openvpn: T3805: use vyos.util.write_file() to store certificates

2 files changed, 18 insertions, 44 deletions

diff --git a/python/vyos/util.py b/python/vyos/util.py
index 59f9f1c44..05643a223 100644
--- a/python/vyos/util.py
+++ b/python/vyos/util.py
@@ -197,7 +197,7 @@ def read_file(fname, defaultonfailure=None):
             return defaultonfailure
         raise e
 
-def write_file(fname, data, defaultonfailure=None, user=None, group=None):
+def write_file(fname, data, defaultonfailure=None, user=None, group=None, mode=None):
     """
     Write content of data to given fname, should defaultonfailure be not None,
     it is returned on failure to read.
@@ -215,6 +215,7 @@ def write_file(fname, data, defaultonfailure=None, user=None, group=None):
         with open(fname, 'w') as f:
             bytes = f.write(data)
         chown(fname, user, group)
+        chmod(fname, mode)
         return bytes
     except Exception as e:
         if defaultonfailure is not None:
@@ -295,7 +296,6 @@ def makedir(path, user=None, group=None):
     os.makedirs(path, mode=0o755)
     chown(path, user, group)
 
-
 def colon_separated_to_dict(data_string, uniquekeys=False):
     """ Converts a string containing newline-separated entries
         of colon-separated key-value pairs into a dict.
diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index 220c4f157..6918c46e0 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -48,9 +48,9 @@ from vyos.template import is_ipv4
 from vyos.template import is_ipv6
 from vyos.util import call
 from vyos.util import chown
-from vyos.util import chmod_600
 from vyos.util import dict_search
 from vyos.util import dict_search_args
+from vyos.util import write_file
 from vyos.validate import is_addr_assigned
 
 from vyos import ConfigError
@@ -498,7 +498,6 @@ def verify(openvpn):
 
 def generate_pki_files(openvpn):
     pki = openvpn['pki']
-
     if not pki:
         return None
 
@@ -506,16 +505,11 @@ def generate_pki_files(openvpn):
     shared_secret_key = dict_search_args(openvpn, 'shared_secret_key')
     tls = dict_search_args(openvpn, 'tls')
 
-    files = []
-
     if shared_secret_key:
         pki_key = pki['openvpn']['shared_secret'][shared_secret_key]
         key_path = os.path.join(cfg_dir, f'{interface}_shared.key')
-
-        with open(key_path, 'w') as f:
-            f.write(wrap_openvpn_key(pki_key['key']))
-
-        files.append(key_path)
+        write_file(key_path, wrap_openvpn_key(pki_key['key']),
+                   user=user, group=group)
 
     if tls:
         if 'ca_certificate' in tls:
@@ -524,20 +518,15 @@ def generate_pki_files(openvpn):
 
             if 'certificate' in pki_ca:
                 cert_path = os.path.join(cfg_dir, f'{interface}_ca.pem')
-
-                with open(cert_path, 'w') as f:
-                    f.write(wrap_certificate(pki_ca['certificate']))
-
-                files.append(cert_path)
+                write_file(cert_path, wrap_certificate(pki_ca['certificate']),
+                           user=user, group=group, mode=0o600)
 
             if 'crl' in pki_ca:
                 for crl in pki_ca['crl']:
                     crl_path = os.path.join(cfg_dir, f'{interface}_crl.pem')
+                    write_file(crl_path, wrap_crl(crl), user=user, group=group,
+                               mode=0o600)
 
-                    with open(crl_path, 'w') as f:
-                        f.write(wrap_crl(crl))
-
-                    files.append(crl_path)
                 openvpn['tls']['crl'] = True
 
         if 'certificate' in tls:
@@ -546,19 +535,14 @@ def generate_pki_files(openvpn):
 
             if 'certificate' in pki_cert:
                 cert_path = os.path.join(cfg_dir, f'{interface}_cert.pem')
-
-                with open(cert_path, 'w') as f:
-                    f.write(wrap_certificate(pki_cert['certificate']))
-
-                files.append(cert_path)
+                write_file(cert_path, wrap_certificate(pki_cert['certificate']),
+                           user=user, group=group, mode=0o600)
 
             if 'private' in pki_cert and 'key' in pki_cert['private']:
                 key_path = os.path.join(cfg_dir, f'{interface}_cert.key')
+                write_file(key_path, wrap_private_key(pki_cert['private']['key']),
+                           user=user, group=group, mode=0o600)
 
-                with open(key_path, 'w') as f:
-                    f.write(wrap_private_key(pki_cert['private']['key']))
-
-                files.append(key_path)
                 openvpn['tls']['private_key'] = True
 
         if 'dh_params' in tls:
@@ -567,11 +551,8 @@ def generate_pki_files(openvpn):
 
             if 'parameters' in pki_dh:
                 dh_path = os.path.join(cfg_dir, f'{interface}_dh.pem')
-
-                with open(dh_path, 'w') as f:
-                    f.write(wrap_dh_parameters(pki_dh['parameters']))
-
-                files.append(dh_path)
+                write_file(dh_path, wrap_dh_parameters(pki_dh['parameters']),
+                           user=user, group=group, mode=0o600)
 
         if 'auth_key' in tls:
             key_name = tls['auth_key']
@@ -579,11 +560,8 @@ def generate_pki_files(openvpn):
 
             if 'key' in pki_key:
                 key_path = os.path.join(cfg_dir, f'{interface}_auth.key')
-
-                with open(key_path, 'w') as f:
-                    f.write(wrap_openvpn_key(pki_key['key']))
-
-                files.append(key_path)
+                write_file(key_path, wrap_openvpn_key(pki_key['key']),
+                           user=user, group=group, mode=0o600)
 
         if 'crypt_key' in tls:
             key_name = tls['crypt_key']
@@ -620,7 +598,7 @@ def generate(openvpn):
         chown(ccd_dir, user, group)
 
     # Fix file permissons for keys
-    fix_permissions = generate_pki_files(openvpn)
+    generate_pki_files(openvpn)
 
     # Generate User/Password authentication file
     if 'authentication' in openvpn:
@@ -648,10 +626,6 @@ def generate(openvpn):
     render(cfg_file.format(**openvpn), 'openvpn/server.conf.tmpl', openvpn,
            formater=lambda _: _.replace(""", '"'), user=user, group=group)
 
-    # Fixup file permissions
-    for file in fix_permissions:
-        chmod_600(file)
-
     return None
 
 def apply(openvpn):