Add the native Go client and finish M3 hardening
The new cmd/tunnel client keeps the API URL and tunnel identity in ~/.config/tunnel/config.json (0600), provisions the key/CSR and certificate, terminates TLS, proxies to local routes, reloads routes without a restart, and runs as a background service. `tunnel import` takes over an existing official CLI profile, preserving its tunnel ID, token, key and certificate. Server hardening: per-IP and per-tunnel rate limits for creates and binds, a CA cool-down after repeated ACME failures, a startup sweep for stale _acme-challenge records, admin metrics, a 60-second half-close timeout, and separate prioritized control / ordered data bridge queues (with `end` ordered after the final bytes). The dashboard shows the new metrics.
This commit is contained in:
@@ -0,0 +1,200 @@
|
||||
package client
|
||||
|
||||
import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"time"
|
||||
)
|
||||
|
||||
// ErrCertificateExpired means a cached certificate can no longer be served.
|
||||
var ErrCertificateExpired = errors.New("certificate expired")
|
||||
|
||||
// EnsureIdentity loads (or creates) the tunnel's private key and CSR. The CSR
|
||||
// is reused byte-for-byte when it matches hostname, because binding a different
|
||||
// CSR makes the server issue a new certificate.
|
||||
func EnsureIdentity(paths Paths, hostname string) (keyPEM, csrPEM []byte, err error) {
|
||||
if err := os.MkdirAll(paths.Dir, 0o700); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
keyPEM, err = os.ReadFile(paths.Key)
|
||||
if err != nil && !errors.Is(err, os.ErrNotExist) {
|
||||
return nil, nil, err
|
||||
}
|
||||
var key *ecdsa.PrivateKey
|
||||
if len(keyPEM) > 0 {
|
||||
key, err = parseKey(keyPEM)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("private key: %w", err)
|
||||
}
|
||||
}
|
||||
if key == nil {
|
||||
key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
der, err := x509.MarshalPKCS8PrivateKey(key)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
keyPEM = pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der})
|
||||
if err := writeAtomic(paths.Key, keyPEM, 0o600); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
}
|
||||
|
||||
csrPEM, err = os.ReadFile(paths.CSR)
|
||||
if err == nil && csrMatches(csrPEM, hostname) {
|
||||
return keyPEM, csrPEM, nil
|
||||
}
|
||||
if err != nil && !errors.Is(err, os.ErrNotExist) {
|
||||
return nil, nil, err
|
||||
}
|
||||
csrPEM, err = generateCSR(key, hostname)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if err := writeAtomic(paths.CSR, csrPEM, 0o600); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return keyPEM, csrPEM, nil
|
||||
}
|
||||
|
||||
func parseKey(keyPEM []byte) (*ecdsa.PrivateKey, error) {
|
||||
block, _ := pem.Decode(keyPEM)
|
||||
if block == nil {
|
||||
return nil, errors.New("not a PEM private key")
|
||||
}
|
||||
parsed, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
key, ok := parsed.(*ecdsa.PrivateKey)
|
||||
if !ok {
|
||||
return nil, errors.New("not an ECDSA private key")
|
||||
}
|
||||
if key.Curve != elliptic.P256() {
|
||||
return nil, errors.New("not a P-256 private key")
|
||||
}
|
||||
return key, nil
|
||||
}
|
||||
|
||||
func generateCSR(key *ecdsa.PrivateKey, hostname string) ([]byte, error) {
|
||||
request := &x509.CertificateRequest{
|
||||
Subject: pkix.Name{CommonName: hostname},
|
||||
DNSNames: []string{hostname, "*." + hostname},
|
||||
}
|
||||
der, err := x509.CreateCertificateRequest(rand.Reader, request, key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: der}), nil
|
||||
}
|
||||
|
||||
func csrMatches(csrPEM []byte, hostname string) bool {
|
||||
block, _ := pem.Decode(csrPEM)
|
||||
if block == nil || block.Type != "CERTIFICATE REQUEST" {
|
||||
return false
|
||||
}
|
||||
csr, err := x509.ParseCertificateRequest(block.Bytes)
|
||||
if err != nil || csr.CheckSignature() != nil {
|
||||
return false
|
||||
}
|
||||
if csr.Subject.CommonName != hostname {
|
||||
return false
|
||||
}
|
||||
have := map[string]bool{}
|
||||
for _, name := range csr.DNSNames {
|
||||
have[name] = true
|
||||
}
|
||||
return have[hostname] && have["*."+hostname]
|
||||
}
|
||||
|
||||
// LoadCertificate loads cert.pem/chain.pem/private-key.pem and checks that the
|
||||
// certificate still covers hostname and has not expired.
