مشاهدة ملف: make-ssl-cert

#!/bin/bash -e
# This is a mockup of a script to produce a snakeoil cert
# The aim is to have a debconfisable ssl-certificate script

# shellcheck source=/dev/null disable=SC1091
. /usr/share/debconf/confmodule
db_version 2.0
db_capb backup

progname=$(basename "${0}")

usage() {
    cat <<EOF
Usage: ${progname} [options] <template> <output>
       ${progname} [options] generate-default-snakeoil

Options:
       -h,--help                 This usage text
       -f,--force-overwrite      Overwrite existing .pem and .key files
       -n,--no-overwrite         Never overwrite existing snakeoil .pem and
                                 .key files, even if algorithms are out of date
       -x,--expiration-days <N>  Override default expiration time
EOF
    exit "${1}";
}

ask_via_debconf() {
    RET=""
    if db_settitle make-ssl-cert/title ; then
	: # OK
    else
	echo "Debconf failed with error code $? $RET" >&2
	echo "Maybe your debconf database is corrupt." >&2
	echo "Try re-installing ssl-cert." >&2
    fi

    RET=""
    while [ "x$RET" = "x" ]; do
	db_fset make-ssl-cert/hostname seen false
	db_input high make-ssl-cert/hostname || true
	db_go
	db_get make-ssl-cert/hostname
    done

    db_get make-ssl-cert/hostname
    HostName="$RET"
    db_fset make-ssl-cert/hostname seen false

    db_fset make-ssl-cert/altname seen false
    db_input high make-ssl-cert/altname || true
    db_go
    db_get make-ssl-cert/altname
    AddAltName="$RET"
    db_fset make-ssl-cert/altname seen false
    SubjectAltName="DNS:$HostName"
    [ -z "$AddAltName" ] || SubjectAltName="$SubjectAltName,$AddAltName"
}

make_snakeoil() {
    if ! HostName="$(hostname -f)" ; then
	HostName="$(hostname)"
	echo "make-ssl-cert: Could not get FQDN, using '$HostName'".
	echo "make-ssl-cert: You may want to fix your /etc/hosts and/or DNS setup and run"
	echo "make-ssl-cert: 'make-ssl-cert generate-default-snakeoil --force-overwrite'"
	echo "make-ssl-cert: again."
    fi
    SubjectAltName="DNS:$HostName"
    if [ ${#HostName} -gt 64 ] ; then
	# The certificate's common name cannot be longer than 64 chars.
	# Use the short name instead.
	HostName="$(hostname)"
    fi
}

create_temporary_cnf() {
    sed -e s#@HostName@#"$HostName"# -e s#@SubjectAltName@#"$SubjectAltName"# "${template}" > "${TMPFILE}"
}

create_hash_link() {
    local file="$1"
    local cryptfile filename i
    filename=$(basename "$file")
    cryptfile=$(dirname "$file")/$(openssl x509 -hash -noout -in "$file")
    i=0
    while [ -L "${cryptfile}.$i" ] ; do
	if [ "$(readlink "${cryptfile}.$i")" = "$filename" ] ; then
	    return 0
	fi
	i=$(( i + 1 ))
    done
    ln -sf "$filename" "${cryptfile}.$i"
}

check_min_algo() {
    local file="$1"
    local bits
    if ! openssl x509 -text -in "$file" | grep -q 'Signature Algorithm:.*sha256' ; then
	echo "Signature algorithm of $file is not sha256. Recreating." >&2
	return 1
    fi
    bits=$(openssl x509 -text -in "$file" |grep -o "Public-Key: \\(.*\\)")
    # value: "Public-Key: (2048 bit)"
    bits="${bits##*\(}"
    bits="${bits% bit\)}"
    case "$bits" in
	[0-9][0-9][0-9][0-9])
	    ;;
	*)
	    echo "WARNING: Cannot determine RSA key length" >&2
	    return 0
	    ;;
    esac
    if [ "$bits" -lt 2048 ] ; then
	echo "RSA key length of $file is $bits. Recreating with 2048 bits" >&2
	return 1
    fi
    return 0
}

# Process arguments
subcommand=
template=
opt_force_overwrite="false"
opt_no_overwrite="false"
opt_expiration_days="3650"

