itsi-server 0.1.4 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9738897c1d51717595b2ab829af9a7ed03f14b818f451121abb9fe2dd90ae9a
-  data.tar.gz: 5b0cbc6234c01a11f509541b4ca963ff6743f3d3190c1c55f26eecedb5a49351
+  metadata.gz: be27a619d6a8c35a088332bb467aaf1c15f1e146eefcb9eea4e2bfa30400a1a3
+  data.tar.gz: ac488266fb7e70c0e5a75ad8a14c0788d73a8e2c06df32c4e8968172477950c2
 SHA512:
-  metadata.gz: ec4156d473dcbcc34bc9ae98bfb7161afd62b050fa8652630a26d7ca2dc3b226523b268cc21e86179cecd07a0699ce8766edb861a7dc9c729df1580c98ccff0e
-  data.tar.gz: cb19f0a410357782a691ba8aba8b27d24b3484d284ec363c46c16e3ead74eb8d4fb29e9f32aed59fe8442b8df8a35768fca39fc687a53bb98d15e589b1147d1b
+  metadata.gz: 1b5e765780844d7ab418246aa44481bad579de73fcdb1b19001327456f4d643c5f7dbce310965dae975895ca98388dfeeaa74ab67542000c3d48cfb41e5a473e
+  data.tar.gz: 8cdc7c721573ec281918d80d33870636326c53e7a59b3c4752215a2c5c1da67df8461aff3dd933d56400a813811668b4ab92a6bcae3ca9ffa8e50fcededda8fd

data/ext/itsi_server/Cargo.toml

@@ -41,3 +41,6 @@ tempfile = "3.18.0"
 sysinfo = "0.33.1"
 tokio-rustls-acme = "0.6.0"
 rustls = "0.23.23"
+fs2 = "0.4.3"
+ring = "0.17.14"
+async-trait = "0.1.87"

data/ext/itsi_server/src/server/listener.rs

@@ -78,8 +78,9 @@ impl TokioListener {
         {
             let mut state = state.lock().await;
             loop {
-                if let Some(event) = StreamExt::next(&mut *state).await {
-                    info!("Received acme event: {:?}", event)
+                match StreamExt::next(&mut *state).await {
+                    Some(event) => info!("Received acme event: {:?}", event),
+                    None => error!("Received no acme event"),
                 }
             }
         }
@@ -96,19 +97,19 @@ impl TokioListener {
             }
             ItsiTlsAcceptor::Automatic(acme_acceptor, _, rustls_config) => {
                 let accept_future = acme_acceptor.accept(tcp_stream.0);
-                match accept_future.await.unwrap() {
-                    None => Err(ItsiError::Pass()),
-                    Some(start_handshake) => {
-                        let tls_stream = start_handshake
-                            .into_stream(rustls_config.clone())
-                            .await
-                            .unwrap();
-                        // Wrap in your IoStream::TcpTls variant
+                match accept_future.await {
+                    Ok(None) => Err(ItsiError::Pass()),
+                    Ok(Some(start_handshake)) => {
+                        let tls_stream = start_handshake.into_stream(rustls_config.clone()).await?;
                         Ok(IoStream::TcpTls {
                             stream: tls_stream,
                             addr: SockAddr::Tcp(Arc::new(tcp_stream.1)),
                         })
                     }
+                    Err(error) => {
+                        error!(error = format!("{:?}", error));
+                        Err(ItsiError::Pass())
+                    }
                 }
             }
         }

