????
Your IP : 3.144.86.233
#!/bin/bash
#
# Copyright (C) 2013 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#set -vx
do_extract()
{
if [[ $1 = "warn_if_disabled" ]]; then
prepare_setup
if [[ $CURRENT_SETUP -ne 2 ]]; then
warning "Warning: The dynamic CA configuration feature is in the disabled state"
fi
fi
DEST=/etc/pki/ca-trust/extracted
# OpenSSL PEM bundle that includes trust flags
# (BEGIN TRUSTED CERTIFICATE)
/usr/bin/p11-kit extract --comment --format=openssl-bundle --filter=certificates --overwrite $DEST/openssl/ca-bundle.trust.crt
/usr/bin/p11-kit extract --comment --format=pem-bundle --filter=ca-anchors --overwrite --purpose server-auth $DEST/pem/tls-ca-bundle.pem
/usr/bin/p11-kit extract --comment --format=pem-bundle --filter=ca-anchors --overwrite --purpose email $DEST/pem/email-ca-bundle.pem
/usr/bin/p11-kit extract --comment --format=pem-bundle --filter=ca-anchors --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
/usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
}
HAVE_NSS_32=0
HAVE_NSS_64=0
HAVE_P11_32=0
HAVE_P11_64=0
P11_32_CONSISTENT=1
P11_64_CONSISTENT=1
CURRENT_SETUP=0
FORCE=0
RPM_VFY_INFO=""
RPM_VFY_STATUS=0
SETUPFILE_P11_32=/usr/lib/p11-kit/p11-kit-redhat-setup-trust
SETUPFILE_P11_64=/usr/lib64/p11-kit/p11-kit-redhat-setup-trust
LIBFILE_NSS_32=/usr/lib/nss/libnssckbi.so
LIBFILE_NSS_64=/usr/lib64/nss/libnssckbi.so
INITIAL_BACKUP=/etc/pki/backup-traditional-original-config
RECENT_BACKUP=/etc/pki/backup-traditional-recent-config
CAB_FILE=/etc/pki/tls/certs/ca-bundle.crt
CABT_FILE=/etc/pki/tls/certs/ca-bundle.trust.crt
JAB_FILE=/etc/pki/java/cacerts
warning()
{
echo "update-ca-trust: $@" >&2
}
prepare_setup()
{
# result of test -L filename # 0: yes, a link # 1: no, not a link
test -L $CAB_FILE
CAB_LINK=$?
test -L $CABT_FILE
CABT_LINK=$?
test -L $JAB_FILE
CAJ_LINK=$?
if [[ $CAB_LINK -eq 1 && $CABT_LINK -eq 1 && $CAJ_LINK -eq 1 ]]; then
#echo "current_setup=1 (no links)"
CURRENT_SETUP=1
fi
if [[ $CAB_LINK -eq 0 && $CABT_LINK -eq 0 && $CAJ_LINK -eq 0 ]]; then
#echo "current_setup=2 (all links)"
CURRENT_SETUP=2
fi
}
prepare()
{
prepare_setup
test -e $LIBFILE_NSS_32
if [[ $? -eq 0 ]]; then
#echo "have nss 32"
HAVE_NSS_32=1
fi
test -e $LIBFILE_NSS_64
if [[ $? -eq 0 ]]; then
#echo "have nss 64"
HAVE_NSS_64=1
fi
test -e $SETUPFILE_P11_32
if [[ $? -eq 0 ]]; then
#echo "have p11 32"
HAVE_P11_32=1
fi
test -e $SETUPFILE_P11_64
if [[ $? -eq 0 ]]; then
#echo "have p11 64"
HAVE_P11_64=1
fi
if [[ $HAVE_NSS_32 -eq 1 && $HAVE_P11_32 -eq 0 ]]; then
#echo "p11 32 not consistent"
P11_32_CONSISTENT=0
fi
if [[ $HAVE_NSS_64 -eq 1 && $HAVE_P11_64 -eq 0 ]]; then
#echo "p11 64 not consistent"
P11_64_CONSISTENT=0
fi
if [[ $CURRENT_SETUP -ne 2 ]]; then
# result of rpm --verify: # 0: unchanged
RPM_VFY_INFO=`rpm -q --verify --nomtime ca-certificates`
RPM_VFY_STATUS=$?
#echo "rpm status: $RPM_VFY_INFO"
fi
}
report_if_p11_inconsistent()
{
if [[ $P11_32_CONSISTENT -eq 0 ]]; then
warning "nss 32 bit is installed. You should install p11-kit-trust 32 bit."
fi
if [[ $P11_64_CONSISTENT -eq 0 ]]; then
warning "nss 64 bit is installed. You should install p11-kit-trust 64 bit."
fi
}
report_if_not_enabled_and_bundles_modified()
{
if [[ $CURRENT_SETUP -ne 2 ]]; then
if [[ $RPM_VFY_STATUS -ne 0 ]]; then
warning "Legacy CA bundle files aren't in the default state, they have been modified."
warning "You should research the configuration changes that have been performed and add equivalent configuration after enabling the new dynamic configuration"
warning "Below is a list of files that have been modified:"
warning "$RPM_VFY_INFO"
fi
fi
}
do_check()
{
prepare
if [[ $CURRENT_SETUP -eq 1 ]]; then
echo "PEM/JAVA Status: DISABLED."
echo " (Legacy setup with static files.)"
