utilities/ovs-pki.in

   1 #! /bin/sh
   2
   3 # Copyright (c) 2008, 2009, 2010 Nicira Networks, Inc.
   4 #
   5 # Licensed under the Apache License, Version 2.0 (the "License");
   6 # you may not use this file except in compliance with the License.
   7 # You may obtain a copy of the License at:
   8 #
   9 #     http://www.apache.org/licenses/LICENSE-2.0
  10 #
  11 # Unless required by applicable law or agreed to in writing, software
  12 # distributed under the License is distributed on an "AS IS" BASIS,
  13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14 # See the License for the specific language governing permissions and
  15 # limitations under the License.
  16
  17 set -e
  18
  19 pkidir='@PKIDIR@'
  20 command=
  21 prev=
  22 force=no
  23 batch=no
  24 log='@LOGDIR@/ovs-pki.log'
  25 keytype=rsa
  26 bits=2048
  27 for option; do
  28     # This option-parsing mechanism borrowed from a Autoconf-generated
  29     # configure script under the following license:
  30
  31     # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
  32     # 2002, 2003, 2004, 2005, 2006, 2009 Free Software Foundation, Inc.
  33     # This configure script is free software; the Free Software Foundation
  34     # gives unlimited permission to copy, distribute and modify it.
  35
  36     # If the previous option needs an argument, assign it.
  37     if test -n "$prev"; then
  38         eval $prev=\$option
  39         prev=
  40         continue
  41     fi
  42     case $option in
  43         *=*) optarg=`expr "X$option" : '[^=]*=\(.*\)'` ;;
  44         *) optarg=yes ;;
  45     esac
  46
  47     case $dashdash$option in
  48         --)
  49             dashdash=yes ;;
  50         -h|--help)
  51             cat <<EOF
  52 ovs-pki, for managing a simple OpenFlow public key infrastructure
  53 usage: $0 [OPTION...] COMMAND [ARG...]
  54
  55 The valid stand-alone commands and their arguments are:
  56   init                 Initialize the PKI
  57   req NAME             Create new private key and certificate request
  58                        named NAME-privkey.pem and NAME-req.pem, resp.
  59   sign NAME [TYPE]     Sign switch certificate request NAME-req.pem,
  60                        producing certificate NAME-cert.pem
  61   req+sign NAME [TYPE] Combine the above two steps, producing all three files.
  62   verify NAME [TYPE]   Checks that NAME-cert.pem is a valid TYPE certificate
  63   fingerprint FILE     Prints the fingerprint for FILE
  64   self-sign NAME       Sign NAME-req.pem with NAME-privkey.pem,
  65                        producing self-signed certificate NAME-cert.pem
  66
  67 The following additional commands manage an online PKI:
  68   ls [PREFIX] [TYPE]   Lists incoming requests of the given TYPE, optionally
  69                        limited to those whose fingerprint begins with PREFIX
  70   flush [TYPE]         Rejects all incoming requests of the given TYPE
  71   reject PREFIX [TYPE] Rejects the incoming request(s) whose fingerprint begins
  72                        with PREFIX and has the given TYPE
  73   approve PREFIX [TYPE] Approves the incoming request whose fingerprint begins
  74                        with PREFIX and has the given TYPE
  75   expire [AGE]         Rejects all incoming requests older than AGE, in
  76                        one of the forms Ns, Nmin, Nh, Nday (default: 1day)
  77   prompt [TYPE]        Interactively prompts to accept or reject each incoming
  78                        request of the given TYPE
  79
  80 Each TYPE above is a certificate type: 'switch' (default) or 'controller'.
  81
  82 Options for 'init', 'req', and 'req+sign' only:
  83   -k, --key=rsa|dsa    Type of keys to use (default: rsa)
  84   -B, --bits=NBITS     Number of bits in keys (default: 2048).  For DSA keys,
  85                          this has an effect only on 'init'.
  86   -D, --dsaparam=FILE  File with DSA parameters (DSA only)
  87                          (default: dsaparam.pem within PKI directory)
  88 Options for use with the 'sign' and 'approve' commands:
  89   -b, --batch          Skip fingerprint verification
  90 Options that apply to any command:
  91   -d, --dir=DIR        Directory where the PKI is located
  92                          (default: $pkidir)
  93   -f, --force          Continue even if file or directory already exists
  94   -l, --log=FILE       Log openssl output to FILE (default: ovs-log.log)
  95   -h, --help           Print this usage message.
