1#!/usr/bin/perl
2
3
4# Perl c_rehash script, scan all files in a directory
5# and add symbolic links to their hash values.
6
7my $openssl;
8
9my $dir = "/usr/local/ssl";
10
11if(defined $ENV{OPENSSL}) {
12	$openssl = $ENV{OPENSSL};
13} else {
14	$openssl = "openssl";
15	$ENV{OPENSSL} = $openssl;
16}
17
18$ENV{PATH} .= ":$dir/bin";
19
20if(! -x $openssl) {
21	my $found = 0;
22	foreach (split /:/, $ENV{PATH}) {
23		if(-x "$_/$openssl") {
24			$found = 1;
25			last;
26		}	
27	}
28	if($found == 0) {
29		print STDERR "c_rehash: rehashing skipped ('openssl' program not available)\n";
30		exit 0;
31	}
32}
33
34if(@ARGV) {
35	@dirlist = @ARGV;
36} elsif($ENV{SSL_CERT_DIR}) {
37	@dirlist = split /:/, $ENV{SSL_CERT_DIR};
38} else {
39	$dirlist[0] = "$dir/certs";
40}
41
42
43foreach (@dirlist) {
44	if(-d $_ and -w $_) {
45		hash_dir($_);
46	}
47}
48
49sub hash_dir {
50	my %hashlist;
51	print "Doing $_[0]\n";
52	chdir $_[0];
53	opendir(DIR, ".");
54	my @flist = readdir(DIR);
55	# Delete any existing symbolic links
56	foreach (grep {/^[\da-f]+\.r{0,1}\d+$/} @flist) {
57		if(-l $_) {
58			unlink $_;
59		}
60	}
61	closedir DIR;
62	FILE: foreach $fname (grep {/\.pem$/} @flist) {
63		# Check to see if certificates and/or CRLs present.
64		my ($cert, $crl) = check_file($fname);
65		if(!$cert && !$crl) {
66			print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n";
67			next;
68		}
69		link_hash_cert($fname) if($cert);
70		link_hash_crl($fname) if($crl);
71	}
72}
73
74sub check_file {
75	my ($is_cert, $is_crl) = (0,0);
76	my $fname = $_[0];
77	open IN, $fname;
78	while(<IN>) {
79		if(/^-----BEGIN (.*)-----/) {
80			my $hdr = $1;
81			if($hdr =~ /^(X509 |TRUSTED |)CERTIFICATE$/) {
82				$is_cert = 1;
83				last if($is_crl);
84			} elsif($hdr eq "X509 CRL") {
85				$is_crl = 1;
86				last if($is_cert);
87			}
88		}
89	}
90	close IN;
91	return ($is_cert, $is_crl);
92}
93
94
95# Link a certificate to its subject name hash value, each hash is of
96# the form <hash>.<n> where n is an integer. If the hash value already exists
97# then we need to up the value of n, unless its a duplicate in which
98# case we skip the link. We check for duplicates by comparing the
99# certificate fingerprints
100
101sub link_hash_cert {
102		my $fname = $_[0];
103		$fname =~ s/'/'\\''/g;
104		my ($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname'`;
105		chomp $hash;
106		chomp $fprint;
107		$fprint =~ s/^.*=//;
108		$fprint =~ tr/://d;
109		my $suffix = 0;
110		# Search for an unused hash filename
111		while(exists $hashlist{"$hash.$suffix"}) {
112			# Hash matches: if fingerprint matches its a duplicate cert
113			if($hashlist{"$hash.$suffix"} eq $fprint) {
114				print STDERR "WARNING: Skipping duplicate certificate $fname\n";
115				return;
116			}
117			$suffix++;
118		}
119		$hash .= ".$suffix";
120		print "$fname => $hash\n";
121		$symlink_exists=eval {symlink("",""); 1};
122		if ($symlink_exists) {
123			symlink $fname, $hash;
124		} else {
125			system ("cp", $fname, $hash);
126		}
127		$hashlist{$hash} = $fprint;
128}
129
130# Same as above except for a CRL. CRL links are of the form <hash>.r<n>
131
132sub link_hash_crl {
133		my $fname = $_[0];
134		$fname =~ s/'/'\\''/g;
135		my ($hash, $fprint) = `"$openssl" crl -hash -fingerprint -noout -in '$fname'`;
136		chomp $hash;
137		chomp $fprint;
138		$fprint =~ s/^.*=//;
139		$fprint =~ tr/://d;
140		my $suffix = 0;
141		# Search for an unused hash filename
142		while(exists $hashlist{"$hash.r$suffix"}) {
143			# Hash matches: if fingerprint matches its a duplicate cert
144			if($hashlist{"$hash.r$suffix"} eq $fprint) {
145				print STDERR "WARNING: Skipping duplicate CRL $fname\n";
146				return;
147			}
148			$suffix++;
149		}
150		$hash .= ".r$suffix";
151		print "$fname => $hash\n";
152		$symlink_exists=eval {symlink("",""); 1};
153		if ($symlink_exists) {
154			symlink $fname, $hash;
155		} else {
156			system ("cp", $fname, $hash);
157		}
158		$hashlist{$hash} = $fprint;
159}
160
161