uhttpd: create self-signed certificates with unique subjects
[librecmc/librecmc.git] / package / network / services / uhttpd / files / uhttpd.init
1 #!/bin/sh /etc/rc.common
2 # Copyright (C) 2010 Jo-Philipp Wich
3
4 START=50
5
6 USE_PROCD=1
7
8 UHTTPD_BIN="/usr/sbin/uhttpd"
9 PX5G_BIN="/usr/sbin/px5g"
10 OPENSSL_BIN="/usr/bin/openssl"
11
12 append_arg() {
13         local cfg="$1"
14         local var="$2"
15         local opt="$3"
16         local def="$4"
17         local val
18
19         config_get val "$cfg" "$var"
20         [ -n "$val" -o -n "$def" ] && procd_append_param command "$opt" "${val:-$def}"
21 }
22
23 append_bool() {
24         local cfg="$1"
25         local var="$2"
26         local opt="$3"
27         local def="$4"
28         local val
29
30         config_get_bool val "$cfg" "$var" "$def"
31         [ "$val" = 1 ] && procd_append_param command "$opt"
32 }
33
34 generate_keys() {
35         local cfg="$1"
36         local key="$2"
37         local crt="$3"
38         local days bits country state location commonname
39
40         config_get days       "$cfg" days
41         config_get bits       "$cfg" bits
42         config_get country    "$cfg" country
43         config_get state      "$cfg" state
44         config_get location   "$cfg" location
45         config_get commonname "$cfg" commonname
46
47         # Prefer px5g for certificate generation (existence evaluated last)
48         local GENKEY_CMD=""
49         local UNIQUEID=$(dd if=/dev/urandom bs=1 count=4 | hexdump -e '1/1 "%02x"')
50         [ -x "$OPENSSL_BIN" ] && GENKEY_CMD="$OPENSSL_BIN req -x509 -outform der -nodes"
51         [ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -der"
52         [ -n "$GENKEY_CMD" ] && {
53                 $GENKEY_CMD \
54                         -days ${days:-730} -newkey rsa:${bits:-2048} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \
55                         -subj /C="${country:-DE}"/ST="${state:-Saxony}"/L="${location:-Leipzig}"/O="${commonname:-Lede}$UNIQUEID"/CN="${commonname:-Lede}"
56                 sync
57                 mv "${UHTTPD_KEY}.new" "${UHTTPD_KEY}"
58                 mv "${UHTTPD_CERT}.new" "${UHTTPD_CERT}"
59         }
60 }
61
62 start_instance()
63 {
64         UHTTPD_CERT=""
65         UHTTPD_KEY=""
66
67         local cfg="$1"
68         local realm="$(uci_get system.@system[0].hostname)"
69         local listen http https interpreter indexes path handler
70
71         procd_open_instance
72         procd_set_param respawn
73         procd_set_param stderr 1
74         procd_set_param command "$UHTTPD_BIN" -f
75
76         append_arg "$cfg" home "-h"
77         append_arg "$cfg" realm "-r" "${realm:-OpenWrt}"
78         append_arg "$cfg" config "-c"
79         append_arg "$cfg" cgi_prefix "-x"
80         [ -f /usr/lib/uhttpd_lua.so ] && {
81                 config_get handler "$cfg" lua_handler
82                 [ -f "$handler" ] && append_arg "$cfg" lua_prefix "-l" && {
83                         procd_append_param command "-L" "$handler"
84                 }
85         }
86         [ -f /usr/lib/uhttpd_ubus.so ] && {
87                 append_arg "$cfg" ubus_prefix "-u"
88                 append_arg "$cfg" ubus_socket "-U"
89                 append_bool "$cfg" ubus_cors "-X" 0
90         }
91         append_arg "$cfg" script_timeout "-t"
92         append_arg "$cfg" network_timeout "-T"
93         append_arg "$cfg" http_keepalive "-k"
94         append_arg "$cfg" tcp_keepalive "-A"
95         append_arg "$cfg" error_page "-E"
96         append_arg "$cfg" max_requests "-n" 3
97         append_arg "$cfg" max_connections "-N"
98
99         append_bool "$cfg" no_ubusauth "-a" 0
100         append_bool "$cfg" no_symlinks "-S" 0
101         append_bool "$cfg" no_dirlists "-D" 0
102         append_bool "$cfg" rfc1918_filter "-R" 0
103
104         config_get alias_list "$cfg" alias
105         for alias in $alias_list; do
106                  procd_append_param command -y "$alias"
107         done
108
109         config_get http "$cfg" listen_http
110         for listen in $http; do
111                  procd_append_param command -p "$listen"
112         done
113
114         config_get interpreter "$cfg" interpreter
115         for path in $interpreter; do
116                 procd_append_param command -i "$path"
117         done
118
119         config_get indexes "$cfg" index_page
120         for path in $indexes; do
121                 procd_append_param command -I "$path"
122         done
123
124         config_get https "$cfg" listen_https
125         config_get UHTTPD_KEY  "$cfg" key  /etc/uhttpd.key
126         config_get UHTTPD_CERT "$cfg" cert /etc/uhttpd.crt
127
128         [ -f /lib/libustream-ssl.so ] && [ -n "$https" ] && {
129                 [ -s "$UHTTPD_CERT" -a -s "$UHTTPD_KEY" ] || {
130                         config_foreach generate_keys cert
131                 }
132
133                 [ -f "$UHTTPD_CERT" -a -f "$UHTTPD_KEY" ] && {
134                         append_arg "$cfg" cert "-C"
135                         append_arg "$cfg" key  "-K"
136
137                         for listen in $https; do
138                                 procd_append_param command -s "$listen"
139                         done
140                 }
141
142                 append_bool "$cfg" redirect_https "-q" 0
143         }
144
145         for file in /etc/uhttpd/*.json; do
146                 [ -s "$file" ] && procd_append_param command -H "$file"
147         done
148
149         procd_close_instance
150 }
151
152 service_triggers()
153 {
154         procd_add_reload_trigger "uhttpd"
155 }
156
157 start_service() {
158         config_load uhttpd
159         config_foreach start_instance uhttpd
160 }