Changeset 325 in code for trunk/service.go
- Timestamp:
- Jun 8, 2020, 8:30:09 PM (5 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/service.go
r315 r325 121 121 usage: "-addr <addr> [-name name] [-username username] [-pass pass] [-realname realname] [-nick nick] [-connect-command command]...", 122 122 desc: "add a new network", 123 handle: handleService CreateNetwork,123 handle: handleServiceNetworkCreate, 124 124 }, 125 125 "status": { … … 164 164 }, 165 165 } 166 }167 168 func handleServiceCertfpGenerate(dc *downstreamConn, params []string) error {169 fs := newFlagSet()170 keyType := fs.String("key-type", "rsa", "key type to generate (rsa, ecdsa, ed25519)")171 bits := fs.Int("bits", 3072, "size of key to generate, meaningful only for RSA")172 173 if err := fs.Parse(params); err != nil {174 return err175 }176 177 if len(fs.Args()) != 1 {178 return errors.New("exactly one argument is required")179 }180 181 net := dc.user.getNetwork(fs.Arg(0))182 if net == nil {183 return fmt.Errorf("unknown network %q", fs.Arg(0))184 }185 186 var (187 privKey crypto.PrivateKey188 pubKey crypto.PublicKey189 )190 switch *keyType {191 case "rsa":192 key, err := rsa.GenerateKey(rand.Reader, *bits)193 if err != nil {194 return err195 }196 privKey = key197 pubKey = key.Public()198 case "ecdsa":199 key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)200 if err != nil {201 return err202 }203 privKey = key204 pubKey = key.Public()205 case "ed25519":206 var err error207 pubKey, privKey, err = ed25519.GenerateKey(rand.Reader)208 if err != nil {209 return err210 }211 }212 213 // Using PKCS#8 allows easier extension for new key types.214 privKeyBytes, err := x509.MarshalPKCS8PrivateKey(privKey)215 if err != nil {216 return err217 }218 219 notBefore := time.Now()220 // Lets make a fair assumption nobody will use the same cert for more than 20 years...221 notAfter := notBefore.Add(24 * time.Hour * 365 * 20)222 serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)223 serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)224 if err != nil {225 return err226 }227 cert := &x509.Certificate{228 SerialNumber: serialNumber,229 Subject: pkix.Name{CommonName: "soju auto-generated certificate"},230 NotBefore: notBefore,231 NotAfter: notAfter,232 KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,233 ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},234 }235 derBytes, err := x509.CreateCertificate(rand.Reader, cert, cert, pubKey, privKey)236 if err != nil {237 return err238 }239 240 net.SASL.External.CertBlob = derBytes241 net.SASL.External.PrivKeyBlob = privKeyBytes242 net.SASL.Mechanism = "EXTERNAL"243 244 if err := dc.srv.db.StoreNetwork(net.Username, &net.Network); err != nil {245 return err246 }247 248 sendServicePRIVMSG(dc, "certificate generated")249 250 sha1Sum := sha1.Sum(derBytes)251 sendServicePRIVMSG(dc, "SHA-1 fingerprint: "+hex.EncodeToString(sha1Sum[:]))252 sha256Sum := sha256.Sum256(derBytes)253 sendServicePRIVMSG(dc, "SHA-256 fingerprint: "+hex.EncodeToString(sha256Sum[:]))254 255 return nil256 }257 258 func handleServiceCertfpFingerprints(dc *downstreamConn, params []string) error {259 if len(params) != 1 {260 return fmt.Errorf("expected exactly one argument")261 }262 263 net := dc.user.getNetwork(params[0])264 if net == nil {265 return fmt.Errorf("unknown network %q", params[0])266 }267 268 sha1Sum := sha1.Sum(net.SASL.External.CertBlob)269 sendServicePRIVMSG(dc, "SHA-1 fingerprint: "+hex.EncodeToString(sha1Sum[:]))270 sha256Sum := sha256.Sum256(net.SASL.External.CertBlob)271 sendServicePRIVMSG(dc, "SHA-256 fingerprint: "+hex.EncodeToString(sha256Sum[:]))272 return nil273 }274 275 func handleServiceCertfpReset(dc *downstreamConn, params []string) error {276 if len(params) != 1 {277 return fmt.Errorf("expected exactly one argument")278 }279 280 net := dc.user.getNetwork(params[0])281 if net == nil {282 return fmt.Errorf("unknown network %q", params[0])283 }284 285 net.SASL.External.CertBlob = nil286 net.SASL.External.PrivKeyBlob = nil287 288 if net.SASL.Mechanism == "EXTERNAL" {289 net.SASL.Mechanism = ""290 }291 if err := dc.srv.db.StoreNetwork(dc.user.Username, &net.Network); err != nil {292 return err293 }294 295 sendServicePRIVMSG(dc, "certificate reset")296 return nil297 166 } 298 167 … … 435 304 } 436 305 437 func handleService