/[gentoo-x86]/eclass/ssl-cert.eclass
Gentoo

Diff of /eclass/ssl-cert.eclass

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

Revision 1.5 Revision 1.16
1# Copyright 1999-2004 Gentoo Foundation 1# Copyright 1999-2004 Gentoo Foundation
2# Distributed under the terms of the GNU General Public License v2 2# Distributed under the terms of the GNU General Public License v2
3# $Header: /var/cvsroot/gentoo-x86/eclass/ssl-cert.eclass,v 1.5 2004/06/25 00:39:48 vapier Exp $ 3# $Header: /var/cvsroot/gentoo-x86/eclass/ssl-cert.eclass,v 1.16 2008/04/14 06:37:44 ulm Exp $
4# 4#
5# @ECLASS: ssl-cert.eclass
6# @MAINTAINER:
5# Author: Max Kalika <max@gentoo.org> 7# Author: Max Kalika <max@gentoo.org>
6# 8# @BLURB: Eclass for SSL certificates
9# @DESCRIPTION:
7# This eclass implements standard installation procedure for installing 10# This eclass implements a standard installation procedure for installing
8# self-signed SSL certificates. 11# self-signed SSL certificates.
9 12# @EXAMPLE:
10ECLASS=ssl-cert 13# "install_cert /foo/bar" installs ${ROOT}/foo/bar.{key,csr,crt,pem}
11INHERITED="$INHERITED $ECLASS"
12 14
13# Conditionally depend on OpenSSL: allows inheretence 15# Conditionally depend on OpenSSL: allows inheretence
14# without pulling extra packages if not needed 16# without pulling extra packages if not needed
15DEPEND="ssl? ( dev-libs/openssl )" 17DEPEND="ssl? ( dev-libs/openssl )"
18IUSE="ssl"
16 19
20# @FUNCTION: gen_cnf
21# @USAGE:
22# @DESCRIPTION:
17# Initializes variables and generates the needed 23# Initializes variables and generates the needed
18# OpenSSL configuration file and a CA serial file 24# OpenSSL configuration file and a CA serial file
19# 25#
20# Access: private 26# Access: private
21gen_cnf() { 27gen_cnf() {
22 # Location of the config file 28 # Location of the config file
26 # Location of some random files OpenSSL can use: don't use 32 # Location of some random files OpenSSL can use: don't use
27 # /dev/u?random here -- doesn't work properly on all platforms 33 # /dev/u?random here -- doesn't work properly on all platforms
28 SSL_RANDOM="${T}/environment:${T}/eclass-debug.log:/etc/resolv.conf" 34 SSL_RANDOM="${T}/environment:${T}/eclass-debug.log:/etc/resolv.conf"
29 35
30 # These can be overridden in the ebuild 36 # These can be overridden in the ebuild
31 SSL_DAYS="${SSL_BITS:-730}" 37 SSL_DAYS="${SSL_DAYS:-730}"
32 SSL_BITS="${SSL_BITS:-1024}" 38 SSL_BITS="${SSL_BITS:-1024}"
33 SSL_COUNTRY="${SSL_COUNTRY:-US}" 39 SSL_COUNTRY="${SSL_COUNTRY:-US}"
34 SSL_STATE="${SSL_STATE:-California}" 40 SSL_STATE="${SSL_STATE:-California}"
35 SSL_LOCALITY="${SSL_LOCALITY:-Santa Barbara}" 41 SSL_LOCALITY="${SSL_LOCALITY:-Santa Barbara}"
36 SSL_ORGANIZATION="${SSL_ORGANIZATION:-SSL Server}" 42 SSL_ORGANIZATION="${SSL_ORGANIZATION:-SSL Server}"
56 OU = ${SSL_UNIT} 62 OU = ${SSL_UNIT}
57 CN = ${SSL_COMMONNAME} 63 CN = ${SSL_COMMONNAME}
58 emailAddress = ${SSL_EMAIL} 64 emailAddress = ${SSL_EMAIL}
59 EOF 65 EOF
60 eend $? 66 eend $?
61
62 return $?
63}
64 67
68 return $?
69}
70
71# @FUNCTION: get_base
72# @USAGE: [if_ca]
73# @RETURN: <base path>
74# @DESCRIPTION:
65# Simple function to determine whether we're creating 75# Simple function to determine whether we're creating
66# a CA (which should only be done once) or final part 76# a CA (which should only be done once) or final part
67# 77#
68# Access: private 78# Access: private
69get_base() { 79get_base() {
72 else 82 else
73 echo "${T}/${$}server" 83 echo "${T}/${$}server"
74 fi 84 fi
75} 85}
76 86
87# @FUNCTION: gen_key
88# @USAGE: <base path>
89# @DESCRIPTION:
77# Generates an RSA key 90# Generates an RSA key
78# 91#
79# Access: private 92# Access: private
80gen_key() { 93gen_key() {
81 local base=`get_base $1` 94 local base=`get_base $1`
85 eend $? 98 eend $?
86 99
87 return $? 100 return $?
88} 101}
89 102
103# @FUNCTION: gen_csr
104# @USAGE: <base path>
105# @DESCRIPTION:
90# Generates a certificate signing request using 106# Generates a certificate signing request using
91# the key made by gen_key() 107# the key made by gen_key()
92# 108#
93# Access: private 109# Access: private
94gen_csr() { 110gen_csr() {
99 eend $? 115 eend $?
100 116
101 return $? 117 return $?
102} 118}
103 119
120# @FUNCTION: gen_crt
121# @USAGE: <base path>
122# @DESCRIPTION:
