ldap-utils.lib

Perl写的CA认证程序

#!/usr/bin/perl

## RA Server Management Utility 
## (c) 1999 by Massimiliano Pala
## All Rights Reserved
##
## Project Information:
##
## 	Current Version ..................... $VER
##      Project Started on .................. 17/12/1998
##      Last Modified on .................... 30/03/2001
##      Project Closed on ................... n/a
##
## Program currently tested with OpenLDAP v.1.2 on Linux, Solaris
## and Sleepycat DB.
##
## DISC CLAIMER: THIS SOFTWARE IS GIVEN AS IS WITHOUT ANY WARRANTIES
## ABOUT ANY DAMAGE DERIVED BY THE USE ( CORRECT OR NOT ) OF THIS
## SOFTWARE. THE AUTHOR IS THEREFORE NOT RESPONSABLE IN ANY WAY OF
## DAMAGES RELATED IN ANY WAY TO THIS OR SUPPORTED SOFTWARE AS WELL.
##
## If you want to contact me (the author) please use the e-mail
## addresses listed below. Do not esitate in reporting bugs, enhancement
## or anything seems useful in developing this software:
##
##	[e-mail]
##	[e-mail]
##	[e-mail]
##

## Thank you for using this software, and remember that Open Projects
## are the future of mankind. Do not sleep, partecipate to world wide
## efforts to make life easier for all!

sub addCertsUsers {
  my @keys = @_;

  ## Reserved Variables
  my ( @certsList );
  my ( $filename, $tmp, $ID, $cert, $ldap, $ret );

  ## Get Required parameter
  my $serverDir = getRequired( 'ServerDir' );

  ## Debugging info
  my $DEBUG = 0;

  ## This file has the latest imported certificate's serials
  $filename = "$serverDir/stuff/lastImport.txt";

  ## Let's open the stuff/lastImport.txt
  if( not -e "$filename" ) {
    configError( "File $filename not found!");
  }

  $tmp = $query->getFile( "$filename");

  if( $tmp eq "" ) {
    success( "Last Import file was empty.");
  }

  my @certsList = split( "\n", $tmp );

  my $table = $query->buildRefs ( ELEMENTS =>, MAXITEMS =>);
  my $table .= $query->startTable (COLS=>[ "Cert.-No.",
                                          "DN",
                                          "adding dn",
                                          "adding certificate" ],
                              WIDTH=>"100%",
                              TITLE_BGCOLOR=>"#DDCCFF");

  foreach $ID (@certsList) {

    my @line = ();

    my ( $filter, $serID, $parsed, $ret, $entry );
    ( $serID ) = ( $ID =~ /([a-f0-9]+)/i );

    ## Let's be sure it is in the right format
    $serID = uc( $serID );
    $serID = "0$serID" if( length($serID) % 2 );

    my $cert = $db->getItem ( DATATYPE => VALID_CERTIFICATE,
                              KEY => $serID );

    if( not $cert ) {
      $table .= $query->addTableLine( DATA => [
                    "<FONT COLOR=\"Red\">".
                    "ERROR [$serID] : can't get certificate" .
                    " from dB!\n</FONT>" ] );
      next;
    }

    $parsed = $cert->getParsed();

    push ( @line, $serID, $parsed->{DN});
    $ret = addLDAPobject ( CERTIFICATE=>$cert );

    my $text;
    $text .= "<FONT COLOR=\"Red\">" if ( not $ret->{STATUS} );
    $text .= $ret->{DESC};
    $text .= "</FONT>" if ( not $ret->{STATUS} );
    push ( @line, $text);

    if( $ret->{STATUS} ) {
      $ret = addLDAPattribute ( CERTIFICATE => $cert , NOPRINT => true);

      if ($ret->{STATUS}) {
        push (@line, "success");
      } else {
        push (@line, "Error : ".$ret->{CODE});
      }
    } else {
      push (@line, "operation not performed");
    }

    $table .= $query->addTableLine ( DATA => [ @line ]);

  }

  $table .= $query->endTable;
  print $table;

  return "Ok.";
}

sub addLDAPobject {

  ######################################################
  ## only certs makes sense because a CRL can only be ##
  ## produced if a valid CA-cert exists               ##
  ######################################################

  my $keys = { @_ };
  local ( $obj, $parsed, $serID, $ldap, $ret, $dn, $cn, $sn, $email );

  my $DEBUG = 0;

