From 0358f6c660e6130b94ca8c53ec7b34d796605dd8 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Thu, 21 Nov 2024 22:05:49 +0100
Subject: pki: T6809: Support system install of CA certificates

---
 interface-definitions/pki.xml.in |  6 ++++++
 python/vyos/defaults.py          |  3 ++-
 src/conf_mode/pki.py             | 29 +++++++++++++++++++++++++++++
 src/init/vyos-router             |  6 ++++++
 4 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/interface-definitions/pki.xml.in b/interface-definitions/pki.xml.in
index b922771c1..c69886a4b 100644
--- a/interface-definitions/pki.xml.in
+++ b/interface-definitions/pki.xml.in
@@ -35,6 +35,12 @@
               <multi/>
             </properties>
           </leafNode>
+          <leafNode name="system-install">
+            <properties>
+              <help>Install into CA certificate store on router</help>
+              <valueless/>
+            </properties>
+          </leafNode>
           #include <include/pki/cli-revoke.xml.i>
         </children>
       </tagNode>
diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py
index dec619d3e..425990967 100644
--- a/python/vyos/defaults.py
+++ b/python/vyos/defaults.py
@@ -36,7 +36,8 @@ directories = {
   'isc_dhclient_dir' : '/run/dhclient',
   'dhcp6_client_dir' : '/run/dhcp6c',
   'vyos_configdir' : '/opt/vyatta/config',
-  'completion_dir' : f'{base_dir}/completion'
+  'completion_dir' : f'{base_dir}/completion',
+  'ca_certificates' : '/usr/local/share/ca-certificates/vyos'
 }
 
 config_status = '/tmp/vyos-config-status'
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index 4ff15d56e..acea2c9be 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -50,6 +50,7 @@ from vyos import airbag
 airbag.enable()
 
 vyos_certbot_dir = directories['certbot']
+vyos_ca_certificates_dir = directories['ca_certificates']
 
 # keys to recursively search for under specified path
 sync_search = [
@@ -397,10 +398,33 @@ def verify(pki):
 
     return None
 
+def cleanup_system_ca():
+    if not os.path.exists(vyos_ca_certificates_dir):
+        os.mkdir(vyos_ca_certificates_dir)
+    else:
+        for filename in os.listdir(vyos_ca_certificates_dir):
+            full_path = os.path.join(vyos_ca_certificates_dir, filename)
+            if os.path.isfile(full_path):
+                os.unlink(full_path)
+
 def generate(pki):
     if not pki:
+        cleanup_system_ca()
         return None
 
+    # Create or cleanup CA install directory
+    if 'changed' in pki and 'ca' in pki['changed']:
+        cleanup_system_ca()
+
+        if 'ca' in pki:
+            for ca, ca_conf in pki['ca'].items():
+                if 'system_install' in ca_conf:
+                    ca_obj = load_certificate(ca_conf['certificate'])
+                    ca_path = os.path.join(vyos_ca_certificates_dir, f'{ca}.crt')
+
+                    with open(ca_path, 'w') as f:
+                        f.write(encode_certificate(ca_obj))
+
     # Certbot renewal only needs to re-trigger the services to load up the
     # new PEM file
     if 'certbot_renew' in pki:
@@ -467,6 +491,7 @@ def apply(pki):
     systemd_certbot_name = 'certbot.timer'
     if not pki:
         call(f'systemctl stop {systemd_certbot_name}')
+        call('update-ca-certificates')
         return None
 
     has_certbot = False
@@ -484,6 +509,10 @@ def apply(pki):
     if 'changed' in pki:
         call_dependents()
 
+        # Rebuild ca-certificates bundle
+        if 'ca' in pki['changed']:
+            call('update-ca-certificates')
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 8825cc16a..f8cc87507 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -471,6 +471,12 @@ start ()
         touch /tmp/vyos.smoketest.debug
     fi
 
+    # Cleanup PKI CAs
+    if [ -d /usr/local/share/ca-certificates/vyos ]; then
+        rm -f /usr/local/share/ca-certificates/vyos/*.crt
+        update-ca-certificates >/dev/null 2>&1
+    fi
+
     log_action_begin_msg "Mounting VyOS Config"
     # ensure the vyatta_configdir supports a large number of inodes since
     # the config hierarchy is often inode-bound (instead of size).
-- 
cgit v1.2.3