  96 EOF
  97             exit 0
  98             ;;
  99         --di*=*)
 100             pkidir=$optarg
 101             ;;
 102         --di*|-d)
 103             prev=pkidir
 104             ;;
 105         --k*=*)
 106             keytype=$optarg
 107             ;;
 108         --k*|-k)
 109             prev=keytype
 110             ;;
 111         --bi*=*)
 112             bits=$optarg
 113             ;;
 114         --bi*|-B)
 115             prev=bits
 116             ;;
 117         --ds*=*)
 118             dsaparam=$optarg
 119             ;;
 120         --ds*|-D)
 121             prev=dsaparam
 122             ;;
 123         --l*=*)
 124             log=$optarg
 125             ;;
 126         --l*|-l)
 127             prev=log
 128             ;;
 129         --force|-f)
 130             force=yes
 131             ;;
 132         --ba*|-b)
 133             batch=yes
 134             ;;
 135         -*)
 136             echo "unrecognized option $option" >&2
 137             exit 1
 138             ;;
 139         *)
 140             if test -z "$command"; then
 141                 command=$option
 142             elif test -z "${arg1+set}"; then
 143                 arg1=$option
 144             elif test -z "${arg2+set}"; then
 145                 arg2=$option
 146             else
 147                 echo "$option: only two arguments may be specified" >&2
 148                 exit 1
 149             fi
 150             ;;
 151     esac
 152     shift
 153 done
 154 if test -n "$prev"; then
 155     option=--`echo $prev | sed 's/_/-/g'`
 156     { echo "$as_me: error: missing argument to $option" >&2
 157         { (exit 1); exit 1; }; }
 158 fi
 159 if test -z "$command"; then
 160     echo "$0: missing command name; use --help for help" >&2
 161     exit 1
 162 fi
 163 if test "$keytype" != rsa && test "$keytype" != dsa; then
 164     echo "$0: argument to -k or --key must be rsa or dsa" >&2
 165     exit 1
 166 fi
 167 if test "$bits" -lt 1024; then
 168     echo "$0: argument to -B or --bits must be at least 1024" >&2
 169     exit 1
 170 fi
 171 if test -z "$dsaparam"; then
 172     dsaparam=$pkidir/dsaparam.pem
 173 fi
 174 case $log in
 175     /*) ;;
 176     *) $log="$PWD/$log" ;;
 177 esac
 178
 179 logdir=$(dirname "$log")
 180 if test ! -d "$logdir"; then
 181     mkdir -p -m755 "$logdir" 2>/dev/null || true
 182     if test ! -d "$logdir"; then
 183         echo "$0: log directory $logdir does not exist and cannot be created" >&2
 184         exit 1
 185     fi
 186 fi
 187
 188 if test "$command" = "init"; then
 189     if test -e "$pkidir" && test "$force" != "yes"; then
 190         echo "$0: $pkidir already exists and --force not specified" >&2
 191         exit 1
 192     fi
 193
 194     if test ! -d "$pkidir"; then
 195         mkdir -p "$pkidir"
 196     fi
 197     cd "$pkidir"
 198     exec 3>>$log
 199
 200     if test $keytype = dsa && test ! -e dsaparam.pem; then
 201         echo "Generating DSA parameters, please wait..." >&2
 202         openssl dsaparam -out dsaparam.pem $bits 1>&3 2>&3
 203     fi
 204
 205     # Get the current date to add some uniqueness to this certificate
 206     curr_date=`date +"%Y %b %d %T"`
 207
 208     # Create the CAs.
 209     for ca in controllerca switchca; do
 210         echo "Creating $ca..." >&2
 211         oldpwd=$PWD
 212         mkdir -p $ca
 213         cd $ca
 214
 215         mkdir -p certs crl newcerts
 216         mkdir -p -m 0700 private
 217         mkdir -p -m 0733 incoming
 218         touch index.txt
 219         test -e crlnumber || echo 01 > crlnumber
 220         test -e serial || echo 01 > serial
 221
 222         # Put DSA parameters in directory.
 223         if test $keytype = dsa && test ! -e dsaparam.pem; then
 224             cp ../dsaparam.pem .
 225         fi
 226
 227         # Write CA configuration file.