  ## check the type of the attribute
  $obj   = $keys->{CERTIFICATE};
  return if ( not $obj );

  ## get the needed data
  my $cert_dn    = $obj->getParsed ()->{DN};
  my $cert_cn    = $obj->getParsed ()->{CN};
  my $cert_serID = $obj->getParsed ()->{SERIAL};
  my $cert_email = $obj->getParsed ()->{EMAIL};
  my $cert_ou    = $obj->getParsed ()->{OU};
  my $cert_o     = $obj->getParsed ()->{O};
  my $cert_l     = $obj->getParsed ()->{L};
  my $cert_st    = $obj->getParsed ()->{ST};

  ## debugging
  print "Information of the Object:<br>\n" if ($DEBUG);
  print "dn    ".$cert_dn."<br>\n" if ($DEBUG);
  print "cn    ".$cert_cn."<br>\n" if ($DEBUG);
  print "serID ".$cert_serID."<br>\n" if ($DEBUG);
  print "email ".$cert_email."<br>\n" if ($DEBUG);
  print "ou    ".$cert_ou."<br>\n" if ($DEBUG);
  print "o     ".$cert_o."<br>\n" if ($DEBUG);
  print "l     ".$cert_l."<br>\n" if ($DEBUG);
  print "st    ".$cert_st."<br>\n" if ($DEBUG);
  print "End of the information of the Object.<br>\n" if ($DEBUG);

  ## here we could perform some operations with the data
  ## sn is not the real sn sometimes but you can find
  ## the person via a search with a wildcard
  my $cert_sn = $cert_cn;
  $cert_sn =~ s/^[^ ]* //;
  my $ou_counter = 0;
  my @ou_array   = ();

  ## Get the Connection to the Server
  if ( not ( $ldap = LDAP_connect() )) {
    print "<FONT COLOR=\"Red\">";
    print "LDAP [$serID]: Connection Refused by server!\n";
    print "</FONT><BR>\n";

    return;
  };

  ## Let's bind for a predetermined User
  $ret = LDAP_bind( LDAP => $ldap );
  if( not $ret->{STATUS} ) {
    print "Failed in Bind: " . $ret->{CODE} . "\n";
    LDAP_disconnect( LDAP => $ldap );
    return $ret->{CODE};
  };

  ## build the array from the LDAP root
  my $basedn = getRequired ('basedn');
  my @basedn_array = ();
  my $h_attribute;
  while ($basedn) {
    ## get the last element
    $h_attribute = $basedn;
    $basedn =~ s/^[^,]*,//;
    $h_attribute = substr ($h_attribute, 
                           0, 
                           length ($h_attribute) - length ($basedn));
    if ( not $h_attribute ) {
      $h_attribute = $basedn;
      $basedn = "";
    }
    $h_attribute =~ s/,//;
    $h_attribute =~ s/(^ )|( $)//g;
    print "element of baseDN: ".$h_attribute."<br>\n" if ($DEBUG);
    if ($h_attribute =~ /^\s*ou\s*=.*$/i) {
      $ou_array [$ou_counter] = $h_attribute;
      $ou_array [$ou_counter] =~ s/^\s*ou\s*=\s*//i;
      $ou_counter++;
    }
    push (@basedn_array, $h_attribute);
  }

  ## build the array from the DN
  my $h_dn = $cert_dn;
  my @dn_array = ();
  my $h_attribute;
  while ($h_dn) {
    ## get the last element
    $h_attribute = $h_dn;
    $h_dn =~ s/^[^\/,]*\///;
    $h_attribute = substr ($h_attribute, 
                           0, 
                           length ($h_attribute) - length ($h_dn));
    if ( not $h_attribute ) {
      $h_attribute = $h_dn;
      $h_dn = "";
    }
    $h_attribute =~ s/\///;
    $h_attribute =~ s/(^ )|( $)//g;
    print "element of the inserted DN: ".$h_attribute."<br>\n" if ($DEBUG);
    push (@dn_array, $h_attribute);
  }