CreateNetwork(dc *downstreamConn, params []string) error {306 func handleServiceNetworkCreate(dc *downstreamConn, params []string) error { 438 307 fs := newNetworkFlagSet() 439 308 if err := fs.Parse(params); err != nil { … … 544 413 } 545 414 415 func handleServiceCertfpGenerate(dc *downstreamConn, params []string) error { 416 fs := newFlagSet() 417 keyType := fs.String("key-type", "rsa", "key type to generate (rsa, ecdsa, ed25519)") 418 bits := fs.Int("bits", 3072, "size of key to generate, meaningful only for RSA") 419 420 if err := fs.Parse(params); err != nil { 421 return err 422 } 423 424 if len(fs.Args()) != 1 { 425 return errors.New("exactly one argument is required") 426 } 427 428 net := dc.user.getNetwork(fs.Arg(0)) 429 if net == nil { 430 return fmt.Errorf("unknown network %q", fs.Arg(0)) 431 } 432 433 var ( 434 privKey crypto.PrivateKey 435 pubKey crypto.PublicKey 436 ) 437 switch *keyType { 438 case "rsa": 439 key, err := rsa.GenerateKey(rand.Reader, *bits) 440 if err != nil { 441 return err 442 } 443 privKey = key 444 pubKey = key.Public() 445 case "ecdsa": 446 key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader) 447 if err != nil { 448 return err 449 } 450 privKey = key 451 pubKey = key.Public() 452 case "ed25519": 453 var err error 454 pubKey, privKey, err = ed25519.GenerateKey(rand.Reader) 455 if err != nil { 456 return err 457 } 458 } 459 460 // Using PKCS#8 allows easier extension for new key types. 461 privKeyBytes, err := x509.MarshalPKCS8PrivateKey(privKey) 462 if err != nil { 463 return err 464 } 465 466 notBefore := time.Now() 467 // Lets make a fair assumption nobody will use the same cert for more than 20 years... 468 notAfter := notBefore.Add(24 * time.Hour * 365 * 20) 469 serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) 470 serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) 471 if err != nil { 472 return err 473 } 474 cert := &x509.Certificate{ 475 SerialNumber: serialNumber, 476 Subject: pkix.Name{CommonName: "soju auto-generated certificate"}, 477 NotBefore: notBefore, 478 NotAfter: notAfter, 479 KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, 480 ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, 481 } 482 derBytes, err := x509.CreateCertificate(rand.Reader, cert, cert, pubKey, privKey) 483 if err != nil { 484 return err 485 } 486 487 net.SASL.External.CertBlob = derBytes 488 net.SASL.External.PrivKeyBlob = privKeyBytes 489 net.SASL.Mechanism = "EXTERNAL" 490 491 if err := dc.srv.db.StoreNetwork(net.Username, &net.Network); err != nil { 492 return err 493 } 494 495 sendServicePRIVMSG(dc, "certificate generated") 496 497 sha1Sum := sha1.Sum(derBytes) 498 sendServicePRIVMSG(dc, "SHA-1 fingerprint: "+hex.EncodeToString(sha1Sum[:])) 499 sha256Sum := sha256.Sum256(derBytes) 500 sendServicePRIVMSG(dc, "SHA-256 fingerprint: "+hex.EncodeToString(sha256Sum[:])) 501 502 return nil 503 } 504 505 func handleServiceCertfpFingerprints(dc *downstreamConn, params []string) error { 506 if len(params) != 1 { 507 return fmt.Errorf("expected exactly one argument") 508 } 509 510 net := dc.user.getNetwork(params[0]) 511 if net == nil { 512 return fmt.Errorf("unknown network %q", params[0]) 513 } 514 515 sha1Sum := sha1.Sum(net.SASL.External.CertBlob) 516 sendServicePRIVMSG(dc, "SHA-1 fingerprint: "+hex.EncodeToString(sha1Sum[:])) 517 sha256Sum := sha256.Sum256(net.SASL.External.CertBlob) 518 sendServicePRIVMSG(dc, "SHA-256 fingerprint: "+hex.EncodeToString(sha256Sum[:])) 519 return nil 520 } 521 522 func handleServiceCertfpReset(dc *downstreamConn, params []string) error { 523 if len(params) != 1 { 524 return fmt.Errorf("expected exactly one argument") 525 } 526 527 net := dc.user.getNetwork(params[0]) 528 if net == nil { 529 return fmt.Errorf("unknown network %q", params[0]) 530 } 531 532 net.SASL.External.CertBlob = nil 533 net.SASL.External.PrivKeyBlob = nil 534 535 if net.SASL.Mechanism == "EXTERNAL" { 536 net.SASL.Mechanism = "" 537 } 538 if err := dc.srv.db.StoreNetwork(dc.user.Username, &net.Network); err != nil { 539 return err 540 } 541 542 sendServicePRIVMSG(dc, "certificate reset") 543 return nil 544 } 545 546 546 func handlePasswordChange(dc *downstreamConn, params []string) error { 547 547 if len(params) != 1 {
Note:
See TracChangeset
for help on using the changeset viewer.