From: Schanzenbach, Martin Date: Sun, 17 Feb 2019 21:33:17 +0000 (+0100) Subject: add openssl.cnf X-Git-Tag: v0.11.0~63^2~34 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=003606cc941a4580d787c9970193bb22e307c413;p=oweals%2Fgnunet.git add openssl.cnf --- diff --git a/src/gns/Makefile.am b/src/gns/Makefile.am index 1abc57d57..13f6a6e52 100644 --- a/src/gns/Makefile.am +++ b/src/gns/Makefile.am @@ -79,6 +79,9 @@ bin_PROGRAMS = \ noinst_PROGRAMS = \ gnunet-gns-benchmark +pkgdata_DATA = \ + openssl.cnf + if HAVE_MHD if LINUX bin_PROGRAMS += gnunet-bcd @@ -91,6 +94,15 @@ plugin_LTLIBRARIES = \ libgnunet_plugin_block_gns.la \ libgnunet_plugin_gnsrecord_gns.la +xPFX=$(pkgdatadir)/openssl.cnf + +do_subst = $(SED) -e 's,[@]PREFIX[@],${xPFX},g' + +gnunet-gns-proxy-setup-ca: gnunet-gns-proxy-setup-ca.in + $(do_subst) < $(top_srcdir)/src/gns/gnunet-gns-proxy-setup-ca.in > gnunet-gns-proxy-setup-ca + chmod +x gnunet-gns-proxy-setup-ca + + libgnunet_plugin_gnsrecord_gns_la_SOURCES = \ plugin_gnsrecord_gns.c diff --git a/src/gns/gnunet-gns-proxy-setup-ca b/src/gns/gnunet-gns-proxy-setup-ca deleted file mode 100644 index 7c1d58dc2..000000000 --- a/src/gns/gnunet-gns-proxy-setup-ca +++ /dev/null @@ -1,79 +0,0 @@ -#!/bin/sh -# This shell script will generate an X509 certificate for your gnunet-gns-proxy -# and install it (for both GNUnet and your browser). -# - -# TODO: We should sed the real paths to the binaries involved here. - -if ! which openssl > /dev/null -then - echo "'openssl' command not found. Please install it." - exit 1 -fi - - -echo "Generating CA" -options='' -while getopts "c:" opt; do - case $opt in - c) - options="$options -c $OPTARG" - ;; - \?) - echo "Invalid option: -$OPTARG" >&2 - exit 1 - ;; - :) - echo "Option -$OPTARG requires an argument." >&2 - exit 1 - ;; - esac -done - -GNSCERT=`mktemp /tmp/gnscertXXXXXX.pem` -GNSCAKY=`mktemp /tmp/gnscakeyXXXXXX.pem` -GNSCANO=`mktemp /tmp/gnscakeynoencXXXXXX.pem` -GNS_CA_CERT_PEM=`gnunet-config -s gns-proxy -o PROXY_CACERT -f $options` -mkdir -p `dirname $GNS_CA_CERT_PEM` - -openssl req -new -x509 -days 3650 -extensions v3_ca -keyout $GNSCAKY -out $GNSCERT -subj "/C=ZZ/L=World/O=GNU/OU=GNUnet/CN=GNS Proxy CA/emailAddress=bounce@gnunet.org" -passout pass:"GNU Name System" - -echo "Removing passphrase from key" -openssl rsa -passin pass:"GNU Name System" -in $GNSCAKY -out $GNSCANO - -echo "Making private key available to gnunet-gns-proxy" -cat $GNSCERT $GNSCANO > $GNS_CA_CERT_PEM - -if ! which certutil > /dev/null -then - echo "'certutil' command not found. Not importing into browsers." -else - echo "Importing CA into browsers" - for f in ~/.mozilla/firefox/*.*/ - do - if [ -d $f ]; then - echo "Importing CA info Firefox at $f" - # delete old certificate (if any) - certutil -D -n "GNS Proxy CA" -d "$f" >/dev/null 2>/dev/null - # add new certificate - certutil -A -n "GNS Proxy CA" -t CT,, -d "$f" < $GNSCERT - fi - done - - if [ -d ~/.pki/nssdb/ ]; then - echo "Importing CA into Chrome at ~/.pki/nssdb/" - # delete old certificate (if any) - certutil -D -n "GNS Proxy CA" -d ~/.pki/nssdb/ >/dev/null 2>/dev/null - # add new certificate - certutil -A -n "GNS Proxy CA" -t CT,, -d ~/.pki/nssdb/ < $GNSCERT - fi -fi - -echo "Cleaning up." -rm -f $GNSCAKY $GNSCANO $GNSCERT - -echo "===================================" -echo "You can now start gnunet-gns-proxy." -echo "Afterwards, configure your browser " -echo " to use a SOCKS proxy on port 7777." -echo "===================================" diff --git a/src/gns/gnunet-gns-proxy-setup-ca.in b/src/gns/gnunet-gns-proxy-setup-ca.in new file mode 100644 index 000000000..d3753b074 --- /dev/null +++ b/src/gns/gnunet-gns-proxy-setup-ca.in @@ -0,0 +1,79 @@ +#!