Embed Certificate Authorities

.github/workflows/release.yml

@@ -16,6 +16,10 @@ jobs:
  run: |
  cd pw-feeder
  go mod tidy
+ - name: "go generate"
+ run: |
+ cd pw-feeder
+ go generate ./...
  - name: "go test"
  run: |
  cd pw-feeder
@@ -40,6 +44,10 @@ jobs:
  run: |
  cd pw-feeder
  go mod tidy
+ - name: "go generate"
+ run: |
+ cd pw-feeder
+ go generate ./...
  - name: "go build"
  run: |
  cd pw-feeder

.github/workflows/tests.yml

@@ -39,6 +39,10 @@ jobs:
  run: |
  cd pw-feeder
  go mod tidy
+ - name: "go generate"
+ run: |
+ cd pw-feeder
+ go generate ./...
  - name: "go test"
  run: |
  cd pw-feeder

.gitignore

@@ -1 +1,2 @@
 pw-feeder/pw-feeder
+pw-feeder/lib/stunnel/*.pem

README.md

@@ -25,5 +25,6 @@ Tunnels BEAST and MLAT data from your client to plane.watch over a TLS tunnel.
 * Clone the repo
 * Change into the `pw-feeder` directory
 * Run `go mod tidy` to download required modules
+* Run `go generate ./...` to download required CA certs
 * Test: `go test ./...`
 * Build & Install: `go build -o /usr/local/bin/pw-feeder ./cmd/pw-feeder`

pw-feeder/cmd/pw-feeder/main.go

@@ -23,8 +23,9 @@ import (
 var (
  app = &cli.App{
  Name: "pw-feeder",
+ Usage: "feed ADS-B data to plane.watch",
  Description: `Plane Watch Feeder Client`,
- Version: "0.0.2",
+ Version: "0.0.3",
  Flags: []cli.Flag{
  &cli.StringFlag{
  Name: "apikey",

pw-feeder/lib/stunnel/cacerts.go

@@ -0,0 +1,27 @@
+package stunnel
+
+import (
+ "embed"
+)
+
+// Let's Encrypt CAs
+
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/isrgrootx1.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/isrg-root-x2.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/e5.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/e6.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/e7.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/e8.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/e9.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/r10.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/r11.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/r12.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/r13.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/2024/r14.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/lets-encrypt-e1.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/lets-encrypt-e2.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/lets-encrypt-r3.pem
+//go:generate curl --progress-bar -w %{filename_effective}\n -O https://letsencrypt.org/certs/lets-encrypt-r4.pem
+
+//go:embed *.pem
+var caCertPEMs embed.FS

pw-feeder/lib/stunnel/stunnel.go

@@ -3,13 +3,63 @@ package stunnel
 import (
  "crypto/tls"
  "crypto/x509"
+ "encoding/pem"
  "net"
  "strings"
  "time"
 
  "github.com/rs/zerolog/log"
 )
 
+func addEmbeddedCertsToCertPool(scp *x509.CertPool) error {
+ // load embedded Let's Encrypt CAs
+ // get list of files in caCertPEMs embed.FS
+ pemFiles, err := caCertPEMs.ReadDir(".")
+ if err != nil {
+ return err
+ }
+
+ // for each file...
+ for _, pemFile := range pemFiles {
+
+ func() {
+
+ log := log.With().Str("cafile", pemFile.Name()).Logger()
+
+ // open file
+ f, err := caCertPEMs.Open(pemFile.Name())
+ if err != nil {
+ log.Err(err).Msg("could not open embedded CA cert")
+ }
+ defer f.Close()
+
+ // get file stat (for size)
+ s, err := f.Stat()
+ if err != nil {
+ log.Err(err).Msg("could not stat embedded CA cert")
+ }
+
+ // read bytes from file
+ b := make([]byte, s.Size())
+ n, err := f.Read(b)
+ if err != nil {
+ log.Err(err).Msg("could not read embedded CA cert")
+ }
+
+ // parse cert
+ p, _ := pem.Decode(b[:n])
+ c, err := x509.ParseCertificate(p.Bytes)
+ if err != nil {
+ log.Err(err).Msg("could not parse embedded CA cert")
+ }
+
+ // add cert to system cert pool
+ scp.AddCert(c)
+ }()
+ }
+ return nil
+}
+
 func StunnelConnect(name, addr, sni string) (c *tls.Conn, err error) {
 
  log := log.With().Str("name", name).Str("addr", addr).Logger()
@@ -40,12 +90,16 @@ func StunnelConnect(name, addr, sni string) (c *tls.Conn, err error) {
  return err
  }
 
