]>
Commit | Line | Data |
---|---|---|
abe256e7 | 1 | #!{- $config{HASHBANGPERL} -} |
439df508 | 2 | |
9ab6fc59 | 3 | # {- join("\n# ", @autowarntext) -} |
b0edda11 | 4 | # Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved. |
44c8a5e2 | 5 | # |
9059ab42 | 6 | # Licensed under the Apache License 2.0 (the "License"). You may not use |
44c8a5e2 RS |
7 | # this file except in compliance with the License. You can obtain a copy |
8 | # in the file LICENSE in the source distribution or at | |
9 | # https://www.openssl.org/source/license.html | |
9ab6fc59 | 10 | |
439df508 DSH |
11 | # Perl c_rehash script, scan all files in a directory |
12 | # and add symbolic links to their hash values. | |
13 | ||
291e94df RL |
14 | my $dir = {- quotify1($config{openssldir}) -}; |
15 | my $prefix = {- quotify1($config{prefix}) -}; | |
439df508 | 16 | |
4c7103a5 | 17 | my $errorcount = 0; |
a787c259 MA |
18 | my $openssl = $ENV{OPENSSL} || "openssl"; |
19 | my $pwd; | |
20 | my $x509hash = "-subject_hash"; | |
21 | my $crlhash = "-hash"; | |
22 | my $verbose = 0; | |
23 | my $symlink_exists=eval {symlink("",""); 1}; | |
24 | my $removelinks = 1; | |
25 | ||
26 | ## Parse flags. | |
8846adbd | 27 | while ( $ARGV[0] =~ /^-/ ) { |
a787c259 MA |
28 | my $flag = shift @ARGV; |
29 | last if ( $flag eq '--'); | |
8846adbd | 30 | if ( $flag eq '-old') { |
a787c259 MA |
31 | $x509hash = "-subject_hash_old"; |
32 | $crlhash = "-hash_old"; | |
7d959c35 | 33 | } elsif ( $flag eq '-h' || $flag eq '-help' ) { |
a787c259 MA |
34 | help(); |
35 | } elsif ( $flag eq '-n' ) { | |
36 | $removelinks = 0; | |
37 | } elsif ( $flag eq '-v' ) { | |
38 | $verbose++; | |
39 | } | |
40 | else { | |
7d959c35 | 41 | print STDERR "Usage error; try -h.\n"; |
a787c259 MA |
42 | exit 1; |
43 | } | |
44 | } | |
45 | ||
46 | sub help { | |
7d959c35 | 47 | print "Usage: c_rehash [-old] [-h] [-help] [-v] [dirs...]\n"; |
a787c259 | 48 | print " -old use old-style digest\n"; |
7d959c35 | 49 | print " -h or -help print this help text\n"; |
a787c259 MA |
50 | print " -v print files removed and linked\n"; |
51 | exit 0; | |
439df508 DSH |
52 | } |
53 | ||
a2688c87 AP |
54 | eval "require Cwd"; |
55 | if (defined(&Cwd::getcwd)) { | |
56 | $pwd=Cwd::getcwd(); | |
57 | } else { | |
a787c259 MA |
58 | $pwd=`pwd`; |
59 | chomp($pwd); | |
a2688c87 | 60 | } |
d8cdd156 | 61 | |
a787c259 MA |
62 | # DOS/Win32 or Unix delimiter? Prefix our installdir, then search. |
63 | my $path_delim = ($pwd =~ /^[a-z]\:/i) ? ';' : ':'; | |
64 | $ENV{PATH} = "$prefix/bin" . ($ENV{PATH} ? $path_delim . $ENV{PATH} : ""); | |
439df508 | 65 | |
ff2f6bb0 | 66 | if (! -x $openssl) { |
439df508 | 67 | my $found = 0; |
d8cdd156 | 68 | foreach (split /$path_delim/, $ENV{PATH}) { |
ff2f6bb0 | 69 | if (-x "$_/$openssl") { |
439df508 | 70 | $found = 1; |
ef236ec3 | 71 | $openssl = "$_/$openssl"; |
439df508 DSH |
72 | last; |
73 | } | |
