Keychain support

CMakeLists.txt

@@ -10,17 +10,14 @@ project(ziti-sdk
 )
 
 set(PROJECT_VERSION ${GIT_VERSION})
-include(cmake/project-is-top-level.cmake)
 include(cmake/variables.cmake)
 
 set(tlsuv_DIR "" CACHE FILEPATH "developer option: use local tlsuv checkout")
 
-option(HAVE_LIBSODIUM "use and link installed shared libsodium library" OFF)
-
 message("project version: ${PROJECT_VERSION}")
 message("git info:")
-message("   branch : ${GIT_BRANCH}")
-message("     hash : ${GIT_COMMIT_HASH}")
+message(" branch : ${GIT_BRANCH}")
+message("   hash : ${GIT_COMMIT_HASH}")
 
 message("")
 message("using ${CMAKE_GENERATOR}")
@@ -105,7 +102,7 @@ if (ziti_DEVELOPER_MODE AND NOT CMAKE_CROSSCOMPILING)
     add_subdirectory(tests)
 endif ()
 
-if (EXISTS "${CMAKE_CURRENT_LIST_DIR}/local.cmake")
+if (ziti-sdk_IS_TOP_LEVEL AND EXISTS "${CMAKE_CURRENT_LIST_DIR}/local.cmake")
     include("${CMAKE_CURRENT_LIST_DIR}/local.cmake")
 endif ()
 

cmake/variables.cmake

@@ -21,10 +21,10 @@ set(warning_guard "")
 if (NOT PROJECT_IS_TOP_LEVEL)
     option(
             ziti_INCLUDES_WITH_SYSTEM
-            "Use SYSTEM modifier for tlsuv's includes, disabling warnings"
+            "Use SYSTEM modifier for ziti's includes, disabling warnings"
             ON
     )
-    mark_as_advanced(tlsuv_INCLUDES_WITH_SYSTEM)
+    mark_as_advanced(ziti_INCLUDES_WITH_SYSTEM)
     if (ziti_INCLUDES_WITH_SYSTEM)
         set(warning_guard SYSTEM)
     endif ()

deps/CMakeLists.txt

@@ -1,29 +1,19 @@
 
 include(FetchContent)
 
-if (tlsuv_DIR)
-    add_subdirectory(${tlsuv_DIR}
-            ${CMAKE_CURRENT_BINARY_DIR}/tlsuv)
-else ()
-
-    FetchContent_Declare(tlsuv
+# allow downstream projects to pull tlsuv on their own
+if (NOT TARGET tlsuv)
+    if (tlsuv_DIR)
+        add_subdirectory(${tlsuv_DIR}
+                ${CMAKE_CURRENT_BINARY_DIR}/tlsuv)
+    else ()
+        FetchContent_Declare(tlsuv
             GIT_REPOSITORY https://github.com/openziti/tlsuv.git
-            GIT_TAG v0.30.1
-            )
-    FetchContent_MakeAvailable(tlsuv)
-
-endif (tlsuv_DIR)
-
-FetchContent_Declare(subcommand
-        GIT_REPOSITORY https://github.com/openziti/subcommands.c.git
-        GIT_TAG main
+                GIT_TAG v0.31.1
         )
-FetchContent_GetProperties(subcommand)
-if (NOT subcommand_POPULATED)
-    FetchContent_Populate(subcommand)
-endif ()
-add_library(subcommand INTERFACE)
-target_include_directories(subcommand INTERFACE ${subcommand_SOURCE_DIR})
+        FetchContent_MakeAvailable(tlsuv)
+    endif (tlsuv_DIR)
+endif () # tlsuv TARGET
 
 
 

inc_internal/ziti_enroll.h

@@ -42,6 +42,7 @@ typedef struct enroll_cfg_s {
 
     char *CA;
 
+    bool use_keychain;
     const char *private_key;
     tlsuv_private_key_t pk;
     const char *own_cert;

includes/ziti/ziti.h

@@ -258,6 +258,7 @@ typedef struct ziti_enroll_opts_s {
     const char *enroll_cert;
     const char *enroll_name;
     const char *jwt_content;
+    bool use_keychain; // use keychain if generating new key
 } ziti_enroll_opts;
 
 typedef struct ziti_dial_opts_s {

library/utils.c

@@ -414,7 +414,7 @@
         time_t t = ts.tv_sec;
         struct tm *tm = gmtime(&t);
 
         snprintf(log_timestamp, sizeof(log_timestamp), "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ",
                  1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
                  tm->tm_hour, tm->tm_min, tm->tm_sec, ts.tv_usec / 1000
         );
@@ -572,6 +572,16 @@
         return 0;
     }
 
