globus-gsi-cert-utils-progs 8.6-2 / usr / bin / grid-cert-info

#!/bin/sh

# 
# Copyright 1999-2006 University of Chicago
# 
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# 
# http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# 

#
# globus-cert-info
#
# Easily extract information from a user's cert.
#

if test -n "${GLOBUS_LOCATION}" ; then
    prefix="${GLOBUS_LOCATION}"
else
    prefix="/usr"
fi

exec_prefix="${prefix}"
sbindir="${exec_prefix}/sbin"
bindir="${exec_prefix}/bin"
libdir="${prefix}/lib"
includedir="${prefix}/include/globus"
datarootdir="${prefix}/share"
datadir="${datarootdir}"
libexecdir="${datadir}/globus"
sysconfdir="/etc"
sharedstatedir="/var/lib"
localstatedir="/var"
aclocaldir="${datadir}/globus/aclocal"

. ${libexecdir}/globus-script-initializer

globus_source ${libexecdir}/globus-sh-tools.sh

PROGRAM_NAME=`echo $0 | ${GLOBUS_SH_SED-sed} 's|.*/||g'`

PROGRAM_VERSION=`echo '$Revision: 1.18 $'| ${GLOBUS_SH_SED-sed} -e 's|\\$||g' -e 's|Revision: \(.*\)|\1|'`

VERSION="8.6"

PACKAGE="globus_gsi_cert_utils"

DIRT_TIMESTAMP="1381426153"
DIRT_BRANCH_ID="83"

short_usage="$PROGRAM_NAME [-help] [-file certfile] [-all] [-subject] [...]"

long_usage () {
    ${GLOBUS_SH_CAT-cat} >&2 <<EOF

${short_usage}

    Displays certificate information. Unless the optional -file
    argument is given, the default location of the file containing the
    certficate is assumed:

      -- The location pointed to by the X509_USER_CERT.
      -- If X509_USER_CERT not set, $HOME/.globus/usercert.pem.

    Several options can be given: The output of
        "grid-cert-info -subject -issuer"
    is equivalent to that of
        "grid-cert-info -subject ; grid-cert-info -issuer"

    Options
      -help, -usage                Display usage
      -version                     Display version
      -file certfile     |-f       Use 'certfile' at non-default location
      -rfc2253                     Print X.509 names in RFC-2253 form


    Options determining what to print from certificate

      -all                        Whole certificate
      -subject           |-s      Subject string of the cert
      -issuer            |-i      Issuer of the cert
      -issuerhash        |-ih     Hash of the issuer name 
      -startdate         |-sd     Validity of cert: start date
      -enddate           |-ed     Validity of cert: end date

EOF
}

# See http://www-unix.globus.org/toolkit/docs/4.0/admin/docbook/ch05.html#prewsaa-env-credentials
find_default_credential()
{
    if [ -n "$X509_USER_CERT" ]; then
        echo "$X509_USER_CERT"
    elif [ -r "${HOME}/.globus/usercert.pem" ]; then
        echo "${HOME}/.globus/usercert.pem"
    elif [ -r "${HOME}/.globus/usercred.p12" ]; then
        echo "${HOME}/.globus/usercred.p12"
    else
        echo ""
    fi
}

certificate_format()
{
    testfile="$1"
    _format=''

    if test "$testfile" = ""; then
        :
    elif echo "$certfile" | grep '\.p12$' > /dev/null 2>&1 ; then
        _format=pkcs12
    elif echo "$certfile" | grep '\.pem$' > /dev/null 2>&1 ; then
        _format=x509
    elif grep -- '-----BEGIN' "$testfile" > /dev/null 2>&1 ; then
        _format="x509"
    else
        :
    fi

    echo $_format
}


globus_source $libexecdir/globus-args-parser-header $@


#SSL related needs
if test -x ${bindir}/openssl; then
    SSL_EXEC=${bindir}/openssl
else
    SSL_EXEC="openssl"
fi

if ! ${SSL_EXEC} version > /dev/null 2> /dev/null; then
    echo "Unable to locate openssl binary in $bindir or PATH" 1>&2
    exit 1
fi

# DEFault Generated Files
cert_format=x509
openssl_options=""
toprint=""

# set default location of certificate (may be overridden by --file)
#
certfile=`find_default_credential`

while [ "X$1" != "X" ]; do
    case $1 in
    -file| -f)
        if [ -n "$2" -a -f "$2" -a -r "$2" ]; then
            certfile=$2
        else
            if [ -n "$2" ]; then 
                globus_args_option_error "$1" "\"$2\" is not a valid filename"
            else
                globus_args_option_error "$1" "needs a file name argument"
            fi
        fi
        shift
        ;;
    -all)
	toprint="$toprint -text"
	;;
    -subject|-s)
	toprint="$toprint SUBJECT"
	;;
    -issuerhash|-ih)
	toprint="$toprint -issuer_hash"
	;;
    -issuer|-i)
	toprint="$toprint -issuer"
	;;
    -startdate|-sd)
	toprint="$toprint -startdate"
	;;
    -enddate|-ed)
	toprint="$toprint -enddate"
	;;
    -rfc2253)
        openssl_options='-nameopt rfc2253'
        ;;
    *)
	globus_args_unrecognized_option "$1"
	;;
    esac
    shift
done

cert_format=`certificate_format "$certfile"`
if test "$cert_format" = ""; then
    echo "Error: Cannot locate certificate" 1>&2
    exit 1;
fi

if [ "X$toprint" = "X" ]; then
    toprint="-text"
fi

if [ ! \( -f "${certfile}" -a -r "${certfile}" \) ]; then
    echo "ERROR: Cannot read certificate file ${certfile}" >&2
    exit 1
fi
 
if [ "$cert_format" = pkcs12 ]; then
    echo "Credentials are in pkcs12 format, OpenSSL will prompt for p12 password"
    cert_data="`${SSL_EXEC} pkcs12 -nokeys -clcerts -nomacver -in ${certfile}`"
    command_stub="${SSL_EXEC} x509 -noout $openssl_options"
else
    command_stub="${SSL_EXEC} x509 -noout -in ${certfile} $openssl_options"
fi


# Will probably need this...
if [ "$cert_format" = pkcs12 ]; then
    subject=`echo "$cert_data" | eval ${command_stub} -subject`
else
    subject=`eval ${command_stub} -subject`
fi

if test $? -ne 0 ; then
    exit 1
fi

subject=`echo ${subject} | ${GLOBUS_SH_SED-sed} 's%^subject=\ *%%'`

eval set -- "$toprint"
for i in "$@"; do
    case "$i" in
    -*)
	echo "$cert_data" | eval "{ ${command_stub} $i || exit $?; } | ${GLOBUS_SH_SED-sed} 's/^[a-zA-Z]*=[ ]*//'"
	;;
    SUBJECT)
	# Do not show the proxy levels
	echo "${subject}" | ${GLOBUS_SH_SED-sed} -e 's%/CN=proxy%%g' -e 's%/CN=limited proxy%%g'
	;;
    esac
done