shell/modules/tools/security/openssl.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) toString;
   4   inherit (pkgs.lib) types unlines;
   5   inherit (config) openssl;
   6
   7   generateCerts = certs: unlines (lib.mapAttrsToList generateCert certs);
   8   generateKey = id: cert: ''
   9     mkdir -p "${openssl.opensslHome}/${id}"
  10     test -s "$PASSWORD_STORE_DIR/${cert.passPrefix}/${id}/key.pem.gpg" || {
  11       info "  generateKey: $PASSWORD_STORE_DIR/${cert.passPrefix}/${id}/key.pem.gpg"
  12       ${pkgs.openssl}/bin/openssl genrsa \
  13        -rand /dev/urandom \
  14        ${toString cert.keySize} |
  15       ${pkgs.pass}/bin/pass insert --multiline "${cert.passPrefix}/${id}/key.pem"
  16     }
  17   '';
  18   generateCert = id: cert:
  19     ''
  20     info '"${id}"'
  21     ''
  22     + generateKey id cert
  23     + ''
  24     genCert () {
  25       info "  generateCert: ${openssl.opensslHome}/${id}/cert.self-signed.pem"
  26       ${pkgs.pass}/bin/pass "${cert.passPrefix}/${id}/key.pem" |
  27       user= \
  28       ${pkgs.openssl}/bin/openssl req \
  29        -batch \
  30        -new \
  31        -x509 \
  32        -utf8 \
  33        -rand       /dev/urandom \
  34        -config     ${cert.opensslConf} \
  35        -extensions self_signed_extensions \
  36        -reqexts    self_signed_extensions \
  37        -inform     PEM \
  38        -outform    PEM \
  39        -keyform    PEM \
  40        ${lib.optionalString (cert.days != null) "-days ${toString cert.days}"} \
  41        -set_serial 0x$(sleep 1; date '+%Y%m%d%H%M%S') \
  42        -reqopt     no_pubkey,no_sigdump \
  43        -key        /dev/stdin \
  44        -out        "${openssl.opensslHome}/${id}/cert.self-signed.pem"
  45     }
  46     if test ! -s "${openssl.opensslHome}/${id}/cert.self-signed.pem"
  47      then genCert
  48      else
  49        if test ! "${openssl.opensslHome}/${id}/cert.self-signed.pem" -nt \
  50                  "$PASSWORD_STORE_DIR/${cert.passPrefix}/${id}/key.pem.gpg"
  51         then genCert
  52         else
  53          test ! "''${DEEPCHECK:+set}" || {
  54            info "  generateCert: checking wether key and certificate match"
  55            key_mod_pub="$(
  56              ${pkgs.pass}/bin/pass "${cert.passPrefix}/${id}/key.pem" |
  57              ${pkgs.openssl}/bin/openssl rsa -modulus -noout -in /dev/stdin)"
  58            crt_mod_pub="$(
  59              ${pkgs.openssl}/bin/openssl x509 -noout -modulus \
  60               -in "${openssl.opensslHome}/${id}/cert.self-signed.pem")"
  61            test "$key_mod_pub" = "$crt_mod_pub" ||
  62            error "key and certificate do not match"
  63          }
  64         fi
  65      fi
  66   '';
  67   error = ''
  68     error(){
  69       echo >&2 "openssl-init: ERROR: $*"
  70       exit 1
  71     }
  72   '';
  73   info = ''
  74     info(){
  75       echo >&2 "openssl-init: $*"
  76     }
  77   '';
  78   # Initialize the keyring according to openssl.certificates.
