.merge(client)
end
def server_conf
{
:gen_host => Socket.gethostname
}.merge(@mgr.config[:server])
end
def apply_erb(name, cnf)
erb = File.read(__FILE__.path(name))
ERB.new(erb).result(HashBinding.from_hash(cnf).binding)
end
def server; apply_erb('server.erb', server_conf); end
def client(client)
apply_erb('client.erb', client_conf(client));
end
end
class KeyDB
def initialize(path)
@path = path
@db = File.exists?(path) ? YAML.load_file(path) : {}
@touched = false
end
def [](k); @db[k]; end
def []=(k, v)
@db[k] = v
@db[:modified] = Time.now
@touched = true
end
def touched!
@touched = true
@db[:modified] = Time.now
end
def datadir; self[:datadir]; end
def data_path(k)
File.join(File.dirname(@path), self.datadir, k)
end
def dump(k, v, overwrite=false)
p = data_path(k)
raise "#{k} already exists" if File.exists?(p) && !overwrite
File.open(p, 'w') {|f| f.write(v)}
@touched = true
end
def data(k)
File.exists?(data_path(k)) ? File.read(data_path(k)) : nil
end
def disk_version
File.exists?(@path) ? YAML.load_file(@path)[:version] : 0
end
def sync
if disk_version == @db[:version]
if @touched
FileUtils.mkdir_p(self.datadir)
@db[:version] += 1
File.open(@path, 'w') {|f| f.write(@db.to_yaml)}
true
else
false
end
else
raise "Disk version of #{@path} (#{disk_version}) != loaded version (#{@db[:version]}). " + \
"Try reloading and making your changes again."
end
end
def version; @db[:version]; end
end
class KeyConfig
def initialize(path)
@config = YAML.load_file(path)
end
def [](k); @config[k]; end
end
class KeyTracker
attr_reader :builder
attr_reader :db
attr_reader :config
def self.generate(name, path=nil)
path ||= '/tmp'
dir = File.join(File.expand_path(path), name + '.vpn')
FileUtils.mkdir_p(dir)
datadir = "#{name}_data"
dbpath = File.join(dir, "#{name}.db.yaml")
d = KeyDB.new(dbpath)
d[:version] = 0
d[:modified] = Time.now
d[:users] = {}
d[:datadir] = datadir
d.sync
end
def assert_user(user)
raise "User doesn't exist: #{user}" unless @db[:users][user]
end
def ca; @db[:ca]; end
def set_ca(key, crt, crl, index, serial)
raise "CA already set" if @db[:ca]
@db[:ca] = {:modified => Time.now}
@db.dump('ca.key', key)
@db.dump('ca.crt', crt)
@db.dump('crl.pem', crl)
@db.dump('index.txt', index)
@db.dump('serial', serial)
@db.touched!
@db.sync
end
def set_server_key(key, crt, index, serial)
raise "Server key already set" if @db[:server]
@db[:server] = {:modified => Time.now}
@db.dump('server.key', key)
@db.dump('server.crt', crt)
@db.dump('index.txt', index, true)
@db.dump('serial', serial, true)
@db.touched!
@db.sync
end
def set_ta_key(ta)
raise "TA key already set" if @db[:ta]
@db[:ta] = {:modified => Time.now}
@db.dump('ta.key', ta)
@db.touched!
@db.sync
end
def set_dh(dh)
raise "DH key already set" if @db[:dh]
@db[:dh] = {:modified => Time.now}
@db.dump('dh.pem', dh)
@db.touched!
@db.sync
end
def add_key(user, key, crt, p12, ver)
@db.dump("#{user}-#{ver}.key", key)
@db.dump("#{user}-#{ver}.crt", crt)
@db.dump("#{user}-#{ver}.p12", p12)
end
def key(user, ver, type)
@db.data("#{user}-#{ver}.#{type}")
end
def add_user(user, name, email, key, crt, p12, index, serial)
raise "User must be a non-empty string" unless user.is_a?(String) && user.size > 0
raise "User already exists: #{user}" if @db[:users][user]
@db[:users][user] = {
:user => user,
:name => name,
:email => email,
:active_key => 0,
:revoked => [],
:modified => Time.now
}
@db.dump('serial', serial, true)
@db.dump('index.txt', index, true)
add_key(user, key, crt, p12, 0)
@db.touched!