104# Generates either a self-signed CA certificate using 123# Generates either a self-signed CA certificate using
105# the csr and key made by gen_csr() and gen_key() or 124# the csr and key made by gen_csr() and gen_key() or
106# a signed server certificate using the CA cert previously 125# a signed server certificate using the CA cert previously
107# created by gen_crt() 126# created by gen_crt()
108# 127#
125 eend $? 144 eend $?
126 145
127 return $? 146 return $?
128} 147}
129 148
149# @FUNCTION: gen_pem
150# @USAGE: <base path>
151# @DESCRIPTION:
130# Generates a PEM file by concatinating the key 152# Generates a PEM file by concatinating the key
131# and cert file created by gen_key() and gen_cert() 153# and cert file created by gen_key() and gen_cert()
132# 154#
133# Access: private 155# Access: private
134gen_pem() { 156gen_pem() {
138 eend $? 160 eend $?
139 161
140 return $? 162 return $?
141} 163}
142 164
165# Removed due to bug 174759
166docert() {
167 eerror "Function \"docert\" has been removed for security reasons."
168 eerror "\"install_cert\" should be used instead. See bug 174759."
169 die
170}
171
172# @FUNCTION: install_cert
173# @USAGE: <certificates>
174# @DESCRIPTION:
143# Uses all the private functions above to generate 175# Uses all the private functions above to generate and install the
144# and install the requested certificates 176# requested certificates.
177# <certificates> are full pathnames relative to ROOT, without extension.
178#
179# Example: "install_cert /foo/bar" installs ${ROOT}/foo/bar.{key,csr,crt,pem}
145# 180#
146# Access: public 181# Access: public
147docert() { 182install_cert() {
148 if [ $# -lt 1 ] ; then 183 if [ $# -lt 1 ] ; then
149 eerror "At least one argument needed" 184 eerror "At least one argument needed"
150 return 1; 185 return 1;
151 fi 186 fi
187
188 case ${EBUILD_PHASE} in
189 unpack|compile|test|install)
190 eerror "install_cert cannot be called in ${EBUILD_PHASE}"
191 return 1 ;;
192 esac
152 193
153 # Initialize configuration 194 # Initialize configuration
154 gen_cnf || return 1 195 gen_cnf || return 1
155 echo 196 echo
156 197
160 gen_crt 1 || return 1 201 gen_crt 1 || return 1
161 echo 202 echo
162 203
163 local count=0 204 local count=0
164 for cert in "$@" ; do 205 for cert in "$@" ; do
165 # Sanitize and check the requested certificate 206 # Check the requested certificate
166 cert="`/usr/bin/basename "${cert}"`"
167 if [ -z "${cert}" ] ; then 207 if [ -z "${cert##*/}" ] ; then
168 ewarn "Invalid certification requested, skipping" 208 ewarn "Invalid certification requested, skipping"
169 continue 209 continue
170 fi 210 fi
171 211
172 # Check for previous existence of generated files 212 # Check for previous existence of generated files
173 for type in key crt pem ; do 213 for type in key csr crt pem ; do
174 if [ -e "${D}${INSDESTTREE}/${cert}.${type}" ] ; then 214 if [ -e "${ROOT}${cert}.${type}" ] ; then
175 ewarn "${D}${INSDESTTREE}/${cert}.${type}: exists, skipping" 215 ewarn "${ROOT}${cert}.${type}: exists, skipping"
176 continue 2 216 continue 2
177 fi 217 fi
178 done 218 done
179 219
180 # Generate the requested files 220 # Generate the requested files
183 gen_crt || continue 223 gen_crt || continue
184 gen_pem || continue 224 gen_pem || continue
185 echo 225 echo
186 226
187 # Install the generated files and set sane permissions 227 # Install the generated files and set sane permissions
188 local base=`get_base` 228 local base=$(get_base)
229 install -d "${ROOT}${cert%/*}"
189 newins "${base}.key" "${cert}.key" 230 install -m0400 "${base}.key" "${ROOT}${cert}.key"
190 fperms 0400 "${INSDESTTREE}/${cert}.key"
191 newins "${base}.csr" "${cert}.csr" 231 install -m0444 "${base}.csr" "${ROOT}${cert}.csr"
192 fperms 0444 "${INSDESTTREE}/${cert}.csr"
193 newins "${base}.crt" "${cert}.crt" 232 install -m0444 "${base}.crt" "${ROOT}${cert}.crt"
194 fperms 0444 "${INSDESTTREE}/${cert}.crt"
195 newins "${base}.pem" "${cert}.pem" 233 install -m0400 "${base}.pem" "${ROOT}${cert}.pem"
196 fperms 0400 "${INSDESTTREE}/${cert}.pem"
197 count=$((${count}+1)) 234 count=$((${count}+1))
198 done 235 done
199 236
200 # Resulting status 237 # Resulting status
201 if [ ! ${count} ] ; then 238 if [ ! ${count} ] ; then

Legend:
Removed from v.1.5  
changed lines
  Added in v.1.16

  ViewVC Help
Powered by ViewVC 1.1.20