  79   openssl-init = pkgs.writeShellScriptBin "openssl-init" (''
  80     set -eu
  81     set -o pipefail
  82     ${info}
  83     '' +
  84     generateCerts openssl.certificates
  85   );
  86   openssl-cert-iter = pkgs.writeScriptBin "openssl-cert-iter" ''
  87     set -eu
  88     # SYNTAX: $command .. <cert.pem
  89
  90     begin="-----BEGIN CERTIFICATE-----"
  91     end="-----END CERTIFICATE-----"
  92
  93     buf=
  94     ${pkgs.gnused}/bin/sed -n -e "/^$begin/,/^$end/p" |
  95     while IFS= read -r line
  96      do
  97       case $line in
  98        ("$begin") buf=;;
  99        ("$end") printf '%s\n%s\n%s\n' "$begin" "$(printf %s "$buf" | ${pkgs.gnused}/bin/sed -e 's/\(.\{64\}\)/\1\n/g')" "$end" | "$@";;
 100        (*) buf="$buf$line";;
 101        esac
 102      done
 103   '';
 104   openssl-cert-print = pkgs.writeScriptBin "openssl-cert-print" ''
 105     set -eu
 106     cat -- "$@" |
 107     ${openssl-cert-iter}/bin/openssl-cert-iter \
 108      ${pkgs.openssl}/bin/openssl x509 \
 109       -nameopt multiline,-esc_msb,utf8 \
 110       -certopt no_pubkey,no_sigdump \
 111       -fingerprint \
 112       ''${x509_md:+-"$x509_md"} \
 113       -in "/dev/stdin" \
 114       -noout \
 115       -text \
 116       ''${OPENSSL_FLAGS-} ''${OPENSSL_X509_FLAGS-}
 117   '';
 118   openssl-cert-fetch = pkgs.writeScriptBin "openssl-cert-fetch" ''
 119     set -eu
 120     # SYNTAX: $url
 121     x509="''${x509:-x509}"
 122     url="$1"; shift
 123     host=$(
 124       printf %s "$url" |
 125       ${pkgs.gnused}/bin/sed \
 126        -e 's,^[a-z][a-z]*://,,' \
 127        -e 's,/.*$,,')
 128     servername=$(
 129       printf %s "$host" |
 130       ${pkgs.gnused}/bin/sed \
 131        -e 's,:[0-9][0-9]*,,')
 132     mkdir -p "x509/$host"
 133     begin="-----BEGIN CERTIFICATE-----"
 134     end="-----END CERTIFICATE-----"
 135     set -x
 136     echo |
 137     ${pkgs.openssl}/bin/openssl s_client \
 138      -showcerts \
 139      -servername "$servername" \
 140      -connect    "$host" \
 141      "$@" |
 142     ${pkgs.gnused}/bin/sed -n \
 143      -e "/^$begin/,/^$end/p" \
 144      >"$x509/$host/crt.pem"
 145   '';
 146 in
 147 {
 148 options.openssl = {
 149   enable = lib.mkEnableOption "Configuration of X.509 certificates";
 150   opensslHome = lib.mkOption {
 151     type = types.path;
 152     default = "sec/openssl";
 153     description = ''
 154       OpenSSL's directory.
 155     '';
 156   };
 157   certificates = lib.mkOption {
 158     default = {};
 159     example =
 160       { "example" = rec {
 161           passPrefix        = "x509";
 162           host              = "example.coop";
 163           distributionPoint = "http://example.coop/x509";
 164           domains           = [ "example.org" ];
 165           days              = 365;
 166           keySize           = 4096;
 167           digest            = "sha512";
 168         };
 169       };
 170     type = types.attrsOf (types.submodule ({name, ...}:
 171       let cert = openssl.certificates."${name}"; in
 172       {
 173       #config.uid = lib.mkDefault uid;
 174       options = {
 175         host = lib.mkOption {
 176           type = types.nullOr types.str;
 177           example = "example.coop";
 178         };
 179         passPrefix = lib.mkOption {
 180           type = types.str;
 181           example = "x509";
 182           default = "x509";
 183         };
 184         distributionPoint = lib.mkOption {
 185           type = types.nullOr types.str;
 186           default = null;
 187           example = "http://example.coop/x509";
 188         };
 189         domains = lib.mkOption {
 190           type = types.listOf types.str;
 191           example = [ "example.coop" ];
 192           default = [];
 193         };
 194         days = lib.mkOption {
 195           type = types.int;
 196           default = 3650;
 197           example = 3650;
 198         };
 199         keySize = lib.mkOption {
 200           type = types.int;
 201           default = 4096;
 202           example = 4096;
 203         };
 204         digest = lib.mkOption {
 205           type = types.str;
 206           default = "sha512";
 207           example = "sha512";
 208           description = "A digest from openssl list --digest-commands";
 209         };
 210         opensslConf = lib.mkOption {
 211           type = types.attrsOf types.lines;
 212           default = {};
 213           apply = certConf:
 214             let confBySection =
 215               cert.opensslConf_common //
 216               cert.opensslConf_self-signed //
 217               cert.opensslConf_auth-signed //
 218               cert.opensslConf_user-cert //
 219               certConf
 220             ; in
 221             pkgs.writeText "openssl.conf"
 222               (lib.concatStrings
 223                 (lib.mapAttrsToList
 224                   (sectionHead: sectionBody:
 225                     (if sectionHead == "" then "" else "[ ${sectionHead} ]\n") +
 226                     sectionBody)
 227                   confBySection));
 228         };
