vpnmaker 0.0.0

data/lib/vpnmaker.rb

@@ -0,0 +1,45 @@
+require 'rubygems'
+
+require 'gibberish'
+require 'rubyzip'
+
+require 'fileutils'
+require 'yaml'
+require 'socket'
+
+require 'ipaddr'
+require 'ipaddr_extensions'
+require 'haml'
+
+require 'pry'
+
+class String
+  def path(p)
+    File.join(File.dirname(__FILE__), p)
+  end
+end
+
+class HashBinding < Object
+  def self.from_hash(h)
+    hb = self.new
+    h.each do |k, v|
+      hb.instance_variable_set("@#{k}", v)
+    end
+    hb
+  end
+
+  def binding; super; end # normally private
+end
+
+module VPNMaker
+  autoload :ConfigGenerator, './vpnmaker/config_generator'
+  autoload :KeyDB, './vpnmaker/key_db'
+  autoload :KeyConfig, './vpnmaker/key_config'
+  autoload :KeyTracker, './vpnmaker/key_tracker'
+  autoload :Manager, './vpnmaker/manager'
+  autoload :KeyBuilder, './vpnmaker/key_builder'
+
+  def self.generate(*args)
+    KeyTracker.generate(args.first, args.last)
+  end
+end

data/lib/vpnmaker/config_generator.rb

@@ -0,0 +1,36 @@
+module VPNMaker
+  class ConfigGenerator
+    def initialize(mgr)
+      @mgr = mgr
+    end
+
+    def client_conf(client)
+      {
+        :gen_host => Socket.gethostname,
+        :server => @mgr.config[:server],
+        :client => @mgr.config[:client]
+      }.merge(client)
+    end
+
+    def server_conf
+      {
+        :gen_host => Socket.gethostname
+      }.merge(@mgr.config[:server])
+    end
+
+    def server
+      haml_vars = server_conf.dup
+      haml_vars[:base_ip] = ((a = IPAddr.new haml_vars[:base_ip]); {:net => a.to_s, :mask => a.subnet_mask.to_s})
+      haml_vars[:bridgednets] = haml_vars[:bridgednets].map {|net| a = (IPAddr.new net); {:net => a.to_s, :mask => a.subnet_mask.to_s}}
+      haml_vars[:subnets] = haml_vars[:subnets].map {|net| a = (IPAddr.new net); {:net => a.to_s, :mask => a.subnet_mask.to_s}}
+      template = File.read(__FILE__.path('server.haml'))
+      Haml::Engine.new(template).render(Object.new, haml_vars)
+    end
+
+    def client(client)
+      haml_vars = client_conf(client).dup
+      template = File.read(__FILE__.path('client.haml'))
+      Haml::Engine.new(template).render(Object.new, haml_vars)
+    end
+  end
+end

