cgi/usercert.cgi

   1 #!/usr/bin/perl
   2
   3 # usercert.cgi -- user push authentication certificate retrieval
   4 # Copyright (c) 2013 Kyle J. McKay.  All rights reserved.
   5
   6 # This program is free software; you can redistribute it and/or
   7 # modify it under the terms of the GNU General Public License
   8 # as published by the Free Software Foundation; either version 2
   9 # of the License, or (at your option) any later version.
  10 #
  11 # This program is distributed in the hope that it will be useful,
  12 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 # GNU General Public License for more details.
  15 #
  16 # You should have received a copy of the GNU General Public License
  17 # along with this program; if not, write to the Free Software
  18 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  19
  20 use strict;
  21 use warnings;
  22
  23 use lib ".";
  24 use Girocco::CGI;
  25 use Girocco::Config;
  26 use Girocco::User;
  27 use Girocco::Util;
  28 use Girocco::SSHUtil;
  29
  30 sub notfound
  31 {
  32         my $mesg = shift || "<p>404 - Not found</p>";
  33         my $gcgi = Girocco::CGI->new('User HTTPS Push Authentication Certificate');
  34         print $mesg;
  35         exit;
  36 }
  37
  38 sub mtime
  39 {
  40         my $fname = shift;
  41         my (undef,undef,undef,undef,undef,undef,undef,undef,undef,$mtime) = stat $fname;
  42         return $mtime;
  43 }
  44
  45 sub readfile
  46 {
  47         my $fname = shift;
  48         local $/;
  49         open(FILE, '<', $fname) or return undef;
  50         my $contents = <FILE>;
  51         close(FILE);
  52         return $contents;
  53 }
  54
  55 notfound unless $Girocco::Config::clientcert && $Girocco::Config::clientkey;
  56
  57 my $cgi = CGI->new;
  58
  59 notfound if $cgi->request_method() ne 'GET' && $cgi->request_method() ne 'HEAD';
  60 notfound "<p>Go away, bot.</p>" if $cgi->param('mail');
  61
  62 my $nick = $Girocco::Config::nickname;
  63
  64 my $name = $cgi->param('name');
  65 $name =~ s/^\s*(.*?)\s*$/$1/ if $name;
  66 my $line = $cgi->param('line');
  67 $line =~ s/^\s*(.*?)\s*$/$1/ if $line;
  68 my $view = $cgi->param('view');
  69 $view =~ s/^\s*(.*?)\s*$/$1/ if $view;
  70
  71 notfound if $cgi->path_info() && ($name || $line);
  72
  73 if ($cgi->path_info() =~ m,/([^/]+)/([^/]+)/([^/]+)$,) {
  74         my ($tn,$tl,$tp) = ($1,$2,$3);
  75         if ("${nick}_${tn}_user_$tl.pem" eq $tp) {
  76                 $name = $tn;
  77                 $line = $tl;
  78         }
  79 }
  80
  81 notfound unless $name && $line && $line =~ /^[1-9][0-9]*$/;
  82 $line += 0;
  83
  84 notfound unless Girocco::User::valid_name($name) && Girocco::User::does_exist($name);
  85 my $user = Girocco::User->load($name) or notfound;
  86
  87 my @keys = split(/\r?\n/, $user->{keys});
  88 $line <= @keys or notfound;
  89 my ($type, $bits, $fingerprint, $comment) = sshpub_validate($keys[$line-1]);
  90 $type && $type eq 'ssh-rsa' or notfound;
  91
  92 my $sshkeys = jailed_file($user->_sshkey_path);
  93 my $kname = "${nick}_${name}_user_$line.pem";
  94 my $sshcert = jailed_file("/etc/sshcerts/$kname");
  95 my $sshkeysmtime = mtime($sshkeys);
  96 notfound unless $sshkeysmtime;
  97 my $sshcertmtime = mtime($sshcert);
  98 if (!$sshcertmtime || $sshkeysmtime >= $sshcertmtime) {
  99         unlink $sshcert;
 100         my @args = (
 101                 "$Girocco::Config::basedir/bin/CACreateCert", "--quiet", "--client",
 102                 "--cert", $Girocco::Config::clientcert,
 103                 "--key", $Girocco::Config::clientkey,
 104                 "--out", $sshcert
 105                 );
 106         push(@args, "--suffix", $Girocco::Config::clientcertsuffix)
 107                 if $Girocco::Config::clientcertsuffix;
 108         push(@args, $name);
 109         open(PIPE, "|-", @args) or notfound;
 110         print PIPE $keys[$line-1], "\n";
 111         close(PIPE) or notfound;
 112         chmod(0664, $sshcert);
 113 }
 114 notfound unless -r $sshcert;
 115 my $certdata = readfile($sshcert);
 116 notfound unless $certdata;
 117 my $isviewonly = 0;
 118 $isviewonly = 0 + $view if $view && $view =~ /^[01]$/;
 119 if ($isviewonly) {
 120         print "Content-Type: text/plain\r\n"
 121 } else {
 122         print "Content-Type: application/octet-stream\r\n";
 123         print "Content-Disposition: attachment; filename=\"$kname\"\r\n";
 124 }
 125 print "\r\n";
 126 print $certdata unless $cgi->request_method() eq 'HEAD';
 127
 128 exit 0;