Skip to content

Commit 99f346a

Browse files
TechassiTechassi
committed
refactor: Slightly optimize conditional leaf cert generation
1 parent cc623a2 commit 99f346a

1 file changed

Lines changed: 112 additions & 118 deletions

File tree

  • rust/operator-binary/src/backend/auto_tls

‎rust/operator-binary/src/backend/auto_tls/mod.rs‎

Lines changed: 112 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -324,132 +324,126 @@ impl SecretBackend for TlsGenerate {
324324
// Only run leaf certificate generation if it was requested based on the
325325
// secret volume selector. Otherwise only a ca.crt file as a PEM envelope
326326
// will be available (to be mounted).
327-
let tls_secret_data = if selector.provision_parts == ProvisionParts::PublicPrivate {
328-
let conf = Conf::new(ConfMethod::default())
329-
.expect("failed to initialize OpenSSL configuration");
330-
331-
let pod_key_length = match self.key_generation {
332-
v1alpha2::CertificateKeyGeneration::Rsa { length } => length,
333-
};
334-
335-
let pod_key = Rsa::generate(pod_key_length)
336-
.and_then(PKey::try_from)
337-
.context(GenerateKeySnafu)?;
338-
339-
let mut addresses = Vec::new();
340-
for scope in &selector.scope {
341-
addresses.extend(
342-
selector
343-
.scope_addresses(&pod_info, scope)
344-
.context(ScopeAddressesSnafu { scope })?,
345-
);
346-
}
347-
for address in &mut addresses {
348-
if let Address::Dns(dns) = address {
349-
// Turn FQDNs into bare domain names by removing the trailing dot
350-
if dns.ends_with('.') {
351-
dns.pop();
327+
let (certificate_pem, key_pem) = match selector.provision_parts {
328+
ProvisionParts::Public => (None, None),
329+
ProvisionParts::PublicPrivate => {
330+
let conf = Conf::new(ConfMethod::default())
331+
.expect("failed to initialize OpenSSL configuration");
332+
333+
let pod_key_length = match self.key_generation {
334+
v1alpha2::CertificateKeyGeneration::Rsa { length } => length,
335+
};
336+
337+
let pod_key = Rsa::generate(pod_key_length)
338+
.and_then(PKey::try_from)
339+
.context(GenerateKeySnafu)?;
340+
341+
let mut addresses = Vec::new();
342+
for scope in &selector.scope {
343+
addresses.extend(
344+
selector
345+
.scope_addresses(&pod_info, scope)
346+
.context(ScopeAddressesSnafu { scope })?,
347+
);
348+
}
349+
for address in &mut addresses {
350+
if let Address::Dns(dns) = address {
351+
// Turn FQDNs into bare domain names by removing the trailing dot
352+
if dns.ends_with('.') {
353+
dns.pop();
354+
}
352355
}
353356
}
354-
}
355357