data/lib/vpnmaker/key_builder.rb

@@ -0,0 +1,141 @@
+module VPNMaker
+  class KeyBuilder
+    def initialize(tracker, config)
+      @tmpdir = '/tmp/keybuilder'
+      clean_tmpdir
+      @tracker = tracker
+      @config = config
+    end
+
+    def clean_tmpdir
+      FileUtils.rm_rf(@tmpdir)
+      FileUtils.mkdir_p(@tmpdir)
+    end
+
+    def cnfpath; "/tmp/openssl-#{$$}.cnf"; end
+
+    def opensslvars
+      {
+        :key_size => 1024,
+        :key_dir => @tmpdir,
+        :key_country => @config[:key_properties][:country],
+        :key_province => @config[:key_properties][:province],
+        :key_city => @config[:key_properties][:city],
+        :key_org => @config[:key_properties][:organization],
+        :key_email => @config[:key_properties][:email],
+        :key_org => @config[:key_properties][:organization],
+        :key_ou => 'Organization Unit',
+        :key_cn => 'Common Name',
+        :key_name => 'Name'
+      }
+    end
+
+    def init
+      `touch #{@dir}/index.txt`
+      `echo 01 > #{@dir}/serial`
+    end
+
+    def opensslcnf(hash={})
+      c = cnfpath
+
+      File.open(cnfpath, 'w') do |f|
+        f.write(Haml::Engine.new(File.read __FILE__.path('openssl.haml')).render(Object.new, opensslvars.merge(hash)))
+      end
+
+      c
+    end
+
+    # Build Diffie-Hellman parameters for the server side of an SSL/TLS connection.
+    def build_dh_key(keysize=1024)
+      `openssl dhparam -out #{tmppath('dh.pem')} #{keysize}`
+      @tracker.set_dh(tmpfile('dh.pem'))
+    end
+
+    def ca
+      @tracker[:ca]
+    end
+
+    def gen_crl
+      `openssl ca -gencrl -crldays 3650 -keyfile #{tmppath('ca.key')} -cert #{tmppath('ca.crt')} -out #{tmppath('crl.pem')} -config #{opensslcnf}`
+    end
+
+    def build_ca
+      index = tmppath('index.txt')
+
+      FileUtils.touch(index)
+
+      `openssl req -batch -days 3650 -nodes -new -x509 -keyout #{@tmpdir}/ca.key -out #{@tmpdir}/ca.crt -config #{opensslcnf}`
+      gen_crl
+      @tracker.set_ca(tmpfile('ca.key'), tmpfile('ca.crt'), tmpfile('crl.pem'), tmpfile('index.txt'), "01\n")
+    end
+
+    def build_server_key
+      place_file('ca.crt')
+      place_file('ca.key')
+      place_file('index.txt')
+      place_file('serial')
+
+      `openssl req -batch -days 3650 -nodes -new -keyout #{tmppath('server.key')} -out #{tmppath('server.csr')} -extensions server -config #{opensslcnf}`
+      `openssl ca -batch -days 3650 -out #{tmppath('server.crt')} -in #{tmppath('server.csr')} -extensions server -config #{opensslcnf}`
+
+      @tracker.set_server_key(tmpfile('server.key'), tmpfile('server.crt'), tmpfile('index.txt'), tmpfile('serial'))
+    end
+
+    def build_ta_key
+      `openvpn --genkey --secret #{tmppath('ta.key')}`
+      @tracker.set_ta_key(tmpfile('ta.key'))
+    end
+
+    def place_file(name)
+      if data = @tracker.db.data(name)
+        File.open(File.join(@tmpdir, name), 'w') {|f| f.write(data)}
+      else
+        raise "No data for #{name}"
+      end
+    end
+
+    def tmppath(f, extn=nil); File.join(@tmpdir, extn ? "#{f}.#{extn}" : f); end
+    def tmpfile(*args); File.read(tmppath(*args)); end
+
+    def build_key(user, name, email, pass, delegate)
+      h = {:key_cn => user, :key_name => name, :key_email => email}
+      place_file('ca.crt')
+      place_file('ca.key')
+      place_file('index.txt')
+      place_file('serial')
+      if pass
+        pass_spec = "-passin 'pass:#{pass}' -passout 'pass:#{pass}'"
+      else
+        pass_spec = '-nodes'
+      end
+
+      `openssl req -batch -days 3650 -new -keyout #{tmppath(user, 'key')} -out #{tmppath(user, 'csr')} -config #{opensslcnf(h)} #{pass_spec}`
+      `openssl ca -batch -days 3650 -out #{tmppath(user, 'crt')} -in #{tmppath(user, 'csr')} -config #{opensslcnf(h)}`
+      # TODO: this still asks for the export password
+      `openssl pkcs12 -export -clcerts -in #{tmppath(user, 'crt')} -inkey #{tmppath(user, 'key')} -out #{tmppath(user, 'p12')} #{pass_spec}`
+      @tracker.send(delegate, user, name, email, tmpfile(user, 'key'), tmpfile(user, 'crt'), tmpfile(user, 'p12'), tmpfile('index.txt'), tmpfile('serial'))
+    end
+
+    def revoke_key(user, version)
+      h = {:key_cn => ""}
+      place_file('ca.crt')
+      place_file('ca.key')
+      place_file('crl.pem')
+      place_file('index.txt')
+      place_file('serial')
+
+      user_crt = tmppath(user, 'crt')
+      rev_crt = tmppath('rev-test.crt')
+      File.open(user_crt, 'w') {|f| f.write(@tracker.key(user, version, 'crt'))}
+      `openssl ca -revoke #{user_crt} -keyfile #{tmppath('ca.key')} -cert #{tmppath('ca.crt')} -config #{opensslcnf(h)}`
+      gen_crl
+
+      File.open(rev_crt, 'w') {|f| f.write(File.read(tmppath('ca.crt'))); f.write(File.read(tmppath('crl.pem')))}
+      if `openssl verify -CAfile #{rev_crt} -crl_check #{user_crt}` =~ /certificate revoked/
+        @tracker.user_key_revoked(user, version, tmpfile('crl.pem'), tmpfile('index.txt'))
+      else
+        raise "Revocation verification failed: openssl isn't recognizing it"
+      end
+    end
+  end
+end

