vanhofen
4 years ago
3 changed files with 0 additions and 412 deletions
@ -1,210 +0,0 @@ |
|||
#!/bin/sh |
|||
# |
|||
# Ben Secrest <blsecres@gmail.com> |
|||
# |
|||
# sh c_rehash script, scan all files in a directory |
|||
# and add symbolic links to their hash values. |
|||
# |
|||
# based on the c_rehash perl script distributed with openssl |
|||
# |
|||
# LICENSE: See OpenSSL license |
|||
# ^^acceptable?^^ |
|||
# |
|||
|
|||
# default certificate location |
|||
DIR=/etc/ssl |
|||
|
|||
# for filetype bitfield |
|||
IS_CERT=$(( 1 << 0 )) |
|||
IS_CRL=$(( 1 << 1 )) |
|||
|
|||
|
|||
# check to see if a file is a certificate file or a CRL file |
|||
# arguments: |
|||
# 1. the filename to be scanned |
|||
# returns: |
|||
# bitfield of file type; uses ${IS_CERT} and ${IS_CRL} |
|||
# |
|||
check_file() |
|||
{ |
|||
local IS_TYPE=0 |
|||
|
|||
# make IFS a newline so we can process grep output line by line |
|||
local OLDIFS=${IFS} |
|||
IFS=$( printf "\n" ) |
|||
|
|||
# XXX: could be more efficient to have two 'grep -m' but is -m portable? |
|||
for LINE in $( grep '^-----BEGIN .*-----' ${1} ) |
|||
do |
|||
if echo ${LINE} \ |
|||
| grep -q -E '^-----BEGIN (X509 |TRUSTED )?CERTIFICATE-----' |
|||
then |
|||
IS_TYPE=$(( ${IS_TYPE} | ${IS_CERT} )) |
|||
|
|||
if [ $(( ${IS_TYPE} & ${IS_CRL} )) -ne 0 ] |
|||
then |
|||
break |
|||
fi |
|||
elif echo ${LINE} | grep -q '^-----BEGIN X509 CRL-----' |
|||
then |
|||
IS_TYPE=$(( ${IS_TYPE} | ${IS_CRL} )) |
|||
|
|||
if [ $(( ${IS_TYPE} & ${IS_CERT} )) -ne 0 ] |
|||
then |
|||
break |
|||
fi |
|||
fi |
|||
done |
|||
|
|||
# restore IFS |
|||
IFS=${OLDIFS} |
|||
|
|||
return ${IS_TYPE} |
|||
} |
|||
|
|||
|
|||
# |
|||
# use openssl to fingerprint a file |
|||
# arguments: |
|||
# 1. the filename to fingerprint |
|||
# 2. the method to use (x509, crl) |
|||
# returns: |
|||
# none |
|||
# assumptions: |
|||
# user will capture output from last stage of pipeline |
|||
# |
|||
fingerprint() |
|||
{ |
|||
${SSL_CMD} ${2} -fingerprint -noout -in ${1} | sed 's/^.*=//' | tr -d ':' |
|||
} |
|||
|
|||
|
|||
# |
|||
# link_hash - create links to certificate files |
|||
# arguments: |
|||
# 1. the filename to create a link for |
|||
# 2. the type of certificate being linked (x509, crl) |
|||
# returns: |
|||
# 0 on success, 1 otherwise |
|||
# |
|||
link_hash() |
|||
{ |
|||
local FINGERPRINT=$( fingerprint ${1} ${2} ) |
|||
local HASH=$( ${SSL_CMD} ${2} -hash -noout -in ${1} ) |
|||
local SUFFIX=0 |
|||
local LINKFILE='' |
|||
local TAG='' |
|||
|
|||
if [ ${2} = "crl" ] |
|||
then |
|||
TAG='r' |
|||
fi |
|||
|
|||
LINKFILE=${HASH}.${TAG}${SUFFIX} |
|||
|
|||
while [ -f ${LINKFILE} ] |
