test(cth-tls): add test helpers for TLS related activities
Currently, only certificate issuing and related utilities are there.
This commit is contained in:
Andrew Mayorov
parent
78d3f49fe4
commit
3d679f7e26
|
|
@ -0,0 +1,339 @@
|
||||||
|
%%--------------------------------------------------------------------
|
||||||
|
%% Copyright (c) 2023 EMQ Technologies Co., Ltd. All Rights Reserved.
|
||||||
|
%%
|
||||||
|
%% Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
%% you may not use this file except in compliance with the License.
|
||||||
|
%% You may obtain a copy of the License at
|
||||||
|
%%
|
||||||
|
%% http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
%%
|
||||||
|
%% Unless required by applicable law or agreed to in writing, software
|
||||||
|
%% distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
%% See the License for the specific language governing permissions and
|
||||||
|
%% limitations under the License.
|
||||||
|
%%--------------------------------------------------------------------
|
||||||
|
|
||||||
|
-module(emqx_cth_tls).
|
||||||
|
|
||||||
|
-include_lib("public_key/include/public_key.hrl").
|
||||||
|
|
||||||
|
-export([gen_cert/1]).
|
||||||
|
-export([write_cert/2]).
|
||||||
|
-export([write_cert/3]).
|
||||||
|
-export([write_pem/2]).
|
||||||
|
|
||||||
|
%% -------------------------------------------------------------------
|
||||||
|
%% Certificate Issuing
|
||||||
|
%% Heavily inspired by: ${ERL_SRC}/lib/public_key/test/erl_make_certs.erl
|
||||||
|
%% -------------------------------------------------------------------
|
||||||
|
|
||||||
|
-type pem_entry() :: public_key:pem_entry().
|
||||||
|
-type certificate() :: pem_entry().
|
||||||
|
-type private_key() :: pem_entry().
|
||||||
|
|
||||||
|
-type cert_subject() :: #{
|
||||||
|
name => string(),
|
||||||
|
email => string(),
|
||||||
|
city => string(),
|
||||||
|
state => string(),
|
||||||
|
org => string(),
|
||||||
|
org_unit => string(),
|
||||||
|
country => string(),
|
||||||
|
serial => string(),
|
||||||
|
title => string(),
|
||||||
|
dnQualifer => string()
|
||||||
|
}.
|
||||||
|
|
||||||
|
-type cert_validity() ::
|
||||||
|
{_From :: calendar:date(), _To :: calendar:date()}.
|
||||||
|
|
||||||
|
-type cert_extensions() :: #{
|
||||||
|
basic_constraints => false | ca | _PathLenContraint :: pos_integer(),
|
||||||
|
key_usage => false | certsign
|
||||||
|
}.
|
||||||
|
|
||||||
|
%% @doc Generate a certificate and a private key.
|
||||||
|
%% If you need root (CA) certificate, use `root` as `issuer` option. By default, the
|
||||||
|
%% generated certificate will have according extensions (constraints, key usage, etc).
|
||||||
|
%% Once root certificate + private key pair is generated, you can use the result
|
||||||
|
%% as `issuer` option to generate other certificates signed by this root.
|
||||||
|
-spec gen_cert(Opts) -> {certificate(), private_key()} when
|
||||||
|
Opts :: #{
|
||||||
|
key := ec | rsa | PrivKeyIn,
|
||||||
|
issuer := root | {CertificateIn, PrivKeyIn},
|
||||||
|
subject => cert_subject(),
|
||||||
|
validity => cert_validity(),
|
||||||
|
extensions => cert_extensions() | false
|
||||||
|
},
|
||||||
|
CertificateIn :: certificate() | public_key:der_encoded() | #'OTPCertificate'{},
|
||||||
|
PrivKeyIn :: private_key() | _PEM :: binary().
|
||||||
|
gen_cert(Opts) ->
|
||||||
|
SubjectPrivateKey = get_privkey(Opts),
|
||||||
|
{TBSCert, IssuerKey} = make_tbs(SubjectPrivateKey, Opts),
|
||||||
|
Cert = public_key:pkix_sign(TBSCert, IssuerKey),
|
||||||
|
true = verify_signature(Cert, IssuerKey),
|
||||||
|
{encode_cert(Cert), encode_privkey(SubjectPrivateKey)}.
|
||||||
|
|
||||||
|
get_privkey(#{key := Algo}) when is_atom(Algo) ->
|
||||||
|
gen_privkey(Algo);
|
||||||
|
get_privkey(#{key := Key}) ->
|
||||||
|
decode_privkey(Key).