  ## verify that the root in the DN is ok
  print "Checking RootDN of Certificate ...<br>\n" if ($DEBUG);
  print "Inserted DN\t\t\tBaseDN<br>\n" if ($DEBUG);
  while (scalar (@basedn_array) and scalar (@dn_array)) {
    my $h_basedn = pop (@basedn_array);
    my $h_dn     = pop (@dn_array);
    print $h_dn."\t\t".$h_basedn."<br>\n" if ($DEBUG);
    ## this dn cannot be added under the root-dn
    if ( (uc $h_basedn) ne (uc $h_dn) ) {
      LDAP_disconnect ( $ldap );
      return { STATUS => 0 , 
               DESC => "Error ( dn conflicts with basedn )",
               CODE => -1 };
    }
  }
  ## dn which should be inserted is shorter then the root-dn
  print "Checking the length of the DN of the Certificate ...<br>\n" if ($DEBUG);
  if ( scalar (@basedn_array) ) {
    LDAP_disconnect ( $ldap );
    return { STATUS => 0 , 
             DESC => "Error ( dn is shorter then basedn )",
             CODE => -2 };
  }
  ## if dn == basedn then their is no error because this can 
  ## be the CA-dn
  return { STATUS => 1, CODE => 0, DESC => "Success" }
    if (!scalar (@dn_array));

  ## setup the tree for the DN
  ## attention only the last ldapadd must be successful !!!
  print "Building the missing nodes of the LDAP-tree ...<br>\n" if ($DEBUG);
  my $add_dn = getRequired ('basedn');
  my $actual_element;
  my $use_ldap_add = 0;
  while (scalar (@dn_array)) {
    $actual_element = pop @dn_array;
    if ($actual_element =~ /^\s*ou\s*=.*$/i) {
      $ou_array [$ou_counter] = $actual_element;
      $ou_array [$ou_counter] =~ s/^\s*ou\s*=\s*//i;
      $ou_counter++;
    }

    ## prepare the needed strings
    $add_dn = $actual_element.",".$add_dn;
    print "Try to add $add_dn ...<br>\n" if ($DEBUG);

    ## check that the entry not exist in the LDAP-tree
    my $base          = $add_dn;
    #$base             =~ s/^[^,]*,//;
    my $search_filter = $add_dn;
    $search_filter    =~ s/,.*$//g;
    $search_filter    =~ s/^email=/mail=/i;
    $search_filter    = "(".$search_filter.")";
    print "LDAP Searchfilter: ".$search_filter."<br>\n" if ($DEBUG);
    print "LDAP Base: ".$base."<br>\n" if ($DEBUG);
    my $ldap_search_mesg = $ldap->search (
                             base => $base,
                             scope => "sub",
                             filter => $search_filter);
    print "LDAP Search Mesg-Code ".$ldap_search_mesg->code."<br>\n" if ($DEBUG);
    print "LDAP Search Mesg-Count ".$ldap_search_mesg->count."<br>\n" if ($DEBUG);
    ## I stop the insertion because of a searcherror too
    if ( not $ldap_search_mesg or 
         #$ldap_search_mesg->code or
         $ldap_search_mesg->count) {
      ## node/leaf exists
      print "node exists<br>\n" if ($DEBUG);
      next;
    }
    $use_ldap_add = 1;

    ## insert the different types
    ## attention: I don't insert here a CA!!!
    ## this most be done otherwise because I cannot declare
    ## any o and ou to be a (sub)CA
    my @attr;
    if ($add_dn =~ /^\s*(cn|email|serialNumber)\s*=.*$/i) {
      return undef if (not $cert_sn or not $cert_cn);
      push @attr, 'cn' => $cert_cn;
      push @attr, 'sn' => $cert_sn;
      push @attr, 'objectclass' => [ 'top',
                                     'person',
                                     'organizationalPerson',
                                     'inetOrgPerson' 
                                   ];
      push @attr, 'ou'   => [ @ou_array ] if (scalar @ou_array);
      push @attr, 'o'    => $cert_o       if ($cert_o);
      push @attr, 'mail' => $cert_email   if ($cert_email);
      push @attr, 'st'   => $cert_st      if ($cert_st and $add_dn =~ /\s*st\s*=/i);