@db.sync
end
def add_user_key(user, name, email, key, crt, p12, index, serial)
assert_user(user)
u = @db[:users][user]
u[:modified] = Time.now
u[:active_key] += 1
add_key(user, key, crt, p12, u[:active_key])
@db.dump('serial', serial, true)
@db.dump('index.txt', index, true)
@db.touched!
@db.sync
end
def user_key_revoked(user, version, crl, index)
assert_user(user)
raise "Verison must be an int" unless version.kind_of?(Integer)
u = @db[:users][user]
u[:revoked] << version
u[:modified] = Time.now
@db.dump('index.txt', index, true)
@db.dump('crl.pem', crl, true)
@db.touched!
@db.sync
end
def revoked?(user, version)
assert_user(user)
@db[:users][user][:revoked].include?(version)
end
def active_key_version(user)
assert_user(user)
@db[:users][user][:active_key]
end
def user(user)
assert_user(user)
@db[:users][user]
end
def users; @db[:users]; end
def initialize(name, dir)
@db = KeyDB.new(File.join(dir, name + '.db.yaml'))
@config = KeyConfig.new(File.join(dir, name + '.config.yaml'))
@builder = KeyBuilder.new(self, @config)
end
end
def self.generate(name, path)
KeyTracker.generate(name, path)
end
class Manager
attr_reader :tracker
def self.vpn_name(dir); dir =~ /(^|\/)([^\/\.]+)\.vpn/ ? $2 : nil; end
def initialize(dir)
name = self.class.vpn_name(File.expand_path(dir))
@tracker = KeyTracker.new(name, File.expand_path(dir))
end
def config; @tracker.config; end
def build_ca; @tracker.builder.build_ca; end
def build_server
@tracker.builder.build_server_key
@tracker.builder.build_ta_key
@tracker.builder.build_dh_key
end
def create_user(user, name, email, pass=nil)
@tracker.builder.build_key(user, name, email, pass, :add_user)
end
def revoke_all(user)
cur = @tracker.active_key_version(user)
while cur >= 0
unless @tracker.revoked?(user, cur)
@tracker.builder.revoke_key(user, cur)
end
cur -= 1
end
end
def regenerate_user(user, pass=nil)
revoke_all(user)
u = @tracker.user(user)
@tracker.builder.build_key(user, u[:name], u[:email], pass, :add_user_key)
end
def delete_user(user)
revoke_all(user)
end
def users
@tracker.users.keys
end
def user(user)
@tracker.user(user)
end
def config_generator; ConfigGenerator.new(self); end
end
class KeyBuilder
def initialize(tracker, config)
@tmpdir = '/tmp/keybuilder'
clean_tmpdir
@tracker = tracker
@config = config
end
def clean_tmpdir
FileUtils.rm_rf(@tmpdir)
FileUtils.mkdir_p(@tmpdir)
end
def cnfpath; "/tmp/openssl-#{$$}.cnf"; end
def opensslvars
{
:key_size => 1024,
:key_dir => @tmpdir,
:key_country => @config[:key_properties][:country],
:key_province => @config[:key_properties][:province],
:key_city => @config[:key_properties][:city],
:key_org => @config[:key_properties][:organization],
:key_email => @config[:key_properties][:email],
:key_org => @config[:key_properties][:organization],
:key_ou => 'Organization Unit',
:key_cn => 'Common Name',
:key_name => 'Name'
}
end
def init
`touch #{@dir}/index.txt`
`echo 01 > #{@dir}/serial`
end
def opensslcnf(hash={})
c = cnfpath
File.open(cnfpath, 'w') do |f|
f.write(ERB.new(File.read(__FILE__.path('openssl.erb'))).\
result(HashBinding.from_hash(opensslvars.merge(hash)).binding))