data/lib/vpnmaker/key_config.rb

@@ -0,0 +1,9 @@
+module VPNMaker
+  class KeyConfig
+    def initialize(path)
+      @config = YAML.load_file(path)
+    end
+
+    def [](k); @config[k]; end
+  end
+end

data/lib/vpnmaker/key_db.rb

@@ -0,0 +1,62 @@
+module VPNMaker
+  class KeyDB
+    def initialize(path)
+      @path = path
+      @db = File.exists?(path) ? YAML.load_file(path) : {}
+      @touched = false
+    end
+
+    def [](k); @db[k]; end
+
+    def []=(k, v)
+      @db[k] = v
+      @db[:modified] = Time.now
+      @touched = true
+    end
+
+    def touched!
+      @touched = true
+      @db[:modified] = Time.now
+    end
+
+
+    def datadir; self[:datadir]; end
+
+    def data_path(k)
+      File.join(File.dirname(@path), self.datadir, k)
+    end
+
+    def dump(k, v, overwrite=false)
+      p = data_path(k)
+      raise "#{k} already exists" if File.exists?(p) && !overwrite
+      File.open(p, 'w') {|f| f.write(v)}
+      @touched = true
+    end
+
+    def data(k)
+      File.exists?(data_path(k)) ? File.read(data_path(k)) : nil
+    end
+
+    def disk_version
+      File.exists?(@path) ? YAML.load_file(@path)[:version] : 0
+    end
+
+    def sync
+      if disk_version == @db[:version]
+        if @touched
+          FileUtils.mkdir_p(self.datadir)
+          @db[:version] += 1
+          File.open(@path, 'w') {|f| f.write(@db.to_yaml)}
+          true
+        else
+          false
+        end
+      else
+        raise "Disk version of #{@path} (#{disk_version}) != loaded version (#{@db[:version]}). " + \
+        "Try reloading and making your changes again."
+      end
+    end
+
+    def version; @db[:version]; end
+  end
+end

