#!%INSTDIR%/bin/perl

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

# 

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

# 

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

# 02110-1301, US

#

# Generate a keypair.  Get a keysize from the user, generate

# some useful random data, generate a key, produce a CSR if

# required and add a passphrase if required.

#

# genkey.pl -- based on genkey and genkey.aux from Stronghold

#

# Mark J Cox, mjc@redhat.com and Joe Orton, jorton@redhat.com

#

# 200103 Initial version

# 200106 Converted to Newt

# 200106 Added gencert/genreq functionality

# 200106 Added some state

# 200111 Added makeca functionality

# 200305 Hide passwords entered for private key

# 200308 Adapted for Taroon

# 200308 Fix warnings in UTF-8 locale

# 200409 Added --days support

# 200804 Use NSS library for cryptography [Bug 346731]

#

#

$bindir = "%INSTDIR%/bin";

$ssltop = "%INSTDIR%/conf/ssl";

$nssconf = "/etc/httpd/conf.d/nss.conf";

$cadir = "$ssltop/CA";

use Crypt::Makerand;

use Newt;

use Getopt::Long;

use File::Temp qw/ tempfile /;

sub InitRoot

{

    my $help = shift;

    Newt::Cls();

    Newt::DrawRootText(0, 0, 

		       "Red Hat Keypair Generation (c) 2008 Red Hat, Inc.");

    if ($help == 1) {

	Newt::PushHelpLine("  <Tab>/<Alt-Tab> between elements  |" .

			   "  <Space> selects  |" .

			   "  <Escape> to quit");

    }

}

sub FinishRoot

{

    Newt::PopHelpLine();

    Newt::Cls();

}

sub usage 

{

    print STDERR <

Usage: genkey [options] servername

    --test   Test mode, faster seeding, overwrite existing key

    --genreq Generate a Certificate Signing Request (CSR)

    --makeca Generate a self-signed certificate for a CA

    --days   Days until expiry of self-signed certificate (default 30)

    --renew  CSR is for cert renewal, reusing existing key pair, openssl certs only

    --cacert Renewal is for a CA certificate, needed for openssl certs only

    --nss    Use the nss database for keys and certificates

    --gdb    For package maintainers, to trace into the nss utilities

EOH

    exit 1;

}

# Run a form with support for pressing escape and enter.

sub RunForm

{

    my ($panel, $onenter, $onescape) = @_;

    # set defaults

    $onenter = "Next" if (!defined($onenter));

    $onescape = "Cancel" if (!defined($onescape));    

    $panel->AddHotKey(Newt::NEWT_KEY_ESCAPE());

    $panel->AddHotKey(Newt::NEWT_KEY_ENTER()) unless $onenter eq "Ignore";

    ($reason, $data) = $panel->Run();

    if ($reason eq Newt::NEWT_EXIT_HOTKEY) {

	if ($data == Newt::NEWT_KEY_ESCAPE()) {

	    # They pressed ESCAPE; pretend they pressed "Cancel" or "No"

	    return $onescape;

	}

	elsif ($data == Newt::NEWT_KEY_ENTER()) {

	    my $current = $panel->GetCurrent();

	    if ($panel->{refs}{$$current}->Tag()) {

		# They pressed ENTER over a button; pretend they pressed it.

		return $panel->{refs}{$$current}->Tag();

	    }

	    return $onenter;

	}

    }

    elsif ($reason eq Newt::NEWT_EXIT_COMPONENT) {

	return $data->Tag();

    }

    die "unhandled event ", $reason, " ", $data, "\n";

}

#

# main

#

my $test_mode = '';

my $genreq_mode = '';

my $ca_mode = '';

my $cert_days = 30;

my $nss ='';

my $renew = '';

my $cacert = '';

my $modNssDbDir = '';

my $nssNickname = '';

my $nssDBPrefix = '';

my $gdb = '';

GetOptions('test|t' => \$test_mode, 

           'genreq' => \$genreq_mode,

           'days=i' => \$cert_days,

           'renew'  => \$renew,

           'cacert' => \$cacert,

           'nss|n'  => \$nss,

           'gdb'    => \$gdb,

           'makeca' => \$ca_mode) or usage();

usage() unless @ARGV != 0;

if ($genreq_mode && $renew && !$nss) {

print STDERR <

Certificate renewal from PEM files is not yet supported.

