Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2023 Savoir-faire Linux Inc. |
| 3 | * |
| 4 | * This program is free software: you can redistribute it and/or modify |
| 5 | * it under the terms of the GNU General Public License as published by |
| 6 | * the Free Software Foundation, either version 3 of the License, or |
| 7 | * (at your option) any later version. |
| 8 | * |
| 9 | * This program is distributed in the hope that it will be useful, |
| 10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | * GNU General Public License for more details. |
| 13 | * |
| 14 | * You should have received a copy of the GNU General Public License |
| 15 | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
| 16 | */ |
| 17 | #include "dhtnet_crtmgr.h" |
| 18 | |
| 19 | |
| 20 | #include <iostream> |
Louis Maillard | 9737f53 | 2024-07-23 14:26:33 -0400 | [diff] [blame] | 21 | #include <fstream> |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 22 | #include <unistd.h> |
| 23 | #include <getopt.h> |
| 24 | #if __has_include(<fmt/std.h>) |
| 25 | #include <fmt/std.h> |
| 26 | #else |
| 27 | #include <fmt/ostream.h> |
| 28 | #endif |
| 29 | |
| 30 | |
| 31 | struct dhtnet_crtmgr_params |
| 32 | { |
| 33 | bool help {false}; |
| 34 | bool version {false}; |
| 35 | std::filesystem::path ca {}; |
| 36 | std::filesystem::path id {}; |
| 37 | std::filesystem::path privatekey {}; |
| 38 | bool pkid {false}; |
| 39 | std::string name {}; |
| 40 | bool setup {false}; |
Louis Maillard | 9737f53 | 2024-07-23 14:26:33 -0400 | [diff] [blame] | 41 | bool interactive {false}; |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 42 | }; |
| 43 | static const constexpr struct option long_options[] |
| 44 | = {{"help", no_argument, nullptr, 'h'}, |
| 45 | {"version", no_argument, nullptr, 'v'}, |
| 46 | {"CA", required_argument, nullptr, 'c'}, |
Amna | b5f0a68 | 2024-02-08 16:21:12 -0500 | [diff] [blame] | 47 | {"id", required_argument, nullptr, 'o'}, |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 48 | {"privatekey", required_argument, nullptr, 'p'}, |
| 49 | {"name", required_argument, nullptr, 'n'}, |
Louis Maillard | d887d3b | 2024-07-23 14:29:31 -0400 | [diff] [blame^] | 50 | {"pkid", no_argument, nullptr, 'a'}, |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 51 | {"setup", no_argument, nullptr, 's'}, |
Louis Maillard | 9737f53 | 2024-07-23 14:26:33 -0400 | [diff] [blame] | 52 | {"interactive", no_argument, nullptr, 'i'}, |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 53 | {nullptr, 0, nullptr, 0}}; |
| 54 | |
| 55 | dhtnet_crtmgr_params |
| 56 | parse_args(int argc, char** argv) |
| 57 | { |
| 58 | dhtnet_crtmgr_params params; |
| 59 | int opt; |
Louis Maillard | d887d3b | 2024-07-23 14:29:31 -0400 | [diff] [blame^] | 60 | while ((opt = getopt_long(argc, argv, "hasvi:c:o:p:n:", long_options, nullptr)) != -1) { |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 61 | switch (opt) { |
| 62 | case 'h': |
| 63 | params.help = true; |
| 64 | break; |
| 65 | case 'v': |
| 66 | params.version = true; |
| 67 | break; |
| 68 | case 'c': |
| 69 | params.ca = optarg; |
| 70 | break; |
Amna | b5f0a68 | 2024-02-08 16:21:12 -0500 | [diff] [blame] | 71 | case 'o': |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 72 | params.id = optarg; |
| 73 | break; |
| 74 | case 'p': |
| 75 | params.privatekey = optarg; |
| 76 | break; |
Louis Maillard | d887d3b | 2024-07-23 14:29:31 -0400 | [diff] [blame^] | 77 | case 'a': |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 78 | params.pkid = true; |
| 79 | break; |
| 80 | case 'n': |
| 81 | params.name = optarg; |
| 82 | break; |
| 83 | case 's': |
| 84 | params.setup = true; |
| 85 | break; |
Louis Maillard | 9737f53 | 2024-07-23 14:26:33 -0400 | [diff] [blame] | 86 | case 'i': |