|||
do |
|||
if [ ${FINGERPRINT} = $( fingerprint ${LINKFILE} ${2} ) ] |
|||
then |
|||
echo "WARNING: Skipping duplicate file ${1}" >&2 |
|||
return 1 |
|||
fi |
|||
|
|||
SUFFIX=$(( ${SUFFIX} + 1 )) |
|||
LINKFILE=${HASH}.${TAG}${SUFFIX} |
|||
done |
|||
|
|||
echo "${1} => ${LINKFILE}" |
|||
|
|||
# assume any system with a POSIX shell will either support symlinks or |
|||
# do something to handle this gracefully |
|||
ln -s ${1} ${LINKFILE} |
|||
|
|||
return 0 |
|||
} |
|||
|
|||
|
|||
# hash_dir create hash links in a given directory |
|||
hash_dir() |
|||
{ |
|||
echo "Doing ${1}" |
|||
|
|||
cd ${1} |
|||
|
|||
ls -1 * 2>/dev/null | while read FILE |
|||
do |
|||
if echo ${FILE} | grep -q -E '^[[:xdigit:]]{8}\.r?[[:digit:]]+$' \ |
|||
&& [ -h "${FILE}" ] |
|||
then |
|||
rm ${FILE} |
|||
fi |
|||
done |
|||
|
|||
ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE |
|||
do |
|||
check_file ${FILE} |
|||
local FILE_TYPE=${?} |
|||
local TYPE_STR='' |
|||
|
|||
if [ $(( ${FILE_TYPE} & ${IS_CERT} )) -ne 0 ] |
|||
then |
|||
TYPE_STR='x509' |
|||
elif [ $(( ${FILE_TYPE} & ${IS_CRL} )) -ne 0 ] |
|||
then |
|||
TYPE_STR='crl' |
|||
else |
|||
echo "WARNING: ${FILE} does not contain a certificate or CRL: skipping" >&2 |
|||
continue |
|||
fi |
|||
|
|||
link_hash ${FILE} ${TYPE_STR} |
|||
done |
|||
} |
|||
|
|||
|
|||
# choose the name of an ssl application |
|||
if [ -n "${OPENSSL}" ] |
|||
then |
|||
SSL_CMD=$(which ${OPENSSL} 2>/dev/null) |
|||
else |
|||
SSL_CMD=/usr/bin/openssl |
|||
OPENSSL=${SSL_CMD} |
|||
export OPENSSL |
|||
fi |
|||
|
|||
# fix paths |
|||
PATH=${PATH}:${DIR}/bin |
|||
export PATH |
|||
|
|||
# confirm existance/executability of ssl command |
|||
if ! [ -x ${SSL_CMD} ] |
|||
then |
|||
echo "${0}: rehashing skipped ('openssl' program not available)" >&2 |
|||
exit 0 |
|||
fi |
|||
|
|||
# determine which directories to process |
|||
old_IFS=$IFS |
|||
if [ ${#} -gt 0 ] |
|||
then |
|||
IFS=':' |
|||
DIRLIST=${*} |
|||
elif [ -n "${SSL_CERT_DIR}" ] |
|||
then |
|||
DIRLIST=$SSL_CERT_DIR |
|||
else |
|||
DIRLIST=${DIR}/certs |
|||
fi |
|||
|
|||
IFS=':' |
|||
|
|||
# process directories |
|||
for CERT_DIR in ${DIRLIST} |
|||
do |
|||
if [ -d ${CERT_DIR} -a -w ${CERT_DIR} ] |
|||
then |
|||
IFS=$old_IFS |
|||
hash_dir ${CERT_DIR} |
|||
IFS=':' |
|||
fi |
|||
done |
|||
@ -1,15 +0,0 @@ |
|||
#!/bin/sh |
|||
|
|||
CERTSCONF=/etc/ca-certificates.conf |
|||
CERTSDIR=/usr/share/ca-certificates |
|||
|
|||
rm -f $CERTSCONF |
|||
|
|||
subdirs="$(ls -1 $CERTSDIR)" |
|||
for subdir in $subdirs; do |
|||
certs="$(ls -1 $CERTSDIR/$subdir)" |
|||
for cert in $certs; do |
|||
echo "add $subdir/$cert" |
|||