|
||||||
|
|
||||||
|
make_tbs(SubjectKey, Opts) ->
|
||||||
|
{Issuer, IssuerKey} = issuer(Opts, SubjectKey),
|
||||||
|
Subject =
|
||||||
|
case Opts of
|
||||||
|
#{issuer := root} ->
|
||||||
|
Issuer;
|
||||||
|
#{} ->
|
||||||
|
subject(Opts)
|
||||||
|
end,
|
||||||
|
{
|
||||||
|
#'OTPTBSCertificate'{
|
||||||
|
version = v3,
|
||||||
|
serialNumber = rand:uniform(1000000000000),
|
||||||
|
signature = sign_algorithm(IssuerKey, Opts),
|
||||||
|
issuer = Issuer,
|
||||||
|
validity = validity(Opts),
|
||||||
|
subject = Subject,
|
||||||
|
subjectPublicKeyInfo = publickey(SubjectKey),
|
||||||
|
extensions = extensions(Opts)
|
||||||
|
},
|
||||||
|
IssuerKey
|
||||||
|
}.
|
||||||
|
|
||||||
|
issuer(Opts = #{issuer := root}, SubjectKey) ->
|
||||||
|
%% Self signed
|
||||||
|
{subject(Opts), SubjectKey};
|
||||||
|
issuer(#{issuer := {Issuer, IssuerKey}}, _SubjectKey) ->
|
||||||
|
{issuer_subject(Issuer), decode_privkey(IssuerKey)}.
|
||||||
|
|
||||||
|
issuer_subject({'Certificate', IssuerDer, _}) when is_binary(IssuerDer) ->
|
||||||
|
issuer_subject(IssuerDer);
|
||||||
|
issuer_subject(IssuerDer) when is_binary(IssuerDer) ->
|
||||||
|
issuer_subject(public_key:pkix_decode_cert(IssuerDer, otp));
|
||||||
|
issuer_subject(#'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Subject}}) ->
|
||||||
|
Subject.
|
||||||
|
|
||||||
|
subject(Opts = #{}) ->
|
||||||
|
Subject = maps:get(subject, Opts, #{}),
|
||||||
|
Entries = maps:map(
|
||||||
|
fun(N, V) -> [subject_entry(N, V)] end,
|
||||||
|
maps:merge(default_subject(Opts), Subject)
|
||||||
|
),
|
||||||
|
{rdnSequence, maps:values(Entries)}.
|
||||||
|
|
||||||
|
subject_entry(name, Name) ->
|
||||||
|
typed_attr(?'id-at-commonName', {printableString, Name});
|
||||||
|
subject_entry(email, Email) ->
|
||||||
|
typed_attr(?'id-emailAddress', Email);
|
||||||
|
subject_entry(city, City) ->
|
||||||
|
typed_attr(?'id-at-localityName', {printableString, City});
|
||||||
|
subject_entry(state, State) ->
|
||||||
|
typed_attr(?'id-at-stateOrProvinceName', {printableString, State});
|
||||||
|
subject_entry(org, Org) ->
|
||||||
|
typed_attr(?'id-at-organizationName', {printableString, Org});
|
||||||
|
subject_entry(org_unit, OrgUnit) ->
|
||||||
|
typed_attr(?'id-at-organizationalUnitName', {printableString, OrgUnit});
|
||||||
|
subject_entry(country, Country) ->
|
||||||
|
typed_attr(?'id-at-countryName', Country);
|
||||||
|
subject_entry(serial, Serial) ->
|
||||||
|
typed_attr(?'id-at-serialNumber', Serial);
|
||||||
|
subject_entry(title, Title) ->
|
||||||
|
typed_attr(?'id-at-title', {printableString, Title});
|
||||||
|
subject_entry(dnQualifer, DnQ) ->
|
||||||
|
typed_attr(?'id-at-dnQualifier', DnQ).
|
||||||
|
|
||||||
|
subject_info(Info, Subject, Default) ->
|
||||||
|
case subject_info(Info, Subject) of
|
||||||
|
undefined -> Default;
|
||||||
|
Value -> Value
|
||||||
|
end.
|
||||||
|
|
||||||
|
subject_info(Info, {rdnSequence, Entries}) ->
|
||||||
|
subject_info(Info, Entries);
|
||||||
|
subject_info(name, Entries) when is_list(Entries) ->
|
||||||
|
get_string(find_subject_entry(?'id-at-commonName', Entries));
|
||||||
|
subject_info(org, Entries) when is_list(Entries) ->
|
||||||
|
get_string(find_subject_entry(?'id-at-organizationName', Entries));
|
||||||
|
subject_info(org_unit, Entries) when is_list(Entries) ->
|
||||||
|
get_string(find_subject_entry(?'id-at-organizationalUnitName', Entries));
|
||||||
|
subject_info(country, Entries) when is_list(Entries) ->
|
||||||
|
find_subject_entry(?'id-at-countryName', Entries).