| 87 | params.interactive = true; |
| 88 | break; |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 89 | default: |
| 90 | std::cerr << "Invalid option" << std::endl; |
| 91 | exit(EXIT_FAILURE); |
| 92 | } |
| 93 | } |
| 94 | |
Louis Maillard | 9737f53 | 2024-07-23 14:26:33 -0400 | [diff] [blame] | 95 | if (params.id.empty() && !params.pkid && !params.help && !params.version && !params.interactive) { |
Louis Maillard | 2da6725 | 2024-07-23 14:17:16 -0400 | [diff] [blame] | 96 | std::cerr << "Error: The path to save the generated certificate is not provided.\n Please specify the path using the -o option.\n"; |
Amna | b5f0a68 | 2024-02-08 16:21:12 -0500 | [diff] [blame] | 97 | exit(EXIT_FAILURE); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 98 | } |
| 99 | return params; |
| 100 | } |
| 101 | |
| 102 | |
Louis Maillard | 9737f53 | 2024-07-23 14:26:33 -0400 | [diff] [blame] | 103 | int create_yaml_config(std::filesystem::path file, std::filesystem::path certificate, std::filesystem::path privateKey, bool is_client) |
| 104 | { |
| 105 | std::ofstream yaml_file (file); |
| 106 | if (yaml_file.is_open()) { |
| 107 | yaml_file << "# The bootstrap node serves as the entry point to the DHT network.\n"; |
| 108 | yaml_file << "# By default, bootstrap.jami.net is configured for the public DHT network and should be used for personal use only.\n"; |
| 109 | yaml_file << "# For production environments, it is recommended to set up your own bootstrap node to establish your own DHT network.\n"; |
| 110 | yaml_file << "# Documentation: https://docs.jami.net/en_US/user/lan-only.html#boostraping\n"; |
| 111 | yaml_file << "bootstrap: \"bootstrap.jami.net\"\n"; |
| 112 | |
| 113 | yaml_file << "\n# TURN server is used as a fallback for connections if the NAT block all possible connections.\n"; |
| 114 | yaml_file << "# By default is turn.jami.net (which uses coturn) but can be any TURN.\n"; |
| 115 | yaml_file << "# Developer must set up their own TURN server.\n"; |
| 116 | yaml_file << "# Documentation: https://docs.jami.net/en_US/developer/going-further/setting-up-your-own-turn-server.html\n"; |
| 117 | yaml_file << "turn_host: \"turn.jami.net\"\n"; |
| 118 | yaml_file << "turn_user: \"ring\"\n"; |
| 119 | yaml_file << "turn_pass: \"ring\"\n"; |
| 120 | yaml_file << "turn_realm: \"ring\"\n"; |
| 121 | if (is_client) { |
| 122 | yaml_file << "\n# When dnc server receives connexions, it forwards them to service at specified IP:port requested by client\n"; |
| 123 | yaml_file << "# By default, it forwards them to SSH server running on localhost at port 22\n"; |
| 124 | yaml_file << "ip: \"127.0.0.1\"\n"; |
| 125 | yaml_file << "port: 22\n"; |
| 126 | } |
| 127 | yaml_file << "\n# On server, identities are saved in /etc/dhtnet/id/\n"; |
| 128 | yaml_file << "# On client, they are generaly saved in ~/.dnc/\n"; |
| 129 | yaml_file << "certificate: " << certificate << "\n"; |
| 130 | yaml_file << "privateKey: " << privateKey << "\n"; |
| 131 | if (!is_client) { |
| 132 | yaml_file << "\n# When anonymous is set to true, the server accepts any connection without checking CA\n"; |
| 133 | yaml_file << "# When anonymous is set to false, the server allows only connection which are issued by the same CA as the server\n"; |
| 134 | yaml_file << "anonymous: false\n"; |
| 135 | } |
| 136 | yaml_file << "\n# When verbose is set to true, the server logs all incoming connections\n"; |
| 137 | yaml_file << "verbose: false\n"; |
| 138 | yaml_file.close(); |
| 139 | fmt::print("Configuration file created in {}\n", file); |
| 140 | } else { |
| 141 | fmt::print(stderr, "Error: Could not create configuration file {}.\n", file); |
| 142 | return 1; |
| 143 | } |
| 144 | return 0; |
| 145 | } |
| 146 | |
| 147 | int configure_ssh_config(std::filesystem::path yaml_config) |
