show-status

#!/bin/bash

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Christian Göttsche <cgzones@googlemail.com>

set -eu
set -o pipefail

umask 0077

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
# shellcheck disable=SC1090
source "$BIN_DIR/functions"
# shellcheck disable=SC1090
source "$BIN_DIR/defaults.conf"

ROOT_DIR="$(readlink -e "$BIN_DIR/..")"

echo -e "$NOTE Checking directory $ROOT_DIR  ..."

if [ -L "$BIN_DIR/functions" ]; then
    echo -e "$NOTE Symlinked toolchain (dev mode)"
else
    echo -e "$NOTE Standalone toolchain"
fi

# check directory structure

if [ ! -d bin/templates ]; then
    echo -e "$ERR No 'bin/templates' directory!";
    exit 2
fi

if [ ! -d ca ]; then
    echo -e "$ERR No 'ca' directory!";
    exit 2
fi

if [ ! -f ca/ca.conf ]; then
    echo -e "$ERR No 'ca/ca.conf' file!";
    exit 2
fi

if [ ! -f ca/ca.crt ]; then
    echo -e "$ERR No 'ca/ca.crt' file!";
    exit 2
fi

if [ ! -f ca/ca.csr ]; then
    echo -e "$ERR No 'ca/ca.csr' file!";
    exit 2
fi

if [ ! -f ca/chain.pem ]; then
    echo -e "$ERR No 'ca/chain.pem' file!'";
    exit 2
fi

if [ ! -f ca/root.crt ]; then
    echo -e "$ERR No 'ca/root.crt' file!";
    exit 2
fi

if [ ! -d ca/archive ]; then
    echo -e "$ERR No 'ca/archives' directory!";
    exit 2
fi

if [ ! -d ca/crl ]; then
    echo -e "$ERR No 'ca/crl' directory!";
    exit 2
fi

if [ ! -d ca/db ]; then
    echo -e "$ERR No 'ca/db' directory!";
    exit 2
fi

if [ ! -f ca/db/certificate.db ]; then
    echo -e "$ERR No 'ca/db/certificate.db' file!";
    exit 2
fi

if [ ! -f ca/db/certificate.db.attr ]; then
    echo -e "$ERR No 'ca/db/certificate.db.attr' file!";
    exit 2
fi

if [ ! -f ca/db/crl.srl ]; then
    echo -e "$ERR No 'ca/db/crl.srl' file!";
    exit 2
fi

if [ ! -f ca/db/crt.srl ]; then
    echo -e "$ERR No 'ca/db/crt.srl' file!";
    exit 2
fi

if [ ! -f ca/private/ca.key ]; then
    echo -e "$ERR No 'ca/private/ca.key' file!";
    exit 2
fi

if [ ! -d ca/private ]; then
    echo -e "$ERR No 'ca/private' directory!";
    exit 2
fi

if [ ! -d certs ]; then
    echo -e "$ERR No 'certs' directory!";
    exit 2
fi

CA_CRT="$ROOT_DIR/ca/ca.crt"

if openssl verify -CAfile "$CA_CRT" "$CA_CRT" >/dev/null 2>&1; then
    echo -e "$SUCC RootCA directory (found self-signed CA)"

    if [ ! -f "$ROOT_DIR/ca/archive/01.pem" ] || ! cmp "$CA_CRT" "$ROOT_DIR/ca/archive/01.pem" >/dev/null; then
        echo -e "$ERR Main certificate does not match first archive entry!"
        exit 2
    fi

    rootCA=1 #signs itself
else
    echo -e "$SUCC SignCA directory (found signed CA)"
    rootCA=0
fi

echo -e "$NOTE Sign CA details"
echo -e "$NOTE     Name                        $CA_NAME"
echo -e "$NOTE     Domain                      $CA_DOMAIN"
subject=$(openssl x509 -noout -in "$CA_CRT" -subject) # ignore subject=
echo -e "$NOTE     Subject                     ${subject:8}"
if [ ! $rootCA -eq 1 ]; then
    issuer=$(openssl x509 -noout -in "$CA_CRT" -issuer) # ignore issuer=
    echo -e "$NOTE     Issuer                      ${issuer:7}"
fi
enddate=$(openssl x509 -noout -in "$CA_CRT" -enddate) # ignore notAfter=
echo -e -n "$NOTE     Valid until                 ${enddate:9}"
if ! openssl x509 -noout -in "$CA_CRT" -checkend 15768000 > /dev/null; then # 1/2 year
    echo -e -n " - \033[33;1mabout to expire\033[0m"
else
    echo
fi

echo -e "$NOTE     Bits                       $(openssl x509 -noout -in "$CA_CRT" -text -certopt no_header,no_aux,no_extensions,no_version,no_serial,no_issuer,no_validity,no_subject,no_signame,no_sigdump | grep 'Public-Key:' | cut -d ':' -f2 | tr -d "()")"

srl=$(cat "$ROOT_DIR/ca/db/crt.srl")
certs=$((16#$srl - rootCA - 1))
echo -e "$NOTE     Signed Certificates        " $certs

if ! openssl crl -in "$ROOT_DIR/ca/ca.crl" -CAfile "$CA_CRT" >/dev/null 2>&1; then
    echo -e "$ERR Certificate revocation list not valid!"
    exit 2
fi

