From 498dcdac851dd64d6cfb45211bb0e13f247df402 Mon Sep 17 00:00:00 2001 From: Paramoshka Date: Tue, 18 Feb 2025 13:44:49 +0300 Subject: [PATCH] Add env CLIENT_CERT_EXPIRE for genClientCert func Signed-off-by: Paramoshka --- certificates.go | 20 ++++++++++++++++---- main.go | 46 ++++++++++++++++++++++++---------------------- 2 files changed, 40 insertions(+), 26 deletions(-) diff --git a/certificates.go b/certificates.go index 697c539..05643f7 100644 --- a/certificates.go +++ b/certificates.go @@ -8,7 +8,9 @@ import ( "crypto/x509/pkix" "encoding/pem" "errors" + "fmt" "math/big" + "strconv" "time" ) @@ -60,7 +62,6 @@ func genPrivKey() (privKeyPEM *bytes.Buffer, err error) { Bytes: privKeyPKCS8, }) - return } @@ -131,7 +132,18 @@ func genServerCert(privKey, caPrivKey *rsa.PrivateKey, ca *x509.Certificate, cn // return PEM encoded certificate func genClientCert(privKey, caPrivKey *rsa.PrivateKey, ca *x509.Certificate, cn string) (issuerPEM *bytes.Buffer, err error) { serialNumberRange := new(big.Int).Lsh(big.NewInt(1), 128) - serial, err := rand.Int(rand.Reader, serialNumberRange) + serial, _ := rand.Int(rand.Reader, serialNumberRange) + + certLifetimeDays, err := strconv.Atoi(*clientCertExpirationDays) + if err != nil { + return nil, fmt.Errorf("can't get cert expired value: %w", err) + } + + notBefore := time.Now() + notAfter := notBefore.Add(time.Duration(certLifetimeDays) * 24 * time.Hour) + if notAfter.After(ca.NotAfter) { + notAfter = ca.NotAfter + } template := x509.Certificate{ BasicConstraintsValid: true, @@ -142,8 +154,8 @@ func genClientCert(privKey, caPrivKey *rsa.PrivateKey, ca *x509.Certificate, cn }, KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, - NotBefore: time.Now(), - NotAfter: ca.NotAfter, + NotBefore: notBefore, + NotAfter: notAfter, } issuerBytes, err := x509.CreateCertificate(rand.Reader, &template, ca, &privKey.PublicKey, caPrivKey) diff --git a/main.go b/main.go index 145a942..02a874a 100644 --- a/main.go +++ b/main.go @@ -9,11 +9,7 @@ import ( "encoding/pem" "errors" "fmt" - "github.com/google/uuid" "io/ioutil" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/client-go/kubernetes" - "k8s.io/client-go/rest" "net" "net/http" "os" @@ -25,6 +21,11 @@ import ( "time" "unicode/utf8" + "github.com/google/uuid" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/kubernetes" + "k8s.io/client-go/rest" + "github.com/gobuffalo/packr/v2" "github.com/prometheus/client_golang/prometheus" "github.com/prometheus/client_golang/prometheus/promhttp" @@ -74,6 +75,7 @@ var ( logLevel = kingpin.Flag("log.level", "set log level: trace, debug, info, warn, error (default info)").Default("info").Envar("LOG_LEVEL").String() logFormat = kingpin.Flag("log.format", "set log format: text, json (default text)").Default("text").Envar("LOG_FORMAT").String() storageBackend = kingpin.Flag("storage.backend", "storage backend: filesystem, kubernetes.secrets (default filesystem)").Default("filesystem").Envar("STORAGE_BACKEND").String() + clientCertExpirationDays = kingpin.Flag("easyrsa.client-cert.expired", "Certificate client expired period for OpenVPN in days, default 10 years").Default("3650").Envar("CLIENT_CERT_EXPIRE").String() certsArchivePath = "/tmp/" + certsArchiveFileName ccdArchivePath = "/tmp/" + ccdArchiveFileName @@ -558,27 +560,27 @@ func main() { static := CacheControlWrapper(http.FileServer(staticBox)) http.Handle(*listenBaseUrl, http.StripPrefix(strings.TrimRight(*listenBaseUrl, "/"), static)) - http.HandleFunc(*listenBaseUrl + "api/server/settings", ovpnAdmin.serverSettingsHandler) - http.HandleFunc(*listenBaseUrl + "api/users/list", ovpnAdmin.userListHandler) - http.HandleFunc(*listenBaseUrl + "api/user/create", ovpnAdmin.userCreateHandler) - http.HandleFunc(*listenBaseUrl + "api/user/change-password", ovpnAdmin.userChangePasswordHandler) - http.HandleFunc(*listenBaseUrl + "api/user/rotate", ovpnAdmin.userRotateHandler) - http.HandleFunc(*listenBaseUrl + "api/user/delete", ovpnAdmin.userDeleteHandler) - http.HandleFunc(*listenBaseUrl + "api/user/revoke", ovpnAdmin.userRevokeHandler) - http.HandleFunc(*listenBaseUrl + "api/user/unrevoke", ovpnAdmin.userUnrevokeHandler) - http.HandleFunc(*listenBaseUrl + "api/user/config/show", ovpnAdmin.userShowConfigHandler) - http.HandleFunc(*listenBaseUrl + "api/user/disconnect", ovpnAdmin.userDisconnectHandler) - http.HandleFunc(*listenBaseUrl + "api/user/statistic", ovpnAdmin.userStatisticHandler) - http.HandleFunc(*listenBaseUrl + "api/user/ccd", ovpnAdmin.userShowCcdHandler) - http.HandleFunc(*listenBaseUrl + "api/user/ccd/apply", ovpnAdmin.userApplyCcdHandler) + http.HandleFunc(*listenBaseUrl+"api/server/settings", ovpnAdmin.serverSettingsHandler) + http.HandleFunc(*listenBaseUrl+"api/users/list", ovpnAdmin.userListHandler) + http.HandleFunc(*listenBaseUrl+"api/user/create", ovpnAdmin.userCreateHandler) + http.HandleFunc(*listenBaseUrl+"api/user/change-password", ovpnAdmin.userChangePasswordHandler) + http.HandleFunc(*listenBaseUrl+"api/user/rotate", ovpnAdmin.userRotateHandler) + http.HandleFunc(*listenBaseUrl+"api/user/delete", ovpnAdmin.userDeleteHandler) + http.HandleFunc(*listenBaseUrl+"api/user/revoke", ovpnAdmin.userRevokeHandler) + http.HandleFunc(*listenBaseUrl+"api/user/unrevoke", ovpnAdmin.userUnrevokeHandler) + http.HandleFunc(*listenBaseUrl+"api/user/config/show", ovpnAdmin.userShowConfigHandler) + http.HandleFunc(*listenBaseUrl+"api/user/disconnect", ovpnAdmin.userDisconnectHandler) + http.HandleFunc(*listenBaseUrl+"api/user/statistic", ovpnAdmin.userStatisticHandler) + http.HandleFunc(*listenBaseUrl+"api/user/ccd", ovpnAdmin.userShowCcdHandler) + http.HandleFunc(*listenBaseUrl+"api/user/ccd/apply", ovpnAdmin.userApplyCcdHandler) - http.HandleFunc(*listenBaseUrl + "api/sync/last/try", ovpnAdmin.lastSyncTimeHandler) - http.HandleFunc(*listenBaseUrl + "api/sync/last/successful", ovpnAdmin.lastSuccessfulSyncTimeHandler) - http.HandleFunc(*listenBaseUrl + downloadCertsApiUrl, ovpnAdmin.downloadCertsHandler) - http.HandleFunc(*listenBaseUrl + downloadCcdApiUrl, ovpnAdmin.downloadCcdHandler) + http.HandleFunc(*listenBaseUrl+"api/sync/last/try", ovpnAdmin.lastSyncTimeHandler) + http.HandleFunc(*listenBaseUrl+"api/sync/last/successful", ovpnAdmin.lastSuccessfulSyncTimeHandler) + http.HandleFunc(*listenBaseUrl+downloadCertsApiUrl, ovpnAdmin.downloadCertsHandler) + http.HandleFunc(*listenBaseUrl+downloadCcdApiUrl, ovpnAdmin.downloadCcdHandler) http.Handle(*metricsPath, promhttp.HandlerFor(ovpnAdmin.promRegistry, promhttp.HandlerOpts{})) - http.HandleFunc(*listenBaseUrl + "ping", func(w http.ResponseWriter, r *http.Request) { + http.HandleFunc(*listenBaseUrl+"ping", func(w http.ResponseWriter, r *http.Request) { fmt.Fprintf(w, "pong") })