end
c
end
# Build Diffie-Hellman parameters for the server side of an SSL/TLS connection.
def build_dh_key(keysize=1024)
`openssl dhparam -out #{tmppath('dh.pem')} #{keysize}`
@tracker.set_dh(tmpfile('dh.pem'))
end
def ca
@tracker[:ca]
end
def gen_crl
`openssl ca -gencrl -crldays 3650 -keyfile #{tmppath('ca.key')} -cert #{tmppath('ca.crt')} -out #{tmppath('crl.pem')} -config #{opensslcnf}`
end
def build_ca
index = tmppath('index.txt')
FileUtils.touch(index)
`openssl req -batch -days 3650 -nodes -new -x509 -keyout #{@tmpdir}/ca.key -out #{@tmpdir}/ca.crt -config #{opensslcnf}`
gen_crl
@tracker.set_ca(tmpfile('ca.key'), tmpfile('ca.crt'), tmpfile('crl.pem'), tmpfile('index.txt'), "01\n")
end
def build_server_key
place_file('ca.crt')
place_file('ca.key')
place_file('index.txt')
place_file('serial')
`openssl req -batch -days 3650 -nodes -new -keyout #{tmppath('server.key')} -out #{tmppath('server.csr')} -extensions server -config #{opensslcnf}`
`openssl ca -batch -days 3650 -out #{tmppath('server.crt')} -in #{tmppath('server.csr')} -extensions server -config #{opensslcnf}`
@tracker.set_server_key(tmpfile('server.key'), tmpfile('server.crt'), tmpfile('index.txt'), tmpfile('serial'))
end
def build_ta_key
`openvpn --genkey --secret #{tmppath('ta.key')}`
@tracker.set_ta_key(tmpfile('ta.key'))
end
def place_file(name)
if data = @tracker.db.data(name)
File.open(File.join(@tmpdir, name), 'w') {|f| f.write(data)}
else
raise "No data for #{name}"
end
end
def tmppath(f, extn=nil); File.join(@tmpdir, extn ? "#{f}.#{extn}" : f); end
def tmpfile(*args); File.read(tmppath(*args)); end
def build_key(user, name, email, pass, delegate)
h = {:key_cn => user, :key_name => name, :key_email => email}
place_file('ca.crt')
place_file('ca.key')
place_file('index.txt')
place_file('serial')
if pass
pass_spec = "-passin 'pass:#{pass}' -passout 'pass:#{pass}'"
else
pass_spec = '-nodes'
end
`openssl req -batch -days 3650 -new -keyout #{tmppath(user, 'key')} -out #{tmppath(user, 'csr')} -config #{opensslcnf(h)} #{pass_spec}`
`openssl ca -batch -days 3650 -out #{tmppath(user, 'crt')} -in #{tmppath(user, 'csr')} -config #{opensslcnf(h)}`
# TODO: this still asks for the export password
`openssl pkcs12 -export -clcerts -in #{tmppath(user, 'crt')} -inkey #{tmppath(user, 'key')} -out #{tmppath(user, 'p12')} #{pass_spec}`
@tracker.send(delegate, user, name, email, tmpfile(user, 'key'), tmpfile(user, 'crt'), tmpfile(user, 'p12'), tmpfile('index.txt'), tmpfile('serial'))
end
def revoke_key(user, version)
h = {:key_cn => ""}
place_file('ca.crt')
place_file('ca.key')
place_file('crl.pem')
place_file('index.txt')
place_file('serial')
user_crt = tmppath(user, 'crt')
rev_crt = tmppath('rev-test.crt')
File.open(user_crt, 'w') {|f| f.write(@tracker.key(user, version, 'crt'))}
`openssl ca -revoke #{user_crt} -keyfile #{tmppath('ca.key')} -cert #{tmppath('ca.crt')} -config #{opensslcnf(h)}`
gen_crl
File.open(rev_crt, 'w') {|f| f.write(File.read(tmppath('ca.crt'))); f.write(File.read(tmppath('crl.pem')))}
if `openssl verify -CAfile #{rev_crt} -crl_check #{user_crt}` =~ /certificate revoked/
@tracker.user_key_revoked(user, version, tmpfile('crl.pem'), tmpfile('index.txt'))
else
raise "Revocation verification failed: openssl isn't recognizing it"
end
end
end
end