|
||||
func LoadCertificate(paths Paths, hostname string) (tls.Certificate, time.Time, error) {
|
||||
keyPEM, err := os.ReadFile(paths.Key)
|
||||
if err != nil {
|
||||
return tls.Certificate{}, time.Time{}, err
|
||||
}
|
||||
certPEM, err := os.ReadFile(paths.Cert)
|
||||
if err != nil {
|
||||
return tls.Certificate{}, time.Time{}, err
|
||||
}
|
||||
chainPEM, err := os.ReadFile(paths.Chain)
|
||||
if err != nil && !errors.Is(err, os.ErrNotExist) {
|
||||
return tls.Certificate{}, time.Time{}, err
|
||||
}
|
||||
return parseCertificate(append(certPEM, chainPEM...), keyPEM, hostname)
|
||||
}
|
||||
|
||||
// SaveCertificate validates and stores a certificate from the API.
|
||||
func SaveCertificate(paths Paths, certPEM, chainPEM, keyPEM []byte, hostname string) (tls.Certificate, time.Time, error) {
|
||||
fullchain := append(append([]byte{}, certPEM...), chainPEM...)
|
||||
cert, expiry, err := parseCertificate(fullchain, keyPEM, hostname)
|
||||
if err != nil {
|
||||
return tls.Certificate{}, time.Time{}, err
|
||||
}
|
||||
if err := writeAtomic(paths.Cert, certPEM, 0o644); err != nil {
|
||||
return tls.Certificate{}, time.Time{}, err
|
||||
}
|
||||
if err := writeAtomic(paths.Chain, chainPEM, 0o644); err != nil {
|
||||
return tls.Certificate{}, time.Time{}, err
|
||||
}
|
||||
return cert, expiry, nil
|
||||
}
|
||||
|
||||
func parseCertificate(fullchainPEM, keyPEM []byte, hostname string) (tls.Certificate, time.Time, error) {
|
||||
cert, err := tls.X509KeyPair(fullchainPEM, keyPEM)
|
||||
if err != nil {
|
||||
return tls.Certificate{}, time.Time{}, fmt.Errorf("certificate/key: %w", err)
|
||||
}
|
||||
leaf, err := x509.ParseCertificate(cert.Certificate[0])
|
||||
if err != nil {
|
||||
return tls.Certificate{}, time.Time{}, err
|
||||
}
|
||||
if err := leaf.VerifyHostname(hostname); err != nil {
|
||||
return tls.Certificate{}, time.Time{}, fmt.Errorf("certificate does not cover %s: %w", hostname, err)
|
||||
}
|
||||
if time.Now().After(leaf.NotAfter) {
|
||||
return tls.Certificate{}, time.Time{}, ErrCertificateExpired
|
||||
}
|
||||
return cert, leaf.NotAfter, nil
|
||||
}
|
||||
|
||||
// CertificateExpiry parses the API's RFC 3339 expiry string.
|
||||
func CertificateExpiry(value string) (time.Time, error) {
|
||||
if value == "" {
|
||||
return time.Time{}, nil
|
||||
}
|
||||
return time.Parse(time.RFC3339, value)
|
||||
}
|
||||
|
||||
func writeAtomic(path string, data []byte, mode os.FileMode) error {
|
||||
tmp, err := os.CreateTemp(filepath.Dir(path), ".tunnel-*.tmp")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
name := tmp.Name()
|
||||
defer os.Remove(name)
|
||||
if err := tmp.Chmod(mode); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if _, err := tmp.Write(data); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
return os.Rename(name, path)
|
||||
}
|
||||
Reference in New Issue
Block a user