EOH

}

$skip_random = $test_mode;

$overwrite_key = $test_mode;

$servername = $ARGV[0];

$randfile = $ssltop."/.rand.".$$;

$keyEncPassword = '';  # for the one we write

$tmpPasswordFile = ''; # none has been created yet

$keyfile = $ssltop."/private/".$servername.".key";

if ($ca_mode) {

    $keyfile = $cadir."/private/".$servername.".key";

}

### State variables

my $bits = 0;

my $myca = "Other";

my $useca = 0;

my $subject;

#

Newt::Init();

InitRoot(1);

local $SIG{__DIE__} = sub { @err=@_; Newt::Finished(); die @err;};

# Either mod_nss or mod_ssl is required

requireModule();

# For mod_nss we need these variables set

if ($nss) {

    # the configuration file is required

    if (!nssconfigFound()) {

        Newt::newtWinMessage("Error", "Close", 

        "Could not find mod_nss's nss.conf file".

        "for this host:\n\nPress return to exit");

        Newt::Finished();

        exit 1;

    }

    $modNssDbDir = getModNSSDatabase();

    $nssNickname = $servername ? $servername : getNSSNickname();

    $nssDBPrefix = getNSSDBPrefix();

}

#

# Does the key already exist? don't overwrite

#

if (!$nss) {

    if (!$genreq_mode && -f $keyfile && !$overwrite_key) {

        Newt::newtWinMessage("Error", "Close", 

		"You already have a key file for this host in file:\n\n" .

		$keyfile . "\n\n" .

		"This script will not overwrite an existing key.\n" . 

		"You will need to remove or rename this file in order to" .

		"generate a new key for this host, then rerun the command");

        Newt::Finished();

        exit 1;

    }

} else {

    # check for the key in the database

    if (!$genreq_mode && keyInDatabase($nssNickname,$modNssDbDir) &&

        !$renew && !$overwrite_key) {

        Newt::newtWinMessage("Error", "Close", 

		    "You already have a key file for this host in the datatabase:\n\n" .

		    "$modNssDbDir" ." with nickname ". "$nssNickname" . "\n\n" .

		    "This script will not overwrite an existing key.\n" . 

		    "You will need to remove or rename the database in order to" .

		    "generate a new key for this host, then rerun the command");

        Newt::Finished();

       exit 1;

    }

}

######################################################################

# Main

#

# Array of windows which we cycle through. Each window function should

# return: 

#   "Next" or "Skip" -> go on to the next window

#   "Back" -> go back to the last window which returned "Next"

#   "Cancel" -> cancelled: quit and return failure.

#

# "Skip" is to allow for windows which don't display anything (due

# to choices made in previous windows, for instance).

#

my @windows;

if ($genreq_mode) {

    $useca = 1;

    @windows = $renew 

        ? (passwordWindow,genReqWindow,) 

        : (getkeysizeWindow,

           customKeySizeWindow,

           getRandomDataWindow,

           passwordWindow,

           genReqWindow,

           );

    $doingwhat="CSR generation";

} elsif ($ca_mode) {

    @windows = (CAwelcomeWindow,

		getkeysizeWindow,

		customKeySizeWindow,

		getRandomDataWindow,

		passwordWindow,

		genCACertWindow,

		);

    $doingwhat="CA cert generation";

} else {

    @windows = (welcomeWindow,

		getkeysizeWindow,

		customKeySizeWindow,

		getRandomDataWindow,

		wantCAWindow,

		passwordWindow,

		genReqWindow,

        genCertWindow,

        ### @EXTRA@ ### Leave this comment here.

        );

    $doingwhat="testing CSR and cert generation";

}

my $screen = 0;

my @screenstack;

my $result;

while ($screen <= $#windows) {

    $result = $windows[$screen]->();

    print STDERR "undef from window #" .$screen . "\n" if (!$result);

    if ($result eq "Cancel") {

	my $panel = Newt::Panel(1, 2, "Confirm");

	$panel->Add(0, 0, 

		  Newt::TextboxReflowed(60, 10, 10, 0, 

					"Do you want to cancel ".$doingwhat.

