tls: add db_* commands for tls_mgm provisioning

[dariusstefan]

Motivation

The tls module could only write certificates and keys to files. Provisioning the tls_mgm table — where certificate, private_key and ca_list are stored as BLOBs rather than paths — had to be done by hand in SQL.

What this adds

tls db_add    [domain] [type] column=value ...
tls db_update [domain] [type] column=value ...
tls db_show   [domain] [type]
tls db_delete [domain] [type]
tls db_list

Everything is given as column=value, so the whole schema is reachable — method, cipher_list, verify_cert, match_ip_address and the rest, not just the certificate and the key:

opensips-cli -x tls db_add a.example.org server \
	certificate=/etc/letsencrypt/live/a.example.org/fullchain.pem \
	private_key=/etc/letsencrypt/live/a.example.org/privkey.pem \
	method=TLSv1_2 verify_cert=1

The four columns holding PEM content (certificate, private_key, ca_list, dh_params) take the path of the file holding it; the file is read and its content stored. Every other column is stored as the value it is given, paths included — so ca_list reads its file while ca_dir and crl_dir keep the directory as such, which is what tls_mgm expects of them. The distinction follows the schema: those four are the DB_BLOB columns, the rest are DB_STRING.

db_update changes only the columns it is given, which makes certificate renewal a single command rather than a delete followed by an add.

Columns left unset keep their schema default, so a server domain that relies on the module's global certificate/private_key modparams stays expressible — tls_mgm falls back to them on its own.

Identifying a domain

A row is identified by (domain, type), matching the table's UNIQUE (domain, type) constraint. Both are ordinary columns, so both can be written as column=value:

opensips-cli -x tls db_delete domain=a.example.org type=server

The first two bare arguments are a shorthand for the same two columns, in that order, which keeps the common case short:

opensips-cli -x tls db_delete a.example.org server

The two spellings can be mixed freely; supplying the same column both ways is the one ambiguous case and is refused, as is a third bare argument. id is refused outright — the database generates it.

Whatever is left out is then asked for, in one place rather than one per spelling. db_add and db_show default the type to server; db_update and db_delete have no default and keep asking until one is given, so the two commands that change an existing row cannot pick a different one than intended. db_list addresses no domain and asks for nothing.

There is deliberately no configuration setting for the type: it identifies a row rather than describing the environment, so it does not belong in opensips-cli.cfg next to the database URL.

Notes

• column=value follows the convention already used by the mi module, by -o/--option and by the interactive set command, and is split with split('=', 1) like all of them.
• One parser resolves both the identity and the columns, so db_show and db_delete now report the columns they do not take instead of ignoring them.
• Unknown column names, unreadable files and files that do not hold PEM are rejected before the database is touched, and before anything is asked for.
• After every change the tls_reload MI command is issued, so a running OpenSIPS picks up the domains without a restart. If OpenSIPS cannot be reached, a warning is logged and the domains load at the next restart.
• __complete__ offers the column names in interactive mode.
• The certificate generation path (rootCA, userCERT) is untouched.

Testing

Exercised by hand against MySQL 8.0 and a running OpenSIPS 4.0 with tls_mgm in DB mode: provisioning a certificate and key from PEM files in both the named and the positional form, the scalar columns round-tripping, unset columns coming back as schema NULLs, db_show rendering every column with the private key hidden, rejection of a duplicate (domain, type), of a column given both ways, of a surplus argument, of id= and of an unknown column, db_update patching a single column, and db_delete prompting for the type and removing the row. The tls_reload MI command reached OpenSIPS over the FIFO in each case.

No automated tests are included.