echo "$subdir/$cert" >> $CERTSCONF |
|||
done |
|||
done |
|||
@ -1,187 +0,0 @@ |
|||
#!/bin/sh -e |
|||
# |
|||
# update-ca-certificates |
|||
# |
|||
# Copyright (c) 2003 Fumitoshi UKAI <ukai@debian.or.jp> |
|||
# Copyright (c) 2009 Philipp Kern <pkern@debian.org> |
|||
# |
|||
# This program is free software; you can redistribute it and/or modify |
|||
# it under the terms of the GNU General Public License as published by |
|||
# the Free Software Foundation; either version 2 of the License, or |
|||
# (at your option) any later version. |
|||
# |
|||
# This program is distributed in the hope that it will be useful, |
|||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
|||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|||
# GNU General Public License for more details. |
|||
# |
|||
# You should have received a copy of the GNU General Public License |
|||
# along with this program; if not, write to the Free Software |
|||
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02111-1301, |
|||
# USA. |
|||
# |
|||
|
|||
verbose=0 |
|||
fresh=0 |
|||
default=0 |
|||
CERTSCONF=/etc/ca-certificates.conf |
|||
CERTSDIR=/usr/share/ca-certificates |
|||
LOCALCERTSDIR=/var/share/ca-certificates |
|||
CERTBUNDLE=ca-certificates.crt |
|||
ETCCERTSDIR=/etc/ssl/certs |
|||
|
|||
while [ $# -gt 0 ]; |
|||
do |
|||
case $1 in |
|||
--verbose|-v) |
|||
verbose=1;; |
|||
--fresh|-f) |
|||
fresh=1;; |
|||
--default|-d) |
|||
default=1 |
|||
fresh=1;; |
|||
--certsconf) |
|||
shift |
|||
CERTSCONF="$1";; |
|||
--certsdir) |
|||
shift |
|||
CERTSDIR="$1";; |
|||
--localcertsdir) |
|||
shift |
|||
LOCALCERTSDIR="$1";; |
|||
--certbundle) |
|||
shift |
|||
CERTBUNDLE="$1";; |
|||
--etccertsdir) |
|||
shift |
|||
ETCCERTSDIR="$1";; |
|||
--help|-h|*) |
|||
echo "$0: [--verbose] [--fresh]" |
|||
exit;; |
|||
esac |
|||
shift |
|||
done |
|||
|
|||
if [ ! -s "$CERTSCONF" ] |
|||
then |
|||
fresh=1 |
|||
fi |
|||
|
|||
cleanup() { |
|||
rm -f "$TEMPBUNDLE" |
|||
rm -f "$ADDED" |
|||
rm -f "$REMOVED" |
|||
} |
|||
trap cleanup 0 |
|||
|
|||
# Helper files. (Some of them are not simple arrays because we spawn |
|||
# subshells later on.) |
|||
TEMPBUNDLE="$(mktemp -t "${CERTBUNDLE}.tmp.XXXXXX")" |
|||
ADDED="$(mktemp -t "ca-certificates.tmp.XXXXXX")" |
|||
REMOVED="$(mktemp -t "ca-certificates.tmp.XXXXXX")" |
|||
|
|||
# Adds a certificate to the list of trusted ones. This includes a symlink |
|||
# in /etc/ssl/certs to the certificate file and its inclusion into the |
|||
# bundle. |
|||
add() { |
|||
CERT="$1" |
|||
PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \ |
|||
-e 's/[()]/=/g' \ |
|||
-e 's/,/_/g').pem" |
|||