# Transform long options to short ones
newargs=()
for arg in "${@}"; do
    case "${arg}" in
	--help)            newargs+=(-h)     ;;
	--force-overwrite)
	    # Move to front so that we accept --force-overwrite at the end, for
	    # compatibility with 1.0.x.
	    newargs=("-f" "${newargs[@]}")   ;;
	--no-overwrite)    newargs+=(-n)     ;;
	--expiration-days) newargs+=(-x)     ;;
	--*)
	    printf "Unrecognized option %s\n\n" "${arg}"
	    usage 1
	    ;;
	*)                 newargs+=("$arg") ;;
    esac
done
set -- "${newargs[@]}"

# Parse short options
while getopts "hfnx:" opt "${@}"; do
    case "${opt}" in
	h) usage 0                                ;;
	f) opt_force_overwrite="true"             ;;
	n) opt_no_overwrite="true"                ;;
	x) opt_expiration_days="${OPTIND}"        ;;
	*)
	    printf "Unrecognized option %s\n\n" "-${opt}"
	    usage 1
	    ;;
    esac
done
shift "$((OPTIND - 1))"

if $opt_force_overwrite && $opt_no_overwrite ; then
	usage 1
fi

# Parse subcommand
if [ "${1}" = "generate-default-snakeoil" ]; then
    subcommand="${1}"
else
    subcommand="manual"
    template="${1}"
fi

# Takes two arguments, the base layout and the output cert.
if [ "${subcommand}" = "manual" ]; then
    output="${2}"
    [ -n "${template}" ] || usage 1
    [ -n "${output}" ]   || usage 1

    # be anal in manual mode.
    if [ ! -f "${template}" ]; then
	printf "Could not open template file: %s!\n" "${template}";
	exit 1;
    fi
    if [ -f "${output}" ] && [ "${opt_force_overwrite}" != "true" ]; then
	printf "%s file already exists!\n" "${output}";
	exit 1;
    fi
    ask_via_debconf
elif [ "${subcommand}" = "generate-default-snakeoil" ]; then
    template="/usr/share/ssl-cert/ssleay.cnf"
    if [ -f "/etc/ssl/certs/ssl-cert-snakeoil.pem" ] && [ -f "/etc/ssl/private/ssl-cert-snakeoil.key" ]; then
	if "${opt_no_overwrite}" ; then
	    exit 0
	fi
	if ! "${opt_force_overwrite}" ; then
	    if check_min_algo "/etc/ssl/certs/ssl-cert-snakeoil.pem" ; then
		exit 0
	    fi
	fi
    fi
    make_snakeoil
else
    usage 1
fi

# # should be a less common char
# problem is that openssl virtually accepts everything and we need to
# sacrifice one char.

TMPFILE="$(mktemp)" || exit 1
TMPOUT="$(mktemp)"  || exit 1

trap 'rm -f ${TMPFILE} ${TMPOUT}' EXIT

create_temporary_cnf

# create the certificate.

umask 077

if [ "${subcommand}" = "manual" ]; then
    if ! openssl req -config "${TMPFILE}" -new -x509 -days "${opt_expiration_days}" -nodes -sha256 \
	-out "${output}" -keyout "${output}" > "${TMPOUT}" 2>&1
    then
	echo "Could not create certificate. Openssl output was:" >&2
	cat "${TMPOUT}" >&2
	exit 1
    fi
    chmod 600 "${output}"
    create_hash_link "${output}"
elif [ "${subcommand}" = "generate-default-snakeoil" ]; then
    if ! openssl req -config "${TMPFILE}" -new -x509 -days "${opt_expiration_days}" -nodes -sha256 \
	-out /etc/ssl/certs/ssl-cert-snakeoil.pem \
	-keyout /etc/ssl/private/ssl-cert-snakeoil.key > "${TMPOUT}" 2>&1
    then
	echo "Could not create certificate. Openssl output was:" >&2
	cat "${TMPOUT}" >&2
	exit 1
    fi
    chmod 644 /etc/ssl/certs/ssl-cert-snakeoil.pem
    chmod 640 /etc/ssl/private/ssl-cert-snakeoil.key
    chown root:ssl-cert /etc/ssl/private/ssl-cert-snakeoil.key
    create_hash_link /etc/ssl/certs/ssl-cert-snakeoil.pem
else
    usage 1
fi