| 148 | { |
| 149 | std::filesystem::path home_dir = getenv("HOME"); |
| 150 | if (home_dir.empty()) { |
| 151 | fmt::print(stderr, "Error: HOME environment variable is not set. Cannot configure SSH.\n"); |
| 152 | return 1; |
| 153 | } |
| 154 | std::filesystem::path ssh_dir = home_dir / ".ssh"; |
| 155 | if (!std::filesystem::exists(ssh_dir)) { |
| 156 | fmt::print(stderr, "Error: {} folder doesn't exist. Install and configure ssh client first.\n", ssh_dir); |
| 157 | return 1; |
| 158 | } |
| 159 | std::filesystem::path ssh_config = ssh_dir / "config"; |
| 160 | if (std::filesystem::exists(ssh_config)) { |
| 161 | std::ifstream ssh_file(ssh_config); |
| 162 | std::string line; |
| 163 | while (std::getline(ssh_file, line)) { |
| 164 | if (line.find("Host dnc") != std::string::npos) { |
| 165 | fmt::print("Info: dnc configuration already exists in ssh config. File is left untouched\n"); |
| 166 | return 0; |
| 167 | } |
| 168 | } |
| 169 | } |
| 170 | std::ofstream ssh_file(ssh_config, std::ios::app); |
| 171 | if (ssh_file.is_open()) { |
| 172 | ssh_file << "\nHost dnc/*\n"; |
| 173 | ssh_file << " ProxyCommand dnc -d " << yaml_config << " $(basename %h)\n"; |
| 174 | ssh_file.close(); |
| 175 | fmt::print("SSH configuration added to {}\n", ssh_config); |
| 176 | } else { |
| 177 | fmt::print(stderr, "Error: Could not open ssh config file.\n"); |
| 178 | return 1; |
| 179 | } |
| 180 | return 0; |
| 181 | } |
| 182 | |
| 183 | // https://en.cppreference.com/w/cpp/string/byte/tolower |
| 184 | std::string str_tolower(std::string s) |
| 185 | { |
| 186 | std::transform(s.begin(), s.end(), s.begin(), |
| 187 | [](unsigned char c){ return std::tolower(c); } // correct |
| 188 | ); |
| 189 | return s; |
| 190 | } |
| 191 | |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 192 | int |
| 193 | main(int argc, char** argv) |
| 194 | { |
| 195 | auto params = parse_args(argc, argv); |
| 196 | |
| 197 | if (params.help) { |
| 198 | fmt::print("Usage: dhtnet-crtmgr [options]\n" |
| 199 | "\nOptions:\n" |
Louis Maillard | d887d3b | 2024-07-23 14:29:31 -0400 | [diff] [blame^] | 200 | " -h, --help Display this help message and then exit.\n" |
| 201 | " -v, --version Show the version of the program.\n" |
| 202 | " -p, --privatekey [PATH] Provide the path to the private key as an argument.\n" |
| 203 | " -c, --certificate [PATH] Provide the path to the certificate as an argument.\n" |
| 204 | " -o, --output [FOLDER] Provide the path where the generated certificate should be saved as an argument.\n" |
| 205 | " -a, --identifier Display the user identifier.\n" |
| 206 | " -n, --name [NAME] Provide the name of the certificate to be generated.\n" |
| 207 | " -s, --setup Create an CA and a certificate.\n" |
| 208 | " -i, --interactive Interactively create and setup identities.\n"); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 209 | return EXIT_SUCCESS; |
| 210 | } |
| 211 | |
| 212 | if (params.version) { |
| 213 | fmt::print("dhtnet-crtmgr v1.0\n"); |
| 214 | return EXIT_SUCCESS; |
| 215 | } |
| 216 | // check if the public key id is requested |
| 217 | if (params.pkid) { |
| 218 | if (params.ca.empty() || params.privatekey.empty()) { |
Louis Maillard | d887d3b | 2024-07-23 14:29:31 -0400 | [diff] [blame^] | 219 | fmt::print(stderr, "Error: The path to the private key and the certificate is not provided.\n Please specify the path for the private key and the certificate using the -p and -c options.\n"); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 220 | exit(EXIT_FAILURE); |
| 221 | } |
| 222 | auto identity = dhtnet::loadIdentity(params.privatekey, params.ca); |
| 223 | fmt::print("Public key id: {}\n", identity.second->getId()); |
| 224 | return EXIT_SUCCESS; |
| 225 | } |
| 226 | |