if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ] |
|||
then |
|||
ln -sf "$CERT" "$PEM" |
|||
echo "+$PEM" >> "$ADDED" |
|||
fi |
|||
# Add trailing newline to certificate, if it is missing (#635570) |
|||
sed -e '$a\' "$CERT" >> "$TEMPBUNDLE" |
|||
} |
|||
|
|||
remove() { |
|||
CERT="$1" |
|||
PEM="$ETCCERTSDIR/$(basename "$CERT" .crt).pem" |
|||
if test -L "$PEM" |
|||
then |
|||
rm -f "$PEM" |
|||
echo "-$PEM" >> "$REMOVED" |
|||
fi |
|||
} |
|||
|
|||
mkdir -p "$ETCCERTSDIR" |
|||
cd "$ETCCERTSDIR" |
|||
if [ "$fresh" = 1 ]; then |
|||
echo "Clearing symlinks in $ETCCERTSDIR..." |
|||
find . -type l -print | while read symlink |
|||
do |
|||
case $(readlink "$symlink") in |
|||
$CERTSDIR*|$LOCALCERTSDIR*) rm -f $symlink;; |
|||
esac |
|||
done |
|||
find . -type l -print | while read symlink |
|||
do |
|||
test -f "$symlink" || rm -f "$symlink" |
|||
done |
|||
echo "done." |
|||
fi |
|||
|
|||
echo "Updating certificates in $ETCCERTSDIR..." |
|||
|
|||
# Add default certificate authorities if requested |
|||
if [ "$default" = 1 ]; then |
|||
find -L "$CERTSDIR" -type f -name '*.crt' | sort | while read crt |
|||
do |
|||
add "$crt" |
|||
done |
|||
fi |
|||
|
|||
# Handle certificates that should be removed. This is an explicit act |
|||
# by prefixing lines in the configuration files with exclamation marks (!). |
|||
sed -n -e '/^$/d' -e 's/^!//p' "$CERTSCONF" | while read crt |
|||
do |
|||
remove "$CERTSDIR/$crt" |
|||
done |
|||
|
|||
sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read crt |
|||
do |
|||
if ! test -f "$CERTSDIR/$crt" |
|||
then |
|||
echo "W: $CERTSDIR/$crt not found, but listed in $CERTSCONF." >&2 |
|||
continue |
|||
fi |
|||
add "$CERTSDIR/$crt" |
|||
done |
|||
|
|||
# Now process certificate authorities installed by the local system |
|||
# administrator. |
|||
if [ -d "$LOCALCERTSDIR" ] |
|||
then |
|||
find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read crt |
|||
do |
|||
add "$crt" |
|||
done |
|||
fi |
|||
|
|||
rm -f "$CERTBUNDLE" |
|||
|
|||
ADDED_CNT=$(wc -l < "$ADDED") |
|||
REMOVED_CNT=$(wc -l < "$REMOVED") |
|||
|
|||
if [ "$ADDED_CNT" -gt 0 ] || [ "$REMOVED_CNT" -gt 0 ] |
|||
then |
|||
# only run if set of files has changed |
|||
if [ "$verbose" = 0 ] |
|||
then |
|||
c_rehash . > /dev/null |
|||
else |
|||
c_rehash . |
|||
fi |
|||
fi |
|||
|
|||
chmod 0644 "$TEMPBUNDLE" |
|||
mv -f "$TEMPBUNDLE" "$CERTBUNDLE" |
|||
# Restore proper SELinux label after moving the file |
|||
[ -x /usr/sbin/restorecon ] && /usr/sbin/restorecon "$CERTBUNDLE" >/dev/null 2>&1 |
|||
|
|||
echo "$ADDED_CNT added, $REMOVED_CNT removed; done." |
|||
|
|||
# vim:set et sw=2: |
|||
Loading…
Reference in new issue