|
||||||
|
|
||||||
|
find_subject_entry(Oid, Entries) ->
|
||||||
|
emqx_maybe:from_list([
|
||||||
|
Value
|
||||||
|
|| Attrs <- Entries,
|
||||||
|
#'AttributeTypeAndValue'{type = T, value = Value} <- Attrs,
|
||||||
|
T =:= Oid
|
||||||
|
]).
|
||||||
|
|
||||||
|
get_string({printableString, String}) ->
|
||||||
|
String;
|
||||||
|
get_string(undefined) ->
|
||||||
|
undefined.
|
||||||
|
|
||||||
|
typed_attr(Type, Value) ->
|
||||||
|
#'AttributeTypeAndValue'{type = Type, value = Value}.
|
||||||
|
|
||||||
|
sign_algorithm(#'ECPrivateKey'{parameters = Parms}, _Opts) ->
|
||||||
|
#'SignatureAlgorithm'{
|
||||||
|
algorithm = ?'ecdsa-with-SHA256',
|
||||||
|
parameters = Parms
|
||||||
|
}.
|
||||||
|
|
||||||
|
validity(Opts) ->
|
||||||
|
{From, To} = maps:get(validity, Opts, default_validity()),
|
||||||
|
#'Validity'{
|
||||||
|
notBefore = {generalTime, format_date(From)},
|
||||||
|
notAfter = {generalTime, format_date(To)}
|
||||||
|
}.
|
||||||
|
|
||||||
|
publickey(#'ECPrivateKey'{parameters = Params, publicKey = PubKey}) ->
|
||||||
|
#'OTPSubjectPublicKeyInfo'{
|
||||||
|
algorithm = #'PublicKeyAlgorithm'{
|
||||||
|
algorithm = ?'id-ecPublicKey',
|
||||||
|
parameters = Params
|
||||||
|
},
|
||||||
|
subjectPublicKey = #'ECPoint'{point = PubKey}
|
||||||
|
}.
|
||||||
|
|
||||||
|
extensions(#{extensions := false}) ->
|
||||||
|
asn1_NOVALUE;
|
||||||
|
extensions(Opts) ->
|
||||||
|
Exts = maps:get(extensions, Opts, #{}),
|
||||||
|
Default = default_extensions(Opts),
|
||||||
|
maps:fold(
|
||||||
|
fun(Name, Data, Acc) -> Acc ++ extension(Name, Data) end,
|
||||||
|
[],
|
||||||
|
maps:merge(Default, Exts)
|
||||||
|
).
|
||||||
|
|
||||||
|
extension(basic_constraints, false) ->
|
||||||
|
[];
|
||||||
|
extension(basic_constraints, ca) ->
|
||||||
|
[
|
||||||
|
#'Extension'{
|
||||||
|
extnID = ?'id-ce-basicConstraints',
|
||||||
|
extnValue = #'BasicConstraints'{cA = true},
|
||||||
|
critical = true
|
||||||
|
}
|
||||||
|
];
|
||||||
|
extension(basic_constraints, Len) when is_integer(Len) ->
|
||||||
|
[
|
||||||
|
#'Extension'{
|
||||||
|
extnID = ?'id-ce-basicConstraints',
|
||||||
|
extnValue = #'BasicConstraints'{cA = true, pathLenConstraint = Len},
|
||||||
|
critical = true
|
||||||
|
}
|
||||||
|
];
|
||||||
|
extension(key_usage, false) ->
|
||||||
|
[];
|
||||||
|
extension(key_usage, certsign) ->
|
||||||
|
[
|
||||||
|
#'Extension'{
|
||||||
|
extnID = ?'id-ce-keyUsage',
|
||||||
|
extnValue = [keyCertSign],
|
||||||
|
critical = true
|
||||||
|
}
|
||||||
|
].
|
||||||
|
|
||||||
|
default_validity() ->
|
||||||
|
{shift_date(date(), -1), shift_date(date(), +7)}.
|
||||||
|
|
||||||
|
default_subject(#{issuer := root}) ->
|
||||||
|
#{
|
||||||
|
name => "RootCA",
|
||||||
|
org => "EMQ",
|
||||||
|
org_unit => "EMQX",
|
||||||
|
country => "CN"
|
||||||
|
};
|
||||||
|
default_subject(#{}) ->
|
||||||
|
#{
|
||||||
|
name => "Server",
|
||||||
|
org => "EMQ",
|
||||||
|
org_unit => "EMQX",
|
||||||
|
country => "CN"
|
||||||
|
}.
|
||||||
|
|
||||||
|
default_extensions(#{issuer := root}) ->
|
||||||
|
#{
|
||||||
|
basic_constraints => ca,
|
||||||
|
key_usage => certsign
|
||||||
|
};
|
||||||
|
default_extensions(#{}) ->
|
||||||
|
#{}.