Louis Maillard | 9737f53 | 2024-07-23 14:26:33 -0400 | [diff] [blame] | 227 | // check if the interactive mode is requested |
| 228 | if (params.interactive) { |
| 229 | // Ask user if he want to setup client or server config |
| 230 | std::string usage = ""; |
| 231 | do { |
| 232 | fmt::print("Generate identity for server or client? [(C)lient/(s)erver] (default: client): "); |
| 233 | std::getline(std::cin, usage); |
| 234 | usage = str_tolower(usage); |
| 235 | if (usage == "s") usage = "server"; |
| 236 | if (usage == "c") usage = "client"; |
| 237 | if (usage.empty()) usage = "client"; |
| 238 | } while (usage != "server" && usage != "client"); |
| 239 | |
| 240 | // In case user select client mode, Ask if we should sign using server CA (required for anonymous: false) |
| 241 | std::string use_server_ca = ""; |
| 242 | if (usage == "client") { |
| 243 | do { |
| 244 | fmt::print("Sign client certificate using server CA? [Y/n] (default: yes): "); |
| 245 | std::getline(std::cin, use_server_ca); |
| 246 | use_server_ca = str_tolower(use_server_ca); |
| 247 | if (use_server_ca == "y") use_server_ca = "yes"; |
| 248 | if (use_server_ca == "n") use_server_ca = "no"; |
| 249 | if (use_server_ca.empty()) use_server_ca = "yes"; |
| 250 | } while (use_server_ca != "yes" && use_server_ca != "no"); |
| 251 | } |
| 252 | |
| 253 | // Before asking for save folder, pre-compute default locations |
| 254 | std::filesystem::path home_dir = getenv("HOME"); |
| 255 | if (home_dir.empty()) home_dir = "/tmp/.dnc"; |
| 256 | else if (usage == "server") home_dir = "/etc/dhtnet"; |
| 257 | else home_dir = home_dir / ".dnc"; |
| 258 | |
| 259 | std::string input_folder; |
| 260 | |
| 261 | // Ask where to store identity files |
| 262 | std::filesystem::path folder; |
| 263 | fmt::print("Enter the path to save identities and config [{}]: ", home_dir); |
| 264 | std::getline(std::cin, input_folder); |
| 265 | if (input_folder.empty()) { |
| 266 | folder = home_dir; |
| 267 | } else { |
| 268 | folder = input_folder; |
| 269 | } |
| 270 | folder = std::filesystem::absolute(folder); |
| 271 | std::filesystem::create_directories(folder); |
| 272 | |
| 273 | if (usage == "client") { |
| 274 | // Use existing CA or generate new CA |
| 275 | dht::crypto::Identity ca; |
| 276 | if (use_server_ca == "yes") { |
| 277 | try { |
| 278 | std::filesystem::path server_ca = "/etc/dhtnet/CA"; |
| 279 | ca = dhtnet::loadIdentity(server_ca / "ca-server.pem", server_ca / "ca-server.crt"); |
| 280 | if (!ca.first || !ca.second) { |
| 281 | throw std::runtime_error("Failed to load server CA"); |
| 282 | } |
| 283 | } |
| 284 | catch (const std::exception& e) { |
| 285 | fmt::print(stderr, "Error: Could not load server CA. Please generate server CA first.\n"); |
| 286 | return EXIT_FAILURE; |
| 287 | } |
| 288 | } else { |
| 289 | ca = dhtnet::generateIdentity(folder, "ca"); |
| 290 | fmt::print("Generated CA in {}: {} {}\n", folder, "ca", ca.second->getId()); |
| 291 | } |
| 292 | |
| 293 | // Generate client certificate |
| 294 | auto id = dhtnet::generateIdentity(folder, "certificate", ca); |
| 295 | fmt::print("Generated certificate in {}: {} {}\n", folder, "certificate", id.second->getId()); |
| 296 | |
| 297 | // Create configuration file with generated keys |
| 298 | std::filesystem::path yaml_config{folder / "config.yml"}; |
| 299 | if (create_yaml_config(yaml_config, folder / "certificate.crt", folder / "certificate.pem", true) != 0) { |
| 300 | return EXIT_FAILURE; |
| 301 | } |
| 302 | |
| 303 | // Ask user if he want to configure SSH |
| 304 | std::string ssh_setup = ""; |
| 305 | do { |
| 306 | fmt::print("Configure SSH to support dnc protocol? [Y/n] (default: yes): "); |
| 307 | std::getline(std::cin, ssh_setup); |
| 308 | ssh_setup = str_tolower(ssh_setup); |
| 309 | if (ssh_setup == "y") ssh_setup = "yes"; |
