undercroft

main.rs (5980B)

---

 
 use axum::{
     extract::Request,
     http::{HeaderMap,HeaderValue},
     routing::get, Router,
     http::StatusCode
 };
 use std::sync::Arc;
 use std::net::SocketAddr;
 
 use std::process::Command;
 
 use hyper::body::Incoming;
 use hyper_util::rt::{TokioExecutor, TokioIo};
 use tokio::net::TcpListener;
 use tokio_rustls::{
     rustls::pki_types::{pem::PemObject, CertificateDer, PrivateKeyDer},
     rustls::ServerConfig,
     TlsAcceptor,
 };
 use rustls::{
     server::WebPkiClientVerifier,
     RootCertStore
 };
 use serde_yaml::Value as YamlValue;
 
 use tower_service::Service;
 
 use clap::Parser;
 use log::{error,warn};
 
 const JSON_MIME : HeaderValue = HeaderValue::from_static("application/json");
 
 #[derive(Parser)]
 #[command(name = "undercroft")]
 #[command(version = "0.1")]
 #[command(about = "serves sops secrets to certified https clients",  long_about = None)]
 
 struct Cli {
     #[arg(long)]
     ca_certificate: String,
     #[arg(long)]
     certificate: String,
     #[arg(long)]
     key: String,
     #[arg(long)]
     port: Option<u16>,
     #[arg(long)]
     bind: Option<String>,
     secrets: String
 }
 
 fn yaml_to_json(content: &str) -> Result<String, &str> {
     match serde_yaml::from_str::<YamlValue>(content) {
         Ok(v) => {
             match serde_json::to_string_pretty(&v)  {
                 Ok(s) => Ok(s),
                 Err(e) => {
                     println!("error {:?}", e);
                     Err("can't json")
                 }
             }
         },
         Err(e) => {
             println!("error {:?}", e);
             Err("can't yaml")
         }
     }
 }
 
 
 
 async fn send_it(headers: HeaderMap, secrets_path : String) -> (StatusCode, String) {
     let output = Command::new("sops")
 	.arg("decrypt")
 	.arg(secrets_path)
 	.output()
 	.expect("failed to execute process");
 
     if output.status.success() {
         let body = String::from_utf8(output.stdout).expect("bad utf8");
         match headers.get("accept") {
             Some(ctype) if ctype == &JSON_MIME => {
                 // this is a cheat as we only look for a single mime type
                 // and we only look in the first Accept header, so you
                 // can easily not get json if you ask for any other content-type
                 // as well
 
                 if let Ok(j) = yaml_to_json(&body) {
                     (StatusCode::OK, j)
                 } else {
                     (StatusCode::INTERNAL_SERVER_ERROR, "serialize error".to_string())
                 }
             }
             _ => {
 	        (StatusCode::OK, body)
             }
         }
     } else {
         println!("error calling sops: {:}",
                  String::from_utf8(output.stderr).expect("bad utf8"));
 	(StatusCode::INTERNAL_SERVER_ERROR,
                   "error calling sops".to_string())
     }
 
 }
 
 
 #[tokio::main]
 async fn main() {
     let cli = Cli::parse();
     println!("secrets path = {:}", cli.secrets);
 
     let addr : SocketAddr = match cli.bind {
 	Some(s) => s.parse().expect("can't parse bind address"),
 	None => {
 	    let port = cli.port.unwrap_or(3000);
 	    SocketAddr::from(([127, 0, 0, 1], port))
 	}
     };
 
     let private_key = PrivateKeyDer::from_pem_file(cli.key).unwrap();
 
     let certs = CertificateDer::pem_file_iter(cli.certificate)
         .unwrap()
         .map(|cert| cert.unwrap())
         .collect();
 
     let ca_cert =  CertificateDer::pem_file_iter(cli.ca_certificate)
         .unwrap()
         .map(|cert| cert.unwrap())
         .next();
 
     let mut root_cert_store = RootCertStore::empty();
     if let Some(c) = ca_cert {
 	root_cert_store.add(c).expect("bad ca certificate");
     };
     let client_cert_verifier =
 	WebPkiClientVerifier::builder(root_cert_store.into())
 	.build()
 	.unwrap();
 
     let mut tls_config =
         ServerConfig::builder()
         .with_client_cert_verifier(client_cert_verifier)
         .with_single_cert(certs, private_key)
         .expect("bad certificate/key");
 
     tls_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
 
     let tls_acceptor = TlsAcceptor::from(Arc::new(tls_config));
 
     let tcp_listener = TcpListener::bind(addr).await.unwrap();
 
     println!("listening on {}", addr);
 
     let handler = move |headers: HeaderMap| send_it(headers, cli.secrets) ;
     let app = Router::new().route("/", get(handler));
 
     loop {
         let tower_service = app.clone();
         let tls_acceptor = tls_acceptor.clone();
 
         // Wait for new tcp connection
         let (cnx, addr) = tcp_listener.accept().await.unwrap();
 
         tokio::spawn(async move {
             // Wait for tls handshake to happen
             let Ok(stream) = tls_acceptor.accept(cnx).await else {
                 error!("error during tls handshake connection from {}", addr);
                 return;
             };
 
             // Hyper has its own `AsyncRead` and `AsyncWrite` traits
             // and doesn't use tokio.  `TokioIo` converts between
             // them.
             let stream = TokioIo::new(stream);
 
             // Hyper also has its own `Service` trait and doesn't use
             // tower. We can use `hyper::service::service_fn` to
             // create a hyper `Service` that calls our app through
             // `tower::Service::call`.
             let hyper_service = hyper::service::service_fn(move |request: Request<Incoming>| {
 
                 // We have to clone `tower_service` because hyper's
 		// `Service` uses `&self` whereas
                 // tower's `Service` requires `&mut self`.
                 //
                 // We don't need to call `poll_ready` since `Router`
                 // is always ready.
                 tower_service.clone().call(request)
             });
 
             let ret = hyper_util::server::conn::auto::Builder::new(TokioExecutor::new())
                 .serve_connection_with_upgrades(stream, hyper_service)
                 .await;
 	    if let Err(err) = ret {
                 warn!("error serving connection from {}: {}", addr, err);
             }
         });
     }
 }