					"?"));

	$panel->Add(0, 1, DoubleButton("Yes", "No"));

	# Default to NOT cancel if escape is pressed (again)

	$ret = &RunForm($panel, "No", "No");

	$panel->Hide();

	undef $panel;

	last if $ret eq "Yes";

	next;

    }

    $nextscreen = $screen + 1 if ($result eq "Next" or $result eq "Skip"

				  or !$result);

    $nextscreen = pop @screenstack if ($result eq "Back" and scalar(@screenstack));

    push @screenstack, $screen if ($result eq "Next");

    $screen = $nextscreen;

}

# Exit

clearSensitiveData();

Newt::Finished();

exit 1 if ($result eq "Cancel");

exit 0;

#

# end main

#

######################################################################

# Handy functions

# Returns a panel containing two buttons of given names.

sub DoubleButton {

    my ($left, $right) = @_;

    my $leftb = Newt::Button($left)->Tag($left);

    my $rightb = Newt::Button($right)->Tag($right);

    Newt::Panel(2, 1)

      ->Add(0, 0, $leftb, Newt::NEWT_ANCHOR_RIGHT(), 0, 1, 0, 0)

	  ->Add(1, 0, $rightb, Newt::NEWT_ANCHOR_LEFT(), 1, 1, 0, 0);

}

# Returns a panel containing next/back/cancel buttons.

sub NextBackCancelButton {

    my $nextb = Newt::Button('Next')->Tag('Next');

    my $backb = Newt::Button('Back')->Tag('Back');

    my $cancelb = Newt::Button('Cancel')->Tag('Cancel');

    Newt::Panel(3, 1)

      ->Add(0, 0, $nextb, Newt::NEWT_ANCHOR_RIGHT(), 0, 1, 0, 0)

	  ->Add(1, 0, $backb, Newt::NEWT_ANCHOR_RIGHT(), 1, 1, 0, 0)

	      ->Add(2, 0, $cancelb, Newt::NEWT_ANCHOR_LEFT(), 1, 1, 0, 0);

}

# Require that this Apache module (mod_nss or mod_ssl) be installed

sub requireModule {

    my $module = $nss ? "mod_nss" : "mod_ssl";	

    my $not_installed_msg = `rpm -q $module | grep "not installed"`;

	if ($not_installed_msg) {

        Newt::newtWinMessage("Error", "Close", 

        "$not_installed_msg".

        "\nIt is required to generate this type of CSRs or certs".

        "for this host:\n\nPress return to exit");

        Newt::Finished();

        exit 1;

    }	

}

# Check that nss.conf exists

sub nssconfigFound {

    # if it isn't in its usual place

    if (!$nssconf || !(-f $nssconf)) {

        # do an rpm query

        my $cmd = 'rpm -ql mod_nss';

        ($fh, $tmplist) = tempfile("list.XXXXXX");

        system("$cmd > $tmplist");

        $nssconf = `grep nss.conf $tmplist`;

        unlink($tmplist);

    }

    return ($nssconf && (-f $nssconf));

}

# Returns the mod_nss database directory path.

sub getModNSSDatabase {

    # Extract the value from the mod_nss configuration file.

    my $cmd ='/usr/bin/gawk \'/^NSSCertificateDatabase/ { print $2 }\'' . " $nssconf"; 

    ($fh, $dbfile) = tempfile("dbdirectory.XXXXXX");

    system("$cmd > $dbfile");

    open(DIR, "<$dbfile");

    my $dbdir = '';

    chomp($dbdir = <DIR>);

    unlink($dbfile);

    return $dbdir;

}

# Returns the rsa server name.

sub getNSSNickname {

    # Extract the value from the mod_nss configuration file.

    my $cmd ='/usr/bin/gawk \'/^NSSNickname/ { print $2 }\'' . " $nssconf";

    ($fh, $nicknamefile) = tempfile("nssnickname.XXXXXX");

    system("$cmd > $nicknamefile");

    open(NICK, "<$nicknamefile");  

    my $nickname = ''; 

    chomp($nickname = <NICK>); 

    unlink($nicknamefile);

    return $nickname;

}

# Returns the nss database prefix

sub getNSSDBPrefix {

    # Extract the value from the mod_nss configuration file.

    my $cmd ='/usr/bin/gawk \'/^NSSDBPrefix/ { print $2 }\'' . " $nssconf";

