From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 5A73E73C50 for ; Fri, 16 Apr 2021 15:35:58 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 87AA124D63 for ; Fri, 16 Apr 2021 15:35:25 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 50FDF24C2B for ; Fri, 16 Apr 2021 15:35:22 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 0162845B30 for ; Fri, 16 Apr 2021 15:35:22 +0200 (CEST) From: Wolfgang Bumiller To: pbs-devel@lists.proxmox.com Date: Fri, 16 Apr 2021 15:34:58 +0200 Message-Id: <20210416133517.23349-6-w.bumiller@proxmox.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20210416133517.23349-1-w.bumiller@proxmox.com> References: <20210416133517.23349-1-w.bumiller@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.027 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [config.rs] Subject: [pbs-devel] [RFC backup 05/23] config: factor out certificate writing X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Apr 2021 13:35:58 -0000 for reuse in the certificate api Signed-off-by: Wolfgang Bumiller --- src/config.rs | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/src/config.rs b/src/config.rs index 1557e20a..37df2fd2 100644 --- a/src/config.rs +++ b/src/config.rs @@ -98,10 +98,6 @@ pub fn create_configdir() -> Result<(), Error> { /// Update self signed node certificate. pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { - let backup_user = crate::backup::backup_user()?; - - create_configdir()?; - let key_path = PathBuf::from(configdir!("/proxy.key")); let cert_path = PathBuf::from(configdir!("/proxy.pem")); @@ -111,15 +107,6 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { let priv_pem = rsa.private_key_to_pem()?; - replace_file( - &key_path, - &priv_pem, - CreateOptions::new() - .perm(Mode::from_bits_truncate(0o0640)) - .owner(nix::unistd::ROOT) - .group(backup_user.gid), - )?; - let mut x509 = X509Builder::new()?; x509.set_version(2)?; @@ -198,14 +185,24 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { let x509 = x509.build(); let cert_pem = x509.to_pem()?; - replace_file( - &cert_path, - &cert_pem, - CreateOptions::new() - .perm(Mode::from_bits_truncate(0o0640)) - .owner(nix::unistd::ROOT) - .group(backup_user.gid), - )?; + set_proxy_certificate(&cert_pem, &priv_pem)?; Ok(()) } + +pub(crate) fn set_proxy_certificate(cert_pem: &[u8], key_pem: &[u8]) -> Result<(), Error> { + let backup_user = crate::backup::backup_user()?; + let options = CreateOptions::new() + .perm(Mode::from_bits_truncate(0o0640)) + .owner(nix::unistd::ROOT) + .group(backup_user.gid); + let key_path = PathBuf::from(configdir!("/proxy.key")); + let cert_path = PathBuf::from(configdir!("/proxy.pem")); + + create_configdir()?; + replace_file(&key_path, &key_pem, options.clone()) + .map_err(|err| format_err!("error writing certificate private key - {}", err))?; + replace_file(&cert_path, &cert_pem, options) + .map_err(|err| format_err!("error writing certificate file - {}", err))?; + Ok(()) +} -- 2.20.1