 228         if test ! -e ca.cnf; then
 229             sed "s/@ca@/$ca/g;s/@curr_date@/$curr_date/g" > ca.cnf <<'EOF'
 230 [ req ]
 231 prompt = no
 232 distinguished_name = req_distinguished_name
 233
 234 [ req_distinguished_name ]
 235 C = US
 236 ST = CA
 237 L = Palo Alto
 238 O = Open vSwitch
 239 OU = @ca@
 240 CN = OVS @ca@ CA Certificate (@curr_date@)
 241
 242 [ ca ]
 243 default_ca = the_ca
 244
 245 [ the_ca ]
 246 dir            = .                     # top dir
 247 database       = $dir/index.txt        # index file.
 248 new_certs_dir  = $dir/newcerts         # new certs dir
 249 certificate    = $dir/cacert.pem       # The CA cert
 250 serial         = $dir/serial           # serial no file
 251 private_key    = $dir/private/cakey.pem# CA private key
 252 RANDFILE       = $dir/private/.rand    # random number file
 253 default_days   = 365                   # how long to certify for
 254 default_crl_days= 30                   # how long before next CRL
 255 default_md     = md5                   # md to use
 256 policy         = policy                # default policy
 257 email_in_dn    = no                    # Don't add the email into cert DN
 258 name_opt       = ca_default            # Subject name display option
 259 cert_opt       = ca_default            # Certificate display option
 260 copy_extensions = none                 # Don't copy extensions from request
 261 unique_subject = no                    # Allow certs with duplicate subjects
 262
 263 # For the CA policy
 264 [ policy ]
 265 countryName             = optional
 266 stateOrProvinceName     = optional
 267 organizationName        = match
 268 organizationalUnitName  = optional
 269 commonName              = supplied
 270 emailAddress            = optional
 271 EOF
 272         fi
 273
 274         # Create certificate authority.
 275         if test $keytype = dsa; then
 276             newkey=dsa:dsaparam.pem
 277         else
 278             newkey=rsa:$bits
 279         fi
 280         openssl req -config ca.cnf -nodes \
 281             -newkey $newkey -keyout private/cakey.pem -out careq.pem \
 282             1>&3 2>&3
 283         openssl ca -config ca.cnf -create_serial -out cacert.pem \
 284             -days 2191 -batch -keyfile private/cakey.pem -selfsign \
 285             -infiles careq.pem 1>&3 2>&3
 286         chmod 0700 private/cakey.pem
 287
 288         cd "$oldpwd"
 289     done
 290     exit 0
 291 fi
 292
 293 one_arg() {
 294     if test -z "$arg1" || test -n "$arg2"; then
 295         echo "$0: $command must have exactly one argument; use --help for help" >&2
 296         exit 1
 297     fi
 298 }
 299
 300 zero_or_one_args() {
 301     if test -n "$arg2"; then
 302         echo "$0: $command must have zero or one arguments; use --help for help" >&2
 303         exit 1
 304     fi
 305 }
 306
 307 one_or_two_args() {
 308     if test -z "$arg1"; then
 309         echo "$0: $command must have one or two arguments; use --help for help" >&2
 310         exit 1
 311     fi
 312 }
 313
 314 must_not_exist() {
 315     if test -e "$1" && test "$force" != "yes"; then
 316         echo "$0: $1 already exists and --force not supplied" >&2
 317         exit 1
 318     fi
 319 }
 320
 321 resolve_prefix() {
 322     test -n "$type" || exit 123 # Forgot to call check_type?
 323
 324     case $1 in
 325         ????*)
 326             ;;
 327         *)
 328             echo "Prefix $arg1 is too short (less than 4 hex digits)" >&2
 329             exit 0
 330             ;;
 331     esac
 332
 333     fingerprint=$(cd "$pkidir/${type}ca/incoming" && echo "$1"*-req.pem | sed 's/-req\.pem$//')
 334     case $fingerprint in
 335         "${1}*")
 336             echo "No certificate requests matching $1" >&2
 337             exit 1
 338             ;;
 339         *" "*)
 340             echo "$1 matches more than one certificate request:" >&2
 341             echo $fingerprint | sed 's/ /\
 342 /g' >&2
 343             exit 1
 344             ;;
 345         *)
 346             # Nothing to do.