74 | } | |
ff2f6bb0 | 75 | if ($found == 0) { |
439df508 DSH |
76 | print STDERR "c_rehash: rehashing skipped ('openssl' program not available)\n"; |
77 | exit 0; | |
78 | } | |
79 | } | |
80 | ||
ff2f6bb0 | 81 | if (@ARGV) { |
439df508 | 82 | @dirlist = @ARGV; |
ff2f6bb0 | 83 | } elsif ($ENV{SSL_CERT_DIR}) { |
d8cdd156 | 84 | @dirlist = split /$path_delim/, $ENV{SSL_CERT_DIR}; |
439df508 DSH |
85 | } else { |
86 | $dirlist[0] = "$dir/certs"; | |
87 | } | |
88 | ||
d8cdd156 AP |
89 | if (-d $dirlist[0]) { |
90 | chdir $dirlist[0]; | |
91 | $openssl="$pwd/$openssl" if (!-x $openssl); | |
92 | chdir $pwd; | |
93 | } | |
439df508 DSH |
94 | |
95 | foreach (@dirlist) { | |
ff2f6bb0 RS |
96 | if (-d $_ ) { |
97 | if ( -w $_) { | |
439df508 | 98 | hash_dir($_); |
ff2f6bb0 RS |
99 | } else { |
100 | print "Skipping $_, can't write\n"; | |
4c7103a5 | 101 | $errorcount++; |
ff2f6bb0 | 102 | } |
439df508 DSH |
103 | } |
104 | } | |
4c7103a5 | 105 | exit($errorcount); |
439df508 DSH |
106 | |
107 | sub hash_dir { | |
108 | my %hashlist; | |
109 | print "Doing $_[0]\n"; | |
110 | chdir $_[0]; | |
6f46c3c3 | 111 | opendir(DIR, "."); |
b1ffe8db | 112 | my @flist = sort readdir(DIR); |
6f46c3c3 | 113 | closedir DIR; |
a787c259 | 114 | if ( $removelinks ) { |
a787c259 MA |
115 | # Delete any existing symbolic links |
116 | foreach (grep {/^[\da-f]+\.r{0,1}\d+$/} @flist) { | |
ff2f6bb0 | 117 | if (-l $_) { |
a787c259 | 118 | print "unlink $_" if $verbose; |
ff2f6bb0 | 119 | unlink $_ || warn "Can't unlink $_, $!\n"; |
a787c259 | 120 | } |
439df508 DSH |
121 | } |
122 | } | |
a787c259 | 123 | FILE: foreach $fname (grep {/\.(pem)|(crt)|(cer)|(crl)$/} @flist) { |
439df508 DSH |
124 | # Check to see if certificates and/or CRLs present. |
125 | my ($cert, $crl) = check_file($fname); | |
ff2f6bb0 | 126 | if (!$cert && !$crl) { |
439df508 DSH |
127 | print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n"; |
128 | next; | |
129 | } | |
ff2f6bb0 RS |
130 | link_hash_cert($fname) if ($cert); |
131 | link_hash_crl($fname) if ($crl); | |
439df508 DSH |
132 | } |
133 | } | |
134 | ||
135 | sub check_file { | |
136 | my ($is_cert, $is_crl) = (0,0); | |
137 | my $fname = $_[0]; | |
138 | open IN, $fname; | |
139 | while(<IN>) { | |
ff2f6bb0 | 140 | if (/^-----BEGIN (.*)-----/) { |
439df508 | 141 | my $hdr = $1; |
ff2f6bb0 | 142 | if ($hdr =~ /^(X509 |TRUSTED |)CERTIFICATE$/) { |
439df508 | 143 | $is_cert = 1; |
ff2f6bb0 RS |
144 | last if ($is_crl); |
145 | } elsif ($hdr eq "X509 CRL") { | |
439df508 | 146 | $is_crl = 1; |
ff2f6bb0 | 147 | last if ($is_cert); |
439df508 DSH |
148 | } |
149 | } | |
150 | } | |
151 | close IN; | |
152 | return ($is_cert, $is_crl); | |
153 | } | |
154 | ||
155 | ||
156 | # Link a certificate to its subject name hash value, each hash is of | |
157 | # the form <hash>.<n> where n is an integer. If the hash value already exists | |