- // load root CAs
+ // load system cert pool CAs
  scp, err := x509.SystemCertPool()
  if err != nil {
  log.Err(err).Caller().Msg("could not use system cert pool")
  return err
  }
+ err = addEmbeddedCertsToCertPool(scp)
+ if err != nil {
+ return err
+ }
 
  // TODO: fix this
  // verify server cert
@@ -55,7 +109,6 @@ func StunnelConnect(name, addr, sni string) (c *tls.Conn, err error) {
  vo.DNSName = remoteHost
  _, err = cert.Verify(vo)
  if err != nil {
- log.Err(err).Caller().Msg("could not verify server cert")
  return err
  }
  }
@@ -66,7 +119,11 @@ func StunnelConnect(name, addr, sni string) (c *tls.Conn, err error) {
  // load root CAs
  scp, err := x509.SystemCertPool()
  if err != nil {
- log.Err(err).Caller().Msg("could not use system cert pool")
+ // log.Err(err).Caller().Msg("could not use system cert pool")
+ return c, err
+ }
+ err = addEmbeddedCertsToCertPool(scp)
+ if err != nil {
  return c, err
  }
 
@@ -85,18 +142,18 @@ func StunnelConnect(name, addr, sni string) (c *tls.Conn, err error) {
  // dial remote
  c, err = tls.DialWithDialer(&d, "tcp", addr, &tlsConfig)
  if err != nil {
- log.Err(err).Caller().Msg("could not connect")
+ // log.Err(err).Caller().Msg("could not connect")
  return c, err
  }
 
  // perform handshake
  err = c.Handshake()
  if err != nil {
- log.Err(err).Caller().Msg("handshake error")
+ // log.Err(err).Caller().Msg("handshake error")
  return c, err
  }
 
- log.Debug().Msg("endpoint connected")
+ // log.Debug().Msg("endpoint connected")
  return c, err
 
 }

pw-feeder/lib/stunnel/stunnel_test.go

@@ -33,6 +33,45 @@ func init() {
  log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr, TimeFormat: time.UnixDate})
 }
 
+func TestCACerts(t *testing.T) {
+
+ // get list of files in caCertPEMs embed.FS
+ pemFiles, err := caCertPEMs.ReadDir(".")
+ require.NoError(t, err)
+
+ // for each file...
+ for _, pemFile := range pemFiles {
+ t.Run(pemFile.Name(), func(t *testing.T) {
+
+ // open file
+ f, err := caCertPEMs.Open(pemFile.Name())
+ require.NoError(t, err)
+ defer f.Close()
+
+ // get file stat (for size)
+ s, err := f.Stat()
+ require.NoError(t, err)
+
+ // read bytes from file
+ b := make([]byte, s.Size())
+ n, err := f.Read(b)
+ require.NoError(t, err)
+
+ // parse cert
+ p, _ := pem.Decode(b[:n])
+ c, err := x509.ParseCertificate(p.Bytes)
+ require.NoError(t, err)
+
+ // check validity
+ assert.True(t, c.NotBefore.Before(time.Now()), "Certificate not yet valid")
+ assert.False(t, c.NotAfter.Before(time.Now()), "Certificate expired")
+
+ // check if certs are due to expire within 90 days
+ assert.True(t, c.NotAfter.After(time.Now().Add(time.Hour*24*90)), "Certificate expires within 90 days")
+ })
+ }
+}
+
 func GenerateSelfSignedTLSCertAndKey(keyFile, certFile *os.File) error {
  // Thanks to: https://go.dev/src/crypto/tls/generate_cert.go