1#!/usr/bin/perl
2
3
4# Perl c_rehash script, scan all files in a directory
5# and add symbolic links to their hash values.
6
7my $openssl;
8
9my $dir = "/System/Library/OpenSSL";
10my $prefix = "/System/Library/OpenSSL";
11
12if(defined $ENV{OPENSSL}) {
13	$openssl = $ENV{OPENSSL};
14} else {
15	$openssl = "openssl";
16	$ENV{OPENSSL} = $openssl;
17}
18
19$ENV{PATH} .= ":$dir/bin";
20
21if(! -x $openssl) {
22	my $found = 0;
23	foreach (split /:/, $ENV{PATH}) {
24		if(-x "$_/$openssl") {
25			$found = 1;
26			last;
27		}	
28	}
29	if($found == 0) {
30		print STDERR "c_rehash: rehashing skipped ('openssl' program not available)\n";
31		exit 0;
32	}
33}
34
35if(@ARGV) {
36	@dirlist = @ARGV;
37} elsif($ENV{SSL_CERT_DIR}) {
38	@dirlist = split /:/, $ENV{SSL_CERT_DIR};
39} else {
40	$dirlist[0] = "$dir/certs";
41}
42
43
44foreach (@dirlist) {
45	if(-d $_ and -w $_) {
46		hash_dir($_);
47	}
48}
49
50sub hash_dir {
51	my %hashlist;
52	print "Doing $_[0]\n";
53	chdir $_[0];
54	opendir(DIR, ".");
55	my @flist = readdir(DIR);
56	# Delete any existing symbolic links
57	foreach (grep {/^[\da-f]+\.r{0,1}\d+$/} @flist) {
58		if(-l $_) {
59			unlink $_;
60		}
61	}
62	closedir DIR;
63	FILE: foreach $fname (grep {/\.pem$/} @flist) {
64		# Check to see if certificates and/or CRLs present.
65		my ($cert, $crl) = check_file($fname);
66		if(!$cert && !$crl) {
67			print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n";
68			next;
69		}
70		link_hash_cert($fname) if($cert);
71		link_hash_crl($fname) if($crl);
72	}
73}
74
75sub check_file {
76	my ($is_cert, $is_crl) = (0,0);
77	my $fname = $_[0];
78	open IN, $fname;
79	while(<IN>) {
80		if(/^-----BEGIN (.*)-----/) {
81			my $hdr = $1;
82			if($hdr =~ /^(X509 |TRUSTED |)CERTIFICATE$/) {
83				$is_cert = 1;
84				last if($is_crl);
85			} elsif($hdr eq "X509 CRL") {
86				$is_crl = 1;
87				last if($is_cert);
88			}
89		}
90	}
91	close IN;
92	return ($is_cert, $is_crl);
93}
94
95
96# Link a certificate to its subject name hash value, each hash is of
97# the form <hash>.<n> where n is an integer. If the hash value already exists
98# then we need to up the value of n, unless its a duplicate in which
99# case we skip the link. We check for duplicates by comparing the
100# certificate fingerprints
101
102sub link_hash_cert {
103		my $fname = $_[0];
104		$fname =~ s/'/'\\''/g;
105		my ($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname'`;
106		chomp $hash;
107		chomp $fprint;
108		$fprint =~ s/^.*=//;
109		$fprint =~ tr/://d;
110		my $suffix = 0;
111		# Search for an unused hash filename
112		while(exists $hashlist{"$hash.$suffix"}) {
113			# Hash matches: if fingerprint matches its a duplicate cert
114			if($hashlist{"$hash.$suffix"} eq $fprint) {
115				print STDERR "WARNING: Skipping duplicate certificate $fname\n";
116				return;
117			}
118			$suffix++;
119		}
120		$hash .= ".$suffix";
121		print "$fname => $hash\n";
122		$symlink_exists=eval {symlink("",""); 1};
123		if ($symlink_exists) {
124			symlink $fname, $hash;
125		} else {
126			system ("cp", $fname, $hash);
127		}
128		$hashlist{$hash} = $fprint;
129}
130
131# Same as above except for a CRL. CRL links are of the form <hash>.r<n>
132
133sub link_hash_crl {
134		my $fname = $_[0];
135		$fname =~ s/'/'\\''/g;
136		my ($hash, $fprint) = `"$openssl" crl -hash -fingerprint -noout -in '$fname'`;
137		chomp $hash;
138		chomp $fprint;
139		$fprint =~ s/^.*=//;
140		$fprint =~ tr/://d;
141		my $suffix = 0;
142		# Search for an unused hash filename
143		while(exists $hashlist{"$hash.r$suffix"}) {
144			# Hash matches: if fingerprint matches its a duplicate cert
145			if($hashlist{"$hash.r$suffix"} eq $fprint) {
146				print STDERR "WARNING: Skipping duplicate CRL $fname\n";
147				return;
148			}
149			$suffix++;
150		}
151		$hash .= ".r$suffix";
152		print "$fname => $hash\n";
153		$symlink_exists=eval {symlink("",""); 1};
154		if ($symlink_exists) {
155			symlink $fname, $hash;
156		} else {
157			system ("cp", $fname, $hash);
158		}
159		$hashlist{$hash} = $fprint;
160}
161
162