158 | # then we need to up the value of n, unless its a duplicate in which | |
159 | # case we skip the link. We check for duplicates by comparing the | |
160 | # certificate fingerprints | |
161 | ||
162 | sub link_hash_cert { | |
163 | my $fname = $_[0]; | |
b7910992 | 164 | $fname =~ s/'/'\\''/g; |
a787c259 | 165 | my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`; |
439df508 DSH |
166 | chomp $hash; |
167 | chomp $fprint; | |
168 | $fprint =~ s/^.*=//; | |
169 | $fprint =~ tr/://d; | |
170 | my $suffix = 0; | |
171 | # Search for an unused hash filename | |
172 | while(exists $hashlist{"$hash.$suffix"}) { | |
173 | # Hash matches: if fingerprint matches its a duplicate cert | |
ff2f6bb0 | 174 | if ($hashlist{"$hash.$suffix"} eq $fprint) { |
439df508 DSH |
175 | print STDERR "WARNING: Skipping duplicate certificate $fname\n"; |
176 | return; | |
177 | } | |
178 | $suffix++; | |
179 | } | |
180 | $hash .= ".$suffix"; | |
967d95f0 | 181 | if ($symlink_exists) { |
a787c259 | 182 | print "link $fname -> $hash\n" if $verbose; |
ff2f6bb0 | 183 | symlink $fname, $hash || warn "Can't symlink, $!"; |
967d95f0 | 184 | } else { |
a787c259 | 185 | print "copy $fname -> $hash\n" if $verbose; |
ff2f6bb0 RS |
186 | if (open($in, "<", $fname)) { |
187 | if (open($out,">", $hash)) { | |
188 | print $out $_ while (<$in>); | |
189 | close $out; | |
190 | } else { | |
191 | warn "can't open $hash for write, $!"; | |
192 | } | |
193 | close $in; | |
194 | } else { | |
195 | warn "can't open $fname for read, $!"; | |
196 | } | |
967d95f0 | 197 | } |
439df508 DSH |
198 | $hashlist{$hash} = $fprint; |
199 | } | |
200 | ||
201 | # Same as above except for a CRL. CRL links are of the form <hash>.r<n> | |
202 | ||
203 | sub link_hash_crl { | |
204 | my $fname = $_[0]; | |
caa4f47f | 205 | $fname =~ s/'/'\\''/g; |
a787c259 | 206 | my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`; |
439df508 DSH |
207 | chomp $hash; |
208 | chomp $fprint; | |
209 | $fprint =~ s/^.*=//; | |
210 | $fprint =~ tr/://d; | |
211 | my $suffix = 0; | |
212 | # Search for an unused hash filename | |
213 | while(exists $hashlist{"$hash.r$suffix"}) { | |
214 | # Hash matches: if fingerprint matches its a duplicate cert | |
ff2f6bb0 | 215 | if ($hashlist{"$hash.r$suffix"} eq $fprint) { |
439df508 DSH |
216 | print STDERR "WARNING: Skipping duplicate CRL $fname\n"; |
217 | return; | |
218 | } | |
219 | $suffix++; | |
220 | } | |
221 | $hash .= ".r$suffix"; | |
967d95f0 | 222 | if ($symlink_exists) { |
a787c259 | 223 | print "link $fname -> $hash\n" if $verbose; |
ff2f6bb0 | 224 | symlink $fname, $hash || warn "Can't symlink, $!"; |
967d95f0 | 225 | } else { |
a787c259 | 226 | print "cp $fname -> $hash\n" if $verbose; |
ff2f6bb0 RS |
227 | system ("cp", $fname, $hash); |
228 | warn "Can't copy, $!" if ($? >> 8) != 0; | |
967d95f0 | 229 | } |
439df508 DSH |
230 | $hashlist{$hash} = $fprint; |
231 | } |