| 1 | # Copyright 1999-2004 Gentoo Foundation |
1 | # Copyright 1999-2004 Gentoo Foundation |
| 2 | # Distributed under the terms of the GNU General Public License v2 |
2 | # Distributed under the terms of the GNU General Public License v2 |
| 3 | # $Header: /var/cvsroot/gentoo-x86/eclass/ssl-cert.eclass,v 1.5 2004/06/25 00:39:48 vapier Exp $ |
3 | # $Header: /var/cvsroot/gentoo-x86/eclass/ssl-cert.eclass,v 1.16 2008/04/14 06:37:44 ulm Exp $ |
| 4 | # |
4 | # |
|
|
5 | # @ECLASS: ssl-cert.eclass |
|
|
6 | # @MAINTAINER: |
| 5 | # Author: Max Kalika <max@gentoo.org> |
7 | # Author: Max Kalika <max@gentoo.org> |
| 6 | # |
8 | # @BLURB: Eclass for SSL certificates |
|
|
9 | # @DESCRIPTION: |
| 7 | # This eclass implements standard installation procedure for installing |
10 | # This eclass implements a standard installation procedure for installing |
| 8 | # self-signed SSL certificates. |
11 | # self-signed SSL certificates. |
| 9 | |
12 | # @EXAMPLE: |
| 10 | ECLASS=ssl-cert |
13 | # "install_cert /foo/bar" installs ${ROOT}/foo/bar.{key,csr,crt,pem} |
| 11 | INHERITED="$INHERITED $ECLASS" |
|
|
| 12 | |
14 | |
| 13 | # Conditionally depend on OpenSSL: allows inheretence |
15 | # Conditionally depend on OpenSSL: allows inheretence |
| 14 | # without pulling extra packages if not needed |
16 | # without pulling extra packages if not needed |
| 15 | DEPEND="ssl? ( dev-libs/openssl )" |
17 | DEPEND="ssl? ( dev-libs/openssl )" |
|
|
18 | IUSE="ssl" |
| 16 | |
19 | |
|
|
20 | # @FUNCTION: gen_cnf |
|
|
21 | # @USAGE: |
|
|
22 | # @DESCRIPTION: |
| 17 | # Initializes variables and generates the needed |
23 | # Initializes variables and generates the needed |
| 18 | # OpenSSL configuration file and a CA serial file |
24 | # OpenSSL configuration file and a CA serial file |
| 19 | # |
25 | # |
| 20 | # Access: private |
26 | # Access: private |
| 21 | gen_cnf() { |
27 | gen_cnf() { |
| 22 | # Location of the config file |
28 | # Location of the config file |
| … | |
… | |
| 26 | # Location of some random files OpenSSL can use: don't use |
32 | # Location of some random files OpenSSL can use: don't use |
| 27 | # /dev/u?random here -- doesn't work properly on all platforms |
33 | # /dev/u?random here -- doesn't work properly on all platforms |
| 28 | SSL_RANDOM="${T}/environment:${T}/eclass-debug.log:/etc/resolv.conf" |
34 | SSL_RANDOM="${T}/environment:${T}/eclass-debug.log:/etc/resolv.conf" |
| 29 | |
35 | |
| 30 | # These can be overridden in the ebuild |
36 | # These can be overridden in the ebuild |
| 31 | SSL_DAYS="${SSL_BITS:-730}" |
37 | SSL_DAYS="${SSL_DAYS:-730}" |
| 32 | SSL_BITS="${SSL_BITS:-1024}" |
38 | SSL_BITS="${SSL_BITS:-1024}" |
| 33 | SSL_COUNTRY="${SSL_COUNTRY:-US}" |
39 | SSL_COUNTRY="${SSL_COUNTRY:-US}" |
| 34 | SSL_STATE="${SSL_STATE:-California}" |
40 | SSL_STATE="${SSL_STATE:-California}" |
| 35 | SSL_LOCALITY="${SSL_LOCALITY:-Santa Barbara}" |
41 | SSL_LOCALITY="${SSL_LOCALITY:-Santa Barbara}" |
| 36 | SSL_ORGANIZATION="${SSL_ORGANIZATION:-SSL Server}" |
42 | SSL_ORGANIZATION="${SSL_ORGANIZATION:-SSL Server}" |
| … | |
… | |
| 56 | OU = ${SSL_UNIT} |
62 | OU = ${SSL_UNIT} |
| 57 | CN = ${SSL_COMMONNAME} |
63 | CN = ${SSL_COMMONNAME} |
| 58 | emailAddress = ${SSL_EMAIL} |
64 | emailAddress = ${SSL_EMAIL} |
| 59 | EOF |
65 | EOF |
| 60 | eend $? |
66 | eend $? |
| 61 | |
|
|
| 62 | return $? |
|
|
| 63 | } |
|
|
| 64 | |
67 | |
|
|
68 | return $? |
|
|
69 | } |
|
|
70 | |
|
|
71 | # @FUNCTION: get_base |
|
|
72 | # @USAGE: [if_ca] |