fi
if [[ $CURRENT_SETUP -eq 2 ]]; then
echo "PEM/JAVA Status: ENABLED."
echo " (Legacy filenames are links to files produced by update-ca-trust.)"
fi
if [[ $CURRENT_SETUP -eq 0 ]]; then
echo "PEM/JAVA Status: INCONSISTENT."
echo " (Some legacy files, some symbolic links.)"
fi
report_if_p11_inconsistent
echo "PKCS#11 module Status, see symbolic links reported below:"
ls -l /etc/alternatives/libnssckbi.so*
echo " (link resolving to NSS: using legacy static list)"
echo " (link resolving to p11-kit: using the new source configuration)"
return 0
}
create_backup()
{
# - We'll potentially create two backups. An "initial" and a "most recent".
# - The initial backup will be created, only, if it doesn't exist yet.
# - The initial backup will never be overwritten.
# - The most recent backup will be overwritten each time this script
# is run to "enable" the new-style extracted system.
# - The most recent backup will be restored each time this script
# is run to "disable" the new-style extracted system,
# thereby switching back to the traditional system.
test -e $INITIAL_BACKUP
BACKUPDIR_TEST=$?
if [[ $BACKUPDIR_TEST -eq 1 ]]; then
# Initial backup directory doesn't exist yet
mkdir -p $INITIAL_BACKUP
cp --dereference --preserve --force \
$CAB_FILE $CABT_FILE $JAB_FILE $INITIAL_BACKUP
fi
mkdir -p $RECENT_BACKUP
cp --dereference --preserve --force \
$CAB_FILE $CABT_FILE $JAB_FILE $RECENT_BACKUP
}
restore_backup()
{
test -d $RECENT_BACKUP
BACKUPDIR_TEST=$?
if [[ $BACKUPDIR_TEST -eq 1 ]]; then
warning "recent backup dir doesn't exist, aborting"
exit 1
fi
pushd $RECENT_BACKUP >/dev/null
test -e ca-bundle.crt
T1=$?
test -e ca-bundle.trust.crt
T2=$?
test -e cacerts
T3=$?
if [[ $T1 -eq 1 || $T2 -eq 1 || $T3 -eq 1 ]]; then
warning "at least one backup file doesn't exist, aborting"
exit 1
fi
rm -f $CAB_FILE
cp --dereference --preserve --force ca-bundle.crt $CAB_FILE
rm -f $CABT_FILE
cp --dereference --preserve --force ca-bundle.trust.crt $CABT_FILE
rm -f $JAB_FILE
cp --dereference --preserve --force cacerts $JAB_FILE
popd >/dev/null
}
create_links()
{
rm -f $CAB_FILE
rm -f $CABT_FILE
rm -f $JAB_FILE
ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem $CAB_FILE
ln -s /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt $CABT_FILE
ln -s /etc/pki/ca-trust/extracted/java/cacerts $JAB_FILE
}
setup_p11()
{
ACTION=$1
if [[ $HAVE_P11_32 -eq 1 ]]; then
$SETUPFILE_P11_32 $ACTION
fi
if [[ $HAVE_P11_64 -eq 1 ]]; then
$SETUPFILE_P11_64 $ACTION
fi
}
do_enable()
{
prepare
if [[ $FORCE -eq 0 ]]; then
report_if_p11_inconsistent
report_if_not_enabled_and_bundles_modified
if [[ $P11_32_CONSISTENT -eq 0 || $P11_64_CONSISTENT -eq 0 ]]; then
warning "aborting, because the nss / p11-kit setup is inconsistent."
exit 1
fi
fi
ABORT=0
if [[ $FORCE -eq 0 && $CURRENT_SETUP -eq 0 ]]; then
warning "Aborting because of inconsistent PEM/JAVA setup."
ABORT=1
fi
if [[ $FORCE -eq 0 && $RPM_VFY_STATUS -ne 0 ]]; then
warning "Aborting because system uses modified legacy bundle files."
ABORT=1
fi
if [[ $ABORT -eq 1 ]]; then
warning "If you're certain, use force-enable"
exit 1
fi
if [[ $CURRENT_SETUP -ne 2 ]]; then
# only change files if PEM/JAVA files currently aren't (cleanly) enabled
create_backup
create_links
fi
setup_p11 enable
return 0
}
do_disable()
{
prepare
if [[ $FORCE -eq 0 && $CURRENT_SETUP -eq 0 ]]; then
warning "Aborting because of inconsistent setup. If you're certain, use force-disable"
exit 1
fi
if [[ $CURRENT_SETUP -ne 1 ]]; then
# only change files if PEM/JAVA files currently aren't (cleanly) disabled
restore_backup
fi
setup_p11 disable
return 0
}
if [[ $# -eq 0 ]]; then
# no parameters
do_extract silent
exit $?
fi
if [[ "$1" = "extract" ]]; then
do_extract warn_if_disabled
exit $?
fi
if [[ "$1" = "enable" ]]; then
do_enable
exit $?
fi
if [[ "$1" = "disable" ]]; then
do_disable
exit $?
fi
if [[ "$1" = "force-enable" ]]; then
FORCE=1
do_enable
exit $?
fi
if [[ "$1" = "force-disable" ]]; then
FORCE=1
do_disable
exit $?
fi
if [[ "$1" = "check" ]]; then
do_check
exit $?
fi
echo "usage: $0 [extract | check | enable | disable | force-enable | force-disable ]"