/bin/sh +# This shell script will generate an X509 certificate for your gnunet-gns-proxy +# and install it (for both GNUnet and your browser). +# + +# TODO: We should sed the real paths to the binaries involved here. +OPENSSLCFG=@PREFIX@ +if ! which openssl > /dev/null +then + echo "'openssl' command not found. Please install it." + exit 1 +fi + + +echo "Generating CA" +options='' +while getopts "c:" opt; do + case $opt in + c) + options="$options -c $OPTARG" + ;; + \?) + echo "Invalid option: -$OPTARG" >&2 + exit 1 + ;; + :) + echo "Option -$OPTARG requires an argument." >&2 + exit 1 + ;; + esac +done + +GNSCERT=`mktemp /tmp/gnscertXXXXXX.pem` +GNSCAKY=`mktemp /tmp/gnscakeyXXXXXX.pem` +GNSCANO=`mktemp /tmp/gnscakeynoencXXXXXX.pem` +GNS_CA_CERT_PEM=`gnunet-config -s gns-proxy -o PROXY_CACERT -f $options` +mkdir -p `dirname $GNS_CA_CERT_PEM` + +openssl req -config $OPENSSLCFG -new -x509 -days 3650 -extensions v3_ca -keyout $GNSCAKY -out $GNSCERT -subj "/C=ZZ/L=World/O=GNU/OU=GNUnet/CN=GNS Proxy CA/emailAddress=bounce@gnunet.org" -passout pass:"GNU Name System" + +echo "Removing passphrase from key" +openssl rsa -passin pass:"GNU Name System" -in $GNSCAKY -out $GNSCANO + +echo "Making private key available to gnunet-gns-proxy" +cat $GNSCERT $GNSCANO > $GNS_CA_CERT_PEM + +if ! which certutil > /dev/null +then + echo "'certutil' command not found. Not importing into browsers." +else + echo "Importing CA into browsers" + for f in ~/.mozilla/firefox/*.*/ + do + if [ -d $f ]; then + echo "Importing CA info Firefox at $f" + # delete old certificate (if any) + certutil -D -n "GNS Proxy CA" -d "$f" >/dev/null 2>/dev/null + # add new certificate + certutil -A -n "GNS Proxy CA" -t CT,, -d "$f" < $GNSCERT + fi + done + + if [ -d ~/.pki/nssdb/ ]; then + echo "Importing CA into Chrome at ~/.pki/nssdb/" + # delete old certificate (if any) + certutil -D -n "GNS Proxy CA" -d ~/.pki/nssdb/ >/dev/null 2>/dev/null + # add new certificate + certutil -A -n "GNS Proxy CA" -t CT,, -d ~/.pki/nssdb/ < $GNSCERT + fi +fi + +echo "Cleaning up." +rm -f $GNSCAKY $GNSCANO $GNSCERT + +echo "===================================" +echo "You can now start gnunet-gns-proxy." +echo "Afterwards, configure your browser " +echo " to use a SOCKS proxy on port 7777." +echo "===================================" diff --git a/src/gns/openssl.cnf b/src/gns/openssl.cnf new file mode 100644 index 000000000..503460f9f --- /dev/null +++ b/src/gns/openssl.cnf @@ -0,0 +1,245 @@ +# +# OpenSSL example configuration file. +# This is mostly being used for generation of certificate requests. +# + +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . +RANDFILE = $ENV::HOME/.rnd + +# Extra OBJECT IDENTIFIER info: +#oid_file = $ENV::HOME/.oid +oid_section = new_oids + +# To use this configuration file with the "-extfile" option of the +# "openssl x509" utility, name here the section containing the +# X.509v3 extensions to use: +# extensions = +# (Alternatively, use a configuration file that has only +# X.509v3 extensions in its main [= default] section.) + +[ new_oids ] + +# We can add new OIDs in here for use by 'ca' and 'req'. +# Add a simple OID like this: +# testoid1=1.2.3.4 +# Or use config file substitution like this: +# testoid2=${testoid1}.5.6 + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = ./demoCA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +new_certs_dir = $dir/newcerts # default place for new certs. + +certificate = $dir/cacert.pem # The CA certificate +serial = $dir/serial # The current serial number +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/cakey.pem# The private key +RANDFILE = $dir/private/.rand # private random number file + +x509_extensions = usr_cert # The extentions to add to the cert + +# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs +# so this is commented out by default to leave a V1 CRL. +# crl_extensions = crl_ext + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = md5 # which md to use. +preserve = no # keep passed DN ordering + +# A few difference way