 347             ;;
 348     esac
 349     req="$pkidir/${type}ca/incoming/$fingerprint-req.pem"
 350     cert="$pkidir/${type}ca/certs/$fingerprint-cert.pem"
 351 }
 352
 353 make_tmpdir() {
 354     TMP=/tmp/ovs-pki.tmp$$
 355     rm -rf $TMP
 356     trap "rm -rf $TMP" 0
 357     mkdir -m 0700 $TMP
 358 }
 359
 360 fingerprint() {
 361     file=$1
 362     name=${1-$2}
 363     date=$(date -r $file)
 364     if grep -q -e '-BEGIN CERTIFICATE-' "$file"; then
 365         fingerprint=$(openssl x509 -noout -in "$file" -fingerprint |
 366                       sed 's/SHA1 Fingerprint=//' | tr -d ':')
 367     else
 368         fingerprint=$(sha1sum "$file" | awk '{print $1}')
 369     fi
 370     printf "$name\\t$date\\n"
 371     case $file in
 372         $fingerprint*)
 373             printf "\\t(correct fingerprint in filename)\\n"
 374             ;;
 375         *)
 376             printf "\\tfingerprint $fingerprint\\n"
 377             ;;
 378     esac
 379 }
 380
 381 verify_fingerprint() {
 382     fingerprint "$@"
 383     if test $batch != yes; then
 384         echo "Does fingerprint match? (yes/no)"
 385         read answer
 386         if test "$answer" != yes; then
 387             echo "Match failure, aborting" >&2
 388             exit 1
 389         fi
 390     fi
 391 }
 392
 393 check_type() {
 394     if test x = x"$1"; then
 395         type=switch
 396     elif test "$1" = switch || test "$1" = controller; then
 397         type=$1
 398     else
 399         echo "$0: type argument must be 'switch' or 'controller'" >&2
 400         exit 1
 401     fi
 402 }
 403
 404 parse_age() {
 405     number=$(echo $1 | sed 's/^\([0-9]\+\)\([[:alpha:]]\+\)/\1/')
 406     unit=$(echo $1 | sed 's/^\([0-9]\+\)\([[:alpha:]]\+\)/\2/')
 407     case $unit in
 408         s)
 409             factor=1
 410             ;;
 411         min)
 412             factor=60
 413             ;;
 414         h)
 415             factor=3600
 416             ;;
 417         day)
 418             factor=86400
 419             ;;
 420         *)
 421             echo "$1: age not in the form Ns, Nmin, Nh, Nday (e.g. 1day)" >&2
 422             exit 1
 423             ;;
 424     esac
 425     echo $(($number * $factor))
 426 }
 427
 428 must_exist() {
 429     if test ! -e "$1"; then
 430         echo "$0: $1 does not exist" >&2
 431         exit 1
 432     fi
 433 }
 434
 435 pkidir_must_exist() {
 436     if test ! -e "$pkidir"; then
 437         echo "$0: $pkidir does not exist (need to run 'init' or use '--dir'?)" >&2
 438         exit 1
 439     elif test ! -d "$pkidir"; then
 440         echo "$0: $pkidir is not a directory" >&2
 441         exit 1
 442     fi
 443 }
 444
 445 make_request() {
 446     must_not_exist "$arg1-privkey.pem"
 447     must_not_exist "$arg1-req.pem"
 448     make_tmpdir
 449     cat > "$TMP/req.cnf" <<EOF
 450 [ req ]
 451 prompt = no
 452 distinguished_name = req_distinguished_name
 453
 454 [ req_distinguished_name ]
 455 C = US
 456 ST = CA
 457 L = Palo Alto
 458 O = Open vSwitch
 459 OU = Open vSwitch certifier
 460 CN = Open vSwitch certificate for $arg1
 461 EOF
 462     if test $keytype = rsa; then
 463         newkey=rsa:$bits
 464     else
 465         must_exist "$dsaparam"
 466         newkey=dsa:$dsaparam
 467     fi
 468     openssl req -config "$TMP/req.cnf" -text -nodes \
 469         -newkey $newkey -keyout "$1-privkey.pem" -out "$1-req.pem" 1>&3 2>&3
 470 }
 471
 472 sign_request() {
 473     must_exist "$1"
 474     must_not_exist "$2"
 475     pkidir_must_exist
 476
 477     (cd "$pkidir/${type}ca" &&
 478      openssl ca -config ca.cnf -batch -in /dev/stdin) \
 479         < "$1" > "$2.tmp$$" 2>&3
 480     mv "$2.tmp$$" "$2"
 481 }
 482
 483 glob() {
 484     files=$(echo $1)
 485     if test "$files" != "$1"; then
