version 1.1, 2004/07/02 10:51:18
|
version 1.2, 2004/07/05 11:37:39
|
Line 55
|
Line 55
|
# o The certificate authority files are in $SSLDir/loncapaca |
# o The certificate authority files are in $SSLDir/loncapaca |
# o The certificate authority certificate is in: |
# o The certificate authority certificate is in: |
# $SSLDir/loncapaca/cacert.pem |
# $SSLDir/loncapaca/cacert.pem |
# o The certificate authority maintains a certificate index file |
# o Only one instance of this script will be run at a time in |
# $SSLDIR/loncapaca/index.txt |
# this directory. |
# o Only one instance of this script will be run at a time!!!!! |
|
# (otherwise the last line of the index file may not be the |
|
# index to our certificate. We'll do some rudimentary |
|
# error checking, but have no idea how to recover in case |
|
# of problems). |
|
# o The generated certificates are stored in $SSLDIR/loncapaca/certs |
|
# o The person that runs this script knows the passphrase |
# o The person that runs this script knows the passphrase |
# for the loncapa certificate authority's private key |
# for the loncapa certificate authority's private key |
# which remains encrypted for security reasons. |
# which remains encrypted for security reasons. |
Line 80 use LONCAPA::Configuration;
|
Line 74 use LONCAPA::Configuration;
|
|
|
# Global variable declarations |
# Global variable declarations |
|
|
|
my $ssl_command = "/usr/bin/openssl "; # Command to run openssl. |
|
my $ssl_dir = "/usr/share/ssl"; # Where ssl config files etc. live |
|
my $ca_cert_file = $ssl_dir."/loncapa/cacert.pem"; # CA's certificate file. |
|
my $ca_config_file= $ssl_dir."/loncapaca.cnf"; # CA's config file. |
|
|
|
|
|
|
# Debug/log support |
# Debug/log support |
|
|
Line 94 sub Debug {
|
Line 93 sub Debug {
|
} |
} |
# Support subs: |
# Support subs: |
|
|
sub Usage {} |
# |
|
# Print out program usage. |
|
# |
|
# Side effects: |
|
# Output goes to stderr. |
|
# |
|
sub Usage { |
|
print STDERR << "USAGE"; |
|
|
|
Usage: |
|
CrGrant.pl requestfile.pem |
|
|
|
Where: |
|
requestfile.pem is a PEM formatted certificate extracted from an email |
|
to the LonCAPA certificate manager. |
|
USAGE |
|
|
|
} |
|
# Create a certificate from the request file. The certificate |
|
# is used, in conjunction with the openssl command with the |
|
# certificate authority configuration to produce a certificate |
|
# file. |
|
# |
|
# The certificate is parsed to determine the email address |
|
# of the requestor, which is returned to the caller. |
|
# |
|
#Parameters: |
|
# request_file - Name of the file containing the certificate request. |
|
#Returns: |
|
# If the request file exists and is able to produce a certificate |
|
# the email address of the requester is returned to the caller. |
|
# If not, undef is returned. |
|
# |
sub CreateCertificate { |
sub CreateCertificate { |
my $RequestFile = shift; |
my ($request_file) = @_; |
|
|
|
Debug("CreateCertificate"); |
|
|
|
if(!(-e $request_file)) { |
|
Debug("Certificate file $request_file does not exist"); |
|
return undef; |
|
} |
|
Debug("Certificate file $request_file exists"); |
|
|
|
# Create the certificate: The status of the openssl command |
|
# is used to determine if the certificate succeeded: |
|
|
|
my $create_command = $ssl_command." ca -config ".$ca_config_file |
|
." -in ".$request_file |
|
." -out hostCertificate.pem"; |
|
my $status = system($create_command); |
|
if($status) { |
|
Debug("openssl ca failed"); |
|
print STDERR "Certificate generation failed... probably bad"; |
|
print STDERR " request file!\n"; |
|
return undef; |
|
} |
|
Debug("openssl ca succeeded"); |
|
|
|
# Now we have a shining new signed certificate in ./hostCertificate.pem |
|
# we parse it to get the email address to which the certificate should |
|
# be emailed. |
|
# The certificate's return email address will be in the Subject line: |
|
# |
|
|
|
Debug("Parsing certificate file for Subject:"); |
|
open CERTIFICATE, "<hostCertificate.pem"; |
|
my $line; |
|
my $subject_found = 0; |
|
while ($line = <CERTIFICATE>) { |
|
Debug("Line = $line"); |
|
if($line =~ /Subject:/) { |
|
Debug("Found Subject: in $line"); |
|
$subject_found =1; |
|
last; |
|
} |
|
} |
|
close CERTIFICATE; |
|
|
|
if(!$subject_found) { |
|
Debug("Did not find Subject line in cert"); |
|
print STDERR "Output certificate parse failed: no Subject:\n"; |
|
return undef; |
|
} |
|
# The subject line contains an Email= string amidst the other stuff. |
|
# First break in to comma separated stuff, then locate the piece that |
|
# contains /Email= |
|
|
|
my @subject_fields = split(/,/, $line); |
|
my $email_found = 0; |
|
my $element; |
|
my $email_element; |
|
Debug("Parsing subject line for Email="); |
|
foreach $element (@subject_fields) { |
|
$email_element = $element; |
|
Debug("Parsing $element"); |
|
if($element =~ /\/Email=/) { |
|
Debug("Found /Email="); |
|
$email_found = 1; |
|
last; |
|
} |
|
} |
|
if(!$email_found) { |
|
Debug("Failed to fine Email="); |
|
print STDERR "Unable to find line with /Email= in cert. Subject\n"; |
|
return undef; |
|
} |
|
|
|
# The piece we found must first be split at the / |
|
# to isolate the Email= part and then that part at the = to isolate |
|
# the address: |
|
|
|
Debug("Splitting $email_element at /"); |
|
my ($junk, $email) = split(/\//, $email_element); |
|
Debug("Email part is $email"); |
|
my ($junk, $address) = split(/=/, $email); |
|
Debug("CreateCertificate Returning $address to caller"); |
|
|
|
return $address; |
|
|
return 'fox@nscl.msu.edu'; # Stub.. |
|
} |
} |
sub CreateInstallScript {} |
sub CreateInstallScript {} |
|
|
Line 125 if($argc != 1) {
|
Line 238 if($argc != 1) {
|
} |
} |
my $CertificateRequest = $ARGV[0]; |
my $CertificateRequest = $ARGV[0]; |
|
|
my $EmailAddress = CreateCertificate($CertificateRequest); |
my $email_address = CreateCertificate($CertificateRequest); |
|
|
|
if(!defined $email_address) { |
|
print STDERR "Bad or missing certificate file!!"; |
|
Usage; |
|
exit -1; |
|
} |
|
|
CreateInstallScript; |
CreateInstallScript; |
my $Message = CreateEmail; |
my $Message = CreateEmail; |
SendEmail($EmailAddress, $Message); |
SendEmail($email_address, $Message); |
Cleanup; |
Cleanup; |
|
|
# POD documentation. |
# POD documentation. |