Make create_certs more resilient

Better error and file path handling

create_certs/src/create_certs.go

@@ -14,16 +14,61 @@ import (
 	"net"
 	"os"
 	"time"
+	"flag"
+	"path/filepath"
 )
 
+
+var inBumperSan string
+var outCertDirectory string
+
 func main() {
 
-	make_CA()
+	certPath, err := filepath.Abs("../../certs")
+	if err != nil {
+		log.Printf("Error: %v", err)
+	}
+	sanPath, err := filepath.Abs("../Bumper_SAN.txt")
+	if err != nil {
+		log.Printf("Error: %v", err)
+	}
+	var inBumperSan string
+	var outCertDirectory string
+	flag.StringVar(&inBumperSan, "inSAN", sanPath, "Input file containing a list of Subject Alternate Names (line separated)")
+	flag.StringVar(&outCertDirectory, "out", certPath, "Directory to output certificates to")
+
+	flag.Parse()
+
+	//get absolute path
+	outCertDirectory, _ = filepath.Abs(outCertDirectory)
+	dexists, isdfile := pathExistsType(outCertDirectory)
+	if !dexists {
+		log.Fatal("Certs directory doesn't exist")
+	}
+	if isdfile {
+		log.Fatal("Certs directory is a file, not a directory")
+	}
+	
+	
+
+	//get absolute path
+	inBumperSan, _ = filepath.Abs(inBumperSan)
+	bexists, isbfile := pathExistsType(inBumperSan)
+	if !bexists {
+		log.Print("Bumper SAN doesn't exist, certificate won't contain Subject Alternate Names")
+	}
+	if bexists && !isbfile {
+		log.Print("Bumper SAN is a directory instead of file, certificate won't contain Subject Alternate Names")
+	}
+
+
+	make_CA(outCertDirectory)
+	signCert(outCertDirectory, inBumperSan)
 
-	signCert()
 }
 
-func make_CA() {
+func make_CA(outCertDirectory string) {
+
 	priv, _ := rsa.GenerateKey(rand.Reader, 2048)
 	pub := &priv.PublicKey
 
@@ -46,40 +91,40 @@ func make_CA() {
 
 	ca_b, err := x509.CreateCertificate(rand.Reader, ca, ca, pub, priv)
 	if err != nil {
-		log.Println("create ca failed", err)
+		log.Fatalf("Create ca failed: %v", err)
-		return
 	}
 
+	
 	// Public key
-	certOut, err := os.Create("ca.crt")
+	certOut, err := os.Create(filepath.Join(outCertDirectory,"ca.crt"))
 	if err != nil {
-		log.Fatal("create ca.crt failed", err)
+		log.Fatalf("Create ca.crt failed: %v", err)
 	}
 	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: ca_b})
 	certOut.Close()
-	log.Print("ca.crt created\n")
+	log.Printf("ca.crt created at %v\n", filepath.Join(outCertDirectory,"ca.crt"))
 
 	// Private key
-	keyOut, err := os.OpenFile("ca.key", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	keyOut, err := os.OpenFile(filepath.Join(outCertDirectory,"ca.key"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
-		log.Fatal("create ca.key failed", err)
+		log.Fatalf("Create ca.key failed: %v", err)
 	}
 	pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
 	keyOut.Close()
-	log.Print("ca.key created\n")
+	log.Printf("ca.key created at %v\n",filepath.Join(outCertDirectory,"ca.key") )
 }
 
-func signCert() {
+func signCert(outCertDirectory string, inBumperSan string) {
 
 	// Load CA
-	catls, err := tls.LoadX509KeyPair("ca.crt", "ca.key")
+	catls, err := tls.LoadX509KeyPair(filepath.Join(outCertDirectory,"ca.crt"), filepath.Join(outCertDirectory,"ca.key"))
 	if err != nil {
-		log.Fatal("error loading ca cert", err)
+		log.Fatalf("Error loading ca cert: %v", err)
 	}
 
 	ca, err := x509.ParseCertificate(catls.Certificate[0])
 	if err != nil {
-		log.Fatal("error parsing ca cert", err)
+		log.Fatalf("Error parsing ca cert: %v", err)
 	}
 
 	hostname, _ := os.Hostname()
@@ -109,10 +154,19 @@ func signCert() {
 	//DNS/SAN names for cert
 	dnsNames := []string{hostname, "localhost"}
 	//Read SANs from file
-	if fileExists("Bumper_SAN.txt") {
+	//get absolute path
-		sans, err := readLines("Bumper_SAN.txt")
+	
+	bexists, isbfile := pathExistsType(inBumperSan)
+	if !bexists {
+		log.Print("Bumper SAN doesn't exist, certificate won't contain Subject Alternate Names")
+	}
+	if bexists && !isbfile {
+		log.Print("Bumper SAN is a directory instead of file, certificate won't contain Subject Alternate Names")
+	}
+	if bexists && isbfile {
+		sans, err := readLines(inBumperSan)
 		if err != nil {
-			log.Fatalf("readLines: %s", err)
+			log.Printf("Error reading %v certificates will be created without Subject Alternate Names: %v", inBumperSan, err)
 		}
 		dnsNames = append(dnsNames, sans...)
 	}
@@ -141,22 +195,22 @@ func signCert() {
 	cert_b, err := x509.CreateCertificate(rand.Reader, &template, ca, pubKey, catls.PrivateKey)	
 
 	// Public key
-	certOut, err := os.Create("bumper.crt")
+	certOut, err := os.Create(filepath.Join(outCertDirectory, "bumper.crt"))
 	if err != nil {
-		log.Fatal("create bumper.crt failed", err)
+		log.Fatalf("Create bumper.crt failed: %v", err)
 	}
 	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: cert_b})
 	certOut.Close()
-	log.Print("bumper.crt created\n")
+	log.Printf("bumper.crt created at %v\n", filepath.Join(outCertDirectory, "bumper.crt"))
 
 	// Private key
-	keyOut, err := os.OpenFile("bumper.key", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	keyOut, err := os.OpenFile(filepath.Join(outCertDirectory, "bumper.key"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
-		log.Fatal("create bumper.key failed", err)
+		log.Fatalf("create bumper.key failed: %v", err)
 	}
 	pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)})
 	keyOut.Close()
-	log.Print("bumper.key created\n")
+	log.Printf("bumper.key created at %v\n", filepath.Join(outCertDirectory, "bumper.key"))
 }
 
 func bigIntHash(n *big.Int) []byte {
@@ -182,12 +236,11 @@ func readLines(path string) ([]string, error) {
 	return lines, scanner.Err()
 }
 
-// fileExists checks if a file exists and is not a directory before we
+// pathexistsType checks if a path exists and is a file or directory
-// try using it to prevent further errors.
+func pathExistsType(filename string) (exists bool, isfile bool) {
-func fileExists(filename string) bool {
 	info, err := os.Stat(filename)
 	if os.IsNotExist(err) {
-		return false
+		return false, false
 	}
-	return !info.IsDir()
+	return true, !info.IsDir()
 }