    ($fh, $prefixfile) = tempfile("dbprefix.XXXXXX");

    system("$cmd > $prefixfile");

    open(PREFIX, "<$prefixfile");

    my $prefix = '';

    chomp($prefix = <PREFIX>); 

    unlink($prefixfile);

    return $prefix;

}

# Erases and deletes the password file

sub clearSensitiveData {

    if (-f $tmpPasswordFile) {

       open(DOOMED,$tmpPasswordFile);

       truncate(DOOMED,0);

       close(DOOMED);

       unlink($tmpPasswordFile);

    }

}

# Remove a directory and its contents

sub removeDirectory {

    my ($dir) = @_;

    if (-f $dir) {

        opendir(DOOMED, $dir) || die("Cannot open directory");

        my @thefiles= readdir(DOOMED);

        foreach my $file (@thefiles) {

            unlink @file;

        }

        closedir(DOOMED);

    	rmdir $dir;

    }

}

# Print error message

sub printError {

    my ($msg) = @_;

    Newt::Suspend();

    print STDERR "$msg\n";

    Newt::Resume();

}

# Is the given key in the database?

sub keyInDatabase {

    my ($nickname, $dbdir) = @_;

    my $tmp = "tmp";

    my $answer = `$bindir/certutil -L -d $dbdir | grep $nickname`;

    return $answer;

}

######################################################################

# The window functions

sub makerand

{

    require Fcntl;

    my ($bits,$filename) = @_;

    my $count = 0;

    my @credits = ("This software contains the truerand library",

		   "developed by Matt Blaze, Jim Reeds, and Jack",

		   "Lacy. Copyright (c) 1992, 1994 AT&T.");

    my ($cols, $rows) = Newt::GetScreenSize();

    foreach (@credits) {

	$count++;

	Newt::DrawRootText($cols-45, $rows-5 + $count, $_);

    }

    $count = 0;

    my $panel = Newt::Panel(1, 2, "Generating random bits");

    my $scale = Newt::Scale(40, $bits);

    $panel->Add(0, 0, Newt::Label("(this may take some time)"));

    $panel->Add(0, 1, $scale, 0, 0, 1);

    $panel->Draw();

    if (!sysopen($randfh,$filename,Fcntl::O_WRONLY()|Fcntl::O_CREAT()

		 |Fcntl::O_TRUNC()|Fcntl::O_EXCL(),0600)) {

	Newt::newtWinMessage("Error", "Close", 

			     "Can't create random data file");

	$panel->Hide();

	undef $panel;

	return "Cancel";

    }

    Newt::Refresh();

    while ($count++ < $bits/32) { 

        use bytes; # random data is not UTF-8, prevent warnings

	# decode as an "native-length" unsigned long

	syswrite($randfh,pack("L!",Crypt::Makerand::trand32()));

	$scale->Set($count*32);

	Newt::Refresh();

    }

    $panel->Hide();

    undef $panel;

    close $randfh;

}

sub getkeysizeWindow()

{

    $minbits = 512;

    $maxbits = 8192;

    my $title= <

Choose the size of your key. The smaller the key you choose the faster

your server response will be, but you'll have less security. Keys of

less than 1024 bits are easily cracked.

We suggest you select the default, 2048 bits.

EOT

    my $panel = Newt::Panel(1, 3, "Choose key size");

    my $listbox = Newt::Listbox(5, 0);

    my $text = Newt::Textbox(70, 6, 0, $title);

    my @listitems = ("512 (insecure)",

		     "1024 (low-grade, fast speed)",

		     "2048 (medium-security, medium speed) [RECOMMENDED]",

		     "4096 (high-security, slow speed)",

		     "Choose your own");

    $listbox->Append(@listitems);

    $panel->Add(0, 0, $text);

    $panel->Add(0, 1, $listbox, 0, 0, 1);

    $panel->Add(0, 2, NextBackCancelButton());

    Newt::newtListboxSetCurrent($listbox->{co}, 2);

    $panel->Draw();

    $ret = &RunForm($panel);    

    if ($ret eq "Cancel" or $ret eq "Back") {

	$panel->Hide();

	undef $panel;

	return $ret;

    }

    $bits = 256;

    foreach $item(@listitems) {

	$bits = $bits * 2;

	if ($item eq $listbox->Get()) {

	    last;

	}

    }

    $panel->Hide();

    undef $panel;

    return $ret;

}

sub customKeySizeWindow()

{

    return "Next" if $bits < 8192; # else, choose custom size.

