X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;f=src%2Fapps%2Fclient.cpp;h=80422b3bc0e13046ee40dee913a5e7f3648b7aa3;hb=HEAD;hp=c3a011531306e35685af4a7fc62413cea0b3f958;hpb=6121035a7d8ea738bc89c2de8e6602fb1099b0e2;p=cassiopeia.git diff --git a/src/apps/client.cpp b/src/apps/client.cpp index c3a0115..80422b3 100644 --- a/src/apps/client.cpp +++ b/src/apps/client.cpp @@ -17,6 +17,8 @@ #include "io/slipBio.h" #include "config.h" #include +#include +#include #ifdef NO_DAEMON #define DAEMON false @@ -34,10 +36,7 @@ void checkCRLs( std::shared_ptr sign ) { logger::note( "Signing CRLs" ); for( auto& x : CAs ) { - logger::notef( "Checking: %s ...", x.first ); - if( !x.second->crlNeedsResign() ) { - logger::warnf( "Skipping Resigning CRL: %s ...", x.second->name ); continue; } @@ -46,13 +45,98 @@ void checkCRLs( std::shared_ptr sign ) { try { std::vector serials; std::pair, std::string> rev = sign->revoke( x.second, serials ); - } catch( const std::exception &e ) { + } catch( const std::exception& e ) { logger::error( "Exception: ", e.what() ); } } } -int main( int argc, const char* argv[] ) { +bool pathExists( const std::string& name ) { + struct stat buffer; + return stat( name.c_str(), &buffer ) == 0; +} + +void signOCSP( std::shared_ptr sign, std::string profileName, std::string req, std::string crtName, std::string failName ) { + auto cert = std::make_shared(); + cert->ocspCA = profileName; + cert->wishFrom = "now"; + cert->wishTo = "1y"; + cert->md = "sha512"; + + logger::note( "INFO: Message Digest: ", cert->md ); + + cert->csr_content = req; + cert->csr_type = "CSR"; + auto nAVA = std::make_shared(); + nAVA->name = "CN"; + nAVA->value = "OCSP Responder"; + cert->AVAs.push_back( nAVA ); + + std::shared_ptr res = sign->sign( cert ); + + if( !res ) { + writeFile( failName, "failed" ); + logger::error( "OCSP Cert signing failed." ); + return; + } + + writeFile( crtName, res->certificate ); + logger::notef( "Cert log: %s", res->log ); +} + +void checkOCSP( std::shared_ptr sign ) { + std::unique_ptr> dp( opendir( "ca" ), []( DIR * d ) { + closedir( d ); + } ); + + // When opendir fails and returns 0 the unique_ptr will be considered unintialized and will not call closedir. + // Even if closedir would be called, according to POSIX it MAY handle nullptr properly (for glibc it does). + if( !dp ) { + logger::error( "CA directory not found" ); + return; + } + + struct dirent *ep; + + while( ( ep = readdir( dp.get() ) ) ) { + if( ep->d_name[0] == '.' ) { + continue; + } + + std::string profileName( ep->d_name ); + std::string csr = "ca/" + profileName + "/ocsp.csr"; + + if( ! pathExists( csr ) ) { + continue; + } + + std::string crtName = "ca/" + profileName + "/ocsp.crt"; + + if( pathExists( crtName ) ) { + continue; + } + + std::string failName = "ca/" + profileName + "/ocsp.fail"; + + if( pathExists( failName ) ) { + continue; + } + + logger::notef( "Discovered OCSP CSR that needs action: %s", csr ); + std::string req = readFile( csr ); + std::shared_ptr parsed = X509Req::parseCSR( req ); + + if( parsed->verify() <= 0 ) { + logger::errorf( "Invalid CSR for %s", profileName ); + continue; + } + + signOCSP( sign, profileName, req, crtName, failName ); + } +} + + +int main( int argc, const char *argv[] ) { bool once = false; bool resetOnly = false; @@ -86,7 +170,7 @@ int main( int argc, const char* argv[] ) { std::shared_ptr b = openSerial( serialPath ); std::shared_ptr m( toBio(), BIO_meth_free ); std::shared_ptr slip1( BIO_new( m.get() ), BIO_free ); - static_cast( slip1->ptr )->setTarget( std::make_shared( b ), false ); + static_cast( slip1->ptr )->setTarget( std::make_shared( b ), false ); auto sign = std::make_shared( slip1, generateSSLContext( false ) ); // std::shared_ptr sign( new SimpleOpensslSigner() ); @@ -106,20 +190,21 @@ int main( int argc, const char* argv[] ) { if( lastCRLCheck + 30 * 60 < current ) { // todo set good log TODO FIXME - sign->setLog( std::shared_ptr( - &std::cout, - []( std::ostream* o ) { - ( void ) o; - } ) ); + auto ostreamFree = []( std::ostream * o ) { + ( void ) o; + }; + sign->setLog( std::shared_ptr( &std::cout, ostreamFree ) ); checkCRLs( sign ); lastCRLCheck = current; } + checkOCSP( sign ); + std::shared_ptr job; try { job = jp->fetchJob(); - } catch ( std::exception &e ){ + } catch( std::exception& e ) { logger::errorf( "Exception while fetchJob: %s", e.what() ); } @@ -128,18 +213,23 @@ int main( int argc, const char* argv[] ) { continue; } - std::shared_ptr logPtr = openLogfile( std::string( "logs/" ) + job->id + std::string( "_" ) + job->warning + std::string( ".log" ) ); - - logger::logger_set log_set( {logger::log_target( *logPtr, logger::level::debug )}, logger::auto_register::on ); + logger::logger_set log_set( {logger::log_target( job->log, logger::level::debug )}, logger::auto_register::on ); logger::note( "TASK ID: ", job->id ); - logger::note( "TRY: ", job->warning ); + logger::note( "TRY: ", job->attempt ); logger::note( "TARGET: ", job->target ); logger::note( "TASK: ", job->task ); if( job->task == "sign" ) { try { std::shared_ptr cert = jp->fetchTBSCert( job ); + + if( !cert ) { + logger::error( "Unable to load CSR" ); + jp->failJob( job ); + continue; + } + cert->wishFrom = job->from; cert->wishTo = job->to; logger::note( "INFO: Message Digest: ", cert->md ); @@ -153,14 +243,6 @@ int main( int argc, const char* argv[] ) { logger::notef( "INFO: AVA %s: %s", AVA->name, AVA->value ); } - if( !cert ) { - logger::error( "Unable to load CSR" ); - jp->failJob( job ); - continue; - } - - logger::notef( "FINE: Found the CSR at '%s'", cert->csr ); - cert->csr_content = readFile( keyDir + "/../" + cert->csr ); logger::note( "FINE: CSR content:\n", cert->csr_content ); std::shared_ptr res = sign->sign( cert ); @@ -174,30 +256,14 @@ int main( int argc, const char* argv[] ) { logger::note( "FINE: CERTIFICATE LOG:\n", res->log, "FINE: CERTIFICATE:\n", res->certificate ); - std::string fn = writeBackFile( job->target.c_str(), res->certificate, keyDir ); - - if( fn.empty() ) { - logger::error( "ERROR: Writeback of the certificate failed." ); - jp->failJob( job ); - continue; - } - - res->crt_name = fn; jp->writeBack( job, res ); //! \FIXME: Check return value logger::note( "FINE: signing done." ); if( DAEMON ) { jp->finishJob( job ); } - - continue; } catch( std::exception& c ) { - logger::error( "ERROR: ", c.what() ); - } - - try { jp->failJob( job ); - } catch( std::exception& c ) { logger::error( "ERROR: ", c.what() ); } } else if( job->task == "revoke" ) { @@ -209,12 +275,14 @@ int main( int argc, const char* argv[] ) { logger::note( "revoking" ); std::pair, std::string> rev = sign->revoke( CAs.at( data.second ), serials ); std::string date = rev.second; - const unsigned char* pos = ( const unsigned char* ) date.data(); + const unsigned char *pos = ( const unsigned char * ) date.data(); std::shared_ptr time( d2i_ASN1_TIME( NULL, &pos, date.size() ), ASN1_TIME_free ); jp->writeBackRevocation( job, timeToString( time ) ); jp->finishJob( job ); + continue; } catch( const std::exception& c ) { + jp->failJob( job ); logger::error( "Exception: ", c.what() ); } } else { @@ -225,7 +293,7 @@ int main( int argc, const char* argv[] ) { if( !DAEMON || once ) { return 0; } - } catch ( std::exception &e ){ + } catch( std::exception& e ) { logger::errorf( "std::exception in mainloop: %s", e.what() ); }