Merge ~codersquid/snappy-hwe-snaps/+git/wifi-connect:cert-generation into ~snappy-hwe-team/snappy-hwe-snaps/+git/wifi-connect:master

[Sheila Miguez]

This change adds a cert package responsible for generating self signed certificates. The code is reused from snapweb, with a few minor differences:

* instead of fatal errors, we return errors and allow callers to decide how to handle failures
* files are stored in SNAP_COMMON rather than SNAP_DATA

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:1289197ee65e0a745ea02062b6182530c9aa3f71
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1750/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/2460
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1658/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/2806
    None: https://jenkins.canonical.com/system-enablement/job/generic-cleanup-snap/1980/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1750/rebuild

review: Approve (continuous-integration)

[Kyle Nitzsche (knitzsche)]

Can this PR also include the code that uses this cert package? that is, I don't see why we add it if we don't use it (unless I misunderstand something...)

[Roberto Mier Escandon (rmescandon)]

Looks good (I've not tested it at all). An inline comment

[Sheila Miguez (codersquid)]

> Can this PR also include the code that uses this cert package? that is, I
> don't see why we add it if we don't use it (unless I misunderstand
> something...)

I'll go ahead and cancel this MR and stick it with the rest of hte https work. I wanted to break things up to make things easier to review but in hindsight splitting this one out wasn't the best idea.

Unmerged commits

1289197... by Sheila Miguez on 2017-07-06

reuse self-signing cert package from snapweb

This reuses snapweb code with some minor changes

* instead of fatal errors, we return errors and allow callers to decide
  how to handle failures
* files are stored in SNAP_COMMON rather than SNAP_DATA

diff --git a/cert/cert.go b/cert/cert.go
new file mode 100644
index 0000000..60242c6
--- /dev/null
+++ b/cert/cert.go
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2017 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package cert
+
+/*
+ * help and re-use from https://github.com/snapcore/snapweb/blob/0.25/cmd/snapweb/cert.go
+ */
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"math/big"
+	"net"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// CertFile path to certificate file
+var CertFile = filepath.Join(os.Getenv("SNAP_COMMON"), "cert.pem")
+
+// KeyFile path to key file
+var KeyFile = filepath.Join(os.Getenv("SNAP_COMMON"), "key.pem")
+
+// FindOrGenerateCertificate finds or creates the certificate & key files if they do not exist
+func FindOrGenerateCertificate() error {
+
+	_, err1 := os.Stat(CertFile)
+	_, err2 := os.Stat(KeyFile)
+
+	// skip if both cert and key exist
+	if err1 == nil && err2 == nil {
+		return nil
+	}
+
+	return GenerateCertificate(CertFile, KeyFile)
+}
+
+// GenerateCertificate will generate a new self-signed certifiate at startup
+func GenerateCertificate(certFilename string, keyFilename string) error {
+	/* With help from https://golang.org/src/crypto/tls/generate_cert.go */
+
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return fmt.Errorf("Failed to generate private key: %v", err)
+	}
+
+	notBefore := time.Now()
+	validFor := 365 * 24 * time.Hour
+	notAfter := notBefore.Add(validFor)
+
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		return fmt.Errorf("Failed to generate serial number: %v", err)
+	}
+
+	template := x509.Certificate{
+		SerialNumber: serialNumber,
+		Subject: pkix.Name{
+			Organization: []string{"wifi-connect"},
+		},
+		NotBefore:             notBefore,
+		NotAfter:              notAfter,
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+	}
+
+	// TODO: add other IP addresses and hostnames (check Avahi)
+	template.IPAddresses = append(template.IPAddresses, net.ParseIP("127.0.0.1"))
+	template.IsCA = false
+
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
+	if err != nil {
+		return fmt.Errorf("Failed to create certificate: %v", err)
+	}
+
+	err = createPublicKeycertFile(certFilename, derBytes)
+	if err != nil {
+		return err
+	}
+	err = createPrivateKeyFile(keyFilename, priv)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func createPublicKeycertFile(filename string, b []byte) error {
+	certOut, err := os.Create(filename)
+	if err != nil {
+		return fmt.Errorf("failed to open cert.pem for writing: %v", err)
+	}
+	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: b})
+	certOut.Close()
+	return nil
+}
+
+func createPrivateKeyFile(filename string, k *rsa.PrivateKey) error {
+	keyOut, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return fmt.Errorf("failed to open key.pem for writing: %v", err)
+	}
+	if k == nil {
+		return errors.New("Invalid private key context")
+	}
+	pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(k)})
+	keyOut.Close()
+	return nil
+}
diff --git a/cert/cert_test.go b/cert/cert_test.go
new file mode 100644
index 0000000..8966043
--- /dev/null
+++ b/cert/cert_test.go
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2017 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package cert
+
+/*
+ * help and re-use from https://github.com/snapcore/snapweb/blob/0.25/cmd/snapweb/cert_test.go
+ */
+
+import (
+	"io/ioutil"
+	"os"
+
+	. "gopkg.in/check.v1"
+)
+
+type CertSuite struct {
+	snapdata     string
+	certFilename string
+	keyFilename  string
+}
+
+var _ = Suite(&CertSuite{})
+
+func (s *CertSuite) SetUpTest(c *C) {
+	s.snapdata = c.MkDir()
+	os.Setenv("SNAP_COMMON", s.snapdata)
+}
+
+func (s *CertSuite) TearDownTest(c *C) {
+	os.RemoveAll(s.snapdata)
+}
+
+func (s *CertSuite) TestDumpCertificate(c *C) {
+	c.Assert(ioutil.WriteFile(CertFile, nil, 0600), IsNil)
+	c.Assert(ioutil.WriteFile(KeyFile, nil, 0600), IsNil)
+
+	FindOrGenerateCertificate()
+	certData, err := ioutil.ReadFile(CertFile)
+	c.Assert(err, IsNil)
+	keyData, err := ioutil.ReadFile(KeyFile)
+	c.Assert(err, IsNil)
+
+	FindOrGenerateCertificate()
+	certData2, err := ioutil.ReadFile(CertFile)
+	c.Assert(err, IsNil)
+	keyData2, err := ioutil.ReadFile(KeyFile)
+	c.Assert(err, IsNil)
+
+	// ensure the certificate is not re-generated if one already exists
+	c.Assert(certData, DeepEquals, certData2)
+	c.Assert(keyData, DeepEquals, keyData2)
+}
+
+func (s *CertSuite) TestGenerateCertificate(c *C) {
+	GenerateCertificate(CertFile, KeyFile)
+	_, err := os.Stat(s.certFilename)
+	c.Assert(err, IsNil)
+	_, err = os.Stat(s.keyFilename)
+	c.Assert(err, IsNil)
+	// TODO check for content
+	c.Assert(createPublicKeycertFile(CertFile, nil), IsNil)
+	c.Assert(createPrivateKeyFile(KeyFile, nil), NotNil)
+}