 229         opensslConf_common = lib.mkOption {
 230           type = types.attrsOf types.lines;
 231           default = {
 232             "" = ''
 233               RANDFILE    = ${openssl.opensslHome}/openssl.rand
 234               oid_section = extra_oids
 235               default_md  = ${cert.digest}
 236             '';
 237             extra_oids = ''
 238             '';
 239             req = ''
 240               prompt = no
 241               distinguished_name = distinguished_name
 242               string_mask = pkix
 243               #x509_extensions = root_extensions
 244               #req_extensions = extension
 245               #attributes = req_attributes
 246             '';
 247             distinguished_name = ''
 248               commonName = ${cert.host}
 249               #countryName =
 250               #stateOrProvinceName =
 251               #localityName =
 252               #"0.organizationName" =
 253               #organizationalUnitName =
 254               #businessCategory =
 255             '';
 256           };
 257         };
 258         opensslConf_self-signed = lib.mkOption {
 259           type = types.attrsOf types.lines;
 260           default = {
 261             self_signed_extensions = ''
 262               basicConstraints       = critical,CA:TRUE,pathlen:0
 263               keyUsage               = keyCertSign,cRLSign,digitalSignature,keyEncipherment
 264               subjectAltName         = ${lib.concatMapStringsSep "," (dom: "DNS:${dom}") cert.domains}
 265               subjectKeyIdentifier   = hash
 266               issuerAltName          = issuer:copy
 267               authorityKeyIdentifier = keyid:always,issuer:always
 268             '' + lib.optionalString (cert.distributionPoint != null) ''
 269               authorityInfoAccess    = caIssuers;URI:${cert.distributionPoint}/${cert.host}.cert.pem
 270               crlDistributionPoints  = URI:${cert.distributionPoint}/${cert.host}.crl.self-signed.pem
 271             '';
 272             /*
 273             self_signed_ca = ''
 274               dir         = ${openssl.opensslHome}/${name}
 275               private_key = $dir/key.pem
 276               crl_dir     = $dir
 277               crlnumber   = $dir/crl.self-signed.num
 278               crl         = $dir/crl.self-signed.pem
 279               database    = $dir/idx.self-signed.txt
 280             '';
 281             */
 282           };
 283         };
 284         opensslConf_auth-signed = lib.mkOption {
 285           type = types.attrsOf types.lines;
 286           default = {
 287             auth_signed_extensions = ''
 288               basicConstraints       = critical,CA:FALSE
 289               keyUsage               = digitalSignature,keyEncipherment
 290               subjectAltName         = ${lib.concatMapStringsSep "," (dom: "DNS:${dom}") cert.domains}
 291               subjectKeyIdentifier   = hash
 292               issuerAltName          = issuer:copy
 293               authorityKeyIdentifier = keyid:always,issuer:always
 294               certificatePolicies    = @certificate_policies
 295             '' + lib.optionalString (cert.distributionPoint != null) ''
 296               authorityInfoAccess    = caIssuers;URI:${cert.distributionPoint}/${cert.host}.cert.pem
 297               crlDistributionPoints  = URI:${cert.distributionPoint}/${cert.host}.crl.pem
 298             '';
 299             certificate_policies = lib.optionalString (cert.distributionPoint != null) ''
 300               policyIdentifier = 1.2.250.1.42
 301               CPS.1 = https://${cert.distributionPoint}/cps
 302             '';
 303             /*
 304             ca = ''
 305               dir         = ${openssl.opensslHome}/${name}
 306               private_key = $dir/key.pem
 307               crl_dir     = $dir
 308               crlnumber   = $dir/crl.num
 309               crl         = $dir/crl.pem
 310               database    = $dir/idx.txt
 311             '';
 312             */
 313           };
 314         };
 315         opensslConf_user-cert = lib.mkOption {
 316           type = types.attrsOf types.lines;
 317           default = {
 318             user_cert_extensions = ''
 319               basicConstraints       = critical,CA:FALSE,pathlen:0
 320               keyUsage               = digitalSignature,keyEncipherment
 321               subjectAltName         = email:$ENV::user@${cert.host}
 322               subjectKeyIdentifier   = hash
 323               issuerAltName          = issuer:copy
 324               authorityKeyIdentifier = keyid:always,issuer:always
 325             '' + lib.optionalString (cert.distributionPoint != null) ''
 326               authorityInfoAccess    = caIssuers;URI:${cert.distributionPoint}/${cert.host}.cert.pem
 327             '';
 328           };
 329         };
 330
 331       };
 332     }));
 333   };
 334 };
 335
 336 config = lib.mkIf openssl.enable {
 337   nix-shell.buildInputs = [
 338     openssl-cert-iter
 339     openssl-cert-print
 340     openssl-cert-fetch
 341     openssl-init
 342   ];
 343 };
 344 }