netbird/client/internal/certproof/store.go

package certproof

import (
	"context"
	"crypto"
	"crypto/x509"
	"encoding/pem"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strings"

	log "github.com/sirupsen/logrus"

	"github.com/netbirdio/netbird/client/internal/tpm"
)

const (
	StoreDirEnv     = "NB_CERT_STORE_DIR"
	defaultStoreDir = "/etc/netbird/certs"
)

// Candidate is a certificate chain the peer can sign for. Signer never exposes the key.
type Candidate struct {
	Chain  []*x509.Certificate
	Signer crypto.Signer
}

// Store yields the certificates a peer may prove possession of. FileStore is the PEM
// directory implementation; OS keystores (CNG, Keychain, PKCS#11) slot in here.
type Store interface {
	Candidates(ctx context.Context) ([]Candidate, error)
}

// Config selects where the Linux daemon looks for certificates: Dir is the PEM directory,
// empty for NB_CERT_STORE_DIR or /etc/netbird/certs, and PKCS11 names a token whose keys
// sign for certificates on the token or in that directory.
type Config struct {
	Dir    string
	PKCS11 PKCS11Config
}

func (c Config) dir() string {
	if c.Dir != "" {
		return c.Dir
	}
	return StoreDir()
}

// FileStore reads PEM files from a directory. A file holds the chain (leaf first) and
// either its private key or a sibling "<name>.key" file holds it. The key is a plain
// PKCS#8, EC or RSA key, or a TSS2 key the TPM signs with.
type FileStore struct {
	dir string
}

func NewFileStore(dir string) *FileStore {
	return &FileStore{dir: dir}
}

func StoreDir() string {
	if dir := os.Getenv(StoreDirEnv); dir != "" {
		return dir
	}
	return defaultStoreDir
}

func (s *FileStore) Candidates(_ context.Context) ([]Candidate, error) {
	paths, err := certFiles(s.dir)
	if err != nil {
		return nil, err
	}

	var candidates []Candidate
	for _, path := range paths {
		chain, signer, err := loadPEM(path)
		if err != nil {
			log.Warnf("skipping certificate %s: %v", path, err)
			continue
		}
		if signer == nil {
			log.Debugf("certificate %s has no key file, only a token can sign for it", path)
			continue
		}
		candidates = append(candidates, Candidate{Chain: chain, Signer: signer})
	}
	return candidates, nil
}

// certFiles lists the certificate files in dir, none when the directory does not exist.
func certFiles(dir string) ([]string, error) {
	entries, err := os.ReadDir(dir)
	if errors.Is(err, os.ErrNotExist) {
		return nil, nil
	}
	if err != nil {
		return nil, fmt.Errorf("read certificate store %s: %w", dir, err)
	}
	var paths []string
	for _, entry := range entries {
		if !entry.IsDir() && isCertFile(entry.Name()) {
			paths = append(paths, filepath.Join(dir, entry.Name()))
		}
	}
	return paths, nil
}

// loadPEM reads a certificate file and its private key, held in the file itself or in
// the sibling "<name>.key" file. The signer is nil when neither holds a key.
func loadPEM(path string) ([]*x509.Certificate, crypto.Signer, error) {
	data, err := os.ReadFile(path)
	if err != nil {
		return nil, nil, err
	}
	chain, signer, err := parsePEM(data)
	if err != nil {
		return nil, nil, err
	}
	if len(chain) == 0 {
		return nil, nil, errors.New("no certificate")
	}
	if signer != nil {
		return chain, signer, nil
	}
	keyData, err := os.ReadFile(strings.TrimSuffix(path, filepath.Ext(path)) + ".key")
	if errors.Is(err, os.ErrNotExist) {
		return chain, nil, nil
	}
	if err != nil {
		return nil, nil, fmt.Errorf("read key file: %w", err)
	}
	if _, signer, err = parsePEM(keyData); err != nil {
		return nil, nil, err
	}
	if signer == nil {
		return nil, nil, errors.New("no private key in key file")
	}
	return chain, signer, nil
}

func parsePEM(data []byte) ([]*x509.Certificate, crypto.Signer, error) {
	var chain []*x509.Certificate
	var signer crypto.Signer
	for {
		var block *pem.Block
		block, data = pem.Decode(data)
		if block == nil {
			return chain, signer, nil
		}
		switch block.Type {
		case "CERTIFICATE":
			cert, err := x509.ParseCertificate(block.Bytes)
			if err != nil {
				return nil, nil, fmt.Errorf("parse certificate: %w", err)
			}
			chain = append(chain, cert)
		case "PRIVATE KEY", "EC PRIVATE KEY", "RSA PRIVATE KEY", tpm.KeyPEMType:
			key, err := parsePrivateKey(block)
			if err != nil {
				return nil, nil, err
			}
			signer = key
		}
	}
}

func parsePrivateKey(block *pem.Block) (crypto.Signer, error) {
	var key any
	var err error
	switch block.Type {
	case tpm.KeyPEMType:
		return tpm.ParseKey(block.Bytes)
	case "EC PRIVATE KEY":
		key, err = x509.ParseECPrivateKey(block.Bytes)
	case "RSA PRIVATE KEY":
		key, err = x509.ParsePKCS1PrivateKey(block.Bytes)
	default:
		key, err = x509.ParsePKCS8PrivateKey(block.Bytes)
	}
	if err != nil {
		return nil, fmt.Errorf("parse private key: %w", err)
	}
	signer, ok := key.(crypto.Signer)
	if !ok {
		return nil, errors.New("private key cannot sign")
	}
	return signer, nil
}

func isCertFile(name string) bool {
	switch strings.ToLower(filepath.Ext(name)) {
	case ".pem", ".crt", ".cer":
		return true
	}
	return false
}

// Stores queries several stores and carries on when one fails, so a broken token cannot
// hide the certificates a directory holds. A failure is logged instead of returned
// because Collect treats a store error as "no proofs at all".
type Stores []Store

func (s Stores) Candidates(ctx context.Context) ([]Candidate, error) {
	var all []Candidate
	for _, store := range s {
		candidates, err := store.Candidates(ctx)
		if err != nil {
			log.Warnf("certificate store %T unavailable: %v", store, err)
			continue
		}
		all = append(all, candidates...)
	}
	return all, nil
}