if [ "$(openssl crl -in "$ROOT_DIR/ca/ca.crl" -text -noout | grep -cE '^No Revoked Certificates.')" -eq 1 ]; then
    revoked_certs=0
else
    revoked_certs=$(openssl crl -in "$ROOT_DIR/ca/ca.crl" -text -noout | grep -cE '^\s+Revocation Date:')
fi
echo -e "$NOTE     Revoked Certificates        $revoked_certs"

revoked_lists=$(($(cat "$ROOT_DIR/ca/db/crl.srl") - 1))
echo -e "$NOTE     Revoke Certificates Lists  "  $revoked_lists


if [ $rootCA -eq 0 ]; then
    ROOT_CRT="$ROOT_DIR/ca/root.crt"
    echo -e "$NOTE Root CA details"
    root_subject=$(openssl x509 -noout -in "$ROOT_CRT" -subject) # ignore subject=
    echo -e "$NOTE     Subject                     ${root_subject:8}"
    root_enddate=$(openssl x509 -noout -in "$ROOT_CRT" -enddate) # ignore notAfter=
    echo -e -n "$NOTE     Valid until                 ${root_enddate:9}"
    if ! openssl x509 -noout -in "$ROOT_CRT" -checkend 15768000 > /dev/null; then # 1/2 year
        echo -e -n " - \033[33;1mabout to expire\033[0m"
    else
        echo
    fi

    echo -e "$NOTE     Bits                       $(openssl x509 -noout -in "$ROOT_CRT" -text -certopt no_header,no_aux,no_extensions,no_version,no_serial,no_issuer,no_validity,no_subject,no_signame,no_sigdump | grep 'Public-Key:' | cut -d ':' -f2 | tr -d "()")"
fi

skip=$rootCA
if [ $certs -gt 0 ]; then
    num=1
    echo
    while read -r line; do
        if [ $skip -eq 1 ]; then
            skip=0
        else


            if [[ "$line" == "V"* ]]; then
                ca_number=$(echo "$line" | tr -s ' \t' ' ' | cut -d ' ' -f 3)
                revoked="no"
            else
                ca_number=$(echo "$line" | tr -s ' \t' ' ' | cut -d ' ' -f 4)
                revoked="yes"
            fi

            pem_file="$ROOT_DIR/ca/archive/$ca_number.pem"

            ca_cname=$(openssl x509 -noout -subject -in "$pem_file" -nameopt multiline | grep -E '^\s+commonName' | cut -d '=' -f 2-)

            server_cert=$(openssl x509 -noout -in "$pem_file" -ext extendedKeyUsage | grep -c 'TLS Web Server Authentication') || true
            sign_cert=$(openssl x509 -noout -in "$pem_file" -ext keyUsage | grep -c 'Certificate Sign') || true
            client_cert=$(openssl x509 -noout -in "$pem_file" -ext extendedKeyUsage | grep -c 'TLS Web Client Authentication') || true
            valid_since=$(openssl x509 -noout -in "$pem_file" -startdate) # ignore notBefore=
            valid_until=$(openssl x509 -noout -in "$pem_file" -enddate) # ignore notAfter=
            bits=$(openssl x509 -noout -in "$pem_file" -text -certopt no_header,no_aux,no_extensions,no_version,no_serial,no_issuer,no_validity,no_subject,no_signame,no_sigdump | grep 'Public-Key:' | cut -d ':' -f2 | tr -d "()")
            subjectAltName=$(openssl x509 -noout -in "$pem_file" -ext subjectAltName)
            subjectAltName=$(grep -vE '^X509v3 Subject Alternative Name:\s*$' <<< "$subjectAltName" | sed -e 's/^[[:space:]]*//')

            if [ "$server_cert" -ge 1 ]; then
                type="server"
                san="                SAN:            $subjectAltName\n"
            elif [ "$sign_cert" -ge 1 ]; then
                type="signing"
                san=""
            elif [ "$client_cert" -ge 1 ]; then
                type="client"
                san="                SAN:            $subjectAltName\n"
            else
                echo -e "$ERR unknown certificate type!!"
                exit 2
            fi

            sha1_hash=$(openssl x509 -noout -fingerprint -sha1 -in "$ROOT_DIR/ca/archive/$ca_number.pem") # ignore SHA1 Fingerprint=

            subj=$(openssl x509 -noout -in "$ROOT_DIR/ca/archive/$ca_number.pem" -subject) # ignore subject=


            echo -e -n "$NOTE       $ca_number - $type -$ca_cname"
            if ! openssl x509 -noout -in "$pem_file" -checkend 0 > /dev/null; then
                echo -e -n " - \033[33;1mexpired\033[0m"
            elif ! openssl x509 -noout -in "$pem_file" -checkend 2592000 > /dev/null; then # 30 days
                echo -e -n " - \033[33;1mabout to expire\033[0m"
            fi
            if [ $revoked = "yes" ]; then
                echo -e " - \033[33;1mrevoked\033[0m"
            else
                echo
            fi
            echo -e "                Subject:        ${subj:8}"
            echo -e -n "$san"
            echo -e "                Revoked:        $revoked"
            echo -e "                Valid since:    ${valid_since:10}"
            echo -e "                Valid until:    ${valid_until:9}"
            echo -e "                Bits:          $bits"
            echo -e "                Type:           $type"
            echo -e "                SHA1 hash:      ${sha1_hash:17}"
            echo -e ""

        fi
        num=$((num+1))
    done < "$ROOT_DIR/ca/db/certificate.db"
fi

echo -e "$SUCC Status finished."