    Newt::Refresh();

    $bits = 0;

    $title = <

Select the exact key size you want to use. Note that some browsers do

not work correctly with arbitrary key sizes.  For a reasonable level

of security you should use 2048.

EOT

    $panel = Newt::Panel(1, 3, "Select exact key size");

    my $entry = Newt::Entry(10, 0, "");

    $panel->Add(0, 0, Newt::Textbox(70, 4, 0, $title));

    $panel->Add(0, 1, $entry);

    $panel->Add(0, 2, NextBackCancelButton());

    do {

	$panel->Focus($entry);

	$ret = &RunForm($panel);

	if ($ret eq "Cancel" or $ret eq "Back") {

	    $panel->Hide();

	    undef $panel;

	    return $ret;

	}

	if ($entry->Get() ne "") {

	    $bits = int($entry->Get());

	} else {

	    $bits = 0;

	}

    } while ($bits < $minbits || $bits > $maxbits);

    $panel->Hide();

    undef $panel;

    return "Next";

}

sub welcomeWindow()

{

    my $name = $servername;

    my $where_key = $nss

        ? $modNssDbDir."/$nssDBPrefix"."key3.db" : "$ssltop/private/$name.key";

    my $where_cert = $nss

        ? $modNssDbDir."/$nssDBPrefix"."cert8.db" : "$ssltop/certs/$name.crt";

    my $what = $nss ? "directory" : "file";

    my $message = <

You are now generating a new keypair which will be used to encrypt all

SSL traffic to the server named $name. 

Optionally you can also create a certificate request and send it to a

certificate authority (CA) for signing.

The key will be stored in 

    $where_key

The certificate stored in 

    $where_cert

If the key generation fails, move the $what

    $where_key 

to a backup location and try again.

EOT

    my $panel = Newt::Panel(1, 2, "Keypair generation");

    my $text = Newt::Textbox(70, 10, Newt::NEWT_TEXTBOX_SCROLL(), $message);

    my $ret;

    $panel->Add(0, 0, $text);

    $panel->Add(0, 1, DoubleButton("Next","Cancel"));

    $ret = &RunForm($panel);

    $panel->Hide();

    undef $panel;

    return $ret;

}

sub CAwelcomeWindow()

{

    my $name = $servername;

    my $where = $nss ? $modNssDbDir."/$nssDBPrefix"."key3.db" : "$cadir/private/$name"; 

    my $message = <

You are now generating a new keypair which will be used for your

private CA

The key will be stored in 

    $where

If the key generation fails, move the file 

    $where

to a backup location and try again.

EOT

    my $panel = Newt::Panel(1, 2, "CA Key generation");

    my $text = Newt::Textbox(70, 10, Newt::NEWT_TEXTBOX_SCROLL(), $message);

    my $ret;

    $panel->Add(0, 0, $text);

    $panel->Add(0, 1, DoubleButton("Next","Cancel"));

    $ret = &RunForm($panel);

    $panel->Hide();

    undef $panel;

    return $ret;

}

sub wantCAWindow

{

    my $panel = Newt::Panel(1, 2, "Generate CSR");

    $panel->Add(0, 0, 

	      Newt::TextboxReflowed(60, 10, 10, 0, 

				    "Would you like to send a Certificate Request (CSR) " .

				    "to a Certificate Authority (CA)?"));

    $panel->Add(0, 1, DoubleButton("Yes", "No"));

    $ret = &RunForm($panel);

    $panel->Hide();

    undef $panel;

    if ($ret eq "Cancel") {

	return "Cancel";

    }

    $useca = ($ret eq "Yes") ? 1 : 0;

    return "Next";

}

# Save the passphrase to a temporary file.

sub savePassword 

{

    my ($passwd) = @_;

    #

    # Write password to a file with lines formatted as:

    # NSS Certificate DB:access_passphrase

    # PEM Token #0:ca_key_access_passphrase

    # PEM Token #1:server_key_access_passphrase

    #

    my $passwordLine = $nss

        ? "NSS Certificate DB" : $cacert ? "PEM Token #0:" : "PEM Token #1:";

    $passwordLine .= "$passwd\n";

    if ($tmpPasswordFile) {

        # append to existing file

        if (!open(SESAME, ">>$tmpPasswordFile")) {