+    if (strncmp(keystr, "keychain:", strlen("keychain:")) == 0) {
+        const char *keyname = strchr(keystr, ':') + 1;
+        rc = tls->load_keychain_key(key, keyname);
+        if (rc != 0) {
+            ZITI_LOG(WARN, "failed to load keychain key[%s]", keyname);
+            return ZITI_INVALID_CONFIG;
+        }
+        return 0;
+    }
+
     if (tlsuv_parse_url(&uri, keystr) == 0) {
         if (uri.scheme_len == strlen("file") && strncmp(uri.scheme, "file", uri.scheme_len) == 0) {
             rc = tls->load_key(key, uri.path, uri.path_len);

library/ziti_enroll.c

@@ -100,11 +100,12 @@
     ecfg->own_cert = opts->enroll_cert;
     ecfg->private_key = opts->enroll_key;
     ecfg->name = opts->enroll_name;
+    ecfg->use_keychain = opts->use_keychain;
 
     if (opts->jwt) {
         TRY(ziti, load_jwt(opts->jwt, ecfg, &ecfg->zejh, &ecfg->zej));
     } else {
         ecfg->raw_jwt = opts->jwt_content;
         TRY(ziti, load_jwt_content(ecfg, &ecfg->zejh, &ecfg->zej));
     }
     TRY(ziti, check_cert_required(ecfg));
@@ -175,11 +176,27 @@
         size_t len;
         if (enroll_req->ecfg->private_key == NULL) {
             ziti_err = ZITI_KEY_GENERATION_FAILED;
-            TRY(TLS, tls->generate_key(&enroll_req->ecfg->pk));
-            TRY(TLS,
-                enroll_req->ecfg->pk->to_pem(enroll_req->ecfg->pk, (char **) &enroll_req->ecfg->private_key, &len));
-        }
-        else {
+            if (enroll_req->ecfg->use_keychain && tls->generate_keychain_key) {
+                tlsuv_private_key_t pk = NULL;
+                struct tlsuv_url_s url;
+                tlsuv_parse_url(&url, enroll_req->ecfg->zej->controller);
+
+                string_buf_t *keyname_buf = new_string_buf();
+                string_buf_fmt(keyname_buf, "keychain:%s@%.*s",
+                               enroll_req->ecfg->zej->subject,
+                               (int)url.hostname_len, url.hostname);
+                char *keyname_ref = string_buf_to_string(keyname_buf, NULL);
+                delete_string_buf(keyname_buf);
+
+                char *keyname = strchr(keyname_ref, ':') + 1;
+                enroll_req->ecfg->private_key = keyname_ref;
+                TRY(TLS, tls->generate_keychain_key(&pk, keyname));
+                enroll_req->ecfg->pk = pk;
+            } else {
+                TRY(TLS, tls->generate_key(&enroll_req->ecfg->pk));
+                TRY(TLS, enroll_req->ecfg->pk->to_pem(
+                        enroll_req->ecfg->pk, (char **) &enroll_req->ecfg->private_key, &len));
+            }
         }
 
         ziti_err = ZITI_CSR_GENERATION_FAILED;
@@ -190,9 +207,8 @@
                                                "DC", enroll_req->ecfg->zej->controller,
                                                "CN", enroll_req->ecfg->zej->subject,
                                                NULL));
-    }
-    else if (enroll_req->ecfg->zej->method == ziti_enrollment_methods.ottca ||
-             enroll_req->ecfg->zej->method == ziti_enrollment_methods.ca) {
+    } else if (enroll_req->ecfg->zej->method == ziti_enrollment_methods.ottca ||
+               enroll_req->ecfg->zej->method == ziti_enrollment_methods.ca) {
         ziti_err = ZITI_KEY_LOAD_FAILED;
         tlsuv_certificate_t cert;
         TRY(TLS, tls->load_cert(&cert, enroll_req->ecfg->own_cert, strlen(enroll_req->ecfg->own_cert)));

programs/ziti-prox-c/CMakeLists.txt

@@ -1,6 +1,18 @@
 
 add_executable(ziti-prox-c proxy.c)
 
+FetchContent_Declare(subcommand
+        GIT_REPOSITORY https://github.com/openziti/subcommands.c.git
+        GIT_TAG main
+)
+FetchContent_GetProperties(subcommand)
+if (NOT subcommand_POPULATED)
+    FetchContent_Populate(subcommand)
+endif ()
+add_library(subcommand INTERFACE)
+target_include_directories(subcommand INTERFACE ${subcommand_SOURCE_DIR})
+
+
 if(WIN32)
     target_include_directories(ziti-prox-c PRIVATE win32/include)
     target_sources(ziti-prox-c PRIVATE win32/src/getopt.c)