feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -2,8 +2,8 @@
 
 A user is an entry in ou=users of the router's directory, of one of two kinds, fixed when it is
 added. A VPN user is an inetOrgPerson with a first name, a last name and an e-mail address, whose
-password OpenVPN checks, and a client certificate of the router CA with the user name as its
-common name, which OpenVPN and IKEv2 accept. A Manager-only account is an account,
+password OpenVPN checks, and a client certificate of the P2S issuing CA (vpnrouter_pki) with the
+user name as its common name, which OpenVPN and IKEv2 accept. A Manager-only account is an account,
 simpleSecurityObject and vpnRouterAccount (the package's schema) with a name, a password and
 optionally an e-mail address, no names, no certificate and so no VPN access; it is added when
 neither the first nor the last name is given, and can sign in to the web service. A service
@@ -31,8 +31,8 @@ login() checks a user's password and code with a bind. Members of ADMIN_GROUP ma
 router through the web service. The module knows only the directory; the callers revoke a
 user's refresh tokens after the operations of vpnrouter_auth.REVOKING.
 
-Every operation runs in a session(), which holds the lock that serializes changes and the
-connection of the user manager account. A request that cannot be done raises Failure, whose
+Every operation runs in a session(), which holds the lock that serializes changes, the PKI's
+lock too, and the connection of the user manager account. A request that cannot be done raises Failure, whose
 status says why: 2 the request is invalid, 3 the user does not exist, 4 the user exists, 5 a
 login failed, 1 anything else. Answers are dicts with the keys of the JSON answers.
 """
@@ -41,10 +41,7 @@ import base64
 import calendar
 import contextlib
 import fcntl
-import pathlib
 import re
-import subprocess
-import sys
 import time
 
 import ldap
@@ -54,6 +51,7 @@ import pyotp
 
 import vpnrouter
 import vpnrouter_ldap
+import vpnrouter_pki
 
 #: A user name is one lowercase DNS label, as it is also the common name of the certificate.
 NAME = re.compile(r'^[a-z][a-z0-9-]{0,30}[a-z0-9]$|^[a-z]$')
@@ -91,7 +89,7 @@ LOCKED = b'000001010000Z'
 ADMIN_GROUP = 'admins'
 #: The digits of a TOTP code given to login().
 CODE = re.compile(r'^\d{6}$')
-LOCK_FILE = pathlib.Path('/run/vpn-router/users.lock')
+LOCK_FILE = vpnrouter_pki.LOCK_FILE
 
 
 class Failure(Exception):
@@ -176,7 +174,7 @@ def dn_of(name):
 
 
 def certificate(name):
-    return vpnrouter.USER_CERT_DIR / f'{name}_cert.pem', vpnrouter.USER_CERT_DIR / f'{name}_key.pem'
+    return vpnrouter_pki.user_files(name)
 
 
 def entry(connection, name):
@@ -188,18 +186,6 @@ def entry(connection, name):
         raise Failure(f'user {name} does not exist', 3)
 
 
-def simple_ca(*args):
-    result = subprocess.run([sys.executable, str(vpnrouter.SIMPLE_CA), *args], capture_output=True, text=True)
-    if result.returncode != 0:
-        raise Failure(f'simple-ca {args[0]} failed: {result.stderr.strip() or result.stdout.strip()}')
-
-
-def publish_crl():
-    """Give strongSwan the CRL after a revocation; OpenVPN reads it at every connection."""
-    if vpnrouter.install_file(vpnrouter.PKI_DIR / 'crl.pem', vpnrouter.CRL_DEST, 0o644):
-        subprocess.run(['swanctl', '--load-creds'], capture_output=True, text=True)
-
-
 def locked_since(value):
     """The time a pwdAccountLockedTime value names, in seconds since the epoch, or 0 when it names none."""
     try:
@@ -283,8 +269,9 @@ def add(connection, name, password, values, service=False):
     if vpn_user and len(details) != len(PERSON):
         raise Failure('give first_name, last_name and email for a VPN user, or at most email for a Manager-only account', 2)
     check_password(password)
-    if vpn_user and not (vpnrouter.PKI_DIR / 'ca_key.pem').is_file():
-        raise Failure('the router CA does not exist; vpn-router-setup creates it once a platform is chosen')
+    if vpn_user and not vpnrouter_pki.ready('p2s'):
+        raise Failure('the P2S issuing CA has no certificate yet; vpn-router-setup creates it once a platform is chosen, '
+                      'or, while the root CA is offline, once its certificate is imported')
     if vpn_user:
         record = {'objectClass': VPN_USER_CLASSES, 'uid': [name.encode()], 'cn': [common_name(details, name).encode()]}
     else:
@@ -299,10 +286,10 @@ def add(connection, name, password, values, service=False):
         raise Failure(f'user {name} exists', 4)
     connection.passwd_s(dn_of(name), None, password)
     if vpn_user:
-        vpnrouter.USER_CERT_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
-        for path in certificate(name):
-            path.unlink(missing_ok=True)
-        simple_ca('make-cert', '--ca-dir', str(vpnrouter.PKI_DIR), '--cert-dir', str(vpnrouter.USER_CERT_DIR), name)
+        try:
+            vpnrouter_pki.issue_user(vpnrouter.load_config(), name, details['mail'])
+        except vpnrouter_pki.Failure as failure:
+            raise Failure(f'the certificate cannot be issued: {failure}', failure.status)
     return summary(entry(connection, name))
 
 
@@ -467,19 +454,16 @@ def remove(connection, name):
         raise Failure(f'user {name} is the last member of {", ".join(alone)}; remove the group first', 2)
     for group in groups:
         connection.modify_s(group_dn(group), [(ldap.MOD_DELETE, 'member', [dn_of(name).encode()])])
-    cert, key = certificate(name)
-    if cert.is_file():
-        simple_ca('revoke-cert', '--ca-dir', str(vpnrouter.PKI_DIR), str(cert))
-        simple_ca('make-crl', '--ca-dir', str(vpnrouter.PKI_DIR), '--days', str(vpnrouter.CRL_DAYS))
-        publish_crl()
-    cert.unlink(missing_ok=True)
-    key.unlink(missing_ok=True)
+    try:
+        vpnrouter_pki.revoke_user(vpnrouter.load_config(), name)
+    except vpnrouter_pki.Failure as failure:
+        raise Failure(f'the certificate cannot be revoked: {failure}', failure.status)
     connection.delete_s(dn_of(name))
     return {'name': name, 'removed': True}
 
 
 def profile(connection, name):
-    """The OpenVPN client profile of the user, with the CA, the certificate and the key inline."""
+    """The OpenVPN client profile of the user, with the root and the P2S CA, the certificate and the key inline."""
     entry(connection, name)
     cfg = vpnrouter.load_config()
     if not cfg['openvpn']['enabled']:
@@ -501,7 +485,7 @@ def profile(connection, name):
         'auth-user-pass',
         'auth-nocache',
         'verb 3',
-        '<ca>', extract_pem(vpnrouter.CA_CERT_DEST.read_text(encoding='utf-8')), '</ca>',
+        '<ca>', extract_pem(vpnrouter_pki.OPENVPN_CA.read_text(encoding='utf-8')), '</ca>',
         '<cert>', extract_pem(cert.read_text(encoding='utf-8')), '</cert>',
         '<key>', key.read_text(encoding='utf-8').strip(), '</key>',
         '',