fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -3,7 +3,8 @@
 A user is an entry in ou=users of the router's directory, of one of two kinds, fixed when it is
 added. A VPN user is an inetOrgPerson with a first name, a last name and an e-mail address, whose
 password OpenVPN checks, and a client certificate of the P2S issuing CA (vpnrouter_pki) with the
-user name as its common name, which OpenVPN and IKEv2 accept. A Manager-only account is an account,
+user name as its common name, which OpenVPN and IKEv2 accept; the certificate is the entry's
+userCertificate, and the PKI keeps it with its key. A Manager-only account is an account,
 simpleSecurityObject and vpnRouterAccount (the package's schema) with a name, a password and
 optionally an e-mail address, no names, no certificate and so no VPN access; it is added when
 neither the first nor the last name is given, and can sign in to the web service. A service
@@ -68,7 +69,7 @@ PERSON = (('first_name', 'givenName'), ('last_name', 'sn'), ('email', 'mail'))
 LABELS = (('display_name', 'displayName'), ('description', 'description'))
 #: The attributes read for a user.
 ATTRIBUTES = ['uid', 'objectClass', 'pwdAccountLockedTime', 'givenName', 'sn', 'mail', 'oathTOTPToken', 'vpnRouterScope',
-              'displayName', 'description']
+              'displayName', 'description', 'userCertificate;binary']
 #: The vpnRouterScope of a service account.
 SERVICE_SCOPE = 'service'
 #: The object classes of a VPN user and of a Manager-only account.
@@ -173,9 +174,6 @@ def dn_of(name):
     return f'uid={name},{vpnrouter_ldap.USERS}'
 
 
-def certificate(name):
-    return vpnrouter_pki.user_files(name)
-
 
 def entry(connection, name):
     """The attributes of the user's entry; Failure with status 3 when there is none."""
@@ -234,7 +232,7 @@ def summary(attributes):
         'internal': service(attributes) and name in internal_accounts(),
         'enabled': lock != LOCKED,
         'locked': lock not in (None, LOCKED) and locked_since(lock) > time.time() - vpnrouter_ldap.LOCKOUT_SECONDS,
-        'certificate': certificate(name)[0].is_file(),
+        'certificate': 'userCertificate;binary' in attributes,
         'otp': 'oathTOTPToken' in attributes,
     }
     for key, attribute in PERSON + LABELS:
@@ -468,9 +466,10 @@ def profile(connection, name):
     cfg = vpnrouter.load_config()
     if not cfg['openvpn']['enabled']:
         raise Failure('OpenVPN is not enabled', 2)
-    cert, key = certificate(name)
-    if not cert.is_file() or not key.is_file():
+    credentials = vpnrouter_pki.user_credentials(name)
+    if credentials is None:
         raise Failure(f'user {name} has no certificate')
+    cert, key = (value.decode() for value in credentials)
     fqdn = cfg['wan']['local_fqdn'].strip()
     text = '\n'.join([
         'client',
@@ -486,8 +485,8 @@ def profile(connection, name):
         'auth-nocache',
         'verb 3',
         '<ca>', extract_pem(vpnrouter_pki.OPENVPN_CA.read_text(encoding='utf-8')), '</ca>',
-        '<cert>', extract_pem(cert.read_text(encoding='utf-8')), '</cert>',
-        '<key>', key.read_text(encoding='utf-8').strip(), '</key>',
+        '<cert>', extract_pem(cert), '</cert>',
+        '<key>', key.strip(), '</key>',
         '',
     ])
     return {'name': name, 'profile': text}