of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that :-) +policy = policy_match + +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +default_bits = 1024 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca # The extentions to add to the self signed cert + +# Passwords for private keys if not present they will be prompted for +# input_password = secret +# output_password = secret + +# This sets a mask for permitted string types. There are several options. +# default: PrintableString, T61String, BMPString. +# pkix : PrintableString, BMPString. +# utf8only: only UTF8Strings. +# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). +# MASK:XXXX a literal mask value. +# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings +# so use this option with caution! +string_mask = nombstr + +# req_extensions = v3_req # The extensions to add to a certificate request + +[ req_distinguished_name ] +countryName = Country Name (2 letter code) +countryName_default = AU +countryName_min = 2 +countryName_max = 2 + +stateOrProvinceName = State or Province Name (full name) +stateOrProvinceName_default = Some-State + +localityName = Locality Name (eg, city) + +0.organizationName = Organization Name (eg, company) +0.organizationName_default = Internet Widgits Pty Ltd + +# we can do this but it is not needed normally :-) +#1.organizationName = Second Organization Name (eg, company) +#1.organizationName_default = World Wide Web Pty Ltd + +organizationalUnitName = Organizational Unit Name (eg, section) +#organizationalUnitName_default = + +commonName = Common Name (eg, YOUR name) +commonName_max = 64 + +emailAddress = Email Address +emailAddress_max = 40 + +# SET-ex3 = SET extension number 3 + +[ req_attributes ] +challengePassword = A challenge password +challengePassword_min = 4 +challengePassword_max = 20 + +unstructuredName = An optional company name + +[ usr_cert ] + +# These extensions are added when 'ca' signs a request. + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# Here are some examples of the usage of nsCertType. If it is omitted +# the certificate can be used for anything *except* object signing. + +# This is OK for an SSL server. +# nsCertType = server + +# For an object signing certificate this would be used. +# nsCertType = objsign + +# For normal client use this is typical +# nsCertType = client, email + +# and for everything including object signing: +# nsCertType = client, email, objsign + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# This will be displayed in Netscape's comment listbox. +nsComment = "OpenSSL Generated Certificate" + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer:always + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy + +# Copy subject details +# issuerAltName=issuer:copy + +#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem +#nsBaseUrl +#nsRevocationUrl +#nsRenewalUrl +#nsCaPolicyUrl +#nsSslServerName + +[ v3_req ] + +# Extensions to add to a certificate request + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +[ v3_ca ] + + +# Extensions for a typical CA + + +# PKIX recommendation. + +subjectKeyIdentifier=hash + +authorityKeyIdentifier=keyid:always,issuer:always + +# This is what PKIX recommends but some broken software chokes on critical +# extensions. +#basicConstraints = critical,CA:true +# So we do this instead. +basicConstraints = CA:true + +# Key usage: this is typical for a CA certificate. However since it will +# prevent it being used as an test self-signed certificate it is best +# left out by default. +# keyUsage = cRLSign, keyCertSign + +# Some might want this also +# nsCertType = sslCA, emailCA + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF + +[ crl_ext ] + +# CRL extensions. +# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. + +# issuerAltName=issuer:copy +authorityKeyIdentifier=keyid:always,issuer:always +