[PATCH proxmox v3 03/16] tls-certificates: add self_signed_cert_expires_in to check certificates

[Shannon Sterz <s.sterz@proxmox.com>]

this is useful when self-signed certificates are in use. it
heuristically checks whether a certificate is self-signed by the
specified node and returns for how many more days the certificate is
valid if it is a self-signed certificate.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 proxmox-tls-certificates/Cargo.toml  |  2 +
 proxmox-tls-certificates/src/lib.rs  |  2 +-
 proxmox-tls-certificates/src/util.rs | 55 ++++++++++++++++++++++++++++
 3 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/proxmox-tls-certificates/Cargo.toml b/proxmox-tls-certificates/Cargo.toml
index 3a7b97cd..658a700d 100644
--- a/proxmox-tls-certificates/Cargo.toml
+++ b/proxmox-tls-certificates/Cargo.toml
@@ -16,6 +16,7 @@ hex = { workspace = true, optional = true }
 libc = { workspace = true, optional = true }
 openssl = { workspace = true, optional = true }
 serde = { workspace = true, features = [ "derive" ] }
+regex = { workspace = true, optional = true }
 
 proxmox-schema = { workspace = true, features = [ "api-macro" ] }
 proxmox-time = { workspace = true, optional = true }
@@ -29,6 +30,7 @@ impl = [
     "dep:hex",
     "dep:libc",
     "dep:openssl",
+    "dep:regex",
 
     "dep:proxmox-time",
     "dep:proxmox-uuid",
diff --git a/proxmox-tls-certificates/src/lib.rs b/proxmox-tls-certificates/src/lib.rs
index 454c700f..66def7d6 100644
--- a/proxmox-tls-certificates/src/lib.rs
+++ b/proxmox-tls-certificates/src/lib.rs
@@ -4,4 +4,4 @@ pub use types::CertificateInfo;
 #[cfg(feature = "impl")]
 mod util;
 #[cfg(feature = "impl")]
-pub use util::create_self_signed_cert;
+pub use util::{create_self_signed_cert, self_signed_cert_expires_in};
diff --git a/proxmox-tls-certificates/src/util.rs b/proxmox-tls-certificates/src/util.rs
index 98aa042e..a07903d8 100644
--- a/proxmox-tls-certificates/src/util.rs
+++ b/proxmox-tls-certificates/src/util.rs
@@ -2,12 +2,54 @@ use std::mem::MaybeUninit;
 
 use anyhow::{Error, bail, format_err};
 use foreign_types::ForeignTypeRef;
+use openssl::asn1::Asn1Time;
 use openssl::pkey::{PKey, Private};
 use openssl::rsa::Rsa;
 use openssl::x509::{X509, X509Builder};
 
 use crate::CertificateInfo;
 
+proxmox_schema::const_regex! {
+    SELF_SIGNED_REGEX =
+        // O = $product_name, OU = $uuid, CN = $nodename
+        r#"^O\s?=\s(?P<product>.*)?, OU\s?=\s?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}, CN\s?=\s?(?P<fqdn>.*)$"#;
+}
+
+/// Check whether the current certificate is self-signed and returns the remaining days the
+/// certificate is valid for.
+pub fn self_signed_cert_expires_in(
+    product_name: &str,
+    nodename: &str,
+    domain: Option<&str>,
+    cert: CertificateInfo,
+) -> Result<Option<i32>, Error> {
+    let Some(captures) = (SELF_SIGNED_REGEX.regex_obj)().captures(&cert.issuer) else {
+        return Ok(None);
+    };
+
+    let mut fqdn = nodename.to_string();
+
+    if let Some(domain) = domain {
+        fqdn = format!("{fqdn}.{domain}");
+    }
+
+    if captures["product"] != *product_name {
+        return Ok(None);
+    }
+
+    if captures["fqdn"] != fqdn {
+        return Ok(None);
+    }
+
+    let now = Asn1Time::from_unix(proxmox_time::epoch_i64())?;
+    let not_after = Asn1Time::from_unix(cert.notafter.ok_or_else(|| {
+        format_err!("Could not get \"not after\" epoch for current certificate.")
+    })?)?;
+
+    let diff = now.diff(&not_after)?;
+    Ok(Some(diff.days))
+}
+
 /// Create a new self-signed certificate and its private key.
 ///
 /// * `product_name`: The name of the product, will be used as the organization of the certificate.
@@ -237,6 +279,19 @@ mod test {
         }
     }
 
+    #[test]
+    fn self_signed_cert_expires_in_gets_correct_days() {
+        let cert_info =
+            get_self_signed_certificate_info("Proxmox Test Product", "name", Some("fqdn"), Some(2));
+
+        match self_signed_cert_expires_in("Proxmox Test Product", "name", Some("fqdn"), cert_info) {
+            // allow the range [1,2] due to truncation, the test could take too long to always yield "2" here
+            Ok(Some(days)) => assert!((1..=2).contains(&days)),
+            Ok(None) => panic!("not a self-signed certificate"),
+            Err(e) => panic!("error occurred checking certificate - {e:#}"),
+        }
+    }
+
     #[test]
     fn self_signed_certificate_correct_with_product_and_name_only() {
         let cert_info =
-- 
2.47.3