|
|
73 | # @RETURN: <base path> |
|
|
74 | # @DESCRIPTION: |
| 65 | # Simple function to determine whether we're creating |
75 | # Simple function to determine whether we're creating |
| 66 | # a CA (which should only be done once) or final part |
76 | # a CA (which should only be done once) or final part |
| 67 | # |
77 | # |
| 68 | # Access: private |
78 | # Access: private |
| 69 | get_base() { |
79 | get_base() { |
| … | |
… | |
| 72 | else |
82 | else |
| 73 | echo "${T}/${$}server" |
83 | echo "${T}/${$}server" |
| 74 | fi |
84 | fi |
| 75 | } |
85 | } |
| 76 | |
86 | |
|
|
87 | # @FUNCTION: gen_key |
|
|
88 | # @USAGE: <base path> |
|
|
89 | # @DESCRIPTION: |
| 77 | # Generates an RSA key |
90 | # Generates an RSA key |
| 78 | # |
91 | # |
| 79 | # Access: private |
92 | # Access: private |
| 80 | gen_key() { |
93 | gen_key() { |
| 81 | local base=`get_base $1` |
94 | local base=`get_base $1` |
| … | |
… | |
| 85 | eend $? |
98 | eend $? |
| 86 | |
99 | |
| 87 | return $? |
100 | return $? |
| 88 | } |
101 | } |
| 89 | |
102 | |
|
|
103 | # @FUNCTION: gen_csr |
|
|
104 | # @USAGE: <base path> |
|
|
105 | # @DESCRIPTION: |
| 90 | # Generates a certificate signing request using |
106 | # Generates a certificate signing request using |
| 91 | # the key made by gen_key() |
107 | # the key made by gen_key() |
| 92 | # |
108 | # |
| 93 | # Access: private |
109 | # Access: private |
| 94 | gen_csr() { |
110 | gen_csr() { |
| … | |
… | |
| 99 | eend $? |
115 | eend $? |
| 100 | |
116 | |
| 101 | return $? |
117 | return $? |
| 102 | } |
118 | } |
| 103 | |
119 | |
|
|
120 | # @FUNCTION: gen_crt |
|
|
121 | # @USAGE: <base path> |
|
|
122 | # @DESCRIPTION: |
| 104 | # Generates either a self-signed CA certificate using |
123 | # Generates either a self-signed CA certificate using |
| 105 | # the csr and key made by gen_csr() and gen_key() or |
124 | # the csr and key made by gen_csr() and gen_key() or |
| 106 | # a signed server certificate using the CA cert previously |
125 | # a signed server certificate using the CA cert previously |
| 107 | # created by gen_crt() |
126 | # created by gen_crt() |
| 108 | # |
127 | # |
| … | |
… | |
| 125 | eend $? |
144 | eend $? |
| 126 | |
145 | |
| 127 | return $? |
146 | return $? |
| 128 | } |
147 | } |
| 129 | |
148 | |
|
|
149 | # @FUNCTION: gen_pem |
|
|
150 | # @USAGE: <base path> |
|
|
151 | # @DESCRIPTION: |
| 130 | # Generates a PEM file by concatinating the key |
152 | # Generates a PEM file by concatinating the key |
| 131 | # and cert file created by gen_key() and gen_cert() |
153 | # and cert file created by gen_key() and gen_cert() |
| 132 | # |
154 | # |
| 133 | # Access: private |
155 | # Access: private |
| 134 | gen_pem() { |
156 | gen_pem() { |
| … | |
… | |
| 138 | eend $? |
160 | eend $? |
| 139 | |
161 | |
| 140 | return $? |
162 | return $? |
| 141 | } |
163 | } |
| 142 | |
164 | |
|
|
165 | # Removed due to bug 174759 |
|
|
166 | docert() { |
|
|
167 | eerror "Function \"docert\" has been removed for security reasons." |
|
|
168 | eerror "\"install_cert\" should be used instead. See bug 174759." |
|
|
169 | die |
|
|
170 | } |
|
|
171 | |
|
|
172 | # @FUNCTION: install_cert |
|
|
173 | # @USAGE: <certificates> |
|
|
174 | # @DESCRIPTION: |
| 143 | # Uses all the private functions above to generate |
175 | # Uses all the private functions above to generate and install the |
| 144 | # and install the requested certificates |
176 | # requested certificates. |
|
|