 486         echo "$files"
 487     fi
 488 }
 489
 490 exec 3>>$log || true
 491 if test "$command" = req; then
 492     one_arg
 493
 494     make_request "$arg1"
 495     fingerprint "$arg1-req.pem"
 496 elif test "$command" = sign; then
 497     one_or_two_args
 498     check_type "$arg2"
 499     verify_fingerprint "$arg1-req.pem"
 500
 501     sign_request "$arg1-req.pem" "$arg2-cert.pem"
 502 elif test "$command" = req+sign; then
 503     one_or_two_args
 504     check_type "$arg2"
 505
 506     pkidir_must_exist
 507     make_request "$arg1"
 508     sign_request "$arg1-req.pem" "$arg1-cert.pem"
 509     fingerprint "$arg1-req.pem"
 510 elif test "$command" = verify; then
 511     one_or_two_args
 512     must_exist "$arg1-cert.pem"
 513     check_type "$arg2"
 514
 515     pkidir_must_exist
 516     openssl verify -CAfile "$pkidir/${type}ca/cacert.pem" "$arg1-cert.pem"
 517 elif test "$command" = fingerprint; then
 518     one_arg
 519
 520     fingerprint "$arg1"
 521 elif test "$command" = self-sign; then
 522     one_arg
 523     must_exist "$arg1-req.pem"
 524     must_exist "$arg1-privkey.pem"
 525     must_not_exist "$arg1-cert.pem"
 526
 527     openssl x509 -in "$arg1-req.pem" -out "$arg1-cert.pem" \
 528         -signkey "$arg1-privkey.pem" -req -text 2>&3
 529 elif test "$command" = ls; then
 530     check_type "$arg2"
 531
 532     cd "$pkidir/${type}ca/incoming"
 533     for file in $(glob "$arg1*-req.pem"); do
 534         fingerprint $file
 535     done
 536 elif test "$command" = flush; then
 537     check_type "$arg1"
 538
 539     rm -f "$pkidir/${type}ca/incoming/"*
 540 elif test "$command" = reject; then
 541     one_or_two_args
 542     check_type "$arg2"
 543     resolve_prefix "$arg1"
 544
 545     rm -f "$req"
 546 elif test "$command" = approve; then
 547     one_or_two_args
 548     check_type "$arg2"
 549     resolve_prefix "$arg1"
 550
 551     make_tmpdir
 552     cp "$req" "$TMP/$req"
 553     verify_fingerprint "$TMP/$req"
 554     sign_request "$TMP/$req"
 555     rm -f "$req" "$TMP/$req"
 556 elif test "$command" = prompt; then
 557     zero_or_one_args
 558     check_type "$arg1"
 559
 560     make_tmpdir
 561     cd "$pkidir/${type}ca/incoming"
 562     for req in $(glob "*-req.pem"); do
 563         cp "$req" "$TMP/$req"
 564
 565         cert=$(echo "$pkidir/${type}ca/certs/$req" |
 566                sed 's/-req.pem/-cert.pem/')
 567         if test -f $cert; then
 568             echo "Request $req already approved--dropping duplicate request"
 569             rm -f "$req" "$TMP/$req"
 570             continue
 571         fi
 572
 573         echo
 574         echo
 575         fingerprint "$TMP/$req" "$req"
 576         printf "Disposition for this request (skip/approve/reject)? "
 577         read answer
 578         case $answer in
 579             approve)
 580                 echo "Approving $req"
 581                 sign_request "$TMP/$req" "$cert"
 582                 rm -f "$req" "$TMP/$req"
 583                 ;;
 584             r*)
 585                 echo "Rejecting $req"
 586                 rm -f "$req" "$TMP/$req"
 587                 ;;
 588             *)
 589                 echo "Skipping $req"
 590                 ;;
 591         esac
 592     done
 593 elif test "$command" = expire; then
 594     zero_or_one_args
 595     cutoff=$(($(date +%s) - $(parse_age ${arg1-1day})))
 596     for type in switch controller; do
 597         cd "$pkidir/${type}ca/incoming" || exit 1
 598         for file in $(glob "*"); do
 599             time=$(date -r "$file" +%s)
 600             if test "$time" -lt "$cutoff"; then
 601                 rm -f "$file"
 602             fi
 603         done
 604     done
 605 else
 606     echo "$0: $command command unknown; use --help for help" >&2
 607     exit 1
 608 fi