356-
let pod_cert = X509Builder::new()
357-
.and_then(|mut x509| {
358-
let subject_name = X509NameBuilder::new()
359-
.and_then(|mut name| {
360-
name.append_entry_by_nid(
361-
Nid::COMMONNAME,
362-
"generated certificate for pod",
363-
)?;
364-
Ok(name)
365-
})?
366-
.build();
367-
x509.set_subject_name(&subject_name)?;
368-
x509.set_issuer_name(ca.certificate.subject_name())?;
369-
x509.set_not_before(
370-
Asn1Time::from_unix(not_before.unix_timestamp())?.as_ref(),
371-
)?;
372-
x509.set_not_after(Asn1Time::from_unix(not_after.unix_timestamp())?.as_ref())?;
373-
x509.set_pubkey(&pod_key)?;
374-
x509.set_version(
375-
3 - 1, // zero-indexed
376-
)?;
377-
let mut serial = BigNum::new()?;
378-
serial.rand(64, MsbOption::MAYBE_ZERO, false)?;
379-
x509.set_serial_number(Asn1Integer::from_bn(&serial)?.as_ref())?;
380-
let ctx = x509.x509v3_context(Some(&ca.certificate), Some(&conf));
381-
let mut exts = vec![
382-
BasicConstraints::new().critical().build()?,
383-
KeyUsage::new()
384-
.key_encipherment()
385-
.digital_signature()
386-
.build()?,
387-
ExtendedKeyUsage::new()
388-
.server_auth()
389-
.client_auth()
390-
.build()?,
391-
SubjectKeyIdentifier::new().build(&ctx)?,
392-
AuthorityKeyIdentifier::new()
393-
.issuer(true)
394-
.keyid(true)
395-
.build(&ctx)?,
396-
];
397-
let mut san_ext = SubjectAlternativeName::new();
398-
san_ext.critical();
399-
let mut has_san = false;
400-
for addr in addresses {
401-
has_san = true;
402-
match addr {
403-
Address::Dns(dns) => san_ext.dns(&dns),
404-
Address::Ip(ip) => san_ext.ip(&ip.to_string()),
405-
};
406-
}
407-
if has_san {
408-
exts.push(san_ext.build(&ctx)?);
409-
}
410-
for ext in exts {
411-
x509.append_extension(ext)?;
412-
}
413-
x509.sign(&ca.private_key, MessageDigest::sha256())?;
414-
Ok(x509)
415-
})
416-
.context(BuildCertificateSnafu)?
417-
.build();
418-
419-
well_known::TlsPem {
420-
ca_pem: iterator_try_concat_bytes(
421-
self.ca_manager.trust_roots(now).into_iter().map(|ca| {
422-
ca.to_pem()
423-
.context(SerializeCertificateSnafu { tpe: CertType::Ca })
424-
}),
425-
)?,
426-
certificate_pem: Some(
427-
pod_cert
428-
.to_pem()
429-
.context(SerializeCertificateSnafu { tpe: CertType::Pod })?,
430-
),
431-
key_pem: Some(
432-
pod_key
433-
.private_key_to_pem_pkcs8()
434-
.context(SerializeCertificateSnafu { tpe: CertType::Pod })?,
435-
),
436-
}
437-
} else {
438-
well_known::TlsPem {
439-
ca_pem: iterator_try_concat_bytes(
440-
self.ca_manager.trust_roots(now).into_iter().map(|ca| {
441-
ca.to_pem()
442-
.context(SerializeCertificateSnafu { tpe: CertType::Ca })
443-
}),
444-
)?,
445-
certificate_pem: None,
446-
key_pem: None,
358+
let pod_cert = X509Builder::new()
359+
.and_then(|mut x509| {
360+
let subject_name = X509NameBuilder::new()
361+
.and_then(|mut name| {
362+
name.append_entry_by_nid(
363+
Nid::COMMONNAME,
364+
"generated certificate for pod",
365+
)?;
366+
Ok(name)
367+
})?
368+
.build();
369+
x509.set_subject_name(&subject_name)?;
370+
x509.set_issuer_name(ca.certificate.subject_name())?;
371+
x509.set_not_before(
372+
Asn1Time::from_unix(not_before.unix_timestamp())?.as_ref(),
373+
)?;
374+
x509.set_not_after(
375+
Asn1Time::from_unix(not_after.unix_timestamp())?.as_ref(),
376+
)?;
377+
x509.set_pubkey(&pod_key)?;
378+
x509.set_version(
379+
3 - 1, // zero-indexed
380+
)?;
381+
let mut serial = BigNum::new()?;
382+
serial.rand(64, MsbOption::MAYBE_ZERO, false)?;
383+
x509.set_serial_number(Asn1Integer::from_bn(&serial)?.as_ref())?;
384+
let ctx = x509.x509v3_context(Some(&ca.certificate), Some(&conf));
385+
let mut exts = vec![
386+
BasicConstraints::new().critical().build()?,
387+
KeyUsage::new()
388+
.key_encipherment()
389+
.digital_signature()
390+
.build()?,
391+
ExtendedKeyUsage::new()
392+
.server_auth()
393+
.client_auth()
394+
.build()?,
395+
SubjectKeyIdentifier::new().build(&ctx)?,
396+
AuthorityKeyIdentifier::new()
397+
.issuer(true)
398+
.keyid(true)
399+
.build(&ctx)?,
400+
];
401+
let mut san_ext = SubjectAlternativeName::new();
402+
san_ext.critical();
403+
let mut has_san = false;
404+
for addr in addresses {
405+
has_san = true;
406+
match addr {
407+
Address::Dns(dns) => san_ext.dns(&dns),
408+
Address::Ip(ip) => san_ext.ip(&ip.to_string()),
409+
};
410+
}
411+
if has_san {
412+
exts.push(san_ext.build(&ctx)?);
413+
}
414+
for ext in exts {
415+
x509.append_extension(ext)?;
416+
}
417+
x509.sign(&ca.private_key, MessageDigest::sha256())?;
418+
Ok(x509)
419+
})
420+
.context(BuildCertificateSnafu)?
421+
.build();
422+
423+
let certificate_pem = pod_cert
424+
.to_pem()
425+
.context(SerializeCertificateSnafu { tpe: CertType::Pod })?;
426+
let key_pem = pod_key
427+
.private_key_to_pem_pkcs8()
428+
.context(SerializeCertificateSnafu { tpe: CertType::Pod })?;
429+
430+
(Some(certificate_pem), Some(key_pem))
447431
}
448432
};
449433

434+
let ca_pem =
435+
iterator_try_concat_bytes(self.ca_manager.trust_roots(now).into_iter().map(|ca| {
436+
ca.to_pem()
437+
.context(SerializeCertificateSnafu { tpe: CertType::Ca })
438+
}))?;
439+
450440
Ok(
451441
SecretContents::new(SecretData::WellKnown(WellKnownSecretData::TlsPem(
452-
tls_secret_data,
442+
well_known::TlsPem {
443+
certificate_pem,
444+
key_pem,
445+
ca_pem,
446+
},
453447
)))
454448
.expires_after(
455449
time_datetime_to_chrono(expire_pod_after).context(InvalidCertLifetimeSnafu)?,

0 commit comments

Comments
 (0)