| 310 | if (ssh_setup == "n") ssh_setup = "no"; |
| 311 | if (ssh_setup.empty()) ssh_setup = "yes"; |
| 312 | } while (ssh_setup != "yes" && ssh_setup != "no"); |
| 313 | |
| 314 | if (ssh_setup == "yes") { |
| 315 | if (configure_ssh_config(yaml_config) != 0) { |
| 316 | return EXIT_FAILURE; |
| 317 | } |
| 318 | } |
| 319 | |
| 320 | return EXIT_SUCCESS; |
| 321 | } else { |
| 322 | // Create configuration file with generated keys |
| 323 | std::filesystem::path yaml_config{folder / "config.yml"}; |
| 324 | std::string overwrite = ""; |
| 325 | if (std::filesystem::exists(yaml_config)) { |
| 326 | do { |
| 327 | fmt::print("Configuration file already exists in {}. Overwrite it? [y/N] (default: no): \n", yaml_config); |
| 328 | std::getline(std::cin, overwrite); |
| 329 | overwrite = str_tolower(overwrite); |
| 330 | if (overwrite == "y") overwrite = "yes"; |
| 331 | if (overwrite == "n") overwrite = "no"; |
| 332 | if (overwrite.empty()) overwrite = "no"; |
| 333 | } while (overwrite != "yes" && overwrite != "no"); |
| 334 | } else { |
| 335 | overwrite = "yes"; // File doesn't exist, create it |
| 336 | } |
| 337 | if (overwrite == "yes") { |
| 338 | if (create_yaml_config(yaml_config, folder / "certificate.crt", folder / "certificate.pem", true) != 0) { |
| 339 | return EXIT_FAILURE; |
| 340 | } |
| 341 | } |
| 342 | params.setup = true; |
| 343 | params.id = folder; |
| 344 | } |
| 345 | } |
| 346 | |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 347 | // check if the setup is requested |
| 348 | if (params.setup) { |
| 349 | // create CA with name ca-server |
| 350 | std::filesystem::path path_ca = params.id / "CA"; |
| 351 | auto ca = dhtnet::generateIdentity(path_ca, "ca-server"); |
| 352 | fmt::print("Generated CA in {}: {} {}\n", path_ca, "ca-server", ca.second->getId()); |
| 353 | // create identity with name id-server |
| 354 | std::filesystem::path path_id = params.id / "id"; |
| 355 | auto identity = dhtnet::generateIdentity(path_id, "id-server", ca); |
Amna | b5f0a68 | 2024-02-08 16:21:12 -0500 | [diff] [blame] | 356 | fmt::print("Generated certificate in {}: {} {}\n", path_id,"id-server", identity.second->getId()); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 357 | return EXIT_SUCCESS; |
| 358 | } |
| 359 | |
| 360 | if (params.ca.empty() || params.privatekey.empty()) { |
| 361 | if (params.name.empty()) { |
| 362 | auto ca = dhtnet::generateIdentity(params.id, "ca"); |
Amna | b5f0a68 | 2024-02-08 16:21:12 -0500 | [diff] [blame] | 363 | fmt::print("Generated certificate in {}: {} {}\n", params.id, "ca", ca.second->getId()); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 364 | }else{ |
Louis Maillard | d887d3b | 2024-07-23 14:29:31 -0400 | [diff] [blame^] | 365 | auto ca = dhtnet::generateIdentity(params.id, params.name); |
| 366 | fmt::print("Generated certificate in {}: {} {}\n", params.id, params.name, ca.second->getId()); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 367 | } |
| 368 | }else{ |
| 369 | auto ca = dhtnet::loadIdentity(params.privatekey, params.ca); |
| 370 | if (params.name.empty()) { |
Amna | b5f0a68 | 2024-02-08 16:21:12 -0500 | [diff] [blame] | 371 | auto id = dhtnet::generateIdentity(params.id, "certificate", ca); |
| 372 | fmt::print("Generated certificate in {}: {} {}\n", params.id, "certificate", id.second->getId()); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 373 | }else{ |
| 374 | auto id = dhtnet::generateIdentity(params.id, params.name, ca); |
Amna | b5f0a68 | 2024-02-08 16:21:12 -0500 | [diff] [blame] | 375 | fmt::print("Generated certificate in {}: {} {}\n", params.id, params.name, id.second->getId()); |
Amna | 423b25b | 2024-02-06 13:21:19 -0500 | [diff] [blame] | 376 | } |
| 377 | } |
| 378 | return EXIT_SUCCESS; |
| 379 | } |