data/ext/itsi_server/src/server/tls/locked_dir_cache.rs

@@ -0,0 +1,94 @@
+use async_trait::async_trait;
+use fs2::FileExt; // for lock_exclusive, unlock
+use std::fs::OpenOptions;
+use std::io::Error as IoError;
+use std::path::{Path, PathBuf};
+use tokio_rustls_acme::caches::DirCache;
+use tokio_rustls_acme::{AccountCache, CertCache};
+
+/// A wrapper around DirCache that locks a file before writing cert/account data.
+pub struct LockedDirCache<P: AsRef<Path> + Send + Sync> {
+    inner: DirCache<P>,
+    lock_path: PathBuf,
+}
+
+impl<P: AsRef<Path> + Send + Sync> LockedDirCache<P> {
+    pub fn new(dir: P) -> Self {
+        let dir_path = dir.as_ref().to_path_buf();
+        let lock_path = dir_path.join(".acme.lock");
+        Self {
+            inner: DirCache::new(dir),
+            lock_path,
+        }
+    }
+
+    fn lock_exclusive(&self) -> Result<std::fs::File, IoError> {
+        let lockfile = OpenOptions::new()
+            .write(true)
+            .truncate(true)
+            .open(&self.lock_path)?;
+        lockfile.lock_exclusive()?;
+        Ok(lockfile)
+    }
+}
+
+#[async_trait]
+impl<P: AsRef<Path> + Send + Sync> CertCache for LockedDirCache<P> {
+    type EC = IoError;
+
+    async fn load_cert(
+        &self,
+        domains: &[String],
+        directory_url: &str,
+    ) -> Result<Option<Vec<u8>>, Self::EC> {
+        // Just delegate to the inner DirCache
+        self.inner.load_cert(domains, directory_url).await
+    }
+
+    async fn store_cert(
+        &self,
+        domains: &[String],
+        directory_url: &str,
+        cert: &[u8],
+    ) -> Result<(), Self::EC> {
+        // Acquire the lock before storing
+        let lockfile = self.lock_exclusive()?;
+
+        // Perform the store operation
+        let result = self.inner.store_cert(domains, directory_url, cert).await;
+
+        // Unlock and return
+        let _ = fs2::FileExt::unlock(&lockfile);
+        result
+    }
+}
+
+#[async_trait]
+impl<P: AsRef<Path> + Send + Sync> AccountCache for LockedDirCache<P> {
+    type EA = IoError;
+
+    async fn load_account(
+        &self,
+        contact: &[String],
+        directory_url: &str,
+    ) -> Result<Option<Vec<u8>>, Self::EA> {
+        self.inner.load_account(contact, directory_url).await
+    }
+
+    async fn store_account(
+        &self,
+        contact: &[String],
+        directory_url: &str,
+        account: &[u8],
+    ) -> Result<(), Self::EA> {
+        let lockfile = self.lock_exclusive()?;
+
+        let result = self
+            .inner
+            .store_account(contact, directory_url, account)
+            .await;
+
+        let _ = fs2::FileExt::unlock(&lockfile);
+        result
+    }
+}

data/ext/itsi_server/src/server/tls.rs

@@ -1,6 +1,7 @@
 use base64::{engine::general_purpose, Engine as _};
 use itsi_error::Result;
 use itsi_tracing::info;
+use locked_dir_cache::LockedDirCache;
 use rcgen::{CertificateParams, DnType, KeyPair, SanType};
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 use rustls_pemfile::{certs, pkcs8_private_keys};
@@ -12,8 +13,8 @@ use std::{
 };
 use tokio::sync::Mutex;
 use tokio_rustls::{rustls::ServerConfig, TlsAcceptor};
-use tokio_rustls_acme::{caches::DirCache, AcmeAcceptor, AcmeConfig, AcmeState};
-
+use tokio_rustls_acme::{AcmeAcceptor, AcmeConfig, AcmeState};
+mod locked_dir_cache;
 const ITS_CA_CERT: &str = include_str!("./itsi_ca/itsi_ca.crt");
 const ITS_CA_KEY: &str = include_str!("./itsi_ca/itsi_ca.key");
 
@@ -50,7 +51,7 @@ pub fn configure_tls(
             );
             let acme_state = AcmeConfig::new(domains)
                 .contact(["mailto:wc@pico.net.nz"])
-                .cache(DirCache::new("./rustls_acme_cache"))
+                .cache(LockedDirCache::new("./rustls_acme_cache"))
                 .directory(directory_url)
                 .state();
             let rustls_config = ServerConfig::builder()

data/lib/itsi/server/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Server
-    VERSION = "0.1.4"
+    VERSION = "0.1.5"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: itsi-server
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.5
 platform: ruby
 authors:
 - Wouter Coppieters
@@ -96,6 +96,7 @@ files:
 - ext/itsi_server/src/server/signal.rs
 - ext/itsi_server/src/server/thread_worker.rs
 - ext/itsi_server/src/server/tls.rs
+- ext/itsi_server/src/server/tls/locked_dir_cache.rs
 - ext/itsi_tracing/Cargo.lock
 - ext/itsi_tracing/Cargo.toml
 - ext/itsi_tracing/src/lib.rs