177 | # <certificates> are full pathnames relative to ROOT, without extension. |
|
|
178 | # |
|
|
179 | # Example: "install_cert /foo/bar" installs ${ROOT}/foo/bar.{key,csr,crt,pem} |
| 145 | # |
180 | # |
| 146 | # Access: public |
181 | # Access: public |
| 147 | docert() { |
182 | install_cert() { |
| 148 | if [ $# -lt 1 ] ; then |
183 | if [ $# -lt 1 ] ; then |
| 149 | eerror "At least one argument needed" |
184 | eerror "At least one argument needed" |
| 150 | return 1; |
185 | return 1; |
| 151 | fi |
186 | fi |
|
|
187 | |
|
|
188 | case ${EBUILD_PHASE} in |
|
|
189 | unpack|compile|test|install) |
|
|
190 | eerror "install_cert cannot be called in ${EBUILD_PHASE}" |
|
|
191 | return 1 ;; |
|
|
192 | esac |
| 152 | |
193 | |
| 153 | # Initialize configuration |
194 | # Initialize configuration |
| 154 | gen_cnf || return 1 |
195 | gen_cnf || return 1 |
| 155 | echo |
196 | echo |
| 156 | |
197 | |
| … | |
… | |
| 160 | gen_crt 1 || return 1 |
201 | gen_crt 1 || return 1 |
| 161 | echo |
202 | echo |
| 162 | |
203 | |
| 163 | local count=0 |
204 | local count=0 |
| 164 | for cert in "$@" ; do |
205 | for cert in "$@" ; do |
| 165 | # Sanitize and check the requested certificate |
206 | # Check the requested certificate |
| 166 | cert="`/usr/bin/basename "${cert}"`" |
|
|
| 167 | if [ -z "${cert}" ] ; then |
207 | if [ -z "${cert##*/}" ] ; then |
| 168 | ewarn "Invalid certification requested, skipping" |
208 | ewarn "Invalid certification requested, skipping" |
| 169 | continue |
209 | continue |
| 170 | fi |
210 | fi |
| 171 | |
211 | |
| 172 | # Check for previous existence of generated files |
212 | # Check for previous existence of generated files |
| 173 | for type in key crt pem ; do |
213 | for type in key csr crt pem ; do |
| 174 | if [ -e "${D}${INSDESTTREE}/${cert}.${type}" ] ; then |
214 | if [ -e "${ROOT}${cert}.${type}" ] ; then |
| 175 | ewarn "${D}${INSDESTTREE}/${cert}.${type}: exists, skipping" |
215 | ewarn "${ROOT}${cert}.${type}: exists, skipping" |
| 176 | continue 2 |
216 | continue 2 |
| 177 | fi |
217 | fi |
| 178 | done |
218 | done |
| 179 | |
219 | |
| 180 | # Generate the requested files |
220 | # Generate the requested files |
| … | |
… | |
| 183 | gen_crt || continue |
223 | gen_crt || continue |
| 184 | gen_pem || continue |
224 | gen_pem || continue |
| 185 | echo |
225 | echo |
| 186 | |
226 | |
| 187 | # Install the generated files and set sane permissions |
227 | # Install the generated files and set sane permissions |
| 188 | local base=`get_base` |
228 | local base=$(get_base) |
|
|
229 | install -d "${ROOT}${cert%/*}" |
| 189 | newins "${base}.key" "${cert}.key" |
230 | install -m0400 "${base}.key" "${ROOT}${cert}.key" |
| 190 | fperms 0400 "${INSDESTTREE}/${cert}.key" |
|
|
| 191 | newins "${base}.csr" "${cert}.csr" |
231 | install -m0444 "${base}.csr" "${ROOT}${cert}.csr" |
| 192 | fperms 0444 "${INSDESTTREE}/${cert}.csr" |
|
|
| 193 | newins "${base}.crt" "${cert}.crt" |
232 | install -m0444 "${base}.crt" "${ROOT}${cert}.crt" |
| 194 | fperms 0444 "${INSDESTTREE}/${cert}.crt" |
|
|
| 195 | newins "${base}.pem" "${cert}.pem" |
233 | install -m0400 "${base}.pem" "${ROOT}${cert}.pem" |
| 196 | fperms 0400 "${INSDESTTREE}/${cert}.pem" |
|
|
| 197 | count=$((${count}+1)) |
234 | count=$((${count}+1)) |
| 198 | done |
235 | done |
| 199 | |
236 | |
| 200 | # Resulting status |
237 | # Resulting status |
| 201 | if [ ! ${count} ] ; then |
238 | if [ ! ${count} ] ; then |
Parent Directory
| 
Revision Log
| 
Patch