Fix for RSA Keys which are read only

[BlackDex]

Sometimes an RSA Key file could be read only.
We currently failed because we also wanted to write. Added an extra check if the file exists already and is not 0 in size. If it does already exists and is larger then 0, then open in read only mode.

Fixes #4644

[dani-garcia]

I'm thinking that we could instead make something like this:

pub fn initialize_keys() -> Result<(), crate::error::Error> {
    fn read_key(create_if_missing: bool) -> Result<(Rsa<Private>, Vec<u8>), crate::error::Error> {
        let mut priv_key_buffer = Vec::with_capacity(2048);

        let mut priv_key_file = File::options()
            .create(create_if_missing)
            .truncate(false)
            .read(true)
            .write(create_if_missing)
            .open(CONFIG.private_rsa_key())?;

        #[allow(clippy::verbose_file_reads)]
        let bytes_read = priv_key_file.read_to_end(&mut priv_key_buffer)?;

        let rsa_key = if bytes_read > 0 {
            Rsa::private_key_from_pem(&priv_key_buffer[..bytes_read])?
        } else if create_if_missing {
            // Only create the key if the file doesn't exist or is empty
            let rsa_key = openssl::rsa::Rsa::generate(2048)?;
            priv_key_buffer = rsa_key.private_key_to_pem()?;
            priv_key_file.write_all(&priv_key_buffer)?;
            info!("Private key created correctly.");
            rsa_key
        } else {
            err!("Private key doesn't exist")
        };

        Ok((rsa_key, priv_key_buffer))
    }

    let (priv_key, priv_key_buffer) = read_key(true).or_else(|_| read_key(false))?;

    let pub_key_buffer = priv_key.public_key_to_pem()?;

    let enc = EncodingKey::from_rsa_pem(&priv_key_buffer)?;
    let dec: DecodingKey = DecodingKey::from_rsa_pem(&pub_key_buffer)?;
    if PRIVATE_RSA_KEY.set(enc).is_err() {
        err!("PRIVATE_RSA_KEY must only be initialized once")
    }
    if PUBLIC_RSA_KEY.set(dec).is_err() {
        err!("PUBLIC_RSA_KEY must only be initialized once")
    }
    Ok(())
}

We optimistically try to open it read/write and do the operation atomically, if that fails we can retry read-only. If the file is in read-only mode we don't really care about the atomicity of the operation anyway.

[BlackDex]

@dani-garcia, done :)