|
||||||
|
|
||||||
|
%% -------------------------------------------------------------------
|
||||||
|
|
||||||
|
verify_signature(CertDer, #'ECPrivateKey'{parameters = Params, publicKey = PubKey}) ->
|
||||||
|
public_key:pkix_verify(CertDer, {#'ECPoint'{point = PubKey}, Params});
|
||||||
|
verify_signature(CertDer, KeyPem) ->
|
||||||
|
verify_signature(CertDer, decode_privkey(KeyPem)).
|
||||||
|
|
||||||
|
%% -------------------------------------------------------------------
|
||||||
|
|
||||||
|
gen_privkey(ec) ->
|
||||||
|
public_key:generate_key({namedCurve, secp256k1});
|
||||||
|
gen_privkey(rsa) ->
|
||||||
|
public_key:generate_key({rsa, 2048, 17}).
|
||||||
|
|
||||||
|
decode_privkey(#'ECPrivateKey'{} = Key) ->
|
||||||
|
Key;
|
||||||
|
decode_privkey(#'RSAPrivateKey'{} = Key) ->
|
||||||
|
Key;
|
||||||
|
decode_privkey(PemEntry = {_, _, _}) ->
|
||||||
|
public_key:pem_entry_decode(PemEntry);
|
||||||
|
decode_privkey(PemBinary) when is_binary(PemBinary) ->
|
||||||
|
[KeyInfo] = public_key:pem_decode(PemBinary),
|
||||||
|
decode_privkey(KeyInfo).
|
||||||
|
|
||||||
|
-spec encode_privkey(#'ECPrivateKey'{} | #'RSAPrivateKey'{}) -> private_key().
|
||||||
|
encode_privkey(Key = #'ECPrivateKey'{}) ->
|
||||||
|
{ok, Der} = 'OTP-PUB-KEY':encode('ECPrivateKey', Key),
|
||||||
|
{'ECPrivateKey', Der, not_encrypted};
|
||||||
|
encode_privkey(Key = #'RSAPrivateKey'{}) ->
|
||||||
|
{ok, Der} = 'OTP-PUB-KEY':encode('RSAPrivateKey', Key),
|
||||||
|
{'RSAPrivateKey', Der, not_encrypted}.
|
||||||
|
|
||||||
|
-spec encode_cert(public_key:der_encoded()) -> certificate().
|
||||||
|
encode_cert(Der) ->
|
||||||
|
{'Certificate', Der, not_encrypted}.
|
||||||
|
|
||||||
|
%% -------------------------------------------------------------------
|
||||||
|
|
||||||
|
shift_date(Date, Offset) ->
|
||||||
|
calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(Date) + Offset).
|
||||||
|
|
||||||
|
format_date({Y, M, D}) ->
|
||||||
|
lists:flatten(io_lib:format("~w~2..0w~2..0w000000Z", [Y, M, D])).
|
||||||
|
|
||||||
|
%% -------------------------------------------------------------------
|
||||||
|
|
||||||
|
%% @doc Write certificate + private key pair to respective files.
|
||||||
|
%% Files are created in the given directory. The filenames are derived
|
||||||
|
%% from the subject information in the certificate.
|
||||||
|
-spec write_cert(_Dir :: file:name(), {certificate(), private_key()}) ->
|
||||||
|
{file:name(), file:name()}.
|
||||||
|
write_cert(Dir, {Cert, Key}) ->
|
||||||
|
Subject = issuer_subject(Cert),
|
||||||
|
Filename = subject_info(org, Subject, "ORG") ++ "." ++ subject_info(name, Subject, "XXX"),
|
||||||
|
write_cert(Dir, Filename, {Cert, Key}).
|
||||||
|
|
||||||
|
-spec write_cert(_Dir :: file:name(), _Prefix :: string(), {certificate(), private_key()}) ->
|
||||||
|
{file:name(), file:name()}.
|
||||||
|
write_cert(Dir, Filename, {Cert, Key}) ->
|
||||||
|
Certfile = filename:join(Dir, Filename ++ ".crt"),
|
||||||
|
Keyfile = filename:join(Dir, Filename ++ ".key"),
|
||||||
|
ok = write_pem(Certfile, Cert),
|
||||||
|
ok = write_pem(Keyfile, Key),
|
||||||
|
{Certfile, Keyfile}.
|
||||||
|
|
||||||
|
-spec write_pem(file:name(), pem_entry() | [pem_entry()]) ->
|
||||||
|
ok | {error, file:posix()}.
|
||||||
|
write_pem(Name, Entries = [_ | _]) ->
|
||||||
|
file:write_file(Name, public_key:pem_encode(Entries));
|
||||||
|
write_pem(Name, Entry) ->
|
||||||
|
write_pem(Name, [Entry]).
|
||||||
Loading…
Reference in New Issue