From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 98AD477847 for ; Wed, 28 Apr 2021 12:59:52 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 85E12D151 for ; Wed, 28 Apr 2021 12:59:22 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id E7D26D14B for ; Wed, 28 Apr 2021 12:59:21 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id B7B4845BD3 for ; Wed, 28 Apr 2021 12:59:21 +0200 (CEST) To: Proxmox Backup Server development discussion , Wolfgang Bumiller References: <20210422140213.30989-1-w.bumiller@proxmox.com> <20210422140213.30989-5-w.bumiller@proxmox.com> From: Dietmar Maurer Message-ID: <165e9b1b-2667-a227-583b-8f54a5c418e1@proxmox.com> Date: Wed, 28 Apr 2021 12:59:20 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.10.0 MIME-Version: 1.0 In-Reply-To: <20210422140213.30989-5-w.bumiller@proxmox.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-SPAM-LEVEL: Spam detection results: 0 AWL 0.451 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pbs-devel] applied: [PATCH v2 backup 04/27] config: factor out certificate writing X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Apr 2021 10:59:52 -0000 applied On 4/22/21 4:01 PM, Wolfgang Bumiller wrote: > for reuse in the certificate api > > Signed-off-by: Wolfgang Bumiller > --- > src/config.rs | 39 ++++++++++++++++++--------------------- > 1 file changed, 18 insertions(+), 21 deletions(-) > > diff --git a/src/config.rs b/src/config.rs > index 1557e20a..37df2fd2 100644 > --- a/src/config.rs > +++ b/src/config.rs > @@ -98,10 +98,6 @@ pub fn create_configdir() -> Result<(), Error> { > /// Update self signed node certificate. > pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { > > - let backup_user = crate::backup::backup_user()?; > - > - create_configdir()?; > - > let key_path = PathBuf::from(configdir!("/proxy.key")); > let cert_path = PathBuf::from(configdir!("/proxy.pem")); > > @@ -111,15 +107,6 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { > > let priv_pem = rsa.private_key_to_pem()?; > > - replace_file( > - &key_path, > - &priv_pem, > - CreateOptions::new() > - .perm(Mode::from_bits_truncate(0o0640)) > - .owner(nix::unistd::ROOT) > - .group(backup_user.gid), > - )?; > - > let mut x509 = X509Builder::new()?; > > x509.set_version(2)?; > @@ -198,14 +185,24 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { > let x509 = x509.build(); > let cert_pem = x509.to_pem()?; > > - replace_file( > - &cert_path, > - &cert_pem, > - CreateOptions::new() > - .perm(Mode::from_bits_truncate(0o0640)) > - .owner(nix::unistd::ROOT) > - .group(backup_user.gid), > - )?; > + set_proxy_certificate(&cert_pem, &priv_pem)?; > > Ok(()) > } > + > +pub(crate) fn set_proxy_certificate(cert_pem: &[u8], key_pem: &[u8]) -> Result<(), Error> { > + let backup_user = crate::backup::backup_user()?; > + let options = CreateOptions::new() > + .perm(Mode::from_bits_truncate(0o0640)) > + .owner(nix::unistd::ROOT) > + .group(backup_user.gid); > + let key_path = PathBuf::from(configdir!("/proxy.key")); > + let cert_path = PathBuf::from(configdir!("/proxy.pem")); > + > + create_configdir()?; > + replace_file(&key_path, &key_pem, options.clone()) > + .map_err(|err| format_err!("error writing certificate private key - {}", err))?; > + replace_file(&cert_path, &cert_pem, options) > + .map_err(|err| format_err!("error writing certificate file - {}", err))?; > + Ok(()) > +}