data/lib/vpnmaker/key_tracker.rb

@@ -0,0 +1,158 @@
+module VPNMaker
+  class KeyTracker
+    attr_reader :builder
+    attr_reader :db
+    attr_reader :config
+
+    def self.generate(name, path=nil)
+      path ||= '/tmp'
+      dir = File.join(File.expand_path(path), name + '.vpn')
+
+      FileUtils.mkdir_p(dir)
+      datadir = "#{name}_data"
+      dbpath = File.join(dir, "#{name}.db.yaml")
+
+      d = KeyDB.new(dbpath)
+      d[:version] = 0
+      d[:modified] = Time.now
+      d[:users] = {}
+      d[:datadir] = datadir
+      d.sync
+    end
+
+    def assert_user(user)
+      raise "User doesn't exist: #{user}" unless @db[:users][user]
+    end
+
+    def ca; @db[:ca]; end
+
+    def set_ca(key, crt, crl, index, serial)
+      raise "CA already set" if @db[:ca]
+
+      @db[:ca] = {:modified => Time.now}
+      @db.dump('ca.key', key)
+      @db.dump('ca.crt', crt)
+      @db.dump('crl.pem', crl)
+      @db.dump('index.txt', index)
+      @db.dump('serial', serial)
+      @db.touched!
+      @db.sync
+    end
+
+    def set_server_key(key, crt, index, serial)
+      raise "Server key already set" if @db[:server]
+
+      @db[:server] = {:modified => Time.now}
+      @db.dump('server.key', key)
+      @db.dump('server.crt', crt)
+      @db.dump('index.txt', index, true)
+      @db.dump('serial', serial, true)
+      @db.touched!
+      @db.sync
+    end
+
+    def set_ta_key(ta)
+      raise "TA key already set" if @db[:ta]
+
+      @db[:ta] = {:modified => Time.now}
+      @db.dump('ta.key', ta)
+      @db.touched!
+      @db.sync
+    end
+
+    def set_dh(dh)
+      raise "DH key already set" if @db[:dh]
+
+      @db[:dh] = {:modified => Time.now}
+      @db.dump('dh.pem', dh)
+      @db.touched!
+      @db.sync
+    end
+
+    def add_key(user, key, crt, p12, ver)
+      @db.dump("#{user}-#{ver}.key", key)
+      @db.dump("#{user}-#{ver}.crt", crt)
+      @db.dump("#{user}-#{ver}.p12", p12)
+    end
+
+    def key(user, ver, type)
+      @db.data("#{user}-#{ver}.#{type}")
+    end
+
+    def add_user(user, name, email, key, crt, p12, index, serial)
+      raise "User must be a non-empty string" unless user.is_a?(String) && user.size > 0
+      raise "User already exists: #{user}" if @db[:users][user]
+
+      @db[:users][user] = {
+        :user => user,
+        :name => name,
+        :email => email,
+        :active_key => 0,
+        :revoked => [],
+        :modified => Time.now
+      }
+      @db.dump('serial', serial, true)
+      @db.dump('index.txt', index, true)
+      add_key(user, key, crt, p12, 0)
+      @db.touched!
+      @db.sync
+    end
+
+    def add_user_key(user, name, email, key, crt, p12, index, serial)
+      assert_user(user)
+
+      u = @db[:users][user]
+      u[:modified] = Time.now
+      u[:active_key] += 1
+      add_key(user, key, crt, p12, u[:active_key])
+
+      @db.dump('serial', serial, true)
+      @db.dump('index.txt', index, true)
+
+      @db.touched!
+      @db.sync
+    end
+
+    def user_key_revoked(user, version, crl, index)
+      assert_user(user)
+
+      raise "Verison must be an int" unless version.kind_of?(Integer)
+      u = @db[:users][user]
+      u[:revoked] << version
+      u[:modified] = Time.now
+      @db.dump('index.txt', index, true)
+      @db.dump('crl.pem', crl, true)
+      @db.touched!
+      @db.sync
+    end
+
+    def revoked?(user, version)
+      assert_user(user)
+
+      @db[:users][user][:revoked].include?(version)
+    end
+
+    def active_key_version(user)
+      assert_user(user)
+
+      @db[:users][user][:active_key]
+    end
+
+    def user(user)
+      assert_user(user)
+      @db[:users][user]
+    end
+
+    def users; @db[:users]; end
+
+    def initialize(name, dir)
+      @db = KeyDB.new(File.join(dir, name + '.db.yaml'))
+      @config = KeyConfig.new(File.join(dir, name + '.config.yaml'))
+      @builder = KeyBuilder.new(self, @config)
+    end
+  end
+
+  def self.generate(name, path)
+    KeyTracker.generate(name, path)
+  end
+end